joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55a890
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x55aa85
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004dd254
test eax, eax
je 0x55aa3b
mov eax, dword [esi + 0x20c]
call fcn.004d9d40
mov ebx, eax
dec ebx
cmp ebx, 0
jl 0x55a9fa
mov eax, dword [esi + 0x20c]
mov edx, ebx
call fcn.004d9d70
mov edx, 3
call fcn.004d98a0
test al, al
je 0x55a9f0
cmp dword [ebp - 8], 1
jne 0x55a941
mov eax, dword [esi + 0x20c]
mov edx, ebx
call fcn.004d9d70
mov eax, dword [eax + 8]
lea ecx, [ebp - 0x10]
mov edx, 7
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x10]
push eax
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
call fcn.00490074
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0xc]
pop ecx
call fcn.004043c4
jmp 0x55a95e
mov eax, dword [esi + 0x20c]
mov edx, ebx
call fcn.004d9d70
mov eax, dword [eax + 8]
lea ecx, [ebp - 0xc]
mov edx, 4
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0xc]
call fcn.0040c3e0
test al, al
je 0x55a9dd
xor eax, eax
push ebp
push 0x55a9a0
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
mov eax, dword [ebp - 0xc]
call fcn.0040453c
push eax
push 0x55aa94
push 0x55aaa0
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x55a9f0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
call fcn.004dd254
call fcn.004d96a8
dec ebx
cmp ebx, 0xffffffff
jne 0x55a8dc
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0xb0]
xor eax, eax
push ebp
push 0x55aa2f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004dd254
mov cl, 1
mov edx, 3
call fcn.004d9908
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x55aa62
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30c]
mov eax, dword [eax + 0x1f0]
mov edx, 1
call fcn.004d0640
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x3b0]
call fcn.004d05b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55aa8c
lea eax, [ebp - 0x14]
call fcn.004040dc
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404100
ret
Function at 0x581164
Capabilities:
Query service status
Stop service

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe4
mov edi, eax
mov ebp, 0x3c
xor esi, esi
push 1
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov ebx, eax
test ebx, ebx
je 0x5811e7
push 0xf01ff
push edi
push ebx
call sub.advapi32.dll_OpenServiceA
mov edi, eax
test edi, edi
je 0x5811e1
push esp
push 1
push edi
call sub.advapi32.dll_ControlService
test eax, eax
je 0x5811db
push 0x3e8
call sub.kernel32.dll_Sleep
jmp 0x5811c6
cmp dword [esp + 4], 3
jne 0x5811d1
push 0x3e8
call sub.kernel32.dll_Sleep
dec ebp
test ebp, ebp
je 0x5811d1
push esp
push edi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
jne 0x5811b0
cmp dword [esp + 4], 1
jne 0x5811db
or esi, 0xffffffff
push edi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
mov eax, esi
add esp, 0x1c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x581250
Capabilities:
Query service status
Start service

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe0
mov esi, eax
mov ebp, 0x3c
mov dword [esp], esi
xor edi, edi
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov ebx, eax
cmp ebx, 5
je 0x5812fe
cmp ebx, 0x57
je 0x5812fe
cmp ebx, 0x429
je 0x5812fe
push 0xf01ff
push esi
push ebx
call sub.advapi32.dll_OpenServiceA
mov esi, eax
cmp esi, 5
je 0x5812f8
cmp esi, 0x7b
je 0x5812f8
cmp esi, 6
je 0x5812f8
cmp esi, 0x424
je 0x5812f8
push esp
push 0
push esi
call sub.advapi32.dll_StartServiceA
push 0x3e8
call sub.kernel32.dll_Sleep
jmp 0x5812d9
cmp dword [esp + 8], 2
jne 0x5812e8
push 0x3e8
call sub.kernel32.dll_Sleep
dec ebp
test ebp, ebp
je 0x5812e8
lea eax, [esp + 4]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
jne 0x5812c3
cmp dword [esp + 8], 4
jne 0x5812f2
or edi, 0xffffffff
push esi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
mov eax, edi
add esp, 0x20
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x581318
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040452c
xor eax, eax
push ebp
push 0x5813b3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.00402f28
lea eax, [ebp - 0x5c]
xor ecx, ecx
mov edx, 0x10
call fcn.00402f28
mov dword [ebp - 0x4c], 0x44
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 0x220
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040453c
push eax
push 0
call sub.kernel32.dll_CreateProcessA
neg eax
sbb ebx, ebx
neg ebx
test byte [ebp - 5], bl
je 0x58139d
push 0xffffffffffffffff
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_WaitForSingleObject
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5813ba
lea eax, [ebp - 4]
call fcn.004040dc
ret
Function at 0x5817cc
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa4
mov dword [esp + 4], ecx
mov dword [esp], edx
mov esi, 0x30
mov edi, 0x6627bc
mov ecx, dword [esp]
lea edx, [esp + 0xc]
xor ebx, ebx
mov bl, byte [edi]
mov bl, byte [eax + ebx - 1]
xor bl, byte [ecx]
mov byte [edx], bl
inc edx
inc ecx
inc edi
dec esi
jne 0x5817eb
mov esi, 1
mov edx, 0x6628c4
mov ecx, esi
dec ecx
mov eax, ecx
add eax, eax
lea eax, [eax + eax*2]
shl ecx, 2
xor ebx, ebx
mov bl, byte [esp + eax + 0xc]
mov edi, ebx
add edi, edi
xor ebx, ebx
mov bl, byte [esp + eax + 0x11]
add edi, ebx
xor ebx, ebx
mov bl, byte [esp + eax + 0xd]
shl ebx, 3
movzx ebp, byte [esp + eax + 0xe]
shl ebp, 2
add ebx, ebp
movzx ebp, byte [esp + eax + 0xf]
add ebp, ebp
add ebx, ebp
movzx eax, byte [esp + eax + 0x10]
add ebx, eax
mov dword [esp + 8], ebx
mov eax, 1
mov ebx, eax
dec ebx
je 0x581865
dec ebx
je 0x581889
dec ebx
je 0x5818ad
dec ebx
je 0x5818d0
jmp 0x5818e9
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
mov bl, byte [ebx + ebp - 0x40]
and bl, 8
and ebx, 0xff
shr ebx, 3
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x5818e9
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
mov bl, byte [ebx + ebp - 0x40]
and bl, 4
and ebx, 0xff
shr ebx, 2
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x5818e9
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
mov bl, byte [ebx + ebp - 0x40]
and bl, 2
and ebx, 0xff
shr ebx, 1
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x5818e9
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
mov bl, byte [ebx + ebp - 0x40]
and bl, 1
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
inc eax
cmp eax, 5
jne 0x581852
inc esi
add edx, 0x40
cmp esi, 9
jne 0x581807
mov esi, 0x20
mov eax, 0x6627ec
mov edx, dword [esp + 4]
xor ecx, ecx
mov cl, byte [eax]
mov cl, byte [esp + ecx + 0x3b]
mov byte [edx], cl
inc edx
inc eax
dec esi
jne 0x58190e
add esp, 0x5c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x581948
Capabilities:
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], ecx
mov esi, eax
xor eax, eax
mov al, dl
mov bl, byte [eax + 0x662873]
test bl, bl
jbe 0x581979
lea eax, [esi + 0x3e0]
call fcn.00581928
lea eax, [esi + 0x3fc]
call fcn.00581928
dec bl
jne 0x58195f
mov cl, 0x30
mov edi, 0x662844
mov eax, dword [esp]
mov dl, byte [edi]
cmp dl, 0x1c
ja 0x58199b
and edx, 0xff
mov dl, byte [esi + edx + 0x3df]
mov byte [eax], dl
jmp 0x5819aa
and edx, 0xff
mov dl, byte [esi + edx + 0x3df]
mov byte [eax], dl
inc eax
inc edi
dec cl
jne 0x581983
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x5819b8
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbdc
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov bl, 1
lea esi, [ebp - 0x421]
mov eax, edi
mov edx, ebx
call fcn.00581760
mov byte [esi], al
inc ebx
inc esi
cmp bl, 0x41
jne 0x5819d4
mov bl, 0x1c
mov esi, 0x66280c
lea edi, [ebp - 0x41]
mov dl, byte [esi]
mov eax, dword [ebp - 8]
call fcn.00581760
mov byte [edi], al
mov dl, byte [esi + 0x1c]
mov eax, dword [ebp - 8]
call fcn.00581760
mov byte [edi + 0x1c], al
inc edi
inc esi
dec bl
jne 0x5819f0
mov bl, 1
lea esi, [ebp - 0x3a1]
mov ecx, esi
lea eax, [ebp - 0x421]
mov edx, ebx
call fcn.00581948
inc ebx
add esi, 0x30
cmp bl, 0x11
jne 0x581a18
mov bl, 1
mov eax, 0x66273c
lea edx, [ebp - 0xa1]
cmp bl, 0x20
ja 0x581a51
xor ecx, ecx
mov cl, byte [eax]
mov cl, byte [ebp + ecx - 0x422]
mov byte [edx], cl
jmp 0x581a5e
xor ecx, ecx
mov cl, byte [eax]
mov cl, byte [ebp + ecx - 0x422]
mov byte [edx], cl
inc ebx
inc edx
inc eax
cmp bl, 0x41
jne 0x581a3d
mov byte [ebp - 9], 1
lea esi, [ebp - 0x3a1]
cmp byte [ebp + 8], 0
je 0x581a88
lea ecx, [ebp - 0x61]
mov edx, esi
lea eax, [ebp - 0x81]
call fcn.005817cc
jmp 0x581ab0
xor eax, eax
mov al, byte [ebp - 9]
mov edx, 0x11
sub edx, eax
mov eax, edx
add eax, eax
lea eax, [eax + eax*2]
lea edx, [ebp + eax*8 - 0x3d1]
lea ecx, [ebp - 0x61]
lea eax, [ebp - 0x81]
call fcn.005817cc
mov bl, 0x20
lea eax, [ebp - 0xa1]
mov dl, byte [eax]
xor byte [eax + 0x40], dl
inc eax
dec bl
jne 0x581ab8
push esi
lea esi, [ebp - 0x81]
lea edi, [ebp - 0xa1]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
push esi
lea esi, [ebp - 0x61]
lea edi, [ebp - 0x81]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
inc byte [ebp - 9]
add esi, 0x30
cmp byte [ebp - 9], 0x11
jne 0x581a70
mov bl, 0x40
mov esi, 0x66277c
lea eax, [ebp - 0x3e1]
mov dl, byte [esi]
cmp dl, 0x20
ja 0x581b1e
and edx, 0xff
mov dl, byte [ebp + edx - 0x82]
mov byte [eax], dl
jmp 0x581b2d
and edx, 0xff
mov dl, byte [ebp + edx - 0xc2]
mov byte [eax], dl
inc eax
inc esi
dec bl
jne 0x581b06
mov bl, 1
lea esi, [ebp - 0x3e1]
mov cl, byte [esi]
mov eax, dword [ebp - 4]
mov edx, ebx
call fcn.00581788
inc ebx
inc esi
cmp bl, 0x41
jne 0x581b3b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x582980
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebp, ecx
mov dword [esp], edx
mov esi, eax
mov dl, byte [esi]
mov byte [esp + 4], dl
shl edx, 7
and dl, 0xff
mov al, byte [esi + 1]
xor ecx, ecx
mov cl, al
shr ecx, 1
or dl, cl
mov byte [esp + 5], dl
shl eax, 6
and al, 0xff
mov dl, byte [esi + 2]
xor ecx, ecx
mov cl, dl
shr ecx, 2
or al, cl
mov byte [esp + 6], al
shl edx, 5
and dl, 0xff
mov al, byte [esi + 3]
xor ecx, ecx
mov cl, al
shr ecx, 3
or dl, cl
mov byte [esp + 7], dl
shl eax, 4
and al, 0xff
xor edx, edx
mov dl, byte [esi + 4]
shr edx, 4
or al, dl
mov byte [esp + 8], al
mov al, byte [esi + 4]
shl eax, 3
and al, 0xff
xor edx, edx
mov dl, byte [esi + 5]
shr edx, 5
or al, dl
mov byte [esp + 9], al
mov al, byte [esi + 5]
shl eax, 2
and al, 0xff
xor edx, edx
mov dl, byte [esi + 6]
shr edx, 6
or al, dl
mov byte [esp + 0xa], al
mov al, byte [esi + 6]
add eax, eax
and al, 0xff
mov byte [esp + 0xb], al
mov edi, 8
lea eax, [esp + 4]
mov edx, 1
xor esi, esi
mov ecx, edx
xor ebx, ebx
mov bl, byte [eax]
shl ebx, cl
mov ecx, ebx
xor ecx, esi
and ecx, 1
mov esi, ecx
inc edx
cmp edx, 8
jne 0x582a2c
mov dl, byte [eax]
and dl, 0xfe
mov ecx, esi
or dl, cl
mov byte [eax], dl
inc eax
dec edi
jne 0x582a27
mov eax, ebp
mov edx, 8
call fcn.004046ac
push 1
mov eax, ebp
call fcn.00404548
mov edx, eax
lea ecx, [esp + 8]
mov eax, dword [esp + 4]
call fcn.005819b8
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5921e8
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
shl eax, 2
mov ecx, 3
cdq
idiv ecx
mov ebx, eax
mov edx, ebx
add edx, 4
mov eax, esi
call fcn.004046ac
mov eax, esi
call fcn.00404548
push eax
mov edx, ebx
add edx, 2
xor ecx, ecx
pop eax
call fcn.00402f28
cmp byte [ebp - 1], 0
jne 0x59225b
mov eax, esi
call fcn.00404548
mov dl, byte [ebp - 0xc]
dec edx
and dl, 0x3f
add dl, 0x21
mov byte [eax], dl
mov eax, dword [ebp - 0xc]
add eax, 2
mov ecx, 3
cdq
idiv ecx
lea eax, [eax + eax*2]
mov dword [ebp - 0xc], eax
mov edi, 2
xor eax, eax
mov dword [ebp - 0x10], eax
xor ebx, ebx
mov al, byte [ebp - 1]
sub al, 1
jb 0x592274
sub al, 2
jb 0x59227b
jmp 0x592280
mov ebx, 2
jmp 0x592280
mov ebx, 1
mov eax, esi
call fcn.00404548
mov byte [eax + ebx - 1], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jge 0x592362
test edi, edi
jle 0x5922dc
mov eax, esi
call fcn.00404548
lea eax, [eax + ebx - 1]
push eax
mov ecx, edi
mov eax, 0x3f
shl eax, cl
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
movzx edx, byte [edx + ecx]
and eax, edx
mov ecx, edi
shr eax, cl
mov edx, dword [esi]
or al, byte [edx + ebx - 1]
pop edx
mov byte [edx], al
sub edi, 6
inc ebx
mov eax, esi
call fcn.00404548
mov byte [eax + ebx - 1], 0
jmp 0x592356
test edi, edi
jge 0x592322
mov eax, edi
cdq
xor eax, edx
sub eax, edx
mov edi, eax
mov eax, esi
call fcn.00404548
lea eax, [eax + ebx - 1]
push eax
mov ecx, edi
mov eax, 0x3f
shr eax, cl
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
and al, byte [edx + ecx]
mov ecx, edi
shl al, cl
mov edx, dword [esi]
or al, byte [edx + ebx - 1]
pop edx
mov byte [edx], al
mov eax, 8
sub eax, edi
mov edi, eax
inc dword [ebp - 0x10]
jmp 0x592356
mov eax, esi
call fcn.00404548
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov dl, byte [edx + ecx]
and dl, 0x3f
mov ecx, dword [esi]
mov cl, byte [ecx + ebx - 1]
or dl, cl
mov byte [eax + ebx - 1], dl
inc ebx
inc dword [ebp - 0x10]
mov eax, esi
call fcn.00404548
mov byte [eax + ebx - 1], 0
mov edi, 2
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jl 0x592298
mov al, byte [ebp - 1]
sub al, 1
jb 0x592372
sub al, 2
jb 0x5923ab
jmp 0x5923f2
cmp edi, 2
jne 0x592378
dec ebx
mov eax, ebx
sub eax, 2
jl 0x5923f2
inc eax
mov dword [ebp - 0x14], eax
mov edi, 2
mov eax, esi
call fcn.00404548
mov edx, dword [esi]
movzx edx, byte [edx + edi - 1]
mov ecx, dword [0x662bd0]
mov dl, byte [ecx + edx]
mov byte [eax + edi - 1], dl
inc edi
dec dword [ebp - 0x14]
jne 0x592388
jmp 0x5923f2
cmp edi, 2
jne 0x5923b1
dec ebx
test ebx, ebx
jle 0x5923ed
mov dword [ebp - 0x14], ebx
mov edi, 1
mov eax, esi
call fcn.00404548
mov edx, dword [esi]
movzx edx, byte [edx + edi - 1]
mov ecx, dword [0x662bd4]
mov dl, byte [ecx + edx]
mov byte [eax + edi - 1], dl
inc edi
dec dword [ebp - 0x14]
jne 0x5923bd
jmp 0x5923ed
inc ebx
mov eax, esi
call fcn.00404548
mov byte [eax + ebx - 1], 0x3d
test bl, 3
jne 0x5923e0
mov eax, esi
mov edx, ebx
call fcn.004046ac
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x59cfe8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x59d09b
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
lea edx, [ebp - 0xc]
mov eax, dword [0x663c8c]
mov eax, dword [eax]
call fcn.004af6b8
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.0040c65c
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, 0x59d0b4
call fcn.004043c4
mov edx, esi
mov ecx, dword [ebp - 4]
mov eax, ebx
call fcn.0059bea8
mov eax, dword [ebx + 0x30c]
mov eax, dword [eax + 0x230]
mov edx, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x58]
push 5
mov eax, dword [ebx + 0x620]
call fcn.0040453c
push eax
mov eax, dword [ebp - 4]
call fcn.0040453c
push eax
push 0x59d0c4
push 0x59d0d0
mov eax, ebx
call fcn.0049625c
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59d0a2
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404100
ret
Function at 0x5b2ce0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x5b2ce8
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x5b2e7f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x24]
mov ecx, 0x5b2e98
mov edx, dword [esi + 0x30c]
call fcn.004043c4
mov ecx, dword [ebp - 0x24]
mov dl, 1
mov eax, dword [0x4c228c]
call fcn.004c2334
mov dword [ebp - 4], eax
lea edx, [ebp - 0x2c]
mov eax, dword [esi + 0x2e4]
call fcn.00490074
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.0040bd9c
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 8]
call fcn.0040bb08
mov eax, dword [ebp - 8]
call fcn.00404378
mov edi, eax
test edi, edi
jle 0x5b2e06
mov dword [ebp - 0x1c], 1
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
mov al, byte [eax + edx - 1]
xor al, 0x4b
and eax, 0xff
lea ecx, [ebp - 0xc]
mov edx, 2
call fcn.0040c1d8
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0xc]
mov dl, byte [edx]
call fcn.00404284
lea ecx, [ebp - 0x10]
lea edx, [ebp - 0x20]
mov eax, esi
call fcn.005b281c
mov eax, dword [ebp - 0x10]
call fcn.0040c254
mov ebx, eax
add ebx, 0x41
lea eax, [ebp - 0x30]
mov edx, ebx
call fcn.00404284
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 0x14]
call fcn.00404380
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0xc]
mov dl, byte [edx + 1]
call fcn.00404284
lea ecx, [ebp - 0x10]
lea edx, [ebp - 0x18]
mov eax, esi
call fcn.005b281c
mov eax, dword [ebp - 0x10]
call fcn.0040c254
mov ebx, eax
add ebx, 0x41
lea eax, [ebp - 0x34]
mov edx, ebx
call fcn.00404284
mov edx, dword [ebp - 0x34]
lea eax, [ebp - 0x14]
call fcn.00404380
inc dword [ebp - 0x1c]
dec edi
jne 0x5b2d65
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0x14]
call fcn.0040bd9c
mov eax, dword [ebp - 0x38]
push eax
mov ecx, 0x5b2eac
mov edx, 0x5b2ec4
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 4]
call fcn.004032b4
lea edx, [ebp - 0x3c]
mov eax, dword [ebp - 0x14]
call fcn.0040bd9c
mov eax, dword [ebp - 0x3c]
call fcn.004fad98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b2e86
lea eax, [ebp - 0x3c]
mov edx, 4
call fcn.00404100
lea eax, [ebp - 0x2c]
call fcn.004040dc
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.00404100
lea eax, [ebp - 0x18]
mov edx, 5
call fcn.00404100
ret
Function at 0x601114
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov esi, eax
push esp
push 0x21
push ebx
call sub.shell32.dll_SHGetSpecialFolderLocation
call fcn.00412718
test al, al
je 0x60114f
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.0040430c
add esp, 0x10c
pop esi
pop ebx
ret

Function at 0x601f3c
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
xor eax, eax
push ebp
push 0x60207a
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 4]
call fcn.004f2584
lea ecx, [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, 0x602090
call fcn.00601c50
cmp dword [ebp - 8], 0
jne 0x602000
lea ecx, [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, 0x6020b0
call fcn.00601c50
cmp dword [ebp - 8], 0
je 0x601fbd
push 0x80
push 0x6020c8
call sub.kernel32.dll_SetFileAttributesA
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.0040c65c
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov edx, 0x6020b0
call fcn.004fb4f4
mov bl, 1
jmp 0x60202b
lea ecx, [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, 0x6020e8
call fcn.00601c50
cmp dword [ebp - 8], 0
je 0x60202b
push 0x80
push 0x602104
call sub.kernel32.dll_SetFileAttributesA
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.0040c65c
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov edx, 0x6020e8
call fcn.004fb4f4
mov bl, 1
jmp 0x60202b
push 0x80
push 0x602120
call sub.kernel32.dll_SetFileAttributesA
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.0040c65c
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov edx, 0x602090
call fcn.004fb4f4
mov bl, 1
test bl, bl
je 0x60205f
lea ecx, [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, 0x602140
call fcn.00601db4
cmp dword [ebp - 8], 0
je 0x60205f
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 8]
call fcn.0040c65c
mov eax, dword [ebp - 0x18]
mov cl, 1
mov edx, 0x602158
call fcn.004fb4f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x602081
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.00404100
ret
Function at 0x6030ec
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe10
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x1f0], eax
mov dword [ebp - 0x1ec], eax
mov dword [ebp - 0x1e8], eax
mov dword [ebp - 0x1e4], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x60333a
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x1e4]
xor eax, eax
call fcn.00402c1c
mov eax, dword [ebp - 0x1e4]
lea edx, [ebp - 8]
call fcn.0040c65c
lea eax, [ebp - 8]
mov edx, 0x603350
call fcn.00404380
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x1e0]
call fcn.00406cca
mov eax, dword [ebp - 8]
call fcn.0040c3e0
test al, al
jne 0x60317c
lea eax, [ebp - 0x1e0]
call fcn.00406ff6
call fcn.004028fc
jmp 0x60318c
lea eax, [ebp - 0x1e0]
call fcn.00406fef
call fcn.004028fc
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 0
push 0
call sub.wininet.dll_FindFirstUrlCacheEntryA
mov eax, dword [ebp - 4]
call fcn.004027dc
mov ebx, eax
cmp dword [ebp - 4], 0
jbe 0x6031b3
mov eax, dword [ebp - 4]
mov dword [ebx], eax
lea eax, [ebp - 4]
push eax
push ebx
push 0
call sub.wininet.dll_FindFirstUrlCacheEntryA
mov esi, eax
test esi, esi
je 0x6032ef
mov byte [ebp - 0x11], 1
mov eax, dword [ebx + 0xc]
mov edx, eax
or edx, 0x100000
cmp edx, eax
jne 0x6032ac
lea eax, [ebp - 0x1e8]
mov edx, dword [ebx + 4]
call fcn.00404294
mov edx, dword [ebp - 0x1e8]
mov eax, 0x60336c
call fcn.00404664
dec eax
jl 0x6032ac
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1ec]
mov edx, dword [ebx + 4]
call fcn.00404294
mov edx, dword [ebp - 0x1ec]
mov eax, 0x60336c
call fcn.00404664
inc eax
push eax
lea eax, [ebp - 0x1f0]
mov edx, dword [ebx + 4]
call fcn.00404294
mov eax, dword [ebp - 0x1f0]
mov ecx, 0x104
pop edx
call fcn.00404580
jmp 0x603279
lea edx, [ebp - 0x10]
lea eax, [ebp - 0x1e0]
call fcn.00404738
lea eax, [ebp - 0x1e0]
call fcn.00406f8c
call fcn.004028fc
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
call fcn.00404488
jne 0x603279
mov byte [ebp - 0x11], 0
lea eax, [ebp - 0x1e0]
call fcn.00406e0c
call fcn.004028fc
test al, al
je 0x60324a
lea eax, [ebp - 0x1e0]
call fcn.00406fef
call fcn.004028fc
cmp byte [ebp - 0x11], 0
je 0x6032ac
mov eax, dword [ebx + 4]
push eax
call sub.wininet.dll_DeleteUrlCacheEntry
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004027f4
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 0
push esi
call sub.wininet.dll_FindNextUrlCacheEntryA
mov eax, dword [ebp - 4]
call fcn.004027dc
mov ebx, eax
cmp dword [ebp - 4], 0
jbe 0x6032dc
mov eax, dword [ebp - 4]
mov dword [ebx], eax
lea eax, [ebp - 4]
push eax
push ebx
push esi
call sub.wininet.dll_FindNextUrlCacheEntryA
test eax, eax
jne 0x6031c9
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004027f4
push esi
call sub.wininet.dll_FindCloseUrlCache
lea eax, [ebp - 0x1e0]
call fcn.00406dd0
call fcn.004028fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x603341
lea eax, [ebp - 0x1f0]
mov edx, 4
call fcn.00404100
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404100
ret