joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430fb5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, 0x8000
cmp dword [ebp + 0xc], eax
push ebx
push esi
jbe 0x430fca
mov dword [ebp + 0xc], eax
xor ebx, ebx
push ebx
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
cmp dword [edi + 0x20], ebx
je 0x43108e
jmp 0x431086
mov ecx, dword [ebp + 0xc]
cmp dword [ebp - 4], ecx
jae 0x43108e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
lea esi, [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.00431201
test al, al
jne 0x43102c
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
push ebx
push dword [ebp - 0xc]
mov eax, edi
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.004312af
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0xc], esp
call fcn.00403f4c
mov ecx, dword [edi + 0x20]
mov eax, dword [ecx]
call dword [eax + 0x18]
cmp eax, ebx
jne 0x43108e
mov ecx, dword [ebp + 8]
push ebx
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
mov eax, dword [ebp - 4]
add eax, ecx
push eax
push dword [edi]
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 8]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
add dword [ebp - 4], ecx
cmp eax, ebx
jne 0x430ffe
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 4]
pop esi
mov dword [ecx], edx
pop ebx
leave
ret 0xc

Function at 0x431201
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push edi
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x43122e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x43122e
xor al, al
jmp 0x431249
push 1
push 0
push 0
push dword [ebp - 4]
call fcn.0043c340
xor ecx, ecx
add eax, edi
adc edx, ecx
mov dword [esi], eax
mov dword [esi + 4], edx
mov al, 1
pop edi
leave
ret 4

Function at 0x4321f0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x456214]
jne 0x4321fa
repz ret
jmp fcn.00434447
Function at 0x4355df
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x456230]
je 0x4355fa
inc edi
cmp edi, 0x17
jb 0x4355eb
cmp edi, 0x17
jae 0x43577a
push ebp
push 3
call fcn.0043a41d
cmp eax, 1
pop ecx
je 0x435746
push 3
call fcn.0043a41d
test eax, eax
pop ecx
jne 0x43562e
cmp dword [0x456094], 1
je 0x435746
cmp ebx, 0xfc
je 0x435779
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x45a4d0
push ebp
call fcn.00434689
add esp, 0xc
test eax, eax
je 0x435664
push esi
push esi
push esi
push esi
push esi
call fcn.00432725
add esp, 0x14
push 0x104
mov esi, 0x45a4e9
push esi
push 0
mov byte [0x45a5ed], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4356a8
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.00434689
add esp, 0xc
test eax, eax
je 0x4356a8
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00432725
add esp, 0x14
push esi
call fcn.00432690
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x4356ed
push esi
call fcn.00432690
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x45a7e4
push 0x445a7c
sub ecx, eax
push ecx
push eax
call fcn.00437e19
add esp, 0x14
test eax, eax
je 0x4356ed
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00432725
add esp, 0x14
jmp 0x4356ef
xor esi, esi
push 0x445a78
push ebx
push ebp
call fcn.0043a3ac
add esp, 0xc
test eax, eax
je 0x43570f
push esi
push esi
push esi
push esi
push esi
call fcn.00432725
add esp, 0x14
push dword [edi*8 + 0x456234]
push ebx
push ebp
call fcn.0043a3ac
add esp, 0xc
test eax, eax
je 0x435731
push esi
push esi
push esi
push esi
push esi
call fcn.00432725
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0043a1ef
add esp, 0xc
jmp 0x435779
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x435779
cmp ebp, 0xffffffff
je 0x435779
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x456234]
push dword [esi]
call fcn.00432690
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x43a1ef
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004348c2
xor ebx, ebx
cmp dword [0x45ac00], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x43a2c5
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x43a3a5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x43a3a5
push eax
call fcn.00434854
mov dword [esp], 0x4462f8
push edi
mov dword [0x45ac00], eax
call esi
push eax
call fcn.00434854
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x45ac04], eax
call esi
push eax
call fcn.00434854
mov dword [0x45ac08], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00435060
test eax, eax
pop ecx
pop ecx
je 0x43a293
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00432725
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x43a2c5
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00434854
cmp eax, ebx
pop ecx
mov dword [0x45ac10], eax
je 0x43a2c5
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00434854
pop ecx
mov dword [0x45ac0c], eax
mov eax, dword [0x45ac0c]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x43a34a
cmp dword [0x45ac10], ecx
je 0x43a34a
push eax
call fcn.004348cb
push dword [0x45ac10]
mov esi, eax
call fcn.004348cb
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x43a34a
cmp edi, ebx
je 0x43a34a
call esi
cmp eax, ebx
je 0x43a317
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x43a317
test byte [ebp - 0x18], 1
jne 0x43a34a
lea eax, [ebp - 0x10]
push eax
call fcn.00435097
test eax, eax
pop ecx
je 0x43a332
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00432725
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x43a341
or dword [ebp + 0x10], 0x200000
jmp 0x43a385
or dword [ebp + 0x10], 0x40000
jmp 0x43a385
mov eax, dword [0x45ac04]
cmp eax, dword [ebp - 8]
je 0x43a385
push eax
call fcn.004348cb
cmp eax, ebx
pop ecx
je 0x43a385
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x43a385
mov eax, dword [0x45ac08]
cmp eax, dword [ebp - 8]
je 0x43a385
push eax
call fcn.004348cb
cmp eax, ebx
pop ecx
je 0x43a385
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x45ac00]
call fcn.004348cb
cmp eax, ebx
pop ecx
je 0x43a3a5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x43a3a7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x481291
Capabilities:
Resolve function by parsing pe exports

Disassembly:
enter 8, 0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
add edi, dword [edi + 0x3c]
mov eax, dword [edi + 0x78]
test eax, eax
je 0x4812fc
add eax, dword [ebp + 8]
mov ebx, dword [eax + 0x10]
mov dword [ebp - 4], ebx
mov ecx, dword [eax + 0x18]
mov dword [ebp - 8], ecx
mov edi, dword [eax + 0x1c]
add edi, dword [ebp + 8]
mov esi, dword [eax + 0x20]
add esi, dword [ebp + 8]
mov ebx, dword [eax + 0x24]
add ebx, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [esi]
add eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov dl, byte [edx]
cmp dl, byte [eax]
jb 0x4812fc
push ecx
push dword [ebp + 0xc]
push eax
call fcn.0048125f
pop ecx
test eax, eax
jne 0x4812f0
add esi, 4
inc ecx
cmp ecx, dword [ebp - 8]
jb 0x4812c8
jmp 0x4812fc
movzx eax, word [ebx + ecx*2]
mov eax, dword [edi + eax*4]
add eax, dword [ebp + 8]
jmp 0x4812fe
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x401000
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x412004]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 5]
push eax
push 0
push 1
push 0x13
call dword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
test eax, eax
js 0x401055
push 0x1000a
push 6
push 6
call dword [sym.imp.ntdll.dll_NtSetSystemPowerState]
test eax, eax
jns 0x401043
push 2
call dword [sym.imp.ntdll.dll_NtShutdownSystem]
test eax, eax
js 0x401055
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040106f
mov esp, ebp
pop ebp
ret 0x10
push 4
push 8
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040106f
mov esp, ebp
pop ebp
ret 0x10

Function at 0x406900
Capabilities:
Encode data using xor

Disassembly:
pop ecx
mov word [ecx], fs
std
mov byte [0xfd94312e], al
invalid

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x4018f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.00401831
mov esi, eax
mov eax, dword [ebp + 0x10]
xor ebx, ebx
pop ecx
cmp eax, ebx
je 0x40190f
and byte [eax], bl
cmp esi, ebx
jne 0x40191a
xor eax, eax
jmp 0x401a19
xor edi, edi
inc edi
push edi
push dword [ebp + 0x14]
call fcn.00402c9b
pop ecx
cmp eax, ebx
pop ecx
mov dword [ebp - 0x10], eax
jne 0x401944
push 0x30
push ebx
push str.Out_of_memory
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push edi
call fcn.00402bc6
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0xc], edi
xor edi, edi
test eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], ebx
jle 0x4019fd
or dword [ebp - 8], 0xffffffff
mov eax, dword [ebp + 8]
lea esi, [ebx + eax]
mov al, byte [esi]
cmp al, 0x22
jne 0x401986
cmp dword [ebp - 4], 0
jne 0x401980
inc dword [ebp - 8]
mov dword [ebp - 4], 1
jmp 0x4019bd
and dword [ebp - 4], 0
jmp 0x4019bd
cmp dword [ebp - 4], 0
jne 0x4019bd
movsx eax, al
push eax
call fcn.00402b08
test eax, eax
pop ecx
jne 0x4019a8
cmp dword [ebp - 0xc], 1
jne 0x4019a8
inc dword [ebp - 8]
and dword [ebp - 0xc], eax
jmp 0x4019bd
movsx eax, byte [esi]
push eax
call fcn.00402b08
test eax, eax
pop ecx
je 0x4019bd
mov dword [ebp - 0xc], 1
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 8]
jne 0x4019f3
cmp dword [ebp - 4], 1
je 0x4019dc
cmp dword [ebp - 0xc], 0
je 0x4019dc
cmp dword [ebp - 4], 0
jne 0x4019f3
cmp byte [esi], 0x22
jne 0x4019f3
cmp edi, dword [ebp + 0x14]
jge 0x4019ec
mov ecx, dword [ebp - 0x10]
mov al, byte [esi]
mov byte [edi + ecx], al
inc edi
jmp 0x4019f3
mov eax, dword [ebp - 0x10]
and byte [edi + eax], 0
inc ebx
cmp ebx, dword [ebp - 0x14]
jl 0x401962
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call fcn.004017f5
push dword [ebp - 0x10]
call fcn.00402b30
mov eax, dword [ebp + 0x10]
add esp, 0x10
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401a51
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.00403170
push ebx
mov ebx, dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp + 8], eax
push 0x1000
lea eax, [ebp - 0x1008]
push 0
push eax
call fcn.00403110
push dword [ebp + 8]
lea eax, [ebp - 0x1008]
push ebx
push eax
call fcn.00402dd0
xor ecx, ecx
add esp, 0x18
cmp dword [ebp + 8], ecx
mov dword [ebp - 4], ecx
jle 0x401afb
push esi
push edi
lea edi, [ebp - 0x1008]
mov esi, ebx
sub edi, ebx
cmp dword [ebp + 8], 1
jle 0x401aec
test ecx, ecx
je 0x401aec
mov al, byte [esi]
cmp al, 0x5c
je 0x401abc
cmp al, 0x2f
jne 0x401aec
cmp byte [ebx], 0x5c
jne 0x401ac6
cmp ecx, 1
je 0x401aec
cmp byte [ebx + 1], 0x3a
jne 0x401ad1
cmp ecx, 2
je 0x401aec
and byte [edi + esi], 0
lea eax, [ebp - 0x1008]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 8], eax
mov al, byte [esi]
mov byte [edi + esi], al
mov ecx, dword [ebp - 4]
inc ecx
inc esi
cmp ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
jl 0x401aa8
pop edi
pop esi
mov eax, dword [ebp - 8]
pop ebx
leave
ret
Function at 0x401b01
Capabilities:
Check if file exists
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1144
call fcn.00403170
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x401c3e
cmp dword [ebp + 0xc], 1
jne 0x401c35
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x1144]
push eax
call esi
mov ebx, 0x1000
lea eax, [ebp - 0x1144]
push ebx
push eax
call fcn.00401a1e
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
pop ecx
pop ecx
lea eax, [ebp - 0x1144]
push 0x408060
push eax
call edi
lea eax, [ebp - 0x144]
mov dword [ebp + 0xc], 1
push eax
lea eax, [ebp - 0x1144]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x401c29
cmp dword [ebp + 0xc], 1
jne 0x401c29
lea eax, [ebp - 0x118]
push 0x40805c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x401c11
lea eax, [ebp - 0x118]
push 0x408058
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x401c11
push dword [ebp + 8]
lea eax, [ebp - 0x1144]
push eax
call esi
lea eax, [ebp - 0x1144]
push ebx
push eax
call fcn.00401a1e
pop ecx
lea eax, [ebp - 0x118]
pop ecx
push eax
lea eax, [ebp - 0x1144]
push eax
call edi
test byte [ebp - 0x144], 0x10
lea eax, [ebp - 0x1144]
je 0x401c0a
push 1
push eax
call fcn.00401b01
pop ecx
pop ecx
jmp 0x401c11
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x144]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov dword [ebp + 0xc], eax
jmp 0x401b8e
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
xor eax, eax
leave
ret

Function at 0x401f47
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push edi
push esi
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
cmp byte [eax + esi - 1], 0x5c
mov edi, 0x408054
je 0x401f6d
push edi
push esi
call fcn.004031b0
pop ecx
pop ecx
push str.racer_temp
push esi
call fcn.004031b0
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [eax + esi - 1], 0x5c
je 0x401f91
push edi
push esi
call fcn.004031b0
pop ecx
pop ecx
push dword [esp + 0xc]
push esi
call fcn.004031b0
pop ecx
xor eax, eax
pop ecx
pop edi
inc eax
pop esi
ret

Function at 0x4025eb
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
inc eax
neg eax
sbb eax, eax
and eax, ecx
ret
Function at 0x404f21
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40a430
cmp edx, dword [eax]
je 0x404f43
add eax, 8
inc ecx
cmp eax, 0x40a4c0
jl 0x404f34
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40a430]
jne 0x405071
mov eax, dword [0x40d63c]
cmp eax, 1
je 0x40504b
test eax, eax
jne 0x404f74
cmp dword [0x408144], 1
je 0x40504b
cmp edx, 0xfc
je 0x405071
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x404fab
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004031a0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00402d50
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x404fee
lea eax, [ebp - 0x1a4]
push eax
call fcn.00402d50
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4074b8
push edi
call fcn.00405d50
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004031a0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004031b0
lea eax, [ebp - 0xa0]
push 0x407498
push eax
call fcn.004031b0
push dword [esi + 0x40a434]
lea eax, [ebp - 0xa0]
push eax
call fcn.004031b0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00405cc7
add esp, 0x2c
pop edi
jmp 0x405071
lea eax, [ebp + 8]
lea esi, [esi + 0x40a434]
push 0
push eax
push dword [esi]
call fcn.00402d50
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x5c87b6
Capabilities:
Execute anti-debugging instructions

Disassembly:
add edi, 0xa318c628
jmp 0x5c8991
push esp
mov byte [esp + 1], ch
push word [esp + 3]
pop word [esp + 1]
lea esp, [esp + 3]
jmp 0x5c89a7
pop word [esp + 0x10]
lea esp, [esp + 3]
lea edx, [edx + 0x5b]
push edx
lea esp, [esp + 1]
push edx
call fcn.005c8806
push word [esp + 1]
pushal
lea esp, [esp + 2]
mov dword [esp + 0xbc], esi
pushal
push esp
jmp 0x5c8877
push dword [esp + 0x10]
mov dword [esp + 0xb], esi
pop word [esp + 5]
jmp 0x5c88dd
mov edi, dword [esp + 0x28]
mov bp, word [esp]
mov al, 0xae
mov ebx, ecx
clc
jmp 0x5c8911
xchg si, dx
btc ecx, ebx
jmp 0x5c8892
btr edx, edx
jne 0x5c88a9
xchg si, dx
btc ecx, ebx
jmp 0x5c8892
lea esp, [esp + 2]
mov dword [esp + 0xdc], edi
lea esp, [esp + 0xdc]
pushfd
xchg dx, bx
jmp 0x5c88c3
btc ebx, edi
jne 0x5c8915
je 0x5c8915
aam 0x46
aam 0xb3
dec esi
sti
sti
imul ecx, dword [esi], 0xfffffffd
cmp dword [esp + ebx*8 + 0x72], ecx
adc eax, 0xc8a950e4
imul edi, dword [edi + 0x27], 0x7e
and eax, 0xc0ec81
add byte [eax], al
jg 0x5c893a
jle 0x5c893a
sub esp, 0xc0
mov esi, esp
jmp 0x5c8923
rdtsc
btc eax, edi
je 0x5c894a
mov ebx, 0xd2504cfe
jmp 0x5c898b
lea ebp, [esp]
bswap ebx
lea ecx, [eax*4]
cpuid
jmp 0x5c88f5
mov ebx, 0xd2504cfe
mov bx, 0xd31
mov ecx, edi
jmp 0x5c896c
lea eax, [edx*4]
mov edx, 0x1433bcc
xchg bh, dh
mov al, ah
jmp 0x5c861c
mov bx, 0xd31
jmp 0x5c8953
rol ebx, 1
jl 0x5c8c06
mov dh, ch
rcr dx, cl
rdtsc
jmp 0x5c8a3e
lea esp, [esp + 1]
xchg dword [esp], edx
pushal
mov word [esp], dx
push word [esp + 0x1b]
lea esp, [esp + 1]
jmp 0x5c882f
mov dh, ch
rcr dx, cl
rdtsc
jmp 0x5c8a3e
jmp 0x5c8bc4

Function at 0x5e925e
Capabilities:
Encrypt data using aes

Disassembly:
not bl
xchg bh, bl
jmp 0x5e929c
shr edi, 8
sub esp, 0x14
jmp 0x5e923c
bt ebp, esp
push esi
mov esi, ecx
jmp 0x5e92ac
add esp, 0x1b
lea esp, [esp + 1]
jmp 0x5e92b7
lea esp, [esp + 0x1c]
and edi, 0xff0000
mov bl, 0x5c
inc bp
mov bx, 0x7fcb
jmp 0x5e925b
and edi, esi
inc bl
mov edi, dword [edi*4 + 0x5c5834]
mov bp, sp
jmp 0x5e927f
lea esi, [esi + 4]
mov ebx, dword [esi]
pop esi
stc
cmc
pushal
jmp 0x5e9263
lea esp, [esp + 4]
and eax, 0xff000000
sub bp, 0x61b0
jmp 0x5e9348
lea ebp, [eax - 0x2f79bca7]
bsr bp, cx
mov bp, 0xc8bd
sub esp, 0x10
lea esp, [esp + 0x18]
jmp 0x5e92d6
rcr ebp, 5
inc ebp
sub esp, 8
neg bp
shr edi, 0x18
jmp 0x5e92f6
rcr ebp, 7
stc
xor eax, edi
mov edi, edx
jmp 0x5e931e
Function at 0x5e9b99
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0x5e9bc3
call fcn.005ea399
mov byte [esp], ah
mov byte [esp], dh
lea esp, [esp + 1]
jmp 0x5ea3f9
push edx
sub edx, eax
mov word [esp], bx
xchg bh, cl
lea esp, [esp + 4]
jmp 0x5e9b83
lea ecx, [eax - 1]
jmp 0x5e9bdc
lea esp, [esp + 4]
cmp eax, 1
jle 0x5bb5b9
jg 0x5e9b70
iretd
xchg dh, bl
pushal
lea esp, [esp + 0x20]
movzx ebx, byte [esi + 0x11]
sub esp, 0x1c
jmp 0x5e9c14
mov dword [ebp - 4], ecx
bsf dx, ax
lea edi, [edx*4]
mov ecx, 0xff
jmp 0x5bb596
mov di, 0x8439
mov dl, byte [esp]
xor edi, esi
lea esp, [esp + 0x14]
add esi, 0x10
jmp 0x5e9c29
pop dx
pop dword [esp + 0xa]
neg edx
lea esp, [esp + 2]
mov ebx, dword [ebx*4 + 0x5c5834]
jmp 0x5e9bf4
setbe dh
not di
lea edi, [edi + edi]
mov dh, byte [esp]
mov edx, dword [esi]
jmp 0x5e9e2b
sub esp, 0x1c
call fcn.005e9d1d
mov edx, dword [esi + 4]
pushal
call fcn.005e9e5f
inc ecx
ret 0x3750
lea edi, [eax*4]
rol di, cl
mov edi, edx
push edx
lea esp, [esp + 1]
jmp 0x5e9dce
pop edi
lea esi, [ebx + edi]
bswap esi
mov si, word [esp]
jmp 0x5ea3dd

Function at 0x5e9d1d
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
lea ebp, [ebp*4]
lea ebp, [ebp + 0x5c5c34]
mov edi, dword [ebp]
pop ebp
jmp 0x5e9c90
and edi, ecx
push ebp
mov ebp, edi
jmp 0x5e9c64
and ebx, ecx
lea esp, [esp + 0x40]
xor edi, dword [ebx*4 + 0x5c6434]
mov ebx, 0xb66d438a
jmp 0x5e9d06
pushal
add esp, 0x19
stc
lea esp, [esp + 3]
jmp 0x5e9c89
lea esi, [esi*4]
lea esi, [esi + 0x5c5834]
mov edi, dword [esi]
pop esi
stc
jmp 0x5e9caf
mov word [esp + 9], sp
lea esp, [esp + 1]
push esi
mov esi, edi
jmp 0x5e9cc6
mov ebx, gs
xchg ebx, eax
out dx, eax
mul cl
movzx ebx, byte [esi + 2]
stc
call fcn.005e9cf0
aaa
mov byte [0x60a25730], al
jnp 0x5e9cff
ja 0x5e9d2c
loope 0x5e9d78
lcall 0xefc1, 0x324648d
sbb byte [eax - 0x73], ah
and al, 3
lea esp, [esp + 3]
shr edi, 0x18
pushal
lea esp, [esp + 3]
jmp 0x5e9ce2
movzx ebx, byte [esi + 5]
sub esp, 2
lea esp, [esp + 1]
mov dh, 0x5e
add eax, 0x8d02ec83
and al, 1
pushal
lea esp, [esp + 0xc]
jmp 0x5e9d92
push word [esp + 0xb]
lea esp, [esp + 2]
lea esp, [esp + 0x18]
xor edi, dword [ebx*4 + 0x5c6034]
jmp 0x5e9d2b
and al, 0x12
jmp 0x5e9d51
and edx, ecx
stc
jmp 0x5e9db7
lea esp, [esp + 1]
jmp 0x5e9d7c
mov edx, dword [edx*4 + 0x5c5834]
pushal
pop dword [esp + 0xc]
jmp 0x5e9e10
lea esp, [esp + 0x34]
xor edi, dword [edx*4 + 0x5c6834]
sub edx, ebp
dec dx
jmp 0x5e9dd6
and edx, ecx
push edx
mov byte [esp + 2], ch
jmp 0x5e9dec
Function at 0x5e9e5f
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
bsr di, bp
push edi
mov edi, ebx
jmp 0x5e9e64
pushal
mov dword [esp], edx
popal
sub esp, 8
sub esp, 6
jmp 0x5e9ecf
mov dword [esi], edi
dec edi
jmp 0x5e9e3e
lea edi, [edi*4]
lea edi, [edi + 0x5c5834]
mov ebx, dword [edi]
pop edi
jmp 0x5e9e47
mov dword [esp + 8], edi
stc
cmc
popal
lea ebp, [ebp*4]
jmp 0x5e9f04
and edi, ecx
jmp 0x5e9ee1
pop word [esp]
lea esp, [esp + 3]
push ebp
pushal
jmp 0x5e9e87
lea esp, [esp + 2]
shr edi, 0x18
sub esp, 0x12
add esp, 0xd
mov dword [esp], eax
jmp 0x5e9eae
mov edi, dword [edi*4 + 0x5c5c34]
sub esp, 0x1e
push esp
call fcn.005e9f43
retf 0xce58
lea ebp, [ebp + 0x5c5834]
mov edi, dword [ebp]
pop ebp
push edx
pop word [esp]
lea esp, [esp + 2]
jmp 0x5e9e97

Function at 0x5ea06b
Capabilities:
Encrypt data using aes

Disassembly:
mov edi, dword [edi*4 + 0x5c5834]
call 0x5ea03a
mov word [0xd617e49d], cs
push ds
sahf
or al, 0x6b
cmpsb byte [esi], byte es:[edi]
adc byte [edi + 0x76], ch
mov word [esp], sp
pop word [esp]
add esp, 1
lea esp, [esp + 1]
jmp 0x5ea051

Function at 0x5ea1c7
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 8]
xor edi, dword [edx*4 + 0x5c6834]
setp dh
mov dh, 0xde
jmp 0x5ea166

Function at 0x5ea1fe
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push dword [esp]
add esp, 1
lea esp, [esp + 3]
jmp 0x5ea220

Function at 0x5ea362
Capabilities:
Encrypt data using aes

Disassembly:
sub esp, 8
lea esp, [esp + 0xc]
xor edi, dword [edx*4 + 0x5c6834]
push edx
call fcn.005ea34c
dec esi
pop word [esp + 1]
lea esp, [esp + 2]
and edx, ecx
jmp 0x5ea337

Function at 0x5ea3b2
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 0x28]
jne 0x5bb596
je 0x5bb5b9
popal
out dx, eax
jg 0x5ea3e0
jmp 0x965f2d13
xor ecx, dword [edx - 0x22a67221]

Function at 0x8141fb
Capabilities:
Execute anti-debugging instructions

Disassembly:
setne ch
xchg bp, ax
xchg cx, bp
pushal
mov eax, 0x28041d80
mov cl, ch
jmp 0x8141e5
ror esi, 0x1f
xchg si, ax
setp ah
mov word [esp + 0xc], di
mov al, 0xbe
lea edi, [edx*4]
jmp 0x8141b0
setg dh
neg dh
btc esi, ebx
push word [esp + 0x21]
jmp 0x8141fd
jmp 0x8141cd
push word [esp + 0x27]
pop edx
rdtsc
xchg dword [esp + 0x1c], ebx
rcl bx, cl
pop dword [esp + 0x12]
jmp 0x814252
mov di, word [esp + 0x1c]
lea edi, [esp + ebp]
mov word [esp + 4], di
bswap ebp
mov dword [esp + 0x1b], eax
popal
jmp 0x814235