joyce8/EMBER2024-capa huggingface dataset:
Function at 0x622d4040
Capabilities:
Encrypt data using dpapi
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea esi, [ebp - 0x30]
push ebx
mov ebx, str.SignatureKeyPair
sub esp, 0x6c
cmp ecx, 2
mov dword [ebp - 0x40], eax
mov eax, str.KeyExchangeKeyPair
cmovne ebx, eax
lea eax, [ebp - 0x34]
mov dword [ebp - 0x3c], edx
mov edi, dword [sym.imp.advapi32.dll_RegQueryValueExA]
mov dword [ebp - 0x44], ecx
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], edx
call edi
sub esp, 0x18
test eax, eax
je 0x622d40a8
xor edx, edx
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov edx, dword [ebp - 0x4c]
test eax, eax
mov dword [ebp - 0x48], eax
je 0x622d4096
lea ecx, [ebp - 0x34]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], edx
mov dword [esp + 0xc], ecx
mov ecx, dword [ebp - 0x3c]
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], ecx
call edi
sub esp, 0x18
test eax, eax
je 0x622d4110
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_free]
mov edx, dword [ebp - 0x4c]
lea esp, [ebp - 0xc]
pop ebx
pop esi
mov eax, edx
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x30]
mov ebx, dword [ebp - 0x48]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x20]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], ebx
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x28]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.crypt32.dll_CryptUnprotectData]
sub esp, 0x1c
test eax, eax
mov dword [ebp - 0x4c], eax
jne 0x622d4178
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_free]
mov edx, dword [ebp - 0x4c]
jmp 0x622d4098
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], 0
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov dword [esp + 4], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x40]
mov dword [esp], 0
call sym._import_key
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LocalFree]
mov eax, dword [ebp - 0x48]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_free]
mov edx, dword [ebp - 0x40]
test edx, edx
je 0x622d4096
lea eax, [ebp - 0x2c]
mov dword [esp + 8], 0x73620457
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [esp], 0x622d8080
mov dword [esp + 4], eax
call sym._lookup_handle
mov edx, dword [ebp - 0x40]
test eax, eax
je 0x622d4098
cmp dword [ebp - 0x44], 2
mov ecx, str.SignaturePermissions
mov eax, str.KeyExchangePermissions
mov dword [esp + 0x14], esi
cmove eax, ecx
mov esi, dword [ebp - 0x2c]
mov dword [ebp - 0x30], 4
mov dword [esp + 0xc], 0
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x3c]
lea ecx, [esi + 0x1c]
mov dword [esp + 0x10], ecx
mov dword [esp + 8], 0
mov dword [esp], eax
call edi
mov edx, dword [ebp - 0x40]
sub esp, 0x18
jmp 0x622d4098
Function at 0x622d4250
Capabilities:
Access peb ldr_data
Extract resource via kernel32 functions
Get process heap flags
Get process heap force flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
mov edi, dword [ecx]
mov edx, dword [ecx + 4]
mov eax, dword [ecx + 8]
mov esi, dword [ecx + 0xc]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_FindResourceW]
sub esp, 0xc
mov dword [ebp - 0x1c], eax
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov edx, dword [ebp - 0x1c]
sub esp, 8
mov ebx, eax
mov dword [esp + 4], edx
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov dword [ebp - 0x1c], eax
sub esp, 8
test ebx, ebx
je 0x622d43e8
mov eax, dword [esi]
test eax, eax
je 0x622d43d0
mov edx, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], ebx
mov dword [esp + 0x14], 0
mov dword [ebp - 0x28], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call edx
lea ecx, [eax + 1]
sub esp, 0x18
lea eax, [ecx + ecx]
mov dword [esp + 4], 0
mov edi, eax
mov dword [ebp - 0x20], eax
mov dword [esp + 8], edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x24], ecx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
sub esp, 0xc
test eax, eax
mov edi, eax
je 0x622d43f8
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [esi + 4]
xor edx, edx
sub esp, 0x18
mov word [edi + eax - 2], dx
mov eax, dword [esi]
test ecx, ecx
mov edx, dword [eax]
mov dword [esp + 4], edi
mov dword [esp], eax
jne 0x622d43c0
call dword [edx + 0x28]
mov dword [esi + 8], eax
sub esp, 8
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esi + 8]
sub esp, 0xc
lea esp, [ebp - 0x10]
pop ecx
not eax
pop ebx
shr eax, 0x1f
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
call dword [edx + 0x24]
mov dword [esi + 8], eax
sub esp, 8
jmp 0x622d4386
mov edx, esi
mov eax, edi
call sym._create_registrar
test eax, eax
jne 0x622d42c0
lea esi, [esi]
xor eax, eax
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov dword [esi + 8], 0x8007000e
xor eax, eax
jmp 0x622d43ea
Function at 0x622d4410
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, ecx
sub esp, 0x3c
mov eax, dword [ecx]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x2c], edx
mov dword [esp], esi
mov dword [esp + 4], eax
call sym.rsaenh.dll_CPDestroyKey
mov eax, dword [ebp - 0x2c]
sub esp, 8
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x73620457
mov dword [esp + 4], eax
mov dword [esp], 0x622d8080
call sym._copy_handle
test edi, edi
jne 0x622d4460
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x1c]
mov dword [esp + 8], 0x26384993
mov dword [esp + 0xc], eax
mov dword [esp + 4], esi
mov dword [esp], 0x622d8080
call sym._lookup_handle
test eax, eax
je 0x622d44a0
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x622d4457
mov eax, ebx
call sym._store_key_container_keys
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
jmp sym._store_key_container_permissions
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x80090001
jmp 0x622d4457

Function at 0x622d5d60
Capabilities:
Check if process is running under wine

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x20
lea eax, [ebp + 0x10]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], str.SoftwareWineCryptoRSA_s
mov dword [esp + 0xc], 0x7fffffff
mov dword [esp + 8], eax
mov dword [esp], 5
mov dword [esp + 4], 0
call dword [sym.imp.ucrtbase.dll___stdio_common_vsprintf]
mov edx, 0xffffffff
leave
test eax, eax
cmovs eax, edx
ret

Function at 0x622d5e30
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edx, [ebp - 0x20]
push ebx
mov ebx, eax
sub esp, 0x3c
call sym._create_container_key.constprop.0
test eax, eax
jne 0x622d5e50
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebx + 0x224]
lea esi, [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
mov dword [esp + 8], 0x73620457
mov dword [esp + 0xc], esi
mov dword [esp + 4], eax
mov dword [esp], 0x622d8080
call sym._lookup_handle
test eax, eax
jne 0x622d5ec0
mov eax, dword [ebx + 0x228]
mov edi, dword [ebp - 0x20]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x73620457
mov dword [esp + 4], eax
mov dword [esp], 0x622d8080
call sym._lookup_handle
test eax, eax
jne 0x622d5f00
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x14], 4
mov dword [esp + 0xc], 4
add eax, 0x1c
mov dword [esp + 8], 0
mov dword [esp + 0x10], eax
mov dword [esp + 4], str.KeyExchangePermissions
mov dword [esp], edi
call dword [sym.imp.advapi32.dll_RegSetValueExA]
sub esp, 0x18
jmp 0x622d5e7c
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x14], 4
mov dword [esp + 0xc], 4
add eax, 0x1c
mov dword [esp + 8], 0
mov dword [esp + 0x10], eax
mov dword [esp + 4], str.SignaturePermissions
mov dword [esp], edi
call dword [sym.imp.advapi32.dll_RegSetValueExA]
sub esp, 0x18
jmp 0x622d5ea5
Function at 0x622d5f40
Capabilities:
Encrypt data using dpapi
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, edx
mov edx, str.SignatureKeyPair
push esi
push ebx
mov ebx, str.KeyExchangeKeyPair
sub esp, 0x5c
cmp ecx, 2
mov esi, dword [ebp + 8]
cmove ebx, edx
lea edx, [ebp - 0x30]
mov dword [esp + 8], 0x73620457
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
mov dword [esp], 0x622d8080
call sym._lookup_handle
test eax, eax
jne 0x622d5f90
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x3c], eax
and ah, 0x7f
cmp eax, 0x2400
jne 0x622d6000
mov eax, dword [ebp - 0x40]
mov edx, dword [eax + 0x20]
lea eax, [edx + 1]
shr eax, 1
lea eax, [eax + eax*4]
lea eax, [eax + edx*2 + 0x14]
mov dword [ebp - 0x2c], eax
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov ecx, eax
test eax, eax
je 0x622d5f81
lea eax, [ebp - 0x2c]
mov edx, 1
mov dword [ebp - 0x3c], ecx
mov dword [esp], eax
mov eax, dword [ebp - 0x40]
call sym._crypt_export_private_key
mov ecx, dword [ebp - 0x3c]
test eax, eax
jne 0x622d6018
mov dword [ebp + 8], ecx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp dword [sym.imp.ucrtbase.dll_free]
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x80090003
jmp 0x622d5f81
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x24], ecx
mov dword [esp + 0x14], esi
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x20]
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x28]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.crypt32.dll_CryptProtectData]
mov ecx, dword [ebp - 0x3c]
sub esp, 0x1c
test eax, eax
je 0x622d5fe7
mov eax, dword [ebp - 0x20]
mov dword [esp + 0xc], 3
mov dword [esp + 8], 0
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], ebx
mov dword [esp + 0x10], eax
mov dword [esp], edi
call dword [sym.imp.advapi32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x1c]
sub esp, 0x18
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LocalFree]
mov ecx, dword [ebp - 0x3c]
sub esp, 4
jmp 0x622d5fe7
Function at 0x622d6be0
Capabilities:
Hash data via bcrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._BCryptHashData_16
mov eax, 1
sub esp, 0x10
leave
ret

Function at 0x401000
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ebp, esp
add esp, 0xfffffffc
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x4033ec], eax
mov eax, dword [ebp + 4]
mov dword [0x40321d], eax
xor eax, eax
mov ecx, 0x16
push eax
dec ecx
jne 0x401020
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push 0x7f00
push esi
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [ebp - 0x5c]
push ecx
mov eax, 0x30
mov dword [ecx], eax
mov eax, dword [0x40321d]
mov dword [ebp - 0x48], eax
mov eax, 0x4016dc
mov dword [ebp - 0x54], eax
mov ecx, str.Hello
mov dword [ebp - 0x34], ecx
call dword [sym.imp.USER32.dll_RegisterClassExA]
xor ecx, ecx
push ecx
push dword [0x40321d]
push ecx
push ecx
push 0x12e
push 0x7a
push 0x34c
push 0x2aa
push 0x40000
lea eax, str.lukifas
push eax
mov eax, str.Hello
push eax
push ecx
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x403438], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x403438]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
xor ebx, ebx
lea edi, [ebp - 0x50]
jmp 0x4010bc
push edi
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
push ebx
push edi
call dword [sym.imp.USER32.dll_GetMessageA]
test al, al
jne 0x4010b5
mov esp, ebp
ret
Function at 0x402da5
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0x405537], eax
push 0
push dword [ebp + 8]
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push str.Magnetick
push str.Charge_Window_App
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x402dec
xor eax, eax
jmp 0x402e03
push 0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
inc eax
leave
ret

Function at 0x403222
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x404488
push 0x403384
push eax
mov eax, dword [0x4055b4]
mov dword fs:[0], esp
mov ecx, dword [sym.imp.CRTDLL.dll__fmode_dll]
sub esp, 0x6c
mov dword [ecx], eax
mov edx, dword [0x4055b0]
mov eax, dword [sym.imp.CRTDLL.dll__commode_dll]
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [eax], edx
call fcn.0040337a
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x2c]
push dword [0x4055ac]
push edx
push eax
lea ecx, [ebp - 0x30]
push ecx
call sub.CRTDLL.dll___GetMainArgs
add esp, 0x10
push 0x4040d0
push 0x4040cc
call sub.CRTDLL.dll__initterm
add esp, 8
mov dword [ebp - 4], 0
mov eax, dword [sym.imp.CRTDLL.dll__acmdln_dll]
mov esi, dword [eax]
mov al, byte [esi]
cmp al, 0x22
jne 0x4032bd
mov al, byte [ebp - 0x34]
inc esi
mov al, byte [esi]
test al, al
je 0x4032b5
cmp al, 0x22
jne 0x4032aa
cmp byte [esi], 0x22
jne 0x4032c7
inc esi
jmp 0x4032c7
cmp al, 0x20
jbe 0x4032c7
inc esi
cmp byte [esi], 0x20
ja 0x4032c1
cmp byte [esi], 0
je 0x4032d7
cmp byte [esi], 0x20
ja 0x4032d7
inc esi
cmp byte [esi], 0
jne 0x4032cc
mov dword [ebp - 0x50], 0
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x50], 1
mov eax, 0xa
je 0x4032f7
movzx eax, word [ebp - 0x4c]
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call sub.CRTDLL.dll_exit
jmp 0x403333
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x675ba0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x20]
push ebx
push ebp
push esi
mov ebx, dword [eax]
push edi
push 0x800
push 0x40
mov dword [esp + 0x1c], ebx
call dword [ebx + 0x2c]
mov edi, eax
test edi, edi
jne 0x675bcc
pop edi
pop esi
pop ebp
xor ax, ax
pop ebx
add esp, 0xc
ret
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x20]
push 0
push 0
push ecx
push edx
call dword [ebx + 0x24]
mov eax, dword [esp + 0x2c]
mov ebp, 0x543a2110
test eax, eax
je 0x675c90
jmp 0x675bf4
mov eax, dword [esp + 0x2c]
cmp eax, 0x800
jb 0x675c00
mov eax, 0x800
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x10]
push 0
push ecx
push eax
push edi
push edx
call dword [ebx + 0x14]
test eax, eax
je 0x675ca0
mov edx, dword [esp + 0x10]
test edx, edx
je 0x675ce2
xor esi, esi
test edx, edx
jle 0x675c67
mov ecx, ebp
xor ecx, 0x2da05629
mov eax, ecx
mov ebx, ecx
shr eax, 0x18
shr ebx, 0x10
xor al, bl
mov ebx, ecx
shr ebx, 8
xor al, bl
mov bl, byte [esi + edi]
xor al, bl
xor al, cl
mov byte [esi + edi], al
and eax, 0xff
shl ebp, 8
add ebp, eax
inc esi
cmp esi, edx
jl 0x675c2b
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x18]
push 0
push eax
push edx
push edi
push ecx
call dword [ebx + 0x18]
test eax, eax
je 0x675cc2
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x2c]
sub eax, edx
mov dword [esp + 0x2c], eax
jne 0x675bf0
push edi
call dword [ebx + 0x30]
pop edi
pop esi
pop ebp
mov ax, 1
pop ebx
add esp, 0xc
ret
push 0
call dword [ebx + 0x78]
push eax
mov eax, dword [esp + 0x38]
push eax
call fcn.00676910
add esp, 0xc
push edi
call dword [ebx + 0x30]
pop edi
pop esi
pop ebp
xor ax, ax
pop ebx
add esp, 0xc
ret
call dword [ebx + 0x78]
mov ecx, dword [esp + 0x30]
push eax
push ecx
call fcn.00676980
add esp, 8
push edi
call dword [ebx + 0x30]
pop edi
pop esi
pop ebp
xor ax, ax
pop ebx
add esp, 0xc
ret
push 0
call dword [ebx + 0x78]
mov edx, dword [esp + 0x34]
push eax
push edx
call fcn.00676910
add esp, 0xc
push edi
call dword [ebx + 0x30]
pop edi
pop esi
pop ebp
xor ax, ax
pop ebx
add esp, 0xc
ret

Function at 0x676780
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
push edi
mov al, byte [ecx]
xor edi, edi
mov byte [esi], al
mov al, byte [ecx]
test al, al
je 0x6767ba
mov edx, esi
push ebx
sub edx, ecx
mov al, byte [ecx + 1]
mov bl, byte [edx + ecx]
inc edi
inc ecx
dec al
xor al, bl
mov byte [edx + ecx], al
mov al, byte [ecx]
test al, al
jne 0x67679b
mov byte [edi + esi], 0
pop ebx
mov eax, esi
pop edi
pop esi
ret
mov byte [edi + esi], 0
mov eax, esi
pop edi
pop esi
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x543453
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.0054348c
mov dword [esp + 3], edx
push dword [esp + 7]
mov dword [esp + 8], eax
push cx
pushfd
jmp 0x543513
lea esp, [esp + 2]
mov dword [esp + 8], ecx
push bp
lea esp, [esp + 2]
mov dword [esp + 4], edx
call fcn.005434cc
xor ch, byte [ecx + 0x6aab5839]
dec eax
jmp 0x543535
rcr ebx, 1
push di
lea esp, [esp + 2]
call fcn.005434b6

Function at 0x54348c
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 3]
jbe 0x543458
mov dword [esp + 3], edx
jmp 0x54349c
push dword [esp + 7]
mov dword [esp + 8], eax
push cx
jmp 0x5434c9
pushfd
jmp 0x543513

Function at 0x5434fd
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf052d894
jmp 0x5435a9
mov dword [esp + 0x10], esp
push ebp
jmp 0x543599
pushal
jmp 0x54355d
mov dword [esp + 0x14], ebp
pushal
call fcn.00543579
push word [esp + 3]
jnp 0x543582
mov dword [esp], ebx
lea esp, [esp + 2]
jmp 0x5435bf
mov dword [esp], ebx
jmp 0x5435e7
mov word [esp], bx
push dword [esp + 1]
jbe 0x543558
mov dword [esp + 0x14], ebp
jmp 0x543542
lea ecx, [esp + edx]
jmp 0x5435c9
mov dword [esp + 0x34], edi
lea esp, [esp + 0x34]
jmp 0x5435f3
inc ebx
ja 0x54366b
mov ebp, 0x8f1d395e
jmp 0x543670
lea esp, [esp + 2]
mov dword [esp + 0x34], edi
lea esp, [esp + 0x34]
pushfd
jmp 0x54244c
mov dl, al
lea ecx, [ebx*4]
jmp 0x543637
cmc
jp 0x5435f9
mov dl, al
lea ecx, [ebx*4]
mov di, 0xc1b7
jmp 0x54363b
mov cl, ah
inc si
jmp 0x543653
mov di, 0xc1b7
lea edi, [esp]
mov ebx, eax
stc
jmp 0x543647
jne 0x543621
mov cl, ah
inc si
jmp 0x543653
sub esp, 0xc0
jmp 0x54368c
mov ebp, 0x8f1d395e
mov ebp, dword [esp + 0x2c]
jmp 0x54360f
rdtsc
jmp 0x5436fe
mov esi, esp
bts edx, ebp
jle 0x543676
rdtsc
xchg ebx, edx
mov ch, dh
jmp fcn.00543702
xchg ebx, edx
mov ch, dh

Function at 0x543562
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf052d894
jmp 0x5435a9
mov dword [esp + 0x10], esp
push ebp
jmp 0x543599
pushal
jmp 0x54355d
mov dword [esp + 0x14], ebp
pushal
call fcn.00543579
push word [esp + 3]
jnp 0x543582
mov dword [esp], ebx
lea esp, [esp + 2]
jmp 0x5435bf
mov dword [esp], ebx
jmp 0x5435e7
mov word [esp], bx
push dword [esp + 1]
jbe 0x543558
mov dword [esp + 0x14], ebp
jmp 0x543542
lea ecx, [esp + edx]
jmp 0x5435c9
mov dword [esp + 0x34], edi
lea esp, [esp + 0x34]
jmp 0x5435f3
inc ebx
ja 0x54366b
mov ebp, 0x8f1d395e
jmp 0x543670
lea esp, [esp + 2]
mov dword [esp + 0x34], edi
lea esp, [esp + 0x34]
pushfd
jmp 0x54244c
mov dl, al
lea ecx, [ebx*4]
jmp 0x543637
cmc
jp 0x5435f9
mov dl, al
lea ecx, [ebx*4]
mov di, 0xc1b7
jmp 0x54363b
mov cl, ah
inc si
jmp 0x543653
mov di, 0xc1b7
lea edi, [esp]
mov ebx, eax
stc
jmp 0x543647
jne 0x543621
mov cl, ah
inc si
jmp 0x543653
sub esp, 0xc0
jmp 0x54368c
mov ebp, 0x8f1d395e
mov ebp, dword [esp + 0x2c]
jmp 0x54360f
rdtsc
jmp 0x5436fe
mov esi, esp
bts edx, ebp
jle 0x543676
rdtsc
xchg ebx, edx
mov ch, dh
jmp fcn.00543702
xchg ebx, edx
mov ch, dh

Function at 0x543579
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x34], esi
call 0x543562
Function at 0x5521bd
Capabilities:
Execute anti-debugging instructions

Disassembly:
popfd
jmp fcn.0053d19f
pop ecx
pop edi
pop esi
jmp 0x551a45
mov ecx, eax
cld
rep movsb byte es:[edi], byte [esi]
jmp 0x551a5b
lea esp, [esp + 2]
lea esp, [esp + 4]
popal
jmp 0x551cca
lea esp, [esp + 2]
lea esp, [esp + 4]
popal
jmp 0x551ada
push word [esp + 1]
ja 0x551cc1
jbe 0x551beb
lea ecx, [ebp - 0x99]
call 0x552200
movsd dword es:[edi], dword [esi]
cmp dword [ecx - reloc.KERNEL32.dll_GetLocalTime], ebp
sti
ror byte [ebp - 0x24], cl
lea ecx, [ebp - 0x99]
add esp, 4
ja 0x552238
jbe 0x552238
xor dh, byte [ebx + 0x72b54623]
sub byte [edx + ebp + 0x2108bc4d], dh
pushal
mov dword [reloc.KERNEL32.dll_GetLocalTime], eax
xchg ecx, eax
bsr cx, bp
rcl bh, 2
jmp 0x552213
xchg dword [esp], edx
bt bp, di
mov al, 0xc7
mov bp, si
call fcn.00552319
mov esi, 0xe24b2889
sbb eax, 0xf7e08f0f
invalid
jmp 0x552255
pop ebp
jmp fcn.00540b3e

Function at 0x561b19
Capabilities:
Encode data using xor

Disassembly:
mov byte [esp + 1], dh
shr eax, cl
lea esp, [esp + 0x28]
or eax, dword [ebp - 4]
jmp 0x561b31
pushal
mov bl, 0x67
push edx
pop eax
mov dword [esp + 0x1c], ecx
jmp 0x561b1b
jmp 0x561af2
push eax
push ebx
lea esp, [esp + 8]
popal
lea ecx, [edx + 0xb0]
seto cl
jmp 0x561b41
push ecx
pop word [esp]
mov byte [esp], al
lea esp, [esp + 2]
mov dword [esi], eax
jmp 0x561b01
push ecx
mov ecx, ebx
sub esp, 5
mov dword [esp], ecx
lea esp, [esp + 1]
jmp 0x561d16
shl edx, cl
call 0x561c70
mov esi, ecx
cmc
jmp 0x561d59
pop edi
bt esi, esp
mov si, bx
lea esi, [eax + edi]
mov si, word [esp]
jmp 0x561d1d
in al, 0xec
inc esi
cmp dword [ebp + 8], edi
push ecx
call fcn.00561d43
jge 0x561d55
popal
add bl, dh
xor eax, 0x760f27d
inc ebx
jge 0x561d67
add dh, cl
dec esi
push 0xffffffffffffff8d
and al, 0x18
push 0x20
bswap esi
lea edi, [eax*4]
bsf di, bp
jmp 0x561d33

Function at 0x580687
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 4]
jmp 0x57dffa