joyce8/EMBER2024-capa huggingface dataset:
Function at 0x59f9dc
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x59f9ee
add esp, 0xfffffff0
call fcn.00407a40
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004bfa2c
mov eax, dword [0x6397e4]
mov dword [eax + 4], ebx
mov dword [eax], 0x59fe1c
mov eax, dword [0x6397fc]
mov dword [eax + 4], ebx
mov dword [eax], 0x59fe28
mov eax, ebx
call fcn.0059fe34
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x44], eax
mov dl, 1
mov eax, dword [0x48886c]
call fcn.00407414
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x48886c]
call fcn.00407414
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x48886c]
call fcn.00407414
mov dword [ebx + 0x5c], eax
mov dl, 1
mov eax, dword [0x48886c]
call fcn.00407414
mov dword [ebx + 0x60], eax
mov dl, 1
mov eax, dword [0x48886c]
call fcn.00407414
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x48], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x60]
push eax
mov eax, 0x59a76c
push eax
push 0
push 0
call sub.user32.dll_EnumDisplayMonitors
mov dl, 1
mov eax, dword [0x4f16ec]
call fcn.004f76ec
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x4f16ec]
call fcn.004f76ec
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x4f16ec]
call fcn.004f76ec
mov dword [ebx + 0x80], eax
mov dl, 1
mov eax, dword [0x4f16ec]
call fcn.004f76ec
mov dword [ebx + 0x8c], eax
mov dl, 1
mov eax, dword [0x4f16ec]
call fcn.004f76ec
mov dword [ebx + 0x90], eax
mov eax, ebx
call fcn.005a0424
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5a0240
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5a0240
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5a0240
mov eax, dword [ebx + 0x8c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5a0240
mov eax, dword [ebx + 0x90]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5a0240
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x59fb6b
call fcn.00407a98
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x59ffe0
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5a018b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x3c], 0
jne 0x5a016c
mov dl, 1
mov eax, dword [0x48c020]
call fcn.004ae1d0
mov edx, dword [ebp - 4]
mov dword [edx + 0x3c], eax
mov eax, dword [ebp - 4]
add eax, 0x40
call fcn.00409088
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x5a015b
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00523f10
test al, al
je 0x5a014e
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x5a019c
lea eax, [ebp - 0x394]
call fcn.00423a38
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x5a014e
xor eax, eax
push ebp
push 0x5a0147
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x5a020c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x5a0130
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.00409cd8
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov ebx, dword [eax]
call dword [ebx + 0x40]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x44]
jne 0x5a0130
mov eax, dword [ebp - 4]
add eax, 0x40
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.00409cd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a014e
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x5a0051
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov byte [eax + 0x39], 0
mov dl, 1
call fcn.004ae10c
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x3c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a0192
lea eax, [ebp - 0x3a0]
call fcn.00409088
ret

Function at 0x5a0d44
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x640330]
cmp byte [eax + 0xb1], 0
jne 0x5a0db6
cmp dword [0x640350], 0
jne 0x5a0d76
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, dword [0x636978]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x640350], eax
cmp dword [0x64034c], 0
jne 0x5a0d91
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x64034c], eax
cmp dword [0x640354], 0
jne 0x5a0db6
push esp
push 0
push 0
mov eax, dword [0x636974]
push eax
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x640354], eax
pop edx
ret
Function at 0x5a10d0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x5a10e7
add esp, 0xfffffff0
call fcn.00407a40
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004bfa2c
mov eax, dword [0x639510]
cmp byte [eax], 0
jne 0x5a1114
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x184], al
mov eax, dword [0x639bb4]
cmp word [eax + 2], 0
jne 0x5a112e
mov eax, dword [0x639bb4]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005a32b8
mov eax, dword [0x639e04]
cmp word [eax + 2], 0
jne 0x5a1148
mov eax, dword [0x639e04]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005a34bc
mov byte [ebx + 0x39], 0
mov dl, 1
mov eax, dword [0x4f16ec]
call fcn.004f76ec
mov esi, eax
mov dword [ebx + 0x40], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x5a3a34
mov dl, 1
mov eax, dword [0x48886c]
call fcn.00407414
mov dword [ebx + 0x94], eax
mov dl, 1
mov eax, dword [0x48886c]
call fcn.00407414
mov dword [ebx + 0xb4], eax
xor eax, eax
mov dword [ebx + 0x64], eax
xor eax, eax
mov dword [ebx + 0x88], eax
mov dword [ebx + 0x60], 0xff000018
mov dword [ebx + 0x7c], 0x1f4
mov byte [ebx + 0x80], 1
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x78], 0x9c4
mov byte [ebx + 0x8c], 0
mov byte [ebx + 0xa9], 1
mov byte [ebx + 0xc0], 1
mov dl, 1
mov eax, dword [0x4f5fcc]
call fcn.00500d2c
mov esi, eax
mov dword [ebx + 0xa4], esi
push 0x5a132c
mov eax, dword [0x639930]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.005011bc
mov eax, dword [ebx + 0xa4]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x5a3d1c
mov dl, 1
mov eax, dword [0x48886c]
call fcn.00407414
mov dword [ebx + 0x9c], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x639930]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.00423834
test eax, eax
je 0x5a125c
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.0042361c
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.00423818
test eax, eax
je 0x5a1274
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW_1
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0x90]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.00409cd8
push ebx
push 0x5a2c94
call fcn.00596c44
mov dword [ebx + 0x180], eax
mov byte [ebx + 0xd4], 0
mov eax, dword [0x639510]
cmp byte [eax], 0
jne 0x5a12c5
mov eax, ebx
call fcn.005a14ec
mov byte [ebx + 0x5d], 1
mov byte [ebx + 0x5e], 1
mov byte [ebx + 0x5f], 1
mov byte [ebx + 0xaa], 1
mov byte [ebx + 0xd5], 0
mov byte [ebx + 0xe0], 0
xor eax, eax
mov dword [ebx + 0xd8], eax
mov byte [ebx + 0xd7], 0
xor eax, eax
mov dword [ebx + 0xac], eax
mov eax, ebx
call fcn.005a3f64
mov eax, ebx
call fcn.005a4b90
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5a1322
call fcn.00407a98
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5a1824
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x178]
test eax, eax
je 0x5a18d0
cmp dword [ebx + 0x98], 0
jne 0x5a18ca
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x5a175c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x94]
cmp dword [eax + 8], 0
je 0x5a18ca
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
mov eax, esi
mov edx, 0xffffffec
push edx
push eax
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x5a1890
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x94]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x5a18ca
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x94]
call fcn.004a9b6c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x5a189f
inc dword [ebx + 0x98]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x5a1af0
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x640330]
cmp dword [eax + 0x178], 0
je 0x5a1c55
test bl, bl
jne 0x5a1ba3
cmp dword [esi + 0xa0], 0
jne 0x5a1b98
mov eax, esi
call fcn.005a49e0
push eax
push 0x5a19fc
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x48], 0
je 0x5a1b69
mov eax, dword [0x640330]
cmp byte [eax + 0xd7], 0
je 0x5a1b69
mov eax, dword [esi + 0xdc]
call fcn.0040aec0
mov edi, eax
cmp edi, 0
jl 0x5a1b69
push 0
mov eax, dword [esi + 0xdc]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5a1b52
mov eax, dword [esi + 0x9c]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5a1b98
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x9c]
call fcn.004a9b6c
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5a1b78
inc dword [esi + 0xa0]
jmp 0x5a1c55
cmp dword [esi + 0xa0], 0
jle 0x5a1c55
dec dword [esi + 0xa0]
cmp dword [esi + 0xa0], 0
jne 0x5a1c55
cmp dword [esi + 0x48], 0
je 0x5a1c00
mov eax, dword [0x640330]
cmp byte [eax + 0xd7], 0
je 0x5a1c00
mov eax, dword [esi + 0xdc]
call fcn.0040aec0
mov edi, eax
cmp edi, 0
jl 0x5a1c00
push 5
mov eax, dword [esi + 0xdc]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5a1be9
mov eax, dword [esi + 0x9c]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5a1c2f
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x9c]
call fcn.004a9b6c
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5a1c0f
mov eax, dword [esi + 0x9c]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xdc]
mov ecx, 1
mov edx, dword [0x593544]
call fcn.0040b0d4
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x5a28b0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xb0], 0
je 0x5a290d
cmp byte [ebx + 0xd7], 0
jne 0x5a290d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x178]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00409210
mov eax, dword [esi]
test eax, eax
je 0x5a28fa
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x5a291a
mov eax, esi
mov edx, dword [ebx + 0x90]
call fcn.00409468
jmp 0x5a291a
mov eax, esi
mov edx, dword [ebx + 0x90]
call fcn.00409468
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5a414c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x88]
test esi, esi
je 0x5a41ba
mov eax, esi
call fcn.0051de08
test al, al
je 0x5a41ba
mov eax, dword [ebx + 0x88]
call fcn.0051da54
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5a41ba
mov eax, dword [ebx + 0x88]
mov edx, dword [eax]
call dword [edx + 0x110]
test al, al
je 0x5a41ae
push 0
mov eax, dword [ebx + 0x88]
call fcn.0051da54
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x88]
call fcn.00514740
jmp 0x5a41ba
mov cl, 1
mov edx, dword [ebx + 0x78]
mov eax, ebx
call fcn.005a3f84
pop esi
pop ebx
ret
Function at 0x5aac14
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
cmp dword [ebx + 0x8c], 0
jne 0x5aac8e
mov eax, dword [ebx + 8]
call fcn.0051da54
mov ecx, eax
mov dl, 1
mov eax, dword [0x52aa90]
call fcn.00517d84
mov esi, eax
mov dword [ebx + 0x8c], esi
xor edx, edx
mov eax, esi
call fcn.0052ff20
mov dword [esi + 0x2b4], ebx
mov dword [esi + 0x2b0], 0x5aa50c
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
push 0
mov eax, dword [ebx + 0x8c]
call fcn.0051da54
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x8c]
call fcn.0051da54
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x9c], 0
jne 0x5aad04
mov eax, dword [ebx + 8]
call fcn.0051da54
mov ecx, eax
mov dl, 1
mov eax, dword [0x52aa90]
call fcn.00517d84
mov esi, eax
mov dword [ebx + 0x9c], esi
mov dl, 1
mov eax, esi
call fcn.0052ff20
mov dword [esi + 0x2b4], ebx
mov dword [esi + 0x2b0], 0x5aa558
push 8
push 0
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x9c]
call fcn.0051da54
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x9c]
call fcn.0051da54
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x94], 0
jne 0x5aad70
mov eax, dword [ebx + 8]
call fcn.0051da54
mov ecx, eax
mov dl, 1
mov eax, dword [0x52b500]
call fcn.00517d84
mov esi, eax
mov dword [ebx + 0x94], esi
mov eax, esi
mov byte [eax + 0x288], 1
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x94]
call fcn.0051da54
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x94]
call fcn.0051da54
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x5c034c
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x5c0474
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, word [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.005c0238
mov eax, dword [esi]
call fcn.0040aeb8
add eax, 0x28
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x41c028]
call fcn.0040b0d4
add esp, 4
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1c]
mov ecx, 0x1c
call fcn.004065dc
mov ebx, 0x1c
mov eax, dword [ebp - 4]
lea edx, [eax + ebx]
lea eax, [ebp - 0x2c]
mov ecx, 0x1c
call fcn.004065dc
add ebx, 0x1c
mov eax, dword [esi]
call fcn.0040aeb8
mov dword [ebp - 0xc], eax
mov eax, dword [0x63a064]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
lea edx, [ebp - 4]
mov ecx, ebx
call fcn.005af4a8
add ebx, 4
mov eax, dword [ebp - 4]
add eax, ebx
xor ecx, ecx
mov edx, 3
call fcn.00406ea0
add ebx, 3
mov eax, dword [ebp - 4]
mov byte [eax + ebx], 0x3a
inc ebx
mov eax, dword [esi]
mov byte [eax + 2], 0
mov eax, dword [esi]
mov byte [eax + 3], 0
push ebx
mov eax, dword [esi]
call fcn.0040aeb8
push eax
lea ecx, [ebp - 4]
mov eax, dword [esi]
xor edx, edx
call fcn.005af484
mov edx, dword [ebp - 4]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x98]
mov ebx, eax
mov eax, ebx
call fcn.005af23c
mov edx, esi
mov ecx, dword [ebp + 0x10]
call fcn.005af4a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c047b
lea eax, [ebp - 4]
mov edx, dword [0x41c028]
call fcn.0040b1f8
ret
Function at 0x602068
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x602070
push ecx
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x602225
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x18]
mov ecx, dword [eax + 0xc]
lea eax, [ebp - 4]
mov edx, 0x602240
call fcn.00409e88
push esi
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
mov eax, dword [ebx + 0x2c]
push eax
lea eax, [ebp - 0x18]
push eax
movzx ecx, word [ebx + 0x30]
xor edx, edx
mov eax, dword [ebx + 0x1c]
call fcn.005ffd44
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0x11
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x602254
call fcn.005b0884
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x6020eb
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x60212c
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebx + 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
movzx ecx, word [ebx + 0x30]
xor edx, edx
mov eax, dword [ebx + 0xc]
call fcn.005ffd44
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x6022bc
call fcn.005b0884
mov edx, dword [ebp - 0x1c]
mov eax, esi
call fcn.00409e30
mov eax, esi
mov edx, 0x6022e8
call fcn.00409e30
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x602144
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x6021b2
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x6022fc
call fcn.005b0884
mov edx, dword [ebp - 0x2c]
mov eax, esi
call fcn.00409e30
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x60217b
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x6021a6
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x60232c
call fcn.005b0884
mov edx, dword [ebp - 0x30]
mov eax, esi
call fcn.00409e30
mov eax, esi
mov edx, 0x6022e8
call fcn.00409e30
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x6021be
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x6021e9
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x602358
call fcn.005b0884
mov edx, dword [ebp - 0x34]
mov eax, esi
call fcn.00409e30
mov eax, esi
mov edx, 0x6022e8
call fcn.00409e30
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60222c
lea eax, [ebp - 0x34]
mov edx, 4
call fcn.004090e8
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.004090e8
lea eax, [ebp - 4]
call fcn.00409088
ret
Function at 0x10005510
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x1000551f
pop dword [ebp - 0xc]
mov eax, 0x3ae04d74
sub eax, 0x2adff855
sub dword [ebp - 0xc], eax
push 0x40
push 0x1000
push 0x33aaa
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0xc]
call dword [eax]
mov ecx, 0x2c4d8ef
add ecx, 0xfd3b610f
xor ebx, ebx
add ebx, eax
mov esi, 0x135937b0
sub esi, 0x3579fb0
add esi, dword [ebp - 0xc]
mov edx, 0x5ce8172c
mov dword [ebp - 8], 0xe02195b6
mov edi, dword [esi]
xor dword [ebp - 8], 0x152ddd1c
xor edi, edx
sub dword [ebp - 8], edx
mov dword [ebx], edi
add dword [ebp - 4], ebx
add ebx, 4
add esi, 4
loop 0x10005575
add eax, 0xddf6bccf
sub eax, 0xddf5e204
mov ebx, eax
add eax, 0x7c289300
sub eax, 0x7c2892fb
mov ecx, 0x727b42b0
sub ecx, 0x627b42b0
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0xaca058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00aca1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xaca07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xaca06a
add dl, dl
jne 0xaca089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xaca0dc
xor eax, eax
add dl, dl
jne 0xaca096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xaca17d
add dl, dl
jne 0xaca0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xaca0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xaca0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xaca0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xaca0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xaca075
mov eax, 1
add dl, dl
jne 0xaca0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xaca0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xaca0e1
sub eax, ebx
mov ebx, 1
jne 0xaca128
mov ecx, 1
add dl, dl
jne 0xaca10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xaca119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xaca105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xaca075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xaca13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xaca14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xaca136
cmp eax, 0x7d00
jae 0xaca16d
cmp eax, 0x500
jb 0xaca168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xaca075
cmp eax, 0x7f
ja 0xaca170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xaca075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xaca19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xaca075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x44e57d
Capabilities:
Encode data using xor

Disassembly:
call 0xc221628f
fisubr dword [esi - 0x6be83dfa]
sti
or byte [eax], 0x26
outsb dx, byte [esi]
pushal
cmpsb byte [esi], byte es:[edi]
jno 0x44e548
inc ecx
loopne 0x44e5ca
mov edx, 0xdcab570a
out dx, eax
xchg ebp, eax
leave
in al, dx
push es
xor dword [edx - 0x24], esi
jb 0x44e568
movsd dword es:[edi], dword [esi]
jecxz 0x44e58a
sbb ecx, dword [ebp + 0x12]
aaa
sub dl, byte [ecx + 0x58aab17c]
lodsd eax, dword [esi]
invalid
mov ebp, dword [0xb8b4de63]
sbb ebx, esi
test ecx, esp
in al, 0xc5
mov dword [0xa1d7f4c1], eax
lds esp, [ebx - 0x5e280b3f]
xor eax, 0xf3ce23ff
xor al, 0x13
pushal
xor cl, byte [eax + 0x18160b41]
xchg ebx, eax
cmp al, 0xe0
xor esp, 0xffffffe8
out dx, eax
call 0xeeb8e88
push cs
leave
in eax, dx
loope 0x44e5be
mov al, 0x1d
cmpsd dword [esi], dword es:[edi]
pop edx
cmpsb byte [esi], byte es:[edi]
and dl, byte [ebp - 0x7b]
packuswb mm5, mm1
arpl word [esi], bx
pushal
push ebx
xchg edi, eax
dec ecx
cld
test eax, 0xa9170d4
adc edi, 0xbd0b4ab1
cmpsd dword [esi], dword es:[edi]
int3

Function at 0x45c691
Capabilities:
Encode data using xor

Disassembly:
xor edx, esp
push 0xffffffffffffffbf
xchg edx, eax
pop esi
and edx, esp
sahf
test eax, 0xfff3bc6a
mov ch, 0xb3
push esp
jge 0x45c68b
fcomp dword [esi - 0x574456a3]
cmp eax, 0xaaf94121
mov al, 0x83
pop edi
xchg ebp, eax
invalid

Function at 0x4652e1
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
or ah, 0xe6
sub al, 0x89
mov al, 0x77
add dword [edx + 0x5a], 0x41
in al, dx
and al, 0x3a
push ebp
dec esp
xlatb
pop edx
xor dword [ecx + edx + 0x1127440c], edi
or esp, dword [esi]
push edi
idiv ecx
idiv ecx
sbb dword [ecx - 0x39488599], 0xe68693ee
mov al, byte [0xc4be9fd9]
outsd dx, dword [esi]
adc ah, byte [ecx + 0x44]
outsb dx, byte [esi]
leave
mov eax, dword [ecx]
push esi
push ebp
push ds
or ebx, dword [ebx]
jg 0x4652c5
push ds
mov ah, 0x91
pushfd
inc esp
cmp al, 0xef
test edx, edx
or eax, dword [esi - 0x2f6b1b17]
retf 0xa42d