joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d3df0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], ecx
mov ebx, edx
xor eax, eax
push ebp
push 0x5d3f08
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea edx, [ebp - 0x14]
mov eax, 0x5d3f20
call fcn.005d1644
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 4]
call fcn.0040a114
mov dl, 1
mov eax, dword [0x5d2c68]
call fcn.005d3074
mov dword [ebp - 0x10], eax
mov dl, 1
mov eax, dword [0x48f8b4]
call fcn.004b3ae8
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x5d3ee3
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x5d3ead
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x5d3f40
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.005d33c8
test al, al
jne 0x5d3e8a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
call fcn.00408b28
jmp 0x5d3eea
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x6c]
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004fb578
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5d3eb7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d3eea
mov eax, dword [ebp - 0xc]
call fcn.004076bc
mov eax, dword [ebp - 0x10]
call fcn.004076bc
mov eax, dword [ebp - 4]
call fcn.0040a034
push eax
call sub.kernel32.dll_DeleteFileW
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d3f0f
lea eax, [ebp - 0x14]
call fcn.0040942c
lea eax, [ebp - 4]
call fcn.004093e4
ret
Function at 0x5d468c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004094c8
xor eax, eax
push ebp
push 0x5d47b9
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
lea edx, [ebp - 0x18]
mov eax, 0x5d47d0
call fcn.005d1644
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0xc]
call fcn.0040a114
lea edx, [ebp - 0x1c]
mov eax, 0x5d47e8
call fcn.005d1644
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 8]
call fcn.0040a114
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x4f7ac8]
call fcn.004fae48
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x5d478a
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, esi
mov eax, dword [ebp - 0x14]
call fcn.004fb578
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x60]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.005d4d74
push 0x5d4804
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.005d39e4
test al, al
jne 0x5d474a
call fcn.00408b28
jmp 0x5d4791
mov eax, dword [ebp - 0xc]
call fcn.0040a034
push eax
call sub.kernel32.dll_DeleteFileW
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.005d4be0
mov byte [ebp - 0xd], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d4791
mov eax, dword [ebp - 0x14]
call fcn.004076bc
mov eax, dword [ebp - 0xc]
call fcn.0040a034
push eax
call sub.kernel32.dll_DeleteFileW
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d47c0
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.004094a4
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00409444
ret
Function at 0x5d4818
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004094c8
xor eax, eax
push ebp
push 0x5d4936
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
lea edx, [ebp - 0x14]
mov eax, 0x5d494c
call fcn.005d1644
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0xc]
call fcn.0040a114
lea edx, [ebp - 0x18]
mov eax, 0x5d4964
call fcn.005d1644
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 8]
call fcn.0040a114
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x4f7ac8]
call fcn.004fae48
mov dword [ebx + 8], eax
xor eax, eax
push ebp
push 0x5d4907
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0xc]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x80]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.005d4d74
push 0x5d4980
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.005d39e4
test al, al
jne 0x5d48cf
call fcn.00408b28
jmp 0x5d490e
mov eax, dword [ebp - 0xc]
call fcn.0040a034
push eax
call sub.kernel32.dll_DeleteFileW
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.005d4be0
mov byte [ebp - 0xd], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d490e
mov eax, dword [ebp - 0xc]
call fcn.0040a034
push eax
call sub.kernel32.dll_DeleteFileW
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d493d
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004094a4
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00409444
ret

Function at 0x5d4994
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], ecx
mov ebx, edx
xor eax, eax
push ebp
push 0x5d4a8a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea edx, [ebp - 0x10]
mov eax, 0x5d4aa0
call fcn.005d1644
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
call fcn.0040a114
mov dl, 1
mov eax, dword [0x5d2c68]
call fcn.005d3074
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x5d4a65
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x5d4a37
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x5d4ac0
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.005d33c8
test al, al
jne 0x5d4a1f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
call fcn.00408b28
jmp 0x5d4a6c
mov eax, dword [ebx]
mov edx, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x6c]
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5d4a41
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d4a6c
mov eax, dword [ebp - 0xc]
call fcn.004076bc
mov eax, dword [ebp - 4]
call fcn.0040a034
push eax
call sub.kernel32.dll_DeleteFileW
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d4a91
lea eax, [ebp - 0x10]
call fcn.0040942c
lea eax, [ebp - 4]
call fcn.004093e4
ret
Function at 0x5d4ad4
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7a8
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004094c8
xor eax, eax
push ebp
push 0x5d4bd0
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
lea eax, [ebp - 0x804]
xor ecx, ecx
mov edx, 0x800
call fcn.00407048
lea eax, [ebp - 0x804]
push eax
push 0x3ff
call sub.kernel32.dll_GetTempPathW
lea eax, [ebp - 0x848]
xor ecx, ecx
mov edx, 0x44
call fcn.00407048
mov dword [ebp - 0x848], 0x44
mov dword [ebp - 0x81c], 1
mov word [ebp - 0x818], bx
test ebx, ebx
jne 0x5d4b86
lea eax, [ebp - 0x858]
push eax
lea eax, [ebp - 0x848]
push eax
push 0
push 0
push 0x30
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040a034
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x5d4bba
mov esi, dword [ebp - 0x850]
jmp 0x5d4bba
lea eax, [ebp - 0x858]
push eax
lea eax, [ebp - 0x848]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040a034
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x5d4bba
mov esi, dword [ebp - 0x850]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d4bd7
lea eax, [ebp - 4]
call fcn.004093e4
ret

Function at 0x5d5420
Capabilities:
Check os version

Disassembly:
push ebx
push esi
add esp, 0xffffff64
mov ebx, eax
xor esi, esi
mov eax, esp
xor ecx, ecx
mov edx, 0x9c
call fcn.00407048
mov dword [esp], 0x9c
mov eax, esp
push eax
call sub.kernel32.dll_GetVersionExW
test eax, eax
jne 0x5d5460
mov dword [esp], 0x114
mov eax, esp
push eax
call sub.kernel32.dll_GetVersionExW
test eax, eax
je 0x5d5493
cmp dword [esp + 0x10], 2
sete byte [ebx]
cmp byte [ebx], 0
je 0x5d5474
cmp dword [esp + 4], 5
je 0x5d5478
xor eax, eax
jmp 0x5d547a
mov al, 1
mov byte [ebx], al
cmp byte [ebx], 0
je 0x5d5488
cmp dword [esp + 8], 2
je 0x5d548c
xor eax, eax
jmp 0x5d548e
mov al, 1
mov byte [ebx], al
or esi, 0xffffffff
mov eax, esi
add esp, 0x9c
pop esi
pop ebx
ret

Function at 0x5d7dd0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.004094c8
xor eax, eax
push ebp
push 0x5d7e54
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.00422b34
test al, al
je 0x5d7e39
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, 0x5d7e70
call fcn.0040a288
mov eax, dword [ebp - 8]
mov edx, 1
call fcn.005d17bc
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.0040a034
push eax
call sub.kernel32.dll_DeleteFileW
test esi, esi
jne 0x5d7e39
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d7e5b
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409444
ret
Function at 0x5d9720
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.004094c8
xor eax, eax
push ebp
push 0x5d982e
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov edx, dword [ebp - 4]
mov ax, 0x5c
call fcn.005d96b8
mov esi, eax
test esi, esi
jle 0x5d9813
lea eax, [ebp - 8]
push eax
mov ecx, esi
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040a3f8
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x20006
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.0040a034
push eax
push edi
call sub.advapi32.dll_RegCreateKeyExW
test eax, eax
jne 0x5d9813
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x5d97ac
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 8]
push eax
mov ecx, ebx
sub ecx, esi
lea edx, [esi + 1]
mov eax, dword [ebp - 4]
call fcn.0040a3f8
cmp dword [ebp - 8], 0
jne 0x5d97e5
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
sete bl
jmp 0x5d980a
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.0040a034
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
sete bl
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d9835
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409444
ret
Function at 0x5d98e8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.004094c8
xor eax, eax
push ebp
push 0x5d9a1f
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov edx, dword [ebp - 4]
mov ax, 0x5c
call fcn.005d96b8
mov esi, eax
test esi, esi
jle 0x5d9a04
lea eax, [ebp - 8]
push eax
mov ecx, esi
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040a3f8
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 8]
call fcn.0040a034
push eax
push edi
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x5d9a04
mov edi, dword [ebp - 4]
test edi, edi
je 0x5d996e
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 8]
push eax
mov ecx, edi
sub ecx, esi
lea edx, [esi + 1]
mov eax, dword [ebp - 4]
call fcn.0040a3f8
cmp dword [ebp - 8], 0
jne 0x5d998b
xor edi, edi
jmp 0x5d9995
mov eax, dword [ebp - 8]
call fcn.0040a034
mov edi, eax
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push edi
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x5d99fb
mov eax, dword [ebp - 0x18]
call fcn.004066e0
mov esi, eax
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push 0
push edi
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x5d99f4
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x10]
jne 0x5d99eb
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
mov dword [eax], edx
mov bl, 1
jmp 0x5d99fb
mov eax, esi
call fcn.004066fc
jmp 0x5d99fb
mov eax, esi
call fcn.004066fc
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d9a26
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409444
ret
Function at 0x5d9ab4
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.004094c8
xor eax, eax
push ebp
push 0x5d9c07
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0xffffffff
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.004218c0
cmp dword [ebp - 0x18], 0
je 0x5d9be4
mov dl, 1
mov eax, dword [0x4fda98]
call fcn.004ffb60
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x5d9bdd
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0x14]
call fcn.004ffc48
mov dword [ebp - 0x10], 0xfffffffe
mov edx, dword [0x68031c]
mov eax, dword [ebp - 0x14]
call fcn.004ffed4
test al, al
jne 0x5d9b4c
call fcn.00408b28
jmp 0x5d9be4
mov dword [ebp - 0x10], 0xfffffffd
mov eax, dword [edi + 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x5d9bba
inc ebx
xor esi, esi
mov eax, dword [edi + 4]
mov edx, esi
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov edx, dword [eax + 0xc]
lea eax, [ebp - 8]
call fcn.0040980c
push 0x5d9c24
push dword [ebp - 8]
push 0x5d9c74
push dword [ebp - 4]
push 0x5d9cac
lea eax, [ebp - 0xc]
mov edx, 5
call fcn.0040a310
mov eax, dword [ebp - 0xc]
call fcn.0040a034
push eax
call sub.kernel32.dll_OutputDebugStringW
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.005d17bc
test eax, eax
inc esi
dec ebx
jne 0x5d9b65
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d9be4
mov eax, dword [ebp - 0x14]
call fcn.004ffc18
mov eax, dword [ebp - 0x14]
call fcn.004076bc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d9c0e
lea eax, [ebp - 0x18]
call fcn.004093e4
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00409444
ret

Function at 0x5da54c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.004094c8
xor eax, eax
push ebp
push 0x5da5c0
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.00422b34
test al, al
je 0x5da5a5
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.005d17bc
mov esi, eax
mov eax, dword [ebp - 8]
call fcn.0040a034
push eax
call sub.kernel32.dll_DeleteFileW
test esi, esi
jne 0x5da5a5
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5da5c7
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409444
ret
Function at 0x5e1d18
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0x64]
mov eax, dword [ebp + 8]
cmp dword [eax - 8], 0x1fffffff
jne 0x5e1d7f
cmp ebx, dword [ebp - 8]
jge 0x5e1da2
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
xor eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0x20]
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x5e1d4d
jmp 0x5e1da2
cmp ebx, dword [ebp - 8]
jge 0x5e1da2
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0x20]
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x5e1d84
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5e1dac
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0x64]
mov eax, dword [ebp + 8]
cmp dword [eax - 8], 0x1fffffff
jne 0x5e1e13
cmp ebx, dword [ebp - 8]
jge 0x5e1e36
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
xor eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0x20]
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x5e1de1
jmp 0x5e1e36
cmp ebx, dword [ebp - 8]
jge 0x5e1e36
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0x20]
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x5e1e18
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x61aee4
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x61af12
mov eax, ebx
call fcn.0061b9a0
cmp dword [ebx + 0x40], 0
je 0x61af0b
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x61af83
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x61af75
cmp dword [ebx + 8], 0
je 0x61af34
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x61af46
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x61af75
cmp dword [ebx + 8], 0
je 0x61af27
cmp eax, 3
je 0x61af59
dec eax
jne 0x61af27
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x61af27
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x61af27
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x61afa1
cmp dword [ebx + 0x14], 0xcc
je 0x61afa1
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0061afac
pop ebx
ret

Function at 0x67762c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x677634
mov eax, 0x66e928
call fcn.0040e158
xor eax, eax
push ebp
push 0x67775e
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00406a60
test eax, eax
je 0x677713
lea edx, [ebp - 0x14]
mov eax, 1
call fcn.00406ac0
mov eax, dword [ebp - 0x14]
mov edx, 0x677778
call fcn.0040a3c0
jne 0x6776d2
push 0x1f4
call sub.kernel32.dll_Sleep_1
lea edx, [ebp - 0x18]
mov eax, 2
call fcn.00406ac0
mov eax, dword [ebp - 0x18]
push eax
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.00406ac0
mov eax, dword [ebp - 0x1c]
pop edx
call fcn.005d4d74
lea edx, [ebp - 0x20]
mov eax, 2
call fcn.00406ac0
mov eax, dword [ebp - 0x20]
mov edx, 1
call fcn.005d4be0
mov eax, dword [0x6818cc]
mov eax, dword [eax]
call fcn.005c6de8
jmp 0x677713
lea edx, [ebp - 0x24]
mov eax, 1
call fcn.00406ac0
mov eax, dword [ebp - 0x24]
mov edx, 0x67778c
call fcn.0040a3c0
jne 0x677713
push 0x1f4
call sub.kernel32.dll_Sleep_1
lea edx, [ebp - 0x28]
mov eax, 2
call fcn.00406ac0
mov eax, dword [ebp - 0x28]
call fcn.0040a034
push eax
call sub.kernel32.dll_DeleteFileW
mov eax, dword [0x6818cc]
mov eax, dword [eax]
call fcn.005c6b4c
mov ecx, dword [0x6815b8]
mov eax, dword [0x6818cc]
mov eax, dword [eax]
mov edx, dword [0x62b474]
call fcn.005c6b64
mov eax, dword [0x6818cc]
mov eax, dword [eax]
call fcn.005c6cc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x677765
lea eax, [ebp - 0x28]
mov edx, 6
call fcn.00409444
ret
Function at 0x6efc52
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
add eax, ecx
xor edi, edi
cmp ecx, eax
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
mov esi, ecx
jae 0x6efca9
mov bl, byte [esi]
movsx edx, bl
cmp edx, 0x100
ja 0x6efc8c
cmp byte [edx + 0x1001688], 0x3f
ja 0x6efc8c
inc edi
mov dword [ebp - 4], edi
jmp 0x6efca4
cmp bl, 0x20
je 0x6efca4
cmp bl, 9
je 0x6efca4
cmp bl, 0xd
je 0x6efca4
cmp bl, 0xa
jne 0x6efd7e
inc esi
cmp esi, eax
jb 0x6efc70
mov esi, dword [ebp + 0x10]
lea eax, [edi + 3]
shr eax, 2
test esi, esi
lea eax, [eax + eax*2]
jne 0x6efcc0
mov esi, eax
jmp 0x6efd6c
test edi, edi
jbe 0x6efd6c
xor eax, eax
lea edi, [ebp + 8]
stosd dword es:[edi], eax
xor edi, edi
mov eax, dword [ebp - 4]
cmp eax, 4
jbe 0x6efcdb
push 4
pop eax
cmp edi, eax
jae 0x6efd05
movsx eax, byte [ecx]
mov edx, 0x100
cmp eax, edx
jae 0x6efcfb
cmp byte [eax + 0x1001688], 0x3f
jbe 0x6efcfb
movsx eax, byte [ecx + 1]
inc ecx
jmp 0x6efce7
mov al, byte [ecx]
inc ecx
mov byte [ebp + edi + 8], al
inc edi
jmp 0x6efcd0
movzx eax, byte [ebp + 9]
movzx edx, byte [ebp + 8]
mov bl, byte [eax + 0x1001688]
mov dl, byte [edx + 0x1001688]
shl dl, 2
shr bl, 4
or dl, bl
mov byte [esi], dl
inc esi
cmp edi, 2
jbe 0x6efd44
movzx edx, byte [ebp + 0xa]
mov al, byte [eax + 0x1001688]
mov dl, byte [edx + 0x1001688]
shr dl, 2
shl al, 4
or dl, al
mov byte [esi], dl
inc esi
cmp edi, 3
jbe 0x6efd63
movzx eax, byte [ebp + 0xa]
movzx edx, byte [ebp + 0xb]
mov al, byte [eax + 0x1001688]
shl al, 6
or al, byte [edx + 0x1001688]
mov byte [esi], al
inc esi
sub dword [ebp - 4], edi
jne 0x6efcc8
sub esi, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
mov dword [eax], esi
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 0x10
test edi, edi
je 0x6efd9b
mov eax, edi
and eax, 3
je 0x6efca9
cmp byte [esi], 0x3d
jne 0x6efd9b
cmp eax, 1
jne 0x6efca9
mov dword [ebp - 8], 0xd
jmp 0x6efd74

Function at 0x701bfc
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x5c], ecx
ret