joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5e5bd4
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x14], edx
mov edx, eax
mov eax, dword [ebp - 0x14]
mov ecx, 0x10
call fcn.005e59d0
xor esi, esi
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
test bl, bl
jne 0x5e5caf
movzx ecx, byte [eax]
mov ecx, dword [ecx*4 + 0x78997c]
movzx edi, byte [eax + 1]
xor ecx, dword [edi*4 + 0x789d7c]
movzx edi, byte [eax + 2]
xor ecx, dword [edi*4 + 0x78a17c]
movzx edi, byte [eax + 3]
xor ecx, dword [edi*4 + 0x78a57c]
mov dword [ebp - 0x18], ecx
movzx ecx, byte [ebp - 0x18]
movzx ecx, byte [ecx + 0x788844]
lea edi, [esi]
and edi, 0x80000003
jns 0x5e5c49
dec edi
or edi, 0xfffffffc
inc edi
mov byte [ebp + edi*4 - 0x10], cl
movzx ecx, byte [ebp - 0x17]
movzx ecx, byte [ecx + 0x788844]
lea edi, [esi + 1]
and edi, 0x80000003
jns 0x5e5c68
dec edi
or edi, 0xfffffffc
inc edi
mov byte [ebp + edi*4 - 0xf], cl
movzx ecx, byte [ebp - 0x16]
movzx ecx, byte [ecx + 0x788844]
lea edi, [esi + 2]
and edi, 0x80000003
jns 0x5e5c87
dec edi
or edi, 0xfffffffc
inc edi
mov byte [ebp + edi*4 - 0xe], cl
movzx ecx, byte [ebp - 0x15]
movzx ecx, byte [ecx + 0x788844]
lea edi, [esi + 3]
and edi, 0x80000003
jns 0x5e5ca6
dec edi
or edi, 0xfffffffc
inc edi
mov byte [ebp + edi*4 - 0xd], cl
jmp 0x5e5d34
lea ecx, [esi]
and ecx, 0x80000003
jns 0x5e5cbe
dec ecx
or ecx, 0xfffffffc
inc ecx
mov edi, dword [ebp - 0x14]
movzx ecx, byte [edi + ecx*4]
movzx ecx, byte [ecx + 0x788844]
mov byte [edx], cl
lea ecx, [esi + 3]
and ecx, 0x80000003
jns 0x5e5cde
dec ecx
or ecx, 0xfffffffc
inc ecx
mov edi, dword [ebp - 0x14]
movzx ecx, byte [edi + ecx*4 + 1]
movzx ecx, byte [ecx + 0x788844]
mov byte [edx + 1], cl
lea ecx, [esi + 2]
and ecx, 0x80000003
jns 0x5e5d00
dec ecx
or ecx, 0xfffffffc
inc ecx
mov edi, dword [ebp - 0x14]
movzx ecx, byte [edi + ecx*4 + 2]
movzx ecx, byte [ecx + 0x788844]
mov byte [edx + 2], cl
lea ecx, [esi + 1]
and ecx, 0x80000003
jns 0x5e5d22
dec ecx
or ecx, 0xfffffffc
inc ecx
mov edi, dword [ebp - 0x14]
movzx ecx, byte [edi + ecx*4 + 3]
movzx ecx, byte [ecx + 0x788844]
mov byte [edx + 3], cl
inc esi
add edx, 4
add eax, 4
cmp esi, 4
jne 0x5e5bf9
mov eax, dword [ebp - 0x14]
mov edi, eax
lea esi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5e6fa8
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffff88
mov dword [esp + 4], edx
mov dword [esp], eax
lea eax, [esp + 0x39]
xor ecx, ecx
mov edx, 0x3f
call fcn.00407764
lea edx, [esp + 0xc]
mov ecx, 0x2d
mov eax, dword [esp]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x5e7129
mov edi, 1
xor esi, esi
jmp 0x5e706a
movzx eax, byte [esp + edi + 0xb]
movzx edx, al
shr edx, 2
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [esp + esi + 0x39], dl
mov edx, eax
shl edx, 4
movzx eax, byte [esp + edi + 0xc]
shr eax, 4
or dl, al
and dl, 0x3f
movzx eax, dl
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [esp + esi + 0x3a], al
movzx edx, byte [esp + edi + 0xc]
add edx, edx
add edx, edx
movzx eax, byte [esp + edi + 0xd]
shr eax, 6
or dl, al
and dl, 0x3f
movzx eax, dl
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [esp + esi + 0x3b], al
movzx edx, byte [esp + edi + 0xd]
and dl, 0x3f
movzx eax, dl
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [esp + esi + 0x3c], al
add edi, 3
add esi, 4
mov eax, dword [esp + 8]
sub eax, 2
cmp edi, eax
jle 0x5e6fee
cmp edi, dword [esp + 8]
jg 0x5e710f
movzx eax, byte [esp + edi + 0xb]
movzx edx, al
shr edx, 2
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [esp + esi + 0x39], dl
cmp edi, dword [esp + 8]
jne 0x5e70c5
mov edx, eax
shl edx, 4
and dl, 0x30
and dl, 0x3f
movzx eax, dl
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [esp + esi + 0x3a], al
mov byte [esp + esi + 0x3b], 0x3d
jmp 0x5e7107
mov edx, eax
shl edx, 4
and dl, 0x30
movzx eax, byte [esp + edi + 0xc]
shr eax, 4
and al, 0xf
or dl, al
and dl, 0x3f
movzx eax, dl
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [esp + esi + 0x3a], al
movzx edx, byte [esp + edi + 0xc]
add edx, edx
add edx, edx
and dl, 0x3c
and dl, 0x3f
movzx eax, dl
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [esp + esi + 0x3b], al
mov byte [esp + esi + 0x3c], 0x3d
add esi, 4
mov ecx, esi
lea edx, [esp + 0x39]
mov eax, dword [esp + 4]
mov ebx, dword [eax]
call dword [ebx + 0x10]
cmp dword [esp + 8], 0x2d
jge 0x5e6fc5
add esp, 0x78
pop edi
pop esi
pop ebx
ret
Function at 0x5e7130
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffff48
mov dword [esp + 4], edx
mov dword [esp], eax
lea eax, [esp + 0x3a]
xor ecx, ecx
mov edx, 0x7e
call fcn.00407764
lea edx, [esp + 0xc]
mov ecx, 0x2d
mov eax, dword [esp]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x5e72c5
mov edi, 1
xor esi, esi
jmp 0x5e71fc
movzx eax, byte [esp + edi + 0xb]
movzx edx, al
shr edx, 2
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov word [esp + esi*2 + 0x3a], dx
mov edx, eax
shl edx, 4
movzx eax, byte [esp + edi + 0xc]
shr eax, 4
or dl, al
and dl, 0x3f
movzx eax, dl
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov word [esp + esi*2 + 0x3c], ax
movzx edx, byte [esp + edi + 0xc]
add edx, edx
add edx, edx
movzx eax, byte [esp + edi + 0xd]
shr eax, 6
or dl, al
and dl, 0x3f
movzx eax, dl
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov word [esp + esi*2 + 0x3e], ax
movzx edx, byte [esp + edi + 0xd]
and dl, 0x3f
movzx eax, dl
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov word [esp + esi*2 + 0x40], ax
add edi, 3
add esi, 4
mov eax, dword [esp + 8]
sub eax, 2
cmp edi, eax
jle 0x5e717c
cmp edi, dword [esp + 8]
jg 0x5e72a9
movzx eax, byte [esp + edi + 0xb]
movzx edx, al
shr edx, 2
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov word [esp + esi*2 + 0x3a], dx
cmp edi, dword [esp + 8]
jne 0x5e725b
mov edx, eax
shl edx, 4
and dl, 0x30
and dl, 0x3f
movzx eax, dl
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov word [esp + esi*2 + 0x3c], ax
mov word [esp + esi*2 + 0x3e], 0x3d
jmp 0x5e729f
mov edx, eax
shl edx, 4
and dl, 0x30
movzx eax, byte [esp + edi + 0xc]
shr eax, 4
and al, 0xf
or dl, al
and dl, 0x3f
movzx eax, dl
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov word [esp + esi*2 + 0x3c], ax
movzx edx, byte [esp + edi + 0xc]
add edx, edx
add edx, edx
and dl, 0x3c
and dl, 0x3f
movzx eax, dl
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov word [esp + esi*2 + 0x3e], ax
mov word [esp + esi*2 + 0x40], 0x3d
add esi, 4
mov ecx, esi
add ecx, ecx
lea edx, [esp + 0x3a]
mov eax, dword [esp + 4]
mov ebx, dword [eax]
call dword [ebx + 0x10]
cmp dword [esp + 8], 0x2d
jge 0x5e7150
add esp, 0xb8
pop edi
pop esi
pop ebx
ret
Function at 0x5ea2cc
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5ea382
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00409f90
mov eax, esi
mov edx, 0x104
call fcn.0040b05c
mov eax, dword [esi]
xor ecx, ecx
mov edx, 0x208
call fcn.00407764
push 0
push 0x26
mov eax, dword [esi]
call fcn.0040aec8
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
test eax, eax
je 0x5ea33e
lea edx, [ebp - 8]
mov eax, dword [esi]
call fcn.00425c48
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.0042e27c
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.0040a370
mov eax, dword [0x79c730]
movzx eax, byte [eax]
test al, al
je 0x5ea367
test bl, bl
je 0x5ea367
push 0
push 1
push esi
mov ecx, 0x80000002
mov edx, 0x5ea39c
mov eax, 0x5ea3c8
call fcn.0070f0dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ea389
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409ff0
ret

Function at 0x5ea470
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00409fd8
xor edx, edx
push ebp
push 0x5ea4e6
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 4]
push eax
push esi
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, 0x80000000
sete al
test al, al
je 0x5ea4dc
lea eax, [ebp - 0x20e]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListW
test eax, eax
je 0x5ea4d3
mov eax, ebx
lea edx, [ebp - 0x20e]
mov ecx, 0x105
call fcn.0040ac34
mov eax, dword [ebp - 4]
push eax
call sub.ole32.dll_CoTaskMemFree
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5ea4f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5edb98
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
test dl, dl
je 0x5edbb0
add esp, 0xfffffff0
call fcn.00408808
mov byte [ebp - 9], dl
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x5edcca
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 8]
mov dword [eax + 8], ebx
mov eax, ebx
add eax, eax
add eax, eax
add eax, eax
call fcn.0040668c
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
dec ebx
test ebx, ebx
jl 0x5edcb4
inc ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
call fcn.00526240
xor eax, eax
push ebp
push 0x5edca1
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
call fcn.00526240
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x10]
lea ebx, [eax + edx*8]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov eax, dword [eax + 8]
mov dword [ebx], eax
lea eax, [ebx + 4]
mov edx, dword [ebp - 4]
call fcn.0040afc0
jmp 0x5edc72
lea eax, [ebx + 4]
mov ecx, 1
mov edx, 1
call fcn.0040b34c
mov eax, dword [ebx + 4]
call fcn.0040a488
dec eax
jle 0x5edc86
mov eax, dword [ebx + 4]
cmp word [eax], 0x5f
je 0x5edc60
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5edca8
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x54]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5edcd1
lea eax, [ebp - 4]
call fcn.00409fd8
ret

Function at 0x60f7b4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
lea eax, [ebp - 4]
push eax
mov eax, ebx
call fcn.0040aec8
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x60f84f
mov eax, dword [ebp - 8]
call fcn.004066c0
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x60f848
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x60f832
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x60f858
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x60f832
mov eax, dword [ebp - 0x10]
mov esi, eax
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60f84f
mov eax, dword [ebp - 0xc]
call fcn.004066dc
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x611068
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x611186
push dword fs:[edx]
mov dword fs:[edx], esp
cmp eax, 0x10
ja case.0x611094.0
movzx eax, byte [eax + 0x61109b]
jmp dword [eax*4 + 0x6110ac]
lea eax, [ebp - 4]
mov edx, 0x6111a0
call fcn.0040a3b8
jmp case.0x611094.0
lea eax, [ebp - 4]
mov edx, 0x6111c4
call fcn.0040a3b8
jmp case.0x611094.0
lea eax, [ebp - 4]
mov edx, 0x6111e4
call fcn.0040a3b8
jmp case.0x611094.0
lea eax, [ebp - 4]
mov edx, 0x611200
call fcn.0040a3b8
jmp case.0x611094.0
lea eax, [ebp - 4]
mov edx, 0x61121c
call fcn.0040a3b8
mov dl, 1
mov eax, dword [0x501844]
call fcn.00502990
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x611169
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000001
mov eax, dword [ebp - 8]
call fcn.00502a78
xor ecx, ecx
mov edx, 0x611238
mov eax, dword [ebp - 8]
call fcn.00502bd0
mov ecx, ebx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.0050358c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x611170
mov eax, dword [ebp - 8]
call fcn.004081f0
ret

Function at 0x611cbc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7f8
push ebx
xor edx, edx
mov dword [ebp - 0x808], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x611d9b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
movzx eax, byte [eax + 0x64]
cmp eax, 5
ja case.default.0x611cf1
jmp dword [eax*4 + 0x611cf8]
push 0x400
lea eax, [ebp - 0x802]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
mov edx, ebx
lea eax, [ebp - 0x802]
call fcn.004284dc
jmp case.default.0x611cf1
mov edx, ebx
mov eax, 0xb
call fcn.00611068
jmp case.default.0x611cf1
mov edx, ebx
mov eax, 2
call fcn.00611068
jmp case.default.0x611cf1
mov edx, ebx
mov eax, 0x10
call fcn.00611068
jmp case.default.0x611cf1
lea edx, [ebp - 0x808]
mov eax, dword [0x79c178]
mov eax, dword [eax]
call fcn.005c6728
mov eax, dword [ebp - 0x808]
mov edx, ebx
call fcn.00427954
jmp case.default.0x611cf1
mov eax, ebx
call fcn.00409f90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x611da2
lea eax, [ebp - 0x808]
call fcn.00409f90
ret

Function at 0x613adc
Capabilities:
Delete file
Move file

Disassembly:
push ebx
mov ebx, edx
mov dl, 1
mov eax, ebx
call fcn.004271e8
test al, al
jne 0x613af9
mov dl, 1
mov eax, ebx
call fcn.00427280
test al, al
je 0x613b0a
push 4
push 0
mov eax, ebx
call fcn.0040aec8
push eax
call sub.kernel32.dll_MoveFileExW
pop ebx
ret
Function at 0x6197cc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x61986b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00409fd8
mov eax, 0x104
call fcn.00428508
mov ebx, eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push edi
call sub.shell32.dll_SHGetSpecialFolderLocation
push ebx
mov eax, dword [ebp - 0xc]
push eax
call sub.shell32.dll_SHGetPathFromIDListW
test eax, eax
je 0x619827
mov eax, esi
mov edx, ebx
call fcn.0040abf8
mov eax, ebx
call fcn.00428548
lea eax, [ebp - 4]
call fcn.0040dbf8
push eax
call sub.shell32.dll_SHGetMalloc
test eax, 0x80000000
sete al
test al, al
je 0x619855
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x619872
lea eax, [ebp - 4]
call fcn.0040dbf8
ret

Function at 0x619f90
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a074
mov eax, dword [ebp - 8]
call fcn.0040a074
xor eax, eax
push ebp
push 0x61a061
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.00409f90
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
lea eax, [ebp - 0x14]
push eax
push ebx
mov eax, dword [ebp - 8]
call fcn.0040aec8
push eax
mov eax, dword [ebp - 4]
call fcn.0040aec8
mov edi, eax
push edi
call sub.advapi32.dll_LookupAccountNameW
mov eax, dword [ebp - 0x10]
call fcn.00428508
mov esi, eax
mov eax, dword [ebp - 0x14]
call fcn.0040668c
mov ebx, eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
lea eax, [ebp - 0x14]
push eax
push ebx
mov eax, dword [ebp - 8]
call fcn.0040aec8
push eax
push edi
call sub.advapi32.dll_LookupAccountNameW
test eax, eax
je 0x61a038
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.00619e90
mov eax, esi
call fcn.00428548
mov eax, ebx
call fcn.004066dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61a068
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409ff0
ret
Function at 0x61a380
Capabilities:
Persist via ginadll registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x61a47b
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
call fcn.0061a070
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x61a459
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call fcn.00502a78
mov edx, 0x61a498
mov eax, dword [ebp - 8]
call fcn.00502d04
test al, al
je 0x61a420
mov edx, 0x61a510
mov eax, dword [ebp - 8]
call fcn.00503b18
test al, al
je 0x61a418
lea ecx, [ebp - 0x10]
mov edx, 0x61a510
mov eax, dword [ebp - 8]
call fcn.0050358c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.004257f0
mov edx, dword [ebp - 0xc]
mov ecx, 1
mov eax, 0x61a52c
call fcn.0040b514
test eax, eax
setg byte [ebp - 1]
mov eax, dword [ebp - 8]
call fcn.00502a48
cmp byte [ebp - 1], 0
jne 0x61a443
mov edx, 0x80000001
mov eax, dword [ebp - 8]
call fcn.00502a78
mov edx, 0x61a548
mov eax, dword [ebp - 8]
call fcn.00503ea4
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61a460
mov eax, dword [ebp - 8]
call fcn.004081f0
ret

Function at 0x61a65c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x61a705
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0xff
mov eax, ebx
call fcn.004066c0
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x61a6e3
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
mov eax, dword [ebp - 8]
push eax
push 1
push 0x400
call sub.kernel32.dll_GetLocaleInfoW_1
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.0040af30
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 0x61a720
call fcn.0040b134
mov eax, dword [ebp - 0xc]
call fcn.004267a8
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61a6ea
mov eax, dword [ebp - 8]
call fcn.004066dc
ret

Function at 0x61a730
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x61a7db
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
mov ebx, 0x7a2ec4
lea eax, [ebp - 4]
lea edx, [esi + 0x61]
call fcn.0040aef0
mov edx, dword [ebp - 4]
mov eax, ebx
mov ecx, 0x61a7f4
call fcn.0040b134
lea eax, [ebx + 4]
mov edx, 0x7f
call fcn.0040b05c
lea eax, [ebx + 4]
call fcn.0040a550
xor ecx, ecx
mov edx, 0x7f
call fcn.00407764
push 0x7f
lea eax, [ebx + 4]
call fcn.0040a550
push eax
mov eax, dword [ebx]
call fcn.0040aec8
push eax
call sub.kernel32.dll_QueryDosDeviceW
mov eax, dword [ebx + 4]
call fcn.0040aec8
call fcn.0040a4b4
mov edi, eax
mov dword [ebx + 8], edi
lea eax, [ebx + 4]
mov edx, edi
call fcn.0040b05c
inc esi
add ebx, 0xc
cmp esi, 0x1a
jne 0x61a74d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61a7e2
lea eax, [ebp - 4]
call fcn.00409f90
ret
Function at 0x61c3bc
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x61c4cd
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.005e126c
mov dl, 1
mov eax, dword [0x61c110]
call fcn.0061c798
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x61c49b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x14], 0
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.0061c9d0
mov edx, 0x61c4ec
mov eax, dword [ebp - 0x10]
call fcn.0061c81c
mov byte [ebp - 9], al
lea eax, [ebp - 8]
mov edx, 0x61c528
call fcn.0040a3b8
movzx ebx, byte [ebp - 9]
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea ecx, [ebp - 0x28]
mov dl, 1
mov eax, ebx
call fcn.00426ae0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0x11
lea edx, [ebp - 0x24]
mov ecx, 1
mov eax, 0x61c57c
call fcn.004286c4
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 0x2c], ebx
mov eax, dword [ebp - 0x2c]
call fcn.0040aec8
push eax
call sub.kernel32.dll_OutputDebugStringW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61c4a2
mov eax, dword [ebp - 0x10]
call fcn.004081f0
ret
Function at 0x61d020
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x61d13b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004b1568
mov esi, eax
lea edx, [ebp - 0x1c]
mov eax, dword [edi + 0x18]
add eax, 4
call fcn.0061c5f0
mov edx, dword [ebp - 0x1c]
lea eax, [esi + 0xc]
call fcn.0040a414
lea ecx, [ebp - 0x20]
mov eax, dword [edi + 0x18]
add eax, 0xc
mov dl, 1
call fcn.0061c6c8
mov edx, dword [ebp - 0x20]
lea eax, [esi + 0x14]
mov ecx, 0
call fcn.0040ab78
lea eax, [edi + 4]
lea edx, [ebp - 8]
push edx
push eax
call sub.kernel32.dll_FileTimeToLocalFileTime
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_FileTimeToSystemTime
lea eax, [ebp - 0x18]
call fcn.0042a238
fstp qword [esi + 0x18]
wait
lea eax, [esi + 0x28]
mov edx, dword [edi + 0x18]
mov edx, dword [edx + 0x14]
mov ecx, 0
call fcn.0040a714
lea eax, [esi + 0x2c]
mov edx, dword [edi + 0x18]
mov edx, dword [edx + 0x20]
mov ecx, 0
call fcn.0040a714
lea ecx, [ebp - 0x24]
mov eax, dword [edi + 0x18]
add eax, 0x2c
xor edx, edx
call fcn.0061c6c8
mov edx, dword [ebp - 0x24]
lea eax, [esi + 0x30]
mov ecx, 0
call fcn.0040ab78
mov ebx, dword [edi + 0x10]
mov eax, dword [edi + 0xc]
dec eax
test eax, eax
jl 0x61d118
inc eax
mov edi, eax
mov eax, dword [ebx + 4]
test eax, eax
je 0x61d115
mov edx, dword [esi + 0x24]
xchg edx, eax
call fcn.0061d2f8
add ebx, 0x3c
dec edi
jne 0x61d102
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61d142
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00409ff0
lea eax, [ebp - 0x1c]
call fcn.00409fb4
ret