joyce8/EMBER2024-capa huggingface dataset:
Function at 0x508cc8
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc10
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3f0], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x508d82
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00405984
mov eax, dword [0x5c1afc]
cmp dword [eax], 2
jne 0x508d37
push esi
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.00405f40
mov eax, dword [ebx]
call fcn.00405bdc
push eax
mov eax, dword [ebx]
call fcn.00405bcc
push eax
push esi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebx]
call fcn.00405bdc
mov edx, eax
dec edx
mov eax, ebx
call fcn.00405f40
jmp 0x508d69
lea eax, [ebp - 0x3e9]
push eax
push 0x3e8
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea edx, [ebp - 0x3f0]
lea eax, [ebp - 0x3e9]
call fcn.0040d73c
mov edx, dword [ebp - 0x3f0]
mov eax, ebx
call fcn.00405b50
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x508d89
lea eax, [ebp - 0x3f0]
call fcn.004051cc
ret
Function at 0x5262b8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, ecx
mov edi, edx
mov ebx, eax
mov eax, ebx
call fcn.005262a4
test eax, eax
jne 0x5262d9
mov eax, esi
call fcn.004051cc
jmp 0x52636a
mov eax, ebx
call fcn.00526400
test al, al
je 0x52631f
push 0
push 0
push 0xe
mov eax, dword [ebx + 0x4c]
push eax
call sub.user32.dll_SendMessageA
mov edi, eax
mov eax, esi
mov ecx, edi
xor edx, edx
call fcn.004052bc
test edi, edi
je 0x526316
mov eax, dword [esi]
push eax
inc edi
push edi
push 0xd
mov eax, dword [ebx + 0x4c]
push eax
call sub.user32.dll_SendMessageA
jmp 0x52636a
mov eax, esi
call fcn.004051cc
jmp 0x52636a
mov ebp, dword [ebx + 0x70]
test ebp, ebp
je 0x526363
mov eax, dword [ebp + 0x208]
call fcn.00422da8
test eax, eax
jle 0x526351
mov eax, dword [ebx + 0x70]
mov eax, dword [eax + 0x208]
mov edx, edi
call fcn.0044a9c8
mov edx, dword [eax + 0xc]
mov eax, esi
call fcn.00405220
jmp 0x52636a
mov eax, esi
mov edx, dword [ebx + 0x70]
mov edx, dword [edx + 0x210]
call fcn.00405220
jmp 0x52636a
mov eax, esi
call fcn.004051cc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x537cb0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, ecx
mov esi, edx
mov ebx, eax
mov ebp, 0x5c57fc
test esi, esi
jne 0x537cca
xor eax, eax
jmp 0x537dcc
cmp dword [ebp], 0
jne 0x537cd5
call fcn.00537c40
xor ebx, 0xffffffff
cmp edi, 8
jb 0x537da5
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
sub edi, 8
cmp edi, 8
jae 0x537ce1
test edi, edi
jbe 0x537dc7
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
dec edi
test edi, edi
ja 0x537da9
mov eax, ebx
xor eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x555dcc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, eax
call sub.kernel32.dll_GetTickCount
mov ebx, eax
mov eax, dword [0x5c1738]
mov eax, dword [eax]
call fcn.00485160
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, esi
jb 0x555dd7
pop esi
pop ebx
ret

Function at 0x556338
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffe9c
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [esp], eax
mov eax, ebx
call fcn.0040cffc
test al, al
je 0x5563bf
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0x160
call fcn.0040380c
or esi, 0x100
test esi, esi
jns 0x556373
call fcn.004041f8
push esi
push 0x160
lea eax, [esp + 0xc]
push eax
push 0
mov eax, ebx
call fcn.0040569c
push eax
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x5563bf
mov dl, 1
mov eax, dword [0x42d900]
call fcn.004359a0
mov dword [esp], eax
mov edx, dword [esp + 4]
mov eax, dword [esp]
call fcn.00435dac
mov eax, dword [esp]
mov edx, dword [eax]
call dword [edx + 0x1c]
test al, al
je 0x5563bf
mov eax, esp
call fcn.004128dc
mov eax, dword [esp]
add esp, 0x164
pop esi
pop ebx
ret
Function at 0x55a864
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, eax
mov ebx, dword [ebp + 8]
add ebx, 0xffffffc4
mov esi, dword [ebp + 8]
add esi, 0xffffffbc
xor eax, eax
push ebp
push 0x55aa17
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.0043437c
mov eax, dword [eax + 0xc]
mov edx, dword [esi]
mov edx, dword [edx + 0x30]
mov edx, dword [edx + 0x70]
mov edx, dword [edx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x48]
call fcn.004779d8
call fcn.005442ec
mov edx, dword [ebp + 8]
mov dword [edx - 0x4c], eax
mov eax, dword [ebp + 8]
cmp dword [eax - 0x4c], 0
je 0x55a8e8
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x4c]
mov eax, dword [eax + 0x68]
call fcn.0042ea90
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.0043437c
mov eax, dword [eax + 0xc]
pop edx
call fcn.0042ea98
mov eax, dword [ebp + 8]
mov dword [eax - 0x50], ebx
lea edx, [ebp - 4]
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.0042e978
mov edx, dword [ebp - 4]
lea eax, [ebx + 0x1c]
call fcn.0040d5a8
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x50]
push eax
push 0x3c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.0043437c
call fcn.0042f800
push eax
call sub.gdi32.dll_GetObjectA
mov dword [ebx + 8], edi
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.0042e9ec
mov dword [ebx], eax
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.0042ea28
test al, 8
setne al
mov byte [ebx + 0x16], al
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.0042ea28
test al, 2
setne al
mov byte [ebx + 0x14], al
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.0042ea28
test al, 4
setne al
mov byte [ebx + 0x15], al
mov dword [ebx + 0x10], 0x190
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.0042ea90
mov byte [ebx + 0x17], al
xor eax, eax
mov dword [ebx + 4], eax
mov byte [ebx + 0x18], 0
mov byte [ebx + 0x19], 0
mov eax, dword [ebx + 8]
mov dword [ebx + 0xc], eax
mov byte [ebx + 0x1b], 0
mov byte [ebx + 0x1a], 0
push ebx
call sub.gdi32.dll_CreateFontIndirectA
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.0043437c
mov eax, dword [eax + 0xc]
pop edx
call fcn.0042e924
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.0043437c
mov eax, dword [eax + 0xc]
mov edx, dword [ebp + 8]
imul edx, dword [edx - 0x54], 0x13
mov ecx, dword [esi]
mov ecx, dword [ecx + 0x30]
mov ecx, dword [ecx + 0x94]
mov edx, dword [ecx + edx*8 + 0xc]
call fcn.0042e768
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55aa1e
lea eax, [ebp - 4]
call fcn.004051cc
ret
Function at 0x5721ec
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe0
mov ebp, edx
mov ebx, eax
cmp dword [ebx + 0x6c], 0
jne 0x572204
mov eax, ebx
call fcn.00571a48
cmp dword [ebx + 0x68], 0
jne 0x572211
mov eax, ebx
call fcn.005719e0
mov eax, dword [ebx + 0x6c]
mov edx, dword [eax]
call dword [edx + 0x2c]
mov dword [esp], eax
mov eax, dword [ebx + 0x6c]
mov edx, dword [eax]
call dword [edx + 0x20]
mov dword [esp + 4], eax
lea edx, [esp + 0x10]
mov eax, ebx
call fcn.00571860
lea eax, [esp + 0x10]
xor edx, edx
call fcn.00555a14
cmp eax, dword [esp]
je 0x57227f
lea eax, [esp + 0x10]
xor edx, edx
call fcn.00555a28
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x57225b
adc edx, 0
push edx
lea eax, [esp + 0x14]
xor edx, edx
call fcn.00555a14
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x572274
adc edx, 0
push edx
lea eax, [esp + 0x18]
push eax
call sub.user32.dll_InflateRect
mov esi, dword [ebx + 0x48]
test esi, esi
je 0x57229a
push 3
mov eax, dword [esi + 0x10]
call fcn.0046b674
push eax
call sub.user32.dll_GetWindow
mov esi, eax
jmp 0x5722a7
push 3
mov eax, dword [ebx + 0x50]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov edi, 0x610
mov edx, dword [esp + 0x10]
mov eax, dword [ebx + 0x68]
call fcn.004645c4
mov edx, dword [esp + 0x14]
mov eax, dword [ebx + 0x68]
call fcn.004645e8
mov edx, dword [esp]
mov eax, dword [ebx + 0x68]
call fcn.00464610
mov edx, dword [esp + 4]
mov eax, dword [ebx + 0x68]
call fcn.00464634
lea ecx, [esp + 8]
xor edx, edx
xor eax, eax
call fcn.00407aec
mov eax, ebp
mov edx, dword [0x5c11e4]
mov byte [edx + 2], al
mov eax, dword [0x5c11e4]
mov byte [eax], 0
mov eax, dword [0x5c11e4]
mov byte [eax + 1], 0
mov eax, dword [0x5c11e4]
mov byte [eax + 3], 1
or edi, 2
or edi, 1
push edi
push 0
push 0
push 0
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.0046b674
push eax
call sub.user32.dll_SetWindowPos
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.0046b674
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80000
or eax, 0x8000000
or eax, 0x20
push eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.0046b674
push eax
call sub.user32.dll_SetWindowLongA
push 2
mov eax, dword [0x5c11e4]
push eax
push 0x1fffffff
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebx + 0x6c]
call fcn.0043437c
call fcn.0042f800
push eax
lea eax, [esp + 0x14]
push eax
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.0046b674
push eax
mov eax, dword [0x5c1194]
mov eax, dword [eax]
call eax
push 4
mov eax, dword [ebx + 0x68]
call fcn.0046b674
push eax
call sub.user32.dll_ShowWindow
push esi
push 0
call sub.user32.dll_ReleaseDC
add esp, 0x20
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x578218
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffe30
mov ebp, eax
lea eax, [esp + 0x40]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, ebp
call fcn.004051cc
push 0x40
lea eax, [esp + 4]
push eax
call sub.wsock32.dll_gethostname
push esp
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x578272
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x578266
push dword [edi]
call sub.wsock32.dll_inet_ntoa
mov edx, ebp
call fcn.0040d73c
inc ebx
mov edi, dword [esi + ebx*4]
test edi, edi
jne 0x578257
call sub.wsock32.dll_WSACleanup
add esp, 0x1d0
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5785a4
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe5c
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x578687
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004051cc
lea eax, [ebp - 0x194]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
test eax, eax
jne 0x578671
xor edx, edx
push ebp
push 0x57866a
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 4]
mov edx, esi
call fcn.00405264
cmp dword [ebp - 4], 0
jne 0x578624
lea eax, [ebp - 4]
mov edx, 0x104
call fcn.00405828
push 0x104
lea eax, [ebp - 4]
call fcn.004056f4
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 4]
call fcn.004056f4
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x578657
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x1a0], eax
push dword [ebp - 0x1a0]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, ebx
call fcn.004053d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x578671
call sub.wsock32.dll_WSACleanup
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57868e
lea eax, [ebp - 4]
call fcn.004051cc
ret

Function at 0x578d48
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x578e1d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5c1afc]
cmp dword [eax], 2
jne 0x578da0
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push edi
lea eax, [ebp - 4]
mov edx, esi
call fcn.00405aec
mov eax, dword [ebp - 4]
call fcn.00578d18
push eax
push ebx
call sub.shell32.dll_ShellExecuteW
mov ebx, eax
jmp 0x578dfa
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 8]
mov edx, dword [ebp + 0xc]
call fcn.00405404
mov eax, dword [ebp - 8]
call fcn.00578d34
push eax
lea eax, [ebp - 0xc]
mov edx, dword [ebp + 0x10]
call fcn.00405404
mov eax, dword [ebp - 0xc]
call fcn.00578d34
push eax
lea eax, [ebp - 0x10]
mov edx, edi
call fcn.00405404
mov eax, dword [ebp - 0x10]
call fcn.00578d34
push eax
lea eax, [ebp - 0x14]
mov edx, esi
call fcn.00405404
mov eax, dword [ebp - 0x14]
call fcn.00578d34
push eax
push ebx
call sub.shell32.dll_ShellExecuteA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x578e24
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.004051f0
lea eax, [ebp - 4]
call fcn.00405984
ret

Function at 0x579198
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
push esp
push 0
push 0
push esi
push 0
call sub.SHFolder.dll_SHGetFolderPathA
call fcn.00408af0
test eax, eax
je 0x5791ca
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.0040544c
jmp 0x5791d1
mov eax, ebx
call fcn.004051cc
add esp, 0x108
pop esi
pop ebx
ret
Function at 0x5817e4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5818e1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040549c
dec eax
jl 0x5818cb
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x44]
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 4]
push eax
push 0
mov eax, ebx
call fcn.0040569c
push eax
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
push eax
call sub.kernel32.dll_SetLastError
call sub.kernel32.dll_GetLastError_1
test eax, eax
jne 0x5818cb
cmp dword [ebp - 4], 7
jne 0x5818cb
mov eax, dword [ebp - 8]
call fcn.00402ad4
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x5818c4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
mov eax, ebx
call fcn.0040569c
push eax
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov ebx, dword [ebp - 0xc]
jmp 0x5818a9
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.004053d4
mov edx, dword [ebp - 0x10]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push ebx
call sub.kernel32.dll_lstrlenA_1
inc eax
add ebx, eax
cmp byte [ebx], 0
jne 0x58188c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5818cb
mov eax, dword [ebp - 0xc]
call fcn.00402af4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5818e8
lea eax, [ebp - 0x10]
call fcn.004051cc
ret
Function at 0x5818f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x581a34
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040549c
dec eax
jl 0x581a19
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x58195b
inc ebx
xor esi, esi
lea ecx, [ebp - 0x1c]
mov edx, esi
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x1c]
call fcn.0040549c
inc eax
add dword [ebp - 0x18], eax
inc esi
dec ebx
jne 0x58193e
inc dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
call fcn.00402ad4
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x581a12
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x5819bf
inc ebx
xor esi, esi
lea ecx, [ebp - 0x20]
mov edx, esi
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x20]
call fcn.0040569c
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_lstrcpyA
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_lstrlenA_1
inc eax
add dword [ebp - 0x10], eax
inc esi
dec ebx
jne 0x58198f
mov eax, dword [ebp - 0x10]
mov byte [eax], 0
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x14]
push eax
push 7
push 0
mov eax, dword [ebp - 4]
call fcn.0040569c
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
push eax
call sub.kernel32.dll_SetLastError
call sub.kernel32.dll_GetLastError_1
test eax, eax
je 0x5819fc
call fcn.00404bf4
jmp 0x581a19
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x581a19
mov eax, dword [ebp - 0x14]
call fcn.00402af4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x581a3b
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.004051f0
ret
Function at 0x5873e4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov edi, edx
mov esi, eax
mov eax, esi
call fcn.0040549c
test eax, eax
je 0x587458
mov eax, esi
call fcn.0040549c
mov edx, eax
mov eax, dword [esp]
call fcn.00405828
mov eax, dword [esp]
mov edx, esi
call fcn.00405220
mov eax, esi
call fcn.0040549c
mov ebp, eax
test ebp, ebp
jbe 0x587458
mov ebx, 1
mov eax, dword [esp]
call fcn.004056f4
mov dl, byte [esi + ebx - 1]
movzx ecx, di
shr ecx, 8
xor dl, cl
mov byte [eax + ebx - 1], dl
xor eax, eax
mov al, byte [esi + ebx - 1]
add di, ax
imul ax, di, 0x5ab3
add ax, 0x8d1e
mov edi, eax
inc ebx
dec ebp
jne 0x587428
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x587460
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040549c
test eax, eax
je 0x587506
mov eax, dword [ebp - 4]
call fcn.0040549c
mov edx, eax
mov eax, edi
call fcn.00405828
xor eax, eax
push ebp
push 0x5874fc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00405220
mov eax, dword [ebp - 4]
call fcn.0040549c
test eax, eax
jbe 0x5874f2
mov dword [ebp - 8], eax
mov ebx, 1
mov eax, edi
call fcn.004056f4
mov edx, dword [ebp - 4]
mov dl, byte [edx + ebx - 1]
movzx ecx, si
shr ecx, 8
xor dl, cl
mov byte [eax + ebx - 1], dl
mov eax, dword [edi]
movzx eax, byte [eax + ebx - 1]
add si, ax
imul ax, si, 0x5ab3
add ax, 0x8d1e
mov esi, eax
inc ebx
dec dword [ebp - 8]
jne 0x5874bd
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x587506
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x5a41a0
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
add esp, 0xffffffc0
mov esi, edx
mov ebx, eax
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0x3c
call fcn.0040380c
mov dword [esp + 4], 0x3c
mov dword [esp + 8], 0x40
mov eax, dword [0x5c1738]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
mov dword [esp + 0xc], eax
mov eax, ebx
call fcn.0040569c
mov dword [esp + 0x14], eax
mov eax, esi
call fcn.0040569c
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x20], eax
lea eax, [esp + 4]
push eax
call sub.shell32.dll_ShellExecuteExA
test eax, eax
je 0x5a4235
mov eax, dword [0x5c1738]
mov eax, dword [eax]
call fcn.00485160
push esp
mov eax, dword [esp + 0x40]
push eax
call sub.kernel32.dll_GetExitCodeProcess
cmp dword [esp], 0x103
jne 0x5a4231
mov eax, dword [0x5c1738]
mov eax, dword [eax]
cmp byte [eax + 0x9c], 0
je 0x5a4201
mov al, 1
jmp 0x5a4237
xor eax, eax
add esp, 0x40
pop esi
pop ebx
ret

Function at 0x5a4308
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x5a43f8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x44
push 0x5a4408
push 0x5a4428
mov eax, dword [0x5c850c]
call fcn.0046b674
push eax
call sub.user32.dll_MessageBoxA_1
cmp eax, 6
jne 0x5a43d5
xor eax, eax
push ebp
push 0x5a43cb
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov ecx, 0x5a446c
mov edx, dword [0x5c8514]
call fcn.00405c48
mov eax, dword [ebp - 8]
call fcn.005790a0
test al, al
je 0x5a43c1
lea eax, [ebp - 0xc]
mov ecx, 0x5a446c
mov edx, dword [0x5c8514]
call fcn.00405c48
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.00405464
push 1
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040569c
push eax
push 0x5a4490
mov eax, ebx
call fcn.0046b674
push eax
call sub.shell32.dll_ShellExecuteA
mov eax, dword [0x5c1738]
mov eax, dword [eax]
call fcn.004853f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5a43d5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a43ff
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0040599c
lea eax, [ebp - 4]
call fcn.004051cc
ret