joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f7360
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov eax, dword [eax]
and eax, 7
cmp edx, 5
jae 0x4f7380
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
push ebx
add edx, 0xfffffffc
or ebx, 0xffffffff
add edx, ecx
push esi
mov dword [ebp - 8], edx
nop dword [eax]
lea esi, [edi + ecx]
cmp esi, edx
jae 0x4f73a9
mov cl, byte [esi]
and cl, 0xfe
cmp cl, 0xe8
je 0x4f73a6
inc esi
cmp esi, edx
jb 0x4f7397
mov ecx, dword [ebp - 4]
mov edi, esi
sub edi, ecx
mov ecx, edi
sub ecx, ebx
cmp esi, edx
jae 0x4f74b9
cmp ecx, 3
jbe 0x4f73e8
xor eax, eax
mov cl, byte [esi + 4]
mov ebx, edi
mov dword [ebp - 0x10], ebx
test cl, cl
je 0x4f7426
cmp cl, 0xff
je 0x4f7426
mov edx, dword [ebp - 8]
and eax, 3
add eax, eax
mov ecx, 1
or eax, 1
add edi, ecx
mov ecx, dword [ebp - 4]
jmp 0x4f7390
dec ecx
shl eax, cl
and eax, 7
je 0x4f73c0
movzx ecx, byte [eax + 0x59dd70]
mov edx, esi
sub edx, ecx
cmp byte [eax + 0x59dd68], 0
mov cl, byte [edx + 4]
je 0x4f7410
test cl, cl
je 0x4f7410
cmp cl, 0xff
jne 0x4f73c0
mov edx, dword [ebp - 8]
and eax, 3
mov ecx, dword [ebp - 4]
add eax, eax
mov ebx, edi
or eax, 1
inc edi
jmp 0x4f7390
movzx edx, cl
movzx ecx, byte [esi + 3]
shl edx, 8
or edx, ecx
movzx ecx, byte [esi + 2]
shl edx, 8
or edx, ecx
movzx ecx, byte [esi + 1]
shl edx, 8
or edx, ecx
sub edx, edi
lea ebx, [edx - 5]
test eax, eax
je 0x4f7482
movzx edx, byte [eax + 0x59dd70]
mov ecx, 0x18
shl edx, 3
sub ecx, edx
mov dword [ebp - 0xc], edx
mov edx, ebx
shr edx, cl
test dl, dl
je 0x4f746e
cmp dl, 0xff
jne 0x4f7482
mov ecx, 0x20
mov edx, 1
sub ecx, dword [ebp - 0xc]
shl edx, cl
dec edx
xor edx, ebx
jmp 0x4f7444
mov edx, dword [ebp - 8]
mov ecx, ebx
shr ecx, 0x18
and cl, 1
mov byte [esi + 1], bl
dec cl
not cl
mov byte [esi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [esi + 3], cl
mov ecx, ebx
mov ebx, dword [ebp - 0x10]
shr ecx, 8
mov byte [esi + 2], cl
mov ecx, 5
add edi, ecx
mov ecx, dword [ebp - 4]
jmp 0x4f7390
pop esi
pop ebx
cmp ecx, 3
jbe 0x4f74ce
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov dword [ecx], eax
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
dec ecx
shl eax, cl
mov ecx, dword [ebp + 0xc]
and eax, 7
mov dword [ecx], eax
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4f83e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x585004
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x5c4104]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x1b0], eax
mov eax, dword [ebp + 0x10]
cmp eax, 0xa
jne 0x4f84da
push 0x3e9
push dword [esi + 0x16c]
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, dword [esi + 0x1b8]
test ecx, ecx
je 0x4f8442
push ecx
mov dword [esp], 0x3f800000
call fcn.00495bb0
mov eax, dword [0x5c778c]
test eax, eax
jne 0x4f847d
push 0x174
call fcn.0051aa14
add esp, 4
mov dword [ebp + 0xc], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x4f846f
mov ecx, eax
call fcn.004d57f0
jmp 0x4f8471
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x5c778c], eax
mov ecx, eax
call fcn.004d62c0
mov eax, dword [0x5c7790]
test eax, eax
jne 0x4f84bf
push 0x120
call fcn.0051aa14
add esp, 4
mov dword [ebp + 0xc], eax
mov dword [ebp - 4], 1
test eax, eax
je 0x4f84b1
mov ecx, eax
call fcn.004f95b0
jmp 0x4f84b3
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x5c7790], eax
mov ecx, eax
call fcn.004f9b50
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x10
cmp eax, 9
jne 0x4f84f0
mov eax, dword [esi]
push 0
call dword [eax + 0xd0]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4f9b90
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5852b4
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x5c4104]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [0x5c7790]
test esi, esi
jne 0x4f9bf5
push 0x120
call fcn.0051aa14
add esp, 4
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], esi
test eax, eax
je 0x4f9be6
mov ecx, eax
call fcn.004f95b0
mov esi, eax
jmp 0x4f9be8
xor esi, esi
mov dword [ebp - 4], 0xffffffff
mov dword [0x5c7790], esi
push dword [esi + 0x38]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x4f9cb2
push 1
mov ecx, esi
call fcn.004a28d0
push 0xe8
call fcn.0051aa14
add esp, 4
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 1
test eax, eax
je 0x4f9c35
mov ecx, eax
call fcn.00497dd0
mov edi, eax
jmp 0x4f9c37
xor edi, edi
push 3
push 0x83
mov ecx, edi
mov dword [ebp - 4], 0xffffffff
call fcn.00497a60
push 2
mov ecx, edi
call fcn.00499250
movaps xmm0, xmmword [0x589cf0]
sub esp, 0x10
mov eax, esp
mov ecx, edi
movups xmmword [eax], xmm0
call fcn.004993a0
push edi
mov ecx, esi
call fcn.004a28f0
push 0
mov ecx, esi
call fcn.004a10a0
movaps xmm0, xmmword [0x589d00]
push 0
push ecx
mov eax, esp
push 0x40000
push SysReAllocStringLen
push 0x5a45ec
push ecx
mov dword [eax], 0
lea ecx, [ebp - 0x20]
mov eax, esp
movups xmmword [ebp - 0x20], xmm0
push 0
mov dword [eax], ecx
mov ecx, esi
call fcn.0049f9a0
push 1
push dword [esi + 0x38]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
call fcn.004a2b80
push eax
call fcn.00416a10
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0051b15a
mov esp, ebp
pop ebp
ret
Function at 0x4fa8a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x585436
mov eax, dword fs:[0]
push eax
sub esp, 0x240
mov eax, dword [0x5c4104]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x224], ecx
mov eax, dword [ecx]
mov eax, dword [eax + 0xd0]
call eax
mov dword [ebp - 0x248], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x244], 0
push eax
push 0x11
movups xmmword [ebp - 0x240], xmm0
push 0
movq qword [ebp - 0x230], xmm0
mov dword [ebp - 0x238], 0x51
mov dword [ebp - 0x23c], 0x589fd8
mov dword [ebp - 0x21c], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov ecx, dword [ebp - 0x244]
test eax, eax
lea eax, [ebp - 0x248]
cmovns ecx, dword [ebp - 0x21c]
push eax
mov dword [ebp - 0x244], ecx
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov esi, eax
test esi, esi
je 0x4faa0f
lea eax, [ebp - 0x218]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x4faa0f
push esi
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x220]
call fcn.00404e80
mov eax, dword [ebp - 0x220]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x24c], esp
mov esi, esp
mov dword [ebp - 4], 0
push eax
mov dword [ebp - 0x228], esi
call fcn.00405650
add eax, 0x10
add esp, 4
mov dword [esi], eax
mov byte [ebp - 4], 1
call fcn.004fa800
mov byte [ebp - 4], 0
lea ecx, [eax + 4]
call fcn.004dc1f0
push ecx
push esp
call fcn.004fa800
lea ecx, [eax + 4]
call fcn.004dc080
mov ecx, dword [ebp - 0x224]
mov ecx, dword [ecx + 0x194]
call fcn.00492d20
mov edx, dword [ebp - 0x220]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4faa0f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x4faa20
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0051b15a
mov esp, ebp
pop ebp
ret 4
Function at 0x4fde50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5859a6
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x5c4104]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0x60
push 0
push esi
mov byte [ebp - 4], 1
call ebx
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x4fdefc
push 2
push eax
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x4fdefc
call fcn.00480540
mov esi, eax
jmp 0x4fdfec
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x4fdf1f
call fcn.00480540
jmp 0x4fdfdf
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
test ebx, ebx
jne 0x4fdf3d
call fcn.00480540
jmp 0x4fdfdf
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x41c], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x4fdf5e
mov esi, 0x8007000e
jmp 0x4fdfe1
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.004fcd20
jmp 0x4fdf88
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
jne 0x4fdf9f
mov esi, 0x8007000e
jmp 0x4fdfe1
push esi
push dword [ebp - 0x418]
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x4fdfbf
call fcn.00480540
jmp 0x4fdfdf
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.004fdcf0
mov esi, eax
test edi, edi
je 0x4fdfec
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x4fe010
lea ecx, [ebp - 0x418]
call fcn.004fd2a0
nop word [eax + eax]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0051b15a
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4ff2c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
test ebx, ebx
jne 0x4ff2d9
lea eax, [ebx + 0xd]
pop ebx
mov esp, ebp
pop ebp
ret 8
push esi
push edi
xor esi, esi
mov edx, ebx
nop
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4ff2e5
sub eax, edi
sar eax, 1
lea ecx, [eax + 1]
lea edx, [edx + ecx*2]
lea esi, [esi + ecx*2]
cmp ecx, 1
jne 0x4ff2e0
mov eax, dword [ebp - 4]
push esi
push ebx
push 7
push 0
push dword [ebp + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x5631e0
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00562de5

Function at 0x5631eb
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00562f66

Function at 0x56967e
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00568e58

Function at 0x569689
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00569093

Function at 0x569af5
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0056987c

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x5d841cc9
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x43ad1c0f
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x5e6f50
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
pushal
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
test eax, eax
je 0x5e6fee
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
test eax, eax
jne 0x5e6fee
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
cmp word [eax], 0x5a4d
jne 0x5e6fee
mov ebx, dword [eax + 0x3c]
add eax, ebx
cmp dword [eax], 0x4550
jne 0x5e6fee
mov ebx, dword [eax + 0x34]
mov dword [ebp - 0xc], ebx
mov ebx, dword [eax + 0x50]
mov dword [ebp - 8], ebx
push edi
push 4
push 0x2000
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [edi + 0x122d2b39]
pop edi
test eax, eax
jne 0x5e6fe1
push edi
push 4
push 0x2000
push dword [ebp - 8]
push 0
call dword [edi + 0x122d2b39]
pop edi
test eax, eax
je 0x5e6fee
mov ebx, dword [ebp + 8]
mov dword [ebx + 0x14], eax
mov dword [ebp - 0x10], 1
popal
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x5e7073
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
pushal
mov eax, dword [ebp + 8]
mov ebx, dword [eax + 0x14]
mov dword [ebp - 8], ebx
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov ebx, dword [eax + 0x3c]
add eax, ebx
lea ebx, [eax + 0x18]
movzx ecx, word [eax + 0x14]
add ebx, ecx
movzx ecx, word [eax + 6]
test ecx, ecx
je 0x5e711f
push ecx
mov ecx, dword [ebx + 8]
mov edx, dword [ebx + 0x10]
cmp ecx, edx
jae 0x5e70b4
mov ecx, edx
mov dword [ebp - 4], ecx
mov eax, dword [ebx + 0xc]
add eax, dword [ebp - 8]
push ecx
push edi
push 4
push 0x1000
push dword [ebp - 4]
push eax
call dword [edi + 0x122d2b39]
pop edi
pop ecx
test eax, eax
je 0x5e7112
push edi
mov edi, eax
xor eax, eax
push ecx
push edi
rep stosb byte es:[edi], al
pop edi
pop ecx
mov edx, dword [ebx + 0x10]
cmp ecx, edx
jl 0x5e70f2
mov ecx, edx
mov esi, dword [ebx + 0x14]
add esi, dword [ebp - 0xc]
lea eax, [ebx + 0x10]
cmp dword [eax + 4], 0
je 0x5e7107
rep movsb byte es:[edi], byte [esi]
pop edi
add ebx, 0x28
pop ecx
dec ecx
jmp 0x5e709b
pop ecx
mov dword [ebp - 0x10], 0
jmp 0x5e7126
mov dword [ebp - 0x10], 1
popal
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x5e7340
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
mov dword [ebp - 0x18], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x14], eax
mov ebx, dword [eax + 0x3c]
add eax, ebx
lea ebx, [eax + 0x18]
movzx ecx, word [eax + 0x14]
add ebx, ecx
movzx ecx, word [eax + 6]
test ecx, ecx
je 0x5e73ba
push ecx
mov ecx, dword [ebx + 0xc]
add ecx, dword [ebp - 0x14]
mov edx, dword [ebx + 0x24]
push edx
call fcn.005e72e5
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
mov eax, dword [ebx + 8]
mov dword [ebp - 8], eax
push edi
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [edi + 0x122d2eb6]
pop edi
test eax, eax
jne 0x5e73b0
pop ecx
jmp 0x5e73c1
add ebx, 0x28
pop ecx
dec ecx
jmp 0x5e7369
mov dword [ebp - 0x18], 1
popal
mov eax, dword [ebp - 0x18]
leave
ret 4
Function at 0x5e7567
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [ebp + 0x18], 0
jne 0x5e76bb
cmp dword [ebp + 0xc], 0
jne 0x5e76bb
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [eax + 8]
cmp eax, 0xffffffff
je 0x5e75ae
sub eax, dword [ebp + 0x10]
js 0x5e76bb
je 0x5e76bb
cmp eax, dword [ebp + 0x14]
jl 0x5e76bb
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
cmp word [eax], 0x5a4d
jne 0x5e76bb
mov ebx, dword [eax + 0x3c]
add eax, ebx
cmp dword [eax], 0x4550
jne 0x5e76bb
mov ebx, dword [eax + 0x50]
push edi
push 4
push 0x1000
push ebx
push 0
call dword [edi + 0x122d2b39]
pop edi
test eax, eax
je 0x5e76bb
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], eax
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x14], ebx
pop ebx
lea eax, [ebp - 0x18]
push edi
push eax
lea eax, [edi + 0x124ab91e]
push eax
call fcn.005e65cf
pop edi
test eax, eax
je 0x5e76bb
lea eax, [ebp - 0x18]
push edi
push eax
lea eax, [edi + 0x124ab922]
push eax
call fcn.005e65cf
pop edi
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
mov ebx, dword [eax + 0x3c]
add eax, ebx
mov eax, dword [eax + 0x54]
mov dword [ebp - 0xc], eax
push edi
mov ecx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x1c]
mov esi, dword [esi + 4]
rep movsb byte es:[edi], byte [esi]
pop edi
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
mov dword [ebp - 4], eax
mov ebx, dword [eax + 0x3c]
add eax, ebx
lea ebx, [eax + 0x18]
movzx ecx, word [eax + 0x14]
add ebx, ecx
movzx ecx, word [eax + 6]
test ecx, ecx
je 0x5e76ae
push ecx
mov ecx, dword [ebx + 8]
mov eax, dword [ebx + 0xc]
add eax, dword [ebp - 8]
test eax, eax
je 0x5e76bb
push edi
mov edi, eax
xor eax, eax
push ecx
push edi
rep stosb byte es:[edi], al
pop edi
pop ecx
mov edx, dword [ebx + 0x10]
cmp ecx, edx
jl 0x5e769b
mov ecx, edx
mov esi, dword [ebx + 0x14]
add esi, dword [ebp - 4]
rep movsb byte es:[edi], byte [esi]
pop edi
add ebx, 0x28
pop ecx
dec ecx
jmp 0x5e7669
push dword [ebp + 8]
call fcn.005e845d
jmp 0x5e76c2
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
leave
ret 0x14
Function at 0x5e7a4d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
pushal
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x5e7b3c
mov ecx, eax
mov ebx, dword [ecx + 0x3c]
add ecx, ebx
mov ecx, dword [ecx + 0x7c]
test ecx, ecx
je 0x5e7b3c
mov dword [ebp - 4], ecx
mov ebx, eax
mov ecx, dword [ebx + 0x3c]
add ebx, ecx
mov ebx, dword [ebx + 0x78]
add ebx, eax
mov dword [ebp - 8], ebx
mov eax, dword [ebp + 0xc]
test eax, 0xffff0000
je 0x5e7ae8
mov ecx, dword [ebx + 0x18]
test ecx, ecx
je 0x5e7b3c
dec ecx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x20]
add eax, dword [ebp - 0xc]
push ecx
shl ecx, 2
add eax, ecx
mov eax, dword [eax]
add eax, dword [ebp - 0xc]
push edi
push dword [ebp + 0xc]
push eax
call dword [edi + 0x124aba7e]
pop edi
pop ecx
test eax, eax
jne 0x5e7aa1
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x24]
add eax, dword [ebp - 0xc]
shl ecx, 1
add eax, ecx
movzx ecx, word [eax]
jmp 0x5e7aee
mov ecx, dword [ebp + 0xc]
sub ecx, dword [ebx + 0x10]
mov ebx, dword [ebp - 8]
mov eax, dword [ebx + 0x14]
cmp ecx, eax
jge 0x5e7b3c
mov eax, dword [ebp - 0xc]
mov edx, dword [ebx + 0x1c]
add edx, eax
shl ecx, 2
add edx, ecx
cmp dword [edx], 0
je 0x5e7b3c
mov ebx, dword [edx]
add eax, ebx
mov dword [ebp - 0x10], eax
cmp eax, dword [ebp - 8]
jle 0x5e7b3c
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jge 0x5e7b3c
push dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.005e7996
mov dword [ebp - 0x10], eax
popal
mov eax, dword [ebp - 0x10]
leave
ret 8

Function at 0x5efde4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x5efdff
add esi, 0x1000
lea eax, [ebp - 0x2bc]
push edx
push 0x1c
push eax
push esi
call dword [edx + 0x124b5024]
pop edx
test eax, eax
je 0x5efed1
cmp dword [ebp - 0x2ac], 0x1000
jne 0x5efec0
test dword [ebp - 0x2a8], 1
jne 0x5efec0
and dword [ebp - 0x2a8], 0x100
jne 0x5efec0
push esi
push edx
push 4
push esi
call dword [edx + 0x122d39e9]
pop edx
pop esi
test eax, eax
je 0x5efe63
jmp 0x5efec0
cmp word [esi], 0x5a4d
jne 0x5efec0
mov eax, esi
push ebx
mov ebx, dword [esi + 0x3c]
add eax, ebx
pop ebx
cmp dword [eax], 0x4550
jne 0x5efec0
lea eax, [ebp - 0x28c]
push edx
push 0x28a
push eax
push esi
call dword [edx + 0x122d3c59]
pop edx
test eax, eax
je 0x5efec0
lea eax, [ebp - 0x28c]
push eax
call fcn.005efd40
test eax, eax
jne 0x5efeb9
jmp 0x5efec0
mov eax, esi
jmp 0x5efed1
mov esi, dword [ebp - 0x2b0]
add esi, dword [ebp - 0x2bc]
jmp 0x5efdff
pop esi
leave
ret 4
Function at 0x4b3ab0
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub esp, 0x860
push ebx
push 0x800
lea eax, [esp + 0x68]
mov dword [esp + 8], edx
push 0
push eax
mov ebx, ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x10]
push 0xf0000000
push 0x18
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x4b3c89
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x8004
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x4b3c89
movaps xmm0, xmmword [0x4f2060]
movups xmmword [esp + 0x14], xmm0
push esi
movaps xmm0, xmmword [0x4f2020]
mov esi, dword [esp + 0x86c]
movups xmmword [esp + 0x28], xmm0
movaps xmm0, xmmword [0x4f2050]
movups xmmword [esp + 0x38], xmm0
movaps xmm0, xmmword [0x4f2010]
movups xmmword [esp + 0x48], xmm0
movaps xmm0, xmmword [str.nx]
movups xmmword [esp + 0x58], xmm0
test esi, esi
je 0x4b3b8f
cmp dword [esi], 0
je 0x4b3b8f
push edi
lea edi, [esp + 0x1c]
xor edx, edx
mov ecx, esi
sub edi, esi
cmp esi, 0x4f92b4
jne 0x4b3b7b
mov eax, dword [edi + ecx]
lea eax, [eax*2 + 0x4f18a0]
jmp 0x4b3b7d
mov eax, dword [ecx]
mov ax, word [eax]
add ecx, 4
mov word [esp + edx*2 + 0x6c], ax
inc edx
cmp edx, 0x14
jb 0x4b3b67
pop edi
lea ecx, [esp + 0x68]
lea edx, [ecx + 2]
pop esi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4b3b97
sub ecx, edx
sar ecx, 1
push 0
lea eax, [ecx + ecx]
push eax
lea eax, [esp + 0x6c]
push eax
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x4b3c89
push 0x800
lea eax, [esp + 0x68]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [esp + 0x87c]
add esp, 0xc
cmp ecx, 0x80
jne 0x4b3bed
mov eax, 0x660e
jmp 0x4b3bfd
xor eax, eax
cmp ecx, 0xc0
setne al
add eax, 0x660f
lea edx, [esp + 0xc]
shl ecx, 0x10
push edx
push ecx
push dword [esp + 0x10]
push eax
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x4b3c89
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
test eax, eax
je 0x4b3c89
cmp byte [esp + 0x86c], 0
je 0x4b3c51
mov eax, dword [esp + 4]
add eax, 0x10
push eax
lea eax, [esp + 8]
push eax
push ebx
push 0
push 1
push 0
push dword [esp + 0x24]
call dword [0x4faaa4]
jmp 0x4b3c67
lea eax, [esp + 4]
push eax
push ebx
push 0
push 1
push 0
push dword [esp + 0x20]
call dword [0x4faaa0]
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push 0
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [esp + 4]
pop ebx
add esp, 0x860
ret
xor eax, eax
pop ebx
add esp, 0x860
ret
Function at 0x4cc02b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4cc06a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4cc06a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4cc06a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4cc06a
cmp dword [ecx + 0x74], 0xe
jbe 0x4cc06a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219