joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42be80
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x464478
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, ecx
call fcn.00426780
test eax, eax
je 0x42bf88
lea ecx, [esp + 0xc]
call fcn.00402860
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
push eax
mov eax, dword [esp + 0x34]
push ecx
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
mov ecx, esi
mov dword [esp + 0x3c], 0
call fcn.00426780
mov ecx, eax
call fcn.00423f40
test eax, eax
je 0x42bf6f
mov eax, dword [esp + 0x1c]
test eax, eax
mov ebp, eax
je 0x42bf6f
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x42bf6f
mov esi, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
neg esi
push edi
push ebx
sbb esi, esi
and esi, edx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, ebp
mov edi, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
call fcn.00402a60
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
pop edi
jne 0x42bf51
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x42bf6f
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, dword [0x490c40]
push ebx
and eax, 0xffff
push eax
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0xc], 0x467b40
call fcn.00402a60
mov ecx, dword [esp + 0x20]
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0x10
Function at 0x42bfd0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, ecx
call fcn.00426780
test eax, eax
je 0x42c0bf
mov ecx, edi
call fcn.00426780
mov ecx, eax
call fcn.00423df0
test eax, eax
jne 0x42c0bf
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x42c0bf
mov eax, dword [0x490c40]
and eax, 0xffff
push eax
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
jne 0x42c032
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
lea ecx, [esp + 0x10]
mov ebp, dword [esp + 0x24]
push 1
push ecx
mov ecx, dword [edi + 0x44]
lea edx, [esp + 0x1c]
shr ecx, 4
lea eax, [esp + 0x20]
push edx
mov edx, dword [esp + 0x2c]
and ecx, 1
push eax
push ecx
push ebp
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
mov ecx, edi
call fcn.00426780
mov ecx, eax
call fcn.00424020
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov ecx, dword [esp + 0x28]
mov eax, 1
cmp ecx, eax
jne 0x42c0bf
cmp ebx, eax
jne 0x42c0bf
cmp dword [esp + 0x10], eax
jne 0x42c0a5
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0xcc]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [edi]
push eax
mov eax, dword [esp + 0x24]
push ecx
push ebp
push eax
mov ecx, edi
call dword [edx + 0xc0]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
Function at 0x42ecf0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x464708
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
mov ebx, ecx
push edi
mov esi, dword [ebp]
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
dec ecx
cmp eax, ecx
jge 0x42ed29
inc eax
mov dword [esi + 0x10], eax
jmp 0x42ee3c
mov eax, dword [ebx + 0x3c]
mov ecx, dword [esi + 8]
cmp ecx, eax
jne 0x42ed3d
mov eax, 0xffffffc7
jmp 0x42ee3e
mov esi, dword [esi]
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp edx, ecx
jl 0x42ed4e
cmp dword [esi + 8], eax
jne 0x42ed3d
cmp dword [esi + 8], eax
jne 0x42ed67
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp eax, ecx
jl 0x42ed67
mov eax, 0xffffffc7
jmp 0x42ee3e
mov eax, dword [esi + 4]
xor edi, edi
cmp eax, edi
je 0x42ed7b
push eax
mov ecx, ebx
call fcn.0042e520
mov dword [esi + 4], edi
mov dword [ebp], esi
mov ecx, dword [esi + 0x10]
inc ecx
mov dword [esi + 0x10], ecx
lea ecx, [esp + 0x10]
call fcn.00402860
mov dword [esp + 0x2c], edi
mov edi, dword [esp + 0x3c]
test edi, edi
jne 0x42edac
mov ecx, dword [ebx + 4]
mov edx, dword [ecx + 8]
lea ecx, [esp + 0x10]
push edx
call fcn.00402880
mov edi, eax
mov eax, dword [esi + 8]
push edi
push eax
mov ecx, ebx
call fcn.0042dc90
test eax, eax
mov dword [esp + 0x38], eax
je 0x42eddf
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x467b40
call fcn.00402a60
mov eax, dword [esp + 0x38]
jmp 0x42ee3e
mov ecx, dword [esi + 0x10]
push ecx
push edi
mov ecx, ebx
call fcn.0042eb50
mov dl, byte [edi]
and dl, 1
cmp dl, 1
jne 0x42ee23
mov ecx, dword [esp + 0x34]
push ebp
push ecx
push edi
push eax
mov ecx, ebx
call fcn.0042eb70
mov esi, eax
test esi, esi
jne 0x42ee53
mov edx, dword [ebp]
push eax
push edi
mov ecx, ebx
mov dword [edx + 0x10], eax
call fcn.0042eb50
mov cl, byte [edi]
and cl, 1
cmp cl, 1
je 0x42edf5
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x467b40
call fcn.00402a60
xor eax, eax
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x467b40
call fcn.00402a60
mov eax, esi
jmp 0x42ee3e

Function at 0x431f20
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [ecx + 0xcc], 1
je 0x431f80
mov eax, dword [ecx + 0x1c]
test eax, eax
je 0x431f80
mov eax, dword [ecx + 0xb0]
test eax, eax
je 0x431f80
push esi
mov edx, 5
mov esi, dword [ecx + 0xbc]
cmp esi, edx
pop esi
je 0x431f80
mov dword [ecx + 0xb4], eax
mov dword [ecx + 0x94], 0
mov dword [ecx + 0xbc], edx
lea eax, [esp]
push eax
push 0
push ecx
push 0x431fc0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
ret
Function at 0x537c99
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esp + 8], eax
mov byte [esp], ah
pushal
mov byte [esp + 8], 0x91
lea esp, [esp + 0x28]
jmp fcn.0053898f

Function at 0x537d37
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test dh, dl
sub esi, 1
bt ebp, 0x1b
call fcn.00537db9

Function at 0x538438
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0x872e6e0a
jmp 0x538cc0
mov word [esp + 8], 0x4810
mov dword [esp + 8], esi
pushfd
jmp 0x50b997
mov dword [esp + 0xc], ebx
jmp 0x538619
mov byte [esp + 4], bh
jmp 0x537f9f
mov dword [esp + 0xc], eax
pushfd
push eax
lea esp, [esp + 0x14]
jmp fcn.0053898f

Function at 0x5385a8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esp + 0x1c], eax
mov byte [esp], 0x14
lea esp, [esp + 0x1c]
jmp fcn.0053898f

Function at 0x5388f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushal
mov byte [esp + 0xc], al
mov byte [esp], bl
mov dword [esp + 0x28], esi
push ebx
pushfd
call fcn.00538a93

Function at 0x538903
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov byte [esp], 0xcc
mov dword [esp + 0x50], eax
mov byte [esp + 4], dh
mov word [esp + 8], 0x5ae1
mov byte [esp + 8], 0x6e
lea esp, [esp + 0x50]
jmp fcn.0053898f

Function at 0x538a93
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esp + 0x30], eax
mov word [esp], 0x3934
lea esp, [esp + 0x30]
jmp fcn.0053898f

Function at 0x538bae
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushfd
mov dword [esp + 0x30], eax
mov byte [esp], 0x57
lea esp, [esp + 0x30]
jmp fcn.0053898f

Function at 0x538e1e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov byte [esp + 4], 0x3f
mov dword [esp + 0x20], eax
pushal
mov word [esp], 0xbad3
mov byte [esp + 8], bl
mov byte [esp + 8], 0xbe
lea esp, [esp + 0x40]
jmp fcn.0053898f

Function at 0x539437
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushal
pushfd
pop dword [esp + 0x2c]
call fcn.00538fc0

Function at 0x539442
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushfd
pushfd
mov dword [esp + 0x2c], eax
push ebx
lea esp, [esp + 0x30]
jmp fcn.0053898f

Function at 0x539588
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esp + 0x44], esi
jmp 0x538940
jmp 0x50ba24

Function at 0x5396b6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov byte [esp + 4], dl
mov dword [esp + 0x10], eax
pushal
push ecx
pushfd
lea esp, [esp + 0x38]
jmp fcn.0053898f
mov dword [esp + 0x10], esi
pushfd
jmp 0x537c4e

Function at 0x539824
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov byte [esp], bl
lea esp, [esp + 4]
cpuid
pushfd
sub ebp, 0xc
pushfd
jmp 0x538931
lea eax, [edi + 0xb872c5e]
mov eax, dword [ebp]
jmp 0x537d95

Function at 0x539842
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
pushfd
push ebp
mov byte [esp + 8], 0x4f
mov dword [esp + 8], eax
mov byte [esp], 0xc6
mov word [esp + 4], di
push dword [esp]
lea esp, [esp + 0xc]
jmp fcn.0053898f
lea esp, [esp + 0x4c]
jp 0x539393
push eax
pushal
lea esp, [esp + 0x20]
jmp fcn.0053898f
Function at 0x53e37a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
movzx di, bl
mov word [esp], sp
not di
mov edi, dword [esp + 0x50]
pushfd
lea edi, [edi + 1]
mov byte [esp + 0x10], 0x1b
mov byte [esp], 0xf5
jmp 0x5ac771
mov dword [esp + 0x54], edi
movzx di, al
movzx di, dl
mov word [esp], cx
mov edi, 0x416d1f
mov byte [esp + 8], 0xf6
jmp 0x5b9130
push ebx
mov eax, dword [eax + 0x51d8d]
push esp
call fcn.005e2f16
mov edi, dword [edi + 0x92954]
call 0x5fc07c
push esi
mov dword [esp + 0x14], eax
lahf
push dword [esp]
movsx eax, dl
mov eax, 0x401aee
jmp 0x5b0855
Function at 0x53eb47
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea esp, [esp + 0x34]
jns 0x5b3de2
pushfd
lea edx, [edx + 1]
pushal
jmp 0x589b41
jmp 0x5df41b
pushal
mov dword [esp], 0x685acdbb
lea edx, [edx + 1]

Function at 0x541f30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x5e016a
pushfd
mov byte [esp], ah
mov dword [esp], 0x650af176
pushfd
mov dword [esp], 0xc946b587
pushal
lea esp, [esp + 0x20]
jmp fcn.00538924

Function at 0x55aa19
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esp], 0x6463697a
pushal
jmp 0x5a8d11
mov word [esp + 8], 0xe910
mov dword [esp + 0x1c], 0x79666f8b
pushal
mov dword [esp], 0x62cb52c9
mov word [esp], dx
pushfd
lea esp, [esp + 0x40]
jmp fcn.00537b22

Function at 0x55b0ac
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esp + 4], 0x66d7717a
push 0xd0a41d89
push ecx
mov dword [esp + 8], 0xb61dcda5
push dword [esp]
pushfd
pushfd
pushal
lea esp, [esp + 0x34]
jmp fcn.00538f52

Function at 0x561d61
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
nop
lea esp, [esp + 4]
jne 0x5cdfe2
push 0xf2a1c819
pushal
xchg dword [esp + 0x20], esi
pushfd
lea esi, [ecx*2 - 0x6b040981]
push edx
mov esi, dword [esp + 0x2c]
jmp 0x5a0654
call fcn.0055c3de
pushal
pushal
call fcn.0053b555
push dword [esp + 4]
mov dword [esp + 0x20], 0xa27b01bf
xchg dword [esp + 0x44], esi
mov byte [esp], ah
pushfd
push 0x3dc15a35
push dword [esp + 0x4c]
ret 0x50

Function at 0x5670cf
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushal
mov dword [esp + 0x1c], 0x66e7cd4e
lea esp, [esp + 0x1c]
jne 0x5d2296
push ebp
push dword [esp]
pushfd
mov dword [esp + 8], 0x39848d06
push edi
pushal
lea esp, [esp + 0x2c]
jmp fcn.00537b22
pushal
pushfd
mov dword [esp + 0x20], 0x39848d06
mov byte [esp], 0xc6
pushfd
pushfd
lea esp, [esp + 0x28]
jmp fcn.00537b22
jmp 0x5b0eed

Function at 0x568af0
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp], 0
pushfd
push 0xaf97b854
jmp 0x5bd59b
lea esp, [esp + 8]
call fcn.005aea78
test cx, 0x4382
push ebp
mov dword [ebp + 8], eax
lea esp, [esp + 4]
seto ah
mov eax, dword [ebp + 8]
pushfd
pushfd
mov dword [esp + 4], ebx
jmp 0x59f3f2

Function at 0x56cee4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x5bc2fa
mov word [esp + 4], 0xeb41
mov dword [esp + 4], 0x519d0eb9
push 0x42827a93
push eax
lea esp, [esp + 0xc]
jmp fcn.005399b4

Function at 0x579552
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov byte [esp], bh
mov word [esp], 0x6d7
mov dword [esp], 0x64e3256e
pushal
mov dword [esp + 0x1c], 0x4ad5b336
push dword [esp]
mov byte [esp], bh
pushfd
lea esp, [esp + 0x24]
jmp fcn.00538924
jmp 0x56ec02

Function at 0x57d32f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
bswap ax
not al
lahf
nop
call fcn.00573b01
push 0x64dda566
push 0x49797b16
mov dword [esp], 0xffd468e6
push 0x156ea210
push 0xffcf1891
pushfd
lea esp, [esp + 0xc]
jmp fcn.005399b4
jmp 0x57970d

Function at 0x581d58
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esp + 8], 0x64e3256e
pushal
mov byte [esp], 0xc6
jmp 0x58ce98
Function at 0x581e2c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x564c8b
xchg dword [esp + 0x10], eax
pushfd
push esi
pushal
push dword [esp + 0x38]
ret 0x3c
push 0x2c64ef22
mov byte [esp], dl
mov dword [esp], eax
cwde
jmp 0x5ed3fe
xchg dword [esp + 0x2c], eax
lea esp, [esp + 0x2c]
jae 0x57a0db
push eax
lahf
mov ah, ch
lea eax, [edx - 0x3f177ff8]
mov eax, 0x415b94
pushfd
mov word [esp], dx
mov byte [esp], 0xcf
mov word [esp], 0x546
mov eax, dword [eax + 0x3d474]
push 0xa0baa8c5
mov byte [esp], cl
pushfd
lea eax, [eax + 0x28e2907c]
pushfd
jmp 0x564bc3

Function at 0x583d81
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push eax
mov dword [esp + 0x24], 0xa8f62a4
pushfd
push esi
pushfd
mov byte [esp], dh
lea esp, [esp + 0x30]
jmp fcn.005399b4
jmp 0x53b440

Function at 0x585a05
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x5c64e4
mov eax, dword [eax + 0xe4351]
mov byte [esp], 0x9f
mov byte [esp + 4], ch
call fcn.00598458

Function at 0x587a76
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esp
mov byte [esp], bl
pushfd
push ecx
mov dword [esp + 8], 0x678a3576
mov byte [esp + 4], 0xda
mov dword [esp + 4], 0xb74f5677
push ecx
lea esp, [esp + 8]
jmp fcn.00537b22

Function at 0x589aff
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0xd5c43cf6
mov dword [esp + 0x24], 0x122cb25f
pushal
pushfd
push 0x79c626fc
pushfd
lea esp, [esp + 0x50]
jmp fcn.005399b4

Function at 0x58fdf1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov byte [esp], 0x90
mov dword [esp + 0x20], 0x487ad9
call fcn.005ab5dc

Function at 0x594972
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushal
pushfd
mov dword [esp + 0x28], 0x66e7cd4e
push edx
pushfd
push 0xf02b3d38
mov dword [esp + 0x30], 0x1b9685b2
mov byte [esp + 4], dl
push dword [esp]
push ebp
lea esp, [esp + 0x38]
jmp fcn.00537b22

Function at 0x595ede
Capabilities:
Packed with generic packer

Disassembly:
movzx ax, cl
call fcn.0057421f

Function at 0x598241
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea edi, [edi - 0xd400fa9]
mov word [esp], 0x495c
jmp 0x5caeda
call fcn.005608e6
push 0x66a6115a
pushal
mov byte [esp], 0x8f
push dword [esp]
mov byte [esp + 4], dl
mov dword [esp + 0x20], 0x69f51143
push edx
lea esp, [esp + 0x24]
jmp fcn.00538f52

Function at 0x59e4e8
Capabilities:
Packed with generic packer

Disassembly:
cmp dword [ebp + 8], 0
push esi
lea esp, [esp + 8]
jne 0x5bd5b1
call fcn.00568af0

Function at 0x5a261c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esp], 0x8e4e5da9
pushal
push 0x4384523
mov word [esp + 4], dx
lea esp, [esp + 0x24]
jmp fcn.005399b4

Function at 0x5a6fcd
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esp + 0x28], 0x54bf5ea8
push 0x5422ecda
push dword [esp]
lea esp, [esp + 0x30]
jmp fcn.00538f52
push 0xbc7fa721
jmp 0x53c404

Function at 0x5ae059
Capabilities:
Packed with generic packer

Disassembly:
call 0x5c3bdb
lea esp, [esp + 0x2c]
jb 0x5bca79
movsx cx, al
mov ecx, dword [esp + 4]
jmp 0x59aeba
setbe cl
mov ecx, dword [esp + 4]
call 0x5da615
Function at 0x5b1115
Capabilities:
Encode data using xor

Disassembly:
push dword [esp + 4]
mov byte [esp], 0x1e
lea edi, [edi + 1]
call fcn.005cc85f
mov dl, bl
setl dh
nop
movsx dx, cl
jmp 0x5923eb
push esp
pushfd
mov edx, dword [esp + 8]
pushfd
push esi
xchg dword [esp + 0x14], edx
mov byte [esp], 0xf9
call fcn.005d556f
call fcn.0056d9be
lea edi, [ebx + 0x707276f8]
mov edi, dword [esp + 0x2c]
jmp 0x55ee5f

Function at 0x5b2e2c
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x48]
js 0x5a4b84
mov edi, dword [edi + 0x6f7b3]
push edx
lea edi, [edi - 0x2bd7ff1e]
call fcn.00568d37
lea esi, [esi - 0x4af0d1a2]
mov byte [esp + 4], bh
call fcn.0059e495
imul esi, dword [ecx + 0x35], 0x98d02eb1
or al, byte [ebp - 0x73]
and edx, esp
cmc
mov byte [0xfdb1d1cf], al
in eax, dx
popal
hlt
call 0x5ce507
mov ecx, dword [ecx + 0x8c376]
push 0xd862148f
push dword [esp + 4]
push 0xfbe50389
call fcn.0059120b
lea ecx, [eax + 2]
pushfd
not si
movsx esi, cl
mov esi, dword [esp + 0xc]
bswap bx
lea ebp, [edx*2 - 0x4dbc41ad]
xchg bx, bp
call fcn.00589a59
pushfd
pushfd
mov dword [esp + 0x34], eax
push esp
jmp 0x5c974a
lahf
call fcn.005b776d
mov word [esp + 4], 0x343a
jmp 0x5c9f35
mov dword [esp + 0x28], edi
pushal
pushfd
mov edi, 0x41df2e
jmp 0x598e98

Function at 0x5b776d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x417cba
call fcn.005cf879

Function at 0x5b7777
Capabilities:
Encrypt data using rc4 prga

Disassembly:
call fcn.005c21b2
jmp 0x5e528c
mov word [esp + 0xc], sp
mov dword [esp + 0x38], 0xfe6711a9
push ebx
pushfd
push ebp
mov dword [esp + 0xc], eax
lea esp, [esp + 0x44]
jmp fcn.00537b22
pushal
pushal
mov byte [esp], dh
mov dword [esp + 0x3c], 0x6698ed6a
mov dword [esp + 8], 0x3fd2d28c
jmp 0x5b946a

Function at 0x5b8a29
Capabilities:
Encode data using xor

Disassembly:
lea eax, [eax - 0x32f09ef5]
or byte [ebx], 0x61
bswap ebp
call fcn.0059a12b
xor ebx, edi
pop es
push dword [ebx]
fild word [edi]
pop edi
ja 0x5b8a2a
and eax, 0x8fb94d62
rcl dword [ecx - 0x3687581e], 5
stosb byte es:[edi], al
salc
jae 0x5b8a33
invalid

Function at 0x5b9fac
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x5b913b
not al
mov eax, ebx
pushal
pop ebx
not bx
mov ebx, dword [esp + 0x2c]
jmp 0x5deafa
call fcn.005945b3
pushfd
lea eax, [eax + 1]
jmp 0x5a5dc9

Function at 0x5ba7f3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esp], 0x7a7bb176
push 0x280148e1
push ebp
lea esp, [esp + 8]
jmp fcn.005399b4

Function at 0x5c2b25
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esp], ebp
pushfd
call fcn.00598a3d

Function at 0x5c2b2e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esp + 0x28], 0x1771769a
mov word [esp + 4], 0x4fe8
mov byte [esp + 8], bl
mov dword [esp + 8], 0x879de1f0
lea esp, [esp + 0x28]
jmp fcn.00538f52

Function at 0x5c5348
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
pushfd
mov dword [esp + 4], 0x66e7cd4e
push 0xb3fa215e
pushfd
pushfd
pushal
mov dword [esp + 0x2c], 0x14b085d9
pushfd
mov dword [esp + 8], ebp
pushfd
lea esp, [esp + 0x34]
jmp fcn.005399b4
Function at 0x5c64f7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esp + 4], 0x662afd6e
jmp 0x5df125
push ecx
mov dword [esp + 4], 0x1858846c
pushfd
pushal
mov byte [esp + 4], bh
push edx
lea esp, [esp + 0x2c]
jmp fcn.00538f52

Function at 0x5c91e7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esp], 0x67a17d72
jmp 0x5abdac

Function at 0x5da15b
Capabilities:
Packed with generic packer

Disassembly:
push 0x1e8a4f15
jmp 0x566abf

Function at 0x5df42e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push dword [esp + 0xc]
mov dword [esp + 0x10], 0xe63cca50
pushal
pushfd
mov byte [esp], al
lea esp, [esp + 0x34]
jmp fcn.00537b22
jmp 0x5ad5f3

Function at 0x5e2826
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x2c]
jmp fcn.00538c16
call 0x5fc8e7
das
push eax
push esi
leave
lodsd eax, dword [esi]
xchg ecx, eax
popal
push ebp
add dh, byte [ebx + 0x2ad995d8]
loop 0x5e28b8
and byte [0xd3c2a35d], al
mov bl, 0xb0
push eax
add cl, byte [esi + 0x178fc44a]
xlatb
inc ebp
inc eax
shl byte [edx - 0x41], cl
add al, 0xd3
scasd eax, dword es:[edi]
dec ecx
inc ebp
ja 0x5e2801
int 0x21
cwde
jbe 0x5e28c6
add bl, byte [edi - 0x3d]
js 0x5e2893
adc dword [eax + 0x73], esi
pushfd
and al, 0x45
scasd eax, dword es:[edi]
jae 0x5e28b2
jecxz 0x5e2853
xchg ebp, eax
out 0xb3, eax
and dword [esi + 0x74], eax
pop edi
sbb eax, 0xaff11b21
and eax, 0xff2d09d3
mov dl, 0x75
salc
imul dword [ebx]
pop ebp
invalid
out 0x2b, al
and bl, byte [esi + 0x5a]
hlt
retf 0xb06
mov ah, 0x10
test al, 0xbf
xchg ebp, eax
shl byte [ebx], cl
inc edx
push ebx
adc al, 0x35
pop esp
mov cl, 0xe
retf 0xf44

Function at 0x5e9183
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esp], 0x64fafd62
jmp 0x5766d8

Function at 0x5ec218
Capabilities:
Encode data using xor

Disassembly:
invalid
call fcn.005e1335
mov eax, dword [0xde79a4cd]
or esi, dword [ecx]
jge 0x5ec268
aas
or al, 0x58
cld
call [eax - 0x1f]
out 0x48, eax
push esi
sar ebp, cl
outsb dx, byte [esi]
jo 0x5ec26e
insb byte es:[edi], dx
jo 0x5ec215
popal
invalid
add ah, dl
push edi
cld
adc esp, dword [esp + edx*4 + 5]
inc edi
inc eax
stc
jl 0x5ec29e
xchg esp, eax
add eax, 0x7cf94047
sub ebp, ebp
in eax, dx
mov eax, dword [0x8c791d9a]
mov esi, 0x2b79b000
call 0x5137030b
test byte [edi - 0x75ad8294], bl
or ch, dh
pop ds
add edx, dword [edx - 0x5f0bb9ba]
xor byte [edx - 0x70ec4da], 0x7f
mov esp, dword [ecx + 0x42]
inc edx
pop eax
daa
std
cmc
inc esp
jge 0x5ec26c
sbb byte [0x8e75e042], 0x6c
enter 0xffffffffffffce5c, 0x77
jnp 0x5ec2cf
push ds
mov eax, 0x732b6c6e
pop ebx
fcom dword [ebx + ebx + 0x4ecae42a]
and ch, byte [edi - 0x63bfb3b4]
sub byte [ebp - 0x10], ch
aaa
and esi, dword [ebx - 0x7c]
mov dword [0x2e1e4d44], eax
mov dword [0x2e1e4d44], eax
arpl sp, dx
ror byte [edi + eax*4 - 0x1fb89596], 1
invalid

Function at 0x5f20a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
nop
pushfd
call fcn.005c52b7
pushal
pushal
push 0xe6aebca0
jmp 0x5b9463

Function at 0x5f34c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
nop
pushal
pushfd
mov dword [esp + 0x2c], edx
not dl
mov dh, dl
mov edx, dword [esp + 0x30]
call fcn.0054203e
Function at 0x5f4130
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esp + 0x24], esi
call 0x5fb8fa

Function at 0x42e005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..rsrc
nop
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x42e072
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x5fd9037c
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
loop 0x42e060
nop
nop
nop
nop
mov eax, section..text
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x42e0d2
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0xc8c2717
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219