joyce8/EMBER2024-capa huggingface dataset:
Function at 0x563d74
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x563eca
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, dword [ebp - 8]
call fcn.0044e838
xor eax, eax
push ebp
push 0x563ea5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x44]
xor eax, eax
mov dword [ebp - 0x10], eax
push 0x20019
lea eax, [ebp - 0x10]
push eax
mov eax, esi
call fcn.0040804c
mov edx, eax
mov eax, ebx
call fcn.00562fc8
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.005630a4
test eax, eax
jne 0x563e86
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryInfoKeyW
test eax, eax
jne 0x563e7b
mov edx, dword [ebp - 0x1c]
inc edx
lea eax, [ebp - 4]
call fcn.004081e0
cmp dword [ebp - 0x18], 0
je 0x563e77
mov ebx, dword [ebp - 0x18]
dec ebx
test ebx, ebx
jb 0x563e77
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x14], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
call fcn.0040804c
push eax
push esi
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov eax, dword [ebp - 4]
call fcn.0040804c
mov edx, eax
lea eax, [ebp - 0x20]
call fcn.004080b4
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec ebx
jne 0x563e30
mov byte [ebp - 9], 1
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey
jmp 0x563e8f
mov edx, esi
mov eax, ebx
call fcn.00562e3c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x563eac
mov eax, dword [ebp - 8]
call fcn.0044e8f8
ret

Function at 0x5651b8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0040804c
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x5651d1
test al, 0x10
jne 0x5651d5
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x5651dc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
test ebx, ebx
je 0x5651fa
push ebx
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x5651f2
test al, 0x10
je 0x5651f6
xor eax, eax
jmp 0x5651fc
mov al, 1
pop ebx
ret
xor eax, eax
pop ebx
ret
Function at 0x5658bc
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x565972
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
mov eax, esi
call fcn.0040804c
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
jbe 0x56595c
lea eax, [ebp - 4]
mov edx, edi
call fcn.004081e0
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
push eax
push edi
mov eax, dword [ebp - 0x10]
push eax
mov eax, esi
call fcn.0040804c
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x56595c
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x565984
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x56595c
cmp dword [ebp - 0xc], 0x34
jne 0x56595c
mov bl, 1
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x565979
lea eax, [ebp - 4]
call fcn.004070a4
ret

Function at 0x5659ec
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
test dl, dl
je 0x565a01
add esp, 0xfffffff0
call fcn.00405948
mov edi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov eax, edi
call fcn.005651dc
test al, al
jne 0x565a37
mov dword [ebp - 0x10], edi
mov byte [ebp - 0xc], 0x11
lea eax, [ebp - 0x10]
push eax
push 0
mov ecx, dword [0x6a6928]
mov dl, 1
mov eax, dword [0x564488]
call fcn.004285f8
call fcn.00406780
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
mov eax, edi
call fcn.0040804c
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
jne 0x565a6a
mov ecx, dword [0x6a6b40]
mov dl, 1
mov eax, dword [0x564488]
call fcn.00428528
call fcn.00406780
lea eax, [ebx + 4]
xor ecx, ecx
mov edx, esi
call fcn.00407c44
mov eax, dword [ebx + 4]
call fcn.00407b04
push eax
push esi
mov eax, dword [ebp - 8]
push eax
mov eax, edi
call fcn.0040804c
push eax
call sub.version.dll_GetFileVersionInfoW
call fcn.0042a3ec
mov eax, ebx
call fcn.00566300
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x565ab4
call fcn.004059a0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x567e9c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5680f6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
mov edx, 0x24
call fcn.005670a0
lea eax, [ebp - 0x28]
push eax
call sub.KERNEL32.DLL_GetSystemInfo_1
mov eax, dword [ebp - 0x14]
mov dword [0x69c5e8], eax
mov eax, dword [ebp - 0xc]
mov dword [0x69c5ec], eax
mov eax, dword [ebp - 0x24]
mov dword [0x69c5f0], eax
mov eax, dword [0x6a7434]
cmp dword [eax], 2
sete byte [0x69bdc5]
push 0x568104
call sub.KERNEL32.DLL_GetModuleHandleW_2
lea edx, [ebp - 4]
call fcn.00565200
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp byte [0x69bdc5], 0
jne 0x567f2b
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.005658bc
test al, al
je 0x567f2b
mov eax, dword [ebp - 0x4c]
mov dword [0x72e9a4], eax
jmp 0x567f32
xor eax, eax
mov dword [0x72e9a4], eax
call fcn.005672a4
and eax, 0x7f
cmp eax, 0x1a
ja case.0x567f43.0
jmp dword [eax*4 + 0x567f4a]
mov byte [0x69bdc0], 1
jmp case.0x567f43.0
mov byte [0x69bdc1], 1
jmp case.0x567f43.0
mov byte [0x69bdc2], 1
jmp case.0x567f43.0
mov byte [0x69bdc3], 1
jmp case.0x567f43.0
mov byte [0x69bdc4], 1
jmp case.0x567f43.0
mov byte [0x69bdc6], 1
mov byte [0x69bdc7], 1
jmp case.0x567f43.0
mov byte [0x69bdc6], 1
mov byte [0x69bdc8], 1
jmp case.0x567f43.0
mov byte [0x69bdc6], 1
mov byte [0x69bdc8], 1
mov byte [0x69bdc9], 1
jmp case.0x567f43.0
mov byte [0x69bdca], 1
jmp case.0x567f43.0
mov byte [0x69bdcb], 1
jmp case.0x567f43.0
mov byte [0x69bdcc], 1
jmp case.0x567f43.0
mov byte [0x69bdcd], 1
jmp case.0x567f43.0
mov byte [0x69bdce], 1
jmp case.0x567f43.0
mov byte [0x69bdcf], 1
jmp case.0x567f43.0
mov byte [0x69bdd0], 1
jmp case.0x567f43.0
mov byte [0x69bdd1], 1
jmp case.0x567f43.0
mov byte [0x69bdd2], 1
jmp case.0x567f43.0
mov byte [0x69bdd3], 1
jmp case.0x567f43.0
mov byte [0x69bdd4], 1
jmp case.0x567f43.0
mov byte [0x69bdd5], 1
jmp case.0x567f43.0
mov byte [0x69bdd6], 1
jmp case.0x567f43.0
mov byte [0x69bdd7], 1
jmp case.0x567f43.0
mov byte [0x69bdd8], 1
jmp case.0x567f43.0
mov byte [0x69bdd9], 1
jmp case.0x567f43.0
mov byte [0x69bdda], 1
jmp case.0x567f43.0
mov byte [0x69bddb], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5680fd
lea eax, [ebp - 4]
call fcn.004070a4
ret
Function at 0x56e2a0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x56e2ce
mov eax, ebx
call fcn.0056ed5c
cmp dword [ebx + 0x40], 0
je 0x56e2c7
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x56e33f
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x56e331
cmp dword [ebx + 8], 0
je 0x56e2f0
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x56e302
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x56e331
cmp dword [ebx + 8], 0
je 0x56e2e3
cmp eax, 3
je 0x56e315
dec eax
jne 0x56e2e3
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x56e2e3
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x56e2e3
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x56e35d
cmp dword [ebx + 0x14], 0xcc
je 0x56e35d
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0056e368
pop ebx
ret
Function at 0x5acd00
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x72f304], 0
jne 0x5acd17
call fcn.005accbc
mov eax, edi
dec eax
test eax, eax
jl 0x5acd3f
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x72ef04]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x5acd21
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x5afa10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x5afaaa.0
jmp dword [ecx*4 + 0x5afa43]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x5afa75
sub dl, 8
je 0x5afa84
jmp case.0x5afaaa.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5af6dc
jmp case.0x5afaaa.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5af730
jmp case.0x5afaaa.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x5afaaa.0
movzx ecx, byte [ecx + 0x5afab1]
jmp dword [ecx*4 + 0x5afac2]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5af7d0
jmp case.0x5afaaa.0
cmp dl, 3
jne 0x5afaef
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5af828
jmp case.0x5afaaa.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5af7e4
jmp case.0x5afaaa.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5af86c
jmp case.0x5afaaa.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x5afb1a
sub dl, 8
je 0x5afb26
jmp case.0x5afaaa.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5af898
jmp case.0x5afaaa.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5af8fc
jmp case.0x5afaaa.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x5afb45
sub dl, 8
je 0x5afb51
jmp case.0x5afaaa.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5af9ac
jmp case.0x5afaaa.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5af9d4
mov edx, dword [eax + 0x468]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x450]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 8], esi
add edx, dword [eax + 0x44c]
mov dword [ebp - 0x10], edx
mov esi, ecx
test esi, esi
jb 0x5afbf3
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.005aec18
test eax, eax
je 0x5afbf3
mov eax, ebx
call fcn.005afbfc
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x5afb8c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5afbfc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x5afc2d
dec al
je 0x5afc68
dec al
je 0x5afcad
dec al
je 0x5afd16
jmp 0x5afda0
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x5afda0
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x5afc3d
jmp 0x5afda0
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5afda0
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x5afc78
jmp 0x5afda0
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5afda0
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x5afcdc
xor ebp, ebp
jmp 0x5afcec
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x5afcf5
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x5afcbd
jmp 0x5afda0
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5afda0
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x5afd6f
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.005acd48
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x5afd2a
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5b6fe4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5b70f7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.004070a4
xor eax, eax
push ebp
push 0x5b70bd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.004074cc
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040804c
mov ebx, eax
push ebx
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x5b70b3
mov eax, dword [ebp - 0xc]
call fcn.00404668
mov edi, eax
push edi
mov eax, dword [ebp - 0xc]
push eax
push 0
push ebx
call sub.version.dll_GetFileVersionInfoW
mov esi, 1
mov ebx, 0x69ef78
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebx]
lea eax, [ebp - 0x18]
mov edx, 0x5b7114
call fcn.004082b8
mov eax, dword [ebp - 0x18]
call fcn.0040804c
push eax
push edi
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x5b70a0
cmp esi, 3
jne 0x5b70a0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
call fcn.004080b4
inc esi
add ebx, 4
cmp esi, 0xb
jne 0x5b7066
mov edx, dword [ebp - 0xc]
mov eax, edi
call fcn.004046b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5b70d9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b70fe
lea eax, [ebp - 0x18]
call fcn.004070a4
lea eax, [ebp - 4]
call fcn.004070a4
ret

Function at 0x5b8a10
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
call fcn.00407188
xor eax, eax
push ebp
push 0x5b8b0e
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, edx
test eax, eax
je 0x5b8a46
sub eax, 4
mov eax, dword [eax]
cmp eax, 0xff
jg 0x5b8a5c
mov eax, edx
test eax, eax
je 0x5b8a58
sub eax, 4
mov eax, dword [eax]
mov ecx, eax
jmp 0x5b8a72
mov ecx, 0x5b8b28
mov dl, 1
mov eax, dword [0x5b895c]
call fcn.004283f4
call fcn.00406780
xor ebx, ebx
movzx eax, bl
mov edx, dword [ebp - 8]
mov byte [edx + eax + 4], bl
inc ebx
test bl, bl
jne 0x5b8a74
xor ebx, ebx
lea esi, [ebp - 0x109]
movzx eax, bl
movzx edx, cl
mov edi, edx
xor edx, edx
div edi
mov eax, dword [ebp - 4]
movzx eax, word [eax + edx*2]
mov byte [esi], al
inc ebx
inc esi
test bl, bl
jne 0x5b8a8b
mov byte [ebp - 9], 0
xor ebx, ebx
lea esi, [ebp - 0x109]
movzx eax, bl
mov edx, dword [ebp - 8]
movzx eax, byte [edx + eax + 4]
movzx edx, byte [ebp - 9]
add eax, edx
movzx edx, byte [esi]
add eax, edx
and eax, 0xff
mov byte [ebp - 9], al
movzx ecx, byte [ebp - 9]
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.005b89ec
inc ebx
inc esi
test bl, bl
jne 0x5b8ab2
mov eax, dword [ebp - 8]
mov byte [eax + 0x104], 0
mov eax, dword [ebp - 8]
mov byte [eax + 0x105], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b8b15
lea eax, [ebp - 4]
call fcn.004070a4
ret
Function at 0x5b8f78
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00407188
xor eax, eax
push ebp
push 0x5b9072
push dword fs:[eax]
mov dword fs:[eax], esp
mov edi, dword [ebp - 4]
mov ebx, edi
test ebx, ebx
je 0x5b8fad
sub ebx, 4
mov ebx, dword [ebx]
push ebx
mov eax, dword [ebp - 8]
mov ecx, 1
mov edx, dword [0x5b87a4]
call fcn.00409514
add esp, 4
mov eax, edi
test eax, eax
je 0x5b8fcf
sub eax, 4
mov eax, dword [eax]
test al, al
jbe 0x5b905c
mov byte [ebp - 9], al
mov bl, 1
movzx eax, byte [esi + 0x104]
inc eax
and eax, 0xff
mov byte [esi + 0x104], al
movzx edx, byte [esi + 0x105]
movzx eax, al
movzx eax, byte [esi + eax + 4]
add edx, eax
and edx, 0xff
mov byte [esi + 0x105], dl
mov ecx, edx
mov eax, esi
movzx edx, byte [esi + 0x104]
call fcn.005b89ec
movzx eax, byte [esi + 0x104]
movzx eax, byte [esi + eax + 4]
movzx edx, byte [esi + 0x105]
movzx edx, byte [esi + edx + 4]
add eax, edx
and eax, 0xff
movzx edx, bl
mov ecx, dword [ebp - 4]
movzx ecx, word [ecx + edx*2 - 2]
movzx eax, al
xor cl, byte [esi + eax + 4]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov byte [eax + edx - 1], cl
inc ebx
dec byte [ebp - 9]
jne 0x5b8fdc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b9079
lea eax, [ebp - 4]
call fcn.004070a4
ret

Function at 0x5c6afc
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
mov ebx, eax
xor esi, esi
push 0x40
push ebx
call sub.KERNEL32.DLL_IsBadReadPtr
test eax, eax
jne 0x5c6b3b
mov eax, ebx
cmp word [eax], 0x5a4d
jne 0x5c6b3b
cmp dword [eax + 0x3c], 0
je 0x5c6b3b
mov esi, dword [eax + 0x3c]
add esi, ebx
push 0xf8
push esi
call sub.KERNEL32.DLL_IsBadReadPtr
test eax, eax
jne 0x5c6b39
cmp dword [esi], 0x4550
je 0x5c6b3b
xor esi, esi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x5c6b40
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
mov ebx, eax
xor esi, esi
push 0x40
push ebx
call sub.KERNEL32.DLL_IsBadReadPtr
test eax, eax
jne 0x5c6b7f
mov eax, ebx
cmp word [eax], 0x5a4d
jne 0x5c6b7f
cmp dword [eax + 0x3c], 0
je 0x5c6b7f
mov esi, dword [eax + 0x3c]
add esi, ebx
push 0x108
push esi
call sub.KERNEL32.DLL_IsBadReadPtr
test eax, eax
jne 0x5c6b7d
cmp dword [esi], 0x4550
je 0x5c6b7f
xor esi, esi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x5f2fdc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffd8
mov ebx, eax
mov eax, dword [ebx + 0x3f0]
test eax, eax
je 0x5f30d2
mov edx, 0x64
sub edx, eax
dec edx
jle 0x5f3009
mov eax, 0x64
sub eax, dword [ebx + 0x3f0]
jmp 0x5f300e
mov eax, 1
mov edi, eax
call sub.KERNEL32.DLL_GetTickCount_1
xor edx, edx
push edx
push eax
mov eax, dword [ebx + 0x3a0]
xor edx, edx
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
mov esi, eax
cmp edi, esi
ja 0x5f30d2
mov eax, 0x64
mov edi, dword [ebx + 0x3f0]
sub eax, edi
mov dword [esp + 8], eax
fild dword [esp + 8]
mov dword [esp + 0xc], edi
fild dword [esp + 0xc]
fdivp st(1)
mov dword [esp + 0x10], esi
xor eax, eax
mov dword [esp + 0x14], eax
fild qword [esp + 0x10]
fdivrp st(1)
call fcn.00404c64
mov edi, eax
mov eax, edi
xor edx, edx
cmp edx, 0
jne 0x5f307a
cmp eax, 0x64
jae 0x5f3089
jmp 0x5f307c
jge 0x5f3089
mov eax, edi
xor edx, edx
mov dword [esp], eax
mov dword [esp + 4], edx
jmp 0x5f3098
mov dword [esp], 0x64
mov dword [esp + 4], 0
mov eax, dword [esp]
mov edi, eax
push 1
mov dword [esp + 0x1c], esi
mov byte [esp + 0x20], 0
mov dword [esp + 0x24], edi
mov byte [esp + 0x28], 0
lea ecx, [esp + 0x1c]
mov edx, 0x5f30e8
mov eax, ebx
call fcn.005f44b4
push edi
call sub.KERNEL32.DLL_Sleep_1
call sub.KERNEL32.DLL_GetTickCount_1
mov dword [ebx + 0x3a0], eax
add esp, 0x28
pop edi
pop esi
pop ebx
ret
Function at 0x5fce88
Capabilities:
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebx
call fcn.0040509c
je 0x5fcec9
mov ebx, eax
xor eax, eax
mov dword [ebx], eax
xor eax, eax
mov dword [ebx + 4], eax
push 0xf0000000
push 1
push 0
push 0
push ebx
call sub.advapi32.dll_CryptAcquireContextW
test eax, eax
je 0x5fcec7
lea eax, [ebx + 4]
push eax
push 0
push 0
push 0x8003
mov eax, dword [ebx]
push eax
call sub.advapi32.dll_CryptCreateHash
test eax, eax
mov eax, ebx
pop ebx
ret

Function at 0x5fd1a0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff8
mov dword [esp], edx
mov edi, eax
mov eax, dword [esp]
test eax, eax
je 0x5fd1b7
sub eax, 4
mov eax, dword [eax]
mov dword [esp + 4], eax
xor ebp, ebp
mov eax, edi
mov edx, ebp
mov byte [eax], dl
inc ebp
inc eax
cmp ebp, 0x100
jne 0x5fd1bf
xor esi, esi
xor ebp, ebp
mov ecx, edi
mov eax, ebp
cdq
idiv dword [esp + 4]
mov eax, dword [esp]
movzx eax, byte [eax + edx]
mov edx, esi
add dl, byte [ecx]
add al, dl
movzx eax, al
mov esi, eax
movzx eax, byte [ecx]
movzx edx, byte [edi + esi]
mov byte [ecx], dl
mov byte [edi + esi], al
inc ebp
inc ecx
cmp ebp, 0x100
jne 0x5fd1d3
xor eax, eax
mov dword [edi + 0x100], eax
xor eax, eax
mov dword [edi + 0x104], eax
mov eax, edi
call fcn.005fd220
pop ecx
pop edx
pop ebp
pop edi
pop esi
ret

Function at 0x5fd280
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov ebp, edx
mov esi, eax
cmp dword [esp], 0
jle 0x5fd2b3
mov ebx, dword [esp]
dec ebx
test ebx, ebx
jl 0x5fd2b3
inc ebx
xor edi, edi
mov eax, esi
call fcn.005fd264
xor byte [ebp + edi], al
mov eax, esi
call fcn.005fd220
inc edi
dec ebx
jne 0x5fd29d
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x5fd2ec
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov ebp, edx
mov esi, eax
cmp dword [esp], 0
jle 0x5fd31f
mov ebx, dword [esp]
dec ebx
test ebx, ebx
jl 0x5fd31f
inc ebx
xor edi, edi
mov eax, esi
call fcn.005fd264
xor byte [ebp + edi], al
mov eax, esi
call fcn.005fd220
inc edi
dec ebx
jne 0x5fd309
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret