joyce8/EMBER2024-capa huggingface dataset:
Function at 0x8f6e28
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.008f6f78
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x8f6e4e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8f6e3a
add dl, dl
jne 0x8f6e59
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8f6eac
xor eax, eax
add dl, dl
jne 0x8f6e66
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8f6f4d
add dl, dl
jne 0x8f6e75
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8f6e80
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8f6e8b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8f6e96
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x8f6ea2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x8f6e45
mov eax, 1
add dl, dl
jne 0x8f6eba
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8f6ec5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8f6eb1
sub eax, ebx
mov ebx, 1
jne 0x8f6ef8
mov ecx, 1
add dl, dl
jne 0x8f6ede
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x8f6ee9
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8f6ed5
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8f6e45
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x8f6f0f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x8f6f1a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8f6f06
cmp eax, 0x7d00
jae 0x8f6f3d
cmp eax, 0x500
jb 0x8f6f38
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8f6e45
cmp eax, 0x7f
ja 0x8f6f40
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8f6e45
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x8f6f6e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x8f6e45
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0xe99621
Capabilities:
Encrypt data using speck

Disassembly:
inc esi
or al, al
sbb edi, dword [edx - 0x40f44794]
shr byte [ebp - 0x702950c9], 1
mov al, 0xcf
test dword [ecx], ecx
aam 0x8f
dec esp
scasb al, byte es:[edi]
dec edi
test eax, 0xd90cb2a8
sub edi, dword [eax]
xor al, 0x6d
mov dl, 0x8a
add al, 0xab
adc al, 0x5b
loop 0xe995ce
arpl word [ebp + 0x64], cx
mov ebp, 0x9b52e9b9
rcr dword [ebx + 0x78], 1
popal
mov ebx, edx
push ebx
mov eax, esi
push eax
mov edi, ecx
add byte [edx - 0x36], dl
or al, 0x71
insb byte es:[edi], dx
mov al, byte [0xbe5eb731]
fmul qword [edi - 0x30317077]
les edi, [ebx]
add byte [ecx], 0x62
call fcn.00e95eff
sub edx, dword [edx + 0x67a8fefd]
push ecx
outsd dx, dword [esi]
cmp byte [ebx + 0x66b16b4f], bh
salc
cmp ebp, dword [bp - 0x76b]
fbstp tbyte [eax + 0x20]
jno 0xe995f1
and esp, dword [ebx + 8]
cmp ebx, dword [esi + 0x5bb709d0]
test byte [ebx + 0x5b5b077d], 0xd1
xchg esi, eax
sahf
pop edx
jns 0xe996a6
adc dl, byte [ecx + 0x4e046635]
jne 0xe99686
xor eax, 0x546ea112
salc
cmpsd dword [esi], dword es:[edi]
sub eax, 0xca94fdda
sbb dword [ecx], edx
lahf
je 0xe99677
lcall 0x8501, 0x8a4f52c1
jnp 0xe996d7
xchg edi, eax
cmpsd dword [esi], dword es:[edi]
pop edi
imul eax, edx, 0x83f87be1
dec edi
mov esi, dword [edi + ebp*8 + 0x2ac636e0]
push es
dec ebp
invalid
loopne 0xe996be
invalid
arpl word [ebp + 0x73], sp
jae 0xe996ab
sar bx, cl
mov ebx, eax
jmp 0xea2ba0
mov dh, 0x3e
fisubr word [edi]
fisubr word ds:[edi]
rcr byte [eax], 0xfd
sub ah, byte [eax - 0xeef981b]
jns 0xe996bf
mov dword [0xadad8955], eax
or byte [edx + 0x15ab9d05], 0x6d
and ebx, dword [ebx - 0x51]
adc eax, 0xaf5b236d
mov byte [0x826284fd], al
int3
cmp ch, al
stc
stc
cmp byte [edi], 0x23
push 0xa9634263
lea esp, [esp + 4]
jne 0x19439ca
rol eax, cl
lahf
stc
sar ah, 6
xor edx, edx
rol ah, cl
bsr ax, si
mov eax, edx
Function at 0xe996ab
Capabilities:
Encrypt data using speck

Disassembly:
inc esi
or al, al
sbb edi, dword [edx - 0x40f44794]
shr byte [ebp - 0x702950c9], 1
mov al, 0xcf
test dword [ecx], ecx
aam 0x8f
dec esp
scasb al, byte es:[edi]
dec edi
test eax, 0xd90cb2a8
sub edi, dword [eax]
xor al, 0x6d
mov dl, 0x8a
add al, 0xab
adc al, 0x5b
loop 0xe995ce
arpl word [ebp + 0x64], cx
mov ebp, 0x9b52e9b9
rcr dword [ebx + 0x78], 1
popal
mov ebx, edx
push ebx
mov eax, esi
push eax
mov edi, ecx
add byte [edx - 0x36], dl
or al, 0x71
insb byte es:[edi], dx
mov al, byte [0xbe5eb731]
fmul qword [edi - 0x30317077]
les edi, [ebx]
add byte [ecx], 0x62
call fcn.00e95eff
sub edx, dword [edx + 0x67a8fefd]
push ecx
outsd dx, dword [esi]
cmp byte [ebx + 0x66b16b4f], bh
salc
cmp ebp, dword [bp - 0x76b]
fbstp tbyte [eax + 0x20]
jno 0xe995f1
and esp, dword [ebx + 8]
cmp ebx, dword [esi + 0x5bb709d0]
test byte [ebx + 0x5b5b077d], 0xd1
xchg esi, eax
sahf
pop edx
jns 0xe996a6
adc dl, byte [ecx + 0x4e046635]
jne 0xe99686
xor eax, 0x546ea112
salc
cmpsd dword [esi], dword es:[edi]
sub eax, 0xca94fdda
sbb dword [ecx], edx
lahf
je 0xe99677
lcall 0x8501, 0x8a4f52c1
jnp 0xe996d7
xchg edi, eax
cmpsd dword [esi], dword es:[edi]
pop edi
imul eax, edx, 0x83f87be1
dec edi
mov esi, dword [edi + ebp*8 + 0x2ac636e0]
push es
dec ebp
invalid
loopne 0xe996be
invalid
arpl word [ebp + 0x73], sp
jae 0xe996ab
sar bx, cl
mov ebx, eax
jmp 0xea2ba0
mov dh, 0x3e
fisubr word [edi]
fisubr word ds:[edi]
rcr byte [eax], 0xfd
sub ah, byte [eax - 0xeef981b]
jns 0xe996bf
mov dword [0xadad8955], eax
or byte [edx + 0x15ab9d05], 0x6d
and ebx, dword [ebx - 0x51]
adc eax, 0xaf5b236d
mov byte [0x826284fd], al
int3
cmp ch, al
stc
stc
cmp byte [edi], 0x23
push 0xa9634263
lea esp, [esp + 4]
jne 0x19439ca
rol eax, cl
lahf
stc
sar ah, 6
xor edx, edx
rol ah, cl
bsr ax, si
mov eax, edx
Function at 0xe9b77e
Capabilities:
Encode data using xor

Disassembly:
cmp eax, dword [ebp - 0x10]
pushal
jmp 0x19415ab
lea esp, [esp + 0x44]
jae 0xe9a7d2
sar bl, 4
not bx
mov ebx, eax
btc di, dx
btc edi, edx
rcl di, 6
btr edi, esi
mov edi, eax
stc
btr cx, di
mov ecx, 0x104
pushal
sub al, al
bt si, bp
pushal
cmc
repne scasb al, byte es:[edi]
call fcn.00e97625
push 0x60
scasd eax, dword es:[edi]
jge 0x19415be
pop ds
aas
inc eax
cdq
sbb eax, edx
jl 0x1941632
movsb byte es:[edi], byte [esi]
mov bh, 0xbc
invalid
iretd

Function at 0xe9cab3
Capabilities:
Encrypt data using speck

Disassembly:
lea esp, [esp + 0x4c]
ja 0x1955771
clc
clc
imul edx, edx, 0xa
cmc
add edx, eax
pushfd
Function at 0x420ed4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x420f2d
test eax, edx
je 0x420f30
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x420eeb
movzx eax, word [eax]
sub eax, ecx
jmp 0x420f12
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x420f13
add ecx, 4
js 0x420f03
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x420f10
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x420f12
xor eax, eax
ret
test eax, eax
je 0x420f3c
test edx, edx
jne 0x420edc
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x429174
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.004097f4
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040d074
mov edi, eax
cmp edi, 0x104
jbe 0x42911f
mov eax, edi
add eax, eax
call fcn.004067dc
mov esi, eax
jmp 0x429121
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040d074
push esi
call fcn.00411d8c
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x42915a
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x429144
mov eax, esp
cmp esi, eax
je 0x429167
mov eax, esi
call fcn.004067f8
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x4291a0
cmp bl, 0
je 0x42919c
cmp bl, 0x41
jl 0x429197
cmp bl, 0x5a
jg 0x429197
or bl, 0x20
xor al, bl
inc esi
jmp 0x42917b
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x4290e0
Function at 0x4f6da0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4f6f5b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040974c
mov eax, dword [ebp - 4]
call fcn.004f66d0
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x4f6df2
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.0040a378
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.004f79e4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4f6ed1
xor eax, eax
push ebp
push 0x4f6eca
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.004f6970
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call fcn.004f6f90
test al, al
je 0x4f6ea8
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 8]
xor edx, edx
call fcn.004094ac
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x4f6ea8
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.00409f54
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call fcn.004115a8
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.004f68d0
test al, al
je 0x4f6ea2
mov eax, dword [ebp - 8]
call fcn.00409f54
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.00409fbc
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc]
call fcn.004f6da0
dec ebx
cmp ebx, 0xffffffff
jne 0x4f6e51
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f6ed1
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.004f6970
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00411558
ret
cmp byte [0x60a438], 0
je 0x4f6f11
push 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x18]
and eax, 0x300
push eax
mov eax, dword [ebp - 4]
call fcn.00409f54
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.004f695c
push eax
call sub.advapi32.dll_RegDeleteKeyExW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.004f68d0
mov ebx, eax
jmp 0x4f6f38
mov eax, dword [ebp - 4]
call fcn.00409f54
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.004f695c
push eax
call fcn.00411570
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.004f68d0
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f6f62
lea eax, [ebp - 0x3c]
call fcn.00409324
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409384
ret

Function at 0x500b1c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x500b22
ret
Function at 0x510288
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ebx + 0x6c]
sub edx, 2
mov dword [ebp - 4], edx
mov ecx, dword [ebx + 0x58]
mov edx, dword [ebx + 0x48]
shl edx, cl
lea ecx, [eax + 3]
mov edi, dword [ebx + 0x38]
movzx ecx, byte [edi + ecx - 1]
xor edx, ecx
and edx, dword [ebx + 0x54]
push esp
push esp
mov dword [ebx + 0x48], edx
mov edx, dword [ebx + 0x44]
mov ecx, dword [ebx + 0x48]
mov dx, word [edx + ecx*2]
mov ecx, dword [ebx + 0x34]
and ecx, eax
mov edi, dword [ebx + 0x40]
mov word [edi + ecx*2], dx
adc al, 0x4f
mov edx, dword [ebx + 0x44]
mov ecx, dword [ebx + 0x48]
mov word [edx + ecx*2], ax
inc eax
dec dword [ebp - 4]
jne 0x510271
mov dword [ebx + 0x6c], eax
mov dword [ebx + 0x74], 2
push ebx
call fcn.005115c0
pop ecx
mov edx, dword [ebx + 0x74]
cmp edx, 3
jae 0x510268
mov eax, dword [ebx + 0x74]
mov edx, 2
add dword [ebx + 0x6c], eax
xor eax, eax
mov ecx, dword [ebx + 0x6c]
mov dword [ebx + 0x5c], ecx
mov ecx, dword [ebx + 0x74]
mov dword [ebx + 0x16b4], ecx
mov dword [ebx + 0x74], eax
mov dword [ebx + 0x78], edx
mov dword [ebx + 0x60], edx
xor eax, eax
mov dword [ebx + 0x68], eax
mov ecx, dword [ebp - 0x10]
mov dword [esi], ecx
mov ecx, dword [ebp - 0xc]
mov dword [esi + 4], ecx
mov eax, dword [ebp - 8]
mov dword [ebx + 0x18], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x516bf0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, 0x6018f8
test edx, edx
jne 0x516c0f
xor eax, eax
jmp 0x516d2d
mov dword [ebp - 4], 1
cmp byte [ebp - 4], 0
je 0x516c2c
push esi
push edx
push eax
call fcn.00516d34
add esp, 0xc
jmp 0x516d2d
push esi
push edx
push eax
call fcn.00516ff4
add esp, 0xc
jmp 0x516d2d
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x5e911c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x60abb8], 0
jne 0x5e9133
call fcn.005e90d8
mov eax, edi
dec eax
test eax, eax
jl 0x5e915b
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x60a7b8]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x5e913d
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x5ebe50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x5ebeea.0
jmp dword [ecx*4 + 0x5ebe83]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x5ebeb5
sub dl, 8
je 0x5ebec4
jmp case.0x5ebeea.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5ebb1c
jmp case.0x5ebeea.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5ebb70
jmp case.0x5ebeea.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x5ebeea.0
movzx ecx, byte [ecx + 0x5ebef1]
jmp dword [ecx*4 + 0x5ebf02]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5ebc10
jmp case.0x5ebeea.0
cmp dl, 3
jne 0x5ebf2f
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5ebc68
jmp case.0x5ebeea.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5ebc24
jmp case.0x5ebeea.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5ebcac
jmp case.0x5ebeea.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x5ebf5a
sub dl, 8
je 0x5ebf66
jmp case.0x5ebeea.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5ebcd8
jmp case.0x5ebeea.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5ebd3c
jmp case.0x5ebeea.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x5ebf85
sub dl, 8
je 0x5ebf91
jmp case.0x5ebeea.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5ebdec
jmp case.0x5ebeea.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5ebe14
mov ecx, dword [eax + 0x468]
mov edx, dword [ebx + 0x1c]
dec edx
imul ecx, edx
mov esi, ecx
add esi, dword [eax + 0x450]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 8], esi
add ecx, dword [eax + 0x44c]
mov dword [ebp - 0x10], ecx
mov esi, edx
test esi, esi
jb 0x5ec033
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.005eb064
test eax, eax
je 0x5ec033
mov eax, ebx
call fcn.005ec03c
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x5ebfcc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5ec03c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x5ec06d
dec al
je 0x5ec0a8
dec al
je 0x5ec0e5
dec al
je 0x5ec14e
jmp 0x5ec1d8
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x5ec1d8
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x5ec07d
jmp 0x5ec1d8
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5ec1d8
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov ecx, eax
xor cl, 1
and ecx, 0x7f
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ecx, byte [ecx + esi]
movzx edx, al
mov edx, dword [ebx + edx*4 + 0x40]
add cl, byte [edx + esi]
and cl, 0xff
mov byte [edx + esi], cl
inc esi
dec edi
jne 0x5ec0b8
jmp 0x5ec1d8
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5ec1d8
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x5ec114
xor ebp, ebp
jmp 0x5ec124
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x5ec12d
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x5ec0f5
jmp 0x5ec1d8
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5ec1d8
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x5ec1a7
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.005e9164
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x5ec162
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5f0dc8
Capabilities:
Persist via appinit_dlls registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor edx, edx
mov dword [ebp - 4], edx
xor eax, eax
push ebp
push 0x5f0ea9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4f56d8]
call fcn.004f6824
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x5f0e8c
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call fcn.004f690c
xor ecx, ecx
mov edx, 0x5f0ec0
mov eax, dword [ebp - 8]
call fcn.004f6a64
test al, al
je 0x5f0e76
lea ecx, [ebp - 4]
mov edx, 0x5f0f38
mov eax, dword [ebp - 8]
call fcn.004f7440
lea eax, [ebp - 4]
mov edx, 0x5f0f60
call fcn.0042c160
test al, al
jne 0x5f0e5c
lea eax, [ebp - 4]
mov edx, 0x5f0f84
call fcn.0040974c
mov ecx, dword [ebp - 4]
mov edx, 0x5f0fa8
mov eax, dword [ebp - 8]
call fcn.004f73d8
mov ecx, 1
mov edx, 0x5f0fd0
mov eax, dword [ebp - 8]
call fcn.004f76b8
mov eax, dword [ebp - 8]
call fcn.004f68dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f0e93
mov eax, dword [ebp - 8]
call fcn.004076a8
ret

Function at 0x5f17dc
Capabilities:
Acquire debug privileges

Disassembly:
add esp, 0xffffffcc
push esp
push 0x28
call fcn.004116d0
push eax
call fcn.00411550
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x5f17fe
mov eax, 0xfffffffe
jmp 0x5f1875
lea eax, [esp + 8]
push eax
push 0x5f187c
push 0
call fcn.00411548
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x5f1820
mov eax, 0xfffffffd
jmp 0x5f1875
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 1
mov eax, dword [esp + 8]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 2
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x28]
push eax
push 0x10
lea eax, [esp + 0x20]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call fcn.00411540
call fcn.00411718
test eax, eax
je 0x5f1873
mov eax, 0xfffffffc
jmp 0x5f1875
xor eax, eax
add esp, 0x34
ret
Function at 0x40274a
Capabilities:
Get common file path
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x800
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, esi
xor ebx, ebx
call edi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
cmp ebx, 0x5c9f22f
jg 0x40277a
inc ebx
cmp ebx, 0x1fa20be2
jl 0x402760
cmp dword [0x452344], 0x400
jne 0x4027e2
push 0x448dc0
push str.zudutalegexojefupo
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push esi
push esi
lea eax, [ebp - 0x800]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
push esi
push esi
call dword [sym.imp.USER32.dll_DdeCmpStringHandles]
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
push esi
call fcn.00402846
push esi
push esi
call fcn.00402880
push esi
call fcn.00402b84
pop ecx
pop ecx
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.004029ca
fstp st(0)
push esi
call fcn.00402bf8
add esp, 0xc
xor ebx, ebx
cmp ebx, 0xd0fe
jge 0x4027f3
push esi
call dword [sym.imp.USER32.dll_GetCaretPos]
call edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp ebx, 0x58bc6e
jg 0x40280c
inc ebx
cmp ebx, 0xe52f
jl 0x4027e4
mov eax, dword [0x44b2e4]
mov dword [0x452344], eax
call fcn.004024cb
mov edi, 0x3078f
cmp dword [0x452344], 0x51f
jne 0x40283a
push esi
lea eax, [ebp - 0x800]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec edi
jne 0x402820
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10

Function at 0x4059ce
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44a598]
jne 0x4059d8
repz ret
jmp fcn.0040847a