joyce8/EMBER2024-capa huggingface dataset:
Function at 0x59dc3c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x59dc99
cmp byte [ebx + 0xeb], 0
jne 0x59dc99
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x188]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00409a1c
mov eax, dword [esi]
test eax, eax
je 0x59dc86
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x59dca6
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.00409c74
jmp 0x59dca6
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.00409c74
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x59f4b8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x59f529
mov eax, esi
call fcn.005073e4
test al, al
je 0x59f529
mov eax, dword [ebx + 0x98]
call fcn.00507010
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x59f529
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x134]
test al, al
je 0x59f51a
push 0
mov eax, dword [ebx + 0x98]
call fcn.00507010
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebx + 0x98]
xor edx, edx
call fcn.004fde14
jmp 0x59f529
mov edx, dword [ebx + 0x88]
mov cl, 1
mov eax, ebx
call fcn.0059f2c4
pop esi
pop ebx
ret
Function at 0x5b5fe4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5b60ac
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00409894
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0040e9c0
mov eax, dword [ebp - 4]
test eax, eax
je 0x5b6023
sub eax, 4
mov eax, dword [eax]
mov esi, eax
dec esi
test esi, esi
jl 0x5b6052
inc esi
xor ebx, ebx
movzx eax, di
shr eax, 8
mov edx, dword [ebp - 4]
xor byte [edx + ebx], al
mov eax, dword [ebp - 4]
movzx eax, byte [eax + ebx]
add di, ax
imul ax, di, 0x7bdb
add ax, 0xf5ea
mov edi, eax
inc ebx
dec esi
jne 0x5b602d
mov eax, dword [ebp - 4]
test eax, eax
je 0x5b605e
sub eax, 4
mov eax, dword [eax]
mov esi, eax
dec esi
test esi, esi
jl 0x5b608e
inc esi
xor ebx, ebx
lea ecx, [ebp - 0xc]
mov eax, dword [ebp - 4]
movzx eax, byte [eax + ebx]
mov edx, 2
call fcn.00422114
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.0040a718
mov eax, dword [ebp - 8]
inc ebx
dec esi
jne 0x5b6068
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b60b3
lea eax, [ebp - 0xc]
call fcn.00409894
lea eax, [ebp - 4]
call fcn.004098b8
ret
Function at 0x5b60bc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5b622c
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, ebx
call fcn.0042104c
mov eax, dword [ebp - 8]
test eax, eax
je 0x5b60fd
sub eax, 4
mov eax, dword [eax]
mov edx, eax
sar edx, 1
jns 0x5b6106
adc edx, 0
lea eax, [ebp - 4]
xor ecx, ecx
call fcn.0040a130
mov ebx, 1
xor eax, eax
push ebp
push 0x5b618c
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x5b6176
push 0x5b6248
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 8]
movzx edx, word [edx + ebx*2 - 2]
call fcn.0040a52c
push dword [ebp - 0x18]
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 8]
movzx edx, word [edx + ebx*2]
call fcn.0040a52c
push dword [ebp - 0x1c]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.0040a7f8
mov eax, dword [ebp - 0x14]
call fcn.0042214c
mov edx, ebx
sar edx, 1
jns 0x5b616d
adc edx, 0
mov ecx, dword [ebp - 4]
mov byte [ecx + edx], al
add ebx, 2
mov eax, dword [ebp - 8]
call fcn.00409d60
cmp ebx, eax
jl 0x5b6125
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5b61a5
mov eax, dword [ebp - 4]
test eax, eax
je 0x5b61b1
sub eax, 4
mov eax, dword [eax]
dec eax
test eax, eax
jl 0x5b61e3
inc eax
xor ebx, ebx
mov edx, dword [ebp - 4]
movzx edx, byte [edx + ebx]
mov dword [ebp - 0x10], edx
mov edx, dword [ebp - 4]
movzx ecx, si
shr ecx, 8
xor byte [edx + ebx], cl
add si, word [ebp - 0x10]
imul dx, si, 0x7bdb
add dx, 0xf5ea
mov esi, edx
inc ebx
dec eax
jne 0x5b61b9
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.0040ead4
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc]
call fcn.0040a5fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b6233
lea eax, [ebp - 0x20]
call fcn.004098dc
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.004098f4
lea eax, [ebp - 8]
call fcn.00409894
lea eax, [ebp - 4]
call fcn.004098b8
ret

Function at 0x5b624c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe8
mov ebx, edx
mov esi, eax
mov dl, 1
mov eax, dword [0x47a1f8]
call fcn.0049a3ec
mov edi, eax
mov eax, esi
mov edx, dword [eax]
call dword [edx]
sub eax, 1
sbb edx, 0
mov dword [esp], 0
mov dword [esp + 4], 0
test edx, edx
jl 0x5b62eb
add eax, 1
adc edx, 0
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov eax, dword [esp]
mov ecx, eax
mov eax, dword [esi + 0x14]
movzx eax, byte [eax + ecx]
movzx edx, bx
shr edx, 8
xor al, dl
mov byte [esp + 8], al
mov eax, dword [esi + 0x14]
movzx eax, byte [eax + ecx]
add bx, ax
imul ax, bx, 0x7bdb
add ax, 0xf5ea
mov ebx, eax
lea edx, [esp + 8]
mov ecx, 1
mov eax, edi
mov ebp, dword [eax]
call dword [ebp + 0x10]
add dword [esp], 1
adc dword [esp + 4], 0
mov eax, dword [esp]
cmp eax, dword [esp + 0x10]
jne 0x5b6292
mov eax, dword [esp + 4]
cmp eax, dword [esp + 0x14]
jne 0x5b6292
mov eax, edi
add esp, 0x18
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5bc7a0
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create two anonymous pipes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00409978
mov eax, dword [ebp - 8]
call fcn.00409978
xor eax, eax
push ebp
push 0x5bc96c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x5bc6b8]
call fcn.00407a70
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0x10]
test edx, edx
je 0x5bc7f0
sub edx, 0xfffffff8
call fcn.0040d5fc
mov eax, dword [ebp - 0x10]
mov esi, ebx
mov dword [eax + 0xc], esi
xor edx, edx
push ebp
push 0x5bc90e
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [esi + 0x80]
mov edx, dword [ebp - 4]
call fcn.00409c74
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
add eax, 0x84
mov edx, dword [ebp - 8]
call fcn.00409c74
mov dword [ebp - 0x1c], 0xc
mov dword [ebp - 0x14], 0xffffffff
xor eax, eax
mov dword [ebp - 0x18], eax
push 0
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
lea edx, [eax + 0x58]
push edx
add eax, 0x54
push eax
call sub.kernel32.dll_CreatePipe
push 0
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
lea edx, [eax + 0x60]
push edx
add eax, 0x5c
push eax
call sub.kernel32.dll_CreatePipe
lea eax, [ebp - 0x60]
xor ecx, ecx
mov edx, 0x44
call fcn.004075b8
mov dword [ebp - 0x60], 0x44
mov dword [ebp - 0x34], 0x101
mov word [ebp - 0x30], 0
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax + 0xc]
mov eax, dword [ebx + 0x54]
mov dword [ebp - 0x28], eax
mov eax, dword [ebx + 0x60]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
lea eax, [ebx + 0x6c]
push eax
lea eax, [ebp - 0x60]
push eax
mov eax, dword [ebx + 0x84]
call fcn.0040a504
push eax
push 0
push 0x10
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebx + 0x80]
call fcn.0040a504
push eax
push 0
call sub.kernel32.dll_CreateProcessW
call sub.kernel32.dll_GetLastError
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax + 0xc]
mov eax, dword [ebx + 0x6c]
mov dword [ebx + 0x64], eax
mov eax, dword [ebx + 0x70]
mov dword [ebx + 0x68], eax
lea eax, [ebx + 0x7c]
call fcn.00409894
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
call fcn.004a7950
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5bc949
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5bc973
lea eax, [ebp - 0xc]
call fcn.0040d5e4
lea eax, [ebp - 8]
mov edx, 2
call fcn.004098f4
ret
Function at 0x5bcb74
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x5bcc66
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x5bca70]
call fcn.00407a70
mov ebx, eax
lea eax, [ebp - 8]
mov edx, ebx
test edx, edx
je 0x5bcbb1
sub edx, 0xfffffff8
call fcn.0040d5fc
mov dword [ebx + 0xc], esi
lea eax, [ebp - 0x10]
push eax
push edi
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 0x74]
cmp eax, dword [ebp - 0x10]
je 0x5bcbd4
mov byte [ebp - 9], 1
jmp 0x5bcc48
mov byte [ebp - 9], 0
push edi
call sub.user32.dll_GetWindowTextLengthW
mov esi, eax
test esi, esi
je 0x5bcc48
lea eax, [ebp - 4]
mov edx, esi
call fcn.0040a698
inc esi
push esi
mov eax, dword [ebp - 4]
call fcn.0040a504
push eax
push edi
call sub.user32.dll_GetWindowTextW
test eax, eax
je 0x5bcc48
mov eax, dword [ebp - 4]
call fcn.0040a504
mov edx, eax
lea eax, [ebp - 4]
call fcn.0040a56c
mov esi, dword [ebx + 0xc]
mov eax, dword [esi + 0x7c]
mov edx, dword [ebp - 4]
call fcn.0040a8a8
je 0x5bcc48
lea eax, [esi + 0x7c]
mov edx, dword [ebp - 4]
call fcn.00409c74
mov eax, dword [ebx + 0xc]
cmp word [eax + 0x2a], 0
je 0x5bcc48
mov edx, ebx
test edx, edx
je 0x5bcc43
sub edx, 0xfffffff0
call fcn.004a77e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5bcc6d
lea eax, [ebp - 8]
call fcn.0040d5e4
lea eax, [ebp - 4]
call fcn.00409894
ret

Function at 0x5bcf60
Capabilities:
Terminate process

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
push 0
mov eax, dword [ebx + 0x64]
push eax
call sub.kernel32.dll_TerminateProcess
mov eax, dword [ebx + 0x64]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebx + 0x68]
push eax
call sub.kernel32.dll_CloseHandle
cmp word [ebx + 0x42], 0
je 0x5bcfa6
mov eax, dword [ebx + 0x40]
mov dword [esp], eax
mov eax, dword [ebx + 0x44]
mov dword [esp + 4], eax
push dword [esp + 4]
push dword [esp + 4]
mov eax, ebx
call fcn.004a7764
mov eax, ebx
call fcn.004a79f0
pop ecx
pop edx
pop ebx
ret
Function at 0x5bd234
Capabilities:
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x100c], ebx
mov esi, edx
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x5bd2f5
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0
push esi
call sub.kernel32.dll_PeekNamedPipe
cmp dword [ebp - 4], 0
jle 0x5bd2dc
lea eax, [ebp - 0x1008]
xor ecx, ecx
mov edx, 0x1000
call fcn.004075b8
push 0
lea eax, [ebp - 8]
push eax
push 0x1000
lea eax, [ebp - 0x1008]
push eax
push esi
call sub.kernel32.dll_ReadFile
lea eax, [ebp - 0x1008]
push eax
lea eax, [ebp - 0x1008]
push eax
call sub.user32.dll_OemToCharW
lea eax, [ebp - 0x100c]
lea edx, [ebp - 0x1008]
mov ecx, 0x1000
call fcn.0040a5a8
mov edx, dword [ebp - 0x100c]
mov eax, ebx
call fcn.0040a718
cmp dword [ebp - 8], 0
jbe 0x5bd276
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5bd2fc
lea eax, [ebp - 0x100c]
call fcn.00409894
ret

Function at 0x5bf52c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0040a504
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x5bf545
test al, 0x10
jne 0x5bf549
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x5bf584
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
test ebx, ebx
je 0x5bf5a2
push ebx
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x5bf59a
test al, 0x10
je 0x5bf59e
xor eax, eax
jmp 0x5bf5a4
mov al, 1
pop ebx
ret
xor eax, eax
pop ebx
ret

Function at 0x5bf738
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x5bf7ea
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
mov eax, esi
call fcn.0040a504
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
jbe 0x5bf7d4
lea eax, [ebp - 4]
mov edx, edi
call fcn.0040a698
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
push eax
push edi
mov eax, dword [ebp - 0x10]
push eax
mov eax, esi
call fcn.0040a504
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x5bf7d4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x5bf7fc
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x5bf7d4
cmp dword [ebp - 0xc], 0x34
jne 0x5bf7d4
mov bl, 1
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 8]
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5bf7f1
lea eax, [ebp - 4]
call fcn.00409894
ret
Function at 0x5bf828
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov byte [ebp - 5], cl
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5bf8ac
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x23]
mov edx, 0x1e
call fcn.005c5778
mov dword [ebp - 0x23], ebx
mov dword [ebp - 0x1f], 3
lea eax, [ebp - 4]
mov ecx, 0x5bf8c8
mov edx, esi
call fcn.0040a770
mov eax, dword [ebp - 4]
call fcn.0040a504
mov dword [ebp - 0x1b], eax
movzx eax, byte [ebp - 5]
call fcn.005bf800
mov word [ebp - 0x13], ax
lea eax, [ebp - 0x23]
push eax
call sub.shell32.dll_SHFileOperationW
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5bf8b3
lea eax, [ebp - 4]
call fcn.00409894
ret
Function at 0x5c25f8
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5c2852
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
mov edx, 0x24
call fcn.005c5778
lea eax, [ebp - 0x28]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x14]
mov dword [0x6a9a84], eax
mov eax, dword [ebp - 0xc]
mov dword [0x6a9a88], eax
mov eax, dword [ebp - 0x24]
mov dword [0x6a9a8c], eax
mov eax, dword [0x72b1d4]
cmp dword [eax], 2
sete byte [0x6a9225]
push 0x5c2860
call sub.kernel32.dll_GetModuleHandleW
lea edx, [ebp - 4]
call fcn.005bf708
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp byte [0x6a9225], 0
jne 0x5c2687
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.005bf738
test al, al
je 0x5c2687
mov eax, dword [ebp - 0x4c]
mov dword [0x732748], eax
jmp 0x5c268e
xor eax, eax
mov dword [0x732748], eax
call fcn.005bf8e4
and eax, 0x7f
cmp eax, 0x1a
ja case.0x5c269f.0
jmp dword [eax*4 + 0x5c26a6]
mov byte [0x6a9220], 1
jmp case.0x5c269f.0
mov byte [0x6a9221], 1
jmp case.0x5c269f.0
mov byte [0x6a9222], 1
jmp case.0x5c269f.0
mov byte [0x6a9223], 1
jmp case.0x5c269f.0
mov byte [0x6a9224], 1
jmp case.0x5c269f.0
mov byte [0x6a9226], 1
mov byte [0x6a9227], 1
jmp case.0x5c269f.0
mov byte [0x6a9226], 1
mov byte [0x6a9228], 1
jmp case.0x5c269f.0
mov byte [0x6a9226], 1
mov byte [0x6a9228], 1
mov byte [0x6a9229], 1
jmp case.0x5c269f.0
mov byte [0x6a922a], 1
jmp case.0x5c269f.0
mov byte [0x6a922b], 1
jmp case.0x5c269f.0
mov byte [0x6a922c], 1
jmp case.0x5c269f.0
mov byte [0x6a922d], 1
jmp case.0x5c269f.0
mov byte [0x6a922e], 1
jmp case.0x5c269f.0
mov byte [0x6a922f], 1
jmp case.0x5c269f.0
mov byte [0x6a9230], 1
jmp case.0x5c269f.0
mov byte [0x6a9231], 1
jmp case.0x5c269f.0
mov byte [0x6a9232], 1
jmp case.0x5c269f.0
mov byte [0x6a9233], 1
jmp case.0x5c269f.0
mov byte [0x6a9234], 1
jmp case.0x5c269f.0
mov byte [0x6a9235], 1
jmp case.0x5c269f.0
mov byte [0x6a9236], 1
jmp case.0x5c269f.0
mov byte [0x6a9237], 1
jmp case.0x5c269f.0
mov byte [0x6a9238], 1
jmp case.0x5c269f.0
mov byte [0x6a9239], 1
jmp case.0x5c269f.0
mov byte [0x6a923a], 1
jmp case.0x5c269f.0
mov byte [0x6a923b], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c2859
lea eax, [ebp - 4]
call fcn.00409894
ret

Function at 0x5c383c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor edx, edx
mov dword [ebp - 0x14], edx
xor edx, edx
push ebp
push 0x5c38a0
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 0xe]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xe]
mov ecx, 7
call fcn.0040a5c0
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00422188
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c38a7
lea eax, [ebp - 0x14]
call fcn.00409894
ret
Function at 0x5c4ddc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5c4e72
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x72b1d4]
cmp dword [eax], 2
jne 0x5c4e1c
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push edi
push esi
push ebx
call sub.advapi32.dll_RegQueryValueExW
mov ebx, eax
jmp 0x5c4e54
lea eax, [ebp - 8]
mov edx, esi
call fcn.0040a228
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, 0
call fcn.0040a04c
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push edi
mov eax, dword [ebp - 4]
call fcn.0040a118
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c4e79
lea eax, [ebp - 8]
call fcn.004098dc
lea eax, [ebp - 4]
call fcn.004098b8
ret

Function at 0x5c5210
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esi], eax
xor eax, eax
mov dword [ebp - 8], eax
push 0x20019
lea eax, [ebp - 8]
push eax
mov eax, edi
call fcn.0040a504
mov edx, eax
mov eax, ebx
call fcn.005c4c48
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.005c4d24
test eax, eax
sete al
mov ebx, eax
test bl, bl
je 0x5c5282
push 0
push 0
push esi
push 0
mov eax, dword [ebp - 4]
call fcn.0040a504
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
sete bl
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x5d42b4
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x5d42e2
mov eax, ebx
call fcn.005d4d70
cmp dword [ebx + 0x40], 0
je 0x5d42db
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x5d4353
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x5d4345
cmp dword [ebx + 8], 0
je 0x5d4304
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x5d4316
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x5d4345
cmp dword [ebx + 8], 0
je 0x5d42f7
cmp eax, 3
je 0x5d4329
dec eax
jne 0x5d42f7
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x5d42f7
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x5d42f7
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x5d4371
cmp dword [ebx + 0x14], 0xcc
je 0x5d4371
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.005d437c
pop ebx
ret

Function at 0x5e8988
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x7b3b94], 0
jne 0x5e899f
call fcn.005e8944
mov eax, edi
dec eax
test eax, eax
jl 0x5e89c7
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x7b3794]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x5e89a9
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x5eb994
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x5eb9c5
dec al
je 0x5eba00
dec al
je 0x5eba44
dec al
je 0x5ebab6
jmp 0x5ebb51
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x5ebb51
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x5eb9d5
jmp 0x5ebb51
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5ebb51
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
movzx ecx, al
mov ecx, dword [ebx + ecx*4 + 0x40]
add dl, byte [ecx + esi]
and dl, 0xff
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x5eba10
jmp 0x5ebb51
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5ebb51
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
jbe 0x5eba77
xor edx, edx
mov dword [esp + 4], edx
jmp 0x5eba8c
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov ebp, dword [ebx + edx*4 + 0x40]
movzx edx, byte [ebp + esi]
add eax, dword [esp + 4]
sar eax, 1
jns 0x5ebaa4
adc eax, 0
add dl, al
and dl, 0xff
mov byte [ebp + esi], dl
inc esi
dec edi
jne 0x5eba54
jmp 0x5ebb51
xor eax, eax
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5ebb51
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
ja 0x5ebb1d
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 8], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 8]
push eax
movzx eax, byte [esp + 8]
pop edx
call fcn.005e89d0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [esp]
and al, 0xff
mov byte [edx + esi], al
inc esi
dec edi
jne 0x5ebad2
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret