joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43aa70
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x467613
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0045b0b3
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.00460748
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.00461c64
test eax, eax
je 0x43ab8c
mov ecx, dword [esp + 0x3c]
call fcn.00460775
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x43ab50
push edi
mov ecx, esi
call fcn.0045dde1
mov ecx, esi
call fcn.0043acf0
cmp dword [esp + 0x38], 1
jne 0x43ab85
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.0045df1c
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x43d5c0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x43d5f3
push esi
call fcn.004406d0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x43d5ec
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x43d679
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x43d662
mov eax, dword [esi + 8]
test eax, eax
je 0x43d617
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x43d65e
cmp eax, 2
je 0x43d662
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x43d60a
cmp eax, 3
je 0x43d63d
cmp eax, 1
jne 0x43d60a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x43d60a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x43d60a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0043d6a0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x43d688
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0043d6a0
add esp, 4
pop esi
ret

Function at 0x45bea8
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x45bee0
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00459f5c
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00459f34
jmp 0x45beec
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x45d596
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x45d5d8
call fcn.0046304a
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x45d5d8
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x45d5cf
xor eax, eax
jmp 0x45d5e0
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0045d5e6
pop edi
pop esi
pop ebx
ret 4

Function at 0x46357a
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4635a8
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4635c6
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004634e0
jmp 0x4635c6
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4635c6
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004634e0
test edi, edi
mov eax, edi
jne 0x4635b0
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x1176d31
Capabilities:
Parse pe header

Disassembly:
jmp 0x11b515f
push 0
call dword [0x12400ec]
test eax, eax
je 0x11b519e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x11b519e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x11b519e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x11b519e
cmp dword [ecx + 0x74], 0xe
jbe 0x11b519e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x1177042
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
jmp 0x118c290
push esi
push edi
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [0x12420b8], eax
pop edi
pop esi
ret

Function at 0x40100b
Capabilities:
Execute shellcode via indirect call
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x4010ad
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x40102e
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011b8
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401048
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011b8
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x401134
mov word [ebx], 0x5c
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011b8
mov dword [ebp - 0x108], eax
push 0x401023
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x4011ad
push 0x3e8
call eax
test eax, eax
je 0x4011ad
push eax
push 0x40
push 0x3000
push 0x10000
push 0
call sub.KERNEL32.dll_VirtualAlloc
test eax, eax
je 0x40119a
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
lea eax, [0x4010a7]
jmp 0x4011be
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
lea eax, [0x40108c]
jmp 0x4011be
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
lea eax, [0x40104d]
push 0x10
push 0x4010a7
push eax
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret
Function at 0x64ef00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x650478
push 0x64eef0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x68
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 4], ebx
cld
add bh, bh
adc eax, sym.imp.MSVCRT.dll___set_app_type
pop ecx
or dword [0xa52f7c], 0xffffffff
or dword [0xa52f80], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0xa52f78]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0xa52f74]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0xa52f84], eax
call fcn.0064f07f
cmp dword [0x652270], ebx
jne 0x64ef83
push 0x64f07c
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
call fcn.0064f06a
push 0x65200c
push 0x652008
call sub.MSVCRT.dll__initterm
mov eax, dword [0xa52f70]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x6c]
push eax
push dword [0xa52f6c]
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.MSVCRT.dll___getmainargs]
push 0x652004
push section..data
call sub.MSVCRT.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.MSVCRT.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x74], esi
cmp byte [esi], 0x22
jne 0x64f016
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
cmp al, bl
je 0x64efea
cmp al, 0x22
jne 0x64efdc
cmp byte [esi], 0x22
jne 0x64eff3
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
cmp al, bl
je 0x64effd
cmp al, 0x20
jbe 0x64efef
mov dword [ebp - 0x30], ebx
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x64f021
movzx eax, word [ebp - 0x2c]
jmp 0x64f024
cmp byte [esi], 0x20
jbe 0x64eff3
inc esi
mov dword [ebp - 0x74], esi
jmp 0x64f016
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x68], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x78], ecx
push eax
push ecx
call sub.MSVCRT.dll__XcptFilter
pop ecx
pop ecx
ret
Function at 0x5c4b55
Capabilities:
Encrypt data using aes

Disassembly:
mov word [esp], bx
jmp 0x5c4c48
lea esp, [esp + 8]

Function at 0x5c4bcc
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 1]
mov edx, dword [edx*4 + 0x5a0d98]
and edx, ecx
push edx
add esp, 1
push word [esp + 1]
jmp 0x5c4b97
jmp 0x5c4baf

Function at 0x5c4c9d
Capabilities:
Encrypt data using aes

Disassembly:
add esp, 1
lea esp, [esp + 1]
lea esp, [esp + 2]
popal
sub esp, 0x18
jmp 0x5c4c9f
jmp 0x5c4c85
push dword [esp + 0x12]
jmp 0x5c4cea
shr edi, 0x18
mov edi, dword [edi*4 + 0x5a0d98]
sub esp, 0x14
jmp 0x5c4cc7

Function at 0x5c4d1d
Capabilities:
Encrypt data using aes

Disassembly:
push word [esp + 3]
mov byte [esp + 4], bh
lea esp, [esp + 2]
jmp 0x5c4d7c
movzx ebx, byte [esi + 6]
push esp
mov word [esp], bx
push esp
jmp 0x5c4d42
lea esp, [esp + 0x40]
xor edi, dword [ebx*4 + 0x5a1998]
bts ebx, edi
xchg bl, bh
jmp 0x5c4d61

Function at 0x5c4d8e
Capabilities:
Encrypt data using aes

Disassembly:
mov bl, bh
jmp 0x5c4e2f
mov edx, dword [edx*4 + 0x5a0d98]
sub esp, 0x18
add esp, 5
push word [esp + 3]
lea esp, [esp + 1]
jmp 0x5c4e0a
and edx, ecx
sub esp, 0xc
mov dword [esp + 3], eax
mov word [esp], bx
jmp 0x5c4de3
lea esp, [esp + 4]
movzx ebx, byte [esi + 9]
and edx, ecx
cmc
sub esp, 8
jmp 0x5c4d95

Function at 0x5c4e19
Capabilities:
Encrypt data using aes

Disassembly:
pop word [esp]
add esp, 1
lea esp, [esp + 1]
jmp 0x5c5865
mov edi, dword [esp + 0xd]
mov edi, edx
push edx
pop word [esp]
call fcn.005c4fb1
mov edi, dword [edi*4 + 0x5a1198]
sub esp, 8
cmc
jmp 0x5c5101
movzx ebx, byte [esi + 0xe]
stc
clc
stc
jmp 0x5c5168
and ebx, ecx
lea esp, [esp + 0x28]
xor edi, dword [ebx*4 + 0x5a1998]
cmc
jmp 0x5c50e7
and ebx, ecx
sub esp, 8
stc
push edx
stc
jmp 0x5c511f
lea esp, [esp + 0x14]
xor edi, dword [ebx*4 + 0x5a1598]
sub esp, 0x10
jmp 0x5c5175
mov edx, dword [edx*4 + 0x5a0d98]
jmp 0x5c5111
sub esp, 8
jmp 0x5c5135
mov ebx, dword [ebx*4 + 0x5a0d98]
and edx, ecx
stc
clc
jmp 0x5c5150
pop word [esp + 5]
lea esp, [esp + 2]
and edx, ecx
call fcn.005c51c8
and byte [edx + 0xcba4f28], bh
add bl, byte [edi + 0x15996a0f]
jb 0x5c5200
or al, 2
lahf
punpckhdq mm3, qword [ecx + 0x7c6d7215]
jl 0x5c518a
jl 0x5c5226
add al, 0xbe
movsb byte es:[edi], byte [esi]
stc
or dword [ebp + 0xbd34], 0xc0eb0000
cmp esp, dword [ebp + 0x69af5c35]
dec ebx
salc
inc esp
and ebx, esi
insb byte es:[edi], dx
invalid
mov dword [esi + 4], edi
mov ebx, dword [ebx*4 + 0x5a0d98]
sub esp, 0x10
lea edi, [esi + 0x6cd85aa5]
jmp 0x5c50a4
Function at 0x5c4fb1
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov edi, dword [ecx + 4]
mov dword [ecx + 4], eax
clc
jmp 0x5c4983
popal
mov dword [esi], edi
pop esi
bsf di, ax
rcl di, cl
jmp 0x5c493f
push edx
mov dword [esp + 3], eax
lea esp, [esp + 0xc]
jmp 0x5c495b
mov dword [edx + 4], edi
sub esp, 4
cmc
push esp
mov dword [esp + 3], eax
jmp 0x5c4e4e
lea esp, [esp + 0x2c]
sub ebx, 4
add ecx, 0x10
call fcn.005c4af0
mov dword [esp + 0x10], edi
popal
lea ebx, [ebx*4]
lea ebx, [ebx + 0x5a1198]
mov edi, dword [ebx]
jmp 0x5c4ebb
pushal
mov edx, ebp
mov bp, dx
inc ebx
bswap edx
jmp 0x5c4e5d
pop word [esp + 5]
lea esp, [esp + 2]
and edi, ecx
push ebx
jmp 0x5c4e7b
and ebx, ecx
jmp 0x5c4f0c
pop ebx
cmc
sub esp, 0x10
mov byte [esp + 0xa], bh
jmp 0x5c4ea5
shr edi, 0x18
mov edi, dword [edi*4 + 0x5a0d98]
sub esp, 0x1c
push dword [esp + 0x12]
jmp 0x5c4e97
mov bx, 0x8cd5
lea esp, [esp + 0x14]
movzx ebx, byte [esi + 0xa]
sub esp, 0x1c
mov word [esp + 0x18], bx
jmp 0x5c4f66
lea esp, [esp + 0x40]
xor edi, dword [ebx*4 + 0x5a1998]
mov bl, bh
sub esp, 0x14
lea ebx, [ebx + esi]
jmp 0x5c4eec
lea esp, [esp + 3]
lea esp, [esp + 0x50]
xor edi, dword [ebx*4 + 0x5a1598]
lea ebx, [eax*4]
jmp 0x5c4f92
and ebx, ecx
push edx
sub esp, 0xc
add esp, 5
sub esp, 0x18
jmp 0x5c4f21
mov ebx, dword [ebx*4 + 0x5a0d98]
push edx
sub esp, 0x14
pop word [esp + 0xd]
lea esp, [esp + 2]
jmp 0x5c4f43
movzx ebx, byte [esi + 0xd]
push edx
and edx, ecx
cmc
call fcn.005c4f7c
loope 0x5c5008
not dword [edx - 0x67e6209f]
push cs
imul ebx, dword [eax - 0x689b8ad1], 0x6668c9fe
pop word [esp + 1]
jmp 0x5c4ed9
push eax
mov eax, esi
lea eax, [eax + 8]
jmp 0x5c5040
jmp 0x5c4fdf
sub esp, 0x10
add esp, 0xd
call 0x5c4fd4
pop word [esp]
lea edi, [ecx*4]
lea esp, [esp + 2]
jmp 0x5c508b
mov dword [eax], edi
pop eax
lea edi, [eax + 0x7617e009]
call 0x5c5029
xor byte [eax + 0xbb8492e], bh
push ds
xchg ebp, eax
add eax, 0x84229f6c
aaa
push ds
push esp
mov edx, dword [edx*4 + 0x5a0d98]
stc
and edx, ecx
jmp 0x5c501e
sub esp, 4
add esp, 1
mov word [esp], di
cmc
lea esp, [esp + 3]
popal
jmp 0x5c571a
push esi
pushal
lea eax, [eax + ebx]
mov dword [esp + 4], ebx
jmp 0x5c506a
lea esi, [esi*4]
Function at 0x5c5029
Capabilities:
Encrypt data using aes

Disassembly:
mov edi, dword [ecx + 4]
mov dword [ecx + 4], eax
clc
jmp 0x5c4983
popal
mov dword [esi], edi
pop esi
bsf di, ax
rcl di, cl
jmp 0x5c493f
push edx
mov dword [esp + 3], eax
lea esp, [esp + 0xc]
jmp 0x5c495b
mov dword [edx + 4], edi
sub esp, 4
cmc
push esp
mov dword [esp + 3], eax
jmp 0x5c4e4e
lea esp, [esp + 0x2c]
sub ebx, 4
add ecx, 0x10
call fcn.005c4af0
mov dword [esp + 0x10], edi
popal
lea ebx, [ebx*4]
lea ebx, [ebx + 0x5a1198]
mov edi, dword [ebx]
jmp 0x5c4ebb
pushal
mov edx, ebp
mov bp, dx
inc ebx
bswap edx
jmp 0x5c4e5d
pop word [esp + 5]
lea esp, [esp + 2]
and edi, ecx
push ebx
jmp 0x5c4e7b
and ebx, ecx
jmp 0x5c4f0c
pop ebx
cmc
sub esp, 0x10
mov byte [esp + 0xa], bh
jmp 0x5c4ea5
shr edi, 0x18
mov edi, dword [edi*4 + 0x5a0d98]
sub esp, 0x1c
push dword [esp + 0x12]
jmp 0x5c4e97
mov bx, 0x8cd5
lea esp, [esp + 0x14]
movzx ebx, byte [esi + 0xa]
sub esp, 0x1c
mov word [esp + 0x18], bx
jmp 0x5c4f66
lea esp, [esp + 0x40]
xor edi, dword [ebx*4 + 0x5a1998]
mov bl, bh
sub esp, 0x14
lea ebx, [ebx + esi]
jmp 0x5c4eec
lea esp, [esp + 3]
lea esp, [esp + 0x50]
xor edi, dword [ebx*4 + 0x5a1598]
lea ebx, [eax*4]
jmp 0x5c4f92
and ebx, ecx
push edx
sub esp, 0xc
add esp, 5
sub esp, 0x18
jmp 0x5c4f21
mov ebx, dword [ebx*4 + 0x5a0d98]
push edx
sub esp, 0x14
pop word [esp + 0xd]
lea esp, [esp + 2]
jmp 0x5c4f43
movzx ebx, byte [esi + 0xd]
push edx
and edx, ecx
cmc
call fcn.005c4f7c
loope 0x5c5008
not dword [edx - 0x67e6209f]
push cs
imul ebx, dword [eax - 0x689b8ad1], 0x6668c9fe
pop word [esp + 1]
jmp 0x5c4ed9
push eax
mov eax, esi
lea eax, [eax + 8]
jmp 0x5c5040
jmp 0x5c4fdf
sub esp, 0x10
add esp, 0xd
call 0x5c4fd4
pop word [esp]
lea edi, [ecx*4]
lea esp, [esp + 2]
jmp 0x5c508b
mov dword [eax], edi
pop eax
lea edi, [eax + 0x7617e009]
call 0x5c5029
xor byte [eax + 0xbb8492e], bh
push ds
xchg ebp, eax
add eax, 0x84229f6c
aaa
push ds
push esp
mov edx, dword [edx*4 + 0x5a0d98]
stc
and edx, ecx
jmp 0x5c501e
sub esp, 4
add esp, 1
mov word [esp], di
cmc
lea esp, [esp + 3]
popal
jmp 0x5c571a
push esi
pushal
lea eax, [eax + ebx]
mov dword [esp + 4], ebx
jmp 0x5c506a
lea esi, [esi*4]

Function at 0x5c50e1
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
pop word [esp]
add esp, 1
lea esp, [esp + 1]
jmp 0x5c50b4
and edi, ecx
stc
push edx
jmp 0x5c50ca

Function at 0x5c51c8
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 1]
jmp 0x5c519b
lea esp, [esp + 3]
lea esp, [esp]
jmp 0x5c51b1

Function at 0x5c521e
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 2]
lea esp, [esp + 4]
jne 0x596ecf
je 0x596ee8
dec esi
in al, dx
bound eax, qword [0xf97973f4]
imul ecx, dword [eax], 0xbb5848fb
xchg edx, eax
or eax, 0x247c889c
add ah, byte [esi - 0x71]
add al, 0x24
Function at 0x5c6756
Capabilities:
Encrypt data using aes

Disassembly:
push edx
push word [esp + 3]
jmp 0x5c69bd
xor eax, eax
jmp 0x5c5303
mov dword [esp], eax
lea esp, [esp + 3]
lea esp, [esp + 1]
jmp 0x5c67f6
mov byte [ecx + 2], al
jmp 0x5c56cf
shr edx, 8
call fcn.005c67a0
push word [esp + 7]
lea esp, [esp + 0xc]
jne 0x5c56cf
je 0x5c6787
mov word [eax], es
xchg esi, eax
int1
add byte [eax + 0x342dbd32], dh
invalid
jb 0x5c56f0
bswap edx
mov edx, eax
sub esp, 0x1c
jmp 0x5c67cb
push edx
lea esp, [esp + 3]
lea esp, [esp]
lea esp, [esp]
lea esp, [esp + 1]
jmp fcn.005c688d
mov ebx, dword [esp]
push esp
lea esp, [esp + 8]
leave
jmp 0x5c68e3
mov word [esp], bx
lea esp, [esp + 2]
lea esp, [esp + 4]
pop edi
bswap ebx
jmp 0x5c6913

Function at 0x6b5308
Capabilities:
Access peb ldr_data

Disassembly:
mov dword [esp + 0x2c], ebp
push edx
call fcn.006b52ba
mov dword [esp + 0x34], esi
call fcn.006b536c
mov word [esp + 4], bx
push edx
mov byte [esp], dh
mov word [esp + 2], bx
jmp 0x6b52dd
Function at 0x405590
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
sub esp, 0x10
push esi
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4055ae
or eax, eax
pop esi
add esp, 0x10
ret
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push ecx
mov dword [esp + 0xc], eax
mov word [esp + 8], 2
call dword [sym.imp.WS2_32.dll_htons]
lea edx, [esp + 4]
push 0x10
push edx
push esi
mov word [esp + 0x12], ax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x4055ef
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
pop esi
add esp, 0x10
ret
mov eax, esi
pop esi
add esp, 0x10
ret

Function at 0x42df10
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section..rdata
lea edi, [esi - 0x1d000]
push edi
or ebp, 0xffffffff
jmp 0x42df32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x42df39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x42df28
mov eax, 1
add ebx, ebx
jne 0x42df4b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x42df40
jne 0x42df5c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42df40
xor ecx, ecx
sub eax, 3
jb 0x42df70
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42dfe2
mov ebp, eax
add ebx, ebx
jne 0x42df7b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x42df88
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x42dfac
inc ecx
add ebx, ebx
jne 0x42df98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x42df8d
jne 0x42dfa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42df8d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x42dfcc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x42dfbd
jmp 0x42df2e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42dfcc
add edi, ecx
jmp 0x42df2e
pop esi
mov edi, esi
mov ecx, 0x8e5
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x42dfea
cmp byte [edi], 5
jne 0x42dfea
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x42dfef
lea edi, [esi + 0x2a000]
mov eax, dword [edi]
or eax, eax
je 0x42e067
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2ed9c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2ee3c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x42e01c
mov ecx, edi
jns 0x42e04b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2ee40]
or eax, eax
je 0x42e061
mov dword [ebx], eax
add ebx, 4
jmp 0x42e039
call dword [esi + 0x2ee44]
popal
jmp 0x40297a
Function at 0x401144
Capabilities:
Get system information on windows

Disassembly:
call fcn.00401414
mov edx, dword [0x47619c]
jmp 0x401290
mov dword [edi], edx
mov ecx, 1
rol ecx, 2
add edi, ecx
mov edx, 0xe00000
rol edx, 0xd
add esi, edx
xor esi, 0xdaf4e722
mov dword [ebp - 0x14], esi
rol edi, 0x18
mov dword [ebp - 0xa4], edi
pop edi
pop esi
pop ebx
ret
push ebp
mov ebp, esp
sub esp, 0x3e0
call sub.KERNEL32.dll_GetCurrentProcess
push 0x4761e8
push 0x4761da
push eax
call sub.KERNEL32.dll_GetProcessAffinityMask
mov edx, 0x401020
mov ecx, 0x40104c
mov eax, 0x403eb3a7
add eax, 0xbfc15c59
sub edx, eax
mov eax, 0x20
sub edx, eax
mov dword [0x47619c], edx
mov dword [0x476190], ecx
push 0x476188
call sub.USER32.dll_RegisterClassExW
push 0x4761d8
call sub.KERNEL32.dll_GetSystemInfo
call fcn.00401240
movzx edx, word [0x4761da]
test edx, edx
jne 0x401290
push 8
push 0
push str.msvfw32.dll
call sub.KERNEL32.dll_LoadLibraryExW
test eax, eax
je 0x4010a0
push str.WINMM.dll
call sub.KERNEL32.dll_GetModuleHandleW
test eax, eax
je 0x4010a0
xor ebx, ebx
mov eax, 0x80000000
push ebx
push dword [0x47619c]
push ebx
push ebx
push eax
push eax
push eax
push eax
push 0xcf0000
push str.Qekisibay
push str.Sigobafune
push 0x200
call sub.USER32.dll_CreateWindowExW
jmp 0x4010a0
push eax
call sub.KERNEL32.dll_ExitProcess
mov edi, edi
or edx, dword [ebx]
lock add esi, dword [ecx]
push fcn.00401728
mov edi, edi
mov edx, dword [esi]
mov ecx, dword [ebp - 0x38]
ror ecx, 0x1b
add esi, ecx
dec ebx
mov dword [edi], edx
mov ecx, 0x54419268
xor ecx, 0x5441926c
add edi, ecx
test ebx, ebx
je 0x4015e0
mov edx, dword [esi]
mov ecx, dword [ebp - 0x50]
sub ecx, 0x8d88db9f
add esi, ecx
dec ebx
mov dword [edi], edx
mov ecx, 0x2adc6177
xor ecx, 0x2adc6173
add edi, ecx
test ebx, ebx
jne 0x4012a4
jmp 0x4015b0
mov edx, dword [esi]
mov ecx, dword [ebp - 0x38]
ror ecx, 0x1b
add esi, ecx
jmp 0x4010b8
mov edx, dword [esi]
mov ecx, dword [ebp - 0x50]
sub ecx, 0x8d88db9f
add esi, ecx
jmp 0x4010b8