joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51cbd0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
movzx eax, byte [ebp + 8]
call fcn.0051c1e4
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00406a94
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
je 0x51cc2f
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x612f14]
mov dl, 1
mov eax, dword [0x51c05c]
call fcn.00478144
call fcn.00405214
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x51cc38
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff4
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
call fcn.0051c1e4
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor edx, edx
call fcn.00406a08
mov dword [ebp - 8], 0x800
xor eax, eax
push ebp
push 0x51ccbc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x100a]
push eax
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00406a94
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x51ccb2
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x100a]
mov ecx, 0x801
call fcn.00406c08
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x51ccd3
mov eax, dword [ebp - 4]
call fcn.0051c214
mov edx, dword [ebp + 0xc]
mov byte [edx], al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x51df94
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], ebx
test dl, dl
je 0x51dfad
add esp, 0xfffffff0
call fcn.00404860
mov dword [ebp - 4], ecx
mov byte [ebp - 9], dl
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004069f0
xor eax, eax
push ebp
push 0x51e131
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebx + 0x24], eax
mov byte [ebx + 0x21], 0
mov byte [ebx + 0x20], 0
mov dword [ebx + 0x1c], 0xffffffff
lea eax, [ebx + 0x18]
xor edx, edx
call fcn.00406a08
mov byte [ebx + 0x22], 0
xor ecx, ecx
xor edx, edx
mov eax, ebx
call fcn.00499660
lea eax, [ebx + 0xc]
sub eax, 4
mov eax, dword [eax]
mov dword [ebx + 0x14], eax
call fcn.0040437c
mov dl, 1
mov eax, dword [0x51ceac]
call fcn.0048d374
mov esi, eax
mov dword [ebx + 0x14], esi
lea eax, [ebx + 0xc]
sub eax, 4
mov dword [eax], esi
lea eax, [ebx + 0x10]
mov edx, dword [ebp - 4]
call fcn.00406a08
cmp dword [ebx + 0x10], 0
je 0x51e100
mov edx, dword [ebx + 0x10]
mov eax, ebx
call fcn.0051dca0
mov eax, dword [ebx + 0x10]
call fcn.004713d4
test al, al
jne 0x51e0f6
lea edx, [ebp - 4]
mov eax, dword [ebx + 0x10]
call fcn.0047192c
mov eax, dword [ebp - 4]
test eax, eax
je 0x51e078
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x51e078
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.00405c28
test eax, eax
je 0x51e081
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x51e08d
mov eax, dword [ebp - 4]
call fcn.0051ddd4
push 0
push 0x80
push 4
push 0
push 1
push 0xc0000000
mov eax, dword [ebx + 0x10]
call fcn.00406a94
push eax
call sub.kernel32.dll_CreateFileW_1
mov esi, eax
cmp esi, 0xffffffff
je 0x51e0f6
cmp dword [ebp + 8], 0
je 0x51e0f0
mov eax, dword [ebp + 8]
mov dword [ebx + 0xc], eax
lea edx, [ebp - 8]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 8]
call fcn.004082d0
test eax, eax
jle 0x51e0f0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.004082d0
push eax
mov eax, dword [ebp - 8]
push eax
push esi
call sub.kernel32.dll_WriteFile_1
push esi
call sub.kernel32.dll_CloseHandle_1
cmp dword [ebx + 0x24], 0
je 0x51e100
mov byte [ebx + 0x21], 1
mov eax, dword [ebx + 0x14]
mov dword [eax + 0x34], ebx
mov dword [eax + 0x30], 0x51def8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51e138
lea eax, [ebp - 8]
mov edx, dword [0x46e820]
call fcn.004085b8
lea eax, [ebp - 4]
call fcn.004069f8
ret
Function at 0x51e9dc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004069f0
xor eax, eax
push ebp
push 0x51eabc
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x51ea9e
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00408ffc
mov eax, dword [ebp - 8]
test eax, eax
je 0x51ea3d
mov edx, eax
sub edx, 0xa
cmp word [edx], 1
je 0x51ea3d
lea eax, [ebp - 8]
mov cx, 0xfde9
mov edx, dword [ebp - 8]
call fcn.00405c58
test eax, eax
je 0x51ea46
sub eax, 4
mov eax, dword [eax]
mov esi, eax
lea eax, [esi + 4]
mov dword [edi], eax
mov eax, dword [edi]
push eax
call fcn.00408ec0
pop ecx
mov dword [ebx], eax
mov ebx, dword [ebx]
mov eax, edi
mov edx, ebx
mov ecx, 4
call fcn.004032cc
add ebx, 4
lea eax, [ebp - 8]
call fcn.00406274
mov ecx, esi
mov edx, ebx
call fcn.004032cc
mov ecx, esi
dec ecx
test ecx, ecx
jl 0x51ea9e
inc ecx
xor esi, esi
mov eax, esi
mov edi, 0x16
cdq
idiv edi
movzx eax, byte [edx + 0x60b02c]
xor byte [ebx], al
inc ebx
inc esi
dec ecx
jne 0x51ea86
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51eac3
lea eax, [ebp - 8]
call fcn.00405a3c
lea eax, [ebp - 4]
call fcn.004069f8
ret
Function at 0x5203a8
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
xor ecx, ecx
mov edx, 0x40
call fcn.00403a4c
ret
Function at 0x521f48
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004069f0
xor eax, eax
push ebp
push 0x521fa2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.00521d78
mov eax, dword [ebp - 4]
call fcn.00406a94
push eax
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
mov eax, dword [ebp - 8]
call fcn.00521da8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x521fa9
lea eax, [ebp - 4]
call fcn.004069f8
ret

Function at 0x521fb0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004069f0
mov eax, dword [ebp - 8]
call fcn.004069f0
xor eax, eax
push ebp
push 0x522022
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.00521d78
push ebx
mov eax, dword [ebp - 8]
call fcn.00406a94
push eax
mov eax, dword [ebp - 4]
call fcn.00406a94
push eax
call sub.kernel32.dll_CopyFileW
mov ebx, eax
mov eax, dword [ebp - 0xc]
call fcn.00521da8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x522029
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406a00
ret

Function at 0x52209c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 4]
call fcn.00521d78
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push edi
push esi
push ebx
call sub.shell32.dll_ShellExecuteW
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00521da8
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc

Function at 0x522160
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, dword [ebp + 8]
mov eax, ebx
xor edx, edx
call fcn.00406a08
push 0
push edi
lea eax, [ebp - 0x20a]
push eax
push esi
call sub.shell32.dll_SHGetSpecialFolderPathW
mov eax, ebx
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.00406c08
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x5221a8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffe00
mov ebx, edx
push 0xff
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.00406c08
add esp, 0x200
pop ebx
ret

Function at 0x5221d8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffe00
mov ebx, edx
push esp
push 0xff
call sub.kernel32.dll_GetTempPathW
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.00406c08
add esp, 0x200
pop ebx
ret

Function at 0x522204
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffe00
mov ebx, edx
push 0xff
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.00406c08
add esp, 0x200
pop ebx
ret
Function at 0x522234
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
mov ebx, eax
mov eax, ebx
xor edx, edx
call fcn.00406a08
mov dword [ebp - 4], 0x104
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x20c]
push eax
call sub.advapi32.dll_GetUserNameW
test eax, eax
je 0x522271
mov eax, ebx
lea edx, [ebp - 0x20c]
call fcn.00406bb4
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x522278
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
xor edx, edx
mov dword [ebp - 0x20c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5222f4
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x208]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
test eax, eax
jbe 0x5222db
push ebx
lea eax, [ebp - 0x20c]
lea edx, [ebp - 0x208]
mov ecx, 0x104
call fcn.00406c08
mov eax, dword [ebp - 0x20c]
mov ecx, 2
mov edx, 1
call fcn.004071b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5222fb
lea eax, [ebp - 0x20c]
call fcn.004069f8
ret
Function at 0x522c9c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffddc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x220], edx
mov dword [ebp - 0x224], edx
mov dword [ebp - 0x21c], edx
mov dword [ebp - 0x218], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x522dff
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x522d1a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x23
lea eax, [ebp - 0x212]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetSpecialFolderPathW
mov eax, dword [ebp - 4]
add eax, 8
lea edx, [ebp - 0x212]
mov ecx, 0x105
call fcn.00406c08
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x522d45
xor eax, eax
push ebp
push 0x522d87
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x1a
lea eax, [ebp - 0x212]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetSpecialFolderPathW
mov eax, dword [ebp - 4]
add eax, 4
lea edx, [ebp - 0x212]
mov ecx, 0x105
call fcn.00406c08
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x522db2
lea edx, [ebp - 0x224]
xor eax, eax
call fcn.004034e8
mov eax, dword [ebp - 0x224]
lea edx, [ebp - 0x220]
call fcn.004718f0
mov edx, dword [ebp - 0x220]
mov eax, dword [ebp - 4]
add eax, 0xc
call fcn.00406a08
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x522e06
lea eax, [ebp - 0x224]
mov edx, 4
call fcn.00406a00
ret
Function at 0x524288
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x118], ecx
test dl, dl
je 0x5242a7
add esp, 0xfffffff0
call fcn.00404860
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x52434b
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000001
mov eax, esi
call fcn.00524400
mov dword [esi + 0x18], 0xf003f
mov byte [esi + 0xc], 1
xor eax, eax
mov dword [esi + 0x1c], eax
mov dword [ebp - 0x114], 0x114
lea eax, [ebp - 0x114]
push eax
call sub.kernel32.dll_GetVersionExW
cmp dword [ebp - 0x110], 5
jne 0x5242fd
call fcn.0051be98
test al, al
jne 0x52432b
cmp dword [ebp - 0x110], 5
ja 0x52432b
lea edx, [ebp - 0x118]
xor eax, eax
call fcn.0051a958
mov eax, dword [ebp - 0x118]
mov edx, 0x52437c
call fcn.00470308
test al, al
jne 0x52432b
xor eax, eax
jmp 0x52432d
mov al, 1
mov byte [0x61aa14], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x524352
lea eax, [ebp - 0x118]
call fcn.004069f8
ret

Function at 0x524904
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
movzx eax, byte [ebp + 8]
call fcn.00524230
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00406a94
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
je 0x524963
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x612f14]
mov dl, 1
mov eax, dword [0x524080]
call fcn.00478144
call fcn.00405214
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5249a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x524afb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
call fcn.00524230
mov dword [ebp - 0xc], eax
mov eax, esi
xor edx, edx
call fcn.00406a08
mov eax, dword [ebx + 0x1c]
test eax, eax
jne 0x5249f5
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
jmp 0x5249f8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
dec eax
sub al, 2
jae 0x524a07
add dword [ebp - 0x10], 2
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x52496c]
call fcn.00408498
add esp, 4
mov eax, dword [ebp - 4]
xor ecx, ecx
mov edx, dword [ebp - 0x10]
call fcn.00403a4c
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, edi
call fcn.00406a94
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
mov ebx, eax
test ebx, ebx
jne 0x524a5d
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00406bb4
mov edx, dword [esi]
mov eax, edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x524a70
sub eax, 4
mov eax, dword [eax]
cmp eax, 0x802
jle 0x524ac5
mov eax, edx
mov dword [ebp - 0x14], eax
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x524a88
sub esi, 4
mov esi, dword [esi]
push 0x524b18
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.00470c58
push dword [ebp - 0x1c]
push 0x524b58
lea edx, [ebp - 0x20]
mov eax, esi
call fcn.00470c58
push dword [ebp - 0x20]
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.00406fc0
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov dl, 1
call fcn.00524168
mov eax, dword [ebp - 0xc]
call fcn.00524260
mov edx, dword [ebp + 0xc]
mov byte [edx], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x524b02
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00406a00
lea eax, [ebp - 4]
mov edx, dword [0x52496c]
call fcn.004085b8
ret
Function at 0x526410
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbdc
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x418], eax
mov dword [ebp - 0x41c], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x526544
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x20c]
push eax
push 0x104
call sub.kernel32.dll_GetLogicalDriveStringsW
mov edi, eax
test edi, edi
je 0x52651e
lea ebx, [ebp - 0x20c]
xor esi, esi
cmp edi, esi
jb 0x52651e
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x41c]
mov edx, ebx
call fcn.00406bb4
mov eax, dword [ebp - 0x41c]
mov ecx, 2
mov edx, 1
call fcn.004071b4
mov edx, dword [ebp - 0x418]
lea eax, [ebp - 4]
call fcn.00406c84
push 0x104
lea eax, [ebp - 0x414]
push eax
mov eax, dword [ebp - 4]
call fcn.00406734
push eax
call sub.kernel32.dll_QueryDosDeviceW
mov edi, eax
test edi, edi
jbe 0x52650c
lea eax, [ebp - 0x420]
lea edx, [ebp - 0x414]
mov ecx, 0x104
call fcn.00406c08
mov eax, dword [ebp - 0x420]
push eax
lea eax, [ebp - 0x424]
mov edx, dword [ebp - 4]
call fcn.00406c70
mov edx, dword [ebp - 0x424]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
pop ecx
call fcn.0048c4ac
jmp 0x52650c
add ebx, 2
inc esi
cmp word [ebx], 0
jne 0x526508
add ebx, 2
inc esi
cmp edi, esi
jae 0x526472
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52654b
lea eax, [ebp - 0x424]
mov edx, 4
call fcn.00406a00
lea eax, [ebp - 4]
call fcn.00406568
ret
Function at 0x526634
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], ecx
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x420], ecx
mov dword [ebp - 0x424], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004069f0
xor eax, eax
push ebp
push 0x5267be
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00406a08
lea eax, [ebp - 0x214]
push eax
push 0x104
call sub.kernel32.dll_GetLogicalDriveStringsW
mov edi, eax
test edi, edi
je 0x526790
lea ebx, [ebp - 0x214]
xor esi, esi
cmp edi, esi
jb 0x526790
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x424]
mov edx, ebx
call fcn.00406bb4
mov eax, dword [ebp - 0x424]
mov ecx, 2
mov edx, 1
call fcn.004071b4
mov edx, dword [ebp - 0x420]
lea eax, [ebp - 8]
call fcn.00406c84
push 0x104
lea eax, [ebp - 0x41c]
push eax
mov eax, dword [ebp - 8]
call fcn.00406734
push eax
call sub.kernel32.dll_QueryDosDeviceW
mov edi, eax
test edi, edi
jbe 0x52677e
lea eax, [ebp - 0x428]
lea edx, [ebp - 0x41c]
mov ecx, 0x104
call fcn.00406c08
mov eax, dword [ebp - 0x428]
mov edx, dword [ebp - 4]
call fcn.00407524
dec eax
jne 0x52677e
movzx eax, byte [0x5267cc]
push eax
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x42c]
mov edx, dword [ebp - 8]
call fcn.00406c70
mov eax, dword [ebp - 0x42c]
push eax
lea eax, [ebp - 0x430]
lea edx, [ebp - 0x41c]
mov ecx, 0x104
call fcn.00406c08
mov edx, dword [ebp - 0x430]
mov eax, dword [ebp - 4]
pop ecx
call fcn.0047a0b0
jmp 0x526790
add ebx, 2
inc esi
cmp word [ebx], 0
jne 0x52677a
add ebx, 2
inc esi
cmp edi, esi
jae 0x5266b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5267c5
lea eax, [ebp - 0x430]
mov edx, 5
call fcn.00406a00
lea eax, [ebp - 8]
call fcn.00406568
lea eax, [ebp - 4]
call fcn.004069f8
ret

Function at 0x527020
Capabilities:
Acquire debug privileges

Disassembly:
push ebx
mov ebx, eax
mov eax, 0x527080
mov dl, 1
call fcn.005262f8
cmp byte [0x61aaae], 0
je 0x527043
mov eax, ebx
call fcn.005267d0
mov ebx, eax
jmp 0x52706d
cmp byte [0x61aaad], 0
je 0x527057
mov eax, ebx
call fcn.00526a3c
mov ebx, eax
jmp 0x52706d
cmp byte [0x61aaac], 0
je 0x52706b
mov eax, ebx
call fcn.00526d78
mov ebx, eax
jmp 0x52706d
xor ebx, ebx
mov eax, 0x527080
xor edx, edx
call fcn.005262f8
mov eax, ebx
pop ebx
ret
Function at 0x5270a4
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x428], ecx
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x5272cd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x5272dc
mov dl, 1
call fcn.005262f8
push esi
push 0
push 0x410
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x5272a0
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x527269
mov dword [ebp - 0xc], 0x208
mov edx, dword [ebp - 0xc]
add edx, edx
lea eax, [ebp - 0x424]
xor ecx, ecx
call fcn.00403a4c
cmp byte [0x61aaae], 0
je 0x5271a0
lea eax, [ebp - 0x424]
xor ecx, ecx
mov edx, 0x410
call fcn.00403a4c
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x10]
mov ecx, 4
mov eax, dword [ebp - 8]
call fcn.00526298
test eax, eax
je 0x527269
push 0x208
lea ecx, [ebp - 0x424]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.005262c8
test eax, eax
je 0x527269
lea eax, [ebp - 4]
lea edx, [ebp - 0x424]
mov ecx, 0x208
call fcn.00406c08
cmp dword [ebp - 4], 0
je 0x527269
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0052638c
jmp 0x527269
cmp byte [0x61aaad], 0
je 0x527219
cmp dword [0x60bc3c], 0
je 0x527269
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x424]
push eax
mov eax, dword [ebp - 8]
push eax
call dword [0x60bc3c]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x527269
lea eax, [ebp - 4]
lea edx, [ebp - 0x424]
mov ecx, 0x208
call fcn.00406c08
lea edx, [ebp - 0x428]
mov eax, dword [ebp - 4]
call fcn.00526634
mov edx, dword [ebp - 0x428]
lea eax, [ebp - 4]
call fcn.00406a5c
cmp dword [ebp - 4], 0
je 0x527269
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0052638c
jmp 0x527269
cmp byte [0x61aaac], 0
je 0x527269
cmp dword [0x60bc38], 0
je 0x527269
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x424]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
call dword [0x60bc38]
test eax, eax
je 0x527269
lea eax, [ebp - 0x42c]
lea edx, [ebp - 0x424]
mov ecx, 0x208
call fcn.00406c08
mov eax, dword [ebp - 0x42c]
mov edx, ebx
call fcn.0052638c
cmp dword [ebx], 0
jne 0x527277
mov edx, ebx
mov eax, esi
call fcn.00527300
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5272a7
cmp dword [ebp - 8], 0
je 0x527293
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, 0x5272dc
xor edx, edx
call fcn.005262f8
ret
Function at 0x539664
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
dec ecx
test ecx, ecx
jl 0x5396d3
inc ecx
xor ebx, ebx
mov eax, dword [ebp - 0x10]
and eax, 0xff
movzx edx, byte [esi + ebx]
xor eax, edx
mov edx, dword [eax*8 + 0x60c318]
mov eax, dword [eax*8 + 0x60c314]
push edx
push eax
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
shrd eax, edx, 8
shr edx, 8
xor eax, dword [esp]
xor edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
inc ebx
dec ecx
jne 0x539688
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x5396e4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
dec ecx
test ecx, ecx
jl 0x53970c
inc ecx
xor ebx, ebx
movzx esi, byte [edx + ebx]
xor esi, eax
and esi, 0xff
mov esi, dword [esi*4 + 0x60bf14]
shr eax, 8
xor esi, eax
mov eax, esi
inc ebx
dec ecx
jne 0x5396ee
pop esi
pop ebx
ret