joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d185c
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5d1a07
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x44], 0
jne 0x5d19e8
mov dl, 1
mov eax, dword [0x48d594]
call fcn.004b0eac
mov edx, dword [ebp - 4]
mov dword [edx + 0x44], eax
mov eax, dword [ebp - 4]
add eax, 0x48
call fcn.0040a7a4
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x5d19d7
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00532d94
test al, al
je 0x5d19ca
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x5d1a18
lea eax, [ebp - 0x394]
call fcn.00425068
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x5d19ca
xor eax, eax
push ebp
push 0x5d19c3
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x5d1a88
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x5d19ac
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, 0x100
call fcn.0040b414
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov ebx, dword [eax]
call dword [ebx + 0x40]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x4c]
jne 0x5d19ac
mov eax, dword [ebp - 4]
add eax, 0x48
lea edx, [ebp - 0x314]
mov ecx, 0x100
call fcn.0040b414
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d19ca
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x5d18cd
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov byte [eax + 0x2d], 0
mov dl, 1
call fcn.004b0dd0
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x44]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d1a0e
lea eax, [ebp - 0x3a0]
call fcn.0040a7a4
ret

Function at 0x5d2614
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x6aa148]
cmp byte [eax + 0xc5], 0
jne 0x5d2686
cmp dword [0x6aa16c], 0
jne 0x5d2646
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, dword [0x69f1ec]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x6aa16c], eax
cmp dword [0x6aa168], 0
jne 0x5d2661
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x6aa168], eax
cmp dword [0x6aa170], 0
jne 0x5d2686
push esp
push 0
push 0
mov eax, dword [0x69f1e8]
push eax
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x6aa170], eax
pop edx
ret
Function at 0x5d2aa8
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x5d2abf
add esp, 0xfffffff0
call fcn.00409004
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004c1868
mov eax, dword [0x6a3010]
cmp byte [eax], 0
jne 0x5d2aec
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x194], al
mov eax, dword [0x6a3764]
cmp word [eax + 2], 0
jne 0x5d2b06
mov eax, dword [0x6a3764]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005d4e9c
mov eax, dword [0x6a39f0]
cmp word [eax + 2], 0
jne 0x5d2b20
mov eax, dword [0x6a39f0]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005d50a0
mov byte [ebx + 0x41], 0
mov dl, 1
mov eax, dword [0x4f15b8]
call fcn.004f7ae0
mov esi, eax
mov dword [ebx + 0x54], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x5d5618
mov dl, 1
mov eax, dword [0x489bd8]
call fcn.0040894c
mov dword [ebx + 0xa8], eax
mov dl, 1
mov eax, dword [0x489bd8]
call fcn.0040894c
mov dword [ebx + 0xc8], eax
xor eax, eax
mov dword [ebx + 0x74], eax
xor eax, eax
mov dword [ebx + 0x98], eax
mov dword [ebx + 0x70], 0xff000018
mov dword [ebx + 0x8c], 0x1f4
mov byte [ebx + 0x90], 1
xor eax, eax
mov dword [ebx + 0x94], eax
mov dword [ebx + 0x88], 0x9c4
mov byte [ebx + 0x9c], 0
mov byte [ebx + 0xbd], 1
mov byte [ebx + 0xd4], 1
mov dl, 1
mov eax, dword [0x4f6354]
call fcn.00501e20
mov esi, eax
mov dword [ebx + 0xb8], esi
push 0x5d2d10
mov eax, dword [0x6a3480]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.0050234c
mov eax, dword [ebx + 0xb8]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x5d5900
mov dl, 1
mov eax, dword [0x489bd8]
call fcn.0040894c
mov dword [ebx + 0xb0], eax
push 0x100
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x6a3480]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.00424e68
test eax, eax
je 0x5d2c3a
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.00424cc0
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.00424e4c
test eax, eax
je 0x5d2c52
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW_1
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0xa4]
lea edx, [ebp - 0x202]
mov ecx, 0x100
call fcn.0040b414
push ebx
push 0x5d4878
call fcn.005c7d74
mov dword [ebx + 0x190], eax
mov byte [ebx + 0xe8], 0
mov eax, dword [0x6a3010]
cmp byte [eax], 0
jne 0x5d2ca3
mov eax, ebx
call fcn.005d2ef4
mov byte [ebx + 0x6d], 1
mov byte [ebx + 0x6e], 1
mov byte [ebx + 0x6f], 1
mov byte [ebx + 0xbe], 1
mov byte [ebx + 0xe9], 0
mov byte [ebx + 0xf4], 0
xor eax, eax
mov dword [ebx + 0xec], eax
mov byte [ebx + 0xeb], 0
xor eax, eax
mov dword [ebx + 0xc0], eax
mov eax, ebx
call fcn.005d5b38
mov eax, ebx
call fcn.005d67c0
mov byte [ebx + 0x196], 0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5d2d07
call fcn.0040905c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5d3238
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x188]
test eax, eax
je 0x5d32da
cmp dword [ebx + 0xac], 0
jne 0x5d32d4
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x5d3174
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0xa8]
cmp dword [eax + 8], 0
je 0x5d32d4
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x5d329a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x5d32d4
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [ebx + 0xa8]
mov edx, esi
call fcn.004ac3f0
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x5d32a9
inc dword [ebx + 0xac]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x5d3594
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov ebx, edx
mov esi, eax
mov eax, dword [0x6aa148]
cmp dword [eax + 0x188], 0
je 0x5d370e
test bl, bl
jne 0x5d3659
cmp dword [esi + 0xb4], 0
jne 0x5d364e
mov eax, esi
call fcn.005d6610
push eax
push 0x5d3488
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x58], 0
je 0x5d361f
mov eax, dword [0x6aa148]
cmp byte [eax + 0xeb], 0
je 0x5d361f
mov eax, dword [esi + 0xf0]
mov dword [esp], eax
mov eax, dword [esp]
test eax, eax
je 0x5d3600
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5d361f
push 0
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5d3608
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5d364e
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.004ac3f0
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5d362e
inc dword [esi + 0xb4]
jmp 0x5d370e
cmp dword [esi + 0xb4], 0
jle 0x5d370e
dec dword [esi + 0xb4]
cmp dword [esi + 0xb4], 0
jne 0x5d370e
cmp dword [esi + 0x58], 0
je 0x5d36c3
mov eax, dword [0x6aa148]
cmp byte [eax + 0xeb], 0
je 0x5d36c3
mov eax, dword [esi + 0xf0]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
test eax, eax
je 0x5d36a4
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5d36c3
push 5
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5d36ac
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5d36f2
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.004ac3f0
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5d36d2
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [esi + 0xf0]
mov edx, dword [0x5c4bb0]
call fcn.0040cd04
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x5d43ac
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x5d4409
cmp byte [ebx + 0xeb], 0
jne 0x5d4409
push 0x100
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x188]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040a92c
mov eax, dword [esi]
test eax, eax
je 0x5d43f6
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x5d4416
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040ab84
jmp 0x5d4416
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040ab84
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5d5d4c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x5d5dbd
mov eax, esi
call fcn.0052c8b4
test al, al
je 0x5d5dbd
mov eax, dword [ebx + 0x98]
call fcn.0052c4e0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5d5dbd
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x134]
test al, al
je 0x5d5dae
push 0
mov eax, dword [ebx + 0x98]
call fcn.0052c4e0
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebx + 0x98]
xor edx, edx
call fcn.00522f98
jmp 0x5d5dbd
mov edx, dword [ebx + 0x88]
mov cl, 1
mov eax, ebx
call fcn.005d5b58
pop esi
pop ebx
ret
Function at 0x5da6fc
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
cmp dword [ebx + 0x8c], 0
jne 0x5da77a
mov eax, dword [ebx + 8]
call fcn.0052c4e0
mov ecx, eax
mov dl, 1
mov eax, dword [0x53aa60]
call fcn.0052664c
mov dword [ebx + 0x8c], eax
mov esi, dword [ebx + 0x8c]
xor edx, edx
mov eax, esi
call fcn.00542b00
mov dword [esi + 0x2cc], ebx
mov dword [esi + 0x2c8], 0x5d9fcc
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
push 0
mov eax, dword [ebx + 0x8c]
call fcn.0052c4e0
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x8c]
call fcn.0052c4e0
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x9c], 0
jne 0x5da7f4
mov eax, dword [ebx + 8]
call fcn.0052c4e0
mov ecx, eax
mov dl, 1
mov eax, dword [0x53aa60]
call fcn.0052664c
mov dword [ebx + 0x9c], eax
mov esi, dword [ebx + 0x9c]
mov dl, 1
mov eax, esi
call fcn.00542b00
mov dword [esi + 0x2cc], ebx
mov dword [esi + 0x2c8], 0x5da018
push 8
push 0
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x9c]
call fcn.0052c4e0
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x9c]
call fcn.0052c4e0
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x94], 0
jne 0x5da862
mov eax, dword [ebx + 8]
call fcn.0052c4e0
mov ecx, eax
mov dl, 1
mov eax, dword [0x53b4fc]
call fcn.0052664c
mov dword [ebx + 0x94], eax
mov eax, dword [ebx + 0x94]
mov byte [eax + 0x2a0], 1
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x94]
call fcn.0052c4e0
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x94]
call fcn.0052c4e0
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x5e1cc4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x6aa584], 0
jne 0x5e1cdb
call fcn.005e1c80
mov eax, edi
dec eax
test eax, eax
jl 0x5e1d03
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x6aa184]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x5e1ce5
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x5e4a58
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x5e4af2.0
jmp dword [ecx*4 + 0x5e4a8b]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x5e4abd
sub dl, 8
je 0x5e4acc
jmp case.0x5e4af2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5e4724
jmp case.0x5e4af2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5e4778
jmp case.0x5e4af2.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x5e4af2.0
movzx ecx, byte [ecx + 0x5e4af9]
jmp dword [ecx*4 + 0x5e4b0a]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5e4818
jmp case.0x5e4af2.0
cmp dl, 3
jne 0x5e4b37
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5e4870
jmp case.0x5e4af2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5e482c
jmp case.0x5e4af2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5e48b4
jmp case.0x5e4af2.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x5e4b62
sub dl, 8
je 0x5e4b6e
jmp case.0x5e4af2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5e48e0
jmp case.0x5e4af2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5e4944
jmp case.0x5e4af2.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x5e4b8d
sub dl, 8
je 0x5e4b99
jmp case.0x5e4af2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5e49f4
jmp case.0x5e4af2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5e4a1c
mov ecx, dword [eax + 0x468]
mov edx, dword [ebx + 0x1c]
dec edx
imul ecx, edx
mov esi, ecx
add esi, dword [eax + 0x450]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 8], esi
add ecx, dword [eax + 0x44c]
mov dword [ebp - 0x10], ecx
mov esi, edx
test esi, esi
jb 0x5e4c3b
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.005e3c80
test eax, eax
je 0x5e4c3b
mov eax, ebx
call fcn.005e4c44
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x5e4bd4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5e4c44
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x5e4c75
dec al
je 0x5e4cb0
dec al
je 0x5e4cf4
dec al
je 0x5e4d66
jmp 0x5e4e01
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x5e4e01
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x5e4c85
jmp 0x5e4e01
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5e4e01
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
movzx ecx, al
mov ecx, dword [ebx + ecx*4 + 0x40]
add dl, byte [ecx + esi]
and dl, 0xff
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x5e4cc0
jmp 0x5e4e01
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5e4e01
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
jbe 0x5e4d27
xor edx, edx
mov dword [esp + 4], edx
jmp 0x5e4d3c
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov ebp, dword [ebx + edx*4 + 0x40]
movzx edx, byte [ebp + esi]
add eax, dword [esp + 4]
sar eax, 1
jns 0x5e4d54
adc eax, 0
add dl, al
and dl, 0xff
mov byte [ebp + esi], dl
inc esi
dec edi
jne 0x5e4d04
jmp 0x5e4e01
xor eax, eax
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5e4e01
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
ja 0x5e4dcd
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 8], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 8]
push eax
movzx eax, byte [esp + 8]
pop edx
call fcn.005e1d0c
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [esp]
and al, 0xff
mov byte [edx + esi], al
inc esi
dec edi
jne 0x5e4d82
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x61e4d4
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffdc
mov ebx, eax
mov eax, ebx
call fcn.0040a7a4
mov dword [esp], 0xf
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x61e505
lea edx, [esp + 4]
mov eax, ebx
mov ecx, dword [esp]
call fcn.0040a92c
add esp, 0x24
pop ebx
ret
Function at 0x620324
Capabilities:
Encode data using xor
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
test dl, dl
je 0x62033e
add esp, 0xfffffff0
call fcn.00409004
mov esi, ecx
mov byte [ebp - 5], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x6204f4
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, ebx
call fcn.0040894c
mov dl, 1
mov eax, dword [0x489bd8]
call fcn.0040894c
mov dword [ebx + 4], eax
mov dl, 1
mov eax, dword [0x490b24]
call fcn.0040894c
mov dword [ebx + 8], eax
push 0xa
push esi
push 0
call sub.kernel32.dll_FindResourceW
mov edi, eax
push edi
push 0
call sub.kernel32.dll_LoadResource
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x62039c
call fcn.0040a498
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_LockResource
mov esi, eax
push edi
push 0
call sub.kernel32.dll_SizeofResource
sub eax, 0x14
xor edx, edx
push edx
push eax
mov eax, dword [ebx + 8]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [ebx + 8]
mov edi, dword [eax + 4]
mov eax, dword [ebx + 8]
mov edx, dword [eax]
call dword [edx]
mov edx, edi
mov ecx, esi
xchg ecx, eax
call fcn.00407194
mov eax, dword [ebx + 8]
mov edx, dword [eax]
call dword [edx]
add esi, eax
mov dword [ebp - 0xc], esi
mov edi, dword [ebx + 8]
mov esi, dword [edi + 4]
mov eax, edi
mov edx, dword [eax]
call dword [edx]
mov ecx, eax
dec ecx
test ecx, ecx
jl 0x620411
inc ecx
xor edi, edi
mov eax, edi
push ecx
mov ecx, 0x14
cdq
idiv ecx
pop ecx
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax + edx]
xor byte [esi], al
inc esi
inc edi
dec ecx
jne 0x6203f7
mov dl, 1
mov eax, dword [0x61f42c]
call fcn.0061f5bc
mov esi, eax
push 0
push 0
mov eax, dword [ebx + 8]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x28]
lea ecx, [ebp - 4]
mov edx, dword [ebx + 8]
mov eax, esi
call fcn.0061f034
mov eax, esi
call fcn.0040897c
mov ecx, 0x14
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.0042322c
test al, al
jne 0x62045f
mov eax, 1
call fcn.0040a5c8
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FreeResource
mov eax, 0xc
call fcn.00406ef4
mov esi, eax
push 0xffffffffffffffff
push 0xfffffffffffffff4
mov eax, dword [ebx + 8]
mov dl, 2
mov ecx, dword [eax]
call dword [ecx + 0x28]
mov edx, esi
mov eax, dword [ebx + 8]
mov ecx, 0xc
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebx + 4]
mov edx, esi
call fcn.004ac20c
jmp 0x6204d2
mov eax, 0xc
call fcn.00406ef4
mov esi, eax
push 0xffffffffffffffff
push 0xffffffffffffffe8
mov eax, dword [ebx + 8]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x28]
mov edx, esi
mov eax, dword [ebx + 8]
mov ecx, 0xc
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebx + 4]
mov ecx, esi
xor edx, edx
call fcn.004ac4b4
cmp dword [esi + 8], 0
jne 0x62049d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6204fb
lea eax, [ebp - 4]
mov edx, dword [0x5ec834]
call fcn.0040cd04
ret
Function at 0x6281ac
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
mov eax, esi
mov edx, dword [0x6264dc]
call fcn.00408c68
test al, al
je 0x6282c5
mov edx, dword [ebx + 0xc]
mov eax, dword [esi + 0xc]
mov ecx, dword [eax]
call dword [ecx + 8]
mov edx, dword [ebx + 0x54]
mov eax, dword [esi + 0x54]
mov ecx, dword [eax]
call dword [ecx + 8]
lea eax, [esi + 8]
mov edx, dword [ebx + 8]
call fcn.0040ab84
lea eax, [esi + 0x10]
mov edx, dword [ebx + 0x10]
call fcn.0040ab84
lea eax, [esi + 0x14]
mov edx, dword [ebx + 0x14]
call fcn.0040ab84
lea eax, [esi + 0x18]
mov edx, dword [ebx + 0x18]
call fcn.0040ab84
lea eax, [esi + 0x1c]
mov edx, dword [ebx + 0x1c]
call fcn.0040ab84
lea eax, [esi + 0x20]
mov edx, dword [ebx + 0x20]
call fcn.0040ab84
lea eax, [esi + 0x4c]
mov edx, dword [ebx + 0x4c]
call fcn.0040ab84
lea eax, [esi + 0x50]
mov edx, dword [ebx + 0x50]
call fcn.0040ab84
mov eax, dword [ebx + 0x28]
mov dword [esi + 0x28], eax
mov eax, dword [ebx + 0x2c]
mov dword [esi + 0x2c], eax
mov eax, dword [ebx + 0x30]
mov dword [esi + 0x30], eax
mov eax, dword [ebx + 0x34]
mov dword [esi + 0x34], eax
mov eax, dword [ebx + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [ebx + 0x3c]
mov dword [esi + 0x3c], eax
mov eax, dword [ebx + 0x40]
mov dword [esi + 0x40], eax
mov eax, dword [ebx + 0x44]
mov dword [esi + 0x44], eax
lea eax, [esi + 0x48]
mov edx, dword [ebx + 0x48]
call fcn.0040ab84
mov eax, dword [ebx + 0x58]
mov dword [esi + 0x58], eax
mov eax, dword [ebx + 0x5c]
mov dword [esi + 0x5c], eax
lea eax, [esi + 0x68]
mov edx, dword [ebx + 0x68]
call fcn.0040ab84
mov eax, dword [ebx + 0x60]
mov dword [esi + 0x60], eax
mov eax, dword [ebx + 0x64]
mov dword [esi + 0x64], eax
mov eax, dword [ebx + 0x70]
mov dword [esi + 0x70], eax
mov eax, dword [ebx + 0x74]
mov dword [esi + 0x74], eax
lea eax, [esi + 0x78]
mov edx, dword [ebx + 0x78]
call fcn.0040ab84
movzx eax, byte [ebx + 0x7c]
mov byte [esi + 0x7c], al
lea eax, [esi + 0x80]
mov edx, dword [ebx + 0x80]
call fcn.0040ab84
pop esi
pop ebx
ret
mov edx, esi
mov eax, ebx
call fcn.004adb1c
pop esi
pop ebx
ret