joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42afa5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x508578]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call fcn.0040157d
xor edi, edi
push edi
push eax
call fcn.00401677
mov esi, eax
pop ecx
pop ecx
mov dword [ebp - 0x2c], esi
cmp esi, edi
jne 0x42afd8
push 2
pop eax
jmp 0x42b0b7
push ebx
push edi
push edi
call fcn.004010a5
mov ebx, eax
pop ecx
pop ecx
cmp ebx, edi
jne 0x42aff9
xor edi, edi
inc edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x42b0b6
push edi
push 0x20
lea eax, [ebp - 0x24]
push eax
push esi
call fcn.00401f3c
add esp, 0x10
test eax, eax
jne 0x42b012
push 4
pop edi
jmp 0x42afeb
movsx eax, word [ebp - 0x16]
cmp eax, dword [0x56f61c]
je 0x42b022
push 3
jmp 0x42b00f
mov eax, dword [0x572114]
mov dword [ebp - 0x28], eax
mov esi, 0x56f948
push edi
push 0x80
push esi
push dword [ebp - 0x2c]
call fcn.00401f3c
add esp, 0x10
test eax, eax
je 0x42b073
mov ecx, esi
call fcn.0042a131
test eax, eax
je 0x42b077
push 0x7f
pop edi
cmp ebx, edi
jge 0x42b059
mov edi, ebx
push edi
push esi
push dword [ebp - 0x28]
call fcn.004936a0
add dword [ebp - 0x28], edi
sub ebx, edi
add esp, 0xc
test ebx, ebx
jle 0x42b07c
xor edi, edi
jmp 0x42b02f
push 4
jmp 0x42b079
push 3
pop esi
jmp 0x42b0a6
xor al, al
xor ecx, ecx
xor al, byte [ebp + ecx - 0x14]
inc ecx
cmp ecx, 8
jb 0x42b080
push dword [ebp - 0xc]
mov byte [ebp - 0x28], al
push dword [ebp - 0x28]
call fcn.004019ce
mov esi, eax
neg esi
sbb esi, esi
pop ecx
and esi, 0xfffffffd
pop ecx
add esi, 3
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00401177
mov eax, esi
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00493576
leave
ret
Function at 0x42b10d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x508578]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call fcn.0040157d
xor esi, esi
mov edi, eax
cmp dword [ebp + 8], esi
je 0x42b14b
push 0x40
push esi
push 0x554d00
call fcn.00493620
push 0x40
push esi
push 0x555530
call fcn.00493620
add esp, 0x18
mov eax, dword [0x56f61c]
mov ecx, eax
and ecx, 0x8000007f
jns 0x42b15f
dec ecx
or ecx, 0xffffff80
inc ecx
cdq
neg ecx
push 0x7f
sbb ecx, ecx
pop esi
idiv esi
mov ebx, 0x80
and ecx, ebx
shl eax, 7
lea eax, [ecx + eax + 0x20]
push eax
call fcn.0042a357
pop ecx
test eax, eax
jns 0x42b18a
push 5
pop eax
jmp 0x42b2df
jle 0x42b190
push 7
jmp 0x42b184
push 0
push edi
mov dword [ebp - 0x28], 1
call fcn.00401677
pop ecx
pop ecx
test eax, eax
jne 0x42b1a8
and dword [ebp - 0x28], eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
push 0x20
lea eax, [ebp - 0x24]
push 0
push eax
call fcn.00493620
lea eax, [ebp - 0x24]
push str.PM3win95
push eax
call fcn.00493d10
mov ax, word [0x56f61c]
push edi
mov word [ebp - 0x16], ax
call fcn.00402284
mov edi, eax
add esp, 0x18
mov dword [ebp - 0x38], edi
test edi, edi
jne 0x42b1f7
mov eax, dword [ebp - 0x28]
neg eax
sbb eax, eax
add eax, 6
jmp 0x42b2df
cmp dword [ebp + 8], 0
je 0x42b213
push 8
lea eax, [ebp - 0x14]
push 0
push eax
mov byte [ebp - 0x28], 0
call fcn.00493620
add esp, 0xc
jmp 0x42b245
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x40]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
xor al, al
xor ecx, ecx
xor al, byte [ebp + ecx - 0x14]
inc ecx
cmp ecx, 8
jb 0x42b238
mov byte [ebp - 0x28], al
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x28]
call fcn.004010a5
pop ecx
pop ecx
mov dword [ebp - 0x30], eax
test eax, eax
jne 0x42b262
push edi
call esi
xor eax, eax
inc eax
jmp 0x42b2df
mov eax, dword [0x572114]
mov dword [ebp - 0x28], eax
push 0x20
lea eax, [ebp - 0x24]
push eax
push edi
call fcn.004020a4
add esp, 0xc
test eax, eax
je 0x42b2ee
cmp dword [ebp - 0x30], 0
jle 0x42b2cd
mov esi, 0x56f948
push 0x7f
pop edi
cmp dword [ebp - 0x30], edi
jge 0x42b29f
mov edi, dword [ebp - 0x30]
push ebx
push 0
push esi
call fcn.00493620
add esp, 0xc
push edi
push dword [ebp - 0x28]
push esi
call fcn.004936a0
mov ecx, esi
call fcn.0042a148
push ebx
push esi
push dword [ebp - 0x38]
call fcn.004020a4
add esp, 0x18
test eax, eax
je 0x42b2ee
add dword [ebp - 0x28], edi
sub dword [ebp - 0x30], edi
cmp dword [ebp - 0x30], 0
jg 0x42b288
xor esi, esi
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00401177
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00493576
leave
ret
push 5
pop esi
jmp 0x42b2cf
Function at 0x42b36c
Capabilities:
Create thread

Disassembly:
push ebx
xor ebx, ebx
test byte [0x572120], 1
je 0x42b38d
and dword [0x572120], 0xfffffffe
xor eax, eax
mov word [0x57212c], ax
mov byte [0x572129], bl
movsx eax, byte [0x572129]
sub eax, ebx
je 0x42b3c1
dec eax
je 0x42b3a3
mov byte [0x572128], bl
pop ebx
ret
cmp dword [0x56fb10], ebx
je 0x42b3f1
push ebx
push dword [0x56fb14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x42b407
jmp 0x42b3f1
push 0x56f944
push ebx
push ebx
push 0x42a6fb
push ebx
push ebx
mov dword [0x56fb10], 2
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x56fb14], eax
cmp eax, ebx
jne 0x42b400
push 0x65
pop eax
mov word [0x57212c], ax
mov dword [0x56fb10], ebx
mov byte [0x572129], 0x7f
pop ebx
ret
mov byte [0x572129], 1
pop ebx
ret

Function at 0x42baea
Capabilities:
Create thread

Disassembly:
push ebx
xor ebx, ebx
test byte [0x572120], 1
je 0x42bb0b
and dword [0x572120], 0xfffffffe
xor eax, eax
mov word [0x57212c], ax
mov byte [0x572129], bl
movsx eax, byte [0x572129]
sub eax, ebx
je 0x42bb3f
dec eax
je 0x42bb21
mov byte [0x572128], bl
pop ebx
ret
cmp dword [0x56fb10], ebx
je 0x42bb6f
push ebx
push dword [0x56fb14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x42bb85
jmp 0x42bb6f
push 0x56f944
push ebx
push ebx
push 0x42b643
push ebx
push ebx
mov dword [0x56fb10], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x56fb14], eax
cmp eax, ebx
jne 0x42bb7e
push 0x65
pop eax
mov word [0x57212c], ax
mov dword [0x56fb10], ebx
mov byte [0x572129], 0x7f
pop ebx
ret
mov byte [0x572129], 1
pop ebx
ret

Function at 0x42bbae
Capabilities:
Create thread

Disassembly:
push ebx
xor ebx, ebx
test byte [0x572120], 1
je 0x42bc00
and dword [0x572120], 0xfffffffe
push 0xf78
xor eax, eax
push 0x40
mov word [0x57212c], ax
mov byte [0x572129], bl
mov word [0x572243], 0xf
mov byte [0x572245], bl
mov byte [0x56d5d0], bl
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [0x572110], eax
cmp eax, ebx
jne 0x42bc80
jmp 0x42bc67
movsx eax, byte [0x572129]
sub eax, ebx
je 0x42bc3a
dec eax
je 0x42bc16
mov byte [0x572128], bl
pop ebx
ret
cmp dword [0x56fb10], ebx
je 0x42bc32
push ebx
push dword [0x56fb14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x42bc80
mov dword [0x56fb10], ebx
jmp 0x42bc70
push 0x56f944
push ebx
push ebx
push 0x42b92c
push ebx
push ebx
mov dword [0x56fb10], 3
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x56fb14], eax
cmp eax, ebx
jne 0x42bc79
mov dword [0x56fb10], ebx
push 0x65
pop eax
mov word [0x57212c], ax
mov byte [0x572129], 0x7f
pop ebx
ret
mov byte [0x572129], 1
pop ebx
ret
Function at 0x42cfd3
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x508578]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x573e34], 0
jne 0x42d054
call fcn.00401703
cmp dword [ebp + 8], 1
push dword [ebp + 0xc]
lea eax, [ebp - 0x18]
jne 0x42d006
push 1
push str._02d_03d
jmp 0x42d00e
push dword [ebp + 8]
push str._02d_02d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x18]
push esi
push eax
call fcn.00401d89
push eax
mov esi, 0x573d18
push esi
call fcn.00493d10
or dword [0x573e60], 3
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
push 0
push esi
push 0x4016cc
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x573e28], eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00493576
leave
ret

Function at 0x42ef7a
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, eax
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x42efa0
xor eax, eax
jmp 0x42efd9
mov eax, dword [esi + 8]
test eax, eax
jns 0x42efb1
push dword [esi + 0xc]
call fcn.00493ac0
pop ecx
inc eax
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push eax
push ecx
push edx
push 0
push dword [esi]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
leave
ret

Function at 0x42f69d
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x508578]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x20c]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
xor ebx, ebx
test eax, eax
jne 0x42f6de
mov byte [ebp - 0x20c], bl
push esi
lea eax, [ebp - 0x108]
push eax
push str.InstPath
push ebx
mov byte [ebp - 0x108], bl
call fcn.00401825
add esp, 0x10
mov esi, str.ID_PM3JP.DAT
test eax, eax
je 0x42f70b
cmp byte [ebp - 0x108], bl
je 0x42f73e
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.004014c4
pop ecx
pop ecx
test eax, eax
je 0x42f73e
lea eax, [ebp - 0x108]
push eax
mov esi, 0x573ef0
push esi
call fcn.00493d10
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
xor eax, eax
inc eax
jmp 0x42f79a
cmp byte [ebp - 0x20c], bl
je 0x42f778
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.004014c4
pop ecx
pop ecx
test eax, eax
je 0x42f778
lea eax, [ebp - 0x20c]
push eax
mov esi, 0x573ef0
push esi
call fcn.00493d10
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 2
jmp 0x42f799
cmp edi, ebx
jne 0x42f782
mov byte [0x573ef0], bl
push edi
mov esi, 0x573ef0
push esi
call fcn.00493d10
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 3
pop eax
mov ecx, dword [ebp - 0x210]
mov dword [ecx], esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00493576
leave
ret
Function at 0x449000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x19c
mov eax, dword [0x508578]
xor eax, esp
mov dword [esp + 0x198], eax
push ebx
mov ebx, dword [esp + 0x1a8]
mov eax, dword [esp + 0x1a4]
push ebp
push esi
push edi
mov edi, ecx
mov ecx, dword [edx]
add ecx, ecx
add ecx, ecx
mov ebp, dword [eax + 0x54]
mov dword [esp + 0x20], ecx
mov ecx, dword [edx + 4]
mov edx, dword [edi]
add edx, edx
add edx, edx
mov dword [esp + 0x28], edx
mov edx, dword [edi + 4]
mov edi, dword [ebx]
add edi, edi
add edi, edi
mov dword [esp + 0x30], edi
mov edi, dword [ebx + 4]
mov ebx, dword [eax + 0x74]
mov dword [esp + 0x38], ebx
mov ebx, dword [eax + 0x78]
add ecx, ecx
add ecx, ecx
mov dword [esp + 0x3c], ebx
add edx, edx
add edi, edi
mov ebx, ecx
sar ebx, 8
add edx, edx
add edi, edi
mov dword [esp + 0x1c], eax
lea esi, [esp + 0x20]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x34], edi
mov dword [esp + 0x10], ebx
cmp ebx, ebp
jl 0x4490ae
mov ebx, edx
sar ebx, 8
cmp ebx, ebp
jl 0x4490aa
mov ebx, edi
sar ebx, 8
cmp ebx, ebp
jl 0x4490aa
mov ebx, dword [esp + 0x3c]
sar ebx, 8
cmp ebx, ebp
jge 0x4490ce
mov ebx, dword [esp + 0x10]
mov ebp, dword [eax + 0x50]
cmp ebx, ebp
jge 0x4490f1
sar edx, 8
cmp edx, ebp
jge 0x4490f1
sar edi, 8
cmp edi, ebp
jge 0x4490f1
mov edx, dword [esp + 0x3c]
sar edx, 8
cmp edx, ebp
jge 0x4490f1
mov edx, dword [esp + 0x20]
mov dword [eax + 0x74], edx
mov dword [eax + 0x78], ecx
mov ecx, dword [esp + 0x1a8]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00493576
add esp, 0x19c
ret
mov ebp, dword [esi]
mov eax, dword [esi + 0x18]
mov ebx, dword [esi + 4]
mov edi, dword [esi + 0x1c]
sub eax, ebp
mov dword [esp + 0x18], eax
cdq
mov ecx, eax
sub edi, ebx
xor ecx, edx
sub ecx, edx
mov eax, edi
cdq
xor eax, edx
sub eax, edx
mov dword [esp + 0x14], edi
cmp ecx, eax
jle 0x449124
lea edx, [eax + eax*2]
sar edx, 3
add edx, ecx
jmp 0x44912c
lea edx, [ecx + ecx*2]
sar edx, 3
add edx, eax
cmp edx, 0x7fff
jg 0x4491e1
mov ecx, dword [esi + 8]
imul edx, edx, 0x2a
mov edi, dword [esi + 0xc]
mov dword [esp + 0x10], edx
sub ecx, ebp
sub edi, ebx
mov eax, ecx
imul eax, dword [esp + 0x14]
mov edx, edi
imul edx, dword [esp + 0x18]
sub eax, edx
cdq
xor eax, edx
sub eax, edx
cmp eax, dword [esp + 0x10]
jg 0x4491e1
mov ebx, dword [esi + 0x10]
sub ebx, ebp
mov ebp, dword [esi + 0x14]
sub ebp, dword [esi + 4]
mov eax, ebx
imul eax, dword [esp + 0x14]
mov edx, ebp
imul edx, dword [esp + 0x18]
sub eax, edx
cdq
xor eax, edx
sub eax, edx
cmp eax, dword [esp + 0x10]
jg 0x4491e1
mov eax, dword [esp + 0x18]
mov edx, edi
sub edx, dword [esp + 0x14]
imul edx, edi
mov edi, ecx
sub edi, eax
imul edi, ecx
add edx, edi
test edx, edx
jg 0x4491e1
mov ecx, ebp
sub ecx, dword [esp + 0x14]
mov edx, ebx
sub edx, eax
imul ecx, ebp
imul edx, ebx
add ecx, edx
test ecx, ecx
jg 0x4491e1
mov eax, dword [esi + 4]
push eax
mov eax, dword [esi]
push eax
mov eax, dword [esp + 0x24]
call fcn.00448a40
lea eax, [esp + 0x28]
add esp, 8
cmp esi, eax
je 0x4490d8
sub esi, 0x18
jmp 0x4490f1
mov ecx, esi
call fcn.00448f50
add esi, 0x18
jmp 0x4490f1
Function at 0x45ac10
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov ecx, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x18]
movzx esi, word [esi]
push edi
mov edi, dword [esp + 0x14]
mov ebx, dword [edi]
mov dword [esp + 0x18], ebx
cmp ebx, ecx
jb 0x45ac34
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret
sub ecx, ebx
cmp eax, ecx
cmova eax, ecx
xor ecx, ecx
test eax, eax
je 0x45ac73
push ebp
sub ebx, edx
mov ebp, eax
movzx edi, byte [ebx + edx]
mov ecx, esi
shr ecx, 8
xor ecx, edi
add edi, esi
imul edi, edi, 0x3193
mov esi, 0x58bf
sub esi, edi
mov byte [edx], cl
and esi, 0xffff
inc edx
dec ebp
jne 0x45ac46
mov ebx, dword [esp + 0x1c]
mov ecx, eax
pop ebp
mov edx, dword [esp + 0x1c]
add ebx, eax
mov eax, dword [esp + 0x14]
mov dword [eax], ebx
pop edi
mov word [edx], si
pop esi
mov eax, ecx
pop ebx
pop ecx
ret
Function at 0x493576
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x508578]
jne 0x493580
repz ret
jmp fcn.00496789

Function at 0x4a9494
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x508578]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00498be6
and dword [ebp - 0x14], 0
cmp dword [0x585610], 0
mov dword [ebp - 0x18], eax
jne 0x4a9547
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4a95ef
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4a95ef
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x585610], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x585614], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x585618], eax
call edi
push eax
call esi
mov dword [0x585620], eax
test eax, eax
je 0x4a9547
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x58561c], eax
mov eax, dword [0x58561c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4a95a0
cmp dword [0x585620], ecx
je 0x4a95a0
push eax
call esi
push dword [0x585620]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4a95a0
test ebx, ebx
je 0x4a95a0
call edi
test eax, eax
je 0x4a9597
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4a9597
test byte [ebp - 8], 1
jne 0x4a95a0
or dword [ebp + 0x10], 0x200000
jmp 0x4a95d3
mov eax, dword [0x585614]
cmp eax, dword [ebp - 0x18]
je 0x4a95d3
push eax
call esi
test eax, eax
je 0x4a95d3
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4a95d3
mov eax, dword [0x585618]
cmp eax, dword [ebp - 0x18]
je 0x4a95d3
push eax
call esi
test eax, eax
je 0x4a95d3
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x585610]
call esi
test eax, eax
je 0x4a95ef
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4a95f1
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00493576
leave
ret
Function at 0x5cbaa0
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg word [esp], dx
call fcn.005cba60

Function at 0x5d4bf0
Capabilities:
Execute anti-debugging instructions

Disassembly:
add dword [esi], reloc.ADVAPI32.dll_RegCloseKey
jmp fcn.005cbd67
mov eax, dword [esp]
stc
bsf dx, si
bswap eax
cmc
mov dx, 0xa69f
sub esp, 0x18
jmp 0x5d4c38
lea esp, [esp + 8]
neg ecx
inc al
jno 0x5d4bb8
jo 0x5d4c2e
pop ebp
fisttp dword [ebx + 0x2e]
fstp qword [edx]
mov ch, 0x3c
sal byte [ebp + 0x2889f644], cl
dec ebx
loop 0x5d4c0d
xchg word [esp], dx
lea edx, [ebp*4]
not ax
push dword [esp + 2]
jmp 0x5d4bd3
bswap eax
cmc
jmp 0x5d4bc3
sub dh, ah
xchg dword [esp + 0xe], edx
and al, 0xe
mov byte [esp + 6], ch
pop word [esp + 7]
bsr dx, cx
lea esp, [esp + 2]
jmp 0x5d4c86
mov eax, dword [esp]
stc
bsf dx, si
jmp 0x5d4c04
jno 0x5d4c09
sub dh, ah
xchg dword [esp + 0xe], edx
jmp 0x5d4ca3
call fcn.005d4d6a
sub esp, 0x1e
pop word [esp + 0x20]
jmp 0x5d4cbc
pop word [esp + 0x20]
pop dword [esp + 0x10]
jmp 0x5d4cc0
lea esp, [esp + 0x14]
not ecx
pushal
btc eax, edx
jg 0x5d4c5b
rdtsc
add esp, 0xf
sub esp, 0x1e
jmp 0x5d4c6e
mov byte [esp + 6], ch
pop word [esp + 7]
bsr dx, cx
jmp 0x5d4c1c
pop dword [esp + 0x10]
mov eax, edi
bsf dx, ax
je 0x5d4d36
jne 0x5d4d99
invalid
lea esp, [esp + 1]
jmp 0x5d4d77
lea esp, [esp + 0x28]
sub ecx, 0x406200b6
mov dl, byte [esp]
lea eax, [edx + ebx]
not ah
jmp 0x5d4dfa
lea esp, [esp + 1]
jmp 0x5d4d77
mov dword [esi], ecx
setae ah
xchg cx, ax
jmp 0x5d4f2e
btr edx, edi
jo 0x5d4de2
jno 0x5d4de2
mov bl, 0x2e
mov esp, 0x9ff036db
inc ebx
sal dword [esi + reloc.ADVAPI32.dll_RegCloseKey], cl
xor byte [ebx], dh
mov edx, 0xe0fbc812
jmp 0x5d4a76
sub esp, 0x10
jle 0x5d4e38
mov edx, 0xe0fbc812
jmp 0x5d4a76
Function at 0x5ea5cc
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 4]
movzx esi, byte [eax + 0xd]
jmp 0x5ea5cc
sub esp, 2
lea esp, [esp + 2]
jmp 0x5ea58e
push esi
mov esi, ecx
lea esi, [esi + 8]
jmp 0x5ea5d8
mov dword [esi], edx
pop esi
movzx edx, byte [eax + 0xc]
mov di, word [esp]
mov bx, 0xa317
jmp 0x5ea621
mov edi, 0x6e98efc2
ror edi, 5
jmp 0x5ea662
mov bl, 0xe8
neg bh
shl edx, 8
xchg bl, bh
mov di, word [esp]
jmp 0x5ea60b
mov bx, word [esp]
inc di
bswap edi
jmp 0x5ea7cb
xor edx, esi
movzx esi, byte [eax + 0xe]
movzx eax, byte [eax + 0xf]
jmp 0x5ea649
xor eax, 0x1000000
lea edi, [ecx + edi]
lea edi, [edx + ebx]
stc
jmp 0x5ea705
mov edi, 0xb26aafe0
rol bl, 5
and eax, esi
mov eax, dword [eax*4 + reloc.ADVAPI32.dll_RegCloseKey]
jmp 0x5ea66e
mov si, word [esp]
shr eax, 0x10
lea esp, [esp + 0x20]
mov esi, 0xff
jmp 0x5ea688
mov dword [ecx + 0xc], edx
mov eax, edx
bsr di, cx
bts ebx, ebx
jmp 0x5ea6ab
shr edi, 8
mov bl, byte [esp]
shr bh, 3
pushal
pop dword [esp + 8]
jmp 0x5ea710
mov edi, edx
lea ebp, [esp + edx]
stc
rol ebp, 0x11
jmp 0x5ea6e0
and edi, esi
call fcn.005ea788
bsr bp, bp
lea esp, [esp + 0x20]
and edi, 0xff0000
mov bp, word [esp]
lea ebp, [ecx*4]
jmp 0x5ea763
shl edx, 8
xor edx, eax
neg bh
pushal
jmp 0x5ea6d2
lea ebp, [esi - 0x45]
lea esp, [esp + 4]
and eax, 0xff000000
lea ebp, [esi - 0xfd]
lea ebp, [edi + edi]
jmp 0x5ea7b0
push edx
mov ebp, 0xcd95b8d8
mov ebx, dword [ecx + 4]
mov bp, 0x5297
mov bp, 0xcebf
jmp 0x5ea745
xor eax, edi
mov di, 0xce85
pushal
jmp 0x5ea820
lea ebp, [edi*4]
neg bp
jmp 0x5ea797
shl edx, 8
xor edx, esi
mov ebx, dword [esp]
mov ebp, 0x386a4fd8
jmp 0x5ea73b
pushal
lea ebx, [edx*4]
mov esi, dword [esp]
mov dword [esp], edx
call fcn.005ea805
lea esp, [esp + 0x3c]
movzx edi, byte [edi*4 + 0x5c7c7c]
sub esp, 0x16
push dword [esp + 0x10]
inc ebp
jmp 0x5ea879
pushal
btc ecx, edi
and ebp, ecx
mov dword [esp], edx
call fcn.005ea8c4
mov edx, 0x38c9ae38
sti
xchg esp, eax
adc eax, 0xa31fec85
push es
xchg byte [ebx + esi*2], dl
invalid
lea esp, [esp + 2]
xor eax, edi
mov edi, dword [esp]
mov di, word [esp]
jmp 0x5ea858

Function at 0x5eaf56
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 4]
cmp eax, 1
push edx
jmp 0x5eafaf
not dx
jmp 0x5eb005
lea esp, [esp + 4]
jle 0x5bdaee
mov dx, di
xchg dh, bl
inc dl
jmp 0x5eaf99
mov ecx, 0xff
jmp 0x5bdab3
mov dword [ebp - 4], ecx
xchg edi, edx
mov dl, 0x94
bswap edi
bswap edx
jmp 0x5eafd8
lea ecx, [eax - 1]
mov dh, byte [esp]
jmp 0x5eafee
Function at 0x5eb256
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
lea esp, [esp + 2]
mov dword [esi], edi
inc di
mov ebx, dword [ebx*4 + reloc.ADVAPI32.dll_RegCloseKey]
jmp 0x5eb246
jmp 0x5eb225
not edi
bsf di, si
not edi
mov edi, edx
call 0x5eb256
mov ebp, 0x767e9f9
add byte [eax], al
sub esp, 0x18
pop dword [esp + 0xc]
jmp 0x5eb689
lea esi, reloc.ADVAPI32.dll_RegCloseKey
mov edi, dword [esi]
pop esi
call 0x5eb424
mov edx, dword [edx*4 + reloc.ADVAPI32.dll_RegCloseKey]
and edx, ecx
jmp 0x5eb54b
mov dword [esi + 8], edi
mov ebx, dword [ebx*4 + reloc.ADVAPI32.dll_RegCloseKey]
lea edi, [edx*4]
lea edi, [esi*4]
jmp 0x5eb620
mov edx, dword [esp]
mov edx, dword [esi + 0xc]
pushal
clc
stc
jmp 0x5eb508
lea esp, [esp + 4]
xor edi, dword [edx*4 + reloc.ADVAPI32.dll_RegCloseKey]
lea edx, [esi - 0x25]
not dx
not dx
jmp 0x5eb531
bsf di, ax
mov edi, edx
sub esp, 4
shr edi, 0x18
call fcn.005eb5cf
xor edi, dword [ebx*4 + reloc.ADVAPI32.dll_RegCloseKey]
push esp
pushal
jmp 0x5eb65d
and edx, ecx
cmc
push edx
pop word [esp]
mov word [esp], bx
jmp 0x5eb66f
lea esp, [esp + 2]
lea esp, [esp + 0x24]
xor edi, dword [edx*4 + reloc.ADVAPI32.dll_RegCloseKey]
push edx
jmp 0x5eb755
push esi
mov esi, edi
lea esi, [esi*4]
jmp 0x5eb4ae
lea esp, [esp + 4]
dec dword [ebp - 4]
call fcn.005eb71d

Function at 0x5eb29a
Capabilities:
Encrypt data using aes

Disassembly:
pop word [esp]
mov word [esp], bx
lea esp, [esp + 2]
jmp 0x5eb2c4

Function at 0x5eb4bc
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 2]
mov dword [esi], edi
inc di
mov ebx, dword [ebx*4 + reloc.ADVAPI32.dll_RegCloseKey]
jmp 0x5eb246
jmp 0x5eb225
not edi
bsf di, si
not edi
mov edi, edx
call 0x5eb256
mov ebp, 0x767e9f9
add byte [eax], al
sub esp, 0x18
pop dword [esp + 0xc]
jmp 0x5eb689
lea esi, reloc.ADVAPI32.dll_RegCloseKey
mov edi, dword [esi]
pop esi
call 0x5eb424
mov edx, dword [edx*4 + reloc.ADVAPI32.dll_RegCloseKey]
and edx, ecx
jmp 0x5eb54b
mov dword [esi + 8], edi
mov ebx, dword [ebx*4 + reloc.ADVAPI32.dll_RegCloseKey]
lea edi, [edx*4]
lea edi, [esi*4]
jmp 0x5eb620
mov edx, dword [esp]
mov edx, dword [esi + 0xc]
pushal
clc
stc
jmp 0x5eb508
lea esp, [esp + 4]
xor edi, dword [edx*4 + reloc.ADVAPI32.dll_RegCloseKey]
lea edx, [esi - 0x25]
not dx
not dx
jmp 0x5eb531
bsf di, ax
mov edi, edx
sub esp, 4
shr edi, 0x18
call fcn.005eb5cf
xor edi, dword [ebx*4 + reloc.ADVAPI32.dll_RegCloseKey]
push esp
pushal
jmp 0x5eb65d
and edx, ecx
cmc
push edx
pop word [esp]
mov word [esp], bx
jmp 0x5eb66f
lea esp, [esp + 2]
lea esp, [esp + 0x24]
xor edi, dword [edx*4 + reloc.ADVAPI32.dll_RegCloseKey]
push edx
jmp 0x5eb755
push esi
mov esi, edi
lea esi, [esi*4]
jmp 0x5eb4ae
lea esp, [esp + 4]
dec dword [ebp - 4]
call fcn.005eb71d