joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5343a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffddc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x220], edx
mov dword [ebp - 0x224], edx
mov dword [ebp - 0x21c], edx
mov dword [ebp - 0x218], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x534503
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x53441e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x23
lea eax, [ebp - 0x212]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetSpecialFolderPathW
mov eax, dword [ebp - 4]
add eax, 8
lea edx, [ebp - 0x212]
mov ecx, 0x105
call fcn.00406f90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x534449
xor eax, eax
push ebp
push 0x53448b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x1a
lea eax, [ebp - 0x212]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetSpecialFolderPathW
mov eax, dword [ebp - 4]
add eax, 4
lea edx, [ebp - 0x212]
mov ecx, 0x105
call fcn.00406f90
xor eax, eax
pop edx
pop ecx
pop ecx
Function at 0x534ad8
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
test eax, eax
jns 0x534b0c
add eax, 3
sar eax, 2
test eax, eax
jle 0x534c6a
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x14], 1
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
movzx eax, byte [eax + edx]
cmp eax, 0x3d
jg 0x534b49
je 0x534baf
sub eax, 0x2b
je 0x534b9b
sub eax, 4
je 0x534ba5
dec eax
sub eax, 0xa
jb 0x534b85
jmp 0x534bb7
add eax, 0xffffffbf
sub eax, 0x1a
jb 0x534b5b
add eax, 0xfffffffa
sub eax, 0x1a
jb 0x534b6f
jmp 0x534bb7
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
mov al, byte [eax + edx]
sub al, 0x41
mov edx, dword [ebp - 0x18]
mov byte [ebp + edx - 0x24], al
jmp 0x534bb7
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
mov al, byte [eax + edx]
sub al, 0x61
add al, 0x1a
mov edx, dword [ebp - 0x18]
mov byte [ebp + edx - 0x24], al
jmp 0x534bb7
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
mov al, byte [eax + edx]
sub al, 0x30
add al, 0x34
mov edx, dword [ebp - 0x18]
mov byte [ebp + edx - 0x24], al
jmp 0x534bb7
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x24], 0x3e
jmp 0x534bb7
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x24], 0x3f
jmp 0x534bb7
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x24], 0xff
inc dword [ebp - 0x1c]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jne 0x534b26
mov al, byte [ebp - 0x24]
shl eax, 2
xor edx, edx
mov dl, byte [ebp - 0x23]
shr edx, 4
or al, dl
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
mov byte [edx + ecx], al
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x10], eax
cmp byte [ebp - 0x22], 0xff
je 0x534c1b
cmp byte [ebp - 0x21], 0xff
jne 0x534c1b
mov al, byte [ebp - 0x23]
shl eax, 4
xor edx, edx
mov dl, byte [ebp - 0x22]
shr edx, 2
or al, dl
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
mov byte [edx + ecx + 1], al
mov eax, dword [ebp - 0x20]
add eax, 2
mov dword [ebp - 0x10], eax
inc dword [ebp - 0x20]
jmp 0x534c5b
cmp byte [ebp - 0x22], 0xff
je 0x534c5b
mov al, byte [ebp - 0x23]
shl eax, 4
xor edx, edx
mov dl, byte [ebp - 0x22]
shr edx, 2
or al, dl
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
mov byte [edx + ecx + 1], al
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x20]
mov cl, byte [ebp - 0x22]
shl ecx, 6
or cl, byte [ebp - 0x21]
mov byte [eax + edx + 2], cl
mov eax, dword [ebp - 0x20]
add eax, 3
mov dword [ebp - 0x10], eax
add dword [ebp - 0x20], 2
inc dword [ebp - 0x20]
inc dword [ebp - 0x14]
dec dword [ebp - 0x30]
jne 0x534b21
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x535c38
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
test eax, eax
jbe 0x535c72
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x10]
dec eax
mov al, byte [eax]
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x10]
dec edx
xor byte [edx], al
inc dword [ebp - 0x10]
dec dword [ebp - 0x14]
jne 0x535c58
mov esp, ebp
pop ebp
ret

Function at 0x536f08
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
mov al, byte [ebp - 5]
dec eax
test eax, eax
jb 0x536f9a
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
shl eax, 2
mov edx, dword [ebp - 4]
movzx eax, byte [edx + eax]
lea eax, [eax*4 + 0x7094c4]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
shl edx, 2
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + edx + 1]
lea edx, [edx*4 + 0x7098c4]
xor eax, dword [edx]
mov edx, dword [ebp - 0xc]
shl edx, 2
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + edx + 2]
lea edx, [edx*4 + 0x709cc4]
xor eax, dword [edx]
mov edx, dword [ebp - 0xc]
shl edx, 2
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + edx + 3]
lea edx, [edx*4 + 0x70a0c4]
xor eax, dword [edx]
mov edx, dword [ebp - 0xc]
shl edx, 2
mov ecx, dword [ebp - 4]
lea edx, [ecx + edx]
mov dword [edx], eax
inc dword [ebp - 0xc]
dec dword [ebp - 0x10]
jne 0x536f29
mov esp, ebp
pop ebp
ret

Function at 0x544ac8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
dec eax
test eax, eax
jl 0x544b48
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x10]
and eax, 0xff
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
movzx edx, byte [edx + ecx]
xor eax, edx
mov edx, dword [eax*8 + 0x70adc4]
mov eax, dword [eax*8 + 0x70adc0]
push edx
push eax
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
shrd eax, edx, 8
shr edx, 8
xor eax, dword [esp]
xor edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
inc dword [ebp - 0x14]
dec dword [ebp - 0x18]
jne 0x544af3
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 8
Function at 0x544b54
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x544ba8
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
movzx eax, byte [eax + edx]
xor eax, dword [ebp - 0x10]
and eax, 0xff
mov eax, dword [eax*4 + 0x70a9c0]
mov edx, dword [ebp - 0x10]
shr edx, 8
xor eax, edx
mov dword [ebp - 0x10], eax
inc dword [ebp - 0x14]
dec dword [ebp - 0x18]
jne 0x544b7c
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x55a1ec
Capabilities:
Allocate or change rwx memory
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
cmp byte [eax], 0
je 0x55a2b9
cmp dword [ebp - 4], 0
je 0x55a2b9
xor ecx, ecx
mov edx, 6
mov eax, dword [ebp - 4]
call fcn.00559d44
test al, al
je 0x55a24b
mov eax, dword [0x721d68]
cmp byte [eax], 0
je 0x55a23f
mov ecx, 0x40e9
mov edx, 0x55a2cc
mov eax, 0x55a348
call fcn.00405ac4
push 0x55a38c
call sub.kernel32.dll_OutputDebugStringW
jmp 0x55a2b9
mov eax, dword [ebp - 4]
call fcn.00559964
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x55a2b9
lea eax, [ebp - 0x10]
push eax
push 0x40
push 5
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualProtect
lea eax, [ebp - 0xc]
push eax
push 5
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_WriteProcessMemory
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 5
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualProtect
cmp dword [ebp - 0x14], 0
je 0x55a2b3
push 5
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_FlushInstructionCache
mov eax, dword [ebp - 8]
mov byte [eax], 0
mov esp, ebp
pop ebp
ret

Function at 0x561184
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5611f3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x56120c
call fcn.0047b9a8
mov eax, dword [ebp - 4]
call fcn.00406e0c
push eax
call sub.kernel32.dll_OutputDebugStringW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5611fa
lea eax, [ebp - 4]
call fcn.00406d70
ret

Function at 0x56138c
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5613e9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0xc]
xor ecx, ecx
mov eax, 0x561400
call fcn.0047b9a8
mov eax, dword [ebp - 4]
call fcn.00406e0c
push eax
call sub.kernel32.dll_OutputDebugStringW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5613f0
lea eax, [ebp - 4]
call fcn.00406d70
ret
Function at 0x5614bc
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
xor eax, eax
push ebp
push 0x5617e2
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x7298e8], 0
je 0x5617c7
mov eax, dword [0x7298e8]
mov dword [ebp - 0x20], eax
call fcn.00404a58
mov eax, dword [ebp - 0x20]
call fcn.00404d78
or edx, 0xffffffff
call fcn.00404b04
xor eax, eax
push ebp
push 0x5617c0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x7298e8]
mov edx, dword [eax + 0x30]
mov dword [ebp - 0x18], edx
mov edx, dword [eax + 0x34]
mov dword [ebp - 0x14], edx
xor eax, eax
push ebp
push 0x561670
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x7298e8]
xor edx, edx
mov dword [eax + 0x38], edx
mov eax, dword [0x7298e8]
mov edx, dword [0x53f664]
mov dword [eax + 0x34], edx
mov dword [eax + 0x30], 0x554270
mov eax, dword [0x7298e8]
call fcn.0055fd60
mov eax, dword [0x7298e8]
mov edx, dword [ebp - 0x18]
mov dword [eax + 0x30], edx
mov edx, dword [ebp - 0x14]
mov dword [eax + 0x34], edx
mov eax, dword [0x7298e8]
mov eax, dword [eax + 0x38]
mov dword [ebp - 4], eax
cmp byte [0x729930], 0
je 0x5615e1
cmp dword [ebp - 4], 0
je 0x5615e1
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
je 0x5615e1
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xfffffffe
jne 0x5615d2
inc dword [ebp - 0xc]
push 0x5617fc
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.00479c10
push dword [ebp - 0x28]
push 0x56183c
mov eax, dword [ebp - 4]
push dword [eax]
lea eax, [ebp - 0x24]
mov edx, 4
call fcn.00407348
mov eax, dword [ebp - 0x24]
call fcn.00406e0c
push eax
call sub.kernel32.dll_OutputDebugStringW
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x56158e
mov eax, dword [0x7298e8]
mov eax, dword [eax + 0x38]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x561647
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x18], edx
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0xfffffffe
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0xe6
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0xe6
mov eax, dword [ebp - 4]
mov byte [eax + 0x14], 0
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x10]
mov ecx, dword [ebp - 4]
mov eax, dword [0x7298e8]
call fcn.00560140
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x5615f2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x561677
mov eax, dword [0x7298e8]
xor edx, edx
mov dword [eax + 0x38], edx
mov eax, dword [0x7298e8]
mov edx, dword [ebp - 0x18]
mov dword [eax + 0x30], edx
mov edx, dword [ebp - 0x14]
mov dword [eax + 0x34], edx
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5617e9
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00406d78
ret
Function at 0x56a788
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
xor ecx, ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x2c], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x56aa73
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x76993c], 0
je 0x56a7ce
mov edx, dword [0x76993c]
mov eax, dword [ebp - 4]
call fcn.00569448
cmp dword [0x76994c], 0
je 0x56a818
mov eax, dword [0x76994c]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
cmp eax, 0
jl 0x56a80e
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 0xc]
mov eax, dword [0x76994c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
call fcn.00569448
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffff
jne 0x56a7ea
mov eax, dword [0x76994c]
mov edx, dword [eax]
call dword [edx + 0x44]
lea edx, [ebp - 0x34]
xor eax, eax
call fcn.00483f34
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x30]
call fcn.0047aa38
mov edx, dword [ebp - 0x30]
mov eax, 0x769964
call fcn.00406d80
cmp byte [ebp - 5], 0
je 0x56aa58
cmp dword [0x70b964], 0
je 0x56aa58
mov eax, dword [0x721ad4]
cmp byte [eax], 0
je 0x56a8cb
push 0x56aa8c
mov eax, dword [0x769944]
mov edx, dword [eax]
call dword [edx + 0x14]
lea edx, [ebp - 0x3c]
call fcn.00479c10
push dword [ebp - 0x3c]
push 0x56aac8
mov eax, dword [0x769948]
mov edx, dword [eax]
call dword [edx + 0x14]
lea edx, [ebp - 0x40]
call fcn.00479c10
push dword [ebp - 0x40]
push 0x56aae4
push dword [0x769938]
push 0x56ab04
push dword [0x76993c]
push 0x56ab20
push dword [0x769964]
lea eax, [ebp - 0x38]
mov edx, 0xa
call fcn.00407348
mov eax, dword [ebp - 0x38]
call fcn.00406e0c
push eax
call sub.kernel32.dll_OutputDebugStringW
mov eax, dword [0x70b964]
call fcn.004a6f34
mov eax, dword [0x70b968]
call fcn.004a6f34
call fcn.005614bc
mov eax, dword [0x769944]
mov dword [ebp - 0x10], eax
call fcn.00404a58
mov eax, dword [ebp - 0x10]
call fcn.00404d78
or edx, 0xffffffff
call fcn.00404b04
xor eax, eax
push ebp
push 0x56a93e
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [0x769954], eax
mov eax, dword [0x769944]
mov edx, dword [eax]
call dword [edx + 0x44]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56a945
mov eax, dword [0x769944]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
call fcn.00404ce8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56aa7a
lea eax, [ebp - 0x40]
mov edx, 6
call fcn.00406d78
ret
Function at 0x587cfc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff994
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406d68
xor eax, eax
push ebp
push 0x587e40
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x416]
mov ecx, 0x1ff
mov edx, dword [ebp - 4]
call fcn.0047b4f0
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.004078f8
lea eax, [ebp - 0x616]
mov ecx, 0xfe
mov edx, dword [ebp - 0x14]
call fcn.0047b4f0
lea eax, [ebp - 0x65c]
xor ecx, ecx
mov edx, 0x44
call fcn.00403b8c
mov dword [ebp - 0x65c], 0x44
mov dword [ebp - 0x630], 1
mov ax, word [ebp - 8]
mov word [ebp - 0x62c], ax
xor eax, eax
mov dword [ebp - 0x66c], eax
xor eax, eax
mov dword [ebp - 0x668], eax
lea eax, [ebp - 0x66c]
push eax
lea eax, [ebp - 0x65c]
push eax
push 0
push 0
push 0x30
push 0
push 0
push 0
lea eax, [ebp - 0x416]
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x587dd0
mov dword [ebp - 0x10], 0xffffffff
jmp 0x587e22
cmp dword [ebp - 0xc], 0
je 0x587dec
imul eax, dword [ebp - 0xc], 0x3e8
push eax
mov eax, dword [ebp - 0x66c]
push eax
call sub.kernel32.dll_WaitForSingleObject
jmp 0x587dfa
push 0xffffffffffffffff
mov eax, dword [ebp - 0x66c]
push eax
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x66c]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x66c]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x668]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x587e47
lea eax, [ebp - 0x14]
call fcn.00406d70
lea eax, [ebp - 4]
call fcn.00406d70
ret
Function at 0x588e1c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x18], ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x14]
mov edx, dword [0x435398]
call fcn.00407b60
xor eax, eax
push ebp
push 0x588fdd
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x70bb34], 0
jne 0x588e70
mov ecx, dword [0x721700]
mov dl, 1
mov eax, dword [0x477528]
call fcn.0048180c
call fcn.00405354
lea eax, [ebp - 0x2c]
xor ecx, ecx
mov edx, 0x10
call fcn.00403b8c
mov eax, ebx
call fcn.004068c4
mov dword [ebp - 0x28], eax
push esi
mov esi, 0x588fec
lea edi, [ebp - 0x3c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
call fcn.00409294
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, ebx
test eax, eax
je 0x588eb7
sub eax, 4
mov eax, dword [eax]
shr eax, 1
test eax, eax
jle 0x588f83
mov dword [ebp - 0x1c], 0x20
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x5c]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x588f6f
lea eax, [ebp - 4]
lea edx, [ebp - 0x5c]
mov ecx, 0x10
call fcn.00406f90
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00406ff8
mov eax, dword [ebp - 4]
test eax, eax
je 0x588f12
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x588f12
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.00405d84
mov ebx, eax
test ebx, ebx
je 0x588f1d
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [ebp - 8]
test eax, eax
je 0x588f3a
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x588f3a
lea eax, [ebp - 8]
mov edx, dword [ebp - 8]
call fcn.00405d84
mov edi, eax
test edi, edi
je 0x588f45
sub edi, 4
mov edi, dword [edi]
push edi
mov eax, dword [ebp - 8]
call fcn.00406e0c
push eax
push ebx
mov eax, dword [ebp - 4]
call fcn.00406e0c
push eax
push 1
push 0x400
call sub.kernel32.dll_CompareStringW_1
sub eax, 2
test eax, eax
sete al
jmp 0x588f71
xor eax, eax
test al, al
je 0x588f7c
mov ebx, 0x15
jmp 0x588f88
mov ebx, 0x10
jmp 0x588f88
mov ebx, 0x15
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0x2c]
push eax
push ebx
push 0
push esi
call dword [0x70bb34]
call fcn.00588c2c
mov eax, dword [ebp - 0xc]
call fcn.00588c2c
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x10]
call fcn.004092ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x588fe4
lea eax, [ebp - 0x14]
mov edx, dword [0x435398]
call fcn.00407c38
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406d78
ret
Function at 0x58a0f8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x58a185
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x23]
xor ecx, ecx
mov edx, 0x1e
call fcn.00403b8c
xor eax, eax
mov dword [ebp - 0x23], eax
mov dword [ebp - 0x1f], 3
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.00482e1c
lea eax, [ebp - 0x28]
mov edx, 0x58a1a0
call fcn.004071a4
mov eax, dword [ebp - 0x28]
call fcn.00406e0c
mov dword [ebp - 0x1b], eax
mov eax, 0x58a1a4
mov dword [ebp - 0x17], eax
mov word [ebp - 0x13], 0x14
lea eax, [ebp - 0x23]
push eax
call sub.shell32.dll_SHFileOperationW
test eax, eax
sete byte [ebp - 5]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58a18c
lea eax, [ebp - 0x28]
call fcn.00406d70
ret

Function at 0x58a1ac
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call fcn.00406d68
xor eax, eax
push ebp
push 0x58a24d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0xc]
call fcn.0047a474
test al, al
je 0x58a237
mov edx, 0x40
mov eax, dword [ebp - 0xc]
call fcn.0047a334
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x58a237
xor eax, eax
push ebp
push 0x58a230
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetFileSize_1
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58a237
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58a254
lea eax, [ebp - 0xc]
call fcn.00406d70
ret
Function at 0x58a260
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406d68
mov eax, dword [ebp - 8]
call fcn.00406d68
mov eax, dword [ebp - 0xc]
call fcn.00406d68
xor eax, eax
push ebp
push 0x58a3d7
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp + 8], 0
je 0x58a2ad
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x58a2b4
mov dword [ebp - 0x10], 1
xor eax, eax
push ebp
push 0x58a358
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00406e0c
push eax
mov eax, dword [ebp - 8]
call fcn.00406e0c
push eax
mov eax, dword [ebp - 4]
call fcn.00406e0c
push eax
push 0x58a3e8
push 0
call sub.shell32.dll_ShellExecuteW
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x20
jg 0x58a34e
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00478ddc
mov edx, dword [ebp - 0x18]
mov eax, 0x58a400
call fcn.004078ac
test eax, eax
jg 0x58a32e
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.00478ddc
mov edx, dword [ebp - 0x1c]
mov eax, 0x58a41c
call fcn.004078ac
test eax, eax
jle 0x58a34e
mov eax, dword [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00406e0c
push eax
push 0x58a430
push 0x58a3e8
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x58a3af
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58a3de
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00406d78
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00406d78
ret

Function at 0x58d0fc
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0058e03c
mov eax, dword [ebp - 4]
mov dword [eax], 0x67452301
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0xefcdab89
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0x98badcfe
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0x10325476
pop ecx
pop ebp
ret