joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d69ac
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x5d69be
add esp, 0xfffffff0
call fcn.00408574
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004c1a60
mov eax, dword [0x6028f8]
mov dword [eax + 4], ebx
mov dword [eax], 0x5d6e78
mov eax, dword [0x602908]
mov dword [eax + 4], ebx
mov dword [eax], 0x5d6e84
mov eax, ebx
call fcn.005d6e90
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x489ad0]
call fcn.00407ebc
mov dword [ebx + 0x5c], eax
mov dl, 1
mov eax, dword [0x489ad0]
call fcn.00407ebc
mov dword [ebx + 0x60], eax
mov dl, 1
mov eax, dword [0x489ad0]
call fcn.00407ebc
mov dword [ebx + 0x64], eax
mov dl, 1
mov eax, dword [0x489ad0]
call fcn.00407ebc
mov dword [ebx + 0x68], eax
mov dl, 1
mov eax, dword [0x489ad0]
call fcn.00407ebc
mov dword [ebx + 0x84], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x50], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x68]
push eax
mov eax, 0x5d137c
push eax
push 0
push 0
call sub.user32.dll_EnumDisplayMonitors
mov dl, 1
mov eax, dword [0x5024bc]
call fcn.005089e4
mov dword [ebx + 0x8c], eax
mov dl, 1
mov eax, dword [0x5024bc]
call fcn.005089e4
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x5024bc]
call fcn.005089e4
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x5024bc]
call fcn.005089e4
mov dword [ebx + 0x94], eax
mov dl, 1
mov eax, dword [0x5024bc]
call fcn.005089e4
mov dword [ebx + 0x98], eax
mov eax, ebx
call fcn.005d746c
mov eax, dword [ebx + 0x8c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5d729c
mov eax, dword [ebx + 0x90]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5d729c
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5d729c
mov eax, dword [ebx + 0x94]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5d729c
mov eax, dword [ebx + 0x98]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5d729c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5d6b3e
call fcn.004085cc
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x5d703c
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5d71e7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x44], 0
jne 0x5d71c8
mov dl, 1
mov eax, dword [0x48d48c]
call fcn.004b0e7c
mov edx, dword [ebp - 4]
mov dword [edx + 0x44], eax
mov eax, dword [ebp - 4]
add eax, 0x48
call fcn.00409cd8
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x5d71b7
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0053c04c
test al, al
je 0x5d71aa
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x5d71f8
lea eax, [ebp - 0x394]
call fcn.00424858
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x5d71aa
xor eax, eax
push ebp
push 0x5d71a3
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x5d7268
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x5d718c
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.0040aaac
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov ebx, dword [eax]
call dword [ebx + 0x40]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x4c]
jne 0x5d718c
mov eax, dword [ebp - 4]
add eax, 0x48
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.0040aaac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d71aa
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x5d70ad
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov byte [eax + 0x2d], 0
mov dl, 1
call fcn.004b0da0
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x44]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d71ee
lea eax, [ebp - 0x3a0]
call fcn.00409cd8
ret

Function at 0x5d7df4
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x609150]
cmp byte [eax + 0xc5], 0
jne 0x5d7e66
cmp dword [0x609174], 0
jne 0x5d7e26
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
push 0
mov eax, dword [0x5fea4c]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x609174], eax
cmp dword [0x609170], 0
jne 0x5d7e41
push 0
push 0
push 0
push 0
call sub.KERNEL32.DLL_CreateEventW
mov dword [0x609170], eax
cmp dword [0x609178], 0
jne 0x5d7e66
push esp
push 0
push 0
mov eax, dword [0x5fea48]
push eax
push 0x3e8
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [0x609178], eax
pop edx
ret
Function at 0x5d8288
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x5d829f
add esp, 0xfffffff0
call fcn.00408574
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004c1a60
mov eax, dword [0x6027a8]
cmp byte [eax], 0
jne 0x5d82cc
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x194], al
mov eax, dword [0x602afc]
cmp word [eax + 2], 0
jne 0x5d82e6
mov eax, dword [0x602afc]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005da67c
mov eax, dword [0x602c2c]
cmp word [eax + 2], 0
jne 0x5d8300
mov eax, dword [0x602c2c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005da880
mov byte [ebx + 0x41], 0
mov dl, 1
mov eax, dword [0x5024bc]
call fcn.005089e4
mov esi, eax
mov dword [ebx + 0x54], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x5dadf8
mov dl, 1
mov eax, dword [0x489ad0]
call fcn.00407ebc
mov dword [ebx + 0xa8], eax
mov dl, 1
mov eax, dword [0x489ad0]
call fcn.00407ebc
mov dword [ebx + 0xc8], eax
xor eax, eax
mov dword [ebx + 0x74], eax
xor eax, eax
mov dword [ebx + 0x98], eax
mov dword [ebx + 0x70], 0xff000018
mov dword [ebx + 0x8c], 0x1f4
mov byte [ebx + 0x90], 1
xor eax, eax
mov dword [ebx + 0x94], eax
mov dword [ebx + 0x88], 0x9c4
mov byte [ebx + 0x9c], 0
mov byte [ebx + 0xbd], 1
mov byte [ebx + 0xd4], 1
mov dl, 1
mov eax, dword [0x507258]
call fcn.00512c3c
mov esi, eax
mov dword [ebx + 0xb8], esi
push 0x5d84f0
mov eax, dword [0x6029a8]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.00513158
mov eax, dword [ebx + 0xb8]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x5db0e0
mov dl, 1
mov eax, dword [0x489ad0]
call fcn.00407ebc
mov dword [ebx + 0xb0], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x6029a8]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_GetModuleFileNameW
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.00424658
test eax, eax
je 0x5d841a
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.004244b0
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.0042463c
test eax, eax
je 0x5d8432
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0xa4]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.0040aaac
push ebx
push 0x5da058
call fcn.005cd54c
mov dword [ebx + 0x190], eax
mov byte [ebx + 0xe8], 0
mov eax, dword [0x6027a8]
cmp byte [eax], 0
jne 0x5d8483
mov eax, ebx
call fcn.005d86d4
mov byte [ebx + 0x6d], 1
mov byte [ebx + 0x6e], 1
mov byte [ebx + 0x6f], 1
mov byte [ebx + 0xbe], 1
mov byte [ebx + 0xe9], 0
mov byte [ebx + 0xf4], 0
xor eax, eax
mov dword [ebx + 0xec], eax
mov byte [ebx + 0xeb], 0
xor eax, eax
mov dword [ebx + 0xc0], eax
mov eax, ebx
call fcn.005db318
mov eax, ebx
call fcn.005dbfa0
mov byte [ebx + 0x196], 0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5d84e7
call fcn.004085cc
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5d8a18
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x188]
test eax, eax
je 0x5d8aba
cmp dword [ebx + 0xac], 0
jne 0x5d8ab4
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x5d8954
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0xa8]
cmp dword [eax + 8], 0
je 0x5d8ab4
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x5d8a7a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x5d8ab4
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [ebx + 0xa8]
mov edx, esi
call fcn.004ac408
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x5d8a89
inc dword [ebx + 0xac]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x5d8d74
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov ebx, edx
mov esi, eax
mov eax, dword [0x609150]
cmp dword [eax + 0x188], 0
je 0x5d8eee
test bl, bl
jne 0x5d8e39
cmp dword [esi + 0xb4], 0
jne 0x5d8e2e
mov eax, esi
call fcn.005dbdf0
push eax
push 0x5d8c68
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x58], 0
je 0x5d8dff
mov eax, dword [0x609150]
cmp byte [eax + 0xeb], 0
je 0x5d8dff
mov eax, dword [esi + 0xf0]
mov dword [esp], eax
mov eax, dword [esp]
test eax, eax
je 0x5d8de0
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5d8dff
push 0
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5d8de8
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5d8e2e
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.004ac408
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5d8e0e
inc dword [esi + 0xb4]
jmp 0x5d8eee
cmp dword [esi + 0xb4], 0
jle 0x5d8eee
dec dword [esi + 0xb4]
cmp dword [esi + 0xb4], 0
jne 0x5d8eee
cmp dword [esi + 0x58], 0
je 0x5d8ea3
mov eax, dword [0x609150]
cmp byte [eax + 0xeb], 0
je 0x5d8ea3
mov eax, dword [esi + 0xf0]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
test eax, eax
je 0x5d8e84
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5d8ea3
push 5
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5d8e8c
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5d8ed2
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.004ac408
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5d8eb2
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [esi + 0xf0]
mov edx, dword [0x5c9d90]
call fcn.0040c330
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x5d9b8c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x5d9be9
cmp byte [ebx + 0xeb], 0
jne 0x5d9be9
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x188]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00409e60
mov eax, dword [esi]
test eax, eax
je 0x5d9bd6
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x5d9bf6
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040a0b8
jmp 0x5d9bf6
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040a0b8
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5db52c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x5db59d
mov eax, esi
call fcn.00535b60
test al, al
je 0x5db59d
mov eax, dword [ebx + 0x98]
call fcn.0053578c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5db59d
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x134]
test al, al
je 0x5db58e
push 0
mov eax, dword [ebx + 0x98]
call fcn.0053578c
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebx + 0x98]
xor edx, edx
call fcn.0052c238
jmp 0x5db59d
mov edx, dword [ebx + 0x88]
mov cl, 1
mov eax, ebx
call fcn.005db338
pop esi
pop ebx
ret
Function at 0x5e5870
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, eax
mov ebp, edx
xor ebx, ebx
xor edi, edi
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
test eax, eax
jle 0x5e590a
movzx edx, byte [esi + ebx]
shr edx, 2
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi], dl
movzx edx, byte [esi + ebx]
and dl, 3
movzx edx, dl
shl edx, 4
movzx ecx, byte [esi + ebx + 1]
shr ecx, 4
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
push edx
pop edx
mov byte [ebp + edi + 1], dl
movzx edx, byte [esi + ebx + 1]
and dl, 0xf
movzx edx, dl
add edx, edx
add edx, edx
movzx ecx, byte [esi + ebx + 2]
shr ecx, 6
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
push edx
pop edx
mov byte [ebp + edi + 2], dl
movzx edx, byte [esi + ebx + 2]
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi + 3], dl
add edi, 4
add ebx, 3
dec eax
jne 0x5e588f
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
dec edx
je 0x5e5920
dec edx
je 0x5e5955
jmp 0x5e59a6
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi + 1], al
mov byte [ebp + edi + 2], 0x3d
mov byte [ebp + edi + 3], 0x3d
jmp 0x5e59a6
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx edx, byte [esi + ebx + 1]
shr edx, 4
add eax, edx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi + 1], al
movzx eax, byte [esi + ebx + 1]
and al, 0xf
movzx eax, al
add eax, eax
add eax, eax
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi + 2], al
mov byte [ebp + edi + 3], 0x3d
mov eax, dword [esp]
add eax, 2
mov ecx, 3
cdq
idiv ecx
add eax, eax
add eax, eax
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5e5ab8
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov edi, eax
mov dword [esp + 8], edx
xor esi, esi
xor ebp, ebp
xor eax, eax
mov edx, dword [esp]
test edx, edx
jns 0x5e5ad7
add edx, 3
sar edx, 2
test edx, edx
jle 0x5e5be5
mov dword [esp + 0xc], edx
mov edx, 4
lea eax, [esp + 4]
movzx ecx, byte [edi + esi]
cmp ecx, 0x3d
jg 0x5e5b0c
je 0x5e5b4f
sub ecx, 0x2b
je 0x5e5b45
sub ecx, 4
je 0x5e5b4a
dec ecx
sub ecx, 0xa
jb 0x5e5b37
jmp 0x5e5b52
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x5e5b1e
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x5e5b29
jmp 0x5e5b52
movzx ecx, byte [edi + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x5e5b52
movzx ecx, byte [edi + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x5e5b52
movzx ecx, byte [edi + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x5e5b52
mov byte [eax], 0x3e
jmp 0x5e5b52
mov byte [eax], 0x3f
jmp 0x5e5b52
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x5e5aef
movzx eax, byte [esp + 4]
add eax, eax
add eax, eax
movzx edx, byte [esp + 5]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp], al
lea eax, [ebp + 1]
movzx edx, byte [esp + 6]
cmp dl, 0xff
je 0x5e5ba3
cmp byte [esp + 7], 0xff
jne 0x5e5ba3
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
lea eax, [ebp + 2]
inc ebp
jmp 0x5e5bda
cmp dl, 0xff
je 0x5e5bda
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
mov eax, dword [esp + 8]
movzx edx, byte [esp + 6]
shl edx, 6
or dl, byte [esp + 7]
mov byte [eax + ebp + 2], dl
lea eax, [ebp + 3]
add ebp, 2
inc ebp
dec dword [esp + 0xc]
jne 0x5e5ae6
add esp, 0x10
pop ebp
pop edi
pop esi
ret

Function at 0x5e81e4
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov esi, eax
mov edi, edx
mov edx, ecx
dec edx
test edx, edx
jb 0x5e81ff
inc edx
xor eax, eax
movzx ecx, byte [edi + eax]
xor byte [esi + eax], cl
inc eax
dec edx
jne 0x5e81f4
pop edi
pop esi
ret
Function at 0x5ee188
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x11
push 0
push 0
dec ecx
jne 0x5ee190
push ebx
push esi
push edi
mov dword [ebp - 0x40], edx
mov ebx, eax
lea eax, [ebp - 0x1c]
mov edx, dword [0x5ea4d4]
call fcn.0040b0fc
lea eax, [ebp - 0x24]
mov edx, dword [0x5ea4d4]
call fcn.0040b0fc
lea eax, [ebp - 0x2c]
mov edx, dword [0x5ea4d4]
call fcn.0040b0fc
lea eax, [ebp - 0x34]
mov edx, dword [0x5ea4d4]
call fcn.0040b0fc
lea eax, [ebp - 0x3c]
mov edx, dword [0x5ea4d4]
call fcn.0040b0fc
xor eax, eax
push ebp
push 0x5ee673
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x50], bl
mov eax, 0xff
call fcn.00407278
mov byte [ebp - 0x4f], al
mov eax, 0xff
call fcn.00407278
mov byte [ebp - 0x4e], al
mov eax, 0xff
call fcn.00407278
mov byte [ebp - 0x4d], al
mov eax, 0xff
call fcn.00407278
mov byte [ebp - 0x4c], al
mov eax, 0xff
call fcn.00407278
mov byte [ebp - 0x4b], al
mov eax, 0xff
call fcn.00407278
mov byte [ebp - 0x4a], al
mov eax, 0xff
call fcn.00407278
mov byte [ebp - 0x49], al
mov eax, 0xff
call fcn.00407278
mov byte [ebp - 0x48], al
mov eax, 0xff
call fcn.00407278
mov byte [ebp - 0x47], al
mov eax, 0xff
call fcn.00407278
mov byte [ebp - 0x46], al
mov eax, 0xff
call fcn.00407278
mov byte [ebp - 0x45], al
mov eax, 0xff
call fcn.00407278
mov byte [ebp - 0x44], al
mov eax, 0xff
call fcn.00407278
mov byte [ebp - 0x43], al
mov byte [ebp - 0x41], 0
mov ebx, 0xe
lea eax, [ebp - 0x50]
movzx edx, byte [eax]
xor dl, byte [ebp - 0x41]
movzx edx, dl
movzx edx, byte [edx + 0x601dec]
mov byte [ebp - 0x41], dl
inc eax
dec ebx
jne 0x5ee2ab
movzx eax, byte [ebp - 0x41]
mov byte [ebp - 0x42], al
lea eax, [ebp - 4]
call fcn.00409cfc
mov ebx, 0xf
lea esi, [ebp - 0x50]
lea eax, [ebp - 0x54]
mov edx, dword [ebp - 4]
call fcn.0040aac8
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x58]
movzx eax, byte [esi]
mov edx, 2
call fcn.00423a58
mov edx, dword [ebp - 0x58]
pop eax
call fcn.0040ac04
mov edx, dword [ebp - 0x54]
lea eax, [ebp - 4]
mov ecx, 0
call fcn.0040a79c
inc esi
dec ebx
jne 0x5ee2d9
lea edx, [ebp - 0x1c]
mov eax, 0x5ee690
Function at 0x5eeb08
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x254], ebx
mov dword [ebp - 0x258], ebx
mov dword [ebp - 0x24c], ebx
mov dword [ebp - 0x250], ebx
mov dword [ebp - 0x240], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5eeca5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00409cd8
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
lea eax, [ebp - 0x240]
push eax
mov dword [ebp - 0x248], ebx
mov byte [ebp - 0x244], 0
lea edx, [ebp - 0x248]
xor ecx, ecx
mov eax, 0x5eecc0
call fcn.00424928
mov eax, dword [ebp - 0x240]
call fcn.0040aa08
push eax
call sub.KERNEL32.DLL_CreateFileW
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x5eeba3
call fcn.0042b77c
lea eax, [ebp - 0x18]
xor ecx, ecx
mov edx, 0xc
call fcn.00407828
lea eax, [ebp - 0x23c]
xor ecx, ecx
mov edx, 0x224
call fcn.00407828
mov eax, 0x224
mov dword [ebp - 0x238], eax
push 0
lea edx, [ebp - 0xc]
push edx
push eax
lea eax, [ebp - 0x23c]
push eax
push 0xc
lea eax, [ebp - 0x18]
push eax
push 0x2d1400
push ebx
call sub.KERNEL32.DLL_DeviceIoControl
test eax, eax
jne 0x5eebf7
call fcn.0042b77c
mov eax, dword [ebp - 0x22c]
test eax, eax
je 0x5eec34
lea esi, [ebp + eax - 0x23c]
lea eax, [ebp - 0x250]
mov edx, esi
call fcn.0040aa40
mov eax, dword [ebp - 0x250]
lea edx, [ebp - 0x24c]
call fcn.00422d74
mov edx, dword [ebp - 0x24c]
mov eax, dword [ebp - 4]
call fcn.0040a0b8
mov eax, dword [ebp - 0x228]
test eax, eax
je 0x5eec71
lea esi, [ebp + eax - 0x23c]
lea eax, [ebp - 0x258]
mov edx, esi
call fcn.0040aa40
mov eax, dword [ebp - 0x258]
lea edx, [ebp - 0x254]
call fcn.00422d74
mov edx, dword [ebp - 0x254]
mov eax, dword [ebp - 8]
call fcn.0040a0b8
cmp ebx, 0xffffffff
je 0x5eec7c
push ebx
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5eecac
lea eax, [ebp - 0x258]
mov edx, 4
call fcn.00409d38
lea eax, [ebp - 0x240]
call fcn.00409cd8
ret
Function at 0x5ef794
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffe08
mov ebx, eax
mov esi, 0x5ef7d4
mov edi, esp
mov ecx, 0x7d
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0
push 0x23
lea eax, [esp + 8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
mov edx, ebx
mov eax, esp
call fcn.00424740
add esp, 0x1f8
pop edi
pop esi
pop ebx
ret

Function at 0x100010a0
Capabilities:
Encode data using xor

Disassembly:
dec esp
add al, 0xb6
push esp
sub eax, 0x4165f76f
dec ebp
mov ebx, 0x4fc30577
and dword [eax - 1], eax
lahf
invalid

Function at 0x103b66bc
Capabilities:
Encode data using xor

Disassembly:
jmp 0x103b66c6
pushal
call 0x103b66cc
pop ebp
sub ebp, 0x10
sub ebp, 0x3b66bc
mov al, byte [esp + 0x28]
cmp al, 1
je 0x103b66f0
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x103b66f9
mov eax, 0x3b66bc
add eax, ebp
add eax, 0x63
mov ecx, 0x5f3
mov edx, 0xd45c2af4
xor byte [eax], dl
inc eax
dec ecx
jne 0x103b6710
jmp 0x103b6723
jg 0x103b675e
jg 0x103b67a4
enter 0xfffffffffffff4f4, 0xfffffffffffffff4
jne 0x103b6762
or al, 0xf4
hlt
push ds
fdiv st(4)
cmc
fcom st(0)
pushfd
adc byte [edx + 0x75], ah
sbb al, 0xf1
hlt
invalid
Function at 0x1001aeee
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x1001aefd
pop dword [ebp - 0x44]
mov eax, 0x5c5e3ca5
add eax, 0xb3a37258
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x789d9516
sub dword [ebp - 0x54], 0x2a4b4fcb
mov dword [ebp - 0x50], 0xc4c8c69b
add dword [ebp - 0x50], 0x6d6a85aa
mov dword [ebp - 0x4c], 0x33e28d92
sub dword [ebp - 0x4c], 0xe7964964
mov dword [ebp - 0x48], 0xbfaa5125
sub dword [ebp - 0x48], 0xbfaa5125
lea eax, [ebp - 0x54]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xe5d76d8f
sub dword [ebp - 0x54], 0x71650439
mov dword [ebp - 0x50], 0x5012aeb4
sub dword [ebp - 0x50], 0xea64d3f
mov dword [ebp - 0x4c], 0x9c60d706
add dword [ebp - 0x4c], 0xc70e9566
mov dword [ebp - 0x48], 0x71217a4
add dword [ebp - 0x48], 0xf8ede85c
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x5bac6fec
sub eax, 0x4baaafec
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x37fa6
push 0
call eax
mov ecx, 0x4a32
mov edx, eax
mov edi, 0xe344638b
sub edi, 0xd341fb8b
add edi, dword [ebp - 0x44]
mov esi, 0x9d45cdc6
xor dword [ebp - 0xc], 0x8e0f2000
mov ebx, dword [edi]
add dword [ebp - 0x1c], 0xdc5a46fe
xor ebx, esi
sub dword [ebp - 0x40], eax
mov dword [edx], ebx
xor dword [ebp - 0x1c], esi
add edx, 0x38fa1fbf
sub edx, 0x38fa1fbb
add edi, 0x63669b2c
add edi, 0x9c9964d8
loop 0x1001b00e
add eax, 0x57ab5f86
sub eax, 0x57aa43eb
mov ebx, eax
add eax, 0x7ca89fbf
sub eax, 0x7ca89fba
mov ecx, 0x2ae83a16
add ecx, 0xe517c5ea
add ecx, dword [ebp - 0x44]
call ebx
leave
ret