joyce8/EMBER2024-capa huggingface dataset:
Function at 0x514c44
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 8
push 0
push 0
dec ecx
jne 0x514c4d
push ecx
xchg dword [ebp - 4], ecx
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405d78
mov eax, dword [ebp - 8]
call fcn.00405d78
mov eax, dword [ebp - 0xc]
call fcn.00405d78
xor eax, eax
push ebp
push 0x514e5c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
call fcn.005149b4
mov eax, dword [ebp - 0x18]
call fcn.00514a04
lea edx, [ebp - 0x10]
mov eax, 0x514e70
call fcn.00514ba0
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.00403210
mov eax, dword [ebp - 0x1c]
xor edx, edx
call fcn.0040af70
mov dl, 1
mov eax, dword [0x41a280]
call fcn.00404984
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x514e1c
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x514e80
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x514e90
lea edx, [ebp - 0x24]
xor eax, eax
call fcn.00403210
push dword [ebp - 0x24]
push 0x514ea4
push dword [ebp - 0xc]
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00405c48
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x514eb0
lea edx, [ebp - 0x2c]
xor eax, eax
call fcn.00403210
push dword [ebp - 0x2c]
push 0x514ec4
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.00405c48
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x514e90
push dword [ebp - 4]
push 0x514ea4
push dword [ebp - 8]
lea eax, [ebp - 0x30]
mov edx, 4
call fcn.00405c48
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x34]
xor eax, eax
call fcn.00403210
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x514edc
lea edx, [ebp - 0x40]
xor eax, eax
call fcn.00403210
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x3c]
call fcn.0040b1e0
push dword [ebp - 0x3c]
push 0x514eec
lea eax, [ebp - 0x38]
mov edx, 3
call fcn.00405c48
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x44]
mov ecx, dword [ebp - 0x10]
mov edx, 0x514ef8
call fcn.00405bd4
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x74]
lea eax, [ebp - 0x48]
call fcn.00514b6c
mov eax, dword [ebp - 0x48]
call fcn.00402f84
call fcn.00402f48
push 0
mov eax, dword [ebp - 0x10]
call fcn.00405d88
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x514e23
mov eax, dword [ebp - 0x14]
call fcn.004049b4
ret
Function at 0x514f00
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x514f08
push ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405d78
mov eax, dword [ebp - 8]
call fcn.00405d78
xor eax, eax
push ebp
push 0x515101
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
call fcn.005149b4
mov eax, dword [ebp - 0x14]
call fcn.00514a04
lea edx, [ebp - 0xc]
mov eax, 0x515114
call fcn.00514ba0
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00403210
mov eax, dword [ebp - 0x18]
xor edx, edx
call fcn.0040af70
mov dl, 1
mov eax, dword [0x41a280]
call fcn.00404984
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x5150c1
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x515124
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x20]
xor eax, eax
call fcn.00403210
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov edx, 0x515140
call fcn.00405bd4
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x515150
lea edx, [ebp - 0x28]
xor eax, eax
call fcn.00403210
push dword [ebp - 0x28]
push 0x515164
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00405c48
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
cmp dword [ebp - 4], 0
je 0x515026
push 0x515184
push dword [ebp - 4]
push 0x515194
push dword [ebp - 8]
lea eax, [ebp - 0x2c]
mov edx, 4
call fcn.00405c48
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x30]
xor eax, eax
call fcn.00403210
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x3c]
xor eax, eax
call fcn.00403210
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x38]
call fcn.0040b1e0
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x34]
mov edx, 0x5151a0
call fcn.00405bd4
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x40]
mov ecx, dword [ebp - 0xc]
mov edx, 0x515140
call fcn.00405bd4
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x74]
lea eax, [ebp - 0x44]
call fcn.00514b6c
mov eax, dword [ebp - 0x44]
call fcn.00402f84
call fcn.00402f48
mov eax, 0x5151b0
call fcn.0044b124
push 0
mov eax, dword [ebp - 0xc]
call fcn.00405d88
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5150c8
mov eax, dword [ebp - 0x10]
call fcn.004049b4
ret
Function at 0x515418
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x515420
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x515531
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 0x43
lea eax, [ebp - 0x14]
mov edx, ebx
call fcn.00405a9c
lea eax, [ebp - 0x14]
mov edx, 0x515548
call fcn.00405b90
mov eax, dword [ebp - 0x14]
call fcn.0040ae54
test al, al
je 0x51548c
lea eax, [ebp - 0x18]
mov edx, ebx
call fcn.00405a9c
lea eax, [ebp - 0x18]
mov edx, 0x515548
call fcn.00405b90
mov eax, dword [ebp - 0x18]
call fcn.00405d88
push eax
call sub.kernel32.dll_GetDriveTypeA
add eax, 0xfffffffd
sub eax, 2
jb 0x515492
inc ebx
cmp bl, 0x5b
jne 0x51543c
push 0
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x1c]
mov edx, ebx
call fcn.00405a9c
lea eax, [ebp - 0x1c]
mov edx, 0x515548
call fcn.00405b90
mov eax, dword [ebp - 0x1c]
call fcn.00405d88
push eax
call sub.kernel32.dll_GetVolumeInformationA
lea ecx, [ebp - 0x20]
mov eax, dword [ebp - 8]
movzx eax, ax
mov edx, 4
call fcn.0040a95c
mov eax, dword [ebp - 0x20]
push eax
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 8]
shr eax, 0x10
movzx eax, ax
mov edx, 4
call fcn.0040a95c
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 4]
pop ecx
call fcn.00405bd4
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00405908
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x515538
lea eax, [ebp - 0x24]
mov edx, 5
call fcn.004058d8
lea eax, [ebp - 4]
call fcn.004058b4
ret
Function at 0x5155e8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x5155f0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x51575a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.004058b4
mov bl, 0x43
lea eax, [ebp - 0x24]
mov edx, ebx
call fcn.00405a9c
lea eax, [ebp - 0x24]
mov edx, 0x515770
call fcn.00405b90
mov eax, dword [ebp - 0x24]
call fcn.00405d88
push eax
call sub.kernel32.dll_GetDriveTypeA
sub eax, 3
jne 0x51571e
push 0
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
lea eax, [ebp - 0x28]
mov edx, ebx
call fcn.00405a9c
lea eax, [ebp - 0x28]
mov edx, 0x515770
call fcn.00405b90
mov eax, dword [ebp - 0x28]
call fcn.00405d88
push eax
call sub.kernel32.dll_GetVolumeInformationA
lea ecx, [ebp - 0x2c]
mov eax, dword [ebp - 0xc]
movzx eax, ax
mov edx, 4
call fcn.0040a95c
mov eax, dword [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x30]
mov eax, dword [ebp - 0xc]
shr eax, 0x10
movzx eax, ax
mov edx, 4
call fcn.0040a95c
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 4]
pop ecx
call fcn.00405bd4
movzx eax, bl
sub eax, 0x40
jno 0x5156c0
call fcn.00404884
call fcn.0040b480
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
push dword [ebp - 8]
lea eax, [ebp - 0x34]
mov edx, ebx
call fcn.00405a9c
push dword [ebp - 0x34]
push 0x51577c
push dword [ebp - 4]
push 0x51578c
fild qword [ebp - 0x20]
fld dword [0x515794]
call fcn.004039a8
add esp, 0xfffffff8
fstp qword [esp]
wait
lea ecx, [ebp - 0x38]
xor edx, edx
mov al, 0xa
call fcn.00512f30
push dword [ebp - 0x38]
push 0x5157a0
lea eax, [ebp - 8]
mov edx, 7
call fcn.00405c48
inc ebx
cmp bl, 0x5b
jne 0x515613
mov eax, esi
mov edx, dword [ebp - 8]
call fcn.00405908
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x515761
lea eax, [ebp - 0x38]
mov edx, 6
call fcn.004058d8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004058d8
ret

Function at 0x515cd8
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, eax
mov eax, esi
call fcn.004058b4
push 0
lea eax, [ebp - 4]
push eax
call sub.wininet.dll_InternetGetConnectedState
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x515d5a
mov eax, dword [ebp - 4]
and eax, 1
cmp eax, 1
jne 0x515d13
mov eax, esi
mov edx, 0x515d78
call fcn.00405908
mov eax, dword [ebp - 4]
and eax, 2
cmp eax, 2
jne 0x515d2a
mov eax, esi
mov edx, 0x515d88
call fcn.00405908
mov eax, dword [ebp - 4]
and eax, 4
cmp eax, 4
jne 0x515d41
mov eax, esi
mov edx, 0x515d94
call fcn.00405908
mov eax, dword [ebp - 4]
and eax, 8
cmp eax, 8
jne 0x515d66
mov eax, esi
mov edx, 0x515da4
call fcn.00405908
jmp 0x515d66
mov eax, esi
mov edx, 0x515dbc
call fcn.00405908
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x51635c
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd44
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x29c], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405d78
xor eax, eax
push ebp
push 0x5164a6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x298]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
xor ecx, ecx
push ebp
push 0x51647e
push dword fs:[ecx]
mov dword fs:[ecx], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x105]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x105]
mov edx, dword [ebp - 4]
call fcn.0040b610
lea eax, [ebp - 0x105]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x516467
mov edx, dword [eax + 0xc]
test edx, edx
je 0x516461
mov ebx, dword [edx]
test ebx, ebx
je 0x51645b
lea eax, [ebp - 0x29c]
push eax
movzx eax, byte [ebx]
mov dword [ebp - 0x2bc], eax
mov byte [ebp - 0x2b8], 0
movzx eax, byte [ebx + 1]
mov dword [ebp - 0x2b4], eax
mov byte [ebp - 0x2b0], 0
movzx eax, byte [ebx + 2]
mov dword [ebp - 0x2ac], eax
mov byte [ebp - 0x2a8], 0
movzx eax, byte [ebx + 3]
mov dword [ebp - 0x2a4], eax
mov byte [ebp - 0x2a0], 0
lea edx, [ebp - 0x2bc]
mov ecx, 3
mov eax, 0x5164c0
call fcn.0040c01c
mov edx, dword [ebp - 0x29c]
mov eax, esi
call fcn.00405908
mov byte [ebp - 5], 1
jmp 0x51646b
mov byte [ebp - 5], 0
jmp 0x51646b
mov byte [ebp - 5], 0
jmp 0x51646b
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x516485
call sub.wsock32.dll_WSACleanup
ret
Function at 0x51697c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff58
push ebx
push esi
xor edx, edx
mov dword [ebp - 0xa8], edx
mov dword [ebp - 0x9c], edx
mov dword [ebp - 0xa0], edx
mov dword [ebp - 0xa4], edx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x516b7c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x98], 0x94
lea eax, [ebp - 4]
call fcn.004058b4
lea eax, [ebp - 0x98]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x516b4c
mov ebx, dword [ebp - 0x94]
cmp ebx, 6
jne 0x516a34
mov eax, dword [ebp - 0x90]
cmp eax, 1
jne 0x5169ff
lea eax, [ebp - 4]
mov edx, 0x516b94
call fcn.0040594c
jmp 0x516a34
cmp eax, 2
jne 0x516a13
lea eax, [ebp - 4]
mov edx, 0x516ba4
call fcn.0040594c
jmp 0x516a34
cmp eax, 3
jne 0x516a27
lea eax, [ebp - 4]
mov edx, 0x516bb4
call fcn.0040594c
jmp 0x516a34
lea eax, [ebp - 4]
mov edx, 0x516bc8
call fcn.0040594c
cmp ebx, 5
jne 0x516a74
mov eax, dword [ebp - 0x90]
cmp eax, 1
jne 0x516a53
lea eax, [ebp - 4]
mov edx, 0x516bdc
call fcn.0040594c
jmp 0x516a74
cmp eax, 2
jne 0x516a67
lea eax, [ebp - 4]
mov edx, 0x516bec
call fcn.0040594c
jmp 0x516a74
lea eax, [ebp - 4]
mov edx, 0x516c00
call fcn.0040594c
cmp ebx, 4
jne 0x516ab4
mov eax, dword [ebp - 0x90]
cmp eax, 0xa
jne 0x516a93
lea eax, [ebp - 4]
mov edx, 0x516c14
call fcn.0040594c
jmp 0x516ab4
cmp eax, 0x5a
jne 0x516aa7
lea eax, [ebp - 4]
mov edx, 0x516c24
call fcn.0040594c
jmp 0x516ab4
lea eax, [ebp - 4]
mov edx, 0x516c34
call fcn.0040594c
push dword [ebp - 4]
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x9c]
call fcn.0040a934
push dword [ebp - 0x9c]
push 0x516c44
mov eax, dword [ebp - 0x90]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xa0]
call fcn.0040a934
push dword [ebp - 0xa0]
push 0x516c50
mov eax, dword [ebp - 0x8c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xa4]
call fcn.0040a934
push dword [ebp - 0xa4]
lea eax, [ebp - 4]
mov edx, 6
call fcn.00405c48
push dword [ebp - 4]
push 0x516c5c
lea eax, [ebp - 0xa8]
lea edx, [ebp - 0x84]
mov ecx, 0x80
call fcn.00405b34
push dword [ebp - 0xa8]
lea eax, [ebp - 4]
mov edx, 3
call fcn.00405c48
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00405908
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x516b83
lea eax, [ebp - 0xa8]
mov edx, 4
call fcn.004058d8
lea eax, [ebp - 4]
call fcn.004058b4
ret
Function at 0x517160
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffecc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x114], ebx
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x124], ebx
mov dword [ebp - 0x128], ebx
mov dword [ebp - 0x12c], ebx
mov dword [ebp - 0x130], ebx
mov dword [ebp - 0x134], ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x517373
push dword fs:[eax]
mov dword fs:[eax], esp
mov bx, 1
add bx, 1
jae 0x5171cb
call fcn.00404884
lea eax, [ebp - 0x10d]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 0x114]
lea eax, [ebp - 0x10d]
call fcn.0040b790
push dword [ebp - 0x114]
push edi
push 0x51738c
lea eax, [ebp - 0x118]
call fcn.00513c14
push dword [ebp - 0x118]
push 0x51738c
call fcn.0040d080
add esp, 0xfffffff8
fstp qword [esp]
wait
call fcn.00481308
movzx eax, ax
lea edx, [ebp - 0x11c]
call fcn.0040a848
push dword [ebp - 0x11c]
call fcn.0040d080
add esp, 0xfffffff8
fstp qword [esp]
wait
call fcn.0048132c
movzx eax, ax
lea ecx, [ebp - 0x120]
mov edx, 2
call fcn.00512fb0
push dword [ebp - 0x120]
call fcn.0040d080
add esp, 0xfffffff8
fstp qword [esp]
wait
call fcn.00481350
movzx eax, ax
lea ecx, [ebp - 0x124]
mov edx, 2
call fcn.00512fb0
push dword [ebp - 0x124]
push 0x51738c
call fcn.0040d0ac
add esp, 0xfffffff8
fstp qword [esp]
wait
call fcn.00481374
movzx eax, ax
lea ecx, [ebp - 0x128]
mov edx, 2
call fcn.00512fb0
push dword [ebp - 0x128]
call fcn.0040d0ac
add esp, 0xfffffff8
fstp qword [esp]
wait
call fcn.0048139c
movzx eax, ax
lea ecx, [ebp - 0x12c]
mov edx, 2
call fcn.00512fb0
push dword [ebp - 0x12c]
call fcn.0040d0ac
add esp, 0xfffffff8
fstp qword [esp]
wait
call fcn.004813c4
movzx eax, ax
lea ecx, [ebp - 0x130]
mov edx, 2
call fcn.00512fb0
push dword [ebp - 0x130]
push 0x51738c
lea edx, [ebp - 0x134]
movzx eax, bx
call fcn.0040a848
push dword [ebp - 0x134]
push dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, 0xf
call fcn.00405c48
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00405908
mov eax, dword [esi]
call fcn.0040ae30
test al, al
jne 0x5171c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51737a
lea eax, [ebp - 0x134]
mov edx, 9
call fcn.004058d8
lea eax, [ebp - 4]
call fcn.004058b4
ret
Function at 0x517488
Capabilities:
Reference sql statements
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x517491
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov byte [ebp - 0x12], cl
mov byte [ebp - 0x11], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x5176a9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.004058b4
xor edx, edx
push ebp
push 0x517654
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x5176c4
xor ecx, ecx
xor edx, edx
xor eax, eax
call fcn.00511d80
test al, al
jne 0x5174f1
mov eax, dword [ebp + 8]
call fcn.004058b4
call fcn.004052d4
jmp 0x517666
lea edx, [ebp - 4]
mov eax, 0x5176d8
call fcn.00511ec4
mov eax, dword [ebp - 4]
call fcn.00406cc0
cmp ebx, eax
jle 0x517514
mov eax, dword [ebp - 4]
call fcn.00406cc0
mov ebx, eax
cmp byte [ebp - 0x12], 0
je 0x517526
xor esi, esi
mov eax, dword [ebp - 4]
call fcn.00406cc0
jmp 0x51752a
mov esi, ebx
mov eax, ebx
mov ebx, esi
mov esi, eax
sub esi, ebx
jl 0x517625
inc esi
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x24]
push eax
mov edi, ebx
test edi, edi
jns 0x51754c
call fcn.0040487c
mov ecx, edi
mov edx, 0x5176f8
mov eax, dword [ebp - 4]
call fcn.00511724
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0xb
lea edx, [ebp - 0x20]
xor ecx, ecx
mov eax, 0x517708
call fcn.0040c01c
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 8]
call fcn.00511ec4
push 0
lea eax, [ebp - 0xc]
push eax
test ebx, ebx
jns 0x51758e
call fcn.0040487c
mov ecx, edi
mov edx, 0x517754
mov eax, dword [ebp - 4]
call fcn.00511724
mov edx, 0x517768
mov eax, dword [ebp - 0xc]
call fcn.0040a2cc
test al, al
jne 0x51760a
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.00405b90
cmp byte [ebp - 0x11], 0
je 0x5175f5
push dword [ebp - 0x10]
push 0x517778
push 0
lea eax, [ebp - 0x28]
push eax
test ebx, ebx
jns 0x5175d6
call fcn.0040487c
mov ecx, edi
mov edx, 0x517788
mov eax, dword [ebp - 4]
call fcn.00511724
push dword [ebp - 0x28]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00405c48
cmp byte [ebp - 0x12], 0
je 0x51761d
lea eax, [ebp - 0x10]
mov edx, 0x517798
call fcn.00405b90
jmp 0x51761d
cmp byte [ebp - 0x12], 0
jne 0x51761d
lea eax, [ebp - 0x10]
mov edx, 0x5177a4
call fcn.0040594c
inc ebx
dec esi
jne 0x517537
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51765b
call fcn.00512228
lea eax, [ebp - 4]
mov edx, dword [0x5116f8]
call fcn.00406610
lea eax, [ebp - 8]
mov edx, dword [0x5116f8]
call fcn.00406610
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5176b0
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.004058d8
lea eax, [ebp - 0x18]
call fcn.004058b4
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004058d8
lea eax, [ebp - 8]
mov edx, dword [0x5116f8]
mov ecx, 2
call fcn.00406524
ret
Function at 0x529e6c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov al, byte [ebp - 9]
dec eax
test eax, eax
jl 0x529ebb
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
lea eax, [eax + edx*8]
mov edx, dword [ebp - 0x14]
mov al, byte [eax + edx]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
lea edx, [edx + ecx*8]
mov ecx, dword [ebp - 0x14]
xor byte [edx + ecx], al
inc dword [ebp - 0x14]
dec dword [ebp - 0x18]
jne 0x529e95
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jne 0x529e80
mov esp, ebp
pop ebp
ret
Function at 0x52a5ac
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push esi
push edi
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x200]
push ecx
mov ecx, 0x78
rep movsd dword es:[edi], dword [esi]
pop ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
sub eax, 0x80
je 0x52a5e8
sub eax, 0x40
je 0x52a5f1
sub eax, 0x40
je 0x52a5fa
jmp 0x52a603
mov dword [ebp - 0x18], 4
jmp 0x52a60f
mov dword [ebp - 0x18], 6
jmp 0x52a60f
mov dword [ebp - 0x18], 8
jmp 0x52a60f
mov dword [ebp - 0x10], 0xfffffffe
jmp 0x52a702
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
setge al
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00529df0
sub eax, 0x80
je 0x52a636
sub eax, 0x40
je 0x52a63f
sub eax, 0x40
je 0x52a648
jmp 0x52a651
mov dword [ebp - 0x1c], 0xa
jmp 0x52a65d
mov dword [ebp - 0x1c], 0xc
jmp 0x52a65d
mov dword [ebp - 0x1c], 0xe
jmp 0x52a65d
mov dword [ebp - 0x10], 0xfffffffd
jmp 0x52a702
mov cl, byte [ebp - 0x18]
lea edx, [ebp - 0x200]
mov eax, dword [ebp - 4]
call fcn.00529e6c
mov eax, dword [ebp - 0x1c]
dec eax
test eax, eax
jle 0x52a6c8
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], 1
mov cl, byte [ebp - 0x18]
mov edx, str.cw
mov eax, dword [ebp - 4]
call fcn.00529f80
mov cl, byte [ebp - 0x18]
mov eax, dword [ebp - 4]
xor edx, edx
call fcn.00529ec8
mov dl, byte [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00529fe4
mov cl, byte [ebp - 0x18]
mov eax, dword [ebp - 0x14]
shl eax, 2
lea edx, [ebp + eax*8 - 0x200]
mov eax, dword [ebp - 4]
call fcn.00529e6c
inc dword [ebp - 0x14]
dec dword [ebp - 0x20]
jne 0x52a680
mov cl, byte [ebp - 0x18]
mov edx, str.cw
mov eax, dword [ebp - 4]
call fcn.00529f80
mov cl, byte [ebp - 0x18]
mov eax, dword [ebp - 4]
xor edx, edx
call fcn.00529ec8
mov cl, byte [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
shl eax, 2
lea edx, [ebp + eax*8 - 0x200]
mov eax, dword [ebp - 4]
call fcn.00529e6c
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4