joyce8/EMBER2024-capa huggingface dataset:
Function at 0x531b20
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x57a2e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 1
call sub.MFC42.DLL_CWnd::UpdateData
mov eax, dword [esi + 0xe4]
push 0
push 0
push 0x303
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [esp + 0x10]
lea edi, [esi + 0x128]
push ecx
mov ecx, edi
call fcn.0050f570
push eax
lea ecx, [esi + 0x168]
mov dword [esp + 0x4c], 0
call sub.MFC42.DLL_CString::operator_2
lea ecx, [esp + 0x10]
mov dword [esp + 0x48], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, edi
call fcn.00515480
mov ecx, eax
mov eax, 0x88888889
imul ecx
add edx, ecx
mov ecx, edi
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
mov ebp, edx
call fcn.005154a0
mov ecx, eax
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
mov ecx, edi
mov dword [esp + 0x1c], edx
call fcn.005154c0
mov ecx, eax
mov eax, 0x88888889
imul ecx
add edx, ecx
mov ecx, edi
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [esp + 0x18], edx
call fcn.005154e0
mov ecx, eax
mov eax, 0x88888889
imul ecx
add edx, ecx
push 0
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
mov ecx, esi
mov dword [esp + 0x18], edx
call sub.MFC42.DLL_CWnd::UpdateData
mov eax, dword [esi + 0x148]
lea edx, [esp + 0x30]
push edx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [esp + 0x30]
push ecx
mov ecx, esi
call sub.MFC42.DLL_CWnd::ScreenToClient
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x34]
add edx, 0xfffffffe
push 8
push edx
mov edx, dword [esp + 0x24]
add eax, 0xfffffffc
push eax
lea ebx, [esi + 0xc4]
lea eax, [ecx + edx + 1]
mov ecx, dword [esp + 0x3c]
push eax
mov eax, dword [sym.imp.MFC42.DLL_CWndconstCWnd::wndTop]
lea edx, [ecx + ebp + 2]
mov ecx, ebx
push edx
push eax
call sub.MFC42.DLL_CWnd::SetWindowPos
mov ecx, edi
call fcn.00515370
cmp eax, 4
je 0x531cc6
mov ecx, edi
call fcn.005152d0
cmp eax, 1
jle 0x531cc6
push 5
mov ecx, ebx
call sub.MFC42.DLL_CWnd::ShowWindow
mov ecx, ebx
call sub.MFC42.DLL_CWnd::SetFocus
mov ecx, dword [ebx + 0x20]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0x3e8
push 0x3e8
push 0xb1
push ecx
call edi
mov edx, dword [ebx + 0x20]
push 0
push 0
push 0xb7
push edx
call edi
jmp 0x531ccf
push 0
mov ecx, ebx
call sub.MFC42.DLL_CWnd::ShowWindow
mov eax, dword [esi + 0x17c]
mov edx, dword [esi + 0x184]
mov ecx, dword [esi + 0x180]
mov dword [esp + 0x20], eax
add edx, eax
mov eax, dword [esi + 0x188]
mov dword [esp + 0x24], ecx
add eax, ecx
mov dword [esp + 0x28], edx
mov edx, dword [esi + 0x148]
lea ecx, [esp + 0x20]
push 1
push ecx
push edx
mov dword [esp + 0x38], eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, dword [esp + 0x40]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x3c
ret
Function at 0x54a410
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x57d650
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push esi
push edi
mov esi, ecx
push eax
push 0x1b2
mov dword [esp + 0x10], esi
call sub.MFC42.DLL_CDialog::CDialog_1
lea edi, [esi + 0x88]
mov dword [esp + 0x14], 0
mov ecx, edi
call sub.MFC42.DLL_CWnd::CWnd
mov dword [edi], 0x5803ac
lea edi, [esi + 0xc8]
mov byte [esp + 0x14], 1
mov ecx, edi
call sub.MFC42.DLL_CWnd::CWnd
mov dword [edi], 0x5803ac
lea edi, [esi + 0x108]
mov byte [esp + 0x14], 2
mov ecx, edi
call sub.MFC42.DLL_CWnd::CWnd
mov dword [edi], 0x5803ac
lea edi, [esi + 0x148]
mov byte [esp + 0x14], 3
mov ecx, edi
call sub.MFC42.DLL_CWnd::CWnd
mov dword [edi], 0x5803ac
lea edi, [esi + 0x188]
mov byte [esp + 0x14], 4
mov ecx, edi
call sub.MFC42.DLL_CWnd::CWnd
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
mov dword [edi], 0x5810d8
mov dword [esi + 0x70], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esi + 0x74], edx
mov edx, dword [esp + 0x3c]
mov dword [esi + 0x78], eax
mov eax, dword [esp + 0x30]
mov dword [esi + 0x7c], ecx
mov ecx, dword [esp + 0x34]
mov dword [esi + 0x80], edx
mov edx, dword [esp + 0x38]
mov dword [esi + 0x68], eax
mov dword [esi + 0x6c], ecx
mov ecx, dword [esp + 0xc]
mov dword [esi], 0x58d7b0
mov dword [esi + 0x84], 1
mov dword [esi + 0x64], edx
mov dword [esi + 0x60], 0
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x24
Function at 0x54bc90
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
or eax, 0xffffffff
cmp cx, 5
jge 0x54bca1
or eax, 0xffffffff
ret
push esi
sub ecx, 4
push edi
xor esi, esi
movsx edi, cx
test edi, edi
jle 0x54bce8
mov ecx, dword [esp + 0x14]
push ebx
push ebp
mov ebp, dword [0x5c050c]
mov dl, byte [ecx]
mov ebx, eax
and edx, 0xff
and ebx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [ebp + edx*4]
xor eax, edx
inc esi
mov edx, esi
inc ecx
and edx, 0xffff
cmp edx, edi
jl 0x54bcbb
pop ebp
pop ebx
jmp 0x54bcec
mov ecx, dword [esp + 0x14]
cmp word [esp + 0xc], 1
pop edi
not eax
pop esi
jne 0x54bcfb
sub eax, dword [ecx]
ret
mov dword [ecx], eax
ret
Function at 0x54c200
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
mov edi, eax
call esi
mov ebx, dword [esp + 0x10]
sub eax, edi
cmp eax, ebx
jae 0x54c221
call esi
sub eax, edi
cmp eax, ebx
jb 0x54c219
pop edi
pop esi
pop ebx
ret

Function at 0x54c4a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x57d780
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
mov eax, dword [0x5c05bc]
push esi
push 0x3002
push eax
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CFile::CFile_1
lea ecx, [esp + 4]
mov dword [esp + 0x60], 0
call sub.MFC42.DLL_CFile::GetLength
mov edx, dword [esp + 4]
push 0
push 0
lea ecx, [esp + 0xc]
mov esi, eax
call dword [edx + 0x30]
test esi, esi
pop esi
jne 0x54c4ff
lea ecx, [esp]
call sub.MFC42.DLL_CFile::Close
jmp 0x54c54a
push 0
push 0x1000
lea eax, [esp + 8]
push 1
push eax
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CArchive::CArchive
lea ecx, [esp + 0x10]
mov byte [esp + 0x5c], 1
push ecx
mov ecx, 0x5c05d0
call sub.MFC42.DLL_CObList::Serialize
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CArchive::Close
lea ecx, [esp]
call sub.MFC42.DLL_CFile::Close
lea ecx, [esp + 0x10]
mov byte [esp + 0x5c], 0
call fcn.00557b5e
lea ecx, [esp]
mov dword [esp + 0x5c], 0xffffffff
call fcn.005573a2
mov ecx, dword [esp + 0x54]
mov eax, 1
mov dword fs:[0], ecx
add esp, 0x60
ret
Function at 0x54d950
Capabilities:
Set current directory
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x57daa8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
lea eax, [esp + 8]
push 1
push eax
lea ecx, [esp + 0x4c]
mov dword [esp + 0x44], 0
call sub.MFC42.DLL_CString::Right
mov eax, dword [eax]
mov esi, 0x5b739c
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x54d9b1
test cl, cl
je 0x54d9ad
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x54d9b1
add eax, 2
add esi, 2
test cl, cl
jne 0x54d989
xor eax, eax
jmp 0x54d9b6
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 8]
setne bl
call sub.MFC42.DLL_CString::CString
test bl, bl
je 0x54d9d6
push 0x5b739c
lea ecx, [esp + 0x48]
call fcn.00557276
mov eax, dword [esp + 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x54db0b
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CFileFind::CFileFind
push 0
push 0x5bcca0
lea ecx, [esp + 0x20]
mov byte [esp + 0x44], 1
call sub.MFC42.DLL_CFileFind::FindFile
test eax, eax
je 0x54daf4
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CFileFind::FindNextFileA
lea ecx, [esp + 0x1c]
mov edi, eax
call sub.MFC42.DLL_CFileFind::IsDots
test eax, eax
jne 0x54daeb
mov edx, dword [esp + 0x1c]
push 0x10
lea ecx, [esp + 0x20]
call dword [edx + 0x40]
test eax, eax
jne 0x54daeb
lea eax, [esp + 0xc]
lea ecx, [esp + 0x1c]
push eax
call sub.MFC42.DLL_CFileFind::GetFileName
lea ecx, [esp + 0xc]
lea edx, [esp + 0x48]
push ecx
lea eax, [esp + 0x14]
push edx
push eax
mov byte [esp + 0x4c], 2
call sub.MFC42.DLL_operator_3
mov eax, dword [eax]
push 0x20
push eax
call esi
test eax, eax
lea ecx, [esp + 0x10]
sete bl
call sub.MFC42.DLL_CString::CString
test bl, bl
je 0x54dadd
lea ecx, [esp + 0xc]
lea edx, [esp + 0x18]
push ecx
push 0x5bf318
push edx
call sub.MFC42.DLL_operator_2
push 0x5bf30c
push eax
lea eax, [esp + 0x1c]
mov byte [esp + 0x48], 3
push eax
call sub.MFC42.DLL_operator_4
mov eax, dword [eax]
push 0
push 0
push eax
mov byte [esp + 0x4c], 4
call sub.MFC42.DLL_AfxMessageBox_1
lea ecx, [esp + 0x14]
mov byte [esp + 0x40], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov byte [esp + 0x40], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x40], 1
call sub.MFC42.DLL_CString::CString
test edi, edi
jne 0x54da16
pop edi
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CFileFind::Close
lea ecx, [esp + 0x18]
mov byte [esp + 0x3c], 0
call fcn.00557ea0
lea ecx, [esp + 0x44]
mov dword [esp + 0x3c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x34]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret 4
Function at 0x54fcf0
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [0x5c0628]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, ecx
push eax
call edi
mov ecx, dword [0x5c0650]
push ecx
call edi
mov edx, dword [0x5c0640]
push edx
call edi
mov eax, dword [esi + 0xd8]
test eax, eax
je 0x54fd27
push 1
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi + 0x120]
mov dword [esi + 0xd8], 0
cmp eax, 0xffffffff
je 0x54fd4b
mov eax, dword [esi + 0x11c]
lea ecx, [esi + 0x11c]
call dword [eax + 0x54]
mov eax, dword [esi + 0xac]
test eax, eax
je 0x54fd69
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov dword [esi + 0xac], 0
mov eax, dword [0x5c060c]
mov edi, dword [sym.imp.USER32.dll_KillTimer]
test eax, eax
je 0x54fd80
mov ecx, dword [esi + 0x20]
push 0x14
push ecx
call edi
mov eax, dword [0x5c0618]
test eax, eax
je 0x54fd91
mov edx, dword [esi + 0x20]
push 0x28
push edx
call edi
mov eax, dword [0x5c061c]
test eax, eax
je 0x54fdac
mov eax, dword [esi + 0x20]
push 0x32
push eax
call edi
mov dword [0x5c061c], 0
mov eax, dword [0x5c0610]
test eax, eax
je 0x54fdbd
mov ecx, dword [esi + 0x20]
push 0x3c
push ecx
call edi
mov eax, dword [0x5c0614]
test eax, eax
je 0x54fdce
mov edx, dword [esi + 0x20]
push 0x46
push edx
call edi
pop edi
pop esi
ret

Function at 0x54fde0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
mov ebx, ecx
push edi
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 0x5bf5a8
call fcn.0055734e
mov ecx, ebx
call fcn.0054c620
push 0x3e8
mov dword [ebx + 0x98], 1
call fcn.0054c200
mov edi, 0x5bf5a4
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x18]
mov eax, ecx
mov esi, edi
mov edi, edx
push 0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
lea edi, [esp + 0x1c]
push ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov eax, dword [0x5c0628]
lea edx, [esp + 0x20]
not ecx
dec ecx
push ecx
push edx
push eax
call ebp
push 0x3e8
call fcn.0054c200
mov edi, str.ATH_r
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x18]
mov eax, ecx
mov esi, edi
mov edi, edx
push 0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
lea edx, [esp + 0x1c]
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
lea edi, [esp + 0x1c]
push ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov eax, dword [0x5c0628]
not ecx
dec ecx
push ecx
push edx
push eax
call ebp
mov ecx, ebx
call fcn.0054fcf0
mov ecx, ebx
call fcn.0054e120
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push 0x5bf58c
call fcn.0055734e
mov ecx, ebx
call fcn.0054c620
push 0x3e8
mov ecx, ebx
call fcn.0054c3a0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x54ff00
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x34
push ebx
mov ebx, ecx
push esi
push edi
mov eax, dword [ebx + 0x84]
mov edx, dword [ebx + 0x11c]
lea esi, [ebx + 0x11c]
push 0
push 0x8010
push eax
mov ecx, esi
call dword [edx + 0x28]
test eax, eax
jne 0x54ff5d
push ecx
mov ecx, esp
mov dword [esp + 0x10], esp
push 0x5bf5c0
call fcn.0055734e
mov ecx, ebx
call fcn.0054c620
mov eax, dword [ebx + 0x20]
push 0
push 0
push 0x4cd
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
pop esi
pop ebx
add esp, 0x34
ret
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x38]
lea ecx, [esp + 0x28]
push 0xa
push ecx
push eax
mov dword [ebx + 0xc0], eax
call dword [sym.imp.MSVCRT.dll__itoa]
lea edi, [esp + 0x34]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov eax, ecx
cmp ax, 1
mov byte [esp + 0x14], al
jb 0x54ffb1
and ecx, 0xffff
lea esi, [esp + 0x28]
mov edx, ecx
lea edi, [esp + 0x15]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
inc eax
cmp ax, 0x10
jae 0x54ffdb
and eax, 0xffff
mov ecx, 0x10
sub ecx, eax
mov edx, ecx
lea edi, [esp + eax + 0x14]
mov eax, 0x20202020
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 0x14]
push eax
push 0x14
push 0
call fcn.0054bc90
lea edi, [esp + 0x20]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebx + 0x134]
mov eax, ecx
mov esi, edi
mov edi, edx
push 0x5c05f8
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea edx, [esp + 0x18]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0x5c0628]
lea ecx, [esp + 0x14]
push ecx
push 0x14
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebx + 0x20]
push 0
push 0x1388
push 0x3c
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
test eax, eax
mov dword [0x5c0610], eax
jne 0x550064
mov edx, dword [ebx + 0x20]
push eax
push eax
push 0x4cd
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
pop esi
pop ebx
add esp, 0x34
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
pop edi
mov dword [ebx + 0xc8], eax
pop esi
pop ebx
add esp, 0x34
ret
Function at 0x550080
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x57db40
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
mov ebp, ecx
push esi
push edi
lea ecx, [esp + 0x10]
lea edi, [ebp + 0x110]
push edi
call sub.MFC42.DLL_CString::CString_2
push 0x5c02fc
lea eax, [esp + 0x1c]
push 0x5b6368
push eax
mov dword [esp + 0x30], 0
call sub.MFC42.DLL_operator_2
mov esi, eax
lea ecx, [esp + 0x14]
push 4
push ecx
mov ecx, edi
mov byte [esp + 0x2c], 1
call sub.MFC42.DLL_CString::Right
mov esi, dword [esi]
mov eax, dword [eax]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x55010b
test cl, cl
je 0x550107
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x55010b
add eax, 2
add esi, 2
test cl, cl
jne 0x5500e3
xor eax, eax
jmp 0x550110
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 0x14]
setne bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov byte [esp + 0x24], 0
call sub.MFC42.DLL_CString::CString
test bl, bl
je 0x550161
push 0x5c02fc
lea eax, [esp + 0x1c]
push 0x5b6368
push eax
call sub.MFC42.DLL_operator_2
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 2
call fcn.0055727c
lea ecx, [esp + 0x18]
mov byte [esp + 0x24], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x10]
push 0x5b8e14
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
jne 0x5501a0
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
push esi
call dword [sym.imp.MSVCRT.dll__fileno]
push eax
call dword [sym.imp.MSVCRT.dll__filelength]
push esi
mov ebx, eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0xc
test ebx, ebx
jne 0x5501c8
mov dword [esp + 0x24], 0xffffffff
jmp 0x550247
push 1
push 0x5bf5ec
push ecx
lea edx, [ebp + 0x88]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call sub.MFC42.DLL_CString::CString_2
push 0x64
mov ecx, edi
mov byte [esp + 0x34], 0
call sub.MFC42.DLL_CString::GetBuffer
push eax
mov ecx, ebp
call fcn.00550cd0
or ebx, 0xffffffff
mov ecx, edi
push ebx
mov esi, eax
call sub.MFC42.DLL_CString::ReleaseBuffer
test esi, esi
je 0x550243
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push 0x5bf5d8
call fcn.0055734e
mov ecx, ebp
call fcn.0054c620
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], ebx
call sub.MFC42.DLL_CString::CString
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
mov dword [esp + 0x24], ebx
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
mov eax, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0x18
ret
Function at 0x556370
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ecx
mov eax, dword [0x5c10f4]
push ebx
push esi
push edi
test eax, eax
jne 0x55639d
push str.ADVAPI32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.SystemFunction036
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x5c10f4], eax
je 0x5563b0
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push ecx
push edx
call eax
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov edi, eax
call esi
sub eax, edi
je 0x5563d0
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 1
call ebx
call esi
sub eax, edi
jne 0x5563c6
mov eax, dword [esp + 0x18]
xor ecx, ecx
test eax, eax
jle 0x5563a9
mov eax, dword [esp + 0x14]
mov ebx, 1
push ebp
sub ebx, eax
mov eax, dword [esp + 0x18]
xor edx, edx
lea esi, [ecx + eax]
mov eax, edi
lea ebp, [ebx + esi]
div ebp
mov edx, ecx
and edx, reloc.LXJob.dll_Ordinal_3
mov dword [esp + 0x10], eax
jns 0x556409
dec edx
or edx, 0xfffffffc
inc edx
mov al, byte [esp + edx + 0x10]
inc ecx
mov byte [esi], al
mov eax, dword [esp + 0x1c]
cmp ecx, eax
jl 0x5563e6
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x5c4788
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi]
mov ecx, dword [esi + 4]
test eax, eax
jle 0x5c47e2
push edi
mov edi, dword [ebp + 0x10]
sub dword [ebp + 0xc], edi
mov dword [ebp + 8], eax
mov edi, edi
inc bl
lea edi, [edi + 1]
movzx ebx, bl
mov dl, byte [esi + ebx + 8]
add cl, dl
movzx ecx, cl
mov al, byte [esi + ecx + 8]
mov byte [esi + ebx + 8], al
add al, dl
movzx eax, al
mov byte [esi + ecx + 8], dl
movzx edx, byte [eax + esi + 8]
mov eax, dword [ebp + 0xc]
xor dl, byte [eax + edi - 1]
dec dword [ebp + 8]
mov byte [edi - 1], dl
jne 0x5c47a8
mov eax, dword [ebp + 0x14]
pop edi
mov dword [esi], ebx
mov dword [esi + 4], ecx
pop esi
pop ebx
pop ebp
ret
Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
je 0x432072
nop
nop
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x52cb52de
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x432060
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
je 0x4320d2
nop
nop
nop
nop
mov ebx, 0x42f314
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x477c27c7
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rdata
nop
mov ebx, 0x407ef8
mov ecx, 0x53764133
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
mov eax, section..data
nop
nop
mov ebx, 0x42cd70
mov ecx, 0x709a72a7
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x49f24b3a
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0x1b1d3382
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x2b0202d8
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0xff00e43
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219