joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51a314
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
mov edi, dword [ebp + 8]
test bl, bl
jne 0x51a338
cmp byte [0x6f64c0], 0
je 0x51a41f
mov byte [0x6f64c0], bl
mov eax, 0x6f64b0
mov edx, dword [ebp - 4]
call fcn.00404e00
mov byte [0x6f64a4], 0
mov byte [ebp - 5], bl
test bl, bl
je 0x51a381
cmp dword [esi + 0x10c], 0
je 0x51a374
mov eax, dword [esi + 0x10c]
mov eax, dword [eax + 0x2c]
cmp byte [eax + 0x255], 0
je 0x51a385
cmp dword [0x6f64b0], 0
jne 0x51a385
test edi, edi
jne 0x51a385
xor eax, eax
jmp 0x51a387
mov al, 1
mov ebx, eax
call fcn.00513b6c
mov dword [esi + 0xa8], edi
test bl, bl
je 0x51a3d8
mov eax, esi
call fcn.0051a4c4
test al, al
jne 0x51a3cf
cmp byte [0x6f64b4], 0
jne 0x51a3cf
mov dword [0x6f64bc], esi
push 0x519e58
mov eax, esi
call fcn.0051a46c
push eax
push 0
push 0
call sub.user32.dll_SetTimer
mov dword [0x6f64a8], eax
jmp 0x51a41f
mov eax, esi
call fcn.0051a1f0
jmp 0x51a41f
mov eax, esi
call fcn.0051a4c4
test al, al
je 0x51a41f
push 0
mov eax, dword [0x6f641c]
call fcn.0045a2f4
push eax
call sub.user32.dll_ShowWindow
cmp byte [ebp - 5], 0
je 0x51a41f
call fcn.00513b7c
mov byte [0x6f64b4], 1
push 0x519eb8
push 0x190
push 0
push 0
call sub.user32.dll_SetTimer
mov dword [0x6f64ac], eax
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x5238f4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 0x15], 0
mov eax, dword [ebp - 4]
cmp byte [eax + 0x3c], 0
je 0x52392d
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x5239ae
push ebp
mov al, 1
call fcn.00523804
pop ecx
test al, al
jne 0x5239ae
push ebp
mov al, 3
call fcn.00523804
pop ecx
test al, al
jne 0x5239ae
push ebp
mov al, 2
call fcn.00523804
pop ecx
test al, al
jne 0x5239ae
push ebp
mov al, 4
call fcn.00523804
pop ecx
test al, al
jne 0x5239ae
mov eax, dword [ebp - 4]
cmp byte [eax + 0x3c], 0
je 0x52397c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x45]
sub dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x49]
sub dword [ebp - 0x10], eax
push ebp
mov al, 1
call fcn.00523804
pop ecx
test al, al
jne 0x5239ae
push ebp
mov al, 3
call fcn.00523804
pop ecx
test al, al
jne 0x5239ae
push ebp
mov al, 2
call fcn.00523804
pop ecx
test al, al
jne 0x5239ae
push ebp
mov al, 4
call fcn.00523804
pop ecx
test al, al
mov al, byte [ebp - 0x15]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x5258d0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov byte [ebp - 1], cl
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x525978
push dword fs:[eax]
mov dword fs:[eax], esp
test byte [ebp - 1], 4
jne 0x52595b
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.005244e8
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.004692a0
cmp dword [ebp - 8], 0
jne 0x525915
xor ebx, ebx
jmp 0x52595d
mov eax, dword [ebp - 8]
mov bl, byte [eax]
mov edx, 0x525988
mov eax, ebx
call fcn.004a57b8
test al, al
je 0x525947
xor eax, eax
mov al, bl
cmp si, ax
jne 0x52593d
mov al, byte [0x5259a8]
cmp al, byte [ebp - 1]
je 0x525941
xor eax, eax
jmp 0x525943
mov al, 1
mov ebx, eax
jmp 0x52595d
push ebx
call sub.user32.dll_VkKeyScanA
and ax, 0xff
cmp si, ax
sete al
mov ebx, eax
jmp 0x52595d
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52597f
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404dd0
ret
Function at 0x544f38
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
add esp, 0xffffffe0
mov ebx, eax
lea ecx, [esp + 8]
mov edx, ebx
mov eax, dword [ebx + 0x2c]
call fcn.0052ed0c
lea eax, [esp + 0x18]
call fcn.004ad2d0
lea edx, [esp + 0x18]
mov ecx, esp
mov eax, dword [ebx + 0x2c]
call fcn.004535a0
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x14]
test al, al
je 0x544f84
push dword [esp + 4]
push dword [esp + 4]
lea eax, [esp + 0x10]
push eax
call sub.user32.dll_PtInRect
test eax, eax
jne 0x544f88
xor eax, eax
jmp 0x544f8a
mov al, 1
test al, al
je 0x544fab
cmp byte [0x6f6498], 0
je 0x544f9e
call fcn.0050c7c4
jmp 0x544fab
push 1
call sub.user32.dll_GetKeyState
test ax, ax
setl al
add esp, 0x20
pop ebx
ret

Function at 0x545c44
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
cmp dl, byte [esi + 0x5d]
je 0x545e0b
mov eax, edx
mov byte [esi + 0x5d], al
test al, al
je 0x545caf
mov eax, esi
call fcn.00542e8c
cmp dword [eax + 0x110], 0
jne 0x545c7f
mov eax, esi
call fcn.00542e8c
add eax, 0x114
push eax
call sub.user32.dll_GetFocus
pop edx
mov dword [edx], eax
cmp byte [esi + 0x20], 0
jne 0x545c93
mov cl, 1
mov dl, 1
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x80]
mov edx, esi
mov eax, dword [esi + 0x2c]
mov ecx, dword [eax]
call dword [ecx + 0x298]
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x21c]
jmp 0x545e0b
mov eax, esi
call fcn.00542e8c
cmp byte [eax + 0x33], 0
je 0x545ce0
push 0x1b
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x545ce4
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x545ce4
push 0x12
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x545ce4
xor edx, edx
jmp 0x545ce6
mov dl, 1
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x200]
mov eax, esi
call fcn.00542e8c
cmp dword [eax + 0x110], 0
jne 0x545e0b
mov eax, esi
call fcn.00542e8c
test byte [eax + 0xb1], 0x40
jne 0x545e0b
mov eax, esi
call fcn.00542e8c
call fcn.0051735c
test al, al
jne 0x545e0b
call fcn.004f01ec
test eax, eax
je 0x545d57
mov eax, esi
call fcn.00542e8c
mov eax, dword [eax + 0x114]
call fcn.004508a4
call fcn.0046b7f8
mov ebx, eax
call fcn.004f01ec
cmp ebx, eax
je 0x545d5b
xor ebx, ebx
jmp 0x545d5d
mov bl, 1
test bl, bl
je 0x545d68
mov al, 1
call fcn.00545c24
mov eax, esi
call fcn.00542e8c
cmp dword [eax + 0x114], 0
jbe 0x545da4
mov eax, esi
call fcn.00542e8c
mov eax, dword [eax + 0x114]
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x545da4
mov eax, esi
call fcn.00542e8c
mov eax, dword [eax + 0x114]
push eax
call sub.user32.dll_SetFocus
jmp 0x545df1
mov eax, esi
call fcn.00542e8c
call fcn.00517978
call fcn.004ad3e8
test al, al
je 0x545dd2
mov eax, esi
call fcn.00542e8c
call fcn.00517978
call fcn.0045a2f4
push eax
call sub.user32.dll_SetFocus
jmp 0x545df1
push 2
mov eax, esi
call fcn.00542e8c
call fcn.00517978
call fcn.0045a2f4
push eax
call sub.user32.dll_GetWindow
push eax
call sub.user32.dll_SetFocus
test bl, bl
je 0x545dfc
xor eax, eax
call fcn.00545c24
mov eax, esi
call fcn.00542e8c
xor edx, edx
mov dword [eax + 0x114], edx
pop esi
pop ebx
ret
Function at 0x55ed0c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, edx
mov eax, ebx
add eax, 0xffffffdb
sub ax, 4
jb 0x55ed30
cmp bx, 9
jne 0x55ed2c
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x55ed30
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x590e88
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1f8], 0
je 0x590ea4
cmp dword [esi + 4], 0
je 0x590ed1
test byte [ebx + 0x55], 1
jne 0x590ec3
mov eax, ebx
call fcn.00456fec
test eax, eax
jne 0x590ec3
mov edx, esi
mov eax, ebx
call fcn.0052c8f8
jmp 0x590fe1
mov edx, esi
mov eax, ebx
call fcn.00457f70
jmp 0x590fe1
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x590fda
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0045a2f4
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.00454c68
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.00590e88
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0045a2f4
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x590fe1
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5a1264
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
test dl, dl
je 0x5a1273
add esp, 0xfffffff0
call fcn.00404298
mov esi, ecx
mov ebx, edx
mov edi, eax
mov dword [edi + 4], esi
push esi
call sub.user32.dll_GetKeyState
and ax, 0xff
movzx eax, ax
mov dword [edi + 8], eax
mov eax, edi
test bl, bl
je 0x5a12a1
call fcn.004042f0
pop dword fs:[0]
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x5a3c4e
Capabilities:
Find taskbar

Disassembly:
push ebx
push esi
add esp, 0xffffffdc
mov ebx, eax
mov eax, esp
xor ecx, ecx
mov edx, 0x24
call fcn.00403708
mov dword [esp], 0x24
push esp
push 4
call sub.shell32.dll_SHAppBarMessage
test eax, 1
jbe 0x5a3c72
push 2
push 0
push 0x5a3c80
call sub.user32.dll_FindWindowA
push eax
mov eax, dword [0x6f3cd4]
mov eax, dword [eax]
call eax
mov esi, eax
mov eax, ebx
call fcn.0046e600
cmp esi, dword [eax + 4]
je 0x5a3c76
xor eax, eax
jmp 0x5a3c78
mov al, 1
add esp, 0x24
pop esi
pop ebx
ret

Function at 0x5a43dc
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x5a441e
inc esi
xor edi, edi
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.0041d2e8
mov ebx, eax
mov eax, ebx
call fcn.0045a5f8
test al, al
je 0x5a441a
push 0
mov eax, ebx
call fcn.0045a2f4
push eax
call sub.user32.dll_ShowWindow
inc edi
dec esi
jne 0x5a43f4
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x5ab114
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xa
push 0
push 0
dec ecx
jne 0x5ab11c
push ebx
mov ebx, 0x6f651c
xor eax, eax
push ebp
push 0x5ab331
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, dword [0x6f41f0]
call fcn.004dac4c
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00404e00
lea edx, [ebp - 8]
mov eax, dword [0x6f3fa8]
call fcn.004dac4c
mov edx, dword [ebp - 8]
lea eax, [ebx + 4]
call fcn.00404e00
lea edx, [ebp - 0xc]
mov eax, dword [0x6f3f98]
call fcn.004dac4c
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 8]
call fcn.00404e00
lea edx, [ebp - 0x10]
mov eax, dword [0x6f393c]
call fcn.004dac4c
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0xc]
call fcn.00404e00
lea edx, [ebp - 0x14]
mov eax, dword [0x6f3ac8]
call fcn.004dac4c
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.00404e00
lea edx, [ebp - 0x18]
mov eax, dword [0x6f4268]
call fcn.004dac4c
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.00404e00
lea edx, [ebp - 0x1c]
mov eax, dword [0x6f4364]
call fcn.004dac4c
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x18]
call fcn.00404e00
lea edx, [ebp - 0x20]
mov eax, dword [0x6f3b9c]
call fcn.004dac4c
mov edx, dword [ebp - 0x20]
lea eax, [ebx + 0x1c]
call fcn.00404e00
lea edx, [ebp - 0x24]
mov eax, dword [0x6f3900]
call fcn.004dac4c
mov edx, dword [ebp - 0x24]
lea eax, [ebx + 0x20]
call fcn.00404e00
lea edx, [ebp - 0x28]
mov eax, dword [0x6f3a54]
call fcn.004dac4c
mov edx, dword [ebp - 0x28]
lea eax, [ebx + 0x24]
call fcn.00404e00
lea edx, [ebp - 0x2c]
mov eax, dword [0x6f3714]
call fcn.004dac4c
mov edx, dword [ebp - 0x2c]
lea eax, [ebx + 0x28]
call fcn.00404e00
lea edx, [ebp - 0x30]
mov eax, dword [0x6f39f8]
call fcn.004dac4c
mov edx, dword [ebp - 0x30]
lea eax, [ebx + 0x2c]
call fcn.00404e00
lea edx, [ebp - 0x34]
mov eax, dword [0x6f38f4]
call fcn.004dac4c
mov edx, dword [ebp - 0x34]
lea eax, [ebx + 0x30]
call fcn.00404e00
lea edx, [ebp - 0x38]
mov eax, dword [0x6f3f94]
call fcn.004dac4c
mov edx, dword [ebp - 0x38]
lea eax, [ebx + 0x34]
call fcn.00404e00
lea edx, [ebp - 0x3c]
mov eax, dword [0x6f4198]
call fcn.004dac4c
mov edx, dword [ebp - 0x3c]
lea eax, [ebx + 0x38]
call fcn.00404e00
lea edx, [ebp - 0x40]
mov eax, dword [0x6f3f54]
call fcn.004dac4c
mov edx, dword [ebp - 0x40]
lea eax, [ebx + 0x3c]
call fcn.00404e00
lea edx, [ebp - 0x44]
mov eax, dword [0x6f3e30]
call fcn.004dac4c
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x40]
call fcn.00404e00
lea edx, [ebp - 0x48]
mov eax, dword [0x6f39e0]
call fcn.004dac4c
mov edx, dword [ebp - 0x48]
lea eax, [ebx + 0x44]
call fcn.00404e00
lea edx, [ebp - 0x4c]
mov eax, dword [0x6f4220]
call fcn.004dac4c
mov edx, dword [ebp - 0x4c]
lea eax, [ebx + 0x48]
call fcn.00404e00
lea edx, [ebp - 0x50]
mov eax, dword [0x6f3724]
call fcn.004dac4c
mov edx, dword [ebp - 0x50]
lea eax, [ebx + 0x4c]
call fcn.00404e00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ab338
lea eax, [ebp - 0x50]
mov edx, 0x14
call fcn.00404dd0
ret
Function at 0x5d6e0c
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 4], 6
setae al
add esp, 0x94
ret

Function at 0x5d7ba8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405278
xor eax, eax
push ebp
push 0x5d7c23
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.005dc978
xor eax, eax
push ebp
push 0x5d7c06
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00405288
push eax
push 0x5d7c30
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d7c0d
call fcn.005dc990
ret

Function at 0x5d8384
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x94], eax
xor eax, eax
push ebp
push 0x5d847e
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebp - 8], 0
xor edi, edi
call sub.kernel32.dll_GetLogicalDrives
mov dword [ebp - 5], eax
xor esi, esi
mov eax, esi
cmp eax, 0x1f
ja 0x5d83c3
bt dword [ebp - 5], eax
jae 0x5d8425
mov ebx, esi
add bl, 0x61
lea eax, [ebp - 0x94]
mov edx, ebx
call fcn.00404f94
lea eax, [ebp - 0x94]
mov edx, 0x5d8498
call fcn.00405090
mov eax, dword [ebp - 0x94]
call fcn.00405288
push eax
call sub.kernel32.dll_GetDriveTypeA
mov byte [ebp - 1], al
mov eax, ebx
call fcn.004030e8
mov ebx, eax
mov al, byte [ebp - 1]
sub al, 3
jne 0x5d8425
inc edi
mov eax, ebx
call fcn.005d82dc
movzx eax, di
fstp dword [ebp + eax*4 - 0x74]
wait
movzx eax, di
mov byte [ebp + eax - 0x8e], bl
inc esi
cmp esi, 0x1a
jne 0x5d83b8
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0xc], eax
mov ecx, edi
test cx, cx
jb 0x5d845a
inc ecx
xor ebx, ebx
lea edx, [ebp - 0x74]
fld dword [edx]
fcomp dword [ebp - 0xc]
fnstsw ax
sahf
jbe 0x5d8451
mov eax, dword [edx]
mov dword [ebp - 0xc], eax
mov word [ebp - 8], bx
inc ebx
add edx, 4
dec cx
jne 0x5d843e
movzx eax, word [ebp - 8]
mov bl, byte [ebp + eax - 0x8e]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d8485
lea eax, [ebp - 0x94]
call fcn.00404dac
ret

Function at 0x5d84ac
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xffffff00
mov ebx, eax
push 0xff
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov edx, ebx
mov eax, esp
call fcn.0040ac28
add esp, 0x100
pop ebx
ret
Function at 0x5d8628
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x5d86ae
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLogicalDrives
mov edi, eax
mov esi, 2
mov eax, esi
cmp eax, 0x1f
ja 0x5d865f
bt edi, eax
jae 0x5d8692
mov ebx, esi
add bl, 0x41
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00404f94
lea eax, [ebp - 8]
mov edx, 0x5d86c8
call fcn.00405090
mov eax, dword [ebp - 8]
call fcn.00405288
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp al, 5
jne 0x5d8692
inc dword [ebp - 4]
inc esi
cmp esi, 0x1a
jne 0x5d8655
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d86b5
lea eax, [ebp - 8]
call fcn.00404dac
ret

Function at 0x5d8d04
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405278
xor eax, eax
push ebp
push 0x5d8dcf
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x48342c]
call fcn.00483650
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x5d8d8c
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000001
mov eax, dword [ebp - 0xc]
call fcn.0048372c
xor ecx, ecx
mov edx, 0x5d8de4
mov eax, dword [ebp - 0xc]
call fcn.00483870
test al, al
je 0x5d8d76
lea ecx, [ebp - 0x10]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.00483dec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d8d93
mov eax, dword [ebp - 0xc]
call fcn.00403f20
ret

Function at 0x5e7e98
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x5e7ec6
mov eax, ebx
call fcn.005e894c
cmp dword [ebx + 0x40], 0
je 0x5e7ebf
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x5e7f37
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x5e7f29
cmp dword [ebx + 8], 0
je 0x5e7ee8
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x5e7efa
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x5e7f29
cmp dword [ebx + 8], 0
je 0x5e7edb
cmp eax, 3
je 0x5e7f0d
dec eax
jne 0x5e7edb
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x5e7edb
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x5e7edb
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x5e7f55
cmp dword [ebx + 0x14], 0xcc
je 0x5e7f55
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.005e7f60
pop ebx
ret
Function at 0x60331c
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x6f79d8
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x60333e
shr eax, 1
xor eax, 0xedb88320
jmp 0x603340
shr eax, 1
dec edx
jne 0x60332c
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x603325
mov byte [0x6f7dd8], 1
pop esi
pop ebx
ret

Function at 0x60335c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x6f7dd8], 0
jne 0x603373
call fcn.0060331c
mov eax, edi
dec eax
test eax, eax
jl 0x60339c
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x6f79d8]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x60337d
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x605f94
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x605fc5
dec al
je 0x606001
dec al
je 0x606045
dec al
je 0x6060b0
jmp 0x60613a
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x60613a
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x605fd5
jmp 0x60613a
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x60613a
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x606011
jmp 0x60613a
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x60613a
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x606073
xor ebp, ebp
jmp 0x606084
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x60608d
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x606055
jmp 0x60613a
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x60613a
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x606108
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.006033a4
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x6060c4
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret