joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f7748
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x4f7750
push ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405d50
mov eax, dword [ebp - 8]
call fcn.00405d50
xor eax, eax
push ebp
push 0x4f7949
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
call fcn.004f71fc
mov eax, dword [ebp - 0x14]
call fcn.004f724c
lea edx, [ebp - 0xc]
mov eax, 0x4f795c
call fcn.004f73e8
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.004031e8
mov eax, dword [ebp - 0x18]
xor edx, edx
call fcn.0040ae4c
mov dl, 1
mov eax, dword [0x419f28]
call fcn.0040495c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4f7909
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x4f796c
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x20]
xor eax, eax
call fcn.004031e8
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov edx, 0x4f7988
call fcn.00405bac
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4f7998
lea edx, [ebp - 0x28]
xor eax, eax
call fcn.004031e8
push dword [ebp - 0x28]
push 0x4f79ac
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00405c20
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
cmp dword [ebp - 4], 0
je 0x4f786e
push 0x4f79cc
push dword [ebp - 4]
push 0x4f79dc
push dword [ebp - 8]
lea eax, [ebp - 0x2c]
mov edx, 4
call fcn.00405c20
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x30]
xor eax, eax
call fcn.004031e8
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x3c]
xor eax, eax
call fcn.004031e8
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x38]
call fcn.0040b0bc
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x34]
mov edx, 0x4f79e8
call fcn.00405bac
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x40]
mov ecx, dword [ebp - 0xc]
mov edx, 0x4f7988
call fcn.00405bac
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x74]
lea eax, [ebp - 0x44]
call fcn.004f73b4
mov eax, dword [ebp - 0x44]
call fcn.00402f5c
call fcn.00402f20
mov eax, 0x4f79f8
call fcn.0044a1f0
push 0
mov eax, dword [ebp - 0xc]
call fcn.00405d60
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f7910
mov eax, dword [ebp - 0x10]
call fcn.0040498c
ret
Function at 0x4f7c60
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4f7c68
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4f7d79
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 0x43
lea eax, [ebp - 0x14]
mov edx, ebx
call fcn.00405a74
lea eax, [ebp - 0x14]
mov edx, 0x4f7d90
call fcn.00405b68
mov eax, dword [ebp - 0x14]
call fcn.0040ad30
test al, al
je 0x4f7cd4
lea eax, [ebp - 0x18]
mov edx, ebx
call fcn.00405a74
lea eax, [ebp - 0x18]
mov edx, 0x4f7d90
call fcn.00405b68
mov eax, dword [ebp - 0x18]
call fcn.00405d60
push eax
call sub.kernel32.dll_GetDriveTypeA
add eax, 0xfffffffd
sub eax, 2
jb 0x4f7cda
inc ebx
cmp bl, 0x5b
jne 0x4f7c84
push 0
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x1c]
mov edx, ebx
call fcn.00405a74
lea eax, [ebp - 0x1c]
mov edx, 0x4f7d90
call fcn.00405b68
mov eax, dword [ebp - 0x1c]
call fcn.00405d60
push eax
call sub.kernel32.dll_GetVolumeInformationA
lea ecx, [ebp - 0x20]
mov eax, dword [ebp - 8]
movzx eax, ax
mov edx, 4
call fcn.0040a838
mov eax, dword [ebp - 0x20]
push eax
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 8]
shr eax, 0x10
movzx eax, ax
mov edx, 4
call fcn.0040a838
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 4]
pop ecx
call fcn.00405bac
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.004058e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f7d80
lea eax, [ebp - 0x24]
mov edx, 5
call fcn.004058b0
lea eax, [ebp - 4]
call fcn.0040588c
ret
Function at 0x4f7e30
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x4f7e38
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4f7fa2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.0040588c
mov bl, 0x43
lea eax, [ebp - 0x24]
mov edx, ebx
call fcn.00405a74
lea eax, [ebp - 0x24]
mov edx, 0x4f7fb8
call fcn.00405b68
mov eax, dword [ebp - 0x24]
call fcn.00405d60
push eax
call sub.kernel32.dll_GetDriveTypeA
sub eax, 3
jne 0x4f7f66
push 0
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
lea eax, [ebp - 0x28]
mov edx, ebx
call fcn.00405a74
lea eax, [ebp - 0x28]
mov edx, 0x4f7fb8
call fcn.00405b68
mov eax, dword [ebp - 0x28]
call fcn.00405d60
push eax
call sub.kernel32.dll_GetVolumeInformationA
lea ecx, [ebp - 0x2c]
mov eax, dword [ebp - 0xc]
movzx eax, ax
mov edx, 4
call fcn.0040a838
mov eax, dword [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x30]
mov eax, dword [ebp - 0xc]
shr eax, 0x10
movzx eax, ax
mov edx, 4
call fcn.0040a838
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 4]
pop ecx
call fcn.00405bac
movzx eax, bl
sub eax, 0x40
jno 0x4f7f08
call fcn.0040485c
call fcn.0040b35c
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
push dword [ebp - 8]
lea eax, [ebp - 0x34]
mov edx, ebx
call fcn.00405a74
push dword [ebp - 0x34]
push 0x4f7fc4
push dword [ebp - 4]
push 0x4f7fd4
fild qword [ebp - 0x20]
fld dword [0x4f7fdc]
call fcn.00403980
add esp, 0xfffffff8
fstp qword [esp]
wait
lea ecx, [ebp - 0x38]
xor edx, edx
mov al, 0xa
call fcn.004f5ccc
push dword [ebp - 0x38]
push 0x4f7fe8
lea eax, [ebp - 8]
mov edx, 7
call fcn.00405c20
inc ebx
cmp bl, 0x5b
jne 0x4f7e5b
mov eax, esi
mov edx, dword [ebp - 8]
call fcn.004058e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f7fa9
lea eax, [ebp - 0x38]
mov edx, 6
call fcn.004058b0
lea eax, [ebp - 8]
mov edx, 2
call fcn.004058b0
ret

Function at 0x4f8520
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, eax
mov eax, esi
call fcn.0040588c
push 0
lea eax, [ebp - 4]
push eax
call sub.wininet.dll_InternetGetConnectedState
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x4f85a2
mov eax, dword [ebp - 4]
and eax, 1
cmp eax, 1
jne 0x4f855b
mov eax, esi
mov edx, 0x4f85c0
call fcn.004058e0
mov eax, dword [ebp - 4]
and eax, 2
cmp eax, 2
jne 0x4f8572
mov eax, esi
mov edx, 0x4f85d0
call fcn.004058e0
mov eax, dword [ebp - 4]
and eax, 4
cmp eax, 4
jne 0x4f8589
mov eax, esi
mov edx, 0x4f85dc
call fcn.004058e0
mov eax, dword [ebp - 4]
and eax, 8
cmp eax, 8
jne 0x4f85ae
mov eax, esi
mov edx, 0x4f85ec
call fcn.004058e0
jmp 0x4f85ae
mov eax, esi
mov edx, 0x4f8604
call fcn.004058e0
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4f8ba4
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd44
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x29c], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405d50
xor eax, eax
push ebp
push 0x4f8cee
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x298]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
xor ecx, ecx
push ebp
push 0x4f8cc6
push dword fs:[ecx]
mov dword fs:[ecx], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x105]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x105]
mov edx, dword [ebp - 4]
call fcn.0040b4ec
lea eax, [ebp - 0x105]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x4f8caf
mov edx, dword [eax + 0xc]
test edx, edx
je 0x4f8ca9
mov ebx, dword [edx]
test ebx, ebx
je 0x4f8ca3
lea eax, [ebp - 0x29c]
push eax
movzx eax, byte [ebx]
mov dword [ebp - 0x2bc], eax
mov byte [ebp - 0x2b8], 0
movzx eax, byte [ebx + 1]
mov dword [ebp - 0x2b4], eax
mov byte [ebp - 0x2b0], 0
movzx eax, byte [ebx + 2]
mov dword [ebp - 0x2ac], eax
mov byte [ebp - 0x2a8], 0
movzx eax, byte [ebx + 3]
mov dword [ebp - 0x2a4], eax
mov byte [ebp - 0x2a0], 0
lea edx, [ebp - 0x2bc]
mov ecx, 3
mov eax, 0x4f8d08
call fcn.0040bef8
mov edx, dword [ebp - 0x29c]
mov eax, esi
call fcn.004058e0
mov byte [ebp - 5], 1
jmp 0x4f8cb3
mov byte [ebp - 5], 0
jmp 0x4f8cb3
mov byte [ebp - 5], 0
jmp 0x4f8cb3
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f8ccd
call sub.wsock32.dll_WSACleanup
ret
Function at 0x4f91c4
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff58
push ebx
push esi
xor edx, edx
mov dword [ebp - 0xa8], edx
mov dword [ebp - 0x9c], edx
mov dword [ebp - 0xa0], edx
mov dword [ebp - 0xa4], edx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4f93c4
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x98], 0x94
lea eax, [ebp - 4]
call fcn.0040588c
lea eax, [ebp - 0x98]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x4f9394
mov ebx, dword [ebp - 0x94]
cmp ebx, 6
jne 0x4f927c
mov eax, dword [ebp - 0x90]
cmp eax, 1
jne 0x4f9247
lea eax, [ebp - 4]
mov edx, 0x4f93dc
call fcn.00405924
jmp 0x4f927c
cmp eax, 2
jne 0x4f925b
lea eax, [ebp - 4]
mov edx, 0x4f93ec
call fcn.00405924
jmp 0x4f927c
cmp eax, 3
jne 0x4f926f
lea eax, [ebp - 4]
mov edx, 0x4f93fc
call fcn.00405924
jmp 0x4f927c
lea eax, [ebp - 4]
mov edx, 0x4f9410
call fcn.00405924
cmp ebx, 5
jne 0x4f92bc
mov eax, dword [ebp - 0x90]
cmp eax, 1
jne 0x4f929b
lea eax, [ebp - 4]
mov edx, 0x4f9424
call fcn.00405924
jmp 0x4f92bc
cmp eax, 2
jne 0x4f92af
lea eax, [ebp - 4]
mov edx, 0x4f9434
call fcn.00405924
jmp 0x4f92bc
lea eax, [ebp - 4]
mov edx, 0x4f9448
call fcn.00405924
cmp ebx, 4
jne 0x4f92fc
mov eax, dword [ebp - 0x90]
cmp eax, 0xa
jne 0x4f92db
lea eax, [ebp - 4]
mov edx, 0x4f945c
call fcn.00405924
jmp 0x4f92fc
cmp eax, 0x5a
jne 0x4f92ef
lea eax, [ebp - 4]
mov edx, 0x4f946c
call fcn.00405924
jmp 0x4f92fc
lea eax, [ebp - 4]
mov edx, 0x4f947c
call fcn.00405924
push dword [ebp - 4]
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x9c]
call fcn.0040a810
push dword [ebp - 0x9c]
push 0x4f948c
mov eax, dword [ebp - 0x90]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xa0]
call fcn.0040a810
push dword [ebp - 0xa0]
push 0x4f9498
mov eax, dword [ebp - 0x8c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xa4]
call fcn.0040a810
push dword [ebp - 0xa4]
lea eax, [ebp - 4]
mov edx, 6
call fcn.00405c20
push dword [ebp - 4]
push 0x4f94a4
lea eax, [ebp - 0xa8]
lea edx, [ebp - 0x84]
mov ecx, 0x80
call fcn.00405b0c
push dword [ebp - 0xa8]
lea eax, [ebp - 4]
mov edx, 3
call fcn.00405c20
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.004058e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f93cb
lea eax, [ebp - 0xa8]
mov edx, 4
call fcn.004058b0
lea eax, [ebp - 4]
call fcn.0040588c
ret
Function at 0x4f99a8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffecc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x114], ebx
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x124], ebx
mov dword [ebp - 0x128], ebx
mov dword [ebp - 0x12c], ebx
mov dword [ebp - 0x130], ebx
mov dword [ebp - 0x134], ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4f9bbb
push dword fs:[eax]
mov dword fs:[eax], esp
mov bx, 1
add bx, 1
jae 0x4f9a13
call fcn.0040485c
lea eax, [ebp - 0x10d]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 0x114]
lea eax, [ebp - 0x10d]
call fcn.0040b66c
push dword [ebp - 0x114]
push edi
push 0x4f9bd4
lea eax, [ebp - 0x118]
call fcn.004f645c
push dword [ebp - 0x118]
push 0x4f9bd4
call fcn.0040cf5c
add esp, 0xfffffff8
fstp qword [esp]
wait
call fcn.00479748
movzx eax, ax
lea edx, [ebp - 0x11c]
call fcn.0040a724
push dword [ebp - 0x11c]
call fcn.0040cf5c
add esp, 0xfffffff8
fstp qword [esp]
wait
call fcn.0047976c
movzx eax, ax
lea ecx, [ebp - 0x120]
mov edx, 2
call fcn.004f5d4c
push dword [ebp - 0x120]
call fcn.0040cf5c
add esp, 0xfffffff8
fstp qword [esp]
wait
call fcn.00479790
movzx eax, ax
lea ecx, [ebp - 0x124]
mov edx, 2
call fcn.004f5d4c
push dword [ebp - 0x124]
push 0x4f9bd4
call fcn.0040cf88
add esp, 0xfffffff8
fstp qword [esp]
wait
call fcn.004797b4
movzx eax, ax
lea ecx, [ebp - 0x128]
mov edx, 2
call fcn.004f5d4c
push dword [ebp - 0x128]
call fcn.0040cf88
add esp, 0xfffffff8
fstp qword [esp]
wait
call fcn.004797dc
movzx eax, ax
lea ecx, [ebp - 0x12c]
mov edx, 2
call fcn.004f5d4c
push dword [ebp - 0x12c]
call fcn.0040cf88
add esp, 0xfffffff8
fstp qword [esp]
wait
call fcn.00479804
movzx eax, ax
lea ecx, [ebp - 0x130]
mov edx, 2
call fcn.004f5d4c
push dword [ebp - 0x130]
push 0x4f9bd4
lea edx, [ebp - 0x134]
movzx eax, bx
call fcn.0040a724
push dword [ebp - 0x134]
push dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, 0xf
call fcn.00405c20
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.004058e0
mov eax, dword [esi]
call fcn.0040ad0c
test al, al
jne 0x4f9a08
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f9bc2
lea eax, [ebp - 0x134]
mov edx, 9
call fcn.004058b0
lea eax, [ebp - 4]
call fcn.0040588c
ret
Function at 0x4f9cd0
Capabilities:
Reference sql statements
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4f9cd9
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov byte [ebp - 0x12], cl
mov byte [ebp - 0x11], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x4f9ef1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.0040588c
xor edx, edx
push ebp
push 0x4f9e9c
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x4f9f0c
xor ecx, ecx
xor edx, edx
xor eax, eax
call fcn.004f4b24
test al, al
jne 0x4f9d39
mov eax, dword [ebp + 8]
call fcn.0040588c
call fcn.004052ac
jmp 0x4f9eae
lea edx, [ebp - 4]
mov eax, 0x4f9f20
call fcn.004f4c68
mov eax, dword [ebp - 4]
call fcn.00406e18
cmp ebx, eax
jle 0x4f9d5c
mov eax, dword [ebp - 4]
call fcn.00406e18
mov ebx, eax
cmp byte [ebp - 0x12], 0
je 0x4f9d6e
xor esi, esi
mov eax, dword [ebp - 4]
call fcn.00406e18
jmp 0x4f9d72
mov esi, ebx
mov eax, ebx
mov ebx, esi
mov esi, eax
sub esi, ebx
jl 0x4f9e6d
inc esi
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x24]
push eax
mov edi, ebx
test edi, edi
jns 0x4f9d94
call fcn.00404854
mov ecx, edi
mov edx, 0x4f9f40
mov eax, dword [ebp - 4]
call fcn.004f44c8
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0xb
lea edx, [ebp - 0x20]
xor ecx, ecx
mov eax, 0x4f9f50
call fcn.0040bef8
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 8]
call fcn.004f4c68
push 0
lea eax, [ebp - 0xc]
push eax
test ebx, ebx
jns 0x4f9dd6
call fcn.00404854
mov ecx, edi
mov edx, 0x4f9f9c
mov eax, dword [ebp - 4]
call fcn.004f44c8
mov edx, 0x4f9fb0
mov eax, dword [ebp - 0xc]
call fcn.0040a1a8
test al, al
jne 0x4f9e52
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.00405b68
cmp byte [ebp - 0x11], 0
je 0x4f9e3d
push dword [ebp - 0x10]
push 0x4f9fc0
push 0
lea eax, [ebp - 0x28]
push eax
test ebx, ebx
jns 0x4f9e1e
call fcn.00404854
mov ecx, edi
mov edx, 0x4f9fd0
mov eax, dword [ebp - 4]
call fcn.004f44c8
push dword [ebp - 0x28]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00405c20
cmp byte [ebp - 0x12], 0
je 0x4f9e65
lea eax, [ebp - 0x10]
mov edx, 0x4f9fe0
call fcn.00405b68
jmp 0x4f9e65
cmp byte [ebp - 0x12], 0
jne 0x4f9e65
lea eax, [ebp - 0x10]
mov edx, 0x4f9fec
call fcn.00405924
inc ebx
dec esi
jne 0x4f9d7f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f9ea3
call fcn.004f4fcc
lea eax, [ebp - 4]
mov edx, dword [0x4f449c]
call fcn.004065e8
lea eax, [ebp - 8]
mov edx, dword [0x4f449c]
call fcn.004065e8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f9ef8
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.004058b0
lea eax, [ebp - 0x18]
call fcn.0040588c
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004058b0
lea eax, [ebp - 8]
mov edx, dword [0x4f449c]
mov ecx, 2
call fcn.004064fc
ret
Function at 0x504d04
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
mov eax, 8
test byte [edx + 1], 0x80
setne bl
movzx edi, word [edx]
add edi, edi
movzx esi, cl
mov ebp, esi
shr ebp, 7
or edi, ebp
cmp edi, 0xffff
jbe 0x504d30
call fcn.00404854
mov word [edx], di
test bl, bl
je 0x504d3c
xor word [edx], 0x1021
add esi, esi
and esi, 0xff
cmp esi, 0xff
jbe 0x504d51
call fcn.00404854
mov ecx, esi
dec eax
jne 0x504d0d
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5124dc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov al, byte [ebp - 9]
dec eax
test eax, eax
jl 0x51252b
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
lea eax, [eax + edx*8]
mov edx, dword [ebp - 0x14]
mov al, byte [eax + edx]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
lea edx, [edx + ecx*8]
mov ecx, dword [ebp - 0x14]
xor byte [edx + ecx], al
inc dword [ebp - 0x14]
dec dword [ebp - 0x18]
jne 0x512505
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jne 0x5124f0
mov esp, ebp
pop ebp
ret
Function at 0x512c1c
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push esi
push edi
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x200]
push ecx
mov ecx, 0x78
rep movsd dword es:[edi], dword [esi]
pop ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
sub eax, 0x80
je 0x512c58
sub eax, 0x40
je 0x512c61
sub eax, 0x40
je 0x512c6a
jmp 0x512c73
mov dword [ebp - 0x18], 4
jmp 0x512c7f
mov dword [ebp - 0x18], 6
jmp 0x512c7f
mov dword [ebp - 0x18], 8
jmp 0x512c7f
mov dword [ebp - 0x10], 0xfffffffe
jmp 0x512d72
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
setge al
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00512460
sub eax, 0x80
je 0x512ca6
sub eax, 0x40
je 0x512caf
sub eax, 0x40
je 0x512cb8
jmp 0x512cc1
mov dword [ebp - 0x1c], 0xa
jmp 0x512ccd
mov dword [ebp - 0x1c], 0xc
jmp 0x512ccd
mov dword [ebp - 0x1c], 0xe
jmp 0x512ccd
mov dword [ebp - 0x10], 0xfffffffd
jmp 0x512d72
mov cl, byte [ebp - 0x18]
lea edx, [ebp - 0x200]
mov eax, dword [ebp - 4]
call fcn.005124dc
mov eax, dword [ebp - 0x1c]
dec eax
test eax, eax
jle 0x512d38
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], 1
mov cl, byte [ebp - 0x18]
mov edx, str.cw
mov eax, dword [ebp - 4]
call fcn.005125f0
mov cl, byte [ebp - 0x18]
mov eax, dword [ebp - 4]
xor edx, edx
call fcn.00512538
mov dl, byte [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00512654
mov cl, byte [ebp - 0x18]
mov eax, dword [ebp - 0x14]
shl eax, 2
lea edx, [ebp + eax*8 - 0x200]
mov eax, dword [ebp - 4]
call fcn.005124dc
inc dword [ebp - 0x14]
dec dword [ebp - 0x20]
jne 0x512cf0
mov cl, byte [ebp - 0x18]
mov edx, str.cw
mov eax, dword [ebp - 4]
call fcn.005125f0
mov cl, byte [ebp - 0x18]
mov eax, dword [ebp - 4]
xor edx, edx
call fcn.00512538
mov cl, byte [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
shl eax, 2
lea edx, [ebp + eax*8 - 0x200]
mov eax, dword [ebp - 4]
call fcn.005124dc
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x512d80
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe04
push esi
push edi
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x1fc]
push ecx
mov ecx, 0x78
rep movsd dword es:[edi], dword [esi]
pop ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
sub eax, 0x80
je 0x512dbc
sub eax, 0x40
je 0x512dc5
sub eax, 0x40
je 0x512dce
jmp 0x512dd7
mov dword [ebp - 0x18], 4
jmp 0x512de3
mov dword [ebp - 0x18], 6
jmp 0x512de3
mov dword [ebp - 0x18], 8
jmp 0x512de3
mov dword [ebp - 0x10], 0xfffffffe
jmp 0x512ed1
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
setge al
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00512460
sub eax, 0x80
je 0x512e0a
sub eax, 0x40
je 0x512e13
sub eax, 0x40
je 0x512e1c
jmp 0x512e25
mov dword [ebp - 0x1c], 0xa
jmp 0x512e31
mov dword [ebp - 0x1c], 0xc
jmp 0x512e31
mov dword [ebp - 0x1c], 0xe
jmp 0x512e31
mov dword [ebp - 0x10], 0xfffffffd
jmp 0x512ed1
mov cl, byte [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
shl eax, 2
lea edx, [ebp + eax*8 - 0x1fc]
mov eax, dword [ebp - 4]
call fcn.005124dc
mov cl, byte [ebp - 0x18]
mov edx, 0x55020c
mov eax, dword [ebp - 4]
call fcn.005125f0
mov cl, byte [ebp - 0x18]
mov eax, dword [ebp - 4]
mov dl, 1
call fcn.00512538
mov eax, dword [ebp - 0x1c]
dec eax
cmp eax, 1
jl 0x512ebb
mov dword [ebp - 0x14], eax
mov cl, byte [ebp - 0x18]
mov eax, dword [ebp - 0x14]
shl eax, 2
lea edx, [ebp + eax*8 - 0x1fc]
mov eax, dword [ebp - 4]
call fcn.005124dc
mov dl, byte [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.0051276c
mov cl, byte [ebp - 0x18]
mov edx, 0x55020c
mov eax, dword [ebp - 4]
call fcn.005125f0
mov cl, byte [ebp - 0x18]
mov eax, dword [ebp - 4]
mov dl, 1
call fcn.00512538
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0
jne 0x512e72
mov cl, byte [ebp - 0x18]
lea edx, [ebp - 0x1fc]
mov eax, dword [ebp - 4]
call fcn.005124dc
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x5131e8
Capabilities:
List groups for user account

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.004063c0
xor eax, eax
push ebp
push 0x51325a
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00406230
push eax
push 0
call sub.netapi32.dll_NetUserGetLocalGroups
mov dword [ebp - 8], eax
cmp dword [ebp - 0xc], 0
je 0x513244
mov eax, dword [ebp - 0xc]
push eax
call sub.netapi32.dll_NetApiBufferFree
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x513261
lea eax, [ebp - 4]
call fcn.004060d0
ret