joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4209cb
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x420a0a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x420a0a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x420a0a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x420a0a
cmp dword [ecx + 0x74], 0xe
jbe 0x420a0a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x433180
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4331ad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4331ad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x408f6c
mov ecx, 0x491c469c
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data_1
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x674f660f
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x4704b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x48000]
push edi
jmp 0x4704ca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4704d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4704c0
mov eax, 1
add ebx, ebx
jne 0x4704e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4704f4
jne 0x470513
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x470513
dec eax
add ebx, ebx
jne 0x470500
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4704d8
add ebx, ebx
jne 0x47050f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x470565
xor ecx, ecx
sub eax, 3
jb 0x47052b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x47059a
sar eax, 1
mov ebp, eax
jmp 0x470536
add ebx, ebx
jne 0x470536
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x470504
inc ecx
add ebx, ebx
jne 0x470544
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x470504
add ebx, ebx
jne 0x470551
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x470546
jne 0x470562
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x470546
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x470584
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x470576
jmp 0x4704c6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x470584
add edi, ecx
jmp 0x4704c6
pop esi
mov edi, esi
mov ecx, 0xc57
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4705a2
cmp byte [edi], 9
jne 0x4705a2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4705a7
lea edi, [esi + 0x6d000]
mov eax, dword [edi]
or eax, eax
je 0x470616
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x74690]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x746f4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4705d4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x746f8]
or eax, eax
je 0x470610
mov dword [ebx], eax
add ebx, 4
jmp 0x4705f1
call dword [esi + 0x74708]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x470647
cmp al, 0xef
ja 0x47063a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x47061c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x470629
mov ebp, dword [esi + 0x746fc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x47067b
sub esp, 0xffffff80
jmp 0x40a34a
Function at 0x40c692
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
push edi
push dword [esi + 0x144]
lea ebx, [esi + 0x78]
push dword [esi + 0x20]
lea eax, [esi + 0x1f0]
push ebx
push eax
mov dword [ebp - 8], 1
call fcn.0041c36a
mov edi, eax
test edi, edi
jns 0x40c6cf
push 0x43be48
jmp 0x40c84f
lea eax, [esi + 0xe8]
push ebx
push eax
call fcn.004216d2
mov edi, eax
test edi, edi
jns 0x40c6ec
push 0x43be14
jmp 0x40c84f
cmp dword [esi + 0x268], 1
jne 0x40c740
lea eax, [ebp - 4]
push eax
push 1
lea ebx, [esi + 0x274]
push ebx
call fcn.0040d730
mov edi, eax
test edi, edi
jns 0x40c717
push 0x43bdd6
jmp 0x40c84f
push ebx
call fcn.0040d94c
mov edi, eax
test edi, edi
jns 0x40c72d
push 0x43bda8
jmp 0x40c84f
cmp dword [ebp - 4], 0
je 0x40c740
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 4], 0
lea eax, [ebp - 8]
push eax
lea eax, [esi + 0xe4]
push eax
push dword [esi + 0x144]
lea eax, [esi + 0x9c]
push dword [esi + 0x20]
lea ebx, [esi + 0x78]
push eax
push ebx
call fcn.00420734
mov edi, eax
xor eax, eax
cmp edi, eax
jge 0x40c776
push 0x43bd86
jmp 0x40c84f
cmp dword [ebp - 8], eax
jne 0x40c78e
push 0xe0000035
push 1
call fcn.0040c33a
xor edi, edi
jmp 0x40c855
cmp dword [esi + 0xa8], eax
je 0x40c7a9
cmp dword [esi + 0x20], 2
jle 0x40c7a9
lea ecx, [esi + 0x34]
push ecx
push eax
push dword [ebp + 8]
call fcn.0041f71c
push esi
push dword [ebp + 8]
call fcn.0041ba7a
mov edi, eax
test edi, edi
jns 0x40c7c2
push 0x43bb04
jmp 0x40c84f
push esi
call fcn.004170d2
mov edi, eax
test edi, edi
jns 0x40c7d5
push 0x43bd68
jmp 0x40c84f
push ebx
push dword [esi + 0x1c]
call fcn.0041d5c0
mov edi, eax
test edi, edi
jns 0x40c7eb
push 0x43bd48
jmp 0x40c84f
push ebx
lea eax, [esi + 0xe8]
push eax
call fcn.00411d84
mov edi, eax
test edi, edi
jns 0x40c805
push 0x43bd22
jmp 0x40c84f
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x40c82d
cmp word [eax], 0
je 0x40c82d
push 0
push eax
push 0x402658
push ebx
call fcn.00415a0e
mov edi, eax
test edi, edi
jns 0x40c82d
push 0x43bcd4
jmp 0x40c84f
and dword [ebp + 8], 0
lea eax, [ebp + 8]
push eax
mov eax, esi
call fcn.0040c53c
mov edi, eax
test edi, edi
js 0x40c84a
cmp dword [ebp + 8], 0
jne 0x40c82d
jmp 0x40c857
push 0x43bcbe
push edi
call fcn.004317fa
pop ecx
pop ecx
push esi
call fcn.0041b7a2
lea eax, [esi + 0x78]
push eax
call fcn.00416816
cmp dword [esi + 0x284], 0xffffffff
je 0x40c892
cmp dword [esi + 0x268], 1
jne 0x40c87d
mov eax, dword [esi + 0x18]
jmp 0x40c87f
xor eax, eax
push eax
push dword [esi + 0xe4]
lea eax, [esi + 0x274]
push eax
call fcn.0040dc3a
push dword [esi + 0x34]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x40c8ae
push 0
push 0
push 0x10
push dword [esi + 0x34]
call dword [sym.imp.USER32.dll_PostMessageW]
cmp dword [ebp - 4], 0
je 0x40c8bd
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop ebx
leave
ret 4
Function at 0x45e7d0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0
jmp 0x45e7f5
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0xc]
jae 0x45e868
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 8]
xor ecx, edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 8]
shr eax, 8
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
jmp 0x45e82a
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 8
jge 0x45e85d
mov edx, dword [ebp - 0x10]
and edx, 1
neg edx
sbb edx, edx
neg edx
mov byte [ebp - 0x15], dl
mov eax, dword [ebp - 0x10]
shr eax, 1
mov dword [ebp - 0x10], eax
movzx ecx, byte [ebp - 0x15]
test ecx, ecx
je 0x45e85b
mov edx, dword [ebp - 0x10]
xor edx, 0xedb88320
mov dword [ebp - 0x10], edx
jmp 0x45e821
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x45e7ec
mov eax, dword [ebp - 8]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x40a15c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov word [ebp + 0xc], ax
mov ebx, 0x19826993
mov eax, ebx
mul ebx
mov dword [ebp - 0x10], eax
mov ebx, eax
xor esi, esi
mov eax, ebx
mul ebx
mov dword [ebp - 0x14], eax
mov ebx, eax
mov word [ebp - 0xc], 0
jmp 0x40a272
mov eax, ebx
xor eax, ebx
mov ebx, eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.00405066
pop ecx
mov edx, eax
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
jne 0x40a1b3
mov byte [ebp - 2], 0
jmp 0x40a1dd
call fcn.0040ddd8
mov dword [ebp - 0x18], eax
mov eax, 0x7fff
mov edi, 7
movzx edx, byte [ebp - 1]
mov ecx, edi
sub ecx, edx
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x18]
cdq
idiv ecx
mov edx, eax
mov byte [ebp - 2], dl
mov eax, dword [ebp + 8]
mov al, byte [esi + eax]
cmp al, 0x70
jb 0x40a1fc
cmp al, 0x7f
ja 0x40a1fc
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, dword [ebp + 8]
movzx eax, byte [esi + eax]
cmp eax, 0xe2
jne 0x40a21b
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 8
push 0x90
lea eax, [ebp - 0xa]
push eax
call fcn.0040ddc0
movzx eax, byte [ebp - 1]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
lea eax, [ebp - 0xa]
movzx edx, byte [ebp - 2]
add eax, edx
push eax
call fcn.0040ddb4
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 6
lea eax, [ebp - 0xa]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.0040ddb4
add esp, 0x24
mov eax, ebx
add eax, ebx
mov ebx, eax
add esi, 6
inc word [ebp - 0xc]
movzx eax, word [ebp + 0xc]
dec eax
cmp esi, eax
jb 0x40a190
pop edi
pop esi
pop ebx
leave
ret

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x4d220947
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
loop 0x433060
nop
nop
nop
nop
mov eax, section..text_1
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4330d2
nop
mov ebx, 0x4304d8
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x1f1644b0
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40915c
nop
mov ecx, 0x5d901049
nop
nop
test eax, eax
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x431024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x20540559
nop
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x46bc80
Capabilities:
Terminate process

Disassembly:
adc eax, sym.imp.KERNEL32.dll_LoadLibraryA
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x54]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x48]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x6c]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
push ecx
mov edx, dword [ebp - 0x38]
call edx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x46bd00
jmp 0x46be7c
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x74]
push ecx
push 0
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x28]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x3c]
call edx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x46bd30
jmp 0x46be7c
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x78]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x40]
call edx
test eax, eax
je 0x46bd5d
cmp dword [ebp - 0x28], 0
jbe 0x46bd5d
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
jmp 0x46bd30
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x14]
jne 0x46bd6f
jmp 0x46be7c
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 8], 0
jmp 0x46bd89
mov ecx, dword [ebp - 8]
add ecx, 4
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0x20
jge 0x46bda8
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x40]
mov ecx, dword [ebp - 8]
mov edx, dword [eax + ecx]
add edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 8]
mov dword [eax], edx
jmp 0x46bd80
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x44]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x46bdc9
jmp 0x46be7c
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x1c]
mov dword [ebp - 0xc], ecx
lea edx, [ebp - 0x30]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x18]
push ecx
push 0x4000
mov edx, dword [ebp - 0xc]
push edx
call dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x24]
add ecx, dword [ebp - 0x48]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 4]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 8], 8
jmp 0x46be10
mov ecx, dword [ebp - 8]
add ecx, 4
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0x4000
jge 0x46be2e
mov edx, dword [ebp - 0x14]
add edx, dword [ebp - 8]
invalid
Function at 0x4dade0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5c9988
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
push ebx
push ebp
mov ebp, ecx
push esi
xor ebx, ebx
mov dword [esp + 0x10], ebp
mov esi, dword [ebp + 0xa0]
cmp esi, ebx
mov dword [esp + 0xc], esi
je 0x4daf79
mov eax, dword [ebp + 0x78]
push eax
call dword [sym.imp.USER32.dll_LockWindowUpdate]
mov eax, dword [esi + 8]
cmp eax, 1
lea ecx, [eax + 1]
mov dword [esp + 0x18], ecx
jne 0x4dae34
mov dword [ebp + 0xa8], ebx
cmp ecx, ebx
jle 0x4daf69
push edi
add ebp, 0x5c
push 0
push 0
push 0
push 0
push 0x63f7e8
push ebx
push 1
mov ecx, ebp
call fcn.0058c250
test ebx, ebx
mov esi, eax
je 0x4dae91
mov ecx, dword [esp + 0x10]
lea edi, [ebx + ebx*2]
mov edx, dword [ecx + 4]
lea edi, [edi + edi*8]
shl edi, 1
sub edi, ebx
mov ecx, ebp
shl edi, 2
mov eax, dword [edx + edi - 0xd0]
push eax
push 1
push esi
call fcn.0058c315
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx + 4]
mov eax, dword [edx + edi - 0x44]
push eax
jmp 0x4daece
lea ecx, [esp + 0x18]
push 0xa2f3
push ecx
call fcn.004ec350
add esp, 8
mov eax, dword [eax]
mov ecx, ebp
push eax
push 1
push esi
mov dword [esp + 0x5c], 0
call fcn.0058c315
lea ecx, [esp + 0x18]
mov dword [esp + 0x50], 0xffffffff
call fcn.005936db
push 0x63f7e8
push 2
push esi
mov ecx, ebp
call fcn.0058c315
lea eax, [ebx - 1]
mov ecx, ebp
push eax
push 0
push 0
push 0
push 0
push 4
push 0
push esi
call fcn.0058c29c
mov ecx, 0xa
xor eax, eax
lea edi, [esp + 0x20]
xor edx, edx
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x24], esi
lea eax, [ebx - 1]
mov dword [esp + 0x20], 2
mov esi, dword [ecx + 0xa8]
mov dword [esp + 0x28], edx
cmp esi, eax
jne 0x4daf28
cmp dword [ecx + 0xac], edx
jne 0x4daf34
cmp dword [ecx + 0xac], edx
jne 0x4daf3e
cmp ebx, edx
jne 0x4daf3e
mov dword [esp + 0x3c], 1
jmp 0x4daf42
mov dword [esp + 0x3c], edx
mov ecx, dword [ecx + 0x78]
lea eax, [esp + 0x20]
push eax
push edx
push 0x1006
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [esp + 0x1c]
inc ebx
cmp ebx, eax
jl 0x4dae40
mov ebp, dword [esp + 0x14]
pop edi
push 0
call dword [sym.imp.USER32.dll_LockWindowUpdate]
lea ecx, [ebp + 0x5c]
call fcn.00592e45
mov ecx, dword [esp + 0x44]
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x44
ret

Function at 0x4dc430
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push edi
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
or eax, 0xffffffff
test ecx, ecx
jle 0x4dc46a
push esi
mov esi, ecx
xor ecx, ecx
mov edi, eax
mov cl, byte [edx]
and edi, 0xff
xor ecx, edi
shr eax, 8
mov ecx, dword [ecx*4 + 0x5e6750]
xor eax, ecx
inc edx
dec esi
jne 0x4dc44b
pop esi
not eax
pop edi
ret
Function at 0x502af0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5cd073
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push esi
mov esi, ecx
push eax
mov dword [esp + 8], esi
call fcn.00593749
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0
push ecx
lea ecx, [esi + 4]
call fcn.00593749
mov edx, dword [esp + 0x20]
lea ecx, [esi + 8]
push edx
mov byte [esp + 0x14], 1
call fcn.00593749
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x30]
mov dword [esi + 0x10], ecx
mov ecx, dword [esp + 0x34]
mov dword [esi + 0x14], edx
mov edx, dword [esp + 0x38]
mov dword [esi + 0x18], eax
mov eax, dword [esp + 0x3c]
mov dword [esi + 0x1c], ecx
mov ecx, dword [esp + 0x40]
mov dword [esi + 0x20], edx
mov edx, dword [esp + 0x44]
mov dword [esi + 0x24], eax
mov eax, dword [esp + 0x48]
mov dword [esi + 0x28], ecx
mov ecx, dword [esp + 0x4c]
mov dword [esi + 0x2c], edx
mov edx, dword [esp + 0x50]
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], ecx
mov ecx, dword [esp + 8]
mov dword [esi + 0x38], edx
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x3c

Function at 0x502bd0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x5cd0b6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov eax, dword [0x639698]
mov ebp, dword [edi + 8]
sub esp, 0x40
mov dword [esp + 0x5c], 0
mov esi, esp
mov dword [esp + 0x50], esp
mov dword [esp + 0x50], esi
mov dword [esi], eax
mov ecx, dword [0x639698]
lea ebx, [esi + 4]
mov dword [ebx], ecx
mov edx, dword [0x639698]
mov dword [esi + 8], edx
lea eax, [esp + 0x64]
mov ecx, esi
push eax
mov byte [esp + 0x60], 3
call fcn.00593814
lea ecx, [esp + 0x68]
push ecx
mov ecx, ebx
call fcn.00593814
lea edx, [esp + 0x6c]
lea ecx, [esi + 8]
push edx
call fcn.00593814
mov eax, dword [esp + 0x70]
push ebp
mov dword [esi + 0xc], eax
mov ecx, dword [esp + 0x78]
mov dword [esi + 0x10], ecx
mov edx, dword [esp + 0x7c]
mov dword [esi + 0x14], edx
mov eax, dword [esp + 0x80]
mov dword [esi + 0x18], eax
mov ecx, dword [esp + 0x84]
mov dword [esi + 0x1c], ecx
mov edx, dword [esp + 0x88]
mov eax, dword [esp + 0x8c]
mov dword [esi + 0x20], edx
mov dword [esi + 0x24], eax
mov ecx, dword [esp + 0x90]
mov edx, dword [esp + 0x94]
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], edx
mov eax, dword [esp + 0x98]
mov ecx, dword [esp + 0x9c]
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], ecx
mov edx, dword [esp + 0xa0]
mov ecx, edi
mov dword [esi + 0x38], edx
mov byte [esp + 0x60], 0
call fcn.00503000
lea ecx, [esp + 0x2c]
mov dword [esp + 0x1c], 5
call fcn.005936db
lea ecx, [esp + 0x28]
mov byte [esp + 0x1c], 4
call fcn.005936db
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0xffffffff
call fcn.005936db
mov ecx, dword [esp + 0x14]
pop edi
mov eax, ebp
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x10
ret 0x40
Function at 0x58ef06
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov eax, ebx
push edi
mov edi, ecx
shr eax, 0x10
test ax, ax
mov dword [edi + 0x40], ebx
jne 0x58ef28
cmp dword [edi + 0x3c], 0
jne 0x58ef28
movzx eax, bx
mov dword [edi + 0x3c], eax
call fcn.005aa82c
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov ecx, edi
push dword [esp + 0x18]
push eax
call fcn.0058ef55
pop edi
pop esi
pop ebx
ret 8

Function at 0x58efa3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
call fcn.005aa82c
mov esi, dword [eax + 0xc]
push 5
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x58efd4
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push esi
mov ecx, ebx
push dword [esp + 0x18]
push edi
call fcn.0058efe7
pop edi
pop esi
pop ebx
ret 8