joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5557a0
Capabilities:
Create process on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6142a9
mov eax, dword fs:[0]
push eax
sub esp, 0x94
mov eax, dword [0x6b000c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x98]
mov dword [ebp - 0x9c], 0
push edx
mov ecx, dword [eax + 0x110]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x98]
mov edi, dword [sym.imp.ycomuiu.dll_public:_bool___thiscall_DuiLib::CStdString::operator_wchar_t_const__const]
push str.btnClose
call edi
test al, al
je 0x555818
mov ecx, esi
call fcn.005559e0
jmp 0x55592a
push str.btnCancle
lea ecx, [ebp - 0x98]
call edi
test al, al
jne 0x55580c
push str.btnUpdate
lea ecx, [ebp - 0x98]
call edi
test al, al
je 0x555895
push str.tabMain
lea ecx, [esi + 0x34]
call dword [sym.imp.ycomuiu.dll_public:_class_DuiLib::CControlUI____thiscall_DuiLib::CPaintManagerUI::FindControl_wchar_t_const__const]
test eax, eax
je 0x555856
push 1
mov ecx, eax
call dword [sym.imp.ycomuiu.dll_public:_bool___thiscall_DuiLib::CTabLayoutUI::SelectItem_int_]
push 0
push str.btnUpdate
mov ecx, esi
call dword [sym.imp.ycomuiu.dll_public:_void___thiscall_DuiLib::WindowImplBase::ShowWindow_wchar_t_const___bool_]
lea eax, [ebp - 0xa0]
mov dword [esi + 0x908], 0
push eax
push 0
push esi
push 0x555ae0
push 0
push 0
call fcn.005b6ff3
add esp, 0x18
mov dword [esi + 0x904], eax
jmp 0x55592a
push str.btnInst
lea ecx, [ebp - 0x98]
call edi
test al, al
je 0x55592a
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xa0]
mov edx, dword [0x6b9640]
push str.WnRecoverSetup6.exe
call fcn.0048e450
add esp, 4
mov dword [ebp - 0x9c], 1
push 0xa
push 0
push 0
push dword [ebp - 0xa0]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 1
mov ecx, esi
call dword [sym.imp.ycomuiu.dll_public:_void___thiscall_DuiLib::CWindowWnd::Close_unsigned_int_]
mov eax, 1
mov dword [ebp - 0x9c], eax
and eax, 0xfffffffe
mov dword [ebp - 0x9c], eax
mov byte [ebp - 4], 0
or eax, 0xffffffff
mov edx, dword [ebp - 0xa0]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x55592a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x98]
call dword [sym.imp.ycomuiu.dll_public:_void___thiscall_DuiLib::CStdString::destructor_void_]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055f9be
mov esp, ebp
pop ebp
ret 4
Function at 0x555b80
Capabilities:
Delete file
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x614361
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push edi
mov eax, dword [0x6b000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
mov edx, dword [0x6b9640]
push str.WnRecoverSetup6.exe
call fcn.0048e450
add esp, 4
mov dword [ebp - 0x14], 1
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, ebx
lea eax, [ebx + 0x900]
neg ecx
sbb ecx, ecx
and ecx, eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x1c], ecx
call fcn.005552d0
mov byte [ebp - 4], 1
push ecx
push dword [ebp - 0x18]
lea ecx, [ebp - 0x1c]
push dword [eax]
call fcn.00413470
test eax, eax
sete byte [ebp - 0xd]
mov byte [ebp - 4], 0
or edi, 0xffffffff
mov edx, dword [ebp - 0x20]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x555c30
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 0xd], 0
push 0
je 0x555ccb
push 1
push str.HasNewInstaller
push str.main
mov ecx, 0x6b8f68
call fcn.0048e650
mov ecx, dword [0x6b1ba4]
mov eax, dword [ecx - 0xc]
test eax, eax
je 0x555c7a
add eax, eax
push eax
push ecx
push 1
push str.DownloadedUpdateVersion
push 0x650fc8
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 0
push 4
call fcn.0046a2d0
push 1
push str.btnInst
mov ecx, ebx
call dword [sym.imp.ycomuiu.dll_public:_void___thiscall_DuiLib::WindowImplBase::ShowWindow_wchar_t_const___bool_]
push 0
push str.btnCancle
mov ecx, ebx
call dword [sym.imp.ycomuiu.dll_public:_void___thiscall_DuiLib::WindowImplBase::ShowWindow_wchar_t_const___bool_]
push 0x650a3c
mov edx, str.NowInstUpdate
lea ecx, [ebp - 0x20]
call fcn.004db870
add esp, 4
mov byte [ebp - 4], 3
mov ecx, ebx
push dword [eax]
push str.Title
call dword [sym.imp.ycomuiu.dll_public:_int___thiscall_DuiLib::WindowImplBase::SetDlgItemTextW_wchar_t_const___wchar_t_const__]
jmp 0x555d00
push str.progress
mov ecx, ebx
call dword [sym.imp.ycomuiu.dll_public:_void___thiscall_DuiLib::WindowImplBase::ShowWindow_wchar_t_const___bool_]
push 0x650a3c
mov edx, str.DownloadErr
lea ecx, [ebp - 0x20]
call fcn.004db870
add esp, 4
mov byte [ebp - 4], 5
mov ecx, ebx
push dword [eax]
push str.Title
call dword [sym.imp.ycomuiu.dll_public:_int___thiscall_DuiLib::WindowImplBase::SetDlgItemTextW_wchar_t_const___wchar_t_const__]
mov byte [ebp - 4], 0
mov eax, edi
mov edx, dword [ebp - 0x20]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x555d1e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, 1
mov dword [ebp - 0x14], eax
and eax, 0xfffffffe
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x555d4b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x55aaa0
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
lea eax, [ebp - 8]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 4]
mov dword [ebp - 8], 4
push eax
push 0
push str.type
push dword [0x6b9660]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
test eax, eax
jne 0x55aafd
mov eax, dword [ebp - 4]
cmp eax, 2
ja 0x55aafd
test eax, eax
je 0x55aafd
push str.UserName
push dword [0x6b9660]
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.UserID
push dword [0x6b9660]
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.NickName
push dword [0x6b9660]
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.type
push dword [0x6b9660]
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.token
push dword [0x6b9660]
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push 0x650ee8
push dword [0x6b9660]
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push 0x650edc
push dword [0x6b9660]
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov ecx, 0x6b9698
call fcn.0040cb90
mov byte [0x6b6c1b], 0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x55d9b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x615d6f
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x6b000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.CWebBrowserDlg.4.0
mov dword [esi + 0x10], vtable.CWebBrowserDlg.2.0
mov dword [esi + 0x24], vtable.CWebBrowserDlg.3.0
mov dword [esi + 0x28], vtable.CWebBrowserDlg.0
mov dword [esi + 0x2c], vtable.CWebBrowserDlg.6.0
mov dword [esi + 0x30], vtable.CWebBrowserDlg.1.0
mov dword [esi + 0x900], 0x662e64
mov dword [ebp - 4], 4
lea ecx, [esi + 0x94c]
call fcn.00476270
mov byte [ebp - 4], 3
lea ecx, [esi + 0x934]
call fcn.00476270
mov byte [ebp - 4], 2
lea eax, [esi + 0x91c]
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 2
or edi, 0xffffffff
mov edx, dword [eax]
mov eax, edi
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x55da5d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 1
lea eax, [esi + 0x918]
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
mov edx, dword [eax]
mov eax, edi
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x55da87
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
lea eax, [esi + 0x914]
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 0
mov edx, dword [eax]
sub edx, 0x10
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x55daaf
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov dword [esi], vtable.MyBaseWindow.5.0
mov dword [esi + 0x10], vtable.MyBaseWindow.2.0
mov dword [esi + 0x24], vtable.MyBaseWindow.1.0
mov dword [esi + 0x28], vtable.MyBaseWindow.4.0
mov dword [esi + 0x2c], vtable.MyBaseWindow.0
mov dword [esi + 0x30], vtable.MyBaseWindow.3.0
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call dword [sym.imp.ycomuiu.dll_public_virtual:_void___thiscall_DuiLib::WindowImplBase::destructor_void_]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x584d90
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x619aa8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push esi
push edi
mov eax, dword [0x6b000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 0x10], 0
mov edi, dword [ebp + 8]
jne 0x584dd8
mov eax, 0x80004003
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
xor eax, eax
lea esi, [edi + 4]
cmp edi, 0xc
cmove esi, eax
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
xorps xmm0, xmm0
mov eax, dword [ebp + 0x10]
movups xmmword [eax], xmm0
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx + 8]
mov dword [ebp + 8], eax
test eax, eax
je 0x584e8b
dec eax
test dword [ebp - 0x1c], eax
jne 0x584e8b
cmp dword [edi + 0x44], 1
jne 0x584e27
mov edi, 0x8004020f
jmp 0x584e90
mov eax, dword [edi + 0x20]
cmp eax, dword [edi + 0x30]
jge 0x584e36
mov edi, 0x80040210
jmp 0x584e90
mov eax, dword [ecx + 0xc]
mov ecx, dword [ecx + 4]
add ecx, eax
mov dword [ebp - 0x10], eax
mov eax, ecx
cdq
idiv dword [ebp + 8]
test edx, edx
je 0x584e52
mov eax, dword [ebp + 8]
sub eax, edx
add ecx, eax
sub ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edi + 0x34], ecx
mov dword [ebp + 8], ecx
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov dword [ecx + 4], eax
mov eax, dword [edx]
mov dword [edi + 0x2c], eax
mov dword [ecx], eax
mov eax, dword [edx + 8]
mov dword [edi + 0x38], eax
mov dword [ecx + 8], eax
mov eax, dword [edx + 0xc]
mov dword [edi + 0x3c], eax
mov dword [ecx + 0xc], eax
mov dword [edi + 0x40], 1
xor edi, edi
jmp 0x584e90
mov edi, 0x8004020e
mov dword [ebp - 4], 0xffffffff
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x5cb84c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005cb451

Function at 0x5cb857
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005cb5d2

Function at 0x5d1875
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005d1065

Function at 0x5d1880
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005d12a0

Function at 0x5d2440
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005d2234
Function at 0x40566c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
mov byte [ebp - 4], 0x13
mov byte [ebp - 3], 0x35
mov byte [ebp - 2], 0x86
mov byte [ebp - 1], 7
call dword [fcn.004b0368]
mov ebx, eax
push ebx
call fcn.00445c46
mov esi, eax
pop ecx
test esi, esi
je 0x4056ba
xor edx, edx
test ebx, ebx
jbe 0x4056ba
sub edi, esi
mov eax, edx
and eax, 3
mov al, byte [ebp + eax - 4]
lea ecx, [edx + esi]
xor al, byte [edi + ecx]
inc edx
mov byte [ecx], al
cmp edx, ebx
jb 0x4056a4
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x46d55c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
mov byte [ebp - 4], 0x13
mov byte [ebp - 3], 0x35
mov byte [ebp - 2], 0x86
mov byte [ebp - 1], 7
call dword [fcn.004b0368]
mov ebx, eax
push ebx
call fcn.004adb36
mov esi, eax
pop ecx
test esi, esi
je 0x46d5aa
xor edx, edx
test ebx, ebx
jbe 0x46d5aa
sub edi, esi
mov eax, edx
and eax, 3
mov al, byte [ebp + eax - 4]
lea ecx, [edx + esi]
xor al, byte [edi + ecx]
inc edx
mov byte [ecx], al
cmp edx, ebx
jb 0x46d594
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x4a172c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
mov byte [ebp - 4], 0x13
mov byte [ebp - 3], 0x35
mov byte [ebp - 2], 0x86
mov byte [ebp - 1], 7
call dword [fcn.004b0368]
mov ebx, eax
push ebx
call fcn.004e1d06
mov esi, eax
pop ecx
test esi, esi
je 0x4a177a
xor edx, edx
test ebx, ebx
jbe 0x4a177a
sub edi, esi
mov eax, edx
and eax, 3
mov al, byte [ebp + eax - 4]
lea ecx, [edx + esi]
xor al, byte [edi + ecx]
inc edx
mov byte [ecx], al
cmp edx, ebx
jb 0x4a1764
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x4ceba0
Capabilities:
Authenticate hmac

Disassembly:
clc
inc esp
mov dh, 0x9c
xchg byte [ebx], dh
inc esi
and eax, dword [ecx - 0x7d]
and al, 0x26
push 0x33
cmp dword [ecx], edx
out 0x22, al
and eax, 0xd8066c4f
push ss
shr dword [ecx + 0x1605d180], 1
das
xchg esp, eax
push esp
ficomp word [ebx + 4]
jo 0x4ceb46
jle 0x4cebfc
inc edi
sal dword [esi], 0x5c

Function at 0x4d51bc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
mov byte [ebp - 4], 0x13
mov byte [ebp - 3], 0x35
mov byte [ebp - 2], 0x86
mov byte [ebp - 1], 7
call dword [fcn.004b0368]
mov ebx, eax
push ebx
call fcn.00515796
mov esi, eax
pop ecx
test esi, esi
je 0x4d520a
xor edx, edx
test ebx, ebx
jbe 0x4d520a
sub edi, esi
mov eax, edx
and eax, 3
mov al, byte [ebp + eax - 4]
lea ecx, [edx + esi]
xor al, byte [edi + ecx]
inc edx
mov byte [ecx], al
cmp edx, ebx
jb 0x4d51f4
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4e1d06
Capabilities:
Encode data using xor

Disassembly:
adc ecx, dword [0xff5729b8]
dec edi
jg 0x4e1d00
aad 0x26
sar dword [edi], cl
movsb byte es:[edi], byte [esi]
add eax, 0x6b5f36a9
aam 0xcf
xchg ebp, eax
or byte [esi + 0x5da79c6d], ah
cmp byte [ebp + 0x4a8036e], bh
stosd dword es:[edi], eax
xchg ebx, eax
iretd
mov ebx, 0x3ae24355
mov ss, word [edx + ebx - 0x5b]
push esp
invalid
movsd dword es:[edi], dword [esi]
push ebp
pop ebx
in eax, dx
loopne 0x4e1d84
or eax, 0xaebbbce6
invalid
push esi
xchg esp, eax
mov esp, ebp
xor dword [edi], 0xfffffffa
dec esi
and ah, byte [esi + 0x7c]
invalid
dec ecx
dec ebp
and eax, 0xc11c0f36
into
inc edi
ror esi, 0x47
jnp 0x4e1d33
cmpsd dword cs:[esi], dword es:[edi]
test eax, 0x4c21d33c
dec dword [edi + 0x179776a1]
inc ebp
sbb byte [esi + 0x44ee90fe], bh
inc ecx
xchg byte [eax + 0x2814bb30], ch
xor al, 0x1e
mov dh, 0x44
xor eax, 0xd4c2cece
fnstenv [esi + 2]
inc ebx
cmp eax, 0xc94fa44
xor al, 0xbb
jno 0x4e1d7e
retf

Function at 0x50969c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
mov byte [ebp - 4], 0x13
mov byte [ebp - 3], 0x35
mov byte [ebp - 2], 0x86
mov byte [ebp - 1], 7
call dword [fcn.004b0368]
mov ebx, eax
push ebx
call fcn.00549c76
mov esi, eax
pop ecx
test esi, esi
je 0x5096ea
xor edx, edx
test ebx, ebx
jbe 0x5096ea
sub edi, esi
mov eax, edx
and eax, 3
mov al, byte [ebp + eax - 4]
lea ecx, [edx + esi]
xor al, byte [edi + ecx]
inc edx
mov byte [ecx], al
cmp edx, ebx
jb 0x5096d4
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x536fca
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [0xa2bab515]
or eax, 0x3080034b
test al, 0xa5
jns 0x536eda
pop esi
lds edx, [0xaab1a360]
jle 0x536ec2
and cl, byte [edx]
inc ecx
test al, 0x11
out 0x1d, al
and dword [edi + 0x2ac289c0], edx
ror byte [ecx + 0x40802ac2], 0x15
loop 0x536fbb
add byte [eax + 0x15], 0xe2
je 0x536f3e
idiv byte [esi + 7]
jle 0x536f51
jo 0x536f42
salc
cmc
adc dword [ecx - 0x494a645d], esp
wait
mov ch, 0xb6
xchg ebp, eax
hlt
mov word [0xe5841480], ax
push ebx
aad 0
dec ebp
jmp 0x536f2a
add al, 0x60
xlatb
push 0x66c823f0
mov eax, dword [0x454ed640]
jo 0x536f88
sbb dword [ebx + esi - 0x6182712f], 0xf5375176
inc esp
sal byte [edi], 1
out dx, al
pop edi
invalid
inc ecx
loop 0x536fd1
stc
jecxz 0x536f9d
js 0x536fe3
adc dword [ecx + 0x4106b440], ebp
test eax, 0x4106b440
and eax, 0xdc7868d2
push edx
pushal
add bl, 0xc1
adc al, 0xb9
pushal
lodsd eax, dword [esi]
invalid

Function at 0x538167
Capabilities:
Encode data using xor

Disassembly:
je 0x538139
shl dword [edi + 0x2a], cl
dec ecx
mov esi, 0x1de58150
arpl word [esi + ebx*4 - 0x36a6c1af], dx
xchg edi, eax
push eax
dec ecx
adc al, 0xb5
cmp cl, bl
mov edi, 0xc8c69725
lahf
shl byte [eax + 1], cl
sub eax, 0x7374481b
xchg esi, eax
scasd eax, dword es:[edi]
sbb ebx, esi
sub dword [edi], edi
sbb al, 0x4e
cmp edi, dword [eax + 0x3e]
call 0xb9112d86
cmp eax, dword [bp + si]
rol bh, 1
out 0x94, al
adc byte [edx - 0x339697f], ch
cwde
and cl, dl
mov word [eax - 0x4d66cfc5], gs
push ss
ror edi, cl
invalid
Function at 0x5723ec
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
mov byte [ebp - 4], 0x13
mov byte [ebp - 3], 0x35
mov byte [ebp - 2], 0x86
mov byte [ebp - 1], 7
call dword [fcn.004b0368]
mov ebx, eax
push ebx
call 0x5b29c6
mov esi, eax
pop ecx
test esi, esi
je 0x57243a
xor edx, edx
test ebx, ebx
jbe 0x57243a
sub edi, esi
mov eax, edx
and eax, 3
mov al, byte [ebp + eax - 4]
lea ecx, [edx + esi]
xor al, byte [edi + ecx]
inc edx
mov byte [ecx], al
cmp edx, ebx
jb 0x572424
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x59ea78
Capabilities:
Encode data using xor

Disassembly:
sti
pop ebx
neg byte [edi - 0x56ffd6fb]
pop esi
test al, 0x9c
mov ebp, 0x59c9eb0a
sti
mov dh, 0x5b
popal
push ds
rcr dword [ecx - 0x1c], 0x2c
mov ecx, dword [eax + 0x714f4b95]
cmc
mov byte [ebp - 0xa8eb0b5], dl
xor byte [edx + 0x2d], ch
fisub word [edi + 0x5b]
mov al, 0xe8
out dx, al
outsd dx, dword [esi]
test dword [esi + 0x7d], esp
jge 0x59ea66
jge 0x59ea66
pop esp
jae 0x59ea4b
inc ebp
les esp, [eax + 0x190ceb12]
and dword [edx + 0x1fb32c66], esp
insb byte es:[edi], dx
jecxz 0x59eab3
insb byte es:[edi], dx
lds ebp, [edx + 0x23]
cwde
mov ebx, dword [eax + 0x4429af36]
sub eax, esi
popfd
stosb byte es:[edi], al
leave
push esp
mov ecx, 0x6b54dc91
wait
pop esp
sub ch, byte [ebp - 0x56]
pop edi
jecxz 0x59eb16
push 0x72e8ada2
sub dword [eax], esi
dec ecx
push ss
xor byte [ecx + 0x16], cl
push ebx
dec ebx
retf
mov esi, 0x6808d992
ljmp 0xc74a
Function at 0x4ec47e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5894dc]
jne 0x4ec488
repz ret
jmp fcn.004f03b1

Function at 0x4ec983
Capabilities:
Encrypt data using rc4 prga

Disassembly:
inc ebx
mov ebx, 0xfbcdda40
lea ebp, [0x167dfce5]
sub eax, 0x167dfce5
mov ebx, 0x4960e931
xchg bl, ch
imul edx, edx, 0xde44ae72
sub eax, 0x46
imul ecx, ebx, 0x500bcff9
add eax, 0x45
cmp cl, 0x1e
movsx ebx, ch
mov edx, 0xe1a0dda1
movzx edi, al
sbb cl, dl
rol dword [edx + 0x3d], 1
invalid
add eax, dword [eax]
invalid
jae 0x4ec93d
inc dl
lea ebx, [0xdc7a8095]
mov ah, ch
xchg eax, ecx
sbb dl, dl
imul ebx, edi, 0xfebb16a7
sub edi, 0xfff4e9d2
mov ebx, 0xc9620cb
lea ebp, [0xf2c2e7fe]
sub edi, 0xc055f
pop ebx
adc ecx, 0x5e2c41b3
xor dh, 0x3d
sbb ebp, 0x8d2623bb
test ebx, ecx
ja 0x4ec9cb
imul edx, esi, 0x87f9fddf
jb 0x4ec9d7
mov ecx, 0x30e34645
test ecx, ecx
xchg edx, edx
xchg dl, dh
or ebp, esi
xor dl, bl
sbb dl, 0x85
dec ebp
xchg edx, ebp
imul eax, edi
inc ch
movzx eax, dx
add ebx, 0xc238b
jae 0x4ec9ff
inc dh
imul ebp, edx
imul ebp, edx, 0x491886a6
add ebx, 0x3b5
test esi, eax
jno 0x4eca0b
adc ch, ah
adc esi, 0xca64a9fe
adc eax, eax
test dl, 0xb4
mov esi, edx
inc edi
or dh, 0x74
cmp ecx, 0xed5
test edi, 0x700b586d
add al, 0xb1
imul edx, edi
mov ah, cl
jmp 0x4eca36
push 0xc32611
push ebx
imul edi, ecx
push ebx
and edx, 0x32feda92
movzx edx, bl
imul ebp, eax
add edi, 0x7c0c
or dl, 0xd2
sbb al, 0x4d
add edi, 0xb40
sub esi, esi
cmp edi, eax
mov ah, dl
movsx ecx, dx
xchg ecx, edx
inc ecx
mov edx, edx
add esi, 0xfffff5af
movzx ebp, dh
lea ecx, [0x8cb4fcd]
add esi, 0xa52
lea ebp, [0x7a1e7098]
imul edi, esi, 0x109a58b9
and al, 0x7f
test ebx, 0xb765d560
movzx edi, ah
cmp esi, 0x3af
jb 0x4eca60
cmp al, bh
dec edx
sbb ecx, ebp
ret
Function at 0x4fad5d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004f0f31
and dword [ebp - 4], 0
cmp dword [0x58e070], 0
mov ebx, eax
jne 0x4fae0e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4faebf
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4faebf
push eax
call fcn.004f0ebf
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x58e070], eax
call esi
push eax
call fcn.004f0ebf
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x58e074], eax
call esi
push eax
call fcn.004f0ebf
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x58e078], eax
call esi
push eax
call fcn.004f0ebf
pop ecx
mov dword [0x58e080], eax
test eax, eax
je 0x4fae0e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004f0ebf
pop ecx
mov dword [0x58e07c], eax
mov eax, dword [0x58e07c]
cmp eax, ebx
je 0x4fae66
cmp dword [0x58e080], ebx
je 0x4fae66
push eax
call fcn.004f0f3a
push dword [0x58e080]
mov esi, eax
call fcn.004f0f3a
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4fae66
test edi, edi
je 0x4fae66
call esi
test eax, eax
je 0x4fae5d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4fae5d
test byte [ebp - 0xc], 1
jne 0x4fae66
or dword [ebp + 0x10], 0x200000
jmp 0x4fae9f
mov eax, dword [0x58e074]
cmp eax, ebx
je 0x4fae9f
push eax
call fcn.004f0f3a
pop ecx
test eax, eax
je 0x4fae9f
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4fae9f
mov eax, dword [0x58e078]
cmp eax, ebx
je 0x4fae9f
push eax
call fcn.004f0f3a
pop ecx
test eax, eax
je 0x4fae9f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x58e070]
call fcn.004f0f3a
pop ecx
test eax, eax
je 0x4faebf
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4faec1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret