joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x501235da
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x42e024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42cd70
mov ecx, 0x6f322d3e
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x401000
Capabilities:
Check if file exists
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push 0x104
lea eax, [ebp - 0x410]
push eax
push str._temp_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [ebp - 0x410]
push ecx
push str._sdd55ddff6fd.txt
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x401053
xor al, al
jmp 0x40108d
push 0
push 2
push 2
push 0
push 0
push 0x40000000
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 0xffffffff
je 0x40108b
mov edx, dword [ebp - 0x414]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x4010a0
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x2c], str.Microsoft_Windows_Service
mov dword [ebp - 0x28], str.Microsoft_Windows_Services
mov dword [ebp - 0x24], str.Microsoft_Windows_Update_Service
mov dword [ebp - 0x20], str.Microsoft_Windows_Driver
mov dword [ebp - 0x1c], str.Host_Process_for_Windows_Services
mov dword [ebp - 0x18], str.Windows_Update_75849348
mov dword [ebp - 0x14], str.Windows_Update_46363463464
mov dword [ebp - 0x10], str.Windows_Update_4950505060
mov dword [ebp - 0xc], str.Windows_Upgrade_40885040
mov dword [ebp - 8], str.Windows_Upgrade_Manager
mov dword [ebp - 4], str.Windows_Operating_System
call section..text
movzx eax, al
test eax, eax
je 0x4011c3
lea ecx, [ebp - 0x30]
push ecx
push 0x20006
push 0
push 0x402550
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401163
mov dword [ebp - 0x34], 0
jmp 0x40113f
mov edx, dword [ebp - 0x34]
add edx, 1
mov dword [ebp - 0x34], edx
cmp dword [ebp - 0x34], 0xb
jae 0x401159
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp + eax*4 - 0x2c]
push ecx
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x401136
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x30]
push ecx
push 0x20006
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun_
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4011c3
mov dword [ebp - 0x38], 0
jmp 0x40119f
mov edx, dword [ebp - 0x38]
add edx, 1
mov dword [ebp - 0x38], edx
cmp dword [ebp - 0x38], 0xb
jae 0x4011b9
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp + eax*4 - 0x2c]
push ecx
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x401196
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40969b
Capabilities:
Check for debugger via api

Disassembly:
push esi
push 0xff78
push 0x40
mov esi, ecx
call dword [0x41c048]
mov edx, dword [esi]
mov ecx, eax
call fcn.00412dc2
mov edx, 0x41b6b8
mov ecx, eax
call fcn.00412dc2
mov edx, str._r_n_r_n
mov ecx, eax
pop esi
jmp fcn.00412dc2
Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43200c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43201e
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x10058fb9
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp]
lea esp, [esp + 2]
push edi
jmp 0x10058f2a

Function at 0x1005b0ec
Capabilities:
Encode data using xor

Disassembly:
setnp bh
jmp 0x1005b13a
ror bl, 7
jne 0x1005b11a
mov cx, word [esp]
jmp 0x1005b11e
mov cx, word [esp]
mov ecx, ebp
btr edx, edi
jmp 0x1005b14a
sub esp, 0xb8
mov esi, esp
lea ecx, [edi - 0x19]
mov ch, byte [esp]
jmp 0x1005b0f1
jo 0x1005b160
xchg bx, ax
lea eax, [edx + ebx]
jmp 0x1005b1dd
xchg bx, ax
lea eax, [edx + ebx]
mov edx, dword [esp]
bt eax, esp
sub esp, 0x16
and eax, 0xdc0dea4f
jmp 0x1005b1a8
dec eax
jmp 0x1005b1b9
xchg word [esp + 0x10], dx
pushal
neg ah
jae 0x1005b190
dec eax
jmp 0x1005b214
lea esp, [esp + 2]
rol ebp, 0
jmp 0x1005b1e8
call 0x1005b1fe
add byte [edx + ebx*4], 0xfd
or al, 0xce
mov cl, 0x21
inc eax
mov bl, 0x72
xor byte [ebx], dh
sub al, byte [ebp - 0xc]
out 0x8b, eax
adc al, 0x24
mov edx, dword [esp]
bt eax, esp
sub esp, 0x16
jmp 0x1005b16f
jne 0x1005b1c6
je 0x1005b1c6
push es
mov word [edx], es
xchg esp, eax
push esi
nop
sbb dword [ecx - 0x750e418], ecx
invalid
lea esp, [esp + 2]
jmp 0x1005b1bd

Function at 0x10064e0f
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
jmp 0x1004b7db
xor ecx, ecx
cmp dword [esp + 4], ecx
jbe 0x1004b7f5
push esi
movzx esi, byte [ecx + edx]
rol eax, 7
xor eax, esi
inc ecx
cmp ecx, dword [esp + 8]
jb 0x1004b7e4
pop esi
jmp 0x1004b800
ret 4
jmp 0x1004b7ce

Function at 0x1008b0b0
Capabilities:
Encode data using base64

Disassembly:
cmp ecx, eax
jae 0x100494c1
jb 0x1008b0bd
popal
mov al, byte [0xf4e1ae3]
emms
inc ecx
movsb byte es:[edi], byte [esi]
push ebx
clc
inc edi
shl dword [eax], 1
push cs
dec ebp
lcall 0x8ac2, 0xb03e6a2d
and al, 0x24
xor edx, edx
call fcn.1008b0e3
leave
push 0x3bfc228b
add byte [eax], al
add byte [ebp + 0x5b940d34], ch
mov dl, 0x3b
invalid
jae 0x10049462
mov dl, ch
mov dh, byte [esp]
jmp 0x1008b0d3
push dword [esp + 3]
lea esp, [esp + 8]
cmp ecx, 0x34
jmp 0x1008b09a
mov dx, ax
jmp 0x1008b0db
lea edx, [ecx + 0x47]
jmp 0x1004942e
lea edx, [ecx - 4]
jmp 0x1004942e

Function at 0x10101fdf
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebp, dword [esp + 4]
sub esp, 0x1a
jmp 0x10102418
lea ecx, [edx*4]
bswap edx
mov cx, 0xe736
jmp 0x10102265
mov al, 0x2b
seto bh
mov cl, byte [esp + 1]
mov word [esp], di
push word [esp]
mov byte [esp + 3], bl
jmp 0x10102238
bsr cx, bp
mov ebx, esp
pushfd
xchg dword [esp + 1], ecx
dec cx
bswap edi
jmp 0x101022ad
stc
bswap ebx
cpuid
bsr ebx, ebp
cld
xchg ecx, ebx
jmp 0x1010224e
rdtsc
rcr di, 6
pop dx
lea esp, [esp + 1]
jmp 0x101022fe
cpuid
bswap edx
bsf dx, sp
rdtsc
mov bp, 0x276e
mov bh, byte [esp + 1]
jmp 0x10102297
cld
btr bp, si
xchg dh, ch
xchg word [esp], di
mov edx, dword [esp]
lea esp, [esp]
jmp 0x1010228a
push word [esp + 5]
pushal
add esp, 8
setne cl
xor bx, 0xc3a2
call fcn.101022e8
lcall 0x2024, 0x648de4f5
lea esp, [esp + 0x20]
lea eax, [esp + 0x86]
std
clc
lea edi, reloc.KERNEL32.dll_GetCurrentThread
mov ebp, esp
jmp 0x101022d5
mov dword [esp + 0x15], eax
mov eax, 0x46b86530
xchg edx, ecx
push word [esp + 0xa]
stc
mov bp, word [esp]
jmp 0x10102317
Function at 0x10102366
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg bh, al
lea esp, [esp + 3]
xchg byte [esp + 5], cl
mov bl, ch
lea esp, [esp + 2]
jmp 0x1010238d
shr eax, cl
mov bp, 0x23c5
rdtsc
jmp 0x10102350

Function at 0x10103f75
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor di, dx
bsf edi, ebp
sub esp, 0xa
cpuid
jmp 0x10103fd3
neg cl
mov ecx, 0x26f61752
cpuid
cmp dl, 0xfd
mov ebp, 0x1e87d540
xchg ch, ah
push dword [esp + 0xa]
jmp 0x10103fa2
push word [esp + 0xf]
lea esp, [esp + 2]
xchg bh, al
rdtsc
lea esp, [esp + 0x1c]
mov edx, ebx
jmp 0x10103fb8

Function at 0x10104300
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
mov byte [esp + 1], cl
xchg byte [esp + 4], bh
push dword [esp]
rdtsc
jmp 0x1010428f

Function at 0x101043ed
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg bx, di
mov cl, ch
mov dl, bl
add esp, 0
mov bp, word [esp]
jmp 0x101043c9
neg bl
mov esi, esp
mov bx, cx
inc ah
lea esp, [esp]
not ecx
jmp 0x10104382
rdtsc
add esp, 4
xchg byte [esp], bh
mov bx, 0xe6ed
rdtsc
mov edi, 0x885d3e89
jmp 0x10104398
xchg byte [esp], al
xchg byte [esp], ah
xchg al, dl
add esp, 0
mov byte [esp], bl
bsf edx, ebp
jmp 0x101043f8
rcl si, 0xb
xchg word [esp + 2], dx
jmp 0x101043b4
stc
cpuid
bsf si, cx
xchg bl, cl
setle ch
lea ecx, [eax + edi]
jmp 0x1010444a
lea ebx, [esi*4]
pushfd
xchg byte [esp + 3], cl
add esp, 4
push edx
setne dh
jmp 0x10104434
Function at 0x10104730
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x43]
std
call 0x10104730
in eax, dx
xchg dword [esp], ebx
jmp 0x101047b7
lea esp, [esp]
mov ch, byte [esp]
mov al, 0xdd
bswap edi
sub esp, 0xb
pop dx
jmp 0x1010479c
adc esi, ebp
setae al
mov byte [esp], cl
mov esi, edx
add esp, 1
mov ecx, 0x2b2b3c12
jmp 0x10104765
pushal
lea esp, [esp + 0x27]
xchg ebp, edx
lea ebx, reloc.KERNEL32.dll_GetCurrentThread
add esp, 2
not ebx
jmp 0x101047ef
pop word [esp]
mov word [esp], dx
lea ebx, [esp + edx]
add esp, 0
mov dl, 0x88
mov ax, 0x2382
jmp 0x10104788
lea edi, [edi + 0x1f]
stc
mov si, cx
xchg dh, bl
bswap edx
mov esi, dword [esp]
jmp 0x10104818
stc
cpuid
btc dx, dx
mov byte [esp], bh
mov dl, byte [esp]
mov di, 0x90d7
jmp 0x101047cd
mov si, di
mov eax, ebp
xchg edi, ebp
lea esp, [esp]
sub esp, 0xc
jmp 0x1010482f
lea esi, [ecx*4]
xchg byte [esp], cl
stc
lea edx, [edx + edi]
rdtsc
mov edi, 0x43b31b93
jmp 0x10104802
mov word [esp + 5], bx
xchg word [esp + 6], cx
mov byte [esp + 6], bl
mov di, 0xd024
mov bl, 0xb4
bsf ebx, eax
jmp 0x10104901
xchg edx, ecx
bswap eax
rdtsc
mov word [esp], ax
bswap edx
pop word [esp]
jmp 0x101048ae
push word [esp]
lea esp, [esp + 1]
mov si, 0x6c48
mov al, ch
add esp, 5
bts esi, eax
jmp 0x1010486b
cpuid
mov bh, bl
rol al, 1
mov esi, dword [esp]
pop si
add esp, 0
jmp 0x101048d9
xchg esi, edi
lea ebx, [edi*4]
xchg word [esp], di
xchg cl, ch
mov ah, dl
sub bl, cl
jmp 0x10104897
mov al, bh
lea esp, [esp]
mov bh, dl
xchg bh, ah
xchg si, dx
sub esp, 0xd
call fcn.10104d39
xchg ebx, eax
or cl, byte [ebx - 0x2f08993a]
mov eax, esi
not ax
not dh
add esp, 0
add ebp, 0x596b8b65
lea esp, [esp]
jmp 0x101048c3
mov bp, word [esp + 2]
mov eax, 0x9bf1826
xchg dword [esp + 8], ecx
mov word [esp + 9], di
pop dword [esp + 3]
lea ebx, [edi*4]
jmp 0x10104881
Function at 0x43d45c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov edi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43d4d6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00404060
mov eax, dword [ebp - 4]
call fcn.00404320
mov esi, eax
test esi, esi
jle 0x43d4c0
mov dword [ebp - 8], 1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov bl, byte [eax + edx - 1]
xor bl, 0xa
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.00404248
mov edx, dword [ebp - 0xc]
mov eax, edi
call fcn.00404328
inc dword [ebp - 8]
dec esi
jne 0x43d499
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43d4dd
lea eax, [ebp - 0xc]
call fcn.00404060
ret

Function at 0x444e04
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov edi, ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x444e81
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00404060
mov eax, dword [ebp - 4]
call fcn.00404320
mov esi, eax
test esi, esi
jle 0x444e6b
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov bl, byte [eax + edx - 1]
xor bl, byte [ebp - 5]
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00404248
mov edx, dword [ebp - 0x10]
mov eax, edi
call fcn.00404328
inc dword [ebp - 0xc]
dec esi
jne 0x444e44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x444e88
lea eax, [ebp - 0x10]
call fcn.00404060
ret

Function at 0x5641fa
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov esi, dword [esp + 4]
pushal
mov byte [esp + 4], 0xb9
pushfd
lea esi, [esi + 1]
mov byte [esp + 4], 0x26
jmp 0x5be146
rdtsc
cwde
mov ecx, dword [ebp + 0x18]
bswap dx
movsx edx, dl
mov edx, dword [ebp + 0x14]
not ax
movsx ax, bl
pushal
movsx eax, bl
mov eax, dword [ebp + 0x10]
call fcn.005ae90f
mov dword [esp], edi
jmp 0x5be8ee
jmp 0x5d0406
push ecx
mov dword [esp + 0x2c], esi
push 0xd2c4a6ee
call fcn.00570cdc
clc
bt bx, 0xa
cmc
cmp dword [ebp + 8], 0
jmp 0x5af623
cmp eax, dword [esi]
push 0x868963e
lea esp, [esp + 4]
jne 0x565672
shl eax, 1
call fcn.005a67b3
pushfd
pushal
lea esp, [esp + 0x24]
jne 0x5d5b04
pushfd
mov dword [esp], 0
pushal
call fcn.005acfc6
setle al
lahf
shl ah, cl
pushfd
mov eax, dword [ebp + 8]
cmc
push eax
cmp ch, ah
mov dword [esp + 4], ebx
stc
jmp 0x5a3d63

Function at 0x56c5d0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xb99b1411
lea esp, [esp + 8]
je 0x5bdea5
cmp bh, ah
test ebx, 0xffff0000
pushfd
call fcn.005428b0
push ebx
call fcn.0056667d
Function at 0x5707b8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [ebp + 0x18]
bswap ecx
push 0xbacb5221
setbe ch
mov dx, dx
movzx ecx, word [edi + ebx*8 + 4]
pushfd
call fcn.00582328
test eax, eax
lea esp, [esp + 0x24]
js 0x57e1c8
pushal
lea esp, [esp + 0x20]
jns 0x5bff18
shld edx, esi, cl
btr bx, 0xe
neg dx
and eax, 0x7fffffff
shl bx, 4
inc edx
pushfd
add eax, dword [esi + 0x2c]
lea edx, [ecx*4 + 0x3022f083]
pop edx
xchg dx, bx
mov ebx, eax
movzx edx, dl
lea edx, [eax + 2]
pushal
lea esp, [esp + 0x20]
jmp 0x5e31c1
jmp 0x5a0374
push edi
mov word [esp], sp
pushal
lea esp, [esp + 0x24]
jns 0x5bff18
clc
and eax, 0x7fffffff
shrd ebx, esp, cl
movzx ebx, al
add eax, dword [esi + 0x2c]
jmp 0x541e4e
xchg edx, eax
pushfd
not eax
jmp 0x543611
cmc
mov cx, word [eax]
cmc
add eax, 2
call fcn.005c73b9

Function at 0x575811
Capabilities:
Encode data using xor

Disassembly:
pushal
bswap di
pushal
pop edi
mov edi, 0x428cf3
jmp 0x5a7b82
jmp fcn.0056b975
push edi
xchg dword [esp + 0x14], edi
pushal
mov byte [esp + 8], bh
push dword [esp + 0x10]
push dword [esp + 0x38]
ret 0x3c
lea esp, [esp + 4]
jp 0x57f345
xchg dword [esp], edi
pushfd
jmp 0x58e60c
pushfd
mov word [esp], 0x3557
pushal
xchg dword [esp + 0x24], edi
jmp 0x56a8b2
push 0xe3818a3a
mov dword [esp + 4], edi
lea edi, [ebx + 0x34ead2a5]
mov word [esp], 0x64d6
lea esp, [esp + 4]
je 0x540be8
pushfd
mov edi, 0x428cf3
mov byte [esp], bh
mov byte [esp], dh
mov byte [esp], cl
pushfd
mov edi, dword [edi + 0x16f227]
push dword [esp + 4]
jmp 0x5b2a94
mov byte [esp + 4], bh
mov edi, dword [edi + 0x16f227]
pushfd
lea edi, [edi - 0x8ee0afc]
call fcn.0057b7ea
lcall 0xc9a, 0x3abcdfc7
stosd dword es:[edi], eax
add al, ah
in al, 0xee
std
aam 0xd3
fmulp st(1)
mul byte [ebp + 0xe564a14]
xor dword [ecx - 9], 0xffffffa8
adc dword [eax + 0x1120580c], ecx
xor eax, 0xc8ab4fe0
dec ebp
mov esp, 0x17c9eeb4
jo 0x5a7b9f
push edx
popal
movsd dword es:[edi], dword [esi]
popal
cmp ebx, ecx
rcr ch, cl
or dword [ebx + 0x6e343c5f], edx
fisttp qword [ecx]
xchg ebx, eax
pop edi
cmp al, 0x34
outsb dx, byte [esi]
std
jg 0x5a7bcd
mov eax, 0xbf316e56
sbb dword [ebx], 0x715f7b03
retf 0xc3d7
lea edi, [edi - 0x8ee0afc]
push dword [esp + 8]
jmp 0x56e224

Function at 0x583c17
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
stc
push ebx
xchg dword [esp + 0x20], ebp
pushal
and bp, 0x8166
lea ebp, [esp + 0x40]
push 0xd2c11a65
cmc
clc
sub esp, 0xffffffc4
jno 0x5be155
push esp
stc
cmp dword [ebp + 8], 0
pushal
lea esp, [esp + 0x24]
jne 0x5d5b04
pushfd
push ecx
mov dword [esp + 4], 0
push 0xc09393bb
lea esp, [esp + 8]
call fcn.005a3276
push ebp
jmp 0x5d5afa
Function at 0x588164
Capabilities:
Encode data using xor

Disassembly:
push ebx
lea esp, [esp + 8]
je 0x58087f
lahf
test dh, al
mov eax, dword [ebp + 0xc]
push 0x16cc7171
clc
clc
test eax, 0xffff0000
mov dword [esp], eax
mov byte [esp], 0x6e
lea esp, [esp + 4]
jne 0x5ca44d
movsx bx, cl
call fcn.00560506
push ebx
in eax, dx
test byte [eax + 0x56], cl
imul ebx, dword [edi - 0x7bf07249], 0x6f38655f
xor eax, 0x596d4077
dec edi
pop edi
push ecx
insb byte es:[edi], dx
aas
test byte [0xe1c5efb3], ah
leave
fld st(5)
loope 0x5808aa
mov ecx, 0xc34a49c
invalid
test ebx, ebx
mov dword [esp], 0x9113bdae
jmp 0x58086e
movzx cx, cl
movsx cx, al
movsx ecx, bl
sete ch
push eax
sete ch
movzx ecx, al
pushal
mov dword [esp + 0x1c], edi
pushal
movsx cx, al
pushfd
setle ch
mov ecx, esi
call fcn.00578544

Function at 0x58a23c
Capabilities:
Execute anti-debugging instructions

Disassembly:
push eax
mov dword [esp], ebx
call fcn.005b8fa9
pushfd
lea esp, [esp + 0xc]
je 0x5b8fbf
jmp 0x583a52

Function at 0x58b294
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
push dword [esp]
lea esp, [esp + 0x2c]
je 0x565672
lahf
pushal
push eax
mov ah, byte [esp + 0xc]
mov eax, dword [ebp - 4]
jmp 0x541ab8
bt sp, 8
add esp, 8
cmp bl, ah
cmp bl, dh
pushfd
pushal
test edi, edi
jmp 0x567fac

Function at 0x58fa1e
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edi, [edi + 0x4bc42682]
mov word [esp + 8], 0xac4a
xchg dword [esp + 0x3c], edi
push 0x8a3cb879
push dword [esp + 0x40]
ret 0x44
lea esp, [esp + 8]
jne 0x565672
daa
mov edi, dword [esi + 0x2c]
pushal
inc ah
rcr ah, cl
rcl al, cl
mov dword [ebp - 4], 0
not ah
mov al, byte [esp]
jmp 0x5d050f
mov edi, edi
shl ax, 1
dec ah
cmp dword [ebp - 4], 0
push dword [esp + 0x10]
cwde
mov eax, dword [ebp + 0xc]
call fcn.005a1e3a
push 0x888f00d4
push dword [esp + 8]
mov edi, dword [edi + 0x14d2f6]
push ecx
mov dword [esp], ecx
jmp 0x570f9a

Function at 0x5a1e3a
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x30]
je 0x5e24a8
not ah
push ecx
xchg bh, al
mov eax, dword [ebp + 0x10]
pop ebx
movzx ebx, dl
lea ebx, [ebp - 8]
pushal
jmp 0x58caf0
pushal
lea esp, [esp + 0x40]
call fcn.00542390
rcl bx, 1
movsx bx, dl
shl bl, cl
xor bh, 0x36
mov ebx, dword [ebp - 8]
test bh, 0x3c
test ax, 0xe25f
cmc
test eax, eax
call fcn.0056c5d0
push dword [esp + 4]
mov byte [esp + 0xc], dl
mov dword [ebp - 8], 0
push dword [esp + 8]
jmp 0x57a296

Function at 0x5b3056
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x2c]
jne 0x565672
bts ax, bp
shld eax, ebp, 0x10
aad 0x14
mov edi, dword [esi + 0x2c]
sbb ah, 0xfc
aaa
rcl ah, cl
mov dword [ebp - 4], 0
pushfd
sal ax, 7
shl ah, 3
mov edi, edi
not eax
lea eax, [edi*4 - 0x75cd1189]
btr ax, 0xd
cmp dword [ebp - 4], 0
setle al
mov eax, dword [ebp + 0xc]
push dword [esp]
mov dword [ebp - 8], 0
mov dword [esp + 4], edx
pushal
lea esp, [esp + 0x28]
je 0x5e24a8
pushfd
mov eax, dword [ebp + 0x10]
mov word [esp], 0x78f2
jmp 0x5cb741
call fcn.00569960
in al, dx
pop edx
dec ecx
inc ebx
jbe 0x5c4768
out dx, eax
sbb ah, byte [eax - 0x7a]
ljmp 0xdbdb
pushal
lea ebx, [ebp - 8]
jmp 0x5c475e
Function at 0x5b839a
Capabilities:
Encode data using xor

Disassembly:
pushfd
nop
push dword [esp]
mov dword [esp + 8], eax
bswap eax
cwde
movzx eax, dl
mov eax, 0x41d98f
push dword [esp]
mov byte [esp + 8], 0x6d
push dword [esp + 4]
call fcn.00543a0c
pop edi
cld
mov ah, 0x15
mov ah, byte [ebx]
jle 0x5b83f9
outsb dx, byte [esi]
xor byte [esi + 0x3c], bh
push 0x1f496842
cdq
or al, ch
loopne 0x5b83c7
stc
int3
sbb eax, dword [edi + 0x64f2da36]
sbb dh, ah
push esp
invalid

Function at 0x5b8fa9
Capabilities:
Execute anti-debugging instructions

Disassembly:
push eax
lea esp, [esp + 8]
call fcn.00547751
test al, ch
push 0x78a913ac
push ecx
pushfd
add esp, 0x10

Function at 0x5bf525
Capabilities:
Execute anti-debugging instructions

Disassembly:
movzx eax, word [edi]
lea ecx, [eax - 0x7e11c534]
movzx ecx, word [edi + 2]
pushal
mov byte [esp + 4], cl
call fcn.0053f365

Function at 0x5bf53c
Capabilities:
Execute anti-debugging instructions

Disassembly:
bt di, 3
test ebx, 0xffff0000
mov byte [esp + 8], ah
push dword [esp + 0xc]
push dword [esp + 0xc]
lea esp, [esp + 0x2c]
je 0x5b8fbf
pushal
mov dword [esp + 0x1c], ebx
mov byte [esp + 4], dl
lea esp, [esp + 0x1c]
call fcn.00547751
clc
call fcn.0058b294
pushal
jmp 0x58c706

Function at 0x5d3e9d
Capabilities:
Encode data using xor

Disassembly:
pushfd
mov dword [esp], 0x581449
call fcn.00564719
lea esp, [esp + 0x40]
jne 0x56cee4
push 2
jmp 0x56b9f3

Function at 0x5d510f
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x567f9b
setl dl
movzx dx, bl
mov edx, 0x41bf73
call fcn.005de460
jmp 0x5d782c
push dword [esp + 8]
xchg dword [esp + 0x14], edx
pushal
mov byte [esp + 4], ah
xchg dword [esp + 0x30], edx
jmp 0x547030

Function at 0x5dcdca
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
pop esi
mov esi, dword [esp + 0x24]
jmp 0x56e25f

Function at 0x5e248a
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ecx
lea esp, [esp + 8]
je 0x5bdea5
cmp dh, 0x78
push ecx
call fcn.005a4014
mov dword [ebp - 8], 0
pushal
push eax
lea esp, [esp + 0x3c]
je 0x5e24a8
xchg bx, ax
movsx eax, al
setle al
mov eax, dword [ebp + 0x10]
not bl
setnp bl
setg bl
pushfd
lea ebx, [ebp - 8]
mov byte [esp], 0x7b
push esi
lea esp, [esp + 8]
call fcn.00542390
sbb ebx, 0xe0b2891c
mov ebx, dword [ebp - 8]
push 0x3a6868c9
test bl, 0x18
cmp cx, 0x7835
test eax, eax
jmp 0x5d8c71
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x419004]
jne 0x40100a
repz ret
jmp fcn.00401681

Function at 0x40421b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00402d5c
and dword [ebp - 0x14], 0
cmp dword [0x41b2f0], 0
mov dword [ebp - 0x18], eax
jne 0x4042ce
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x404376
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x404376
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x41b2f0], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x41b2f4], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x41b2f8], eax
call edi
push eax
call esi
mov dword [0x41b300], eax
test eax, eax
je 0x4042ce
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x41b2fc], eax
mov eax, dword [0x41b2fc]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x404327
cmp dword [0x41b300], ecx
je 0x404327
push eax
call esi
push dword [0x41b300]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x404327
test ebx, ebx
je 0x404327
call edi
test eax, eax
je 0x40431e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40431e
test byte [ebp - 8], 1
jne 0x404327
or dword [ebp + 0x10], 0x200000
jmp 0x40435a
mov eax, dword [0x41b2f4]
cmp eax, dword [ebp - 0x18]
je 0x40435a
push eax
call esi
test eax, eax
je 0x40435a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40435a
mov eax, dword [0x41b2f8]
cmp eax, dword [ebp - 0x18]
je 0x40435a
push eax
call esi
test eax, eax
je 0x40435a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x41b2f0]
call esi
test eax, eax
je 0x404376
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x404378
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret