joyce8/EMBER2024-capa huggingface dataset:
Function at 0x57ffd2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x62f570]
jne 0x57ffdc
repz ret
jmp fcn.0058fa47

Function at 0x58752b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x58755c
call fcn.005877cf
mov dword [eax], esi
call fcn.005877bc
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.005807b2
add esp, 0x14
push 0x16
pop eax
jmp 0x5875b1
test dword [ebp + 0xc], 0xfffffff9
jne 0x587538
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x587589
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.005877e2
pop ecx
call fcn.005877bc
mov eax, dword [eax]
jmp 0x5875b1
test al, 0x10
jne 0x5875af
test al, 1
je 0x5875af
test byte [ebp + 0xc], 2
je 0x5875af
call fcn.005877cf
mov dword [eax], 5
call fcn.005877bc
mov dword [eax], 0xd
jmp 0x587580
xor eax, eax
pop esi
pop ebp
ret

Function at 0x587b65
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x587b96
call fcn.005877cf
mov dword [eax], esi
call fcn.005877bc
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.005807b2
add esp, 0x14
or eax, 0xffffffff
jmp 0x587bd1
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x587bb3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.005877e2
pop ecx
jmp 0x587b91
test byte [ebp + 0xc], 0x80
je 0x587bbe
and eax, 0xfffffffe
jmp 0x587bc1
or eax, 1
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x587ba4
xor eax, eax
pop esi
pop ebp
ret
Function at 0x5a7b6f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0058f321
and dword [ebp - 4], 0
cmp dword [0x638074], 0
mov ebx, eax
jne 0x5a7c20
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x5a7cd1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x5a7cd1
push eax
call fcn.0058f2af
mov dword [esp], 0x5d5d50
push edi
mov dword [0x638074], eax
call esi
push eax
call fcn.0058f2af
mov dword [esp], 0x5d5d3c
push edi
mov dword [0x638078], eax
call esi
push eax
call fcn.0058f2af
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x63807c], eax
call esi
push eax
call fcn.0058f2af
pop ecx
mov dword [0x638084], eax
test eax, eax
je 0x5a7c20
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0058f2af
pop ecx
mov dword [0x638080], eax
mov eax, dword [0x638080]
cmp eax, ebx
je 0x5a7c78
cmp dword [0x638084], ebx
je 0x5a7c78
push eax
call fcn.0058f32a
push dword [0x638084]
mov esi, eax
call fcn.0058f32a
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x5a7c78
test edi, edi
je 0x5a7c78
call esi
test eax, eax
je 0x5a7c6f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x5a7c6f
test byte [ebp - 0xc], 1
jne 0x5a7c78
or dword [ebp + 0x10], 0x200000
jmp 0x5a7cb1
mov eax, dword [0x638078]
cmp eax, ebx
je 0x5a7cb1
push eax
call fcn.0058f32a
pop ecx
test eax, eax
je 0x5a7cb1
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x5a7cb1
mov eax, dword [0x63807c]
cmp eax, ebx
je 0x5a7cb1
push eax
call fcn.0058f32a
pop ecx
test eax, eax
je 0x5a7cb1
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x638074]
call fcn.0058f32a
pop ecx
test eax, eax
je 0x5a7cd1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x5a7cd3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x543657
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
not dl
jmp 0x543699
bsr bx, di
xchg word [esp], bx
xchg byte [esp + 3], bl
lea esp, [esp + 2]
jmp 0x543712
bsr bx, di
xchg word [esp], bx
xchg byte [esp + 3], bl
jmp 0x543783
xchg bh, ah
lea ebx, [esp + edi]
setle bl
sub esp, 0xa
jp 0x54365f
jnp 0x543683
mov al, 0x21
lea ebx, [ebp - 0xcb]
mov ebx, 0xce6546c2
jmp 0x5436ee
mov al, 0x21
lea ebx, [ebp - 0xcb]
mov ebx, 0xce6546c2
lea ebx, [ebx*4]
bswap ebx
inc dl
xchg bx, ax
jmp 0x5436f9
lea ebx, [ebx*4]
bswap ebx
jmp 0x5436d4
lea ebx, [ecx + edi]
ror bl, 0
jge 0x54373f
mov ax, word [esp]
jmp 0x54371e
lea esp, [esp + 8]
xor dl, 0x54
cmc
jns 0x5436be
js 0x5436a8
bsr ebx, eax
cmc
not ax
jmp 0x54374a
add dl, 0xe2
mov ebx, 0x9b131133
call fcn.00543762
jge 0x543734
insb byte es:[edi], dx
or eax, dword [esi]
call 0xc3960d8d
jp 0x5437a6
mov ax, word [esp]
mov eax, dword [esp]
bsr ebx, eax
cmc
not ax
jmp 0x543727
lea esp, [esp + 2]
jmp 0x543712
jge 0x5437d0
lodsd eax, dword [esi]
add ebp, ebx
sub byte [ebp - 0x7cdfdb9c], cl
in al, dx
adc ecx, dword [ebp + reloc.KERNEL32.dll_CloseHandle]
add byte [eax], al
lea ebx, reloc.KERNEL32.dll_CloseHandle
jmp 0x543a17
jge 0x5437fa
lodsd eax, dword [esi]
add ebp, ebx
mov bl, 0x8a
mov bl, byte [esp]
pushal
setno bh
sub esp, 7
neg bh
jmp 0x543818
add dh, ch
adc byte [ebx + 0x47d4a50a], dl
neg bl
lea edi, [edi + 0x54]
call fcn.00543844
popfd
push ds
mov ebx, gs
enter 0xfffffffffffff6ef, 0xffffffffffffffe1
and byte [ebx - 0x66], ah
lea esp, [esp + 3]
xchg dword [esp + 0x24], edi
lea ebx, [eax + ebp]
sete bh
mov ebx, dword [esp]
mov bh, byte [esp]
jmp 0x543802
push word [esp + 0xf]

Function at 0x543762
Capabilities:
Execute anti-debugging instructions

Disassembly:
not dl
mov ax, 0x8a24
bswap eax
lea ebx, [ecx*4]
jmp 0x54376a
pop eax
pushal
lea esp, [esp + 0x20]
jmp 0x54374c
xchg ebx, eax
mov eax, edx
neg bl
jns 0x5437c9
js 0x54379f
retf 0xd84a
pushal
shl eax, 2
js 0x5437ac
lea esp, [esp + 0x20]
call fcn.005437d6
xchg ecx, eax
lahf
out 0x11, al
nop
adc ecx, dword [edx + reloc.KERNEL32.dll_CloseHandle]
jmp 0x28d1fb29
stc
mov bx, 0xe938
add ebx, 0x3ad287d
jmp 0x5437d4
lea esp, [esp + 0x20]
sub esp, 0x13
lea ebx, [ebp*4]
stc
mov bx, 0xe938
add ebx, 0x3ad287d
jmp 0x543789

Function at 0x543844
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bx, sp
bt bx, ax
call fcn.00543c33
inc esp
div dword [ebp - 0x1b]
invalid
bsr ebx, ebx
mov ebx, eax
xchg dword [esp + 0x28], edi
mov ebx, edx
jmp 0x54382e
Function at 0x544e04
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x5637c6
jo 0x544d90
jno 0x544d90
fistp word [esi - 0x34]
stosd dword es:[edi], eax
test byte [edi], ch
and dword ss:[eax - 0x5d], esp
fiadd dword [edi - 0x72191426]
out 0x8d, al
lea esp, [esp + 8]
and al, 8
inc ebp
lea edx, reloc.KERNEL32.dll_CloseHandle
mov edx, 0xe81c6d62
mov edx, 0xaee32659
jmp 0x544da8
jmp 0x544d74
add ebp, dword [esi]
xchg dx, ax
call fcn.00544d92
sbb eax, 0xa7540d9d
inc ebx
insd dword es:[edi], dx
out dx, al
jl 0x544dd7
neg byte [eax]
jg 0x544e06
int1
lea esp, [esp + 2]
push dword [esp + 0x18]
ret 0x1c
movzx ebx, byte [ebp]
call fcn.00544de4
bnd jb 0x544db8
loopne 0x544d60
xchg dword [edx - 0x68], esi
jb 0x544d73
invalid
jmp 0x544dcc
bsr bx, di
call 0x544dc1
jmp 0x544e60
mov ebp, 0x3acfa83a
mov ebp, 0xea8f1f9b
sbb ecx, eax
jo 0x544dfb
xor dword [eax - 0x62], reloc.KERNEL32.dll_CloseHandle
call 0x544e04
int 0x53
ret
add bl, cl
or dh, ah
jp 0x544ea7
rdtsc
inc dh
rcl dx, 6
jmp 0x544ec1
xchg word [esp + 1], dx
xchg word [esp + 1], ax
jmp 0x544e4a
inc dh
rcl dx, 6
jmp 0x544ec1
rdtsc
jmp 0x544e91
jmp 0x544f15
mov al, bl
mov dh, dl
lea edx, [ecx*4]
bsf edx, esp
jge 0x544eab
lea edx, reloc.KERNEL32.dll_CloseHandle
adc eax, 0x86fd674c
mov dl, byte [esp]
inc dx
jmp 0x544eff
xor al, 0x68
mov dx, 0xc1c7
mov dx, sp
bswap edx
mov edx, ecx
jmp 0x544f38
lea edx, reloc.KERNEL32.dll_CloseHandle
mov dl, byte [esp]
inc dx
jmp 0x544eff
bsf edx, eax
dec dh
mov edx, dword [esp]
sete dh
ror edx, cl
push ebx
jmp 0x544f99
mov edx, 0xb2a9a14f
sub al, 0x76
ror dl, cl
jo 0x544f22
jno 0x5450aa
cld
jl 0x544f5e
jne 0x544ed2
outsb dx, byte [esi]
leave
push 0x865d228b
fsubr st(0)
xchg edx, eax
invalid
pop word [esp]
lea esp, [esp + 2]
ror al, 0
mov dh, 0x26
lea edx, [ebx*4]
call fcn.00544f5b
hlt
sete dh
ror edx, cl
jmp 0x544f2f
bsf edx, eax
dec dh
mov edx, dword [esp]
jmp 0x54503c
mov al, 0xea
jmp 0x5637d0
mov al, 0x2b
lea ebx, reloc.KERNEL32.dll_CloseHandle
jmp 0x5637b0
lea edx, [edi + 0x50]
mov ah, byte [esp]
lea eax, [ebx + esi]
xchg al, bh
jmp 0x56380e
jmp 0x56383b
cmp esi, edx
ja 0x544de2
shr al, 2
jnp 0x5637f8
lea eax, [edi*4]
setle dl
neg dh
jmp 0x563940
lea eax, [edi*4]
setle dl
neg dh
jmp 0x563940
lea ebx, [edi + 0x40]
mov eax, dword [esp]
mov ah, al
push esp
call fcn.00563863
jmp 0x56391d
lea esp, [esp + 1]
jmp 0x563fff
and al, 0xfc
call fcn.005638ef
jl 0x5638f8
lea esp, [esp + 1]
jmp 0x563fff
mov edx, edi
mov ebx, 0x69e83516
mov ebx, ecx
push sp
lea esp, [esp + 2]
jmp 0x5638df
pushal
mov dword [esp + 0x18], ebx
popal
jmp 0x56396e
push ecx
mov esi, edx
mov edi, eax
jmp 0x563951
cld
rep movsb byte es:[edi], byte [esi]
pop ecx
jmp 0x563990
lea edi, [eax + ebx - 0x40]
push esi
push edi
jmp 0x563967
pop edi
pop esi
popfd
jmp fcn.0054593d
mov dword [esp + 1], eax
jmp 0x563de7
mov dword [esp + 1], eax
mov esp, eax
pushfd
jmp 0x563988
sub eax, ebx
pushfd
push dword [esp + 2]
jae 0x563de3
jb 0x5639b9
Function at 0x589911
Capabilities:
Encrypt data using aes

Disassembly:
shl edx, 8
jmp 0x5898ff
movzx esi, byte [eax + 0xb]
sub esp, 0x1f
btc ebp, esi
mov ebp, 0x898ae62d
lea esp, [esp + 3]
jmp 0x5898b0
xchg bh, bl
mov bp, word [esp]
cmc
jmp 0x5898c6
push edx
jmp 0x58990a
xor edx, esi
mov dword [ecx + 8], edx
movzx edx, byte [eax + 0xc]
jmp 0x5898e9
pushal
call 0x589911
sbb dh, byte [ebp - 0x762e745b]
inc esp
and al, 0x18
lea esp, [esp + 4]
jmp 0x58996a
movzx esi, byte [eax + 0xe]
jmp 0x5899d2
shl edx, 8
xor edx, esi
jmp 0x58993b
popal
lea edx, [edx + 0xd]
movzx esi, byte [edx]
pop edx
jmp 0x589951
mov esi, 0xff
jmp 0x5899ac
mov eax, edx
shr eax, 0x10
jmp 0x589974
shl edx, 8
xor edx, eax
mov dword [ecx + 0xc], edx
jmp 0x58998a
and eax, esi
mov eax, dword [eax*4 + reloc.KERNEL32.dll_CloseHandle]
lea esp, [esp + 0x54]
jmp 0x5899f3
and edi, esi
dec ebx
jmp 0x5899dd
movzx eax, byte [eax + 0xf]
shl edx, 8
xor edx, esi
jmp 0x5899a2
mov edi, dword [edi*4 + reloc.KERNEL32.dll_CloseHandle]
jmp 0x589a19
xor eax, 0x1000000
mov edi, edx
shr edi, 8
btr bx, bp
jmp 0x5899bb
and edi, 0xff0000
call fcn.00589a03
push edi
mov edi, ecx
add edi, 4
jmp 0x589a56
lea esp, [esp + 0xc]
and eax, 0xff000000
jmp 0x589a67
mov ebx, dword [edi]
pop edi
mov ebp, edi
mov bp, si
sub esp, 0xf
lea esp, [esp + 3]
jmp 0x589a2c
xor eax, edi
mov edi, edx
pushal
jmp 0x589abe
shr edi, 0x18
call fcn.00589a95
mov ebp, 0xff00
jmp 0x589b16
or edi, 0x792fbd50
jmp 0x589b38
lea esp, [esp + 0x24]
xor eax, dword [ecx]
inc edi
lea edi, [ebp*4]
jmp 0x589ae8
and edi, ebp
xor eax, edi
mov di, word [esp]
mov edi, ecx
jmp 0x589afe
mov eax, dword [ecx + 8]
jmp 0x589bb2
lea edi, [ecx + 0x10]
xor ebx, eax
mov dword [edi], eax
jmp 0x589b22
xor edx, eax
not ebx
mov ah, byte [esp]
jmp 0x589b94
mov dword [ecx + 0x18], eax
bsf ebx, ecx
mov bx, 0x2577
not bl
jmp 0x589b6a
mov dword [ecx + 0x1c], edx
xchg dx, ax
neg cx
rcl cx, 0xc
call fcn.00589c24
outsd dx, dword [esi]
in eax, dx
jge 0x589bad
neg dword [edi]
jg 0x589bab
insb byte es:[edi], dx
or eax, dword [esi]
in al, 0x4f
xor eax, ebx
mov dword [ecx + 0x14], ebx
push dx
sub esp, 0x1e
jmp 0x589b86
Function at 0x589c24
Capabilities:
Encrypt data using aes

Disassembly:
mov eax, edi
bt edi, edx
jmp 0x589bd4
add ecx, 0xc
mov edx, dword [ecx]
pop ecx
bswap ecx
xchg cx, di
jmp 0x589bdd
mov dx, word [esp]
push ecx
mov ecx, eax
jmp 0x589bbe
mov ecx, edx
mov edi, 0xb0ed8bf7
jmp 0x589c04
mov ebx, 0x53e958
lea esp, [esp + 0x24]
jmp 0x52dd1b
shr ecx, 8
bsf edi, ebp
bsr di, dx
mov edi, edx
jmp 0x589c50
jmp 0x589bf6
sub esp, 3
lea esp, [esp + 3]
and ecx, esi
sub esp, 0x1d
call fcn.00589c26
mov edi, dword [edi*4 + reloc.KERNEL32.dll_CloseHandle]
jmp 0x589c84
lea esp, [esp + 0x20]
and ecx, 0xff0000
jmp 0x58a11e
shr edi, 0x18
movzx edi, byte [edi*4 + 0x53d154]
xor ecx, edi
neg edi
jmp 0x589f3d
mov edi, edx
and edx, esi
mov edx, dword [edx*4 + reloc.KERNEL32.dll_CloseHandle]
jmp 0x589caf
add ebx, 4
setbe dl
mov dh, byte [esp]
jmp 0x589d7b
mov dl, byte [esp]
mov dx, 0x43b7
xor ecx, dword [eax]
inc dl
jmp 0x589cdf
xor edx, ecx
mov ch, dh
mov ecx, dword [esp]
lea ecx, [ecx*4]
mov dword [eax + 0x14], edx
jmp 0x589d55
mov ebp, eax
add ebp, 8
mov ecx, dword [ebp]
pop ebp
pushal
jmp 0x589d3f
bts dx, dx
bswap edx
mov dx, word [esp]
mov edx, dword [eax + 4]
jmp 0x589d04
xor ecx, edx
mov dx, bp
mov dx, 0x422b
jmp 0x589d60
xchg ch, cl
mov ecx, eax
bsr cx, di
push ebp
jmp 0x589d17
mov dword [eax + 0x18], ecx
mov edx, dword [eax + 0xc]
jmp 0x589d83
push edx
mov edx, edi
mov dword [edx], ecx
pop edx
jmp 0x589d30
xor edx, ecx
pushfd
stc
mov dword [eax + 0x1c], edx
jmp 0x589d90
clc
lea esp, [esp + 0x24]
cmp ebx, 0x53e97c
jmp 0x589e1a
xor ecx, edx
xor ecx, dword [ebx]
lea edi, [eax + 0x10]
mov edx, eax
jmp 0x589cf7
lea esp, [esp + 4]
pop edi
bswap ebp
jmp 0x589dfa
mov eax, dword [esp]
setae bh
mov bp, ax
mov esi, 0xe83a9aa1
mov bh, 0x81
jmp 0x589dbc
xchg bl, bh
mov bl, byte [esp]
pushal
lea ebx, reloc.KERNEL32.dll_CloseHandle
jmp 0x589e04
pop esi
xchg bx, bp
mov bx, cx
pop ebp
jmp 0x589de4
lea esp, [esp + 0x20]
pop ebx
ret
jne 0x52dd1b
mov eax, dword [esp]
push 0xa
mov di, word [esp]
jmp 0x589dd2
and edx, ebp
btr edi, ecx
mov di, word [esp]
bts di, di
jmp 0x589dae
and edi, 0xff000000
xor ecx, edi
mov di, word [esp]
jmp 0x589cd2

Function at 0x589c26
Capabilities:
Encrypt data using aes

Disassembly:
mov byte [esp + 0x16], dl
jmp 0x589c30
lea esp, [esp + 1]
mov ecx, dword [ecx*4 + reloc.KERNEL32.dll_CloseHandle]
jmp 0x589c77
shr edi, 0x10
and edi, esi
push cx
lea esp, [esp + 2]
jmp 0x589c61

Function at 0x58a071
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
add esp, 1
not edi
lea esp, [esp + 3]
jmp 0x58a0b2
add esi, 0x10
mov dh, byte [esp]
mov edx, dword [esi]
bswap edi
jmp 0x58a0f4
bsf di, bx
rcl edi, 0xf
cmc
mov edi, edx
sub esp, 0x11
jmp 0x58a0be

Function at 0x58a367
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov ebx, esi
jmp 0x58a36a
push ebx
jmp 0x58a351
add ebx, 4
mov dword [ebx], edi
pop ebx
mov edi, dword [esp]
jmp 0x58a3b6
mov ebx, dword [ebx*4 + reloc.KERNEL32.dll_CloseHandle]
not edi
not di
lea edi, [edx*4]
lea edi, [esp + 0x47]
jmp 0x58a393
Function at 0x58a405
Capabilities:
Encrypt data using aes

Disassembly:
xor edi, dword [ebx*4 + reloc.KERNEL32.dll_CloseHandle]
sub esp, 0xf
not ebx
lea esp, [esp + 3]
jmp 0x58a1ae
and ebx, ecx
jmp 0x58a151
mov ebx, dword [ebx*4 + reloc.KERNEL32.dll_CloseHandle]
push di
lea esp, [esp + 1]
lea esp, [esp + 1]
jmp 0x58a167
sub esp, 5
lea esp, [esp + 1]
and edx, ecx
jmp 0x58a259
movzx ebx, byte [esi + 5]
and edx, ecx
mov edx, dword [edx*4 + reloc.KERNEL32.dll_CloseHandle]
jmp 0x58a191
add ecx, 4
mov edx, dword [ecx]
pop ecx
pushfd
jmp 0x58a223
pushal
mov al, byte [esp]
cpuid
mov dword [esp + 0x18], esi
popal
jmp 0x58a1bd
shr edi, 0x18
sub esp, 0
jmp 0x58a205
xor di, bx
bswap edi
mov edi, edx
push si
lea esp, [esp + 2]
jmp 0x58a1e0
mov edi, dword [edi*4 + reloc.KERNEL32.dll_CloseHandle]
call fcn.0058a236
stosd dword es:[edi], eax
xor esp, dword [ebx - reloc.KERNEL32.dll_CloseHandle]
xor al, 0xaa
int 0x3c
mov ebx, 0x5a23e0a1
mov ch, 0xa4
mov dword [esi], edi
mov edi, 0x18738d56
mov ebx, dword [ebx*4 + reloc.KERNEL32.dll_CloseHandle]
mov edi, dword [esp]
jmp 0x58a1f6
lea esp, [esp + 0x10]
xor edi, dword [edx*4 + reloc.KERNEL32.dll_CloseHandle]
mov dx, word [esp]
push ecx
jmp 0x58a1d3
and ebx, ecx
lea esp, [esp + 0x2c]
xor edi, dword [ebx*4 + reloc.KERNEL32.dll_CloseHandle]
movzx ebx, byte [esi + 2]
jmp 0x58a17e
jmp 0x58a29f

Function at 0x58a53f
Capabilities:
Encrypt data using aes

Disassembly:
and ebx, ecx
jmp 0x58a5a8
mov bl, al
movzx ebx, byte [esi + 0xe]
push edi
jmp 0x58a62d
and edx, ecx
jmp 0x58a5e8
clc
lea esp, [esp + 0xc]
xor edi, dword [ebx*4 + reloc.KERNEL32.dll_CloseHandle]
bswap ebx
lea ebx, [esi*4]
jmp 0x58a586
push dword [esp + 2]
lea esp, [esp + 8]
xor edi, dword [ebx*4 + reloc.KERNEL32.dll_CloseHandle]
pushal
cmc
jmp 0x58a60e
dec dword [ebp - 4]
call fcn.0058a5f8
and byte [ecx + 0x4fa35031], ah
invalid
mov edx, dword [edx*4 + reloc.KERNEL32.dll_CloseHandle]
and ebx, ecx
pushfd
mov word [esp], dx
jmp 0x58a5bf
and edx, ecx
lea esp, [esp + 0x20]
xor edi, dword [edx*4 + reloc.KERNEL32.dll_CloseHandle]
jmp 0x58a5d2
mov edi, ebx
lea edi, [edi*4]
lea edi, reloc.KERNEL32.dll_CloseHandle
mov ebx, dword [edi]
pop edi
jmp 0x58a592

Function at 0x58a578
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
lea esi, [esi*4]
lea esi, reloc.KERNEL32.dll_CloseHandle
mov edi, dword [esi]
pop esi
call fcn.0058a53f
in ax, 0x75
sbb al, 0xef
seto byte [esi]
test bl, ah
push ds
cld
pop es
scasb al, byte es:[edi]
add esp, 0
push dword [esp + 3]
lea esp, [esp + 0xc]
popal
jmp 0x58a555

Function at 0x58a644
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 8]
jne 0x52e3e1
je 0x52e3f7

Function at 0x676616
Capabilities:
Parse pe header

Disassembly:
and al, 1
mov dword [esp], edi
call 0x676616
jl 0x6765a0
je 0x67663d
add esp, dword [esi - 1]
je 0x676642
add eax, 0xd34a6beb
inc ebx
aad 0x54
salc
inc ecx
ret
div ebp
invalid
Function at 0x67665c
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
mov dword [esp], edx
pushfd
mov dword [esp + 0xc], esi
call fcn.00676646
push word [esp + 3]
lea esp, [esp + 5]
mov byte [esp], ah
lea esp, [esp + 1]
mov dword [esp + 8], edi
lea esp, [esp + 8]
jmp 0x6766c5
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x676699
Function at 0x423f75
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041da1c
and dword [ebp - 4], 0
cmp dword [0x44b370], 0
mov ebx, eax
jne 0x424026
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4240d7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4240d7
push eax
call fcn.0041d9aa
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x44b370], eax
call esi
push eax
call fcn.0041d9aa
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x44b374], eax
call esi
push eax
call fcn.0041d9aa
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x44b378], eax
call esi
push eax
call fcn.0041d9aa
pop ecx
mov dword [0x44b380], eax
test eax, eax
je 0x424026
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041d9aa
pop ecx
mov dword [0x44b37c], eax
mov eax, dword [0x44b37c]
cmp eax, ebx
je 0x42407e
cmp dword [0x44b380], ebx
je 0x42407e
push eax
call fcn.0041da25
push dword [0x44b380]
mov esi, eax
call fcn.0041da25
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x42407e
test edi, edi
je 0x42407e
call esi
test eax, eax
je 0x424075
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x424075
test byte [ebp - 0xc], 1
jne 0x42407e
or dword [ebp + 0x10], 0x200000
jmp 0x4240b7
mov eax, dword [0x44b374]
cmp eax, ebx
je 0x4240b7
push eax
call fcn.0041da25
pop ecx
test eax, eax
je 0x4240b7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4240b7
mov eax, dword [0x44b378]
cmp eax, ebx
je 0x4240b7
push eax
call fcn.0041da25
pop ecx
test eax, eax
je 0x4240b7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44b370]
call fcn.0041da25
pop ecx
test eax, eax
je 0x4240d7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4240d9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x405d9a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42c574], 0
push esi
jne 0x405dd1
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405dab
mov dword [ecx*4 + 0x42c570], eax
inc ecx
cmp ecx, 0x100
jl 0x405da6
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405e02
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42c570]
xor eax, esi
inc ecx
dec edx
jne 0x405de4
pop edi
not eax
pop esi
ret 0xc
Function at 0x401000
Capabilities:
Extract resource via kernel32 functions
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, edx
push esi
push 0
mov ebx, ecx
mov byte [ebp - 1], 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x4010be
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4010be
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x4010b4
push 0x80
push ebx
mov dword [ebp - 0x18], 0xc
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 1
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
push 0x80
push 2
lea eax, [ebp - 0x18]
push eax
push 0
push 0x40000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4010b4
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
mov dword [ebp - 8], 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
push esi
sete bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4010d0
Capabilities:
Accept command line arguments
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x8b4
push ebx
push esi
push edi
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x10], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
test edi, edi
je 0x4012ba
cmp dword [esp + 0x18], 3
jl 0x4012b3
mov eax, dword [edi + 8]
mov ebx, dword [edi + 4]
mov dword [esp + 0x14], eax
mov eax, dword [edi + 0xc]
mov dword [esp + 0x10], eax
mov ecx, 0x410
lea eax, [esp + 0x260]
jmp 0x401130
mov byte [eax], 0
lea eax, [eax + 1]
dec ecx
jne 0x401130
mov ecx, 0x208
lea eax, [esp + 0x58]
mov byte [eax], 0
lea eax, [eax + 1]
dec ecx
jne 0x401142
push 0x104
lea eax, [esp + 0x5c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.1.exe
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [esp + eax*2 + 0x54]
push eax
call esi
push 0x402098
push 0x4020b4
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x40119a
mov edx, eax
lea ecx, [esp + 0x58]
call fcn.00401000
lea eax, [esp + 0x670]
push eax
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x4012b3
push 0x4020d4
lea eax, [esp + 0x264]
push eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push ebx
lea eax, [esp + 0x264]
push eax
call esi
push 0x4020d8
lea eax, [esp + 0x264]
push eax
call esi
push 0x4020d4
lea eax, [esp + 0x264]
push eax
call esi
push dword [esp + 0x14]
lea eax, [esp + 0x264]
push eax
call esi
push 0x4020d8
lea eax, [esp + 0x264]
push eax
call esi
push 0x4020d4
lea eax, [esp + 0x264]
push eax
call esi
push dword [esp + 0x10]
lea eax, [esp + 0x264]
push eax
call esi
push 0x4020d8
lea eax, [esp + 0x264]
push eax
call esi
lea eax, [esp + 0x58]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x260]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x20], 0x3c
mov dword [esp + 0x24], 0x40
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], str.runas
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 3
mov dword [esp + 0x40], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp eax, 1
jne 0x4012b3
push 0xffffffffffffffff
push dword [esp + 0x58]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x58]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_ExitProcess]