joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47576c
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x47577e
add esp, 0xfffffff0
call fcn.00404b6c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004236ec
mov eax, dword [0x596d64]
mov dword [eax + 4], ebx
mov dword [eax], 0x475b10
mov eax, dword [0x596d7c]
mov dword [eax + 4], ebx
mov dword [eax], 0x475b1c
mov eax, ebx
call fcn.00475b28
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x419aa0]
call fcn.00404818
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x419aa0]
call fcn.00404818
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x419aa0]
call fcn.00404818
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x419aa0]
call fcn.00404818
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x419aa0]
call fcn.00404818
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x4715a4
push eax
push 0
push 0
mov eax, dword [0x5970dc]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x4289a0]
call fcn.0042a294
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x4289a0]
call fcn.0042a294
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x4289a0]
call fcn.0042a294
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.00475fa0
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x475e70
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x475e70
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x475e70
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4758bb
call fcn.00404bc4
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x475c54
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x475dff
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x475de0
mov dl, 1
mov eax, dword [0x41a10c]
call fcn.00404818
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00405748
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x475dcf
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.004672c4
test al, al
je 0x475dc2
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x475e10
lea eax, [ebp - 0x254]
call fcn.0040be28
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x475dc2
xor eax, eax
push ebp
push 0x475dbb
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x475e48
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x475da4
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004059c8
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x475da4
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004059c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x475dc2
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x475cc5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x25], 0
mov dl, 1
call fcn.0041ed10
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x475e06
lea eax, [ebp - 0x260]
call fcn.00405748
ret

Function at 0x476778
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x59b5bc]
cmp byte [eax + 0xad], 0
jne 0x4767e9
cmp dword [0x59b5d4], 0
jne 0x4767aa
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x476734
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x59b5d4], eax
cmp dword [0x59b5d0], 0
jne 0x4767c5
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x59b5d0], eax
cmp dword [0x59b5d8], 0
jne 0x4767e9
push esp
push 0
push 0
push 0x4766d8
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x59b5d8], eax
pop edx
ret
Function at 0x4769ec
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x476a03
add esp, 0xfffffff0
call fcn.00404b6c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004236ec
mov eax, dword [0x5970ac]
cmp word [eax + 2], 0
jne 0x476a2b
mov eax, dword [0x5970ac]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00478544
mov eax, dword [0x597298]
cmp word [eax + 2], 0
jne 0x476a45
mov eax, dword [0x597298]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00478750
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x419aa0]
call fcn.00404818
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x419aa0]
call fcn.00404818
mov dword [ebx + 0x98], eax
mov dl, 1
mov eax, dword [0x419aa0]
call fcn.00404818
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x429550]
call fcn.00431aa0
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x476bfc
mov eax, dword [0x596e70]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00431e74
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x478e20
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x596e70]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040fd94
test eax, eax
je 0x476b4c
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.0040b404
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040fdc8
test eax, eax
je 0x476b60
mov byte [eax], 0
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_CharNextA_1
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004059c8
mov byte [ebx + 0xd4], 0
push ebx
push 0x47808c
call fcn.00424868
mov dword [ebx + 0xc8], eax
mov eax, dword [0x596b1c]
cmp byte [eax], 0
jne 0x476bb1
mov eax, ebx
call fcn.00476d40
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.00478ffc
mov eax, ebx
call fcn.00479b5c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x476bf1
call fcn.00404bc4
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x476fc0
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x59b5bc]
cmp dword [eax + 0x30], 0
je 0x47706a
cmp dword [ebx + 0x94], 0
jne 0x477064
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x476f50
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x477064
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x47702a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x477064
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041c19c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x477039
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x477d84
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x477db9
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00405838
jmp 0x477dc6
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0040579c
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4791e0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x47924e
mov eax, esi
call fcn.00461ef8
test al, al
je 0x47924e
mov eax, dword [ebx + 0x84]
call fcn.00461b58
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x47924e
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x479242
push 0
mov eax, dword [ebx + 0x84]
call fcn.00461b58
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00459f08
jmp 0x47924e
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.0047901c
pop esi
pop ebx
ret
Function at 0x48dbbc
Capabilities:
Link many functions at runtime

Disassembly:
mov byte [0x58df54], 0
mov eax, dword [0x597610]
cmp dword [eax], 2
jne 0x48dd95
mov eax, dword [0x596e7c]
cmp dword [eax], 5
jl 0x48dd95
call fcn.004857d8
test al, al
jne 0x48dbed
call fcn.004857e4
call fcn.004857d0
mov dword [0x58df5c], eax
push 0x48dd98
mov eax, dword [0x58df5c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x58df20], eax
cmp dword [0x58df20], 0
jne 0x48dc48
mov edx, 0x8000
mov eax, 0x48ddac
call fcn.00410c8c
mov dword [0x58df58], eax
mov eax, dword [0x58df58]
mov dword [0x58df5c], eax
push 0x48dd98
mov eax, dword [0x58df5c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x58df20], eax
cmp dword [0x58df20], 0
je 0x48dd90
push 0x48ddb8
mov eax, dword [0x58df5c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x58df24], eax
cmp dword [0x58df24], 0
je 0x48dd90
push 0x48ddc4
mov eax, dword [0x58df5c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x58df28], eax
cmp dword [0x58df28], 0
je 0x48dd90
mov byte [0x58df54], 1
push 0x48ddd4
mov eax, dword [0x58df5c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x58df2c], eax
push 0x48dde0
mov eax, dword [0x58df5c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x58df30], eax
push 0x48ddec
mov eax, dword [0x58df5c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x58df34], eax
push 0x48ddfc
mov eax, dword [0x58df5c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x58df38], eax
push 0x48de0c
mov eax, dword [0x58df5c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x58df3c], eax
mov edx, 0x8000
mov eax, 0x48de24
call fcn.00410c8c
mov dword [0x58df60], eax
cmp dword [0x58df60], 0
je 0x48dd95
push 0x48de34
mov eax, dword [0x58df60]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x58df40], eax
push 0x48de50
mov eax, dword [0x58df60]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x58df44], eax
push 0x48de70
mov eax, dword [0x58df60]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x58df48], eax
push 0x48de8c
mov eax, dword [0x58df60]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x58df4c], eax
push 0x48dea4
mov eax, dword [0x58df60]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x58df50], eax
ret
call fcn.0048db3c
ret

Function at 0x4abc58
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
mov eax, 8
test byte [edx + 1], 0x80
setne bl
movzx edi, word [edx]
add edi, edi
movzx esi, cl
mov ebp, esi
shr ebp, 7
or edi, ebp
cmp edi, 0xffff
jbe 0x4abc84
call fcn.00404710
mov word [edx], di
test bl, bl
je 0x4abc90
xor word [edx], 0x1021
add esi, esi
and esi, 0xff
cmp esi, 0xff
jbe 0x4abca5
call fcn.00404710
mov ecx, esi
dec eax
jne 0x4abc61
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4e43a0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x408ad4]
call fcn.0040629c
xor eax, eax
push ebp
push 0x4e4541
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x59127c], 0
jne 0x4e43fb
mov ecx, dword [0x596b50]
mov dl, 1
mov eax, dword [0x40913c]
call fcn.0040eec8
call fcn.004050bc
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x10
call fcn.004039a0
mov eax, ebx
call fcn.004060ec
mov dword [ebp - 0x24], eax
mov esi, 0x4e4550
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x38]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.004073f8
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
call fcn.004060fc
test eax, eax
jle 0x4e44e4
mov dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4e44d0
lea eax, [ebp - 0x4c]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.004059c8
mov edi, dword [ebp - 0x4c]
test edi, edi
je 0x4e4476
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x50]
mov edx, ebx
call fcn.004059e0
mov esi, dword [ebp - 0x50]
test esi, esi
je 0x4e448c
sub esi, 4
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x54]
mov edx, ebx
call fcn.004059e0
mov eax, dword [ebp - 0x54]
call fcn.00405c1c
push eax
push edi
lea eax, [ebp - 0x58]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.004059c8
mov eax, dword [ebp - 0x58]
call fcn.00405c1c
push eax
push 1
push 0x400
call sub.kernel32.dll_CompareStringA_1
sub eax, 2
test eax, eax
sete al
jmp 0x4e44d2
xor eax, eax
test al, al
je 0x4e44dd
mov ebx, 0x15
jmp 0x4e44e9
mov ebx, 0x10
jmp 0x4e44e9
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x28]
push eax
push ebx
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [0x59127c]
call fcn.004e4224
mov eax, dword [ebp - 4]
call fcn.004e4224
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.00407410
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e4548
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.0040576c
lea eax, [ebp - 0xc]
mov edx, dword [0x408ad4]
call fcn.0040636c
ret

Function at 0x4fa1e0
Capabilities:
Set global application hook

Disassembly:
cmp dword [0x59c5d4], 0
jne 0x4fa203
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x4fa154
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x59c5d4], eax
ret
Function at 0x4fe148
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4fe176
mov eax, ebx
call fcn.004febfc
cmp dword [ebx + 0x40], 0
je 0x4fe16f
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4fe1e7
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4fe1d9
cmp dword [ebx + 8], 0
je 0x4fe198
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4fe1aa
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4fe1d9
cmp dword [ebx + 8], 0
je 0x4fe18b
cmp eax, 3
je 0x4fe1bd
dec eax
jne 0x4fe18b
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4fe18b
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4fe18b
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4fe205
cmp dword [ebx + 0x14], 0xcc
je 0x4fe205
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004fe210
pop ebx
ret
Function at 0x510128
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x23c], edx
mov dword [ebp - 0x240], edx
mov dword [ebp - 4], eax
lea esi, [ebp - 0x238]
xor eax, eax
push ebp
push 0x5102f0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 9], 0
mov eax, dword [ebp - 4]
add eax, 0xa
call fcn.00405748
mov eax, dword [ebp - 4]
add eax, 0xe
call fcn.00405748
mov eax, dword [ebp - 4]
add eax, 0x12
call fcn.00405748
mov eax, dword [ebp - 4]
add eax, 0x16
call fcn.00405748
xor edx, edx
push ebp
push 0x5102cb
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
push 3
push 0
push 3
push 0
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 4]
call fcn.005100d8
mov edx, eax
lea eax, [ebp - 0x240]
call fcn.00405930
mov ecx, dword [ebp - 0x240]
lea eax, [ebp - 0x23c]
mov edx, 0x510308
call fcn.00405a68
mov eax, dword [ebp - 0x23c]
call fcn.00405c1c
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 5], ebx
cmp ebx, 0xffffffff
jne 0x5101fc
call fcn.00405168
jmp 0x5102d2
lea eax, [ebp - 0x14]
xor ecx, ecx
mov edx, 0xc
call fcn.004039a0
mov eax, esi
xor ecx, ecx
mov edx, 0x224
call fcn.004039a0
mov eax, 0x224
mov dword [esi + 4], eax
push 0
lea edx, [ebp - 8]
push edx
push eax
push esi
push 0xc
lea eax, [ebp - 0x14]
push eax
push 0x2d1400
mov eax, dword [ebp - 4]
mov eax, dword [eax + 5]
push eax
call sub.kernel32.dll_DeviceIoControl
test eax, eax
jne 0x510249
call fcn.00410630
mov eax, dword [esi + 0xc]
test eax, eax
je 0x510260
lea ebx, [esi + eax]
mov eax, dword [ebp - 4]
add eax, 0x16
mov edx, ebx
call fcn.00405950
mov eax, dword [esi + 0x10]
test eax, eax
je 0x510277
lea ebx, [esi + eax]
mov eax, dword [ebp - 4]
add eax, 0xe
mov edx, ebx
call fcn.00405950
mov eax, dword [esi + 0x14]
test eax, eax
je 0x51028e
lea ebx, [esi + eax]
mov eax, dword [ebp - 4]
add eax, 0xa
mov edx, ebx
call fcn.00405950
mov eax, dword [esi + 0x18]
test eax, eax
je 0x5102a5
lea ebx, [esi + eax]
mov eax, dword [ebp - 4]
add eax, 0x12
mov edx, ebx
call fcn.00405950
mov eax, dword [ebp - 4]
mov byte [eax + 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5102d2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 5]
cmp eax, 0xffffffff
je 0x5102ca
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5102f7
lea eax, [ebp - 0x240]
mov edx, 2
call fcn.0040576c
ret

Function at 0x5114bc
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
mov dword [esp], pe_nt_image_headers32
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x5114ed
mov eax, ebx
lea edx, [esp + 4]
mov ecx, pe_nt_image_headers32
call fcn.004059c8
jmp 0x5114f4
mov eax, ebx
call fcn.00405748
add esp, 0x104
pop ebx
ret
Function at 0x5114fc
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x511576
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xff
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00405ea4
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00405c1c
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x511554
push ebx
mov ecx, dword [ebp - 8]
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00405c7c
jmp 0x511560
mov eax, ebx
mov edx, 0x51158c
call fcn.0040579c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51157d
lea eax, [ebp - 4]
call fcn.00405748
ret

Function at 0x51213c
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405c0c
mov eax, dword [ebp - 8]
call fcn.00405c0c
xor eax, eax
push ebp
push 0x512257
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp - 9], 0
je 0x5121a3
xor ecx, ecx
mov dl, 1
mov eax, dword [0x510328]
call fcn.0046f63c
mov edx, dword [0x596c98]
mov dword [edx], eax
mov eax, dword [0x596c98]
mov eax, dword [eax]
call fcn.004747e8
mov dl, 1
mov eax, dword [0x51059c]
call fcn.00404818
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
call fcn.00405c1c
mov ebx, eax
push ebx
call sub.wininet.dll_DeleteUrlCacheEntry
xor eax, eax
push ebp
push 0x512214
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp - 9], 0
je 0x5121ee
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x5121d1
sub eax, 0xfffffffc
push eax
push 1
mov eax, dword [ebp - 8]
call fcn.00405c1c
push eax
push ebx
push 0
call sub.URLMON.DLL_URLDownloadToFileA
test eax, eax
sete al
mov ebx, eax
jmp 0x51220a
push 0
push 1
mov eax, dword [ebp - 8]
call fcn.00405c1c
push eax
push ebx
push 0
call sub.URLMON.DLL_URLDownloadToFileA
test eax, eax
sete al
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x512220
cmp byte [ebp - 9], 0
je 0x51223c
mov eax, dword [0x596c98]
mov eax, dword [eax]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx - 4]
mov eax, dword [ebp - 0x10]
call fcn.00404848
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51225e
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040576c
ret
Function at 0x5122b8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe90
xor edx, edx
mov dword [ebp - 0x170], edx
mov dword [ebp - 0x16c], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405c0c
lea eax, [ebp - 0x168]
mov edx, dword [0x40911c]
call fcn.0040629c
xor eax, eax
push ebp
push 0x5123f2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x16c]
mov ecx, 0x512408
mov edx, dword [ebp - 4]
call fcn.00405a68
mov eax, dword [ebp - 0x16c]
lea ecx, [ebp - 0x168]
mov edx, 0x3f
call fcn.0040aea8
test eax, eax
jne 0x51235a
test byte [ebp - 0x158], 0x10
jne 0x512340
mov eax, dword [ebp - 0x154]
call fcn.00405c1c
push eax
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x168]
call fcn.0040aef8
test eax, eax
je 0x512326
lea eax, [ebp - 0x168]
call fcn.0040af1c
lea eax, [ebp - 0x170]
mov ecx, 0x512418
mov edx, dword [ebp - 4]
call fcn.00405a68
mov eax, dword [ebp - 0x170]
lea ecx, [ebp - 0x168]
mov edx, 0x3f
call fcn.0040aea8
test eax, eax
jne 0x5123bb
test byte [ebp - 0x158], 0x10
jne 0x5123a1
mov eax, dword [ebp - 0x154]
call fcn.00405c1c
push eax
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x168]
call fcn.0040aef8
test eax, eax
je 0x512387
lea eax, [ebp - 0x168]
call fcn.0040af1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5123f9
lea eax, [ebp - 0x170]
mov edx, 2
call fcn.0040576c
lea eax, [ebp - 0x168]
mov edx, dword [0x40911c]
call fcn.0040636c
lea eax, [ebp - 4]
call fcn.00405748
ret