joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b3f00
Capabilities:
Get file size
Write file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4d2abb
push eax
mov eax, 0x2718
mov dword fs:[0], esp
call fcn.004bcc80
mov eax, dword [0x545c8c]
push edi
mov dword [esp + 4], eax
mov ecx, 0x9c4
xor eax, eax
lea edi, [esp + 0xc]
mov dword [esp + 0x2724], 0
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x272c]
push ecx
lea ecx, [esp + 8]
call fcn.004ca929
push 0x5c
lea ecx, [esp + 8]
call fcn.004caa55
mov edx, dword [esp + 0x2730]
lea ecx, [esp + 4]
push edx
call fcn.004caa2e
mov eax, dword [esp + 4]
push 0
push 0x80
push 3
push 0
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4b3fa6
lea ecx, [esp + 4]
mov dword [esp + 0x2724], eax
call fcn.004ca7ec
xor eax, eax
jmp 0x4b4023
push ebx
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push 0
mov esi, eax
push 0x40
push edi
sub esi, 0x40
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test esi, esi
jbe 0x4b4001
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
cmp esi, 0x2710
push 0
jbe 0x4b3ff3
lea ecx, [esp + 0x14]
lea edx, [esp + 0x18]
push ecx
push 0x2710
push edx
push edi
call ebx
sub esi, 0x2710
jne 0x4b3fcd
jmp 0x4b4001
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push eax
push esi
push ecx
push edi
call ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0xc]
mov dword [esp + 0x272c], 0xffffffff
call fcn.004ca7ec
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x271c]
pop edi
mov dword fs:[0], ecx
add esp, 0x2724
ret 8
Function at 0x4b4040
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x14
push ebp
push esi
mov esi, dword [esp + 0x24]
xor ebp, ebp
cmp esi, ebp
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ebp
je 0x4b4170
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0xc]
push edi
mov edi, dword [esp + 0x28]
push eax
push 0x40000
push ebp
push esi
push edi
call ebx
test eax, eax
jne 0x4b415f
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x10]
push ecx
push 4
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
test eax, eax
jne 0x4b415f
mov eax, dword [esp + 0x34]
test eax, eax
je 0x4b415a
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], ebp
push ecx
push 0x20019
push ebp
push esi
push edi
call ebx
test eax, eax
jne 0x4b415f
push eax
push eax
lea edx, [esp + 0x30]
lea eax, [esp + 0x20]
push edx
lea ecx, [esp + 0x28]
push eax
push ecx
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x34]
push ebp
lea eax, [esp + 0x44]
push edx
push eax
push ebp
push ebp
push ebp
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x4b415f
push 0x105
call fcn.004ca52d
mov esi, eax
mov eax, dword [esp + 0x30]
add esp, 4
xor edi, edi
test eax, eax
jbe 0x4b4151
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edx, dword [esp + 0x10]
push 0x105
push esi
push edi
push edx
call ebx
test eax, eax
jne 0x4b4141
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x10]
push 1
push eax
push esi
push ecx
mov ecx, dword [esp + 0x24]
call fcn.004b4040
jmp 0x4b4148
cmp eax, 0x103
je 0x4b4151
mov eax, dword [esp + 0x2c]
inc edi
cmp edi, eax
jb 0x4b4117
push esi
call fcn.004ca556
add esp, 4
mov ebp, 1
mov eax, dword [esp + 0x10]
pop edi
test eax, eax
pop ebx
je 0x4b4170
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebp
pop esi
pop ebp
add esp, 0x14
ret 0x10

Function at 0x4b4650
Capabilities:
Check os version

Disassembly:
sub esp, 0x9c
push esi
push edi
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 8]
xor esi, esi
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0x9c
call edi
test eax, eax
jne 0x4b469c
lea ecx, [esp + 8]
mov dword [esp + 8], 0x94
push ecx
call edi
test eax, eax
jne 0x4b469c
pop edi
pop esi
add esp, 0x9c
ret
cmp dword [esp + 0x18], 2
jne 0x4b46af
cmp dword [esp + 0xc], 5
jb 0x4b46af
mov esi, 1
mov eax, esi
pop edi
pop esi
add esp, 0x9c
ret
Function at 0x4b7e2a
Capabilities:
Create directory
Get common file path

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x104
push esi
mov esi, ecx
push 0
lea ecx, [esp + 8]
push eax
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov edx, dword [esp + 0x10c]
lea eax, [esp + 4]
push edx
push 0x5455c8
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [esp + eax + 0xc]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [esp + 4]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x4b7e7e
pop esi
add esp, 0x104
ret 8
lea eax, [esp + 4]
mov ecx, esi
push eax
push reloc.WS2_32.dll_htonl
call fcn.004b7dd0
mov eax, 1
pop esi
add esp, 0x104
ret 8

Function at 0x4b7eaa
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x104
push esi
mov esi, ecx
push 0
lea ecx, [esp + 8]
push eax
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov edx, dword [esp + 0x10c]
lea eax, [esp + 4]
push edx
push 0x5455c8
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [esp + eax + 0xc]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [esp + 4]
mov ecx, esi
push 0
push 0
push edx
call fcn.004b3cf0
test eax, eax
jne 0x4b7f01
pop esi
add esp, 0x104
ret 8
lea eax, [esp + 4]
push eax
call fcn.004bdbdf
add esp, 4
test eax, eax
je 0x4b7f1e
xor eax, eax
pop esi
add esp, 0x104
ret 8
lea ecx, [esp + 4]
push ecx
push reloc.WS2_32.dll_recv
mov ecx, esi
call fcn.004b7dd0
mov eax, 1
pop esi
add esp, 0x104
ret 8

Function at 0x4b7f5b
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4d2d9b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x120
push esi
mov esi, ecx
push edi
lea ecx, [esp + 8]
call fcn.004bb455
mov edi, dword [esp + 0x140]
push 0
push edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x138], 0
call fcn.004bb518
test eax, eax
lea ecx, [esp + 8]
jne 0x4b7fae
call fcn.004bb4ce
lea ecx, [esp + 8]
mov dword [esp + 0x130], 0xffffffff
call fcn.004bb492
xor eax, eax
jmp 0x4b8045
call fcn.004bb4ce
mov eax, dword [esp + 0x144]
push 0
lea ecx, [esp + 0x28]
push eax
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov edx, dword [esp + 0x13c]
mov eax, dword [esp + 0x138]
push edx
lea ecx, [esp + 0x28]
push eax
push ecx
lea edx, [esp + 0x30]
push str._s_s_s.lnk
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [esp + 0x24]
mov ecx, esi
push eax
push edi
call fcn.004b80e0
test eax, eax
jne 0x4b801b
lea ecx, [esp + 8]
mov dword [esp + 0x130], 0xffffffff
call fcn.004bb492
xor eax, eax
jmp 0x4b8045
lea ecx, [esp + 0x24]
push ecx
push reloc.WS2_32.dll_bind
mov ecx, esi
call fcn.004b7dd0
lea ecx, [esp + 8]
mov dword [esp + 0x130], 0xffffffff
call fcn.004bb492
mov eax, 1
mov ecx, dword [esp + 0x128]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x12c
ret 0x10
Function at 0x4b806a
Capabilities:
Delete file
Get common file path

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x104
push esi
mov esi, ecx
push 0
lea ecx, [esp + 8]
push eax
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov edx, dword [esp + 0x110]
mov eax, dword [esp + 0x10c]
push edx
lea ecx, [esp + 8]
push eax
push ecx
lea edx, [esp + 0x10]
push str._s_s_s.lnk
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4b80be
pop esi
add esp, 0x104
ret 0xc
lea ecx, [esp + 4]
push ecx
push reloc.WS2_32.dll_connect
mov ecx, esi
call fcn.004b7dd0
mov eax, 1
pop esi
add esp, 0x104
ret 0xc

Function at 0x4b80e0
Capabilities:
Create shortcut via ishelllink

Disassembly:
sub esp, 0x210
lea eax, [esp]
push eax
push 0x4fcd80
push 1
push 0
push 0x4fcd70
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jge 0x4b810e
xor eax, eax
add esp, 0x210
ret 8
mov eax, dword [esp]
mov edx, dword [esp + 0x214]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, dword [esp]
lea edx, [esp + 4]
push edx
push 0x4fcd90
mov ecx, dword [eax]
push eax
call dword [ecx]
test eax, eax
jge 0x4b8142
xor eax, eax
add esp, 0x210
ret 8
mov ecx, dword [esp + 0x218]
lea eax, [esp + 8]
push 0x104
push eax
push 0xffffffffffffffff
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esp + 4]
lea ecx, [esp + 8]
push 2
push ecx
mov edx, dword [eax]
push eax
call dword [edx + 0x18]
mov eax, dword [esp + 4]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, 1
add esp, 0x210
ret 8
Function at 0x4ba110
Capabilities:
Capture screenshot
Open clipboard
Write clipboard data

Disassembly:
sub esp, 0x10
push edi
mov edi, dword [esp + 0x18]
mov dword [esp + 0x10], ecx
push edi
mov dword [esp + 0xc], 0
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x4ba138
xor eax, eax
pop edi
add esp, 0x10
ret 0xc
push ebx
push ebp
push esi
push 0
push 0
push 0
push str.DISPLAY
call dword [sym.imp.GDI32.dll_CreateDCA]
mov esi, eax
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ebp, dword [edi]
mov ebx, dword [edi + 8]
mov dword [esp + 0x18], eax
mov eax, dword [edi + 4]
mov edi, dword [edi + 0xc]
push 8
push esi
mov dword [esp + 0x2c], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0xa
push esi
mov dword [esp + 0x18], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
test ebp, ebp
jge 0x4ba184
xor ebp, ebp
mov ecx, dword [esp + 0x24]
test ecx, ecx
jge 0x4ba194
mov dword [esp + 0x24], 0
mov ecx, dword [esp + 0x10]
cmp ebx, ecx
jle 0x4ba19e
mov ebx, ecx
cmp edi, eax
jle 0x4ba1a4
mov edi, eax
mov edx, dword [esp + 0x24]
sub ebx, ebp
sub edi, edx
push edi
push ebx
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ecx, dword [esp + 0x18]
push eax
push ecx
mov dword [esp + 0x18], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [esp + 0x24]
push 0xcc0020
push edx
push ebp
push esi
push edi
mov edi, dword [esp + 0x2c]
push ebx
push 0
push 0
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
push esi
mov esi, dword [sym.imp.GDI32.dll_DeleteDC]
call esi
push edi
call esi
mov eax, dword [esp + 0x28]
pop esi
sub eax, 0
pop ebp
pop ebx
je 0x4ba22c
dec eax
jne 0x4ba243
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4ba243
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, dword [esp + 4]
push eax
push 2
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esp + 8], 1
jmp 0x4ba243
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 4]
push ecx
mov ecx, dword [esp + 0x14]
push edx
call fcn.004ba340
mov dword [esp + 8], eax
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [esp + 8]
pop edi
add esp, 0x10
ret 0xc
Function at 0x4ba260
Capabilities:
Capture screenshot

Disassembly:
sub esp, 8
push edi
mov edi, dword [esp + 0x10]
push edi
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x4ba27c
xor eax, eax
pop edi
add esp, 8
ret 4
push ebx
push ebp
push esi
push 0
push 0
push 0
push str.DISPLAY
call dword [sym.imp.GDI32.dll_CreateDCA]
mov esi, eax
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ebp, dword [edi]
mov ebx, dword [edi + 8]
mov dword [esp + 0x10], eax
mov eax, dword [edi + 4]
mov edi, dword [edi + 0xc]
push 8
push esi
mov dword [esp + 0x24], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0xa
push esi
mov dword [esp + 0x1c], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
test ebp, ebp
jge 0x4ba2c8
xor ebp, ebp
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jge 0x4ba2d8
mov dword [esp + 0x1c], 0
mov ecx, dword [esp + 0x14]
cmp ebx, ecx
jle 0x4ba2e2
mov ebx, ecx
cmp edi, eax
jle 0x4ba2e8
mov edi, eax
mov edx, dword [esp + 0x1c]
sub ebx, ebp
sub edi, edx
push edi
push ebx
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ecx, dword [esp + 0x10]
push eax
push ecx
mov dword [esp + 0x1c], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [esp + 0x1c]
push 0xcc0020
push edx
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
push ebx
push 0
push 0
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
push esi
mov esi, dword [sym.imp.GDI32.dll_DeleteDC]
call esi
push edi
call esi
mov eax, dword [esp + 0x14]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret 4
Function at 0x4cbfb5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x4d3234
call fcn.004be1b4
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
mov eax, dword [esi + 0x48]
mov edi, dword [esi + 0x44]
mov dword [ebp - 0x18], eax
call fcn.004d1437
cmp dword [esi + 0x40], 0
mov ebx, dword [eax + 0xc]
je 0x4cbff4
call fcn.004d1437
mov ebx, dword [eax + 0xc]
push 5
push dword [esi + 0x40]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4cc002
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4cc010
or eax, 0xffffffff
jmp 0x4cc0f8
mov ecx, esi
call fcn.004cbf2b
mov dword [ebp - 0x14], eax
call fcn.004cd332
xor edi, edi
cmp dword [ebp - 0x14], edi
mov dword [ebp - 0x20], edi
je 0x4cc047
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x4cc047
push edi
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x20], 1
push esi
mov dword [ebp - 4], edi
call fcn.004cd2e6
push dword [ebp - 0x14]
call fcn.004cce18
push ebx
push eax
push dword [ebp - 0x18]
mov ecx, esi
call fcn.004cbcc3
cmp eax, edi
je 0x4cc0ba
test byte [esi + 0x24], 0x10
je 0x4cc088
push 4
mov ecx, esi
pop ebx
call fcn.004cc818
test ah, 1
je 0x4cc080
push 5
pop ebx
push ebx
mov ecx, esi
call fcn.004cedfa
cmp dword [esi + 0x1c], edi
je 0x4cc0ba
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.004cc84c
jmp 0x4cc0ba
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x20], edi
je 0x4cc0ce
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x4cc0e7
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x1c]
jne 0x4cc0e7
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x58]
mov ecx, esi
call fcn.004cbf65
mov eax, dword [esi + 0x2c]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x4ceca8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4cecea
call fcn.004d1437
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4cecea
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4cece1
xor eax, eax
jmp 0x4cecf2
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004cecf8
pop edi
pop esi
pop ebx
ret 4
Function at 0x587000
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push 0x587db7
call fcn.0058700f
jmp fcn.004e7371
Function at 0x587693
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x5876c1
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x5876b8
cmp edi, 0x6a4abc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x5876b0
mov eax, ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x5876e2
mov esp, ebp
pop ebp
ret

Function at 0x5876e6
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
add esp, 0xffffffec
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 0x10]
xor edx, edx
xchg edx, eax
mov esi, 0x3c
add esi, dword [ebp + 0xc]
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
mov esi, dword [eax + 0x78]
add esi, 0x18
add esi, dword [ebp + 0xc]
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
add esi, 4
lea edi, [ebp - 8]
lodsd eax, dword [esi]
add eax, dword [ebp + 0xc]
stosd dword es:[edi], eax
mov dword [ebp - 8], eax
lodsd eax, dword [esi]
add eax, dword [ebp + 0xc]
push eax
stosd dword es:[edi], eax
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
pop esi
mov dword [ebp - 4], 0
push esi
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
xchg edi, eax
mov ebx, edi
push edi
xor al, al
scasb al, byte es:[edi]
jne 0x587752
pop esi
sub edi, ebx
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x58777f
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x58776e
xor ecx, eax
xor edx, ebx
dec edi
jne 0x58775f
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop edx
cmp edx, eax
je 0x5877a5
pop esi
add esi, 4
add dword [ebp - 4], 1
jmp 0x587746
pop esi
mov eax, dword [ebp - 4]
shl eax, 1
add eax, dword [ebp - 0x10]
xor esi, esi
xchg esi, eax
mov ax, word [esi]
shl ax, 2
add eax, dword [ebp - 8]
xchg esi, eax
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
pop ecx
pop edx
pop edi
pop ebx
pop esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x5877d1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x588f59
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x628837
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x40
cmp dword [0x1011c6ac], 1
jge 0x6288a6
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
je 0x62887c
mov edx, dword [ebx + 8]
movzx eax, word [edx]
movzx ecx, word [ebx + 0xc]
cmp eax, ecx
je 0x62887c
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x628859
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x628892
mov eax, dword [ebx + 8]
mov dword [ebp - 4], eax
jmp 0x628899
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
jmp 0x628996
movzx ecx, word [ebx + 0xc]
movd xmm0, ecx
movaps xmmword [ebp - 0x30], xmm0
pshuflw xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
pshufd xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
mov edx, dword [ebx + 8]
and edx, 0xfff
cmp edx, 0xff0
ja 0x628967
mov eax, dword [ebx + 8]
movups xmm0, xmmword [eax]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pxor xmm0, xmmword [ebp - 0x20]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pcmpeqw xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x40]
pcmpeqw xmm0, xmmword [ebp - 0x30]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
por xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pmovmskb ecx, xmm0
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x62895c
bsf edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebx + 8]
mov dword [ebx + 8], eax
mov ecx, dword [ebx + 8]
movzx edx, word [ecx]
movzx eax, word [ebx + 0xc]
cmp edx, eax
jne 0x628950
mov ecx, dword [ebx + 8]
mov dword [ebp - 0xc], ecx
jmp 0x628957
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
jmp 0x628996
mov edx, dword [ebx + 8]
add edx, 0x10
mov dword [ebx + 8], edx
jmp 0x628991
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x62897a
mov eax, dword [ebx + 8]
jmp 0x628996
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x628988
xor eax, eax
jmp 0x628996
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x6288c6
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x5925b7
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + 0x14]
mov eax, dword [ebp - 8]
lea ecx, [eax + edx + 0x18]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 8]
movzx eax, word [edx + 6]
imul ecx, eax, 0x28
add ecx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x10]
mov dword [ebp - 4], edx
jmp 0x592607
mov eax, dword [ebp - 4]
add eax, 0x28
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x18]
je 0x592632
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
cmp eax, dword [edx + 0xc]
jb 0x592630
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
mov eax, dword [ebp - 4]
add edx, dword [eax + 8]
cmp dword [ebp + 0xc], edx
jae 0x592630
mov eax, dword [ebp - 4]
jmp 0x592634
jmp 0x5925fe
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x592677
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 8], 0
jne 0x592687
xor al, al
jmp 0x5926dc
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x59269f
xor al, al
jmp 0x5926dc
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x5926c0
xor al, al
jmp 0x5926dc
mov ecx, dword [ebp - 8]
add ecx, 0x18
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
movzx eax, word [edx]
cmp eax, 0x10b
je 0x5926da
xor al, al
jmp 0x5926dc
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x596577
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0xcccccccc
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
test eax, eax
je 0x5965c7
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x90
je 0x5965c7
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + eax]
cmp edx, 0xcc
je 0x5965c7
xor eax, eax
jmp 0x596608
mov dword [ebp - 4], 1
jmp 0x5965d9
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x596603
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
mov ecx, 1
imul edx, ecx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
cmp eax, edx
je 0x596601
xor eax, eax
jmp 0x596608
jmp 0x5965d0
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x5dde27
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push 0
call dword [0x1011e07c]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x5dde44
xor al, al
jmp 0x5ddea8
mov eax, dword [ebp - 4]
movzx ecx, word [eax]
cmp ecx, 0x5a4d
je 0x5dde56
xor al, al
jmp 0x5ddea8
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
add eax, dword [edx + 0x3c]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp dword [ecx], 0x4550
je 0x5dde71
xor al, al
jmp 0x5ddea8
mov edx, dword [ebp - 8]
movzx eax, word [edx + 0x18]
cmp eax, 0x10b
je 0x5dde83
xor al, al
jmp 0x5ddea8
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x74], 0xe
ja 0x5dde90
xor al, al
jmp 0x5ddea8
mov edx, 8
imul eax, edx, 0xe
mov ecx, dword [ebp - 8]
cmp dword [ecx + eax + 0x78], 0
jne 0x5ddea6
xor al, al
jmp 0x5ddea8
mov al, 1
mov esp, ebp
pop ebp
ret