joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55eb88
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov ebx, eax
mov edx, 0x55e4e4
mov eax, dword [ebx + 0xc]
call fcn.00439214
cmp byte [ebx + 0x314], 0
je 0x55ebae
mov edi, 0xff
jmp 0x55ebb3
mov edi, pe_nt_image_headers32
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 8]
mov dword [ebx + 0x310], eax
dec eax
test eax, eax
jl 0x55ebed
inc eax
mov dword [esp + 8], eax
xor esi, esi
cmp edi, esi
jle 0x55ebde
mov edx, esi
mov eax, dword [ebx + 0xc]
call fcn.00438c94
cmp dword [eax], 0
jne 0x55ebe6
mov dword [ebx + 0x310], esi
jmp 0x55ebed
inc esi
dec dword [esp + 8]
jne 0x55ebcb
mov eax, dword [ebx + 0x310]
dec eax
test eax, eax
jl 0x55ec30
inc eax
mov dword [esp + 8], eax
xor esi, esi
mov edx, esi
mov eax, dword [ebx + 0xc]
call fcn.00438c94
mov dword [eax + 8], esi
mov edx, esi
mov eax, dword [ebx + 0xc]
call fcn.00438c94
lea edx, [esi + esi*2]
mov cx, word [eax + 0xc]
mov word [ebx + edx + 0x10], cx
mov cl, byte [eax + 0xe]
mov byte [ebx + edx + 0x12], cl
inc esi
dec dword [esp + 8]
jne 0x55ebff
mov esi, dword [ebx + 0x310]
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 8]
dec eax
sub eax, esi
jl 0x55ed03
inc eax
mov dword [esp + 8], eax
mov edx, esi
mov eax, dword [ebx + 0xc]
call fcn.00438c94
mov edi, eax
cmp dword [edi], 0
jne 0x55ec69
mov eax, dword [edi + 0xc]
mov eax, dword [eax + 8]
mov dword [edi + 8], eax
jmp 0x55ecf8
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], 0x2fd
mov eax, dword [ebx + 0x310]
dec eax
test eax, eax
jl 0x55ece6
inc eax
mov dword [esp + 0xc], eax
xor ebp, ebp
mov edx, ebp
mov eax, dword [ebx + 0xc]
call fcn.00438c94
movzx eax, byte [eax + 0xc]
movzx edx, byte [edi + 0xc]
sub eax, edx
push eax
mov edx, ebp
mov eax, dword [ebx + 0xc]
call fcn.00438c94
movzx eax, byte [eax + 0xd]
movzx edx, byte [edi + 0xd]
sub eax, edx
pop edx
add edx, eax
push edx
mov edx, ebp
mov eax, dword [ebx + 0xc]
call fcn.00438c94
movzx eax, byte [eax + 0xe]
movzx edx, byte [edi + 0xe]
sub eax, edx
mov edx, eax
pop eax
add eax, edx
cdq
xor eax, edx
sub eax, edx
cmp eax, dword [esp]
jge 0x55ecdf
mov dword [esp], eax
mov dword [esp + 4], ebp
inc ebp
dec dword [esp + 0xc]
jne 0x55ec88
mov edx, dword [esp + 4]
mov eax, dword [ebx + 0xc]
call fcn.00438c94
mov eax, dword [eax + 8]
mov dword [edi + 8], eax
inc esi
dec dword [esp + 8]
jne 0x55ec4a
cmp byte [ebx + 0x314], 0
je 0x55ed49
movzx eax, byte [ebx + 0x310]
mov byte [ebx + 0x315], al
mov eax, dword [ebx + 0x310]
lea eax, [eax + eax*2]
mov byte [ebx + eax + 0x10], 0
mov eax, dword [ebx + 0x310]
lea eax, [eax + eax*2]
mov byte [ebx + eax + 0x11], 0
mov eax, dword [ebx + 0x310]
lea eax, [eax + eax*2]
mov byte [ebx + eax + 0x12], 0
inc dword [ebx + 0x310]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x56618c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe8c
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407568
mov eax, dword [ebp - 8]
call fcn.00407568
xor eax, eax
push ebp
push 0x56625e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040760c
push eax
call sub.KERNEL32.DLL_DeleteFileW
xor ecx, ecx
mov edx, 0x10
mov eax, dword [ebp - 4]
call fcn.004154cc
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x566232
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x174]
mov edx, dword [ebp - 8]
mov ecx, 0xff
call fcn.0040781c
lea edx, [ebp - 0x174]
lea eax, [ebp - 0x71]
mov cl, 0x64
call fcn.00404ba4
lea edx, [ebp - 0x71]
mov ecx, 0x65
mov eax, dword [ebp - 0xc]
call fcn.0041553c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x566239
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_CloseHandle
ret

Function at 0x5677dc
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffd4c
mov esi, eax
push 0x4001
push 0x2b4
lea eax, [esp + 8]
push eax
push 0
push 0x567828
call sub.shell32.dll_SHGetFileInfoW
mov ebx, eax
test ebx, ebx
je 0x56781e
mov eax, esi
call fcn.004db6d8
mov esi, eax
push ebx
push 0
push 0x1109
push esi
call sub.user32.dll_SendMessageW
add esp, 0x2b4
pop esi
pop ebx
ret

Function at 0x568660
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
test dl, dl
je 0x568673
add esp, 0xfffffff0
call fcn.004059d8
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00407568
mov eax, dword [ebp + 8]
call fcn.00407568
xor eax, eax
push ebp
push 0x56871f
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
xor ecx, ecx
xor edx, edx
mov eax, edi
call fcn.0053a9bc
lea eax, [edi + 0x3a4]
mov edx, dword [ebp - 4]
call fcn.00407580
mov eax, dword [edi + 0x39c]
mov edx, dword [ebp + 8]
call fcn.004d2790
mov eax, dword [ebp - 4]
call fcn.0040760c
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
mov esi, eax
test esi, 1
jle 0x5686e9
mov eax, dword [edi + 0x38c]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0xf0]
test esi, 2
jle 0x568701
mov eax, dword [edi + 0x390]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0xf0]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x568726
lea eax, [ebp - 4]
call fcn.00407570
lea eax, [ebp + 8]
call fcn.00407570
ret
Function at 0x568aac
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
push edi
test dl, dl
je 0x568ac1
add esp, 0xfffffff0
call fcn.004059d8
mov esi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov eax, dword [ebp + 0xc]
call fcn.00407568
xor eax, eax
push ebp
push 0x568c0b
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, esi
xor edx, edx
mov eax, ebx
call fcn.00444fa8
push ebx
push 0x568d10
call fcn.00446764
mov dword [ebx + 0x40], eax
mov eax, dword [ebp + 8]
mov byte [eax], 0
mov eax, dword [ebp + 0xc]
call fcn.0040760c
push eax
call sub.KERNEL32.DLL_LoadLibraryW
mov esi, eax
mov dword [ebx + 0x4c], esi
test esi, esi
je 0x568bf5
push 0x568c34
push esi
call fcn.0040c9d0
mov dword [ebx + 0x50], eax
push 0x568c44
mov eax, dword [ebx + 0x4c]
push eax
call fcn.0040c9d0
mov dword [ebx + 0x54], eax
cmp dword [ebx + 0x50], 0
je 0x568bf5
cmp dword [ebx + 0x54], 0
je 0x568bf5
push 0x568c54
push 0
push 2
call sub.KERNEL32.DLL_OpenFileMappingW
mov esi, eax
mov dword [ebx + 0x44], esi
test esi, esi
jne 0x568b9c
push 0x568c54
push 0x50
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.KERNEL32.DLL_CreateFileMappingW
mov esi, eax
mov dword [ebx + 0x44], esi
push 0
push 0
push 0
push 2
push esi
call sub.KERNEL32.DLL_MapViewOfFile
mov edi, eax
mov dword [ebx + 0x48], edi
mov eax, edi
xor ecx, ecx
mov edx, 0x50
call fcn.00404cb4
mov esi, dword [ebx + 0x44]
test esi, esi
je 0x568bf5
push 0
push 0
push 0
push 6
push esi
call sub.KERNEL32.DLL_MapViewOfFile
mov edi, eax
mov dword [ebx + 0x48], edi
lea edx, [ebp - 0x54]
mov eax, edi
mov ecx, 0x50
call fcn.004044cc
mov edx, 0x14
lea eax, [ebp - 0x54]
cmp dword [eax], 0
jne 0x568bd9
mov ecx, dword [ebx + 0x40]
mov dword [eax], ecx
jmp 0x568bdf
add eax, 4
dec edx
jne 0x568bcd
mov edx, dword [ebx + 0x48]
lea eax, [ebp - 0x54]
mov ecx, 0x50
call fcn.004044cc
mov eax, dword [ebp + 8]
mov byte [eax], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x568c12
lea eax, [ebp + 0xc]
call fcn.00407570
ret
Function at 0x57835c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff824
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x7dc], ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x57843d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004070a0
mov eax, dword [0x642544]
cmp byte [eax], 0
je 0x5783f2
push edi
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.004074cc
mov eax, dword [ebx]
mov dword [ebp - 0x7d8], eax
mov esi, dword [ebp - 0x7d8]
test esi, esi
je 0x5783be
sub esi, 4
mov eax, dword [esi]
shr eax, 1
mov esi, eax
push esi
mov eax, dword [ebx]
call fcn.00407290
push eax
push edi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebx]
mov dword [ebp - 0x7d8], eax
mov eax, dword [ebp - 0x7d8]
test eax, eax
je 0x5783e6
sub eax, 4
mov eax, dword [eax]
shr eax, 1
mov edx, eax
dec edx
mov eax, ebx
call fcn.004074cc
jmp 0x578424
lea eax, [ebp - 0x7d2]
push eax
push 0x3e8
push 0xd
push edi
call sub.user32.dll_SendMessageW
lea edx, [ebp - 0x7dc]
lea eax, [ebp - 0x7d2]
call fcn.0041640c
mov edx, dword [ebp - 0x7dc]
mov eax, ebx
call fcn.004077f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x578444
lea eax, [ebp - 0x7dc]
call fcn.00407570
ret

Function at 0x57844c
Capabilities:
Get graphical window text

Disassembly:
push ebx
add esp, 0xfffff82c
mov ebx, edx
mov edx, esp
push edx
push 0x3e8
push 0xd
push eax
call sub.user32.dll_SendMessageW
mov edx, ebx
mov eax, esp
call fcn.0041640c
add esp, 0x7d4
pop ebx
ret

Function at 0x57f074
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov esi, edx
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, eax
mov eax, dword [0x642d2c]
mov eax, dword [eax]
cmp dword [eax + 0x58], 0
jne 0x57f11a
call sub.KERNEL32.DLL_GetTickCount
sub eax, dword [ebx + 0x80]
xor edx, edx
push edx
push eax
mov eax, dword [ebx + 0x84]
cdq
cmp edx, dword [esp + 4]
jne 0x57f0b9
cmp eax, dword [esp]
pop edx
pop eax
jae 0x57f0f5
jmp 0x57f0bd
pop edx
pop eax
jge 0x57f0f5
mov eax, dword [0x642d2c]
mov eax, dword [eax]
mov dword [eax + 0x38], 2
call sub.KERNEL32.DLL_GetTickCount
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.0057945c
mov eax, dword [ebx + 0xf4]
test eax, eax
je 0x57f11a
mov ecx, dword [esp + 4]
mov edx, dword [esp]
mov ebx, dword [eax]
call dword [ebx + 0x44]
jmp 0x57f11a
cmp dword [ebx + 0x11c], 0
je 0x57f11a
xor edx, edx
mov eax, dword [ebx + 0x58]
call fcn.0047bd58
push 0
push 0
push 0x10
mov eax, dword [ebx + 0x12c]
push eax
call sub.user32.dll_PostMessageW
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x589b4c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff824
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x7dc], ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x589c2d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004070a0
mov eax, dword [0x642544]
cmp byte [eax], 0
je 0x589be2
push edi
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.004074cc
mov eax, dword [ebx]
mov dword [ebp - 0x7d8], eax
mov esi, dword [ebp - 0x7d8]
test esi, esi
je 0x589bae
sub esi, 4
mov eax, dword [esi]
shr eax, 1
mov esi, eax
push esi
mov eax, dword [ebx]
call fcn.00407290
push eax
push edi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebx]
mov dword [ebp - 0x7d8], eax
mov eax, dword [ebp - 0x7d8]
test eax, eax
je 0x589bd6
sub eax, 4
mov eax, dword [eax]
shr eax, 1
mov edx, eax
dec edx
mov eax, ebx
call fcn.004074cc
jmp 0x589c14
lea eax, [ebp - 0x7d2]
push eax
push 0x3e8
push 0xd
push edi
call sub.user32.dll_SendMessageW
lea edx, [ebp - 0x7dc]
lea eax, [ebp - 0x7d2]
call fcn.0041640c
mov edx, dword [ebp - 0x7dc]
mov eax, ebx
call fcn.004077f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x589c34
lea eax, [ebp - 0x7dc]
call fcn.00407570
ret

Function at 0x596670
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
push 0
mov eax, ebx
call fcn.004db6d8
push eax
call sub.user32.dll_ShowWindow
mov byte [ebx + 0x2e4], 0
xor edx, edx
mov eax, ebx
call fcn.004d2678
pop ebx
ret
Function at 0x5a41b8
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
cmp byte [ebx + 0x98], 0
je 0x5a41de
push 0
mov eax, dword [ebx + 0x94]
call fcn.004db6d8
push eax
call sub.user32.dll_ShowWindow
mov byte [ebx + 0x98], 0
pop ebx
ret

Function at 0x5a44d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x5a4642
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xa4], 1
mov eax, dword [ebp - 0xc]
test byte [eax + 0x1c], 0x10
jne 0x5a4627
lea eax, [ebp - 0x20e]
push eax
push pe_nt_image_headers32
call sub.KERNEL32.DLL_GetTempPathW
lea edx, [ebp - 4]
lea eax, [ebp - 0x20e]
call fcn.0041640c
mov dl, 1
mov eax, dword [0x56cd6c]
call fcn.0056d050
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x9c], eax
mov dl, 1
mov eax, dword [0x43123c]
call fcn.00405474
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0xa0]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x9c]
call fcn.0056d884
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x5a4623
mov dl, 1
mov eax, dword [0x56fa78]
call fcn.00570228
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x38], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x40]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x9c]
mov edx, 0x5a465c
call fcn.0056e1f8
lea eax, [ebp - 8]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00407a4c
xor eax, eax
push ebp
push 0x5a461c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x40]
xor ecx, ecx
xor edx, edx
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x40]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x38]
call fcn.005708e4
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.005a4668
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a4623
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x9c]
call fcn.004054a4
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x40]
call fcn.004054a4
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x38]
call fcn.004054a4
ret
movzx ebx, byte [ebp - 0xd]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a4649
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407578
ret
Function at 0x5a81b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5a836a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp word [eax + 0x2a], 0
jne 0x5a81fa
push 0
push 0x5a8378
push 0x5a8378
push 0
call sub.user32.dll_MessageBoxW
jmp 0x5a8347
xor eax, eax
push ebp
push 0x5a8340
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, ecx
mov eax, dword [ebp - 4]
call fcn.005a8400
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov edx, dword [ebp - 4]
call fcn.005a7824
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 4], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 8], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
mov edx, dword [ebp - 4]
mov dword [eax + 0x3c], edx
mov dword [eax + 0x38], 0x5a80d8
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x5a8287
inc ebx
xor esi, esi
push 1
lea ecx, [ebp - 0xc]
mov edx, esi
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
mov cl, 1
call fcn.005a6a18
inc esi
dec ebx
jne 0x5a8264
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x10], eax
fild qword [ebp - 0x14]
fdiv dword [0x5a8384]
call fcn.00404784
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 8], ebx
test ebx, ebx
ja 0x5a82b9
mov eax, dword [ebp - 4]
mov dword [eax + 8], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
mov edx, dword [ebp - 4]
mov dword [eax + 0x3c], edx
mov dword [eax + 0x38], 0x5a80e4
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x5a8324
inc ebx
xor esi, esi
push 1
lea ecx, [ebp - 0x18]
mov edx, esi
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
mov cl, 1
call fcn.005a6a18
mov eax, dword [ebp - 4]
cmp word [eax + 0x22], 0
je 0x5a8320
lea ecx, [ebp - 0x1c]
mov edx, esi
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x1c]
mov edi, dword [ebp - 4]
mov eax, dword [edi + 0x24]
call dword [edi + 0x20]
inc esi
dec ebx
jne 0x5a82de
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a8347
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov edx, dword [ebp - 4]
call fcn.005a7884
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a8371
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00407578
lea eax, [ebp - 0xc]
call fcn.00407570
ret
Function at 0x5ab294
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, eax
mov ebp, edx
xor ebx, ebx
xor edi, edi
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
test eax, eax
jle 0x5ab32e
movzx edx, byte [esi + ebx]
shr edx, 2
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi], dl
movzx edx, byte [esi + ebx]
and dl, 3
movzx edx, dl
shl edx, 4
movzx ecx, byte [esi + ebx + 1]
shr ecx, 4
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
push edx
pop edx
mov byte [ebp + edi + 1], dl
movzx edx, byte [esi + ebx + 1]
and dl, 0xf
movzx edx, dl
add edx, edx
add edx, edx
movzx ecx, byte [esi + ebx + 2]
shr ecx, 6
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
push edx
pop edx
mov byte [ebp + edi + 2], dl
movzx edx, byte [esi + ebx + 2]
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi + 3], dl
add edi, 4
add ebx, 3
dec eax
jne 0x5ab2b3
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
dec edx
je 0x5ab344
dec edx
je 0x5ab379
jmp 0x5ab3ca
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi + 1], al
mov byte [ebp + edi + 2], 0x3d
mov byte [ebp + edi + 3], 0x3d
jmp 0x5ab3ca
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx edx, byte [esi + ebx + 1]
shr edx, 4
add eax, edx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi + 1], al
movzx eax, byte [esi + ebx + 1]
and al, 0xf
movzx eax, al
add eax, eax
add eax, eax
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi + 2], al
mov byte [ebp + edi + 3], 0x3d
mov eax, dword [esp]
add eax, 2
mov ecx, 3
cdq
idiv ecx
add eax, eax
add eax, eax
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5ab4ac
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov edi, eax
mov dword [esp + 8], edx
xor esi, esi
xor ebp, ebp
xor eax, eax
mov edx, dword [esp]
test edx, edx
jns 0x5ab4cb
add edx, 3
sar edx, 2
test edx, edx
jle 0x5ab5d9
mov dword [esp + 0xc], edx
mov edx, 4
lea eax, [esp + 4]
movzx ecx, byte [edi + esi]
cmp ecx, 0x3d
jg 0x5ab500
je 0x5ab543
sub ecx, 0x2b
je 0x5ab539
sub ecx, 4
je 0x5ab53e
dec ecx
sub ecx, 0xa
jb 0x5ab52b
jmp 0x5ab546
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x5ab512
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x5ab51d
jmp 0x5ab546
movzx ecx, byte [edi + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x5ab546
movzx ecx, byte [edi + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x5ab546
movzx ecx, byte [edi + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x5ab546
mov byte [eax], 0x3e
jmp 0x5ab546
mov byte [eax], 0x3f
jmp 0x5ab546
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x5ab4e3
movzx eax, byte [esp + 4]
add eax, eax
add eax, eax
movzx edx, byte [esp + 5]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp], al
lea eax, [ebp + 1]
movzx edx, byte [esp + 6]
cmp dl, 0xff
je 0x5ab597
cmp byte [esp + 7], 0xff
jne 0x5ab597
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
lea eax, [ebp + 2]
inc ebp
jmp 0x5ab5ce
cmp dl, 0xff
je 0x5ab5ce
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
mov eax, dword [esp + 8]
movzx edx, byte [esp + 6]
shl edx, 6
or dl, byte [esp + 7]
mov byte [eax + ebp + 2], dl
lea eax, [ebp + 3]
add ebp, 2
inc ebp
dec dword [esp + 0xc]
jne 0x5ab4da
add esp, 0x10
pop ebp
pop edi
pop esi
ret

Function at 0x5ad86c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jbe 0x5ad88d
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
movzx ebx, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x5ad87a
pop edi
pop esi
pop ebx
ret
Function at 0x5b2fec
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x114], ebx
mov dword [ebp - 0x110], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00407568
xor eax, eax
push ebp
push 0x5b315e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x110]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00407d58
mov eax, dword [ebp - 0x110]
mov edx, 0x5b3178
call fcn.00407cf0
jne 0x5b30af
mov eax, dword [ebp - 4]
test eax, eax
je 0x5b3074
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x5b3074
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.0040693c
mov ebx, eax
test ebx, ebx
je 0x5b307f
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0x114]
push eax
mov ecx, ebx
sub ecx, 2
mov edx, 3
mov eax, dword [ebp - 4]
call fcn.00407d58
mov ecx, dword [ebp - 0x114]
mov eax, esi
mov edx, 0x5b318c
call fcn.00407a4c
jmp 0x5b3133
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00415b3c
mov eax, dword [ebp - 4]
test eax, eax
je 0x5b30d7
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x5b30d7
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.0040693c
mov ebx, eax
test ebx, ebx
je 0x5b30e2
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0xc]
push eax
mov ecx, ebx
sub ecx, 2
mov edx, 3
mov eax, dword [ebp - 4]
call fcn.00407d58
push 0x80
lea eax, [ebp - 0x10c]
push eax
mov eax, dword [ebp - 8]
call fcn.0040760c
push eax
call sub.KERNEL32.DLL_QueryDosDeviceW
lea edx, [ebp - 0x118]
lea eax, [ebp - 0x10c]
call fcn.0041640c
mov edx, dword [ebp - 0x118]
mov eax, esi
mov ecx, dword [ebp - 0xc]
call fcn.00407a4c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b3165
lea eax, [ebp - 0x118]
mov edx, 3
call fcn.00407578
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00407578
ret