joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4aabd0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x204], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4aad67
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x204]
mov eax, ebx
call fcn.004aa6a0
mov eax, dword [ebp - 0x204]
lea edx, [esi + 1]
call fcn.0040a79c
cmp al, 2
jne 0x4aac16
dec esi
mov eax, ebx
call fcn.004aa9b4
test al, al
je 0x4aad07
test esi, esi
jge 0x4aac2b
xor esi, esi
lea edi, [esi + 1]
lea edx, [ebp - 0x204]
mov eax, ebx
call fcn.004aa6a0
mov eax, dword [ebp - 0x204]
call fcn.00403c8c
cmp edi, eax
jge 0x4aac72
lea edx, [ebp - 0x204]
mov eax, ebx
call fcn.004aa6a0
mov eax, dword [ebp - 0x204]
mov al, byte [eax + edi - 1]
mov edx, dword [0x5c6e64]
and eax, 0xff
bt dword [edx], eax
jae 0x4aac72
inc edi
mov eax, dword [ebx + 0x138]
cmp esi, eax
jl 0x4aac80
mov esi, eax
mov edi, esi
mov ecx, edi
mov edx, edi
mov eax, ebx
call fcn.004aabac
cmp edi, esi
je 0x4aacff
lea eax, [ebp - 0x100]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x200]
mov byte [eax], 0
inc eax
dec edx
jne 0x4aaca6
mov byte [ebp - 0x1f0], 0x81
mov byte [ebp - 0x1db], 0x81
lea eax, [ebp - 0x200]
push eax
call sub.user32.dll_SetKeyboardState
push 1
push 0x25
push pe_nt_image_headers32
mov eax, ebx
call fcn.00425df4
push eax
call sub.user32.dll_SendMessageA
push 1
push 0x25
push 0x101
mov eax, ebx
call fcn.00425df4
push eax
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x100]
push eax
call sub.user32.dll_SetKeyboardState
mov dword [ebx + 0x140], esi
jmp 0x4aad4e
test esi, esi
jge 0x4aad0d
xor esi, esi
lea edx, [ebp - 0x204]
mov eax, ebx
call fcn.004aa6a0
mov eax, dword [ebp - 0x204]
call fcn.00403c8c
cmp esi, eax
jl 0x4aad43
lea edx, [ebp - 0x204]
mov eax, ebx
call fcn.004aa6a0
mov eax, dword [ebp - 0x204]
call fcn.00403c8c
mov esi, eax
mov ecx, esi
mov edx, esi
mov eax, ebx
call fcn.004aabac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aad6e
lea eax, [ebp - 0x204]
call fcn.00403a10
ret
Function at 0x4add88
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax - 4]
mov ebx, dword [eax + 0x118]
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x4adf0e
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax - 4]
mov edx, dword [eax + 0x150]
mov eax, dword [ebx + 0x10]
call fcn.00417570
cmp byte [ebp + 8], 0
je 0x4adde1
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 0xc]
mov eax, dword [ebx + 0x10]
call fcn.00417440
jmp 0x4addef
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 8]
mov eax, dword [ebx + 0x10]
call fcn.00417440
mov eax, dword [ebx + 0x10]
call fcn.00417568
dec eax
jle 0x4ade35
xor eax, eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebx + 0x10]
call fcn.00417438
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
push 0
push 0
lea eax, [ebp - 0x24]
push eax
mov edi, dword [ebx + 0x10]
mov eax, edi
call fcn.00417568
push eax
push 0x12200
call sub.gdi32.dll_ExtCreatePen
mov edx, eax
mov eax, edi
call fcn.00417500
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x1c]
mov edi, dword [eax - 8]
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0x28]
call dword [ebx + 0x24]
mov edx, dword [ebp + 0xc]
mov edx, dword [edx + 0x14]
mov edx, dword [edx + esi*4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
shr ecx, 1
add edx, ecx
add eax, edx
mov dword [ebp - 0xc], eax
mov eax, esi
xor eax, 1
mov edx, dword [ebp + 0xc]
mov edx, dword [edx + 0x14]
mov edx, dword [edx + eax*4]
mov dword [ebp - 0x14], edx
add eax, 2
mov edx, dword [ebp + 0xc]
mov edx, dword [edx + 0x14]
mov eax, dword [edx + eax*4]
mov dword [ebp - 0x18], eax
lea eax, [esi + 2]
mov edx, dword [ebp + 0xc]
mov edx, dword [edx + 0x14]
mov eax, dword [edx + eax*4]
mov edx, dword [ebp - 4]
add eax, dword [edx]
mov dword [ebp - 0x10], eax
xor ebx, ebx
lea eax, [esi + ebx]
mov edx, dword [ebp - 0xc]
mov dword [edi + eax*4], edx
mov eax, esi
xor eax, 1
mov edx, eax
add edx, ebx
mov ecx, dword [ebp - 0x14]
mov dword [edi + edx*4], ecx
add ebx, 2
lea edx, [esi + ebx]
mov ecx, dword [ebp - 0xc]
mov dword [edi + edx*4], ecx
add eax, ebx
mov edx, dword [ebp - 0x18]
mov dword [edi + eax*4], edx
add ebx, 2
inc dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [ecx + 0x28]
call dword [ecx + 0x24]
mov edx, dword [ebp - 4]
add eax, dword [edx]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x10]
jle 0x4ade97
shr ebx, 2
push ebx
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax - 0xc]
push eax
push edi
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x118]
call fcn.00417f90
push eax
call sub.gdi32.dll_PolyPolyline
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4f8828
Capabilities:
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00403e50
push eax
call sub.kernel32.dll_GetFileAttributesA
inc eax
setne al
pop ebx
ret

Function at 0x4fbca0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4fbd57
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5c6a44]
cmp dword [eax], 0
je 0x4fbce1
push 0
mov eax, dword [0x5c6a44]
mov eax, dword [eax]
call fcn.00425df4
push eax
call sub.user32.dll_ShowWindow
mov dl, 1
mov eax, dword [ebx + 0x288]
call fcn.00489e78
mov eax, dword [0x5c69d0]
mov eax, dword [eax]
mov ecx, dword [eax + 0x34]
mov edx, dword [0x5c6d54]
mov edx, dword [edx]
lea eax, [ebp - 4]
call fcn.00403cd8
mov edx, dword [0x5c6aa4]
mov edx, dword [edx]
mov eax, dword [ebp - 4]
call fcn.004a67b8
test eax, eax
jne 0x4fbd41
lea eax, [ebp - 4]
mov edx, dword [0x5c6d04]
mov edx, dword [edx]
call fcn.00403aa8
mov eax, dword [0x5c64a4]
mov eax, dword [eax]
call fcn.00425df4
push eax
mov eax, dword [ebp - 4]
call fcn.00403e50
mov edx, eax
mov ecx, 1
pop eax
call fcn.0059efec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fbd5e
lea eax, [ebp - 4]
call fcn.00403a10
ret

Function at 0x4fff0c
Capabilities:
Hide graphical window

Disassembly:
mov edx, dword [0x5c6a44]
cmp dword [edx], 0
je 0x4fff50
mov eax, dword [eax + 0x288]
cmp byte [eax + 0xc0], 0
je 0x4fff3c
push 0
mov eax, dword [0x5c6a44]
mov eax, dword [eax]
call fcn.00425df4
push eax
call sub.user32.dll_ShowWindow
jmp 0x4fff50
push 4
mov eax, dword [0x5c6a44]
mov eax, dword [eax]
call fcn.00425df4
push eax
call sub.user32.dll_ShowWindow
ret
Function at 0x506e38
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x506fb0
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x5c4c94], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3ac]
mov eax, dword [eax + 0x130]
call fcn.004831ec
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3ac]
mov eax, dword [eax + 0x130]
call fcn.004831cc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x434]
call fcn.004430c8
mov edx, eax
mov eax, dword [0x5c7e4c]
call fcn.0043b80c
mov ebx, eax
test ebx, ebx
je 0x506f7f
mov eax, ebx
call fcn.0043b644
dec eax
test eax, eax
jl 0x506f23
inc eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3ac]
mov eax, dword [eax + 0x130]
call fcn.0048309c
mov esi, eax
lea ecx, [ebp - 0x10]
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0043b674
mov edx, dword [ebp - 0x10]
mov eax, esi
call fcn.00482b74
lea ecx, [ebp - 0x10]
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0043b690
mov edx, dword [ebp - 0x10]
mov eax, dword [esi + 8]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0043b700
mov edx, eax
xor dl, 1
mov eax, esi
call fcn.00482b18
inc dword [ebp - 8]
dec dword [ebp - 0xc]
jne 0x506ec0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3ac]
mov eax, dword [eax + 0x130]
call fcn.004830d8
test eax, eax
jle 0x506f7f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3ac]
mov eax, dword [eax + 0x130]
xor edx, edx
call fcn.00483108
mov cl, 1
mov edx, 3
call fcn.00482ca8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3ac]
mov eax, dword [eax + 0x130]
xor edx, edx
call fcn.00483108
mov cl, 1
mov edx, 2
call fcn.00482ca8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3ac]
mov eax, dword [eax + 0x130]
call fcn.004833c4
mov byte [0x5c4c94], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x506fb7
lea eax, [ebp - 0x10]
call fcn.00403a10
ret
Function at 0x509bd0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x509d09
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f4]
mov dword [ebx + 0xc], eax
mov byte [ebx + 0x10], 0
mov dword [ebx], edx
mov eax, dword [0x5c637c]
mov eax, dword [eax + 0x34]
mov dword [ebx + 0x24], eax
mov eax, dword [0x5c637c]
mov eax, dword [eax + 0x38]
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x50], 0x40
mov dword [ebx + 0x14], ecx
mov eax, dword [0x5c4d88]
sub eax, esi
mov dword [ebx + 0x18], eax
mov edi, dword [ebx + 0x50]
mov eax, ecx
cdq
idiv edi
imul edi
add eax, edi
mov dword [ebx + 0x1c], eax
xor eax, eax
mov dword [ebx + 0x20], eax
mov dword [ebx + 0x38], 0x15
xor eax, eax
mov dword [ebx + 0x30], eax
mov eax, dword [ebx + 0x38]
dec eax
mov dword [ebx + 0x34], eax
mov dword [ebx + 0x40], esi
mov dword [ebx + 0x44], esi
mov dword [ebx + 0x48], esi
mov eax, dword [ebx + 0x38]
dec eax
imul dword [ebx + 0x50]
add esi, eax
dec esi
mov dword [ebx + 0x4c], esi
mov eax, dword [ebx + 0x1c]
mov ecx, dword [ebx + 0x50]
cdq
idiv ecx
imul ecx
add eax, ecx
mov dword [ebx + 0x3c], eax
xor eax, eax
mov dword [ebx + 0x58], eax
xor eax, eax
mov dword [ebx + 0x54], eax
mov byte [ebx + 0x5c], 1
mov edx, ebx
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
call fcn.0058d478
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x509d10
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov dl, 1
call fcn.00422080
mov eax, dword [0x5c4d94]
mov dword [0x5c4dac], eax
mov eax, dword [0x5c4d94]
add eax, dword [0x5c4d8c]
mov dword [0x5c4db4], eax
mov eax, dword [0x5c4dac]
cmp eax, dword [0x5c4db4]
jne 0x509ce6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x264]
mov edx, 2
call fcn.00421b50
jmp 0x509d00
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x268]
mov edx, dword [eax + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x264]
call fcn.00421b50
mov eax, dword [ebp - 4]
call fcn.00509a80
ret
Function at 0x516750
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403e40
xor eax, eax
push ebp
push 0x5168d3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00403e50
mov ebx, eax
push ebx
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x51688d
mov eax, dword [ebp - 8]
call fcn.004026a8
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x516886
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x516833
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov edx, dword [ebp - 8]
call fcn.00402b14
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push ebx
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x5167f9
mov eax, dword [ebp - 0x10]
push 1
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
lea ecx, [edx + 0x248]
movzx edx, word [eax]
mov eax, dword [ebp - 0x10]
call fcn.0058f6c8
jmp 0x516829
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x248]
mov edx, dword [eax]
call dword [edx + 0x94]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x248]
mov eax, dword [eax + 0x154]
mov edx, 0x5168ec
mov ecx, dword [eax]
call dword [ecx + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x51686d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5168bd
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.004026c0
ret
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x248]
mov edx, dword [eax]
call dword [edx + 0x94]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x248]
mov eax, dword [eax + 0x154]
mov edx, 0x516934
mov ecx, dword [eax]
call dword [ecx + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5168da
lea eax, [ebp - 4]
call fcn.00403a10
ret
Function at 0x52ebac
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, edx
test cl, cl
je 0x52ebc1
mov eax, dword [eax + 0x3fc]
call fcn.00448c30
test bl, bl
je 0x52ebe3
mov eax, dword [0x5c6a44]
cmp dword [eax], 0
je 0x52ebe3
push 0
mov eax, dword [0x5c6a44]
mov eax, dword [eax]
call fcn.00425df4
push eax
call sub.user32.dll_ShowWindow
mov ebx, dword [0x5c83fc]
dec ebx
test ebx, ebx
jl 0x52ec27
inc ebx
xor esi, esi
lea ebp, [esi + esi*2]
mov eax, dword [0x5c847c]
mov edi, dword [eax + ebp*8]
test edi, edi
je 0x52ec23
lea eax, [esi + esi*2]
mov edx, dword [0x5c847c]
push edi
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x52ec23
push 0
mov eax, dword [0x5c847c]
mov eax, dword [eax + ebp*8]
push eax
call sub.user32.dll_ShowWindow
inc esi
dec ebx
jne 0x52ebf1
mov esi, 2
mov ebx, 0x5c8498
mov edi, dword [ebx]
test edi, edi
je 0x52ec4b
push edi
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x52ec4b
push 0
mov eax, dword [ebx]
push eax
call sub.user32.dll_ShowWindow
add ebx, 0x18
dec esi
jne 0x52ec31
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x540104
Capabilities:
Hide graphical window

Disassembly:
mov edx, dword [0x5c6a44]
cmp dword [edx], 0
je 0x540194
mov eax, dword [eax + 0x5e8]
cmp byte [eax + 0xc0], 0
je 0x540138
push 0
mov eax, dword [0x5c6a44]
mov eax, dword [eax]
call fcn.00425df4
push eax
call sub.user32.dll_ShowWindow
jmp 0x540194
mov eax, dword [0x5c6a44]
mov eax, dword [eax]
call fcn.00425df4
push eax
call sub.user32.dll_IsIconic
test eax, eax
je 0x540164
push 8
mov eax, dword [0x5c6a44]
mov eax, dword [eax]
call fcn.00425df4
push eax
call sub.user32.dll_ShowWindow
jmp 0x540184
mov eax, dword [0x5c6a44]
mov eax, dword [eax]
call fcn.004300c8
push 4
mov eax, dword [0x5c6a44]
mov eax, dword [eax]
call fcn.00425df4
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x5c7f14]
call fcn.00425df4
push eax
call sub.user32.dll_SetForegroundWindow
ret

Function at 0x545ad0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x545b36
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00403c3c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402b4c
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x545b20
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x545b3d
lea eax, [ebp - 0x10]
call fcn.00403a10
ret
Function at 0x56b4b8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
jle 0x56b4fc
pushal
mov esi, dword [ebp - 4]
mov edi, 0x5c5220
mov ecx, dword [ebp - 8]
mov edx, 0xffffffff
cld
xor eax, eax
lodsb al, byte [esi]
xor eax, edx
and eax, 0xff
mov eax, dword [edi + eax]
shr edx, 8
and edx, 0xffffff
xor edx, eax
loop 0x56b4dc
mov dword [ebp - 0xc], edx
popal
jmp 0x56b501
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x56b508
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 4], eax
mov ebx, 0x3fff
mov eax, 0x5c88e0
xor ecx, ecx
mov edx, ebx
call fcn.00402b14
xor edx, edx
push ebp
push 0x56b57f
push dword fs:[edx]
mov dword fs:[edx], esp
test ebx, ebx
jl 0x56b575
inc ebx
push esi
mov esi, 0x5c88e0
mov edx, dword [0x5c56e0]
xor edx, 0xf455ff
xor esi, edx
mov eax, dword [ebp - 4]
or eax, 2
mov edx, eax
xor edx, 1
mul dx
shr eax, 8
and eax, 0xff
mov ecx, dword [ebp - 4]
shr ecx, 2
mov byte [esi + ecx], al
add dword [ebp - 4], 4
pop esi
dec ebx
jne 0x56b53a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x56b589
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x5728e4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
push ebx
xor edx, edx
mov dword [ebp - 0x64], edx
mov dword [ebp - 0x68], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x572ab1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x3d]
xor ecx, ecx
mov edx, 0x21
call fcn.00402b14
lea eax, [ebp - 0x5e]
xor ecx, ecx
mov edx, 0x21
call fcn.00402b14
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x3d]
mov dword [ebp - 0xc], eax
lea eax, [ebx + 0x2c]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x5e]
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0x1ff
pushal
mov esi, dword [ebp - 4]
mov ecx, dword [ebp - 8]
xor edx, edx
mov ebx, 0x3617e418
mov eax, ebx
xor byte [esi + edx], al
ror ebx, 1
xor ebx, 0xa5a5a5a5
inc edx
dec ecx
jne 0x57295c
popal
lea edx, [ebp - 0x3d]
lea eax, [ebx + 0x2c]
mov ecx, 0x20
call fcn.004027e0
pushal
mov edi, dword [ebp - 0xc]
mov esi, dword [ebp - 0x10]
mov eax, dword [edi]
xor eax, dword [edi + 4]
mov ebx, dword [edi + 8]
xor ebx, dword [edi + 0xc]
mov eax, 0x3617e418
xor dword [edi], eax
mov eax, 0xa935fc2e
xor dword [edi + 4], eax
mov eax, 0x57d872b9
xor dword [edi + 8], eax
mov eax, 0x493db437
xor dword [edi + 0xc], eax
mov eax, dword [edi]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov edi, dword [ebp - 4]
mov eax, dword [edi + 0x20]
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x24]
mov dword [ebp - 0x14], eax
mov edi, dword [ebp - 0xc]
mov eax, 0x3617e418
xor dword [edi], eax
mov eax, 0xa935fc2e
xor dword [edi + 4], eax
mov eax, 0x57d872b9
xor dword [edi + 8], eax
mov eax, 0x493db437
xor dword [edi + 0xc], eax
mov eax, dword [edi]
xor eax, dword [edi + 4]
mov ebx, dword [edi + 8]
xor ebx, dword [edi + 0xc]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ebx
popal
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 8]
jne 0x572a76
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x14]
jne 0x572a76
mov eax, 0x5c5634
lea edx, [ebp - 0x5e]
mov ecx, 0x21
call fcn.00403c3c
lea ecx, [ebp - 0x64]
mov edx, 8
mov eax, dword [ebp - 0x1c]
call fcn.00407490
mov eax, dword [ebp - 0x64]
push eax
lea ecx, [ebp - 0x68]
mov edx, 8
mov eax, dword [ebp - 0x18]
call fcn.00407490
mov edx, dword [ebp - 0x68]
mov eax, 0x5c5638
pop ecx
call fcn.00403cd8
jmp 0x572a96
mov eax, 0x5c5634
mov edx, dword [0x5c5644]
call fcn.00403a64
mov eax, 0x5c5638
mov edx, dword [0x5c5650]
call fcn.00403a64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x572ab8
lea eax, [ebp - 0x68]
mov edx, 2
call fcn.00403a34
ret
Function at 0x582788
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x110], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x582825
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
push 0x23
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x109]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov eax, ebx
lea edx, [ebp - 0x109]
mov ecx, 0x105
call fcn.00403c3c
cmp dword [ebx], 0
jne 0x5827f0
mov eax, ebx
mov edx, dword [0x5c5ee0]
call fcn.00403aa8
jmp 0x58280c
lea edx, [ebp - 0x110]
mov eax, dword [ebx]
call fcn.00582710
mov edx, dword [ebp - 0x110]
mov eax, ebx
mov ecx, esi
call fcn.00403cd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58282c
lea eax, [ebp - 0x110]
call fcn.00403a10
ret

Function at 0x582834
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x110], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x5828d1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
push 0x1a
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x109]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov eax, ebx
lea edx, [ebp - 0x109]
mov ecx, 0x105
call fcn.00403c3c
cmp dword [ebx], 0
jne 0x58289c
mov eax, ebx
mov edx, dword [0x5c5ee0]
call fcn.00403aa8
jmp 0x5828b8
lea edx, [ebp - 0x110]
mov eax, dword [ebx]
call fcn.00582710
mov edx, dword [ebp - 0x110]
mov eax, ebx
mov ecx, esi
call fcn.00403cd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5828d8
lea eax, [ebp - 0x110]
call fcn.00403a10
ret

Function at 0x5828e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x110], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x58297d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
push 5
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x109]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov eax, ebx
lea edx, [ebp - 0x109]
mov ecx, 0x105
call fcn.00403c3c
cmp dword [ebx], 0
jne 0x582948
mov eax, ebx
mov edx, dword [0x5c5ee0]
call fcn.00403aa8
jmp 0x582964
lea edx, [ebp - 0x110]
mov eax, dword [ebx]
call fcn.00582710
mov edx, dword [ebp - 0x110]
mov eax, ebx
mov ecx, esi
call fcn.00403cd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x582984
lea eax, [ebp - 0x110]
call fcn.00403a10
ret