joyce8/EMBER2024-capa huggingface dataset:
Function at 0x523080
Capabilities:
Extract resource via kernel32 functions
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x609450
push 0x5612f0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x60f520]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x2c], ecx
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
test edx, edx
je 0x5230c4
mov dword [edx], ebx
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
test edi, edi
je 0x523233
cmp dword [sym.imp.KERNEL32.dll_CloseHandle], ebx
je 0x523233
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov esi, eax
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push dword [ebp - 0x2c]
call edi
mov dword [ebp - 0x2c], eax
cmp eax, 0xffffffff
je 0x52313d
push 0
push 0
push 0
push 0x1000002
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edi, eax
mov dword [ebp - 0x28], edi
test edi, edi
je 0x52313d
push 0
push 0
push 0
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
mov dword [ebp - 0x24], edi
test edi, edi
cmovne ebx, edi
push esi
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
test ebx, ebx
je 0x5231e1
mov dword [ebp - 4], 0
xor edi, edi
mov dword [ebp - 0x20], edi
push 0x10
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x5231b4
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x5231b4
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x5231b4
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x5231b4
movzx esi, word [eax]
cmp esi, dword [ebp - 0x1c]
ja 0x5231ac
mov dword [ebp - 0x1c], esi
add esi, 3
and esi, 0xfffffffc
mov dword [ebp - 0x1c], esi
cmp dword [eax + 0x28], 0xfeef04bd
je 0x5231b9
mov edi, 0xd
mov dword [ebp - 0x20], edi
xor esi, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0xfffffffe
jmp 0x5231e6
mov edi, 0xd
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x5231f4
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0x28]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x523204
push eax
call ebx
mov eax, dword [ebp - 0x2c]
cmp eax, 0xffffffff
je 0x52320f
push eax
call ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
je 0x523233
lea eax, [esi*2 + 4]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x523250
Capabilities:
Extract resource via kernel32 functions
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x609470
push 0x5612f0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x60f520]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x28], ecx
xor eax, eax
mov dword [ebp - 0x1c], eax
xor esi, esi
xor edi, edi
mov dword [ebp - 0x20], edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
cmp dword [sym.imp.KERNEL32.dll_CreateFileW], eax
je 0x5232b5
cmp dword [sym.imp.KERNEL32.dll_CloseHandle], eax
je 0x5232b5
cmp dword [ebp + 8], 2
jae 0x5232c9
push 0x7a
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov dword [ebp - 0x2c], eax
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x28], eax
cmp eax, 0xffffffff
je 0x523332
push 0
push 0
push 0
push 0x1000002
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edi, eax
mov dword [ebp - 0x20], edi
test edi, edi
je 0x523332
push 0
push 0
push 0
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
mov dword [ebp - 0x24], ebx
xor eax, eax
test ebx, ebx
cmovne eax, ebx
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x5233eb
push 0x10
push 1
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x5233e9
push eax
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ecx, eax
test ecx, ecx
je 0x5233e9
mov dword [ebp - 4], esi
movzx esi, word [ecx]
mov dword [ebp - 0x2c], esi
lea eax, [esi*2 + 4]
mov edx, dword [ebp + 8]
cmp eax, edx
jbe 0x523394
mov esi, edx
shr esi, 1
sub esi, 4
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x1c], 1
jmp 0x52339b
mov dword [ebp - 0x1c], 0
push esi
push ecx
push dword [ebp + 0xc]
call fcn.00559410
add esp, 0xc
mov eax, dword [ebp + 0xc]
mov dword [esi + eax], 0x58324546
cmp dword [ebp - 0x1c], 0
je 0x5233bb
mov word [eax], si
mov esi, 1
mov dword [ebp - 0x30], esi
mov dword [ebp - 4], 0xfffffffe
jmp 0x5233eb
xor esi, esi
test ebx, ebx
je 0x5233f6
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x523403
push edi
call ebx
mov eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x52340e
push eax
call ebx
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x529c10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x60f520]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
mov esi, ecx
call fcn.00556115
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], esi
add esp, 4
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], 0x5b8310
lea edi, [ebp - 5]
mov dword [ebp - 8], fcn.0052a190
xor eax, 0x10
mov esi, 0x10
movzx edx, byte [edi + esi - 0x10]
mov ecx, eax
shl ecx, 5
dec esi
add edx, ecx
mov ecx, eax
shr ecx, 2
add edx, ecx
xor eax, edx
cmp esi, 1
jae 0x529c50
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0055199a
mov esp, ebp
pop ebp
ret

Function at 0x52a390
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
push esi
mov esi, dword [ebx]
mov eax, esi
xor eax, dword [ebp + 8]
mov ecx, dword [ebx + 8]
and eax, 0xff
shr esi, 8
mov eax, dword [edx + eax*4]
xor eax, esi
mov dword [ebx], eax
movzx eax, al
add eax, dword [ebx + 4]
imul eax, eax, 0x8088405
pop esi
inc eax
mov dword [ebx + 4], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [edx + eax*4]
mov eax, dword [ebp + 8]
mov dword [ebx + 8], ecx
pop ebx
pop ebp
ret
Function at 0x52fe80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, edx
mov ebx, ecx
push edi
mov edi, esi
mov eax, esi
xor eax, dword [ebp + 8]
shr edi, 5
inc edi
cmp esi, edi
jb 0x52febb
lea esp, [esp]
movzx edx, byte [ebx + esi - 1]
mov ecx, eax
shl ecx, 5
sub esi, edi
add edx, ecx
mov ecx, eax
shr ecx, 2
add edx, ecx
xor eax, edx
cmp esi, edi
jae 0x52fea0
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x530090
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, ecx
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, dword [eax + 0xc]
push edi
mov edi, edx
mov dword [ebp - 8], edi
mov ebx, dword [eax + 0x30]
mov eax, dword [ebp + 8]
mov esi, eax
shr esi, 5
xor ebx, eax
inc esi
mov edx, eax
cmp eax, esi
jb 0x5300db
lea ebx, [ebx]
movzx ecx, byte [edi + edx - 1]
mov eax, ebx
shl eax, 5
sub edx, esi
add ecx, eax
mov eax, ebx
shr eax, 2
add ecx, eax
xor ebx, ecx
cmp edx, esi
jae 0x5300c0
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0xc]
mov ecx, dword [eax + 0x20]
mov eax, dword [eax + 0x18]
dec ecx
and ecx, ebx
mov edi, dword [eax + ecx*4]
test edi, edi
je 0x530159
cmp ebx, dword [edi + 8]
jne 0x530153
mov eax, dword [ebp + 8]
cmp eax, dword [edi + 0xc]
jne 0x530153
mov edx, dword [ebp - 8]
lea esi, [edi + 0x10]
sub eax, 4
jb 0x530121
lea esp, [esp]
mov ecx, dword [edx]
cmp ecx, dword [esi]
jne 0x530126
add edx, 4
add esi, 4
sub eax, 4
jae 0x530110
cmp eax, 0xfffffffc
je 0x530172
mov cl, byte [edx]
cmp cl, byte [esi]
jne 0x530153
cmp eax, 0xfffffffd
je 0x530172
mov cl, byte [edx + 1]
cmp cl, byte [esi + 1]
jne 0x530153
cmp eax, 0xfffffffe
je 0x530172
mov cl, byte [edx + 2]
cmp cl, byte [esi + 2]
jne 0x530153
cmp eax, 0xffffffff
je 0x530172
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
je 0x530172
mov edi, dword [edi]
test edi, edi
jne 0x5300f1
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 8]
call fcn.00530000
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
mov al, byte [edi + 5]
xor al, 3
mov ecx, dword [edx + 0xc]
mov cl, byte [ecx + 0x34]
xor cl, 3
test al, cl
jne 0x53018a
mov byte [edi + 5], al
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x531630
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov edi, edx
xor esi, esi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], esi
mov dword [edi], ecx
movzx eax, byte [ecx]
test byte [eax + 0x5bb471], 8
je 0x531661
movzx eax, byte [ecx + 1]
inc ecx
test byte [eax + 0x5bb471], 8
jne 0x531653
mov al, byte [ecx]
cmp al, 0x2d
jne 0x531671
inc ecx
mov dword [ebp - 0x14], 1
jmp 0x531679
cmp al, 0x2b
jne 0x531676
inc ecx
mov dword [ebp - 0x14], esi
cmp byte [ecx], 0x30
jne 0x531769
mov al, byte [ecx + 1]
cmp al, 0x78
je 0x531691
cmp al, 0x58
jne 0x531769
add ecx, 2
lea edx, [ebp - 0x10]
mov dword [ebp - 8], ecx
xorps xmm1, xmm1
lea ecx, [ebp - 8]
call fcn.005315d0
mov edx, dword [ebp - 8]
cmp byte [edx], 0x2e
jne 0x5316c3
inc edx
movapd xmm1, xmm0
mov dword [ebp - 8], edx
lea edx, [ebp - 0xc]
call fcn.005315d0
mov edx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
cmp dword [ebp - 0x10], 0
jne 0x5316d1
test esi, esi
je 0x531769
neg esi
mov dword [edi], edx
mov al, byte [edx]
shl esi, 2
cmp al, 0x70
je 0x5316e2
cmp al, 0x50
jne 0x53173a
mov al, byte [edx + 1]
inc edx
xor ecx, ecx
cmp al, 0x2d
jne 0x5316f2
inc edx
lea edi, [ecx + 1]
jmp 0x5316f9
cmp al, 0x2b
jne 0x5316f7
inc edx
xor edi, edi
mov al, byte [edx]
mov byte [ebp - 1], al
movzx eax, al
test byte [eax + 0x5bb471], 2
je 0x53173c
lea ebx, [ebx]
movsx eax, byte [ebp - 1]
lea ecx, [ecx + ecx*4]
inc edx
lea ecx, [ecx - 0x18]
lea ecx, [eax + ecx*2]
mov al, byte [edx]
mov byte [ebp - 1], al
movzx eax, al
test byte [eax + 0x5bb471], 2
jne 0x531710
test edi, edi
je 0x531735
neg ecx
mov edi, dword [ebp - 0x1c]
add esi, ecx
mov dword [edi], edx
cmp dword [ebp - 0x14], 0
je 0x53174a
xorpd xmm0, xmmword [0x5d09a0]
push esi
sub esp, 8
movsd qword [esp], xmm0
call fcn.0055a073
fstp qword [ebp - 0x20]
movsd xmm0, qword [ebp - 0x20]
add esp, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xorps xmm0, xmm0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x533110
Capabilities:
Enumerate pe sections

Disassembly:
push esi
mov esi, edx
push edi
mov edi, ecx
mov edx, dword [esi + 0x10]
cmp edx, 0x5b82f8
je 0x52f7ee
mov cl, byte [esi + 7]
mov eax, 1
shl eax, cl
mov ecx, edi
push 0
lea eax, [eax + eax*2]
shl eax, 3
push eax
call fcn.00544660
add esp, 8
mov eax, dword [esi + 0x1c]
mov ecx, edi
mov edx, dword [esi + 0xc]
shl eax, 3
push 0
push eax
call fcn.00544660
push 0
push 0x20
mov edx, esi
mov ecx, edi
call fcn.00544660
add esp, 0x10
pop edi
pop esi
ret
push edi
mov edi, ecx
lea ecx, [edx + 0x10]
cmp dword [edx + 8], ecx
je 0x53037d
mov eax, dword [ecx]
push esi
mov esi, dword [edx + 0x14]
mov dword [esi + 0x10], eax
mov ecx, dword [ecx]
mov eax, dword [edx + 0x14]
pop esi
mov dword [ecx + 0x14], eax
push 0
push 0x18
mov ecx, edi
call fcn.00544660
add esp, 8
pop edi
ret
push esi
mov esi, edx
push edi
push 0
mov edi, ecx
mov eax, dword [esi + 0x30]
mov edx, dword [esi + 0xc]
shl eax, 2
push eax
call fcn.00544660
mov eax, dword [esi + 0x38]
mov ecx, edi
mov edx, dword [esi + 0x10]
shl eax, 2
push 0
push eax
call fcn.00544660
mov eax, dword [esi + 0x2c]
mov ecx, edi
mov edx, dword [esi + 8]
shl eax, 3
push 0
push eax
call fcn.00544660
mov eax, dword [esi + 0x34]
mov ecx, edi
mov edx, dword [esi + 0x14]
shl eax, 2
push 0
push eax
call fcn.00544660
mov eax, dword [esi + 0x3c]
mov ecx, edi
mov edx, dword [esi + 0x18]
push 0
lea eax, [eax + eax*2]
shl eax, 2
push eax
call fcn.00544660
mov eax, dword [esi + 0x28]
mov ecx, edi
mov edx, dword [esi + 0x1c]
shl eax, 3
push 0
push eax
call fcn.00544660
push 0
push 0x50
mov edx, esi
mov ecx, edi
call fcn.00544660
add esp, 0x38
pop edi
pop esi
ret
push esi
mov esi, edx
push edi
mov edi, ecx
movzx eax, byte [esi + 4]
add eax, 0xfffffffc
cmp eax, 0x22
ja case.0x53312d.11
movzx eax, byte [eax + 0x5331f8]
jmp dword [eax*4 + 0x5331d0]
pop edi
pop esi
jmp 0x530590
movzx eax, byte [esi + 6]
push 0
lea eax, [eax*4 + 0x10]
push eax
call fcn.00544660
add esp, 8
pop edi
pop esi
ret
movzx eax, byte [esi + 6]
push 0
lea eax, [eax*8 + 0x10]
push eax
call fcn.00544660
add esp, 8
pop edi
pop esi
ret
pop edi
pop esi
jmp 0x530360
pop edi
pop esi
jmp 0x52f7c0
mov edx, dword [esi + 0x1c]
mov ecx, esi
call fcn.00530390
mov ecx, esi
call fcn.00529dc0
push 0
push 0x70
mov edx, esi
mov ecx, edi
call fcn.00544660
add esp, 8
pop edi
pop esi
ret
mov eax, dword [esi + 0x10]
add eax, 0x18
push 0
push eax
call fcn.00544660
add esp, 8
pop edi
pop esi
ret
mov eax, dword [edi + 0xc]
dec dword [eax + 0x1c]
mov eax, dword [esi + 0xc]
add eax, 0x11
push 0
push eax
call fcn.00544660
add esp, 8
pop edi
pop esi
ret
Function at 0x53da60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x60f520]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, 0x200
mov dword [ebp - 0x20c], ecx
mov edi, edx
mov dword [ebp - 0x210], 0
lea eax, [ebp - 0x208]
mov dword [ebp - 0x214], esi
mov edx, esi
mov dword [ebp - 0x218], eax
lea ecx, [ebp - 0x218]
call fcn.00528ac0
push edi
push esi
push 1
push eax
call fcn.00557924
add dword [ebp - 0x210], eax
add esp, 0x10
cmp eax, esi
jb 0x53daf0
cmp esi, 0x3fffffff
ja 0x53dacc
add esi, esi
mov edx, esi
lea ecx, [ebp - 0x218]
call fcn.00528ac0
push edi
push esi
push 1
push eax
call fcn.00557924
add dword [ebp - 0x210], eax
add esp, 0x10
cmp eax, esi
jae 0x53dac2
lea ecx, [ebp - 0x218]
call fcn.00528b40
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0055199a
mov esp, ebp
pop ebp
ret

Function at 0x53db10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x60f520]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
mov edi, edx
mov dword [ebp - 0x210], ecx
mov edx, esi
mov dword [ebp - 0x21c], eax
lea ecx, [ebp - 0x21c]
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x218], 0x200
call fcn.00528ac0
push edi
push esi
push 1
push eax
call fcn.00557924
add esp, 0x10
lea ecx, [ebp - 0x21c]
mov esi, eax
add dword [ebp - 0x214], esi
call fcn.00528b40
mov ecx, dword [ebp - 8]
xor eax, eax
cmp eax, esi
pop edi
sbb eax, eax
xor ecx, ebp
neg eax
pop esi
call fcn.0055199a
mov esp, ebp
pop ebp
ret
Function at 0x5446e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x5446eb
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.00544700
Function at 0x544d60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 0x2c]
mov edi, edi
mov eax, dword [edi + 0x2c]
mov edx, dword [edi + 0x3c]
add eax, 0xfffffefa
sub edx, dword [edi + 0x74]
add eax, esi
sub edx, dword [edi + 0x6c]
mov dword [ebp - 4], edx
cmp dword [edi + 0x6c], eax
jb 0x544dec
mov ecx, dword [edi + 0x38]
push esi
lea eax, [ecx + esi]
push eax
push ecx
call fcn.00559410
mov edx, dword [edi + 0x4c]
add esp, 0xc
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], esi
sub dword [edi + 0x6c], esi
sub dword [edi + 0x5c], esi
lea ecx, [eax + edx*2]
mov edi, edi
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x544dbf
sub eax, esi
jmp 0x544dc1
xor eax, eax
mov word [ecx], ax
dec edx
jne 0x544db0
mov eax, dword [edi + 0x40]
mov edx, esi
lea ecx, [eax + esi*2]
nop
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x544ddf
sub eax, esi
jmp 0x544de1
xor eax, eax
mov word [ecx], ax
dec edx
jne 0x544dd0
mov edx, dword [ebp - 4]
add edx, esi
mov ebx, dword [edi]
cmp dword [ebx + 4], 0
je 0x544ea8
mov eax, dword [edi + 0x74]
add eax, dword [edi + 0x6c]
add eax, dword [edi + 0x38]
mov dword [ebp - 8], eax
mov eax, dword [ebx + 4]
cmp eax, edx
mov ecx, eax
cmova ecx, edx
mov dword [ebp - 4], ecx
test ecx, ecx
jne 0x544e19
xor eax, eax
jmp 0x544e6c
sub eax, ecx
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x544e36
mov edx, dword [ebx]
push ecx
mov ecx, dword [ebx + 0x30]
call fcn.0054d9e0
jmp 0x544e4e
cmp eax, 2
jne 0x544e54
mov edx, dword [ebx]
test edx, edx
jne 0x544e45
xor eax, eax
jmp 0x544e51
push ecx
mov ecx, dword [ebx + 0x30]
call fcn.00544700
add esp, 4
mov dword [ebx + 0x30], eax
push dword [ebp - 4]
push dword [ebx]
push dword [ebp - 8]
call fcn.00559410
mov eax, dword [ebp - 4]
add esp, 0xc
add dword [ebx], eax
add dword [ebx + 8], eax
add dword [edi + 0x74], eax
mov ebx, dword [edi + 0x74]
cmp ebx, 3
jb 0x544e94
mov eax, dword [edi + 0x38]
add eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x58]
movzx edx, byte [eax]
mov dword [edi + 0x48], edx
movzx eax, byte [eax + 1]
shl edx, cl
xor edx, eax
and edx, dword [edi + 0x54]
mov dword [edi + 0x48], edx
cmp ebx, 0x106
jae 0x544ea8
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x544d70
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x56056c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x56aa9e
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x60f520]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0055e8b2
mov dword [ebp - 0x14], eax
cmp dword [0x63ffcc], esi
jne 0x56ab91
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x56ab1e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x56ac71
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x56ac71
push 0x5b2240
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x56ac71
push eax
call ebx
push 0x5b224c
push edi
mov dword [0x63ffcc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x63ffd0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x63ffd4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x63ffdc], eax
test eax, eax
je 0x56ab8e
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x63ffd8], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x56abb6
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x56aba9
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x56abcb
push 4
pop eax
jmp 0x56ac73
cmp dword [ebp - 0x14], esi
je 0x56abcb
push dword [0x63ffcc]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x56abb0
mov eax, dword [0x63ffd8]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x56ac29
cmp dword [0x63ffdc], edi
je 0x56ac29
push eax
call ebx
push dword [0x63ffdc]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x56ac29
test eax, eax
je 0x56ac29
call ecx
test eax, eax
je 0x56ac1e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x56ac1e
test byte [ebp - 8], 1
jne 0x56ac29
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x56ac59
mov eax, dword [0x63ffd0]
cmp eax, edi
je 0x56ac56
push eax
call ebx
test eax, eax
je 0x56ac56
call eax
mov esi, eax
test esi, esi
je 0x56ac56
mov eax, dword [0x63ffd4]
cmp eax, edi
je 0x56ac56
push eax
call ebx
test eax, eax
je 0x56ac56
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x63ffcc]
call ebx
test eax, eax
je 0x56ac71
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x56ac73
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0055199a
mov esp, ebp
pop ebp
ret
Function at 0x42d650
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x6c2b98]
xor edx, edx
cmp eax, edx
jne 0x42d676
xor eax, eax
mov byte [eax + 0x6c2a98], al
inc eax
cmp eax, 0x100
jl 0x42d65e
mov dword [0x6c2b98], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x6c2a98
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x42d707
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x42d6da
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x42d6a8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x42d780
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x42d7d3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x42d7ba
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret