joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4df4a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffffa0
xor edx, edx
mov dword [ebp - 0x1060], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4df645
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x100c]
xor ecx, ecx
mov edx, 0x1000
call fcn.0040345c
lea eax, [ebp - 0x105c]
xor ecx, ecx
mov edx, 0x50
call fcn.0040345c
mov dword [ebp - 8], 0x50
mov word [ebp - 0x105c], 0x2c
mov byte [ebp - 0x1058], 0
mov byte [ebp - 0x1059], 0
mov byte [ebp - 0x1057], 0
mov byte [ebp - 0x1056], 0xc
mov byte [ebp - 0x1054], 0
mov dword [ebp - 0x1050], 0xbf0
mov dword [ebp - 0x104c], 5
lea eax, [ebp - 0x100c]
mov dword [ebp - 0x1048], eax
mov dword [ebp - 0x1044], 0x30
mov byte [ebp - 0x1055], 0x20
mov byte [ebp - 0x1040], 0x1d
mov byte [ebp - 0x103f], 0
mov byte [ebp - 0x103e], 0
mov byte [ebp - 0x103d], 0xb
mov byte [ebp - 0x103c], 0xf0
mov byte [ebp - 0x100c], 0xe0
mov byte [ebp - 0x100a], 0xb
mov byte [ebp - 0x1009], 0xec
mov byte [ebp - 0x1008], 4
mov byte [ebp - 0x1006], 0x38
mov byte [ebp - 0x1004], 0xf3
mov byte [ebp - 0x1003], 9
mov byte [ebp - 0xff5], 1
mov byte [ebp - 0xfd4], 0xb0
mov byte [ebp - 0xfd3], 0xb
mov byte [ebp - 0xfcf], 1
mov byte [ebp - 0xfcc], 0xc
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x105c]
push eax
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x105c]
push eax
push 0x4d014
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.KERNEL32.DLL_DeviceIoControl
test eax, eax
je 0x4df605
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
call fcn.004df1ec
pop ecx
jmp 0x4df62c
call sub.KERNEL32.DLL_GetLastError
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1060]
call fcn.0040a3c4
mov ecx, dword [ebp - 0x1060]
mov eax, dword [ebp - 4]
mov edx, 0x4df658
call fcn.00405414
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4df64c
lea eax, [ebp - 0x1060]
call fcn.00405108
ret
Function at 0x4e3e70
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
xor edx, edx
mov dword [ebp - 0x14c], edx
mov dword [ebp - 0x150], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4e3fd2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00405108
lea eax, [ebp - 0x13e]
xor ecx, ecx
mov edx, 0x121
call fcn.0040345c
lea eax, [ebp - 0x1d]
xor ecx, ecx
mov edx, 0xd
call fcn.0040345c
push 0
lea eax, [ebp - 0x10]
push eax
push 0x121
lea eax, [ebp - 0x13e]
push eax
push 0xd
lea eax, [ebp - 0x1d]
push eax
push 0x2d1400
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.KERNEL32.DLL_DeviceIoControl
test eax, eax
je 0x4e3fa7
lea edx, [ebp - 0x148]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.0040a2d8
mov ecx, dword [ebp - 0x148]
lea eax, [ebp - 0x144]
mov edx, 0x4e3fe8
call fcn.00405414
mov eax, dword [ebp - 0x144]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x13e]
mov ecx, 0x14
mov edx, dword [ebp - 0x12a]
call fcn.00500a2c
push dword [ebp - 8]
push 0x4e3ffc
lea edx, [ebp - 0x150]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.0040a2d8
push dword [ebp - 0x150]
lea eax, [ebp - 0x14c]
mov edx, 3
call fcn.00405488
mov eax, dword [ebp - 0x14c]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x13e]
mov ecx, 0x14
mov edx, dword [ebp - 0x12a]
call fcn.00500b78
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
call fcn.0040515c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e3fd9
lea eax, [ebp - 0x150]
mov edx, 4
call fcn.0040512c
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0040512c
ret
Function at 0x4e748c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd28
push ebx
xor ebx, ebx
mov dword [ebp - 0x2d0], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4e76b6
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
cmp dword [ebp + 8], 0
je 0x4e74c7
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
jmp 0x4e7513
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
lea eax, [ebp - 0x2d0]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x2d8], eax
mov byte [ebp - 0x2d4], 0
lea edx, [ebp - 0x2d8]
xor ecx, ecx
mov eax, 0x4e76d0
call fcn.0040b8b4
mov eax, dword [ebp - 0x2d0]
call fcn.004055c8
push eax
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
je 0x4e769d
lea eax, [ebp - 0x2cc]
xor ecx, ecx
mov edx, 0x2b4
call fcn.0040345c
mov dword [ebp - 0x2cc], 0x1c
mov byte [ebp - 0x2c8], 0x3c
mov byte [ebp - 0x2c7], 0x33
mov byte [ebp - 0x2c6], 0x77
mov byte [ebp - 0x2c5], 0x61
mov byte [ebp - 0x2c4], 0x72
mov byte [ebp - 0x2c3], 0x65
mov byte [ebp - 0x2c2], 0x3e
mov byte [ebp - 0x2c1], 0
mov dword [ebp - 0x2c0], 0x23
mov dword [ebp - 0x2bc], 0xf000e000
xor eax, eax
mov dword [ebp - 0x2b8], eax
mov dword [ebp - 0x2b4], 0x298
mov byte [ebp - 0x234], 0x80
mov byte [ebp - 0x230], 0xb1
mov byte [ebp - 0x22f], 5
mov byte [ebp - 0x22e], 0xff
mov al, byte [ebp - 8]
and al, 0xff
mov byte [ebp - 0x22d], al
mov byte [ebp - 0x22c], 0
mov byte [ebp - 0x22b], 1
mov byte [ebp - 0x22a], 0xd
mov byte [ebp - 0x229], 0
mov byte [ebp - 0x228], 0xd0
mov byte [ebp - 0x227], 0
mov byte [ebp - 0x226], 1
mov byte [ebp - 0x225], 0
mov byte [ebp - 0x224], 0
mov byte [ebp - 0x223], 0
mov byte [ebp - 0x222], 0x4f
mov byte [ebp - 0x221], 0
mov byte [ebp - 0x220], 0xc2
mov byte [ebp - 0x21f], 0
mov byte [ebp - 0x21e], 0
mov byte [ebp - 0x21d], 0xb0
lea eax, [ebp - 0x218]
lea edx, [ebp - 0x21c]
mov dword [edx], eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0x2b4
lea eax, [ebp - 0x2cc]
push eax
push 0x2b4
lea eax, [ebp - 0x2cc]
push eax
push 0x4d008
mov eax, dword [ebp - 0x18]
push eax
call sub.KERNEL32.DLL_DeviceIoControl
test eax, eax
je 0x4e768e
lea eax, [ebp - 0x2b0]
cmp dword [eax], 0
jne 0x4e768e
mov byte [ebp - 0xd], 1
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x218]
mov ecx, 0x200
call fcn.00402a8c
cmp dword [ebp + 8], 0
jne 0x4e769d
mov eax, dword [ebp - 0x18]
push eax
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e76bd
lea eax, [ebp - 0x2d0]
call fcn.00405108
ret
Function at 0x50135c
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc98
push ebx
xor ebx, ebx
mov dword [ebp - 0x360], ebx
mov dword [ebp - 0x364], ebx
mov dword [ebp - 0x368], ebx
mov dword [ebp - 0x358], ebx
mov dword [ebp - 0x35c], ebx
mov dword [ebp - 0x354], ebx
mov dword [ebp - 0x350], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x501597
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.00405108
mov eax, dword [ebp + 0xc]
call fcn.00405108
mov eax, dword [ebp + 8]
call fcn.00405108
mov dword [ebp - 0x10], 0xffffffff
cmp dword [ebp - 4], 0xffffffff
je 0x501571
lea eax, [ebp - 0x146]
xor ecx, ecx
mov edx, 0x121
call fcn.0040345c
lea eax, [ebp - 0x25]
xor ecx, ecx
mov edx, 0xd
call fcn.0040345c
lea eax, [ebp - 0x34a]
xor ecx, ecx
mov edx, 0x204
call fcn.0040345c
push 0
lea eax, [ebp - 0x18]
push eax
push 0x121
lea eax, [ebp - 0x146]
push eax
push 0xd
lea eax, [ebp - 0x25]
push eax
push 0x2d1400
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_DeviceIoControl
test eax, eax
je 0x501569
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x146]
mov ecx, 8
mov edx, dword [ebp - 0x13a]
call fcn.00500a2c
push 0x5015b0
lea eax, [ebp - 0x350]
push eax
lea eax, [ebp - 0x146]
mov ecx, 0x28
mov edx, dword [ebp - 0x136]
call fcn.00500a2c
mov edx, dword [ebp - 0x350]
lea eax, [ebp - 0x14]
call fcn.004053d0
lea edx, [ebp - 0x354]
mov eax, dword [ebp - 0x14]
call fcn.00409de4
mov edx, dword [ebp - 0x354]
lea eax, [ebp - 0x14]
call fcn.004051a0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
call fcn.0040515c
lea edx, [ebp - 0x35c]
mov eax, dword [ebp - 8]
call fcn.0040a2d8
mov ecx, dword [ebp - 0x35c]
lea eax, [ebp - 0x358]
mov edx, 0x5015c4
call fcn.00405414
mov eax, dword [ebp - 0x358]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x146]
mov ecx, 0x14
mov edx, dword [ebp - 0x132]
call fcn.00500a2c
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x14]
call fcn.0040515c
push dword [ebp - 0x14]
push 0x5015d8
lea edx, [ebp - 0x368]
mov eax, dword [ebp - 8]
call fcn.0040a2d8
push dword [ebp - 0x368]
lea eax, [ebp - 0x364]
mov edx, 3
call fcn.00405488
mov eax, dword [ebp - 0x364]
push eax
lea eax, [ebp - 0x360]
push eax
lea eax, [ebp - 0x146]
mov ecx, 0x14
mov edx, dword [ebp - 0x132]
call fcn.00500b78
mov edx, dword [ebp - 0x360]
lea eax, [ebp - 0x14]
call fcn.004051a0
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x14]
call fcn.0040515c
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x501571
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50159e
lea eax, [ebp - 0x368]
mov edx, 7
call fcn.0040512c
lea eax, [ebp - 0x14]
call fcn.00405108
ret
Function at 0x525d98
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec4
mov dword [ebp - 4], eax
mov eax, 0x525e24
call fcn.0049839c
mov dword [ebp - 8], 0xffffffff
cmp byte [0x614154], 0
je 0x525e12
lea eax, [ebp - 0x13a]
xor ecx, ecx
mov edx, 0x121
call fcn.0040345c
lea eax, [ebp - 0x19]
xor ecx, ecx
mov edx, 0xd
call fcn.0040345c
push 0
lea eax, [ebp - 0xc]
push eax
push 0x121
lea eax, [ebp - 0x13a]
push eax
push 0xd
lea eax, [ebp - 0x19]
push eax
push 0x2d1400
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_DeviceIoControl
test eax, eax
je 0x525e12
mov eax, dword [ebp - 0x11e]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x527a0c
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffcac
xor edx, edx
mov dword [ebp - 0x350], edx
mov dword [ebp - 0x354], edx
mov dword [ebp - 0x34c], edx
mov dword [ebp - 0x348], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x527b76
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea eax, [ebp - 0x13e]
xor ecx, ecx
mov edx, 0x121
call fcn.0040345c
lea eax, [ebp - 0x1d]
xor ecx, ecx
mov edx, 0xd
call fcn.0040345c
lea eax, [ebp - 0x342]
xor ecx, ecx
mov edx, 0x204
call fcn.0040345c
push 0
lea eax, [ebp - 0xc]
push eax
push 0x121
lea eax, [ebp - 0x13e]
push eax
push 0xd
lea eax, [ebp - 0x1d]
push eax
push 0x2d1400
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_DeviceIoControl
test eax, eax
je 0x527b50
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x13e]
mov ecx, 8
mov edx, dword [ebp - 0x132]
call fcn.00500a2c
push 0x527b8c
lea eax, [ebp - 0x348]
push eax
lea eax, [ebp - 0x13e]
mov ecx, 0x28
mov edx, dword [ebp - 0x12e]
call fcn.00500a2c
mov edx, dword [ebp - 0x348]
lea eax, [ebp - 0x10]
call fcn.004053d0
lea edx, [ebp - 0x34c]
mov eax, dword [ebp - 0x10]
call fcn.00409de4
mov edx, dword [ebp - 0x34c]
lea eax, [ebp - 0x10]
call fcn.004051a0
lea eax, [ebp - 0x354]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.00405628
mov eax, dword [ebp - 0x354]
lea edx, [ebp - 0x350]
call fcn.00409b94
mov eax, dword [ebp - 0x350]
mov edx, 0x527ba0
call fcn.00405514
jne 0x527b50
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x527b7d
lea eax, [ebp - 0x354]
mov edx, 4
call fcn.0040512c
lea eax, [ebp - 0x10]
call fcn.00405108
ret
Function at 0x5305a8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd54
push ebx
xor ebx, ebx
mov dword [ebp - 0x2ac], ebx
mov dword [ebp - 0x2a8], ebx
mov dword [ebp - 0x2a4], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
call fcn.004055b8
lea eax, [ebp - 0x178]
mov edx, dword [0x408dd0]
call fcn.00405c30
xor eax, eax
push ebp
push 0x53079d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00405108
lea ecx, [ebp - 0x2a4]
mov edx, 0x5307b4
mov eax, dword [ebp - 4]
call fcn.0048cc9c
mov eax, dword [ebp - 0x2a4]
lea ecx, [ebp - 0x178]
mov edx, 0x3f
call fcn.0040aa44
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x53068a
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0x16c]
call fcn.005304cc
cmp dword [ebp - 0x10], 0
je 0x530676
push 0x2c
mov eax, dword [ebp - 8]
mov eax, dword [eax]
xor ecx, ecx
mov edx, dword [ebp - 0x10]
call fcn.0048c464
test eax, eax
jne 0x530676
mov eax, dword [ebp - 8]
push dword [eax]
push dword [ebp - 0x10]
push 0x5307c4
mov eax, dword [ebp - 8]
mov edx, 3
call fcn.00405488
lea eax, [ebp - 0x178]
call fcn.0040aa94
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x530633
lea eax, [ebp - 0x178]
call fcn.0040aab8
push 0x20
lea eax, [ebp - 0x29e]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x105
lea eax, [ebp - 0x27d]
push eax
lea eax, [ebp - 0x2a8]
mov ecx, 0x5307d0
mov edx, dword [ebp - 4]
call fcn.00405414
mov eax, dword [ebp - 0x2a8]
call fcn.004055c8
push eax
call sub.KERNEL32.DLL_GetVolumeInformationA
test eax, eax
je 0x530737
lea eax, [ebp - 0x2ac]
lea edx, [ebp - 0x27d]
mov ecx, 0x105
call fcn.00405378
mov eax, dword [ebp - 0x2ac]
lea edx, [ebp - 0x10]
call fcn.005304cc
cmp dword [ebp - 0x10], 0
je 0x530737
push 0x2c
mov eax, dword [ebp - 8]
mov eax, dword [eax]
xor ecx, ecx
mov edx, dword [ebp - 0x10]
call fcn.0048c464
test eax, eax
jne 0x530737
mov eax, dword [ebp - 8]
push dword [eax]
push dword [ebp - 0x10]
push 0x5307c4
mov eax, dword [ebp - 8]
mov edx, 3
call fcn.00405488
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.004053c8
test eax, eax
jle 0x53075e
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.004053c8
mov edx, eax
mov eax, dword [ebp - 8]
mov ecx, 1
call fcn.00405668
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5307a4
lea eax, [ebp - 0x2ac]
mov edx, 3
call fcn.0040512c
lea eax, [ebp - 0x178]
mov edx, dword [0x408dd0]
call fcn.00405d00
lea eax, [ebp - 0x10]
call fcn.00405108
lea eax, [ebp - 4]
call fcn.00405108
ret
Function at 0x5310f4
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004055b8
mov eax, dword [ebp - 8]
call fcn.004055b8
xor eax, eax
push ebp
push 0x531231
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x44]
mov byte [ebp - 0xd], 0
call fcn.0048dd5c
test al, al
je 0x531216
push 0x531244
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [ebp - 0x18], eax
push 0x531254
mov eax, dword [ebp - 0x18]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0xbc5edc], eax
push 0x53126c
mov eax, dword [ebp - 0x18]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0xbc5ee0], eax
push 0x53128c
mov eax, dword [ebp - 0x18]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0xbc5ee4], eax
push 0x5312a4
mov eax, dword [ebp - 0x18]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0xbc5ee8], eax
push 0x5312c4
mov eax, dword [ebp - 0x18]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0xbc5eec], eax
push 0x5312dc
mov eax, dword [ebp - 0x18]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0xbc5ef0], eax
cmp dword [0xbc5edc], 0
je 0x53120d
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x5311fb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
mov edx, 2
mov eax, dword [ebp - 4]
call fcn.00530dcc
mov dword [ebp - 0x14], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x531205
cmp dword [ebp - 0x14], 0
setg byte [ebp - 0xd]
mov eax, dword [ebp - 0x18]
push eax
call sub.KERNEL32.DLL_FreeLibrary
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x531238
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040512c
ret

Function at 0x551078
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov esi, dword [ebp + 0xc]
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, ecx
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x55134e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x2c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x20]
mov dword [ebp - 0x20], eax
cmp dword [ebp + 8], 0
je 0x551176
lea eax, [ebp - 0x24]
call fcn.00406ff4
push eax
push 0x615b6c
push 1
push 0
push 0x615b7c
call sub.ole32.dll_CoCreateInstance
call fcn.0041a240
test al, al
je 0x551176
mov eax, dword [ebp - 4]
or byte [eax + 0x30], 8
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x1c]
Function at 0x551108
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4b8
push ebx
push esi
push edi
push ecx
call fcn.00551121
add byte [ecx*2 + 0x4a3f3744], bh
Function at 0x551584
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add byte [ebx], bh
inc ecx
dec edx
dec esp
xor al, 0x40
dec esp
inc ecx
xor al, byte [ebx - 0x74a6fb3c]
lea ebx, [eax]
invalid

Function at 0x55158f
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add byte [ebx], bh
inc ecx
dec edx
dec esp
xor al, 0x40
dec esp
inc ecx
xor al, byte [ebx - 0x74a6fb3c]
lea ebx, [eax]
invalid

Function at 0x55164c
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
les eax, [ecx + eax*4]
enter 0x1e75, 0
add byte [eax + 0x56], bl
push ebx
add esp, 4
add esi, 0x11d8b
pop esi
movzx eax, word [ebp - 0x54]
movzx ecx, word [ebp - 8]
cmp eax, ecx
jge 0x551679
mov dword [ebp - 0x36c], 0xffffffff
jmp 0x551683
mov dword [ebp - 0x36c], 1
mov edx, dword [ebp - 0x36c]
mov dword [ebp - 0x370], edx
cmp dword [ebp - 0x370], 0
jne 0x5516d8
push edi
push esi
add esp, 4
jmp 0x5516a5
jmp 0x5516ab
jmp 0x5516b1
pop edi
push ebx
push ecx
add esp, 4
add ebx, 0x15274
or ebx, 0x99ac
and ebx, 0xf749
pop ebx
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x6c], eax
jmp 0x55176f
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ecx]
mov dword [ebp - 0xc4], edx
push edi
xor edi, 0xfe7e
call fcn.005516fc
add byte [esi], bh
dec ecx
dec esp
cmp al, byte [ebp + 0x50]
xor al, 0x3d
xor eax, dword [ebx - 0x307efb3c]
add esp, 4
or edi, 0x9b29
pop edi
push esi

Function at 0x5516fc
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or edi, 0x9b29
pop edi
push esi
push eax
add esp, 4
and esi, 0x1f7e
xor esi, 0x66c1
pop esi
mov eax, dword [ebp - 0xc4]
cmp eax, dword [ebp - 0x1ec]
je 0x551736
mov ecx, dword [ebp - 0xc4]
cmp dword [ecx + 0x30], 0
jne 0x55147a
push ecx
jmp 0x55173d
sub ecx, 0x286f
pop ecx
push ecx
push ebx
add esp, 4
xor ecx, 0x3db6
add ecx, 0x1722b
jmp 0x55175b
pop ecx
push ecx
push ebx
add esp, 4
xor ecx, 0xccef
pop ecx
mov dword [ebp - 0x6c], 0
Function at 0x552fc4
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
je 0x5558f1
push ecx
or ecx, 0xe820
add ecx, 0x130fe
xor ecx, 0x10be8
sub ecx, 0x103cf
pop ecx
push eax
push edx
add esp, 4
sub eax, 0x2d1f
and eax, 0x91bc
sub eax, 0x8ff3
pop eax
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x210], eax
push esi
sub esi, 0x10e78
call 0x552fc4
add byte [esi], bh
inc ecx
xor eax, 0x833e3b4f
les eax, [ecx + eax*4]
invalid
jmp fcn.00555900

Function at 0x553010
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x55301c
pop eax
jmp fcn.00555900

Function at 0x553030
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add esp, 4
and ebx, 0x12225
xor ebx, 0x9eba
xor ebx, 0x5cdf
pop ebx
push edx
and edx, 0xfd0b
or edx, 0x12702
pop edx
mov ecx, dword [ebp - 0x210]
mov edx, dword [ebp - 0x210]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x2d0], edx
jne 0x5530a2
push edx
push esi
add esp, 4
and edx, 0x173d5
and edx, 0x91ab
sub edx, 0xa00d
and edx, 0x15729
pop edx
push edx
or edx, 0x760
xor edx, 0xdf83
sub edx, 0x15ab0
pop edx
jmp fcn.00555900
mov eax, dword [ebp - 0x2d0]
mov ecx, dword [eax + 0x50]
mov dword [ebp - 0x3f0], ecx
push eax
and eax, 0x8cd5
add eax, 0xbe3a
call 0x5530cb
add byte [ebx + 0x44], cl
dec ecx
cmp byte [edx + ecx*2 + 0x3e], cl
add esp, 4
pop eax
push ebx
sub ebx, 0x59d6
xor ebx, 0x16190
or ebx, 0x4ff5
pop ebx
mov edx, dword [ebp - 0x1b0]
mov dword [ebp - 0x218], edx
push esi
sub esi, 0xf3cb
add esi, 0x1099f
pop esi
push edx
push ebx
add esp, 4
and edx, 0x1640a
pop edx
push edi
push eax
add esp, 4
or edi, 0x5a4e
xor edi, 0x16aa9
xor edi, 0x5493
pop edi
mov eax, dword [ebp - 0x218]
add eax, dword [ebp - 0x3f0]
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x218], 0
je 0x5558f1
cmp dword [ebp - 0x22c], 0
je 0x5558f1
push esi
call 0x55315c
add byte [ebx + 0x32], al
dec edi
xor al, 0x32
dec esp
dec ebx
add esp, 4
call 0x55316d
add byte [ebx], dh
aaa
dec esp
xor ecx, dword [edx + 0x43]
cmp al, 0x44
add esp, 4
or esi, 0xf1ac
pop esi
push esi
and esi, 0xcfb6
pop esi
mov byte [ebp - 0x285], 7
mov byte [ebp - 1], 2
jmp 0x553195