joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5f9dd8
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5f9f83
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x44], 0
jne 0x5f9f64
mov dl, 1
mov eax, dword [0x490418]
call fcn.004b3c64
mov edx, dword [ebp - 4]
mov dword [edx + 0x44], eax
mov eax, dword [ebp - 4]
add eax, 0x48
call fcn.00409a28
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x5f9f53
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0053b2cc
test al, al
je 0x5f9f46
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x5f9f94
lea eax, [ebp - 0x394]
call fcn.0042510c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x5f9f46
xor eax, eax
push ebp
push 0x5f9f3f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x5fa004
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x5f9f28
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.0040a888
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov ebx, dword [eax]
call dword [ebx + 0x40]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x4c]
jne 0x5f9f28
mov eax, dword [ebp - 4]
add eax, 0x48
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.0040a888
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f9f46
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x5f9e49
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov byte [eax + 0x39], 0
mov dl, 1
call fcn.004b3bb4
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x44]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f9f8a
lea eax, [ebp - 0x3a0]
call fcn.00409a28
ret

Function at 0x5fab30
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x7097a4]
cmp byte [eax + 0xc5], 0
jne 0x5faba2
cmp dword [0x7097c8], 0
jne 0x5fab62
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, dword [0x6fc7b0]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x7097c8], eax
cmp dword [0x7097c4], 0
jne 0x5fab7d
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x7097c4], eax
cmp dword [0x7097cc], 0
jne 0x5faba2
push esp
push 0
push 0
mov eax, dword [0x6fc7ac]
push eax
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x7097cc], eax
pop edx
ret
Function at 0x5fafc4
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x5fafdb
add esp, 0xfffffff0
call fcn.00408374
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004c4afc
mov eax, dword [0x7030ec]
cmp byte [eax], 0
jne 0x5fb008
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x194], al
mov eax, dword [0x7036fc]
cmp word [eax + 2], 0
jne 0x5fb022
mov eax, dword [0x7036fc]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005fd298
mov eax, dword [0x703924]
cmp word [eax + 2], 0
jne 0x5fb03c
mov eax, dword [0x703924]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005fd49c
mov byte [ebx + 0x41], 0
mov dl, 1
mov eax, dword [0x4fef98]
call fcn.005050e8
mov esi, eax
mov dword [ebx + 0x54], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x5fda14
mov dl, 1
mov eax, dword [0x48cc5c]
call fcn.00407d40
mov dword [ebx + 0xa8], eax
mov dl, 1
mov eax, dword [0x48cc5c]
call fcn.00407d40
mov dword [ebx + 0xc8], eax
xor eax, eax
mov dword [ebx + 0x74], eax
xor eax, eax
mov dword [ebx + 0x98], eax
mov dword [ebx + 0x70], 0xff000018
mov dword [ebx + 0x8c], 0x1f4
mov byte [ebx + 0x90], 1
xor eax, eax
mov dword [ebx + 0x94], eax
mov dword [ebx + 0x88], 0x9c4
mov byte [ebx + 0x9c], 0
mov byte [ebx + 0xbd], 1
mov byte [ebx + 0xd4], 1
mov dl, 1
mov eax, dword [0x5039c0]
call fcn.0050e6d0
mov esi, eax
mov dword [ebx + 0xb8], esi
push 0x5fb224
mov eax, dword [0x703488]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.0050eb60
mov eax, dword [ebx + 0xb8]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x5fdcfc
mov dl, 1
mov eax, dword [0x48cc5c]
call fcn.00407d40
mov dword [ebx + 0xb0], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x703488]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.00424ef4
test eax, eax
je 0x5fb156
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.00424c68
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.00424ed8
test eax, eax
je 0x5fb16e
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW_1
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0xa4]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.0040a888
push ebx
push 0x5fcc74
call fcn.005f0858
mov dword [ebx + 0x190], eax
mov byte [ebx + 0xe8], 0
mov eax, dword [0x7030ec]
cmp byte [eax], 0
jne 0x5fb1bf
mov eax, ebx
call fcn.005fb408
mov byte [ebx + 0x6d], 1
mov byte [ebx + 0x6e], 1
mov byte [ebx + 0x6f], 1
mov byte [ebx + 0xbe], 1
mov byte [ebx + 0xe9], 0
mov byte [ebx + 0xf4], 0
xor eax, eax
mov dword [ebx + 0xec], eax
mov byte [ebx + 0xeb], 0
xor eax, eax
mov dword [ebx + 0xc0], eax
mov eax, ebx
call fcn.005fdf34
mov eax, ebx
call fcn.005feba0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5fb21c
call fcn.004083cc
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5fb74c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x188]
test eax, eax
je 0x5fb7ee
cmp dword [ebx + 0xac], 0
jne 0x5fb7e8
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x5fb688
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0xa8]
cmp dword [eax + 8], 0
je 0x5fb7e8
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x5fb7ae
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x5fb7e8
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0xa8]
call fcn.004af498
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x5fb7bd
inc dword [ebx + 0xac]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x5fba2c
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov ebx, edx
mov esi, eax
mov eax, dword [0x7097a4]
cmp dword [eax + 0x188], 0
je 0x5fbba6
test bl, bl
jne 0x5fbaf1
cmp dword [esi + 0xb4], 0
jne 0x5fbae6
mov eax, esi
call fcn.005fe9f0
push eax
push 0x5fb920
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x58], 0
je 0x5fbab7
mov eax, dword [0x7097a4]
cmp byte [eax + 0xeb], 0
je 0x5fbab7
mov eax, dword [esi + 0xf0]
mov dword [esp], eax
mov eax, dword [esp]
test eax, eax
je 0x5fba98
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5fbab7
push 0
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5fbaa0
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5fbae6
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0xb0]
call fcn.004af498
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5fbac6
inc dword [esi + 0xb4]
jmp 0x5fbba6
cmp dword [esi + 0xb4], 0
jle 0x5fbba6
dec dword [esi + 0xb4]
cmp dword [esi + 0xb4], 0
jne 0x5fbba6
cmp dword [esi + 0x58], 0
je 0x5fbb5b
mov eax, dword [0x7097a4]
cmp byte [eax + 0xeb], 0
je 0x5fbb5b
mov eax, dword [esi + 0xf0]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
test eax, eax
je 0x5fbb3c
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5fbb5b
push 5
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5fbb44
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5fbb8a
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0xb0]
call fcn.004af498
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5fbb6a
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [esi + 0xf0]
mov edx, dword [0x5ed0e4]
call fcn.0040bed0
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x5fc800
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x5fc85d
cmp byte [ebx + 0xeb], 0
jne 0x5fc85d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x188]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00409bb0
mov eax, dword [esi]
test eax, eax
je 0x5fc84a
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x5fc86a
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.00409e08
jmp 0x5fc86a
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.00409e08
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5fe11c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x5fe18d
mov eax, esi
call fcn.0053500c
test al, al
je 0x5fe18d
mov eax, dword [ebx + 0x98]
call fcn.00534c3c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5fe18d
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x114]
test al, al
je 0x5fe17e
push 0
mov eax, dword [ebx + 0x98]
call fcn.00534c3c
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x98]
call fcn.0052b934
jmp 0x5fe18d
mov cl, 1
mov edx, dword [ebx + 0x88]
mov eax, ebx
call fcn.005fdf54
pop esi
pop ebx
ret
Function at 0x611b38
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x709c10], 0
jne 0x611b4f
call fcn.00611af4
mov eax, edi
dec eax
test eax, eax
jl 0x611b77
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x709810]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x611b59
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x61486c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x614906.0
jmp dword [ecx*4 + 0x61489f]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x6148d1
sub dl, 8
je 0x6148e0
jmp case.0x614906.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x614538
jmp case.0x614906.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x61458c
jmp case.0x614906.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x614906.0
movzx ecx, byte [ecx + 0x61490d]
jmp dword [ecx*4 + 0x61491e]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x61462c
jmp case.0x614906.0
cmp dl, 3
jne 0x61494b
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x614684
jmp case.0x614906.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x614640
jmp case.0x614906.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x6146c8
jmp case.0x614906.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x614976
sub dl, 8
je 0x614982
jmp case.0x614906.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x6146f4
jmp case.0x614906.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x614758
jmp case.0x614906.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x6149a1
sub dl, 8
je 0x6149ad
jmp case.0x614906.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x614808
jmp case.0x614906.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x614830
mov ecx, dword [eax + 0x468]
mov edx, dword [ebx + 0x1c]
dec edx
imul ecx, edx
mov esi, ecx
add esi, dword [eax + 0x450]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 8], esi
add ecx, dword [eax + 0x44c]
mov dword [ebp - 0x10], ecx
mov esi, edx
test esi, esi
jb 0x614a4f
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00613a80
test eax, eax
je 0x614a4f
mov eax, ebx
call fcn.00614a58
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x6149e8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x614a58
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x614a89
dec al
je 0x614ac4
dec al
je 0x614b01
dec al
je 0x614b6a
jmp 0x614bf4
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x614bf4
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x614a99
jmp 0x614bf4
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x614bf4
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov ecx, eax
xor cl, 1
and ecx, 0x7f
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ecx, byte [ecx + esi]
movzx edx, al
mov edx, dword [ebx + edx*4 + 0x40]
add cl, byte [edx + esi]
and cl, 0xff
mov byte [edx + esi], cl
inc esi
dec edi
jne 0x614ad4
jmp 0x614bf4
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x614bf4
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x614b30
xor ebp, ebp
jmp 0x614b40
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x614b49
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x614b11
jmp 0x614bf4
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x614bf4
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x614bc3
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.00611b80
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x614b7e
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x61c76c
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x61c79a
mov eax, ebx
call fcn.0061d228
cmp dword [ebx + 0x40], 0
je 0x61c793
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x61c80b
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x61c7fd
cmp dword [ebx + 8], 0
je 0x61c7bc
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x61c7ce
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x61c7fd
cmp dword [ebx + 8], 0
je 0x61c7af
cmp eax, 3
je 0x61c7e1
dec eax
jne 0x61c7af
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x61c7af
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x61c7af
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x61c829
cmp dword [ebx + 0x14], 0xcc
je 0x61c829
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0061c834
pop ebx
ret

Function at 0x64f5d8
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x65034c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, edx
mov edi, eax
mov eax, dword [edi]
test eax, eax
je 0x65035f
sub eax, 4
mov eax, dword [eax]
mov esi, eax
test esi, esi
jle 0x650382
mov ebp, 1
mov eax, edi
call fcn.00409fe8
mov edx, dword [edi]
movzx edx, byte [edx + ebp - 1]
xor dl, bl
mov byte [eax + ebp - 1], dl
inc ebp
dec esi
jne 0x65036a
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x655574
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
xor ecx, ecx
mov dword [ebp - 0x210], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x655603
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0x20a]
push edx
push 0
push 0
push eax
push 0
call sub.SHFolder.dll_SHGetFolderPathW
test eax, 0x80000000
sete al
test al, al
je 0x6555c9
mov eax, ebx
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.0040a888
jmp 0x6555d0
mov eax, ebx
call fcn.00409a28
lea edx, [ebp - 0x210]
mov eax, dword [ebx]
call fcn.0042b874
mov edx, dword [ebp - 0x210]
mov eax, ebx
call fcn.00409e08
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x65560a
lea eax, [ebp - 0x210]
call fcn.00409a28
ret

Function at 0x656b38
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
mov esi, 0xedb88320
mov eax, 0x70c740
xor ecx, ecx
mov edx, 0x804
call fcn.00407690
xor ebx, ebx
mov ecx, 0x70c740
movzx eax, bx
add eax, eax
mov dx, 0xfff7
test al, 1
je 0x656b6a
shr eax, 1
xor eax, esi
jmp 0x656b6c
shr eax, 1
inc dx
jne 0x656b60
mov dword [ecx], eax
inc ebx
add ecx, 4
cmp bx, 0x100
jne 0x656b57
pop esi
pop ebx
ret

Function at 0x656d90
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x224], edx
mov dword [ebp - 0x228], edx
mov dword [ebp - 0x220], edx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x656eac
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x21a]
push eax
push 0x103
call sub.kernel32.dll_GetTempPathW
lea eax, [ebp - 0x21a]
call fcn.00409f44
mov ebx, eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x220]
lea edx, [ebp - 0x21a]
mov ecx, 0x105
call fcn.0040a888
mov eax, dword [ebp - 0x220]
mov ecx, ebx
mov edx, 1
call fcn.0040aba8
lea edx, [ebp - 0x228]
mov eax, dword [ebp - 4]
call fcn.00424998
mov eax, dword [ebp - 0x228]
lea edx, [ebp - 0x224]
call fcn.0042b874
mov edx, dword [ebp - 0x224]
lea eax, [ebp - 4]
call fcn.00409e50
push 0
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0x20a
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 4]
call fcn.0040a7cc
push eax
call sub.kernel32.dll_GetVolumeInformationW
push esi
mov eax, dword [ebp - 8]
mov dword [ebp - 0x230], eax
mov byte [ebp - 0x22c], 0
lea edx, [ebp - 0x230]
xor ecx, ecx
mov eax, 0x656ec8
call fcn.004251dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x656eb3
lea eax, [ebp - 0x228]
mov edx, 3
call fcn.00409a88
lea eax, [ebp - 4]
call fcn.00409a28
ret
Function at 0x656ed4
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xc
push 0
push 0
dec ecx
jne 0x656edc
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x657111
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x30]
mov eax, dword [0x70c4a8]
call fcn.0064eb38
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
call fcn.0040a8a4
mov eax, dword [ebp - 0x2c]
call fcn.00650958
test al, al
je 0x656f97
lea eax, [ebp - 0x34]
push eax
lea edx, [ebp - 0x3c]
mov eax, dword [0x70c4a4]
call fcn.0064eb38
mov edx, dword [ebp - 0x3c]
lea eax, [ebp - 0x38]
call fcn.0040a8a4
mov eax, dword [ebp - 0x38]
push eax
lea edx, [ebp - 0x40]
mov eax, 0x65712c
call fcn.0064eb38
mov eax, dword [ebp - 0x40]
push eax
lea edx, [ebp - 0x44]
mov eax, 0x657148
call fcn.0064eb38
mov eax, dword [ebp - 0x44]
pop edx
pop ecx
call fcn.006506ac
mov eax, dword [ebp - 0x34]
push eax
lea edx, [ebp - 0x4c]
mov eax, dword [0x70c4a8]
call fcn.0064eb38
mov edx, dword [ebp - 0x4c]
lea eax, [ebp - 0x48]
call fcn.0040a8a4
mov edx, dword [ebp - 0x48]
pop eax
call fcn.0040ab70
jne 0x656f97
lea edx, [ebp - 4]
mov eax, dword [0x70c4a8]
call fcn.0064eb38
jmp 0x656fa4
lea edx, [ebp - 4]
mov eax, 0x657170
call fcn.0064eb38
push dword [ebp - 4]
push 0x657188
lea eax, [ebp - 0x54]
call fcn.00656d90
mov edx, dword [ebp - 0x54]
lea eax, [ebp - 0x50]
mov ecx, 0
call fcn.0040a560
push dword [ebp - 0x50]
lea eax, [ebp - 4]
mov edx, 3
call fcn.0040a328
push dword [ebp - 4]
push 0x657198
lea edx, [ebp - 0x5c]
mov eax, dword [0x70c4d4]
call fcn.00423888
mov edx, dword [ebp - 0x5c]
lea eax, [ebp - 0x58]
mov ecx, 0
call fcn.0040a560
push dword [ebp - 0x58]
lea eax, [ebp - 4]
mov edx, 3
call fcn.0040a328
push dword [ebp - 4]
push 0x6571a8
push 0x6571b8
lea eax, [ebp - 4]
mov edx, 3
call fcn.0040a328
mov dword [ebp - 8], 0xf
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x26]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x657070
push dword [ebp - 4]
push 0x6571cc
lea edx, [ebp - 0x64]
lea eax, [ebp - 0x26]
call fcn.00424ff4
mov edx, dword [ebp - 0x64]
lea eax, [ebp - 0x60]
mov ecx, 0
call fcn.0040a560
push dword [ebp - 0x60]
lea eax, [ebp - 4]
mov edx, 3
call fcn.0040a328
jmp 0x65707d
lea eax, [ebp - 4]
mov edx, 0x6571dc
call fcn.0040a24c
lea eax, [ebp - 4]
mov edx, 0x6571f4
call fcn.0040a24c
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0064e804
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x657118
lea eax, [ebp - 0x64]
call fcn.00409a28
lea eax, [ebp - 0x60]
call fcn.00409a4c
lea eax, [ebp - 0x5c]
call fcn.00409a28
lea eax, [ebp - 0x58]
call fcn.00409a4c
lea eax, [ebp - 0x54]
call fcn.00409a28
lea eax, [ebp - 0x50]
mov edx, 2
call fcn.00409ab8
lea eax, [ebp - 0x48]
call fcn.00409a28
lea eax, [ebp - 0x44]
mov edx, 3
call fcn.00409ab8
lea eax, [ebp - 0x38]
mov edx, 2
call fcn.00409a88
lea eax, [ebp - 0x30]
call fcn.00409a4c
lea eax, [ebp - 0x2c]
call fcn.00409a28
lea eax, [ebp - 4]
call fcn.00409a4c
ret