joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d1828
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
mov byte [ebp - 1], 0
mov ebx, 0x14
mov dword [ebp - 0x1c], 0x14
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 3
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x3c], 3
mov dword [ebp - 0x34], 2
mov eax, 0x5d18f0
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 3
mov eax, 0x5d18f4
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 1
push 0x5d18f0
call sub.wininet.dll_InternetOpenW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x5d18e7
xor eax, eax
push ebp
push 0x5d18e0
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
lea eax, [ebp - 0x1c]
push eax
push 0x4b
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetSetOptionW
push 0
push 0
push 0x25
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetSetOptionW
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d18e7
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
movzx eax, byte [ebp - 1]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5d24a4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
xor edx, edx
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x5d26ce
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x20], 0x105
mov eax, dword [ebp - 0x20]
call fcn.004044c0
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x5d2525
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
test eax, eax
je 0x5d250f
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x10]
call fcn.00407d94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d252c
mov eax, dword [ebp - 0x10]
call fcn.004044dc
ret

Function at 0x5d3d0c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
mov bl, 2
lea eax, [ebp - 0x14]
xor ecx, ecx
mov edx, 0x14
call fcn.00404b9c
push 0x14
lea eax, [ebp - 0x14]
push eax
push 0xd
push 0x400
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
je 0x5d3d47
cmp word [ebp - 0x14], 0x31
jne 0x5d3d45
mov bl, 1
jmp 0x5d3d47
xor ebx, ebx
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5d5798
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
xor ebx, ebx
mov eax, esi
call fcn.00487dac
test al, al
je 0x5d5857
mov byte [ebp - 9], 0
xor ebx, ebx
call sub.kernel32.dll_GetTickCount_1
mov dword [ebp - 8], eax
jmp 0x5d5835
cmp word [esi + 0x67a], 0
je 0x5d57e9
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 9]
push eax
mov ecx, dword [ebp - 8]
mov edx, esi
mov eax, dword [esi + 0x67c]
call dword [esi + 0x678]
movzx eax, byte [esi + 0x670]
or al, byte [ebp - 9]
jne 0x5d580c
cmp dword [ebp - 4], 0
jbe 0x5d5808
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
ja 0x5d580c
xor ebx, ebx
jmp 0x5d580e
mov bl, 1
test bl, bl
jne 0x5d5857
mov eax, dword [0x65f994]
mov eax, dword [eax]
cmp byte [eax + 0xa4], 0
jne 0x5d5857
mov eax, dword [0x65f994]
mov eax, dword [eax]
call fcn.004d1a28
push 1
call sub.kernel32.dll_Sleep_2
test esi, esi
je 0x5d5857
cmp byte [esi + 0x610], 0
jne 0x5d5857
mov edx, 0xfffffdf3
mov eax, esi
call fcn.00570f1c
cmp eax, 4
jne 0x5d57c6
mov byte [esi + 0x670], 0
test bl, bl
sete al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5d6e7c
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa4
mov dword [esp + 4], ecx
mov dword [esp], edx
mov esi, 0x30
mov edi, 0x65e3c0
mov ecx, dword [esp]
lea edx, [esp + 0xc]
movzx ebx, byte [edi]
movzx ebx, byte [eax + ebx - 1]
xor bl, byte [ecx]
mov byte [edx], bl
inc edx
inc ecx
inc edi
dec esi
jne 0x5d6e9b
mov esi, 1
mov edx, 0x65e4c8
mov ecx, esi
dec ecx
mov eax, ecx
add eax, eax
lea eax, [eax + eax*2]
add ecx, ecx
add ecx, ecx
movzx ebx, byte [esp + eax + 0xc]
mov edi, ebx
add edi, edi
movzx ebx, byte [esp + eax + 0x11]
add edi, ebx
movzx ebx, byte [esp + eax + 0xd]
add ebx, ebx
add ebx, ebx
add ebx, ebx
movzx ebp, byte [esp + eax + 0xe]
add ebp, ebp
add ebp, ebp
add ebx, ebp
movzx ebp, byte [esp + eax + 0xf]
add ebp, ebp
add ebx, ebp
movzx eax, byte [esp + eax + 0x10]
add ebx, eax
mov dword [esp + 8], ebx
mov eax, 1
mov ebx, eax
dec ebx
je 0x5d6f14
dec ebx
je 0x5d6f36
dec ebx
je 0x5d6f58
dec ebx
je 0x5d6f79
jmp 0x5d6f93
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 8
movzx ebx, bl
shr ebx, 3
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x5d6f93
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 4
movzx ebx, bl
shr ebx, 2
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x5d6f93
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 2
movzx ebx, bl
shr ebx, 1
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x5d6f93
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 1
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
inc eax
cmp eax, 5
jne 0x5d6f04
inc esi
add edx, 0x40
cmp esi, 9
jne 0x5d6eb7
mov esi, 0x20
mov eax, 0x65e3f0
mov edx, dword [esp + 4]
movzx ecx, byte [eax]
movzx ecx, byte [esp + ecx + 0x3b]
mov byte [edx], cl
inc edx
inc eax
dec esi
jne 0x5d6fb8
add esp, 0x5c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x5d6ff4
Capabilities:
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], ecx
mov esi, eax
movzx eax, dl
movzx ebx, byte [eax + 0x65e477]
test bl, bl
jbe 0x5d7025
lea eax, [esi + 0x3e0]
call fcn.005d6fd0
lea eax, [esi + 0x3fc]
call fcn.005d6fd0
dec bl
jne 0x5d700b
mov cl, 0x30
mov edi, 0x65e448
mov eax, dword [esp]
movzx edx, byte [edi]
cmp dl, 0x1c
ja 0x5d7046
movzx edx, dl
movzx edx, byte [esi + edx + 0x3df]
mov byte [eax], dl
jmp 0x5d7053
movzx edx, dl
movzx edx, byte [esi + edx + 0x3df]
mov byte [eax], dl
inc eax
inc edi
dec cl
jne 0x5d702f
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x5d7060
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbdc
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov bl, 1
lea esi, [ebp - 0x421]
mov eax, edi
mov edx, ebx
call fcn.005d6e14
mov byte [esi], al
inc ebx
inc esi
cmp bl, 0x41
jne 0x5d707c
mov bl, 0x1c
mov esi, str.91__
lea edi, [ebp - 0x41]
movzx edx, byte [esi]
mov eax, dword [ebp - 8]
call fcn.005d6e14
mov byte [edi], al
movzx edx, byte [esi + 0x1c]
mov eax, dword [ebp - 8]
call fcn.005d6e14
mov byte [edi + 0x1c], al
inc edi
inc esi
dec bl
jne 0x5d7098
mov bl, 1
lea esi, [ebp - 0x3a1]
mov ecx, esi
lea eax, [ebp - 0x421]
mov edx, ebx
call fcn.005d6ff4
inc ebx
add esi, 0x30
cmp bl, 0x11
jne 0x5d70c2
mov bl, 1
mov eax, 0x65e340
lea edx, [ebp - 0xa1]
cmp bl, 0x20
ja 0x5d70fb
movzx ecx, byte [eax]
movzx ecx, byte [ebp + ecx - 0x422]
mov byte [edx], cl
jmp 0x5d7108
movzx ecx, byte [eax]
movzx ecx, byte [ebp + ecx - 0x422]
mov byte [edx], cl
inc ebx
inc edx
inc eax
cmp bl, 0x41
jne 0x5d70e7
mov byte [ebp - 9], 1
lea esi, [ebp - 0x3a1]
cmp byte [ebp + 8], 0
je 0x5d7132
lea ecx, [ebp - 0x61]
mov edx, esi
lea eax, [ebp - 0x81]
call fcn.005d6e7c
jmp 0x5d7159
movzx eax, byte [ebp - 9]
mov edx, 0x11
sub edx, eax
mov eax, edx
add eax, eax
lea eax, [eax + eax*2]
lea edx, [ebp + eax*8 - 0x3d1]
lea ecx, [ebp - 0x61]
lea eax, [ebp - 0x81]
call fcn.005d6e7c
mov bl, 0x20
lea eax, [ebp - 0xa1]
movzx edx, byte [eax]
xor byte [eax + 0x40], dl
inc eax
dec bl
jne 0x5d7161
push esi
lea esi, [ebp - 0x81]
lea edi, [ebp - 0xa1]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
push esi
lea esi, [ebp - 0x61]
lea edi, [ebp - 0x81]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
inc byte [ebp - 9]
add esi, 0x30
cmp byte [ebp - 9], 0x11
jne 0x5d711a
mov bl, 0x40
mov esi, 0x65e380
lea eax, [ebp - 0x3e1]
movzx edx, byte [esi]
cmp dl, 0x20
ja 0x5d71c7
movzx edx, dl
movzx edx, byte [ebp + edx - 0x82]
mov byte [eax], dl
jmp 0x5d71d4
movzx edx, dl
movzx edx, byte [ebp + edx - 0xc2]
mov byte [eax], dl
inc eax
inc esi
dec bl
jne 0x5d71b0
mov bl, 1
lea esi, [ebp - 0x3e1]
movzx ecx, byte [esi]
mov eax, dword [ebp - 4]
mov edx, ebx
call fcn.005d6e3c
inc ebx
inc esi
cmp bl, 0x41
jne 0x5d71e2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x5d7d50
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.005d8908
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret
Function at 0x5d8804
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff20
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x40
jle 0x5d8849
lea eax, [ebp - 0x60]
call fcn.005d7d50
mov edx, ebx
lea eax, [ebp - 0x60]
mov ecx, dword [ebp + 0xc]
call fcn.005d7d78
lea edx, [ebp - 0x60]
mov eax, dword [ebp + 8]
call fcn.005d7e4c
mov dword [ebp + 0xc], 0x10
mov esi, dword [ebp + 8]
jmp 0x5d884b
mov esi, ebx
xor ecx, ecx
lea eax, [ebp - 0xa0]
lea edx, [ebp - 0xe0]
lea ebx, [ecx + 1]
cmp ebx, dword [ebp + 0xc]
jg 0x5d8874
movzx ebx, byte [esi]
xor bl, 0x36
mov byte [eax], bl
movzx ebx, byte [esi]
xor bl, 0x5c
mov byte [edx], bl
inc esi
jmp 0x5d887a
mov byte [eax], 0x36
mov byte [edx], 0x5c
inc ecx
inc edx
inc eax
cmp ecx, 0x40
jne 0x5d8859
lea eax, [ebp - 0x60]
call fcn.005d7d50
lea edx, [ebp - 0xa0]
lea eax, [ebp - 0x60]
mov ecx, 0x40
call fcn.005d7d78
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x60]
mov ecx, dword [ebp - 8]
call fcn.005d86ec
lea edx, [ebp - 0x60]
mov eax, dword [ebp + 8]
call fcn.005d7e4c
lea eax, [ebp - 0x60]
call fcn.005d7d50
lea edx, [ebp - 0xe0]
lea eax, [ebp - 0x60]
mov ecx, 0x40
call fcn.005d7d78
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x60]
mov ecx, 0x10
call fcn.005d7d78
lea edx, [ebp - 0x60]
mov eax, dword [ebp + 8]
call fcn.005d7e4c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5dcc3c
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, ecx
mov dword [esp], edx
mov ebp, eax
xor esi, esi
mov ebx, dword [esp]
jmp 0x5dcc50
inc ebx
mov eax, ebx
mov ecx, 3
cdq
idiv ecx
test edx, edx
jg 0x5dcc4f
mov eax, ebx
mov ecx, 3
cdq
idiv ecx
add eax, eax
add eax, eax
mov ebx, eax
mov eax, edi
xor ecx, ecx
mov edx, ebx
call fcn.004077e8
xor ebx, ebx
cmp esi, dword [esp]
jge 0x5dcdb4
inc ebx
mov eax, edi
call fcn.00407338
movzx edx, byte [ebp + esi]
and dl, 0xfc
movzx edx, dl
shr edx, 2
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + ebx - 1], dl
lea eax, [esi + 1]
cmp eax, dword [esp]
jge 0x5dcd6d
inc ebx
mov eax, edi
call fcn.00407338
movzx edx, byte [ebp + esi]
and dl, 3
movzx edx, dl
shl edx, 4
movzx ecx, byte [ebp + esi + 1]
and cl, 0xf0
movzx ecx, cl
shr ecx, 4
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + ebx - 1], dl
lea eax, [esi + 2]
cmp eax, dword [esp]
jge 0x5dcd3c
inc ebx
mov eax, edi
call fcn.00407338
movzx edx, byte [ebp + esi + 1]
and dl, 0xf
movzx edx, dl
add edx, edx
add edx, edx
movzx ecx, byte [ebp + esi + 2]
and cl, 0xc0
movzx ecx, cl
shr ecx, 6
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + ebx - 1], dl
inc ebx
mov eax, edi
call fcn.00407338
movzx edx, byte [ebp + esi + 2]
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + ebx - 1], dl
jmp 0x5dcda8
inc ebx
mov eax, edi
call fcn.00407338
movzx edx, byte [ebp + esi + 1]
and dl, 0xf
movzx edx, dl
add edx, edx
add edx, edx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + ebx - 1], dl
inc ebx
mov eax, edi
call fcn.00407338
mov byte [eax + ebx - 1], 0x3d
jmp 0x5dcda8
inc ebx
mov eax, edi
call fcn.00407338
movzx edx, byte [ebp + esi]
and dl, 3
movzx edx, dl
shl edx, 4
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + ebx - 1], dl
inc ebx
mov eax, edi
call fcn.00407338
mov byte [eax + ebx - 1], 0x3d
inc ebx
mov eax, edi
call fcn.00407338
mov byte [eax + ebx - 1], 0x3d
add esi, 3
cmp esi, dword [esp]
jl 0x5dcc84
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5dd14c
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov edi, ecx
mov dword [esp], edx
mov esi, eax
movzx edx, byte [esi]
mov byte [esp + 4], dl
shl edx, 7
and dl, 0xff
movzx eax, byte [esi + 1]
movzx ecx, al
shr ecx, 1
or dl, cl
mov byte [esp + 5], dl
shl eax, 6
and al, 0xff
movzx edx, byte [esi + 2]
movzx ecx, dl
shr ecx, 2
or al, cl
mov byte [esp + 6], al
shl edx, 5
and dl, 0xff
movzx eax, byte [esi + 3]
movzx ecx, al
shr ecx, 3
or dl, cl
mov byte [esp + 7], dl
shl eax, 4
and al, 0xff
movzx edx, byte [esi + 4]
shr edx, 4
or al, dl
mov byte [esp + 8], al
movzx eax, byte [esi + 4]
add eax, eax
add eax, eax
add eax, eax
and al, 0xff
movzx edx, byte [esi + 5]
shr edx, 5
or al, dl
mov byte [esp + 9], al
movzx eax, byte [esi + 5]
add eax, eax
add eax, eax
and al, 0xff
movzx edx, byte [esi + 6]
shr edx, 6
or al, dl
mov byte [esp + 0xa], al
movzx eax, byte [esi + 6]
add eax, eax
and al, 0xff
mov byte [esp + 0xb], al
mov ebp, 8
lea eax, [esp + 4]
mov edx, 1
xor esi, esi
mov ecx, edx
movzx ebx, byte [eax]
shl ebx, cl
mov ecx, ebx
xor ecx, esi
and ecx, 1
mov esi, ecx
inc edx
cmp edx, 8
jne 0x5dd1fd
movzx edx, byte [eax]
and dl, 0xfe
mov ecx, esi
or dl, cl
mov byte [eax], dl
inc eax
dec ebp
jne 0x5dd1f8
mov eax, edi
xor ecx, ecx
mov edx, 8
call fcn.004077e8
push 1
mov eax, edi
call fcn.00407338
mov edx, eax
lea ecx, [esp + 8]
mov eax, dword [esp + 4]
call fcn.005d7060
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5dfd3c
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x5dfd45
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov byte [ebp - 5], cl
mov esi, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x5dfef7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.005e008c
xor eax, eax
push ebp
push 0x5dfed5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
test byte [eax + 0x1c], 8
je 0x5dfd94
call fcn.0040650c
jmp 0x5dfedc
mov eax, dword [ebp - 4]
test byte [eax + 0x34], 8
je 0x5dfe63
mov eax, dword [ebp - 4]
test byte [eax + 0x34], 1
je 0x5dfde9
mov eax, dword [ebp - 4]
cmp word [eax + 0x3a], 0
je 0x5dfde9
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.005dfc80
push dword [ebp - 0x10]
mov eax, dword [ebp - 4]
push dword [eax + 0x50]
push ebx
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00408020
mov eax, dword [ebp - 0xc]
push eax
mov edi, dword [ebp - 4]
movzx ecx, byte [ebp - 5]
mov edx, esi
mov eax, dword [edi + 0x3c]
call dword [edi + 0x38]
mov eax, dword [ebp - 4]
test byte [eax + 0x34], 4
je 0x5dfe22
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.005dfc80
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
push dword [eax + 0x50]
push ebx
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00408020
mov eax, dword [ebp - 0x14]
call fcn.00407d34
push eax
call sub.kernel32.dll_OutputDebugStringW
mov eax, dword [ebp - 4]
test byte [eax + 0x34], 2
je 0x5dfebf
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.005dfc80
push dword [ebp - 0x20]
mov eax, dword [ebp - 4]
push dword [eax + 0x50]
push ebx
push 0x5dff14
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.00408020
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.005dfcb0
jmp 0x5dfebf
mov eax, dword [ebp - 4]
test byte [eax + 0x34], 1
je 0x5dfe86
mov eax, dword [ebp - 4]
cmp word [eax + 0x3a], 0
je 0x5dfe86
push ebx
mov edi, dword [ebp - 4]
movzx ecx, byte [ebp - 5]
mov edx, esi
mov eax, dword [edi + 0x3c]
call dword [edi + 0x38]
mov eax, dword [ebp - 4]
test byte [eax + 0x34], 4
je 0x5dfe9c
mov eax, ebx
call fcn.00407d34
push eax
call sub.kernel32.dll_OutputDebugStringW
mov eax, dword [ebp - 4]
test byte [eax + 0x34], 2
je 0x5dfebf
lea eax, [ebp - 0x24]
mov ecx, 0x5dff14
mov edx, ebx
call fcn.00407f98
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.005dfcb0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5dfedc
mov eax, dword [ebp - 4]
call fcn.005e0098
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5dfefe
lea eax, [ebp - 0x24]
mov edx, 7
call fcn.00406d90
ret
Function at 0x5e76ac
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov esi, eax
mov byte [esp], 0
xor eax, eax
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], eax
mov edi, 1
jmp 0x5e76cd
inc edi
mov eax, esi
call fcn.00407240
cmp edi, eax
jg 0x5e76df
cmp byte [esi + edi - 1], 0x20
je 0x5e76cc
mov eax, esi
test eax, eax
je 0x5e76ea
sub eax, 4
mov eax, dword [eax]
cmp eax, edi
jl 0x5e77ac
cmp byte [esi + edi - 1], 0x2e
je 0x5e77d0
jmp 0x5e77ac
cmp byte [esi + edi - 1], 0x2e
jne 0x5e7754
inc dword [esp + 4]
cmp dword [esp + 4], 3
jg 0x5e77d0
cmp dword [esp + 8], 0xff
jg 0x5e77d0
xor eax, eax
mov dword [esp + 8], eax
mov ebp, esi
test ebp, ebp
je 0x5e7738
sub ebp, 4
mov ebp, dword [ebp]
cmp ebp, edi
jg 0x5e7740
mov bl, 1
jmp 0x5e774e
movzx eax, byte [esi + edi]
add al, 0xd0
sub al, 0xa
setb bl
xor bl, 1
test bl, bl
jne 0x5e77d0
jmp 0x5e77ab
movzx eax, byte [esi + edi - 1]
add al, 0xd0
sub al, 0xa
jae 0x5e7779
mov eax, dword [esp + 8]
add eax, eax
lea eax, [eax + eax*4]
movzx edx, byte [esi + edi - 1]
add eax, edx
sub eax, 0x30
mov dword [esp + 8], eax
jmp 0x5e77ab
inc edi
mov eax, esi
call fcn.00407240
cmp edi, eax
jg 0x5e778b
cmp byte [esi + edi - 1], 0x20
je 0x5e7778
mov dword [esp + 0xc], esi
cmp dword [esp + 0xc], 0
je 0x5e77a3
mov eax, dword [esp + 0xc]
sub eax, 4
mov eax, dword [eax]
mov dword [esp + 0xc], eax
cmp edi, dword [esp + 0xc]
jle 0x5e77d0
jmp 0x5e77bb
inc edi
mov eax, esi
call fcn.00407240
cmp edi, eax
jle 0x5e7702
cmp dword [esp + 4], 3
jne 0x5e77d0
cmp dword [esp + 8], 0xff
jg 0x5e77d0
mov byte [esp], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5ffcb0
Capabilities:
Encode data using base64
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
add eax, eax
add eax, eax
mov ecx, 3
cdq
idiv ecx
mov edx, eax
add edx, 4
mov ecx, esi
xor eax, eax
call fcn.0040847c
cmp byte [ebp - 1], 0
jne 0x5ffd10
mov eax, esi
call fcn.00407338
movzx edx, byte [ebp - 0xc]
dec edx
and dl, 0x3f
add dl, 0x21
mov byte [eax], dl
mov eax, dword [ebp - 0xc]
add eax, 2
mov ecx, 3
cdq
idiv ecx
lea eax, [eax + eax*2]
mov dword [ebp - 0xc], eax
mov edi, 2
xor eax, eax
mov dword [ebp - 0x10], eax
xor ebx, ebx
movzx eax, byte [ebp - 1]
sub al, 1
jb 0x5ffd2a
sub al, 2
jb 0x5ffd31
jmp 0x5ffd36
mov ebx, 2
jmp 0x5ffd36
mov ebx, 1
mov eax, esi
call fcn.00407338
mov byte [eax + ebx - 1], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jge 0x5ffe1a
test edi, edi
jle 0x5ffd92
mov eax, esi
call fcn.00407338
lea eax, [eax + ebx - 1]
push eax
mov ecx, edi
mov eax, 0x3f
shl eax, cl
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
movzx edx, byte [edx + ecx]
and eax, edx
mov ecx, edi
shr eax, cl
mov edx, dword [esi]
or al, byte [edx + ebx - 1]
pop edx
mov byte [edx], al
sub edi, 6
inc ebx
mov eax, esi
call fcn.00407338
mov byte [eax + ebx - 1], 0
jmp 0x5ffe0e
test edi, edi
jge 0x5ffdd8
mov eax, edi
cdq
xor eax, edx
sub eax, edx
mov edi, eax
mov eax, esi
call fcn.00407338
lea eax, [eax + ebx - 1]
push eax
mov ecx, edi
mov eax, 0x3f
shr eax, cl
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
and al, byte [edx + ecx]
mov ecx, edi
shl al, cl
mov edx, dword [esi]
or al, byte [edx + ebx - 1]
pop edx
mov byte [edx], al
mov eax, 8
sub eax, edi
mov edi, eax
inc dword [ebp - 0x10]
jmp 0x5ffe0e
mov eax, esi
call fcn.00407338
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
movzx edx, byte [edx + ecx]
and dl, 0x3f
mov ecx, dword [esi]
movzx ecx, byte [ecx + ebx - 1]
or dl, cl
mov byte [eax + ebx - 1], dl
inc ebx
inc dword [ebp - 0x10]
mov eax, esi
call fcn.00407338
mov byte [eax + ebx - 1], 0
mov edi, 2
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jl 0x5ffd4e
movzx eax, byte [ebp - 1]
sub al, 1
jb 0x5ffe2b
sub al, 2
jb 0x5ffe65
jmp 0x5ffead
cmp edi, 2
jne 0x5ffe31
dec ebx
mov eax, ebx
sub eax, 2
jl 0x5ffead
inc eax
mov dword [ebp - 0x14], eax
mov edi, 2
mov eax, esi
call fcn.00407338
mov edx, dword [esi]
movzx edx, byte [edx + edi - 1]
mov ecx, dword [0x65e7f0]
movzx edx, byte [ecx + edx]
mov byte [eax + edi - 1], dl
inc edi
dec dword [ebp - 0x14]
jne 0x5ffe41
jmp 0x5ffead
cmp edi, 2
jne 0x5ffe6b
dec ebx
test ebx, ebx
jle 0x5ffea8
mov dword [ebp - 0x14], ebx
mov edi, 1
mov eax, esi
call fcn.00407338
mov edx, dword [esi]
movzx edx, byte [edx + edi - 1]
mov ecx, dword [0x65e7f4]
movzx edx, byte [ecx + edx]
mov byte [eax + edi - 1], dl
inc edi
dec dword [ebp - 0x14]
jne 0x5ffe77
jmp 0x5ffea8
inc ebx
mov eax, esi
call fcn.00407338
mov byte [eax + ebx - 1], 0x3d
test bl, 3
jne 0x5ffe9b
mov eax, esi
xor ecx, ecx
mov edx, ebx
call fcn.004077e8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x6004d4
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
test dl, dl
je 0x6004e8
add esp, 0xfffffff0
call fcn.00405714
mov ebx, edx
mov esi, eax
xor eax, eax
mov dword [esi + 8], eax
xor eax, eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GetSystemInfo_1
mov eax, dword [ebp - 0x20]
xor edx, edx
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], edx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], edx
mov eax, esi
test bl, bl
je 0x600538
call fcn.0040576c
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x600580
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00406e14
xor eax, eax
push ebp
push 0x600614
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [esi + 4]
mov edx, dword [ebp - 4]
call fcn.00407110
push 0
push pe_nt_image_headers32
push 3
push 0
push 3
push 0x10000000
mov eax, dword [esi + 4]
call fcn.00407d34
push eax
call sub.kernel32.dll_CreateFileW
cmp eax, 0xffffffff
je 0x6005fe
mov edx, eax
mov dword [esi + 8], edx
lea eax, [esi + 0x18]
push eax
push edx
call sub.kernel32.dll_GetFileSizeEx
push 0
push 0
push 0
push 4
push 0
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_CreateFileMappingW
test eax, eax
jbe 0x6005fe
mov dword [esi + 0xc], eax
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60061b
lea eax, [ebp - 4]
call fcn.00406d30
ret