joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5bc1b0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405738
mov eax, dword [ebp - 8]
call fcn.00405738
xor eax, eax
push ebp
push 0x5bc35a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x44]
mov byte [ebp - 0xd], 0
call fcn.0049fd94
test al, al
je 0x5bc33f
push 0x5bc370
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 0x18], eax
push 0x5bc380
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x1200dbc], eax
push 0x5bc398
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x1200dc0], eax
push 0x5bc3b8
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x1200dc4], eax
push 0x5bc3d0
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x1200dc8], eax
push 0x5bc3f0
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x1200dd0], eax
push 0x5bc408
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x1200dd8], eax
push 0x5bc420
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x1200ddc], eax
push 0x5bc430
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x1200de0], eax
push 0x5bc440
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x1200dcc], eax
push 0x5bc3f0
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x1200dd0], eax
push 0x5bc408
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x1200dd8], eax
cmp dword [0x1200dbc], 0
je 0x5bc336
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x5bc324
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, 2
mov eax, dword [ebp - 4]
call fcn.005bba5c
mov dword [ebp - 0x14], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5bc32e
cmp dword [ebp - 0x14], 0
setg byte [ebp - 0xd]
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_FreeLibrary_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5bc361
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040529c
ret
Function at 0x5be5b4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
push esi
push edi
push eax
push ebx
push ecx
push edx
lea edi, [0x7cfa04]
mov esi, dword [ebp - 4]
mov ax, word [ebp - 8]
mov dx, word [ebp - 6]
mov ecx, dword [ebp - 0xc]
or ecx, ecx
je 0x5be601
xor ebx, ebx
mov bl, al
lodsb al, byte [esi]
xor bl, al
mov al, ah
mov ah, dl
mov dl, dh
xor dh, dh
shl bx, 1
shl bx, 1
add ebx, edi
xor ax, word [ebx]
xor dx, word [ebx + 2]
loop 0x5be5e1
mov word [ebp - 0x10], ax
mov word [ebp - 0xe], dx
pop edx
pop ecx
pop ebx
pop eax
pop edi
pop esi
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x5be7e4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405738
xor eax, eax
push ebp
push 0x5be94c
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.0040b1f4
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.0040a0f8
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x1c]
call fcn.00405548
mov ecx, eax
mov edx, 2
mov eax, dword [ebp - 0x1c]
call fcn.004057a8
mov eax, dword [ebp - 0x1c]
mov edx, 0x5be960
call fcn.00405694
jne 0x5be862
lea eax, [ebp - 0x1c]
mov edx, 0x5be96c
call fcn.00405310
mov eax, dword [ebp - 0x1c]
call fcn.00405748
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0040b0f4
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 4]
call fcn.00405310
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.00405748
push eax
mov eax, dword [0x7d8668]
push eax
call sub.kernel32.dll_FindResourceA
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [0x7d8668]
push eax
call sub.kernel32.dll_LoadResource
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x5be8dc
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 4]
mov edx, 0x5be97c
call fcn.00405594
mov ecx, dword [ebp - 0x28]
mov dl, 1
mov eax, dword [0x41ba30]
call fcn.0040f2f0
call fcn.00404c14
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_LockResource
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
call fcn.00421d10
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [0x7d8668]
push eax
call sub.kernel32.dll_SizeofResource
mov ecx, eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.00421790
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [ebp - 0x10]
call fcn.00408c8c
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FreeResource
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5be953
lea eax, [ebp - 0x28]
mov edx, 4
call fcn.0040529c
lea eax, [ebp - 4]
call fcn.00405278
ret
Function at 0x5c0708
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff48
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xb8], ebx
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00405738
xor eax, eax
push ebp
push 0x5c089a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xa], 0
xor eax, eax
push ebp
push 0x5c086f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xb4], 0x94
lea eax, [ebp - 0xb4]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
jne 0x5c0770
mov eax, dword [ebp - 4]
mov byte [eax + 8], 1
jmp 0x5c0780
cmp dword [ebp - 0xa4], 2
sete al
mov edx, dword [ebp - 4]
mov byte [edx + 8], al
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x5c0865
cmp dword [ebp - 0xb0], 5
jb 0x5c0865
cmp dword [ebp - 8], 0
jne 0x5c07a7
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x5c07b2
mov eax, dword [ebp - 8]
call fcn.00405748
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xb8]
push eax
mov eax, dword [0x7d6554]
mov eax, dword [eax]
mov cl, 1
mov edx, 0x5c08b4
call fcn.0049ee2c
mov eax, dword [ebp - 0xb8]
mov edx, 0x5c08d4
call fcn.00405694
je 0x5c082c
xor eax, eax
push ebp
push 0x5c0822
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp byte [ebp - 9], 0
je 0x5c0818
push 0xffffffffffffffff
push 0x64
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x1c]
push eax
push 0
push 0
mov eax, dword [0x7d7464]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x20], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5c082c
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [0x7d68f0]
mov eax, dword [eax]
call eax
test eax, eax
jne 0x5c0865
mov eax, dword [ebp - 4]
mov byte [eax + 9], 1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 4]
add eax, 4
mov edx, dword [ebp - 8]
call fcn.004052cc
mov byte [ebp - 0xa], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5c0879
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c08a1
lea eax, [ebp - 0xb8]
call fcn.00405278
lea eax, [ebp - 8]
call fcn.00405278
ret
Function at 0x5d336c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add dword [ebx - 0x39743], eax
inc dword [eax]
je 0x5d338d
cmp dword [ebp - 0x398], 0
je 0x5d3557
cmp dword [ebp + 0xc], 1
je 0x5d3557
cmp dword [ebp + 0xc], 8
jne 0x5d351f
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
invalid
invalid
Function at 0x5d4b14
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe18
xor edx, edx
mov dword [ebp - 0x1e8], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5d4c1e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1e4]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
lea eax, [ebp - 8]
call fcn.00405278
push 0x40
lea eax, [ebp - 0x54]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x54]
push eax
call sub.wsock32.dll_gethostbyname
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x5d4bfd
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x5d4bbe
push dword [ebp - 8]
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + eax*4]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 0x1e8]
call fcn.00405480
push dword [ebp - 0x1e8]
push 0x5d4c34
lea eax, [ebp - 8]
mov edx, 3
call fcn.00405608
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
cmp dword [edx + eax*4], 0
jne 0x5d4b83
call sub.wsock32.dll_WSACleanup
mov eax, dword [ebp - 8]
call fcn.00405548
test eax, eax
jle 0x5d4bf2
mov eax, dword [ebp - 8]
call fcn.00405548
mov edx, eax
lea eax, [ebp - 8]
mov ecx, 1
call fcn.004057e8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.004052cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d4c25
lea eax, [ebp - 0x1e8]
call fcn.00405278
lea eax, [ebp - 8]
call fcn.00405278
ret
Function at 0x5d799c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
cmp byte [0x1221e48], 0
jne 0x5d7a16
cmp byte [0x1221e49], 0
je 0x5d7a16
mov byte [0x1221e49], 0
mov eax, dword [0x1221e50]
push eax
call sub.advapi32.dll_RegCloseKey_1
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push 0x5d7a1c
push 0x80000006
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5d7a16
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
push 0x1221e4c
lea eax, [ebp - 0x10]
push eax
push 0
push 0x5d7a30
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov esp, ebp
pop ebp
ret
Function at 0x5db594
Capabilities:
Link many functions at runtime

Disassembly:
mov byte [0x7d0330], 0
mov eax, dword [0x7d7484]
cmp dword [eax], 2
jne 0x5db76d
mov eax, dword [0x7d68a8]
cmp dword [eax], 5
jl 0x5db76d
call fcn.005d8220
test al, al
jne 0x5db5c5
call fcn.005d8238
call fcn.005d820c
mov dword [0x7d0338], eax
push 0x5db770
mov eax, dword [0x7d0338]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x7d02fc], eax
cmp dword [0x7d02fc], 0
jne 0x5db620
mov edx, 0x8000
mov eax, 0x5db784
call fcn.00411410
mov dword [0x7d0334], eax
mov eax, dword [0x7d0334]
mov dword [0x7d0338], eax
push 0x5db770
mov eax, dword [0x7d0338]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x7d02fc], eax
cmp dword [0x7d02fc], 0
je 0x5db768
push 0x5db790
mov eax, dword [0x7d0338]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x7d0300], eax
cmp dword [0x7d0300], 0
je 0x5db768
push 0x5db79c
mov eax, dword [0x7d0338]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x7d0304], eax
cmp dword [0x7d0304], 0
je 0x5db768
mov byte [0x7d0330], 1
push 0x5db7ac
mov eax, dword [0x7d0338]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x7d0308], eax
push 0x5db7b8
mov eax, dword [0x7d0338]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x7d030c], eax
push 0x5db7c4
mov eax, dword [0x7d0338]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x7d0310], eax
push 0x5db7d4
mov eax, dword [0x7d0338]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x7d0314], eax
push 0x5db7e4
mov eax, dword [0x7d0338]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x7d0318], eax
mov edx, 0x8000
mov eax, 0x5db7fc
call fcn.00411410
mov dword [0x7d033c], eax
cmp dword [0x7d033c], 0
je 0x5db76d
push 0x5db80c
mov eax, dword [0x7d033c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x7d031c], eax
push 0x5db828
mov eax, dword [0x7d033c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x7d0320], eax
push 0x5db848
mov eax, dword [0x7d033c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x7d0324], eax
push 0x5db864
mov eax, dword [0x7d033c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x7d0328], eax
push 0x5db87c
mov eax, dword [0x7d033c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x7d032c], eax
ret
call fcn.005db4f8
ret
Function at 0x5dd998
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5ddaed
push dword fs:[eax]
mov dword fs:[eax], esp
mov ax, word [ebp + 8]
push eax
lea eax, [ebp - 0x2a]
push eax
lea eax, [ebp - 0x3a]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.005dd86c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00406854
add eax, 0x28
push eax
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, dword [0x5c2224]
call fcn.00406a10
add esp, 4
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0x2a]
mov ecx, 0x1c
call fcn.00402a6c
mov dword [ebp - 0x14], 0x1c
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
lea edx, [eax + edx]
lea eax, [ebp - 0x3a]
mov ecx, 0x1c
call fcn.00402a6c
add dword [ebp - 0x14], 0x1c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00406854
mov dword [ebp - 0x18], eax
mov eax, dword [0x7d726c]
mov eax, dword [eax]
mov edx, dword [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x30]
lea edx, [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
call fcn.005c3d4c
add dword [ebp - 0x14], 4
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
add eax, edx
xor ecx, ecx
mov edx, 3
call fcn.00403450
add dword [ebp - 0x14], 3
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov byte [eax + edx], 0x3a
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00406854
push eax
lea ecx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
xor edx, edx
call fcn.005c3cf0
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x94]
mov word [ebp - 0x1a], ax
mov ax, word [ebp - 0x1a]
call fcn.005c3a5c
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp + 0x10]
call fcn.005c3d24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ddaf4
lea eax, [ebp - 0x10]
mov edx, dword [0x5c2224]
call fcn.00406b10
ret

Function at 0x5f96c4
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x5f9721
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 8]
call fcn.00405748
push eax
mov eax, dword [ebp - 4]
call fcn.00405748
push eax
call sub.kernel32.dll_CopyFileA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f9728
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x5f9730
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5f97ba
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, 0x104
call fcn.004058d4
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00405748
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x5f979c
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.004058d4
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.005c5c80
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004052cc
jmp 0x5f97a4
mov eax, dword [ebp - 4]
call fcn.00405278
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f97c1
lea eax, [ebp - 0xc]
call fcn.00405278
ret

Function at 0x5ff5a0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, 0x10
call fcn.004058d4
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00405548
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00405748
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x5ff5e6
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.004058d4
pop ecx
pop ecx
pop ebp
ret

Function at 0x60059c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x600624
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.0040a3cc
mov eax, dword [ebp - 0x14]
mov ebx, dword [0x7d64d0]
mov ebx, dword [ebx]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
call ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x600604
mov edx, dword [ebp - 0x10]
dec edx
mov eax, dword [ebp - 0xc]
call fcn.004058d4
jmp 0x60060e
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.004058d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60062b
lea eax, [ebp - 0x14]
call fcn.00405278
ret

Function at 0x607ffc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 8]
test byte [eax + 1], 0x80
setne byte [ebp - 0xa]
mov eax, dword [ebp - 8]
mov ax, word [eax]
add eax, eax
xor edx, edx
mov dl, byte [ebp - 9]
shr edx, 7
or ax, dx
mov edx, dword [ebp - 8]
mov word [edx], ax
cmp byte [ebp - 0xa], 0
je 0x608044
mov eax, dword [ebp - 8]
xor word [eax], 0x1021
mov al, byte [ebp - 9]
add eax, eax
and al, 0xff
mov byte [ebp - 9], al
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 9
jne 0x608012
mov esp, ebp
pop ebp
ret
Function at 0x617844
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x617922
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
push 0
push 0
mov eax, dword [0x7d6758]
mov eax, dword [eax]
call eax
call fcn.00408cd0
cmp eax, 1
sbb eax, eax
inc eax
mov byte [0x7d2254], al
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call sub.ole32.dll_CoInitializeSecurity
lea eax, [ebp - 0xc]
call fcn.004071f8
push eax
push 0x617930
push 1
push 0
push 0x7d2258
call sub.ole32.dll_CoCreateInstance
call fcn.00408ce0
test eax, eax
je 0x6178c7
call fcn.0061734c
jmp 0x617904
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x617940
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
call fcn.00408ce0
test eax, eax
je 0x6178f5
call fcn.0061734c
jmp 0x617904
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
call fcn.00407210
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x617929
lea eax, [ebp - 0x10]
call fcn.004071f8
lea eax, [ebp - 0xc]
call fcn.004071f8
ret

Function at 0x61e568
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
mov ecx, edx
test ecx, ecx
js 0x61e57c
mov ebx, dword [eax + ecx*4]
dec ecx
push ebx
jns 0x61e575
mov eax, esp
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
test eax, eax
jl 0x61e5f1
inc eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x1c]
mov eax, dword [eax + edx*4]
call fcn.0042b460
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
and eax, 0xff
cdq
idiv dword [ebp - 8]
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x20]
and eax, 0xff00
shr eax, 8
cdq
idiv dword [ebp - 8]
add dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x20]
and eax, 0xff0000
shr eax, 0x10
cdq
idiv dword [ebp - 8]
add dword [ebp - 0x18], eax
inc dword [ebp - 0x1c]
dec dword [ebp - 0x24]
jne 0x61e5a5
mov cl, byte [ebp - 0x18]
mov dl, byte [ebp - 0x14]
mov al, byte [ebp - 0x10]
call fcn.00408cfc
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x28]
mov esp, ebp
pop ebp
ret