joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49cf20
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, eax
mov byte [ebp - 1], 1
fld qword [ebp + 8]
call fcn.004035c0
mov esi, eax
movzx eax, si
cmp eax, dword [ebx + 0xa0]
je 0x49cfb7
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0xa4]
cmp eax, 0x927c0
jbe 0x49cfb7
xor edx, edx
xor eax, eax
cmp si, word [ebx + eax*2 + 0x1d]
jne 0x49cf62
mov dl, 1
jmp 0x49cf68
inc eax
cmp eax, 0x40
jne 0x49cf57
test dl, dl
jne 0x49cfb7
mov eax, ebx
call fcn.0049d014
xor eax, eax
cmp si, word [ebx + eax*2 + 0x1d]
je 0x49cfb7
inc eax
cmp eax, 0x40
jne 0x49cf75
movzx eax, si
mov dword [ebx + 0xa0], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0xa4], eax
xor eax, eax
cmp word [ebx + eax*2 + 0x1d], 0
jne 0x49cfa7
mov word [ebx + eax*2 + 0x1d], si
jmp 0x49cfad
inc eax
cmp eax, 0x40
jne 0x49cf98
mov eax, ebx
call fcn.0049d160
mov byte [ebp - 1], al
movzx eax, byte [ebp - 1]
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x49f7cc
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
xor eax, eax
push ebp
push 0x49f953
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
xor eax, eax
push ebp
push 0x49f92f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4344d0]
call fcn.004345d0
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x49f91e
push dword fs:[eax]
mov dword fs:[eax], esp
test bl, bl
je 0x49f82f
mov edx, 0x80000002
mov eax, dword [ebp - 0x10]
call fcn.004346ac
jmp 0x49f83c
mov edx, 0x80000001
mov eax, dword [ebp - 0x10]
call fcn.004346ac
xor ecx, ecx
mov edx, 0x49f970
mov eax, dword [ebp - 0x10]
call fcn.00434710
test al, al
je 0x49f908
cmp dword [ebp + 8], 0
je 0x49f8ae
xor eax, eax
push ebp
push 0x49f87f
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.00434acc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49f891
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 8]
call fcn.004058a8
je 0x49f8fc
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.00434a9c
jmp 0x49f8fc
xor eax, eax
push ebp
push 0x49f8d4
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.00434acc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49f8eb
cmp dword [ebp - 4], 0
je 0x49f8fc
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.00434a04
mov eax, dword [ebp - 0x10]
call fcn.0043467c
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49f925
mov eax, dword [ebp - 0x10]
call fcn.0040443c
ret
Function at 0x4a4be8
Capabilities:
Check if file exists
Check mutex on windows
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, eax
mov eax, edi
call fcn.004a4980
test al, al
je 0x4a4c02
mov bl, 1
jmp 0x4a4cce
xor ebx, ebx
push 0x4a4cd8
push 0
push 0x100001
call sub.kernel32.dll_OpenMutexA
mov esi, eax
mov dword [edi + 0x40], esi
test esi, esi
jne 0x4a4c31
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
je 0x4a4cce
call fcn.00412500
push 0x4a4d00
push 0
push 0x100000
call sub.kernel32.dll_OpenEventA
mov esi, eax
mov dword [edi + 0x48], esi
test esi, esi
jne 0x4a4c50
call fcn.004124f4
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov esi, eax
mov dword [edi + 0x4c], esi
test esi, esi
jne 0x4a4c6b
call fcn.004124f4
push 0x4a4d28
push 0
push 4
call sub.kernel32.dll_OpenFileMappingA
mov esi, eax
mov dword [edi + 0x44], esi
test esi, esi
jne 0x4a4c87
call fcn.004124f4
push 0x10030
push 0
push 0
push 4
mov eax, dword [edi + 0x44]
push eax
call sub.kernel32.dll_MapViewOfFile
mov esi, eax
mov dword [edi + 0x50], esi
test esi, esi
jne 0x4a4ca9
call fcn.004124f4
mov eax, dword [edi + 0x50]
cmp dword [eax], 0xa
je 0x4a4cc7
mov ecx, 0x4a4d58
mov dl, 1
mov eax, dword [0x4093f8]
call fcn.00410868
call fcn.00404db4
mov eax, edi
call fcn.0042fb30
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4b7dbc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
movzx ebx, byte [0x4b7dfc]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4b7dd6
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4b7de5
or bl, 4
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4b7df4
or bl, 2
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x4c7544
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x4c75a8
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004056f0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP_1
mov edx, eax
pop eax
call fcn.0040b060
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c75af
lea eax, [ebp - 0xc]
call fcn.00405480
ret
Function at 0x4de888
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, ecx
mov edi, edx
sub esi, 3
js 0x4de8eb
movzx eax, byte [ebx]
shl eax, 0x10
mov ah, byte [ebx + 1]
mov al, byte [ebx + 2]
rol eax, 0xe
mov edx, eax
and edx, 0x3f
rol eax, 6
mov cl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [edi], cl
mov edx, eax
and edx, 0x3f
rol eax, 6
mov cl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [edi + 1], cl
mov edx, eax
and edx, 0x3f
shr eax, 0x1a
mov cl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [edi + 2], cl
add ebx, 3
mov cl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [edi + 3], cl
add edi, 4
sub esi, 3
jns 0x4de896
add esi, 3
jmp dword [esi*4 + 0x4de8f5]

Function at 0x4df49c
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push edi
mov ebx, 0x3020100
push esi
mov edi, eax
mov esi, 8
mov dword [eax], ebx
add ebx, 0x4040404
mov dword [eax + 4], ebx
add ebx, 0x4040404
mov dword [eax + 8], ebx
add ebx, 0x4040404
mov dword [eax + 0xc], ebx
add ebx, 0x4040404
mov dword [eax + 0x10], ebx
add ebx, 0x4040404
mov dword [eax + 0x14], ebx
add ebx, 0x4040404
mov dword [eax + 0x18], ebx
add ebx, 0x4040404
mov dword [eax + 0x1c], ebx
add ebx, 0x4040404
add eax, 0x20
dec esi
jne 0x4df4ab
dec ecx
js 0x4df526
push ebp
xor eax, eax
mov ebp, pe_nt_image_headers32
push edx
push ecx
mov bl, byte [esi + edi]
add al, byte [edx]
add al, bl
movzx eax, al
mov bh, byte [eax + edi]
mov byte [eax + edi], bl
mov byte [esi + edi], bh
inc edx
dec ecx
js 0x4df52a
inc esi
dec ebp
jne 0x4df505
mov dword [esp], ebp
pop ecx
pop ecx
pop ebp
pop esi
pop edi
pop ebx
ret
mov ecx, dword [esp]
mov edx, dword [esp + 4]
inc esi
dec ebp
jne 0x4df505
jmp 0x4df520

Function at 0x4df5c4
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
test ecx, ecx
je 0x4df617
push edi
lea esi, [edx - 1]
mov edi, eax
xor ebx, ebx
mov bl, byte [eax + 0x100]
xor edx, edx
mov dl, byte [eax + 0x101]
inc ebx
and ebx, 0xff
movzx eax, byte [ebx + edi]
add edx, eax
and edx, 0xff
mov ah, byte [edx + edi]
mov byte [edx + edi], al
add al, ah
inc esi
mov byte [ebx + edi], ah
movzx eax, al
mov al, byte [eax + edi]
xor byte [esi], al
dec ecx
jne 0x4df5e0
mov byte [edi + 0x100], bl
mov byte [edi + 0x101], dl
pop edi
pop esi
pop ebx
ret
Function at 0x4e03b4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4e0479
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x10e
call fcn.00405ba0
mov eax, dword [ebx]
call fcn.00405910
push eax
push 0
push 0
push 5
push 0
call sub.SHFolder.dll_SHGetFolderPathA
test eax, 0x80000000
sete al
neg al
sbb eax, eax
test eax, eax
je 0x4e0443
mov eax, dword [ebx]
call fcn.00405910
call fcn.0040bb58
mov edx, eax
mov eax, ebx
call fcn.00405ba0
cmp dword [ebx], 0
je 0x4e044a
mov eax, dword [ebx]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x4e042c
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
je 0x4e044a
mov eax, ebx
mov edx, 0x4e0490
call fcn.0040574c
jmp 0x4e044a
mov eax, ebx
call fcn.00405480
cmp dword [ebx], 0
jne 0x4e0463
lea edx, [ebp - 8]
xor eax, eax
call fcn.00403438
mov eax, dword [ebp - 8]
mov edx, ebx
call fcn.0040b894
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e0480
lea eax, [ebp - 8]
call fcn.00405480
ret
Function at 0x4e4750
Capabilities:
Hash data with md5

Disassembly:
push ebx
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
mov edx, 0x40
lea ecx, [eax + 0x18]
mov byte [ecx], 0
inc ecx
dec edx
jne 0x4e4763
mov edx, 0x10
lea ecx, [eax + 0x58]
xor ebx, ebx
mov dword [ecx], ebx
add ecx, 4
dec edx
jne 0x4e4772
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebx
ret

Function at 0x4e5288
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff50
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405900
mov eax, dword [ebp - 8]
call fcn.00405900
xor eax, eax
push ebp
push 0x4e5407
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
test eax, eax
je 0x4e52d7
sub eax, 4
mov eax, dword [eax]
cmp eax, 0x40
jle 0x4e52f8
lea edx, [ebp - 0xb0]
mov eax, dword [ebp - 8]
call fcn.004e5240
mov edx, dword [ebp - 0xb0]
lea eax, [ebp - 8]
call fcn.00405518
lea ecx, [ebp - 0xc]
mov edx, 0x40
mov al, 0x36
call fcn.00405c04
lea ecx, [ebp - 0x10]
mov edx, 0x40
mov al, 0x5c
call fcn.00405c04
mov eax, dword [ebp - 8]
test eax, eax
je 0x4e5322
sub eax, 4
mov eax, dword [eax]
mov esi, eax
test esi, esi
jle 0x4e5367
mov ebx, 1
lea eax, [ebp - 0xc]
call fcn.00405970
mov edx, dword [ebp - 0xc]
movzx edx, byte [edx + ebx - 1]
mov ecx, dword [ebp - 8]
xor dl, byte [ecx + ebx - 1]
mov byte [eax + ebx - 1], dl
lea eax, [ebp - 0x10]
call fcn.00405970
mov edx, dword [ebp - 0x10]
movzx edx, byte [edx + ebx - 1]
mov ecx, dword [ebp - 8]
xor dl, byte [ecx + ebx - 1]
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x4e532d
lea eax, [ebp - 0xac]
call fcn.004e4750
mov ebx, 0x4e4878
mov ecx, ebx
lea eax, [ebp - 0xac]
mov edx, dword [ebp - 0xc]
call fcn.004e4f94
mov ecx, ebx
lea eax, [ebp - 0xac]
mov edx, dword [ebp - 4]
call fcn.004e4f94
lea ecx, [ebp - 0x14]
mov edx, ebx
lea eax, [ebp - 0xac]
call fcn.004e50c8
lea eax, [ebp - 0xac]
call fcn.004e4750
mov ecx, ebx
lea eax, [ebp - 0xac]
mov edx, dword [ebp - 0x10]
call fcn.004e4f94
mov ecx, ebx
lea eax, [ebp - 0xac]
mov edx, dword [ebp - 0x14]
call fcn.004e4f94
mov ecx, edi
mov edx, ebx
lea eax, [ebp - 0xac]
call fcn.004e50c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e540e
lea eax, [ebp - 0xb0]
call fcn.00405480
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.004054a4
ret
Function at 0x4f2758
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
xor edx, edx
push ebp
push 0x4f27cb
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, ecx
call fcn.004f2734
mov ebx, eax
mov edx, 0x4f27e4
mov eax, ebx
call fcn.004f1380
lea eax, [ebx + 0xc]
mov edx, esi
call fcn.004054d4
lea eax, [ebx + 0x24]
mov edx, 0x4f27f8
call fcn.004054d4
lea eax, [ebp - 4]
call fcn.004f1580
mov edx, dword [ebp - 4]
lea eax, [ebx + 0x30]
call fcn.004054d4
mov eax, ebx
call fcn.004f0f48
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f27d2
lea eax, [ebp - 4]
call fcn.00405480
ret
Function at 0x597490
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x59752d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x10]
call fcn.00426d04
mov edi, eax
dec edi
test edi, edi
jl 0x597517
inc edi
xor esi, esi
mov eax, dword [ebx + 0x48]
push eax
mov eax, dword [ebx + 0x44]
push eax
mov eax, dword [ebx + 0x4c]
push eax
mov eax, dword [ebx + 0x10]
push eax
mov eax, dword [ebx + 0x68]
push eax
mov eax, dword [ebx + 0xc]
push eax
mov eax, dword [eax]
mov eax, dword [eax + 0x78]
push eax
push esi
mov eax, dword [ebx + 0x1c]
push eax
mov eax, dword [ebx + 0xa4]
push eax
push 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebx + 0x40]
mov edx, dword [ebx + 0x3c]
movzx eax, byte [ebx + 0x39]
call fcn.00588204
push 1
mov edx, esi
mov eax, dword [ebx + 0x10]
call fcn.005a4020
mov edx, dword [eax + 0x18]
mov ecx, dword [ebp - 4]
mov eax, dword [ebx + 0x14]
call fcn.005a63f8
inc esi
dec edi
jne 0x5974ba
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x597534
lea eax, [ebp - 4]
call fcn.00405480
ret
Function at 0x5c1400
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x5f70dc
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x5c1422
shr eax, 1
xor eax, 0xedb88320
jmp 0x5c1424
shr eax, 1
dec edx
jne 0x5c1410
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x5c1409
mov byte [0x5f74dc], 1
pop esi
pop ebx
ret

Function at 0x5c1440
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x5f74dc], 0
jne 0x5c145a
call fcn.005c1400
mov eax, edi
dec eax
test eax, eax
jl 0x5c1482
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5f70dc]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x5c1464
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x5c3e74
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x5c3f0e.0
jmp dword [ecx*4 + 0x5c3ea7]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x5c3ed9
sub dl, 8
je 0x5c3ee8
jmp case.0x5c3f0e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5c3b20
jmp case.0x5c3f0e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5c3b78
jmp case.0x5c3f0e.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x5c3f0e.0
movzx ecx, byte [ecx + 0x5c3f15]
jmp dword [ecx*4 + 0x5c3f26]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5c3c24
jmp case.0x5c3f0e.0
cmp dl, 3
jne 0x5c3f53
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5c3c78
jmp case.0x5c3f0e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5c3c34
jmp case.0x5c3f0e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5c3cbc
jmp case.0x5c3f0e.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x5c3f7e
sub dl, 8
je 0x5c3f8a
jmp case.0x5c3f0e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5c3ce8
jmp case.0x5c3f0e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5c3d54
jmp case.0x5c3f0e.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x5c3fa9
sub dl, 8
je 0x5c3fb5
jmp case.0x5c3f0e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5c3e10
jmp case.0x5c3f0e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5c3e38
mov edx, dword [eax + 0x468]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x450]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 8], esi
mov esi, edx
add esi, dword [eax + 0x44c]
mov dword [ebp - 0x10], esi
mov esi, ecx
test esi, esi
jb 0x5c4059
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.005c302c
test eax, eax
je 0x5c4059
mov eax, ebx
call fcn.005c4064
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x5c3ff2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5c4064
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x5c4097
dec al
je 0x5c40d2
dec al
je 0x5c4117
dec al
je 0x5c4186
jmp 0x5c4215
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x5c4215
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x5c40a7
jmp 0x5c4215
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5c4215
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x5c40e2
jmp 0x5c4215
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5c4215
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jae 0x5c4147
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x5c415b
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [ebp - 8], edx
add eax, dword [ebp - 8]
sar eax, 1
jns 0x5c4165
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x5c4127
jmp 0x5c4215
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5c4215
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x5c41e3
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [ebp - 8], edx
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [ebp - 0xc], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [ebp - 4], edx
movzx ecx, byte [ebp - 0xc]
push eax
movzx eax, byte [ebp - 8]
pop edx
call fcn.005c148c
add al, byte [ebp - 4]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x5c419c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5c8010
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, eax
mov eax, dword [0x5eea28]
mov eax, dword [eax]
movzx eax, word [eax + 0x44]
mov word [ebp - 2], ax
xor eax, eax
push ebp
push 0x5c80a1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5eea28]
mov eax, dword [eax]
mov dx, 0xfff5
call fcn.0048896c
cmp dword [ebx + 0x1ac], 0
je 0x5c8083
mov eax, dword [ebx + 0x1ac]
mov edx, 0x5c80b4
call fcn.004058a8
je 0x5c8083
push 5
push 0x5c80bc
push 0x5c80bc
mov eax, dword [ebx + 0x1ac]
call fcn.00405910
push eax
push 0x5c80c0
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c80a8
mov eax, dword [0x5eea28]
mov eax, dword [eax]
movzx edx, word [ebp - 2]
call fcn.0048896c
ret

Function at 0x5c9478
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405900
xor eax, eax
push ebp
push 0x5c951f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5eea28]
mov eax, dword [eax]
mov dx, 0xfff5
call fcn.0048896c
xor eax, eax
push ebp
push 0x5c9502
push dword fs:[eax]
mov dword fs:[eax], esp
push 5
push 0x5c9530
push 0x5c9530
mov eax, dword [ebp - 4]
call fcn.00405910
push eax
push 0x5c9534
mov eax, ebx
call fcn.00472fa0
push eax
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
seta byte [ebp - 5]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c9509
mov eax, dword [0x5eea28]
mov eax, dword [eax]
xor edx, edx
call fcn.0048896c
ret
Function at 0x5cf280
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5cf394
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
call fcn.00406c8c
mov edi, eax
dec edi
test edi, edi
jl 0x5cf2e2
inc edi
xor esi, esi
test bl, bl
je 0x5cf2d0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov eax, dword [eax + esi*4]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_TerminateThread
jmp 0x5cf2de
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov eax, dword [eax + esi*4]
call fcn.0042fb58
inc esi
dec edi
jne 0x5cf2b6
mov eax, dword [ebp - 4]
add eax, 0x44
mov edx, dword [0x5cecb4]
call fcn.00406f68
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
call fcn.0043f8fc
xor eax, eax
push ebp
push 0x5cf36f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov edx, dword [eax]
call dword [edx + 0x14]
mov edi, eax
dec edi
test edi, edi
jl 0x5cf356
inc edi
xor esi, esi
lea ecx, [ebp - 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov edx, esi
call fcn.0042872c
mov eax, dword [ebp - 8]
mov edx, 0x5cf3ac
call fcn.004058a8
jne 0x5cf352
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ecx, 0x5cf3b8
mov edx, esi
call fcn.004287cc
inc esi
dec edi
jne 0x5cf321
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5cf376
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
call fcn.0043f904
ret