joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f8408
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov bl, byte [0x4f8440]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4f841e
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4f842d
or bl, 4
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4f843c
or bl, 2
mov eax, ebx
pop ebx
ret
Function at 0x50fc88
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
mov edi, dword [ebp + 8]
add edi, 0xfffffff8
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov word [eax], 0
test dl, dl
je 0x50fcc2
test bl, bl
je 0x50fcb3
mov eax, dword [edi]
mov esi, dword [eax + 0x21c]
jmp 0x50fcbd
mov eax, dword [edi]
movzx esi, byte [eax + 0x405]
dec esi
xor bl, 1
jmp 0x50fcd3
mov eax, dword [edi]
mov edx, dword [eax + 0x420]
mov eax, dword [edi]
call fcn.00501088
mov esi, eax
mov eax, esi
test bl, bl
je 0x50fcdc
inc esi
jmp 0x50fcdd
dec esi
mov edx, dword [edi]
cmp esi, dword [edx + 0x21c]
jl 0x50fcf2
mov edx, dword [edi]
movzx esi, byte [edx + 0x405]
jmp 0x50fd12
mov edx, dword [edi]
movzx edx, byte [edx + 0x405]
cmp esi, edx
jge 0x50fd12
mov edx, dword [edi]
mov esi, dword [edx + 0x21c]
mov edx, dword [edi]
movzx edx, byte [edx + 0x405]
sub esi, edx
cmp eax, esi
je 0x50fd56
jmp 0x50fd2e
test bl, bl
je 0x50fd1f
inc esi
jmp 0x50fd20
dec esi
test esi, esi
jl 0x50fd56
mov eax, dword [edi]
cmp esi, dword [eax + 0x21c]
jge 0x50fd56
mov eax, dword [edi]
mov edx, esi
call fcn.0050107c
mov edx, eax
mov eax, dword [edi]
call fcn.0050ec78
test al, al
je 0x50fd18
mov eax, dword [edi]
mov edx, esi
call fcn.0050107c
mov edx, eax
mov eax, dword [edi]
call fcn.0050ed4c
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x510c8c
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff90
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov eax, ebx
call fcn.004dea6c
test al, al
jne 0x510e38
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x150]
test al, al
je 0x510cc6
cmp byte [0x6b6fc0], 0
jne 0x510cc6
mov byte [ebx + 0x43c], 1
cmp byte [ebx + 0x43c], 0
je 0x510cd5
cmp dword [esi + 4], 0
je 0x510d02
test byte [ebx + 0x55], 1
jne 0x510cf4
mov eax, ebx
call fcn.0045bcec
test eax, eax
jne 0x510cf4
mov edx, esi
mov eax, ebx
call fcn.00460d74
jmp 0x510e38
mov edx, esi
mov eax, ebx
call fcn.0045cc70
jmp 0x510e38
push 0
call sub.user32.dll_GetDC
mov edi, eax
mov eax, ebx
call fcn.00458204
push eax
mov eax, ebx
call fcn.004581c0
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x510e31
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x50]
push eax
mov eax, ebx
call fcn.0045f040
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x44]
push eax
mov eax, dword [ebp - 0x48]
push eax
call sub.gdi32.dll_CreateRectRgn
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
call fcn.004aa0e8
push eax
mov ecx, eax
mov edx, 0x14
mov eax, ebx
call fcn.00459988
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectClipRgn
mov eax, dword [ebp - 0x10]
push eax
call sub.gdi32.dll_DeleteObject
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.00510c8c
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x60]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x54]
push eax
lea edx, [ebp - 0x70]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x68]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x50]
push eax
mov eax, ebx
call fcn.0045f040
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x510e38
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x51a6bc
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
test dl, dl
je 0x51a6d6
add esp, 0xfffffff0
call fcn.00403adc
mov esi, ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x51a764
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, edi
call fcn.00403740
mov dword [edi + 4], esi
lea eax, [edi + 0x40]
call fcn.004ec5b0
mov byte [edi + 0x34], 1
mov dl, 1
mov eax, dword [0x41e4b4]
call fcn.00403740
mov dword [edi + 0x28], eax
mov dl, 1
mov eax, dword [0x41e4b4]
call fcn.00403740
mov dword [edi + 0x14], eax
mov dl, 1
mov eax, dword [0x49e648]
call fcn.0049e7e8
mov esi, eax
mov dword [edi + 0x30], esi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x48], 0x51b094
lea eax, [ebp - 0x10]
call fcn.0041b6f0
lea edx, [ebp - 0x10]
lea eax, [edi + 0x18]
call fcn.00412f08
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51a76b
lea eax, [ebp - 0x10]
call fcn.00412bf4
ret
Function at 0x5255f8
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
test dl, dl
je 0x52560d
add esp, 0xfffffff0
call fcn.00403adc
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov esi, eax
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x18]
mov eax, dword [ebp - 8]
call fcn.00404b68
mov eax, dword [ebp + 0x14]
call fcn.00404b68
xor eax, eax
push ebp
push 0x52575a
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, esi
call fcn.00403740
lea eax, [esi + 4]
mov edx, dword [ebp - 8]
call fcn.004046e0
lea eax, [esi + 0x10]
mov edx, dword [ebp + 0x14]
call fcn.004046e0
mov dword [esi + 0xc], edi
mov al, byte [ebp + 0xc]
mov byte [esi + 0x1a], al
mov al, byte [ebp + 8]
mov byte [esi + 0x1c], al
mov byte [esi + 0x1b], 0
mov byte [esi + 0x24], 0
mov byte [esi + 0x26], 1
xor eax, eax
mov dword [esi + 0x28], eax
xor eax, eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x17c]
call fcn.0052454c
test eax, eax
setle al
mov byte [esi + 0x19], al
mov al, byte [0x525784]
mov byte [esi + 0x27], al
mov dl, 1
mov eax, dword [0x41dca4]
call fcn.00403740
mov dword [esi + 8], eax
mov dl, 1
mov eax, dword [0x520834]
call fcn.00403740
mov edi, eax
mov dword [esi + 0x14], edi
mov edx, dword [esi + 0x10]
push edx
mov ecx, edi
mov eax, dword [esi + 0xc]
mov edx, eax
call fcn.0052fcd8
mov byte [esi + 0x18], bl
test bl, 1
je 0x5256e4
mov eax, dword [esi + 0x10]
push eax
mov edx, dword [esi + 0x14]
mov eax, dword [esi + 0xc]
xor ecx, ecx
call fcn.0052ff7c
test bl, 2
je 0x5256fa
mov eax, dword [esi + 0x10]
push eax
mov edx, dword [esi + 0x14]
mov eax, dword [esi + 0xc]
mov cl, 1
call fcn.0052ff7c
test bl, 4
je 0x525710
mov eax, dword [esi + 0x10]
push eax
mov edx, dword [esi + 0x14]
mov eax, dword [esi + 0xc]
mov cl, 2
call fcn.0052ff7c
test bl, 8
je 0x525726
mov eax, dword [esi + 0x10]
push eax
mov edx, dword [esi + 0x14]
mov eax, dword [esi + 0xc]
mov cl, 3
call fcn.0052ff7c
test bl, 0x10
je 0x52573c
mov eax, dword [esi + 0x10]
push eax
mov edx, dword [esi + 0x14]
mov eax, dword [esi + 0xc]
mov cl, 4
call fcn.0052ff7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x525761
lea eax, [ebp - 8]
call fcn.0040468c
lea eax, [ebp + 0x14]
call fcn.0040468c
ret
Function at 0x525788
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
test dl, dl
je 0x5257a0
add esp, 0xfffffff0
call fcn.00403adc
mov esi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov edi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x5258f4
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, ebx
call fcn.00403740
lea eax, [ebx + 4]
mov edx, dword [esi + 0xc]
call fcn.004046e0
lea edx, [ebp - 8]
mov eax, esi
call fcn.004974a0
mov edx, dword [ebp - 8]
lea eax, [ebx + 0x10]
call fcn.004046e0
mov dword [ebx + 0xc], edi
mov byte [ebx + 0x1a], 1
mov byte [ebx + 0x1c], 0
mov byte [ebx + 0x1b], 0
mov byte [ebx + 0x24], 0
mov byte [ebx + 0x26], 1
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x34], eax
mov eax, dword [edi + 0x17c]
call fcn.0052454c
test eax, eax
setle al
mov byte [ebx + 0x19], al
mov al, byte [0x525920]
mov byte [ebx + 0x27], al
mov dl, 1
mov eax, dword [0x41dca4]
call fcn.00403740
mov dword [ebx + 8], eax
mov dl, 1
mov eax, dword [0x520834]
call fcn.00403740
mov dword [ebx + 0x14], eax
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.004974a0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebx + 0x14]
mov edi, dword [ebx + 0xc]
mov edx, edi
mov eax, edi
call fcn.0052fcd8
mov al, byte [esi + 0x20]
call fcn.00523180
mov byte [ebx + 0x18], al
test byte [ebx + 0x18], 1
je 0x52587d
mov eax, dword [ebx + 0x10]
push eax
mov edx, dword [ebx + 0x14]
mov eax, dword [ebx + 0xc]
xor ecx, ecx
call fcn.0052ff7c
test byte [ebx + 0x18], 2
je 0x525894
mov eax, dword [ebx + 0x10]
push eax
mov edx, dword [ebx + 0x14]
mov eax, dword [ebx + 0xc]
mov cl, 1
call fcn.0052ff7c
test byte [ebx + 0x18], 4
je 0x5258ab
mov eax, dword [ebx + 0x10]
push eax
mov edx, dword [ebx + 0x14]
mov eax, dword [ebx + 0xc]
mov cl, 2
call fcn.0052ff7c
test byte [ebx + 0x18], 8
je 0x5258c2
mov eax, dword [ebx + 0x10]
push eax
mov edx, dword [ebx + 0x14]
mov eax, dword [ebx + 0xc]
mov cl, 3
call fcn.0052ff7c
test byte [ebx + 0x18], 0x10
je 0x5258d9
mov eax, dword [ebx + 0x10]
push eax
mov edx, dword [ebx + 0x14]
mov eax, dword [ebx + 0xc]
mov cl, 4
call fcn.0052ff7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5258fb
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004046b0
ret
Function at 0x55b36c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
xor esi, esi
jmp 0x55b3c1
push 0
push eax
mov eax, dword [ebx + 0x1b0]
add eax, esi
push eax
mov eax, dword [ebx + 0x1a4]
push eax
call sub.wsock32.dll_send
test eax, eax
jg 0x55b3b9
call fcn.0055b590
mov dword [esp], eax
mov byte [esp + 4], 0
push esp
push 0
mov ecx, 0x55b3e0
mov dl, 1
mov eax, dword [0x55a810]
call fcn.0040f098
call fcn.00404008
sub dword [ebx + 0x1b4], eax
add esi, eax
mov eax, dword [ebx + 0x1b4]
test eax, eax
jg 0x55b377
xor eax, eax
mov dword [ebx + 0x1b4], eax
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x55bacc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov dl, 1
mov eax, dword [0x55a6e4]
call fcn.0055aa1c
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x55bbda
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [esi + 0x1c]
push eax
call sub.kernel32.dll_InterlockedIncrement_1
mov dword [ebx], eax
call fcn.0055b780
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov eax, dword [ebx + 4]
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
add eax, 0x10
mov edx, dword [ebx + 0x28]
call fcn.00404e00
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
mov dword [edx + 0x2c], eax
mov eax, dword [ebx]
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
mov eax, dword [ebx + 8]
mov edx, dword [ebp - 4]
mov dword [edx + 0x30], eax
mov eax, dword [ebp - 4]
add eax, 0x34
mov edx, dword [ebx + 0xc]
call fcn.00404e00
mov eax, dword [ebx + 0x10]
mov edx, dword [ebp - 4]
mov dword [edx + 0x38], eax
mov eax, dword [ebp - 4]
add eax, 0x3c
mov edx, dword [ebx + 0x14]
call fcn.00404e00
mov eax, dword [ebx + 0x18]
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 4]
add eax, 0x44
mov edx, dword [ebx + 0x1c]
call fcn.00404e00
mov eax, dword [ebx + 0x20]
mov edx, dword [ebp - 4]
mov dword [edx + 0x48], eax
mov eax, dword [ebp - 4]
add eax, 0x4c
mov edx, dword [ebx + 0x24]
call fcn.00404e00
mov eax, dword [ebp - 4]
add eax, 0x50
mov edx, dword [ebx + 0x2c]
call fcn.00404e00
mov eax, dword [ebp - 4]
add eax, 0x54
mov edx, dword [ebx + 0x30]
mov ecx, dword [0x55a6ac]
call fcn.0040611c
mov eax, dword [ebp - 4]
add eax, 0x58
mov edx, dword [ebx + 0x40]
mov ecx, dword [0x55a40c]
call fcn.0040611c
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.0055bccc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x55bbf1
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x570fe0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x57110e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x40]
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 0x30]
call fcn.00490394
dec eax
test eax, eax
jl 0x57107b
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 0x30]
mov edx, dword [ebp - 4]
call fcn.0049035c
mov esi, eax
cmp byte [esi + 0x42], 0
jne 0x571073
mov edx, esi
mov eax, dword [ebx + 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x29c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 0x200]
cmp byte [eax + 0x1b], 0
je 0x571061
mov ecx, dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x48]
mov eax, dword [ebp - 0xc]
cmp byte [eax + 0x50], 0
je 0x571073
mov dl, 1
mov eax, esi
call fcn.00491f40
inc dword [ebp - 4]
dec dword [ebp - 0x10]
jne 0x571020
lea eax, [ebp - 8]
mov edx, dword [0x55cd8c]
call fcn.004060e0
mov eax, dword [ebx + 0xc]
cmp byte [eax + 0xa6], 0
je 0x5710de
lea edx, [ebp - 8]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov eax, dword [ebp - 8]
call fcn.00405e0c
test eax, eax
jl 0x5710de
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [eax + edx*4]
xor edx, edx
call fcn.00491dd8
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [eax + edx*4]
mov dl, 1
call fcn.00491d9c
inc dword [ebp - 4]
dec dword [ebp - 0x10]
jne 0x5710b6
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x60]
mov esi, eax
mov dword [ebx + 0x24], esi
test esi, esi
je 0x5710f2
mov byte [esi + 0x45], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x571115
lea eax, [ebp - 8]
mov edx, dword [0x55cd8c]
call fcn.004060e0
ret
Function at 0x59a9b4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x59aa1a
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.0040490c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00403164
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x59aa04
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59aa21
lea eax, [ebp - 0x10]
call fcn.0040468c
ret
Function at 0x5b0500
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
test dl, dl
je 0x5b0512
add esp, 0xfffffff0
call fcn.00403adc
mov esi, ecx
mov ebx, edx
mov edi, eax
lea eax, [ebp + 8]
call fcn.004053a8
xor eax, eax
push ebp
push 0x5b058e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [esi + 0xc]
xor edx, edx
mov eax, edi
call fcn.005b03e8
mov eax, dword [esi + 0xc]
mov dword [edi + 0x30], eax
lea eax, [edi + 0x34]
mov edx, dword [esi + 4]
call fcn.00404940
lea eax, [edi + 0x38]
mov edx, dword [esi + 8]
call fcn.00404940
mov al, byte [esi + 0x10]
mov byte [edi + 0x3c], al
mov al, byte [esi + 0x11]
mov byte [edi + 0x3d], al
mov ax, word [esi + 0x12]
mov word [edi + 0x3e], ax
lea eax, [edi + 0x40]
mov edx, dword [esi]
call fcn.00404940
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b0595
lea eax, [ebp + 8]
call fcn.00404dc4
ret
Function at 0x5b5168
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x5b5263
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
jl 0x5b5240
mov dword [ebp - 8], 0xf
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00404d04
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00404b78
push eax
call sub.kernel32.dll_GetComputerNameA
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00404d04
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x5b5240
inc eax
mov dword [ebp - 0xc], eax
xor ebx, ebx
lea ecx, [ebp - 0x14]
mov edx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.004097b0
mov eax, dword [ebp - 0x10]
mov edx, 0x5b527c
call fcn.00404ac4
jne 0x5b520a
mov ecx, dword [ebp - 4]
mov edx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x20]
jmp 0x5b523a
push dword [ebp - 4]
push 0x5b5290
lea ecx, [ebp - 0x1c]
mov edx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
push dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404a38
mov ecx, dword [ebp - 0x18]
mov edx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x20]
inc ebx
dec dword [ebp - 0xc]
jne 0x5b51d6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b526a
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.004046b0
lea eax, [ebp - 4]
call fcn.0040468c
ret
Function at 0x5bed24
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x6ba344], 0
jne 0x5bed3b
call fcn.005bece4
mov eax, edi
dec eax
test eax, eax
jl 0x5bed64
inc eax
xor edx, edx

Function at 0x5c12d8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x5c1309
dec al
je 0x5c1345
dec al
je 0x5c1389
dec al
je 0x5c13f4
jmp 0x5c147e
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x5c147e
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x5c1319
jmp 0x5c147e
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5c147e
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x5c1355
jmp 0x5c147e
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5c147e
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x5c13b7
xor ebp, ebp
jmp 0x5c13c8
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x5c13d1
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x5c1399
jmp 0x5c147e
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5c147e
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x5c144c
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.005bed6c
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x5c1408
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5dc348
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
test dl, dl
je 0x5dc35d
add esp, 0xfffffff0
call fcn.00403adc
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404b68
xor eax, eax
push ebp
push 0x5dc438
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.005d7524
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.0041f18c
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x24], eax
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.0041f18c
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x38], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x3c], eax
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.0041f18c
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x30], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x34], eax
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.0041f18c
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x28], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x2c], eax
push 0
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
xor edx, edx
xor eax, eax
call fcn.0041f1b4
push esi
lea edi, [esi + 0x40]
lea esi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
mov dword [esi + 0xc], 0xffffffff
mov byte [esi + 0x52], 0
mov byte [esi + 0x53], 0
mov byte [esi + 0x54], 0
mov byte [esi + 0x55], 0
mov byte [esi + 0x50], 0
mov byte [esi + 0x51], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5dc43f
lea eax, [ebp - 4]
call fcn.0040468c
ret