joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54dad8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x24]
mov eax, dword [eax + 0x38]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x24]
mov edx, dword [edx + 0x28]
shr edx, 1
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x24]
mov ecx, dword [eax + 0x28]
shr ecx, 1
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x24]
mov eax, dword [eax + 0x38]
call fcn.00404a5c
add dword [ebp - 8], 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x24]
mov eax, dword [eax + 0x4c]
shl eax, 2
sub eax, 5
test eax, eax
jl 0x54dbb7
inc eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
shr eax, 8
and eax, 0xff
mov eax, dword [eax*4 + 0x63e488]
mov edx, 8
call fcn.0054b1b8
mov ebx, eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
and eax, 0xff
xor ebx, dword [eax*4 + 0x63e488]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x63e488]
mov edx, 0x10
call fcn.0054b1b8
xor ebx, eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
shr eax, 0x18
mov eax, dword [eax*4 + 0x63e488]
mov edx, 0x18
call fcn.0054b1b8
xor ebx, eax
mov eax, dword [ebp - 8]
mov dword [eax], ebx
add dword [ebp - 8], 4
inc dword [ebp - 4]
dec dword [ebp - 0xc]
jne 0x54db3a
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x54f22c
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov ecx, 8
mov edx, 0x3020100
mov dword [eax], edx
add edx, 0x4040404
mov dword [eax + 4], edx
add edx, 0x4040404
mov dword [eax + 8], edx
add edx, 0x4040404
mov dword [eax + 0xc], edx
add edx, 0x4040404
mov dword [eax + 0x10], edx
add edx, 0x4040404
mov dword [eax + 0x14], edx
add edx, 0x4040404
mov dword [eax + 0x18], edx
add edx, 0x4040404
mov dword [eax + 0x1c], edx
add edx, 0x4040404
add eax, 0x20
dec ecx
jne 0x54f236
ret

Function at 0x551e40
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x551eb9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.004089e4
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.004089e4
mov eax, dword [ebp - 0x14]
call fcn.0040897c
push eax
mov eax, dword [ebp - 0x10]
call fcn.0040897c
push eax
call sub.kernel32.dll_MoveFileW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x15], al
mov al, byte [ebp - 0x15]
mov byte [ebp - 9], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x551ec0
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00407b5c
ret
Function at 0x552c1c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x552c80
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00420618
mov eax, dword [ebp - 4]
call fcn.00552b6c
test al, al
je 0x552c55
mov byte [ebp - 5], 1
jmp 0x552c6a
mov eax, dword [ebp - 0xc]
call fcn.0040897c
push eax
call sub.kernel32.dll_GetDriveTypeW
cmp eax, 2
sete byte [ebp - 5]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x552c87
lea eax, [ebp - 0xc]
call fcn.00407afc
ret

Function at 0x552f78
Capabilities:
Encode data using xor

Disassembly:
and edx, edx
je 0x552f9b
and ecx, ecx
jle 0x552f9b
push ebx
push edi
xor ebx, ebx
lea edi, cs:[0x552fa1]
mov bl, al
shr eax, 8
xor bl, byte [edx]
xor eax, dword [edi + ebx*4]
inc edx
dec ecx
jne 0x552f8b
pop edi
pop ebx
ret

Function at 0x55357c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
dec eax
test eax, eax
jl 0x5535d9
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, dword [ebp - 0x14]
mov al, byte [eax]
mov byte [ebp - 0xe], al
mov eax, dword [ebp - 0xc]
call fcn.005534cc
xor al, byte [ebp - 0xe]
mov byte [ebp - 0xd], al
mov edx, dword [ebp - 0xc]
mov al, byte [ebp - 0xd]
call fcn.00553434
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, dword [ebp - 0x14]
mov dl, byte [ebp - 0xd]
mov byte [eax], dl
inc dword [ebp - 0x14]
dec dword [ebp - 0x18]
jne 0x55359e
mov esp, ebp
pop ebp
ret

Function at 0x553634
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0x12345678
mov dword [eax + 4], 0
mov eax, dword [ebp - 8]
mov dword [eax + 8], 0x23456789
mov dword [eax + 0xc], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x10], 0x34567890
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x55368c
mov eax, dword [ebp - 0x1c]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
dec eax
test eax, eax
jl 0x5536bc
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 4]
call fcn.004083f8
add eax, dword [ebp - 0x10]
mov al, byte [eax]
mov edx, dword [ebp - 8]
call fcn.00553434
inc dword [ebp - 0x10]
dec dword [ebp - 0x18]
jne 0x55369f
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
call fcn.005534cc
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
xor al, byte [edx + ecx]
mov byte [ebp - 0x11], al
mov edx, dword [ebp - 8]
mov al, byte [ebp - 0x11]
call fcn.00553434
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov cl, byte [ebp - 0x11]
mov byte [eax + edx], cl
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xc
jne 0x5536c1
mov esp, ebp
pop ebp
ret
Function at 0x5605d4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x21e]
mov edx, 0x560660
call fcn.00420db8
mov eax, dword [ebp - 4]
cmp dword [eax + 0x54], 0
je 0x56060f
lea eax, [ebp - 0x208]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x54]
call fcn.00420db8
jmp 0x560620
lea eax, [ebp - 0x208]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathW
lea eax, [ebp - 0x428]
push eax
push 0
lea eax, [ebp - 0x21e]
push eax
lea eax, [ebp - 0x208]
push eax
call sub.kernel32.dll_GetTempFileNameW
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x428]
mov ecx, 0x105
call fcn.00408a38
mov esp, ebp
pop ebp
ret

Function at 0x5818cc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x204], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x581a25
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x581a0a
mov eax, ebx
test eax, eax
je 0x581905
sub eax, 4
mov eax, dword [eax]
jmp 0x581907
xor eax, eax
mov edi, eax
test ebx, ebx
je 0x581917
mov eax, ebx
sub eax, 0xa
movzx eax, word [eax]
jmp 0x58191b
mov ax, 2
cmp ax, 1
jne 0x58199c
test ebx, ebx
je 0x58192f
mov eax, ebx
sub eax, 0xc
movzx eax, word [eax]
jmp 0x581937
mov eax, dword [0x6466e8]
movzx eax, word [eax]
push edi
push 0
push 0
movzx eax, ax
mov ecx, ebx
xor edx, edx
call fcn.0040bc80
mov edi, eax
cmp edi, 0x100
jle 0x58195f
mov eax, edi
add eax, eax
call fcn.00404810
mov esi, eax
jmp 0x581965
lea esi, [ebp - 0x200]
test ebx, ebx
je 0x581973
mov eax, ebx
sub eax, 0xc
movzx edx, word [eax]
jmp 0x58197c
mov edx, dword [0x6466e8]
movzx edx, word [edx]
mov eax, ebx
test eax, eax
je 0x581989
sub eax, 4
mov eax, dword [eax]
jmp 0x58198b
xor eax, eax
push eax
push esi
push edi
movzx eax, dx
mov ecx, ebx
xor edx, edx
call fcn.0040bc80
jmp 0x5819d5
cmp edi, 0x100
jle 0x5819b1
mov eax, edi
add eax, eax
call fcn.00404810
mov esi, eax
jmp 0x5819b7
lea esi, [ebp - 0x200]
lea edx, [ebp - 0x204]
mov eax, ebx
call fcn.0041e924
mov eax, dword [ebp - 0x204]
mov ecx, edi
add ecx, ecx
mov edx, esi
call fcn.00404a5c
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x5819f7
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x5819e1
lea eax, [ebp - 0x200]
cmp esi, eax
je 0x581a0c
mov eax, esi
call fcn.0040482c
jmp 0x581a0c
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x581a2c
lea eax, [ebp - 0x204]
call fcn.00407afc
ret

Function at 0x596218
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffeec
mov dword [esp], 0x114
push esp
call sub.kernel32.dll_GetVersionExW
cmp dword [esp + 0x10], 2
jne 0x59623d
cmp dword [esp + 4], 5
jb 0x59623d
mov al, 1
jmp 0x59623f
xor eax, eax
add esp, 0x114
ret
Function at 0x5ab270
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
je 0x5ab3ec
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov ecx, 3
xor edx, edx
div ecx
lea eax, [eax + eax*2]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
add dword [ebp - 0x14], eax
jmp 0x5ab332
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
mov dword [ebp - 0x10], eax
shl dword [ebp - 0x10], 8
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax + 1]
or dword [ebp - 0x10], eax
shl dword [ebp - 0x10], 8
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax + 2]
or dword [ebp - 0x10], eax
add dword [ebp - 0x1c], 3
mov eax, dword [ebp - 0x10]
and eax, 0x3f
mov al, byte [eax + 0x63fcb4]
mov edx, dword [ebp - 0x20]
mov byte [edx + 3], al
shr dword [ebp - 0x10], 6
mov eax, dword [ebp - 0x10]
and eax, 0x3f
mov al, byte [eax + 0x63fcb4]
mov edx, dword [ebp - 0x20]
mov byte [edx + 2], al
shr dword [ebp - 0x10], 6
mov eax, dword [ebp - 0x10]
and eax, 0x3f
mov al, byte [eax + 0x63fcb4]
mov edx, dword [ebp - 0x20]
mov byte [edx + 1], al
shr dword [ebp - 0x10], 6
mov eax, dword [ebp - 0x10]
mov al, byte [eax + 0x63fcb4]
mov edx, dword [ebp - 0x20]
mov byte [edx], al
add dword [ebp - 0x20], 4
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x14]
jb 0x5ab2b5
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x18]
dec eax
je 0x5ab34f
dec eax
je 0x5ab390
jmp 0x5ab3ec
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
mov dword [ebp - 0x10], eax
shl dword [ebp - 0x10], 4
mov eax, dword [ebp - 0x10]
and eax, 0x3f
mov al, byte [eax + 0x63fcb4]
mov edx, dword [ebp - 0x20]
mov byte [edx + 1], al
shr dword [ebp - 0x10], 6
mov eax, dword [ebp - 0x10]
mov al, byte [eax + 0x63fcb4]
mov edx, dword [ebp - 0x20]
mov byte [edx], al
mov eax, dword [ebp - 0x20]
mov byte [eax + 2], 0x3d
mov eax, dword [ebp - 0x20]
mov byte [eax + 3], 0x3d
jmp 0x5ab3ec
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
mov dword [ebp - 0x10], eax
shl dword [ebp - 0x10], 8
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax + 1]
or dword [ebp - 0x10], eax
shl dword [ebp - 0x10], 2
mov eax, dword [ebp - 0x10]
and eax, 0x3f
mov al, byte [eax + 0x63fcb4]
mov edx, dword [ebp - 0x20]
mov byte [edx + 2], al
shr dword [ebp - 0x10], 6
mov eax, dword [ebp - 0x10]
and eax, 0x3f
mov al, byte [eax + 0x63fcb4]
mov edx, dword [ebp - 0x20]
mov byte [edx + 1], al
shr dword [ebp - 0x10], 6
mov eax, dword [ebp - 0x10]
mov al, byte [eax + 0x63fcb4]
mov edx, dword [ebp - 0x20]
mov byte [edx], al
mov eax, dword [ebp - 0x20]
mov byte [eax + 3], 0x3d
mov esp, ebp
pop ebp
ret
Function at 0x5b25ec
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
xor ebx, ebx
mov dword [ebp - 0x34], ebx
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407bf0
mov eax, dword [ebp - 8]
call fcn.00407bf0
xor eax, eax
push ebp
push 0x5b271a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x5b2636
mov eax, dword [ebp - 0x2c]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 4]
call fcn.004080d0
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x5b265e
mov eax, dword [ebp - 0x30]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jbe 0x5b2677
lea eax, [ebp - 8]
call fcn.004080d0
mov dword [ebp - 0x20], eax
jmp 0x5b267c
xor eax, eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x1c]
push eax
xor eax, eax
mov al, byte [ebp - 9]
mov eax, dword [eax*4 + 0x640140]
push eax
push 0
push 0
lea eax, [ebp - 0x24]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
call sub.Crypt32.dll_CryptProtectData
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
jne 0x5b26b4
call fcn.00428a80
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [ebp - 0x1c]
call fcn.004084c8
mov eax, dword [ebp + 8]
call fcn.004080d0
mov edx, eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
call fcn.00404a5c
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_LocalFree_1
lea edx, [ebp - 0x34]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
call fcn.005aafe8
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp + 8]
call fcn.00407f80
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b2721
lea eax, [ebp - 0x34]
call fcn.00407b20
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407b8c
ret
Function at 0x5b2728
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
xor ebx, ebx
mov dword [ebp - 0x34], ebx
mov byte [ebp - 0x2d], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407bf0
mov eax, dword [ebp - 8]
call fcn.00407bf0
xor eax, eax
push ebp
push 0x5b2849
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 4]
call fcn.005ab038
mov edx, dword [ebp - 0x34]
lea eax, [ebp - 4]
call fcn.00407fc8
mov eax, dword [ebp - 4]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x5b2788
mov eax, dword [ebp - 0x28]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 4]
call fcn.004080d0
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x5b27b0
mov eax, dword [ebp - 0x2c]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jbe 0x5b27c9
lea eax, [ebp - 8]
call fcn.004080d0
mov dword [ebp - 0x1c], eax
jmp 0x5b27ce
xor eax, eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
call sub.Crypt32.dll_CryptUnprotectData
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
jne 0x5b27fb
call fcn.00428a80
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [ebp - 0x18]
call fcn.004084c8
mov eax, dword [ebp + 8]
call fcn.004080d0
mov edx, eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
call fcn.00404a5c
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_LocalFree_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b2850
lea eax, [ebp - 0x34]
call fcn.00407b20
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407b8c
ret
Function at 0x5b36e0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
test eax, eax
jns 0x5b3714
add eax, 3
sar eax, 2
test eax, eax
jle 0x5b3872
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x14], 1
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
movzx eax, byte [eax + edx]
cmp eax, 0x3d
jg 0x5b3751
je 0x5b37b7
sub eax, 0x2b
je 0x5b37a3
sub eax, 4
je 0x5b37ad
dec eax
sub eax, 0xa
jb 0x5b378d
jmp 0x5b37bf
add eax, 0xffffffbf
sub eax, 0x1a
jb 0x5b3763
add eax, 0xfffffffa
sub eax, 0x1a
jb 0x5b3777
jmp 0x5b37bf
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
mov al, byte [eax + edx]
sub al, 0x41
mov edx, dword [ebp - 0x18]
mov byte [ebp + edx - 0x24], al
jmp 0x5b37bf
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
mov al, byte [eax + edx]
sub al, 0x61
add al, 0x1a
mov edx, dword [ebp - 0x18]
mov byte [ebp + edx - 0x24], al
jmp 0x5b37bf
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
mov al, byte [eax + edx]
sub al, 0x30
add al, 0x34
mov edx, dword [ebp - 0x18]
mov byte [ebp + edx - 0x24], al
jmp 0x5b37bf
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x24], 0x3e
jmp 0x5b37bf
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x24], 0x3f
jmp 0x5b37bf
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x24], 0xff
inc dword [ebp - 0x1c]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jne 0x5b372e
mov al, byte [ebp - 0x24]
shl eax, 2
xor edx, edx
mov dl, byte [ebp - 0x23]
shr edx, 4
or al, dl
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
mov byte [edx + ecx], al
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x10], eax
cmp byte [ebp - 0x22], 0xff
je 0x5b3823
cmp byte [ebp - 0x21], 0xff
jne 0x5b3823
mov al, byte [ebp - 0x23]
shl eax, 4
xor edx, edx
mov dl, byte [ebp - 0x22]
shr edx, 2
or al, dl
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
mov byte [edx + ecx + 1], al
mov eax, dword [ebp - 0x20]
add eax, 2
mov dword [ebp - 0x10], eax
inc dword [ebp - 0x20]
jmp 0x5b3863
cmp byte [ebp - 0x22], 0xff
je 0x5b3863
mov al, byte [ebp - 0x23]
shl eax, 4
xor edx, edx
mov dl, byte [ebp - 0x22]
shr edx, 2
or al, dl
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
mov byte [edx + ecx + 1], al
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x20]
mov cl, byte [ebp - 0x22]
shl ecx, 6
or cl, byte [ebp - 0x21]
mov byte [eax + edx + 2], cl
mov eax, dword [ebp - 0x20]
add eax, 3
mov dword [ebp - 0x10], eax
add dword [ebp - 0x20], 2
inc dword [ebp - 0x20]
inc dword [ebp - 0x14]
dec dword [ebp - 0x30]
jne 0x5b3729
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x5b4a68
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
test eax, eax
jbe 0x5b4aa2
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x10]
dec eax
mov al, byte [eax]
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x10]
dec edx
xor byte [edx], al
inc dword [ebp - 0x10]
dec dword [ebp - 0x14]
jne 0x5b4a88
mov esp, ebp
pop ebp
ret
Function at 0x5b8ad8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407be0
xor eax, eax
push ebp
push 0x5b8c2d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
call fcn.0040897c
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call fcn.00404810
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.0040897c
push eax
call sub.version.dll_GetFileVersionInfoW
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x5b8c38
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 8]
shr eax, 0x10
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 8]
call fcn.0041f4cc
mov eax, dword [ebp - 8]
push dword [eax]
push 0x5b8c48
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 8]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x24]
call fcn.0041f4cc
push dword [ebp - 0x24]
mov eax, dword [ebp - 8]
mov edx, 3
call fcn.00408c70
mov eax, dword [ebp - 8]
push dword [eax]
push 0x5b8c48
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0xc]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x28]
call fcn.0041f4cc
push dword [ebp - 0x28]
mov eax, dword [ebp - 8]
mov edx, 3
call fcn.00408c70
mov eax, dword [ebp - 8]
push dword [eax]
push 0x5b8c48
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0xc]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x2c]
call fcn.0041f4cc
push dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
mov edx, 3
call fcn.00408c70
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.0040482c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b8c34
lea eax, [ebp - 0x2c]
mov edx, 3
call fcn.00407b5c
lea eax, [ebp - 4]
call fcn.00407afc
ret

Function at 0x5b9288
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x10
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00408b10
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040897c
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x5b92c8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00408b10
jmp 0x5b92d0
mov eax, dword [ebp - 4]
call fcn.005b91a4
pop ecx
pop ecx
pop ebp
ret