joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4304f6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x408
push esi
push edi
mov edi, dword [ebp + 8]
cmp dword [edi], 0xffffffff
jne 0x43051b
push 8
pop ecx
call fcn.0043023b
xor al, al
jmp 0x4305ae
mov esi, dword [ebp + 0x14]
cmp dword [esi], 0
je 0x4305ac
push dword [ebp + 0x10]
lea eax, [esp + 0x10]
mov byte [edi + 8], 0
push eax
push dword [esi]
push dword [ebp + 0xc]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0xc]
mov dword [esi], ecx
test eax, eax
jne 0x4305ac
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x27
je 0x43057d
cmp esi, 0x70
je 0x43057d
push 6
pop ecx
call fcn.0043023b
push dword [edi + 0x54]
lea eax, [esp + 0x14]
push esi
push 0x5d0de8
push eax
call fcn.004383b9
push 1
push 6
jmp 0x43059c
push 0xb
pop ecx
call fcn.0043023b
push dword [edi + 0x54]
lea eax, [esp + 0x14]
push esi
push 0x5d0de8
push eax
call fcn.004383b9
push 1
push 0xb
mov edx, eax
pop ecx
call fcn.00430274
add esp, 0x14
jmp 0x430514
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x430edb
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x260
push ebx
push esi
push ecx
lea ecx, [esp + 0xc]
mov esi, edx
call fcn.0043580a
push esi
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, eax
lea eax, [esp + 0x10]
neg ebx
sbb bl, bl
inc bl
cmp dword [esp + 0xc], eax
je 0x430f1b
push dword [esp + 0xc]
call fcn.004ab853
pop ecx
test bl, bl
je 0x430f2f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
sete al
jmp 0x430f31
mov al, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x431d87
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
lea eax, [edi + 4]
mov byte [edi + 0xc], bl
push eax
push 0x5d0f00
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push edi
push 0x28
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push 3
push dword [edi]
call esi
mov eax, dword [ebp - 4]
call fcn.004ac340
mov ebx, esp
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push ebx
push 3
push dword [edi]
call esi
test eax, eax
je 0x431e1b
xor edx, edx
cmp dword [ebx], edx
jbe 0x431e1b
mov esi, dword [edi + 8]
lea ecx, [ebx + 4]
cmp dword [ecx + 4], esi
jne 0x431e13
mov eax, dword [ecx]
cmp eax, dword [edi + 4]
jne 0x431e13
cmp dword [ecx + 8], 2
je 0x431e0e
cmp dword [ecx + 8], 1
je 0x431e0e
xor al, al
jmp 0x431e10
mov al, 1
mov byte [edi + 0xc], al
inc edx
add ecx, 0xc
cmp edx, dword [ebx]
jb 0x431df2
mov eax, edi
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x432244
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push edi
push 9
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor eax, eax
inc eax
cmp dword [ebp - 0x10], 0
pop edi
cmovne eax, dword [ebp - 0x10]
leave
ret

Function at 0x433a4d
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x400
push eax
lea eax, [ebp - 0x804]
mov esi, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov ecx, esi
test eax, eax
je 0x433a90
sub esp, 0xc
lea eax, [ebp - 0x804]
mov edx, 0x100
push eax
call fcn.004358aa
add esp, 0x10
jmp 0x433aa2
push 0x100
mov edx, 0x5d0c78
call fcn.004354ee
add esp, 4
mov eax, esi
pop esi
leave
ret

Function at 0x4348a3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
mov esi, edx
push edi
mov edi, ecx
cmp esi, 0x104
jl 0x4348ec
lea eax, [ebp - 0x208]
push eax
xor eax, eax
push eax
push eax
push 0x23
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x4348ec
sub esp, 0xc
lea eax, [ebp - 0x208]
mov edx, esi
mov ecx, edi
push eax
call fcn.004358aa
add esp, 0x10
mov al, 1
jmp 0x4348ee
xor al, al
pop edi
pop esi
leave
ret
Function at 0x435eb7
Capabilities:
Set thread local storage value

Disassembly:
push esi
push edi
mov edi, ecx
mov esi, edx
push esi
mov eax, dword [edi]
not eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp dword [edi + 4], 0
je 0x435ee8
test esi, esi
je 0x435ee8
call fcn.00435df5
test eax, eax
jne 0x435ee8
mov edx, dword [edi + 4]
mov ecx, esi
pop edi
pop esi
jmp fcn.0043628d
pop edi
pop esi
ret

Function at 0x436d29
Capabilities:
Hash data using fnv

Disassembly:
mov edx, 0x1000193
jmp 0x436d3c
movzx eax, al
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
mov al, byte [ecx]
test al, al
jne 0x436d30
xor eax, eax
inc eax
test edx, edx
cmovne eax, edx
ret

Function at 0x43fee3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
mov edx, dword [ebp + 8]
mov esi, edi
mov dword [ebp - 4], esi
mov ecx, edi
lea eax, [edx - 1]
sar eax, 1
mov dword [ebp - 8], eax
cmp edi, eax
jge 0x43ff3e
lea esi, [ecx + ecx]
lea ecx, [ebx + 0x10]
lea ecx, [ecx + esi*8]
lea eax, [ecx - 8]
push eax
push ecx
call fcn.0043f630
movzx ecx, al
xor ecx, 1
inc ecx
add ecx, esi
mov eax, dword [ebx + ecx*8]
mov dword [ebx + edi*8], eax
mov eax, dword [ebx + ecx*8 + 4]
mov dword [ebx + edi*8 + 4], eax
mov edi, ecx
mov eax, dword [ebp - 8]
cmp ecx, eax
jl 0x43ff05
mov edx, dword [ebp + 8]
mov esi, dword [ebp - 4]
cmp ecx, eax
jne 0x43ff59
test dl, 1
jne 0x43ff59
mov eax, dword [ebx + edx*8 - 8]
mov dword [ebx + edi*8], eax
mov eax, dword [ebx + edx*8 - 4]
mov dword [ebx + edi*8 + 4], eax
lea edi, [edx - 1]
cmp esi, edi
jge 0x43ff87
push dword [ebp + 0xc]
lea esi, [edi - 1]
sar esi, 1
lea eax, [ebx + esi*8]
push eax
call fcn.0043f630
test al, al
je 0x43ff87
mov eax, dword [ebx + esi*8]
mov dword [ebx + edi*8], eax
mov eax, dword [ebx + esi*8 + 4]
mov dword [ebx + edi*8 + 4], eax
mov edi, esi
cmp dword [ebp - 4], esi
jl 0x43ff5d
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
mov dword [ebx + edi*8], eax
mov eax, dword [ecx + 4]
mov dword [ebx + edi*8 + 4], eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x474909
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov edx, ecx
cmp dword [ecx + 0x14], 0x10
jb 0x474919
mov edx, dword [ecx]
mov eax, dword [ecx + 0x10]
add eax, edx
cmp dword [ecx + 0x14], 0x10
jb 0x474926
mov ecx, dword [ecx]
push ebx
push esi
xor edx, edx
mov esi, eax
sub esi, ecx
xor ebx, ebx
cmp ecx, eax
push edi
cmova esi, ebx
mov edi, edx
test esi, esi
je 0x474962
movsx eax, byte [ecx]
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor eax, edx
rol eax, 0xd
imul edx, eax, 5
sub edx, 0x19ab949c
inc ecx
inc edi
cmp edi, esi
jne 0x47493c
pop edi
pop esi
mov eax, edx
pop ebx
pop ebp
ret 4

Function at 0x47d3c5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
push esi
lea ecx, [eax - 1]
push edi
mov edi, edx
mov dword [ebp - 0xc], ecx
sar ecx, 1
mov esi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], ecx
cmp edi, ecx
jge 0x47d425
add esi, esi
lea ecx, [esi + 2]
shl ecx, 5
add ecx, ebx
lea eax, [ecx - 0x20]
push eax
push ecx
call fcn.0047d33b
movzx eax, al
xor eax, 1
shl edi, 5
inc eax
add esi, eax
mov eax, esi
shl eax, 5
lea ecx, [ebx + edi]
add eax, ebx
push eax
call fcn.0047d1cb
mov ecx, dword [ebp - 8]
mov edi, esi
cmp esi, ecx
jl 0x47d3e9
mov eax, dword [ebp + 8]
cmp esi, ecx
jne 0x47d444
test al, 1
jne 0x47d444
shl eax, 5
shl edi, 5
add eax, 0xffffffe0
add eax, ebx
push eax
lea ecx, [ebx + edi]
call fcn.0047d1cb
mov edi, dword [ebp - 0xc]
cmp dword [ebp - 4], edi
jge 0x47d47a
push dword [ebp + 0xc]
lea esi, [edi - 1]
sar esi, 1
mov eax, esi
shl eax, 5
add eax, ebx
push eax
mov dword [ebp + 8], eax
call fcn.0047d33b
test al, al
je 0x47d47a
push dword [ebp + 8]
shl edi, 5
lea ecx, [ebx + edi]
call fcn.0047d1cb
mov edi, esi
cmp dword [ebp - 4], esi
jl 0x47d449
push dword [ebp + 0xc]
shl edi, 5
lea ecx, [ebx + edi]
call fcn.0047d1cb
pop edi
pop esi
pop ebx
leave
ret
Function at 0x47e23f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, edi
jne 0x47e25b
xor eax, eax
jmp 0x47e320
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x47e284
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
add eax, ecx
cmp ecx, eax
jae 0x47e284
dec dword [edx]
mov eax, ebx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
jmp 0x47e320
cmp dword [esi + 0x4c], 0
je 0x47e31e
mov ecx, esi
call fcn.0047e437
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x47e2b1
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.004d92a4
cmp eax, edi
pop ecx
pop ecx
cmovne edi, ebx
jmp 0x47e31e
lea eax, [ebp + 8]
mov byte [ebp - 1], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x47e31e
cmp eax, 1
jle 0x47e2ed
cmp eax, 3
jne 0x47e31e
push dword [esi + 0x4c]
movsx ecx, byte [ebp - 1]
push ecx
jmp 0x47e2a3
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
sub eax, ecx
mov dword [ebp - 8], eax
je 0x47e310
push dword [esi + 0x4c]
push eax
mov eax, ecx
push 1
push eax
call fcn.004d67f9
add esp, 0x10
cmp dword [ebp - 8], eax
jne 0x47e31e
lea eax, [ebp - 1]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0xc], eax
mov eax, ebx
jne 0x47e320
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x47e4bf
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x47e537
cmp byte [esi + 0x3d], 0
je 0x47e537
push 0xffffffffffffffff
call fcn.0047e23f
cmp eax, 0xffffffff
je 0x47e509
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x47e50d
sub eax, 1
je 0x47e511
dec eax
sub eax, 1
je 0x47e537
xor al, al
jmp 0x47e539
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 4]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x47e52e
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004d67f9
add esp, 0x10
cmp edi, eax
jne 0x47e509
cmp byte [esi + 0x3d], 0
sete al
jmp 0x47e539
mov al, 1
pop edi
pop esi
leave
ret

Function at 0x4801f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x260
push esi
push edi
push dword [ebp + 8]
mov edi, ecx
mov esi, edx
lea ecx, [esp + 0xc]
call fcn.0043580a
push dword [eax + 4]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
lea eax, [esp + 0x10]
cmp dword [esp + 0xc], eax
je 0x48022f
push dword [esp + 0xc]
call fcn.004ab853
pop ecx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x486523
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
push ecx
lea ecx, [ebp - 0x260]
mov edi, edx
mov dword [esi], eax
call fcn.0043580a
push esi
push dword [ebp + 8]
mov esi, dword [ebp + 0x14]
push edi
push 0
push dword [eax + 4]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
lea eax, [ebp - 0x258]
cmp dword [ebp - 0x25c], eax
je 0x486575
push dword [ebp - 0x25c]
call fcn.004ab853
pop ecx
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x486600
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x370
lea eax, [esp + 8]
push ebx
push esi
push ecx
push eax
mov ecx, 0x5d8088
xor ebx, ebx
call fcn.004864f7
pop ecx
pop ecx
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
lea eax, [esp + 0x2c]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, eax
test esi, esi
jne 0x4866b3
push 0x5d8098
lea ecx, [esp + 0x11c]
call fcn.0043580a
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 1
push ebx
push dword [eax + 4]
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
lea eax, [esp + 0x120]
cmp dword [esp + 0x11c], eax
je 0x486691
push dword [esp + 0x11c]
call fcn.004ab853
pop ecx
test esi, esi
jne 0x4866a9
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
test esi, esi
jne 0x4866a9
mov bl, 1
jmp 0x4866ba
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c2c36
Capabilities:
Authenticate hmac

Disassembly:
inc ebp
leave
add esp, 0x5a3ba8b9
push cs
jns 0x4c2c62
lodsb al, byte [esi]
pop ebx
arpl word [esi], bx
mov al, 0x79
push ss
fisubr word [ebx + 0x6d9ef06a]
xchg ebx, eax
nop
inc ebp
stc
pop es
je 0x4c2ca6
xchg esp, eax
sbb dword [ebp - 0x1ff978a2], ebx
sub byte [ecx], al
add dword [ebx], esp
cmpsd dword [esi], dword es:[edi]
aam 0x8e
out 0x2f, al
add dword [ebx], esp
cmpsd dword [esi], dword es:[edi]
aam 0x8e
out 0x2f, al
dec ebx
lea edi, [0x9a72b0e3]
push ebx
pop ss
dec edi
xor byte [eax - 0x7e8291a8], dl
loope 0x4c2c81
iretd
test al, 0xc1
and dword [esi], eax
adc dword [ebx], edi
mov dword [0x3d25a5fa], eax
cmp dword [esi - 0x21d209e9], ecx
xchg esi, eax
inc edx
and ecx, dword [ebp - 0x2d]
push ebp
invd
std
cmp dword [ecx], edx
popfd
ja fcn.004c2c36
jbe 0x4c2c0e
pop ebp
sbb byte [esi - 0x2f], bl
invalid
dec ebx
insb byte es:[edi], dx
add eax, 0xe13f3e7f
loop 0x4c2c66
invalid

Function at 0x4dff38
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004dfebb

Function at 0x4eb339
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004eafdb

Function at 0x4f13b0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x600088]
xor eax, esp
mov dword [esp + 0x190], eax
mov eax, dword [0x60d04c]
mov ecx, eax
inc eax
mov dword [0x60d04c], eax
test ecx, ecx
je 0x4f13ec
xor eax, eax
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.004ac0cf
add esp, 0x194
ret
cmp byte [esp + 0x19c], 0
je 0x4f1428
mov dword [fcn.004d89a5], 0x4d89a5
mov dword [fcn.004cc3ce], 0x4cc3ce
mov dword [fcn.004d5df3], 0x4d5df3
mov dword [fcn.004df0a6], 0x4df0a6
mov dword [fcn.004cce02], 0x4cce02
push ebx
call fcn.004fde50
test eax, eax
je 0x4f146a
mov ebx, dword [esp + 0x19c]
test bl, 2
je 0x4f148d
lea eax, [esp + 4]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x4f146a
mov eax, dword [esp + 4]
cmp al, 2
jne 0x4f1485
shr eax, 8
cmp al, 2
jne 0x4f1485
call fcn.004fca60
test eax, eax
je 0x4f148d
mov eax, 2
pop ebx
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.004ac0cf
add esp, 0x194
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x4f146a
call fcn.00403b40
test eax, eax
jne 0x4f146a
call fcn.004fab80
mov eax, dword [0x60d164]
test bl, 4
mov ecx, 1
mov dword [0x60d050], ebx
cmovne eax, ecx
mov dword [0x60d164], eax
call fcn.00506f80
mov ecx, dword [esp + 0x194]
xor eax, eax
pop ebx
xor ecx, esp
call fcn.004ac0cf
add esp, 0x194
ret
Function at 0x5047b0
Capabilities:
Write file on windows

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp dword [edi + 0x1d0], 0
je 0x5047f4
push esi
push 1
push edi
call fcn.004f4fa0
push dword [edi + 0x15c]
mov eax, dword [edi + 0x1d0]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push edi
call eax
push 0
push edi
mov esi, eax
call fcn.004f4fa0
add esp, 0x24
mov eax, esi
pop esi
pop edi
ret
mov eax, dword [esp + 0xc]
cmp eax, 2
ja 0x50482d
push dword [edi + 0x158]
lea eax, [eax + eax*2]
push 1
add eax, 0x5b12b4
push 2
push eax
call fcn.004d67f9
push dword [edi + 0x158]
push 1
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call fcn.004d67f9
add esp, 0x20
xor eax, eax
pop edi
ret
Function at 0x518550
Capabilities:
Encode data using xor

Disassembly:
xchg edx, eax
push ebp
inc edi
mov dh, 0xd3
arpl word [ebx - 1], cx
add bl, cl
retf
salc
pop esi
scasd eax, dword es:[edi]
ja 0x518572
mov al, 0xb8
jnp 0x5185b8
push edx
inc eax
movsb byte es:[edi], byte [esi]
push esp
adc bl, byte [ebx + 0x38]
or al, byte [ebx]
jp 0x518503
loopne 0x5185c4
jp 0x51853d
pop es
movsd dword es:[edi], dword [esi]
imul edi, dword [ebx + 0x27], 4
nop
cmp ecx, dword [ebx - 0x60d86665]
mov ebx, 0x6297c10a
inc esp
stosb byte es:[edi], al
jl 0x518595
or al, cl
xchg edi, eax
bound eax, qword [edx + ebp*4 + 0x7c]
sub dword [edi - 0x386f63ad], ecx
xchg esi, eax
invalid
sbb al, 0x9e
xor dword [esi + 0x6a], edx
sub byte [edx - 0x755dd776], ah
sub byte [edx - 0x435dd776], ah
mov byte [0xbca2288a], al
test al, 0xa3
xor eax, ecx
popal
mov word [esi], ds
push cs
jp 0x51857e
xlatb
in eax, 0x53
scasd eax, dword es:[edi]
xchg esp, eax
jmp 0xf20b729e
in eax, dx
mov ecx, 0x926339f1
dec esi
dec ecx
invalid
pop ds
push eax
sahf
adc al, byte [ebx + edi*2]
add esi, dword [eax + 0x2463c356]
loope 0x5185f8
jp 0x518564
push ds
cmpps xmm6, xmmword [esi + eax*4 - 0x5f4d2359], 0x90
invalid
xchg ebp, eax
cmp ch, byte cs:[ecx]
sub cl, byte [esi - 0x21]
scasb al, byte es:[edi]
xor ebx, dword [edi + 0x34]
mov dword [esi + 9], esi
sbb bh, bh
add byte [edx], ch
inc esi
cmp eax, 0x5f739231
aaa
and byte [edx - 0x3f363fc0], dl
lodsb al, byte [esi]
stosd dword es:[edi], eax
or dword [ecx + 0x40f362b5], esp
daa
add eax, 0x65972a18
add ah, dh
fdiv qword [esi - 0x70]
js 0x518621
adc eax, 0xbbb4d0b1
inc di
mov edi, 0x78db4ed4
jp 0x518661
jo 0x518634
push cs
or ch, bh
xchg edx, eax
jb 0x518652
scasd eax, dword es:[edi]
mov dword [esi - 0x4b0c758a], eax
pop ss
imul edi, dword [edx + 0x12], 0xf2345c79
and cl, byte [0x5164b7ab]
scasd eax, dword es:[edi]
or byte [esi + 0xeb4331e], bh
push cs
xor byte [ecx], dh
xlatb
salc
mov ah, 0x9d
imul esp, dword [ebx - 0x27], 0xfffffffd
pop ds
stc
jb 0x51865e
sub eax, 0xe016ab4c
fisub word [edi]
rcr byte [ecx], 0xa
dec eax
pop esi
dec eax
in eax, 0x8f
add ebx, dword [edx + 0x663110c2]
pop esi
cmp al, 0x20
out 0x9c, eax
invalid
Function at 0x5371c0
Capabilities:
Encode data using xor

Disassembly:
sbb al, 0xae
inc esp
sub byte [ecx + ebp*2], bl
xchg ecx, eax
out 0x25, eax
mov dword [0x736673dc], eax
imul esi, dword [edi + ebx], 0xffffffab
jae 0x53723a
xor al, 0x1f
stosd dword es:[edi], eax
mov eax, dword [0xbb143c44]
inc ecx
test al, 0x9e
cwde
fadd st(4), st(0)
das
enter 0xfffffffffffff53d, 0xffffffffffffff98
xchg edi, eax
inc edx
imul esp, ebp, 0xffffff88
pop ebx
and eax, 0x623b7fbf
jecxz 0x5371cc
imul edi, eax, 0x2d
mov dword [0xea4900d6], eax
cmp edx, 0x1afe810f
mov bh, 3
sbb dh, bh
fsubr qword [esi - 0x387362c5]
out dx, al
pushal
or cl, bl
xor dl, byte [ecx + 0x15]
xchg ebp, eax
invalid
stc
std
cmc
push ds
cdq
fimul dword [eax + ebx*4 + 0x46]
or edx, dword [ebx + ecx*4 + 0x34]
dec eax
push cs
xchg ebp, eax
scasb al, byte es:[edi]
dec ebp
add eax, 0xffa3aaf7
mov ah, 0xe
jecxz 0x53726d
mov esi, 0x4a53aa2
sbb dword [esi + eax*4 - 0x63b261c3], edx
push ecx
dec edi
mul byte [eax + 0x662cea88]
push 0xbdd5b6
loop 0x5372c1
add dl, ah
push ecx
mov esi, 0x5f695104
mov cl, 0x30
movsb byte es:[edi], byte [esi]
std
push esp
xor dword [edx - 6], ecx
wait
xor esp, dword [eax - 0x653f9332]
insd dword es:[edi], dx
sahf
das
pop ds
mov bh, 0x6d
leave
ja 0x5372b8
mov al, 0xc8
mov ebp, 0xe5d0944f
pop ebp
add byte [ebx + 0x5e8af438], al
fadd st(1)
dec byte [edi]
in eax, dx
into
sbb eax, 0xf8d5ad6d
cld
mov dh, 0xa9
les edx, [ebx + 0x4c48f00c]
pushfd
jmp 0x537336
clc
movsb byte es:[edi], byte [esi]
test al, 0x19
scasb al, byte es:[edi]
into
in eax, dx
invalid
Function at 0x402e50
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
push ebx
push esi
push edi
push 0
mov ebx, dword [sym.imp.USER32.dll_CreateWindowExW]
mov eax, ecx
push eax
push 0
push 0
push 0x320
push 0x280
push 0xa
push 0x64
push 0xcf0000
push 0x425730
push 0x425658
push 0
mov esi, edx
mov dword [ebp - 4], eax
mov dword [0x425724], eax
call ebx
mov edi, eax
mov dword [0x425654], edi
test edi, edi
jne 0x402ea9
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call dword [sym.imp.USER32.dll_UpdateWindow]
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x28], 1
push eax
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
lea eax, [ebp - 0x24]
push eax
push edi
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
push 0
push dword [0x425724]
sub eax, 0x3c
push 0
push edi
push eax
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x24]
push eax
push 0x1e
push 0
push 0x50000201
push 0x420fdc
push str.SysListView32
push 0x21
call ebx
push 0x21
push 0
mov ebx, eax
push 0x1036
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [0x42554c], ebx
xor esi, esi
mov dword [ebp - 0x58], 0xf
mov dword [ebp - 0x14], 0x420ffc
mov dword [ebp - 0x10], str.Name
mov dword [ebp - 0xc], str.Ports
mov dword [ebp - 8], 0x42101c
nop dword [eax]
nop dword [eax + eax]
push dword [ebp + esi*4 - 0x14]
lea eax, [ebp - 0x258]
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x4c], eax
xor eax, eax
cmp esi, 2
mov dword [ebp - 0x50], 0x64
push 0x421024
setge al
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x258]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x58]
push eax
push esi
push 0x1061
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
je 0x402fa3
inc esi
cmp esi, 4
jb 0x402f50
mov ebx, dword [ebp - 4]
push 0
push ebx
push 0xdc
push edi
push 0
push 0
push 0
push 0
push 0x50000100
push 0
push str.msctls_statusbar32
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x425720], eax
lea eax, [ebp - 0x14]
push eax
push edi
call dword [sym.imp.USER32.dll_GetClientRect]
push 0x10
push 0x42
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_LocalLock]
mov esi, eax
mov eax, dword [ebp - 0xc]
cdq
and edx, 3
add eax, edx
sar eax, 2
push esi
push 4
push 0x404
push dword [0x425720]
lea ecx, [eax + eax]
mov dword [esi], eax
mov dword [esi + 4], ecx
add ecx, eax
add eax, ecx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], eax
call dword [sym.imp.USER32.dll_SendMessageW]
push edi
call dword [sym.imp.KERNEL32.dll_LocalUnlock]
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0
push 0x4039b0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0x67
push ebx
call dword [sym.imp.USER32.dll_DialogBoxParamW]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret