joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5011a8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x501242.0
jmp dword [ecx*4 + 0x5011db]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x50120d
sub dl, 8
je 0x50121c
jmp case.0x501242.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x500e50
jmp case.0x501242.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x500ea8
jmp case.0x501242.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x501242.0
movzx ecx, byte [ecx + 0x501249]
jmp dword [ecx*4 + 0x50125a]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x500f54
jmp case.0x501242.0
cmp dl, 3
jne 0x501287
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x500fac
jmp case.0x501242.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x500f68
jmp case.0x501242.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x500ff0
jmp case.0x501242.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x5012b2
sub dl, 8
je 0x5012be
jmp case.0x501242.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x50101c
jmp case.0x501242.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x501088
jmp case.0x501242.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x5012dd
sub dl, 8
je 0x5012e9
jmp case.0x501242.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x501144
jmp case.0x501242.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x50116c
mov edx, dword [eax + 0x468]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x450]
mov dword [ebp - 0x10], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 0xc], esi
add edx, dword [eax + 0x44c]
mov dword [ebp - 0x14], edx
mov esi, ecx
test esi, esi
jb 0x50138b
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00500354
test eax, eax
je 0x50138b
mov eax, ebx
call fcn.00501394
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
call dword [ebp - 0x20]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0x10], eax
sub dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 0xc], eax
dec esi
jne 0x501324
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x501394
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x5013c5
dec al
je 0x501400
dec al
je 0x501445
dec al
je 0x5014ae
jmp 0x501538
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x501538
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x5013d5
jmp 0x501538
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x501538
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x501410
jmp 0x501538
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x501538
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x501474
xor ebp, ebp
jmp 0x501484
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x50148d
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x501455
jmp 0x501538
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x501538
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x501507
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.004fe408
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x5014c2
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x507b00
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x507b71
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [0x5a42fc]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
cmp dword [ebp - 4], 0
je 0x507b5b
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.00507ae8
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x5072a0]
call fcn.005085a4
mov dword [0x5a4360], eax
mov eax, dword [ebp - 4]
call fcn.00507a94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x507b78
lea eax, [ebp - 8]
call fcn.004099bc
ret

Function at 0x50db70
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff828
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x7d8], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x50dc2a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004068dc
mov eax, dword [0x5a4c78]
cmp dword [eax], 2
jne 0x50dbdf
push esi
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.00406bd0
mov eax, dword [ebx]
call fcn.00406ab8
push eax
mov eax, dword [ebx]
call fcn.00406aa8
push eax
push esi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebx]
call fcn.00406ab8
mov edx, eax
dec edx
mov eax, ebx
call fcn.00406bd0
jmp 0x50dc11
lea eax, [ebp - 0x7d2]
push eax
push 0x3e8
push 0xd
push esi
call sub.user32.dll_SendMessageW
lea edx, [ebp - 0x7d8]
lea eax, [ebp - 0x7d2]
call fcn.00414634
mov edx, dword [ebp - 0x7d8]
mov eax, ebx
call fcn.00406f00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50dc31
lea eax, [ebp - 0x7d8]
call fcn.00406c74
ret
Function at 0x529884
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, eax
mov ebx, dword [ebp + 8]
add ebx, 0xffffffa4
mov esi, dword [ebp + 8]
add esi, 0xffffff9c
xor eax, eax
push ebp
push 0x529a37
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x60]
call fcn.0045bfa4
mov eax, dword [eax + 0x40]
mov edx, dword [esi]
mov edx, dword [edx + 0x30]
mov edx, dword [edx + 0x78]
mov edx, dword [edx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x68]
call fcn.00496790
call fcn.00524998
mov edx, dword [ebp + 8]
mov dword [edx - 0x6c], eax
mov eax, dword [ebp + 8]
cmp dword [eax - 0x6c], 0
je 0x529908
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x6c]
mov eax, dword [eax + 0x64]
call fcn.00454df8
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x60]
call fcn.0045bfa4
mov eax, dword [eax + 0x40]
pop edx
call fcn.00454e00
mov eax, dword [ebp + 8]
mov dword [eax - 0x70], ebx
lea edx, [ebp - 4]
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x78]
mov eax, dword [eax + 0x10]
call fcn.00454c80
mov edx, dword [ebp - 4]
lea eax, [ebx + 0x1c]
call fcn.004143a4
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x70]
push eax
push 0x5c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x60]
call fcn.0045bfa4
call fcn.0045670c
push eax
call sub.gdi32.dll_GetObjectW
mov dword [ebx + 8], edi
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x78]
mov eax, dword [eax + 0x10]
call fcn.00454d30
mov dword [ebx], eax
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x78]
mov eax, dword [eax + 0x10]
call fcn.00454d6c
test al, 8
setne al
mov byte [ebx + 0x16], al
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x78]
mov eax, dword [eax + 0x10]
call fcn.00454d6c
test al, 2
setne al
mov byte [ebx + 0x14], al
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x78]
mov eax, dword [eax + 0x10]
call fcn.00454d6c
test al, 4
setne al
mov byte [ebx + 0x15], al
mov dword [ebx + 0x10], 0x190
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x78]
mov eax, dword [eax + 0x10]
call fcn.00454df8
mov byte [ebx + 0x17], al
xor eax, eax
mov dword [ebx + 4], eax
mov byte [ebx + 0x18], 0
mov byte [ebx + 0x19], 0
mov eax, dword [ebx + 8]
mov dword [ebx + 0xc], eax
mov byte [ebx + 0x1b], 0
mov byte [ebx + 0x1a], 0
push ebx
call sub.gdi32.dll_CreateFontIndirectW
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x60]
call fcn.0045bfa4
mov eax, dword [eax + 0x40]
pop edx
call fcn.00454c1c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x60]
call fcn.0045bfa4
mov eax, dword [eax + 0x40]
mov edx, dword [ebp + 8]
imul edx, dword [edx - 0x74], 0x13
mov ecx, dword [esi]
mov ecx, dword [ecx + 0x30]
mov ecx, dword [ecx + 0x9c]
mov edx, dword [ecx + edx*8 + 0xc]
call fcn.004549b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x529a3e
lea eax, [ebp - 4]
call fcn.00406c74
ret
Function at 0x53506c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, ecx
mov esi, edx
mov ebx, eax
mov ebp, 0x5aa9b4
test esi, esi
jne 0x535086
xor eax, eax
jmp 0x535177
cmp dword [ebp], 0
jne 0x535091
call fcn.00534ffc
xor ebx, 0xffffffff
cmp edi, 8
jb 0x535151
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
sub edi, 8
cmp edi, 8
jae 0x53509d
test edi, edi
jbe 0x535172
movzx eax, byte [esi]
xor eax, ebx
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
dec edi
test edi, edi
ja 0x535155
mov eax, ebx
xor eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x55f740
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, ecx
mov edi, edx
mov ebx, eax
mov eax, ebx
call fcn.0055f72c
test eax, eax
jne 0x55f763
mov eax, esi
xor edx, edx
call fcn.00406c84
jmp 0x55f7f8
mov eax, ebx
call fcn.0055f890
test al, al
je 0x55f7ab
push 0
push 0
push 0xe
mov eax, dword [ebx + 0x4c]
push eax
call sub.user32.dll_SendMessageW
mov edi, eax
mov eax, esi
mov ecx, edi
xor edx, edx
call fcn.00406dc0
test edi, edi
je 0x55f7a0
mov eax, dword [esi]
push eax
inc edi
push edi
push 0xd
mov eax, dword [ebx + 0x4c]
push eax
call sub.user32.dll_SendMessageW
jmp 0x55f7f8
mov eax, esi
xor edx, edx
call fcn.00406c84
jmp 0x55f7f8
mov ebp, dword [ebx + 0x70]
test ebp, ebp
je 0x55f7ef
mov eax, dword [ebp + 0x270]
call fcn.00435e0c
test eax, eax
jle 0x55f7dd
mov eax, dword [ebx + 0x70]
mov eax, dword [eax + 0x270]
mov edx, edi
call fcn.00482b10
mov edx, dword [eax + 0xc]
mov eax, esi
call fcn.00406c84
jmp 0x55f7f8
mov eax, esi
mov edx, dword [ebx + 0x70]
mov edx, dword [edx + 0x278]
call fcn.00406c84
jmp 0x55f7f8
mov eax, esi
xor edx, edx
call fcn.00406c84
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x57a918
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe0
mov ebp, edx
mov ebx, eax
cmp dword [ebx + 0x74], 0
jne 0x57a930
mov eax, ebx
call fcn.0057a118
cmp dword [ebx + 0x70], 0
jne 0x57a93d
mov eax, ebx
call fcn.0057a0b0
mov eax, dword [ebx + 0x74]
mov edx, dword [eax]
call dword [edx + 0x30]
mov dword [esp], eax
mov eax, dword [ebx + 0x74]
mov edx, dword [eax]
call dword [edx + 0x24]
mov dword [esp + 4], eax
lea edx, [esp + 0x10]
mov eax, ebx
call fcn.00579f14
lea eax, [esp + 0x10]
xor edx, edx
call fcn.0057b0c0
cmp eax, dword [esp]
je 0x57a9ab
lea eax, [esp + 0x10]
xor edx, edx
call fcn.0057b0d4
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x57a987
adc edx, 0
push edx
lea eax, [esp + 0x14]
xor edx, edx
call fcn.0057b0c0
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x57a9a0
adc edx, 0
push edx
lea eax, [esp + 0x18]
push eax
call sub.user32.dll_InflateRect
mov esi, dword [ebx + 0x50]
test esi, esi
je 0x57a9c6
push 3
mov eax, dword [esi + 0x10]
call fcn.004b18ac
push eax
call sub.user32.dll_GetWindow
mov esi, eax
jmp 0x57a9d3
push 3
mov eax, dword [ebx + 0x58]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov edi, 0x610
mov edx, dword [esp + 0x10]
mov eax, dword [ebx + 0x70]
call fcn.004d56e8
mov edx, dword [esp + 0x14]
mov eax, dword [ebx + 0x70]
call fcn.004d5724
mov edx, dword [esp]
mov eax, dword [ebx + 0x70]
call fcn.004a7fa4
mov edx, dword [esp + 4]
mov eax, dword [ebx + 0x70]
call fcn.004a7fd8
lea ecx, [esp + 8]
xor edx, edx
xor eax, eax
call fcn.0040a8c8
mov eax, ebp
mov edx, dword [0x5a4680]
mov byte [edx + 2], al
mov eax, dword [0x5a4680]
mov byte [eax], 0
mov eax, dword [0x5a4680]
mov byte [eax + 1], 0
mov eax, dword [0x5a4680]
mov byte [eax + 3], 1
or edi, 2
or edi, 1
push edi
push 0
push 0
push 0
push 0
push esi
mov eax, dword [ebx + 0x70]
call fcn.004b18ac
push eax
call sub.user32.dll_SetWindowPos
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x70]
call fcn.004b18ac
push eax
call sub.user32.dll_GetWindowLongW
or eax, 0x80000
or eax, 0x8000000
or eax, 0x20
push eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x70]
call fcn.004b18ac
push eax
call sub.user32.dll_SetWindowLongW
push 2
mov eax, dword [0x5a4680]
push eax
push 0x1fffffff
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebx + 0x74]
call fcn.0045bfa4
call fcn.0045670c
push eax
lea eax, [esp + 0x14]
push eax
push 0
push esi
mov eax, dword [ebx + 0x70]
call fcn.004b18ac
push eax
mov eax, dword [0x5a4658]
mov eax, dword [eax]
call eax
push 4
mov eax, dword [ebx + 0x70]
call fcn.004b18ac
push eax
call sub.user32.dll_ShowWindow
push esi
push 0
call sub.user32.dll_ReleaseDC
add esp, 0x20
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x57bbf4
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffd48
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [esp], eax
mov eax, ebx
call fcn.00413d68
test al, al
je 0x57bc7b
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0x2b4
call fcn.00404a14
or esi, 0x100
test esi, esi
jns 0x57bc2f
call fcn.00404f68
push esi
push 0x2b4
lea eax, [esp + 0xc]
push eax
push 0
mov eax, ebx
call fcn.00406d10
push eax
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x57bc7b
mov dl, 1
mov eax, dword [0x452988]
call fcn.0045dc9c
mov dword [esp], eax
mov edx, dword [esp + 4]
mov eax, dword [esp]
call fcn.0045e130
mov eax, dword [esp]
mov edx, dword [eax]
call dword [edx + 0x20]
test al, al
je 0x57bc7b
mov eax, esp
call fcn.0041a9ac
mov eax, dword [esp]
add esp, 0x2b8
pop esi
pop ebx
ret
Function at 0x590c4c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe80
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x16c], ecx
mov dword [ebp - 0x170], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov esi, edx
lea edi, [ebp - 0x10c]
movzx ecx, byte [esi]
inc ecx
rep movsb byte es:[edi], byte [esi]
mov ebx, eax
xor eax, eax
push ebp
push 0x590df0
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x168]
xor eax, eax
call fcn.004045b8
mov eax, dword [ebp - 0x168]
lea edx, [ebp - 0x164]
call fcn.00414060
mov edx, dword [ebp - 0x164]
lea eax, [ebp - 4]
mov ecx, 0x590e0c
call fcn.00407158
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x16c]
call fcn.0041380c
push dword [ebp - 0x16c]
push 0x590e3c
lea eax, [ebp - 0x170]
lea edx, [ebp - 0x10c]
call fcn.00406fe8
push dword [ebp - 0x170]
lea eax, [ebp - 8]
mov edx, 3
call fcn.0040723c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x180], eax
mov byte [ebp - 0x17c], 0x11
mov eax, dword [ebp - 8]
mov dword [ebp - 0x178], eax
mov byte [ebp - 0x174], 0x11
lea edx, [ebp - 0x180]
mov ecx, 1
mov eax, 0x590e4c
call fcn.0041479c
lea eax, [ebp - 0x150]
xor ecx, ecx
mov edx, 0x44
call fcn.00404a14
mov dword [ebp - 0x150], 0x44
mov dword [ebp - 0x124], 1
mov word [ebp - 0x120], 1
lea eax, [ebp - 0x160]
push eax
lea eax, [ebp - 0x150]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.00406d10
push eax
mov eax, dword [ebp - 4]
call fcn.00406d10
push eax
call sub.kernel32.dll_CreateProcessW
cmp eax, 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x590dc5
mov eax, dword [ebp - 0x160]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x15c]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x590df7
lea eax, [ebp - 0x170]
mov edx, 4
call fcn.00406c7c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00406c7c
ret
Function at 0x5df878
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x5df921
test eax, edx
je 0x5df924
push 0
push 0
cmp word [eax - 0xa], 2
je 0x5df8a1
push edx
mov edx, eax
mov eax, esp
call fcn.005d63f8
pop edx
mov eax, dword [esp]
cmp word [edx - 0xa], 2
je 0x5df8b7
push eax
lea eax, [esp + 8]
call fcn.005d63f8
pop eax
mov edx, dword [esp + 4]
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x5df8c6
movzx eax, word [eax]
sub eax, ecx
jmp 0x5df8ed
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x5df907
add ecx, 4
js 0x5df8de
pop eax
pop ebx
mov ecx, esp
mov edx, dword [ecx]
or edx, dword [ecx + 4]
je 0x5df904
push eax
mov eax, ecx
mov edx, 2
call fcn.005d5a44
pop eax
pop edx
pop edx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x5df8eb
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x5df8ed
xor eax, eax
ret
test eax, eax
je 0x5df934
test edx, edx
jne 0x5df888
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x5e677f
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.005d5d54
mov ebp, eax
push 0
push 0
push ebp
push ebx
push 0
push 0xfde9
call fcn.005dab70
mov edi, eax
cmp edi, 0x104
jbe 0x5e67a2
mov eax, edi
add eax, eax
call fcn.005d3ab8
mov esi, eax
jmp 0x5e67a4
mov esi, esp
push edi
push esi
push ebp
push ebx
push 0
push 0xfde9
call fcn.005dab70
push edi
push esi
call fcn.005daf38
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x5e67dd
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x5e67c7
mov eax, esp
cmp esi, eax
je 0x5e67ea
mov eax, esi
call fcn.005d3ad4
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x5e6824
cmp bl, 0
je 0x5e6820
cmp bl, 0x41
jl 0x5e681b
cmp bl, 0x5a
jg 0x5e681b
or bl, 0x20
xor al, bl
inc esi
jmp 0x5e67ff
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x5e6764

Function at 0x613f10
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x613f16
ret
Function at 0x4025dd
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xc]
add eax, edx
add eax, 0x18
mov dword [ebp - 4], eax
jmp 0x40263c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
cmp dword [ebp + 0xc], eax
jb 0x402634
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x402634
mov eax, dword [ebp - 4]
jmp 0x402650
add dword [ebp - 8], 1
add dword [ebp - 4], 0x28
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 8], eax
jb 0x402611
mov eax, 0
leave
ret

Function at 0x402c8c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push edi
mov ecx, 8
push esi
mov esi, 0x405044
push ebx
sub esp, 0x250
mov eax, dword [0x407040]
mov dword [esp + 0x24c], eax
xor eax, eax
lea edi, [esp + 0x2c]
mov ebx, dword [esp + 0x260]
rep movsd dword es:[edi], dword [esi]
mov edx, eax
mov byte [esp + eax + 0x14c], al
and edx, 0x1f
mov dl, byte [esp + edx + 0x2c]
mov byte [esp + eax + 0x4c], dl
inc eax
cmp eax, 0x100
jne 0x402cba
xor esi, esi
xor edi, edi
movzx eax, byte [esp + esi + 0x14c]
add eax, edi
add al, byte [esp + esi + 0x4c]
movzx edi, al
lea eax, [esp + 0x14c]
add eax, esi
inc esi
mov dword [esp + 4], eax
lea eax, [esp + 0x14c]
add eax, edi
mov dword [esp], eax
call fcn.00402c00
cmp esi, 0x100
jne 0x402cda
mov edi, dword [esp + 0x264]
xor esi, esi
xor eax, eax
add edi, ebx
cmp edi, ebx
je 0x402d71
lea edx, [esi + 1]
lea ecx, [esp + 0x14c]
movzx esi, dl
add al, byte [esp + esi + 0x14c]
movzx eax, al
lea edx, [ecx + eax]
mov dword [esp + 0x1c], eax
mov dword [esp + 4], edx
lea edx, [ecx + esi]
mov dword [esp], edx
call fcn.00402c00
mov eax, dword [esp + 0x1c]
mov dl, byte [esp + eax + 0x14c]
add dl, byte [esp + esi + 0x14c]
movzx edx, dl
mov dl, byte [esp + edx + 0x14c]
xor byte [ebx], dl
inc ebx
jmp 0x402d1f
mov eax, dword [esp + 0x24c]
sub eax, dword [0x407040]
je 0x402d85
call fcn.00401770
mov eax, dword [esp + 0x264]
add esp, 0x250
pop ebx
pop esi
pop edi
ret