joyce8/EMBER2024-capa huggingface dataset:
Function at 0x510231
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x51028d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x41d3ac]
call fcn.0040441c
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLogicalDrives
mov dword [ebp - 9], eax
xor esi, esi
mov eax, esi
cmp eax, 0x1f
ja 0x51014b
bt dword [ebp - 9], eax
jae 0x510268
mov ebx, esi
add bl, 0x61
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00405584
lea eax, [ebp - 0x10]
mov edx, 0x5102a8
call fcn.00405680
mov eax, dword [ebp - 0x10]
call fcn.00405878
push eax
call sub.kernel32.dll_GetDriveTypeA
mov byte [ebp - 5], al
mov dl, 1
mov eax, dword [0x50fddc]
call fcn.0040441c
mov edi, eax
mov eax, ebx
call fcn.0040341c
mov byte [edi + 4], al
mov al, byte [ebp - 5]
mov byte [edi + 5], al
xor eax, eax
mov al, byte [ebp - 5]
cmp eax, 6
ja case.0x5101aa.0
jmp dword [eax*4 + 0x5101b1]
lea eax, [edi + 8]
call fcn.0040539c
jmp case.0x5101aa.0
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.0050fe80
mov edx, dword [ebp - 0x14]
lea eax, [edi + 8]
call fcn.004053f0
jmp case.0x5101aa.0
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.0051001c
mov edx, dword [ebp - 0x18]
lea eax, [edi + 8]
call fcn.004053f0
jmp case.0x5101aa.0
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.0050fe80
mov edx, dword [ebp - 0x1c]
lea eax, [edi + 8]
call fcn.004053f0
jmp case.0x5101aa.0
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.0050fe80
mov edx, dword [ebp - 0x20]
lea eax, [edi + 8]
call fcn.004053f0
lea eax, [ebp - 0x24]
push eax
mov al, byte [edi + 4]
mov byte [ebp - 0x34], al
mov byte [ebp - 0x30], 2
mov eax, dword [edi + 8]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
lea edx, [ebp - 0x34]
mov ecx, 1
mov eax, 0x5102b4
call fcn.0040e1f0
mov edx, dword [ebp - 0x24]
mov ecx, edi
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
inc esi
cmp esi, 0x1a
jne 0x510140
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x510294
lea eax, [ebp - 0x24]
mov edx, 6
call fcn.004053c0
ret
Function at 0x516b58
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
mov ebx, 0x569528
mov eax, dword [0x56b200]
cmp dword [eax], 2
jne 0x516ce0
push 0x516cf8
call sub.kernel32.dll_GetModuleHandleA_2
mov dword [ebx], eax
cmp dword [ebx], 0
sete byte [0x5730ec]
cmp dword [ebx], 0
jne 0x516b93
push 0x516cf8
call sub.kernel32.dll_LoadLibraryA
mov dword [ebx], eax
cmp dword [ebx], 0
je 0x516ce0
push 0x516d04
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x569534], eax
push 0x516d1c
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x569538], eax
push 0x516d30
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x56952c], eax
push 0x516d40
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x569530], eax
push 0x516d48
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x56953c], eax
push 0x516d58
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x569540], eax
push 0x516d74
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x569544], eax
push 0x516d84
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x56956c], eax
push 0x516d94
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x569548], eax
push 0x516da8
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x56954c], eax
push 0x516dc0
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x569554], eax
push 0x516dcc
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x569550], eax
push 0x516ddc
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x569558], eax
push 0x516dec
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x56955c], eax
push 0x516e08
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x569560], eax
push 0x516e24
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x569564], eax
push 0x516e3c
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x569568], eax
push 0x516e50
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x569570], eax
cmp dword [ebx], 0
je 0x516cee
cmp dword [0x569558], 0
jne 0x516cf2
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x519224
Capabilities:
Get hostname

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov esi, eax
mov dword [esp], 0xff
mov eax, dword [esp]
call fcn.0040dcec
mov dword [esp + 4], eax
push esp
mov eax, dword [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
mov eax, esi
mov edx, dword [esp + 4]
call fcn.00405594
mov eax, dword [esp + 4]
call fcn.0040dd48
call fcn.0051b0c0
mov ebx, eax
mov edx, 0x80000002
mov eax, ebx
call fcn.0046e504
xor ecx, ecx
mov edx, 0x5192bc
mov eax, ebx
call fcn.0046e648
test al, al
je 0x5192a7
mov edx, 0x519300
mov eax, ebx
call fcn.0046ec14
test al, al
je 0x5192a0
mov edx, 0x519300
mov ecx, esi
mov eax, ebx
call fcn.0046ea2c
mov eax, ebx
call fcn.0046e4d4
mov eax, ebx
call fcn.0040444c
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x519310
Capabilities:
Get session user name

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
mov dword [esp], 0xff
mov eax, dword [esp]
call fcn.0040dcec
mov dword [esp + 4], eax
push esp
mov eax, dword [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x519345
mov edx, ebx
mov eax, dword [esp + 4]
call fcn.0040dcd8
jmp 0x51934c
mov eax, ebx
call fcn.0040539c
mov eax, dword [esp + 4]
call fcn.0040dd48
pop ecx
pop edx
pop ebx
ret

Function at 0x519b60
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x519c0c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x44]
mov esi, 0x1000
call sub.kernel32.dll_GetEnvironmentStringsA
mov dword [ebp - 8], eax
xor edi, edi
lea eax, [ebp - 0xc]
call fcn.0040539c
cmp esi, edi
jbe 0x519be8
mov eax, dword [ebp - 8]
mov bl, byte [eax + edi]
test bl, bl
je 0x519bc8
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00405584
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.00405680
jmp 0x519be3
cmp dword [ebp - 0xc], 0
je 0x519be8
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0xc]
call fcn.0040539c
inc edi
cmp esi, edi
ja 0x519ba7
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeEnvironmentStringsA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x519c13
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004053c0
ret
Function at 0x519e80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov ebx, ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x519f19
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00405b00
mov eax, 0x104
call fcn.0040dcec
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push edi
push esi
call sub.shell32.dll_SHGetSpecialFolderLocation
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
test eax, eax
je 0x519edc
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00405c20
mov eax, dword [ebp - 8]
call fcn.0040dd48
lea eax, [ebp - 0xc]
push eax
call sub.shell32.dll_SHGetMalloc
call fcn.0041c6a8
test al, al
je 0x519f03
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x519f20
lea eax, [ebp - 0xc]
call fcn.00407124
ret

Function at 0x519f28
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405868
xor eax, eax
push ebp
push 0x51a097
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040539c
call fcn.0051b0c0
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x51a068
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x57327c], 0
je 0x519fa8
mov edx, 0x80000003
mov eax, dword [ebp - 0xc]
call fcn.0046e504
lea eax, [ebp - 0x14]
call fcn.00519654
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
xor eax, eax
call fcn.0051af84
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x51a0ac
call fcn.004056c4
jmp 0x519fc2
mov edx, 0x80000001
mov eax, dword [ebp - 0xc]
call fcn.0046e504
lea eax, [ebp - 8]
mov edx, 0x51a0ac
call fcn.00405434
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.0046e648
test al, al
je 0x519ff7
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.0046ec14
test al, al
je 0x519fef
mov ecx, ebx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.0046ea2c
mov eax, dword [ebp - 0xc]
call fcn.0046e4d4
cmp dword [ebx], 0
je 0x51a003
call fcn.00404d9c
jmp 0x51a06f
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.0046e504
lea eax, [ebp - 8]
mov edx, 0x51a0ac
call fcn.00405434
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.0046e648
test al, al
je 0x51a052
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.0046ec14
test al, al
je 0x51a04a
mov ecx, ebx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.0046ea2c
mov eax, dword [ebp - 0xc]
call fcn.0046e4d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51a06f
mov eax, dword [ebp - 0xc]
call fcn.0040444c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51a09e
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004053c0
lea eax, [ebp - 8]
mov edx, 2
call fcn.004053c0
ret
Function at 0x51a0f0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x20], edx
mov esi, eax
lea edi, [ebp - 4]
xor ecx, ecx
mov cl, byte [esi]
cmp cl, 2
jb 0x51a10e
mov cl, 2
mov byte [edi], cl
inc esi
inc edi
rep movsb byte es:[edi], byte [esi]
xor eax, eax
push ebp
push 0x51a200
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xff
call fcn.0040dcec
mov dword [ebp - 0xc], eax
lea edx, [ebp - 4]
lea eax, [ebp - 0x24]
call fcn.004039a4
mov edx, 0x51a214
lea eax, [ebp - 0x24]
mov cl, 3
call fcn.00403974
lea edx, [ebp - 0x24]
lea eax, [ebp - 0x20]
call fcn.00405600
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc]
call fcn.0040db68
push 0x8001
call sub.kernel32.dll_SetErrorMode
mov word [ebp - 8], ax
xor eax, eax
push ebp
push 0x51a1e3
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x51a1b5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetDiskFreeSpaceA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x51a1c3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51a1ea
mov eax, dword [ebp - 0xc]
call fcn.0040dd48
movzx eax, word [ebp - 8]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x51abbc
Capabilities:
Compare security identifiers

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov byte [esp], 0
lea eax, [esp + 4]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
mov ebx, eax
test ebx, ebx
jne 0x51ac00
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x3f0
jne 0x51ac00
lea eax, [esp + 4]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
mov ebx, eax
test ebx, ebx
je 0x51acab
lea eax, [esp + 8]
push eax
push 0
push 0
push 2
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_GetTokenInformation
mov eax, dword [esp + 8]
call fcn.00402df4
mov esi, eax
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
push esi
push 2
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_GetTokenInformation
mov ebx, eax
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_CloseHandle_1
test ebx, ebx
je 0x51aca4
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
push 0x5696a8
call sub.advapi32.dll_AllocateAndInitializeSid
mov ebx, dword [esi]
dec ebx
test ebx, ebx
jl 0x51ac9a
inc ebx
xor edi, edi
mov eax, dword [esi + edi*8 + 4]
push eax
mov eax, dword [esp + 0x10]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x51ac96
mov byte [esp], 1
jmp 0x51ac9a
inc edi
dec ebx
jne 0x51ac7d
mov eax, dword [esp + 0xc]
push eax
call sub.advapi32.dll_FreeSid
mov eax, esi
call fcn.00402e24
mov al, byte [esp]
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x51af84
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405868
mov eax, dword [ebp - 8]
call fcn.00405868
xor eax, eax
push ebp
push 0x51b0b1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
call fcn.0040c340
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], 1
mov eax, dword [ebp - 0x18]
call fcn.0040c340
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00405878
mov esi, eax
push esi
mov eax, dword [ebp - 4]
call fcn.00405878
mov ebx, eax
push ebx
call sub.advapi32.dll_LookupAccountNameA
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0x14]
call fcn.00402e44
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0x18]
call fcn.00402e44
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0xc]
push eax
push esi
push ebx
call sub.advapi32.dll_LookupAccountNameA
test eax, eax
je 0x51b069
mov edx, edi
mov eax, dword [ebp - 0xc]
call fcn.0051ae68
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_GetSidSubAuthorityCount
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_GetLengthSid
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0x10]
call fcn.0040dcd8
jmp 0x51b07e
call sub.kernel32.dll_GetLastError_1
test eax, eax
jns 0x51b077
call fcn.00404388
mov edx, edi
call fcn.0051790c
mov eax, dword [ebp - 0x10]
call fcn.00402e24
mov eax, dword [ebp - 0xc]
call fcn.00402e24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51b0b8
lea eax, [ebp - 0x20]
call fcn.0040539c
lea eax, [ebp - 8]
mov edx, 2
call fcn.004053c0
ret
Function at 0x51b754
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe24
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1dc], edx
mov esi, eax
xor eax, eax
push ebp
push 0x51b83f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1d8]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, esi
call fcn.0040539c
push 0x40
lea eax, [ebp - 0x48]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x48]
push eax
call sub.wsock32.dll_gethostbyname
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x51b826
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov dword [ebp - 8], eax
xor ebx, ebx
jmp 0x51b7f5
push dword [esi]
cmp ebx, 0xff
jbe 0x51b7c9
call fcn.00404388
push dword [edi]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 0x1dc]
call fcn.00405594
push dword [ebp - 0x1dc]
push 0x51b858
mov eax, esi
mov edx, 3
call fcn.00405738
inc ebx
cmp ebx, 0xff
jbe 0x51b802
call fcn.00404388
mov eax, dword [ebp - 8]
mov edi, dword [eax + ebx*4]
test edi, edi
jne 0x51b7ba
mov eax, dword [esi]
call fcn.00405678
mov edx, eax
mov eax, esi
mov ecx, 1
call fcn.00405918
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51b846
lea eax, [ebp - 0x1dc]
call fcn.0040539c
ret
Function at 0x51d8c8
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x51da00
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea eax, [ebp - 8]
mov edx, 0x104
call fcn.00405a04
push 0x104
lea eax, [ebp - 8]
call fcn.004058d0
push eax
push 0x51da14
call sub.kernel32.dll_GetEnvironmentVariableA
mov edx, eax
lea eax, [ebp - 8]
call fcn.00405a04
mov eax, dword [ebp - 8]
call fcn.00405678
test eax, eax
jle 0x51d9e2
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.00403ac0
mov dword [ebp - 0x4c], 0x44
mov dword [ebp - 0x20], 1
mov word [ebp - 0x1c], 0
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 0x210
push 0
push 0
push 0
push dword [ebp - 8]
push 0x51da24
push ebx
push 0x51da34
push esi
lea eax, [ebp - 0x60]
mov edx, 5
call fcn.00405738
mov eax, dword [ebp - 0x60]
call fcn.00405878
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x51d9e2
xor eax, eax
push ebp
push 0x51d9db
push dword fs:[eax]
mov dword fs:[eax], esp
push edi
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
setne byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51d9e2
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51da07
lea eax, [ebp - 0x60]
call fcn.0040539c
lea eax, [ebp - 8]
call fcn.0040539c
ret

Function at 0x51da38
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00405878
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x51da55
and eax, 0x10
cmp eax, 0x10
je 0x51da59
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x51e0fc
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
test dl, dl
je 0x51e110
add esp, 0xfffffff0
call fcn.004047c4
mov ebx, edx
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.0051c418
lea eax, [ebp - 0x24]
xor ecx, ecx
mov edx, 0x24
call fcn.00403ac0
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x20]
mov dword [esi + 0xa8], eax
mov eax, esi
test bl, bl
je 0x51e153
call fcn.0040481c
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5316cc
Capabilities:
Check for time delay via gettickcount
Check for time delay via queryperformancecounter

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffc8
mov esi, edx
mov edi, eax
call fcn.005316c8
mov dword [esp], eax
mov dword [esp + 4], edx
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_QueryPerformanceCounter
call sub.kernel32.dll_GetTickCount
mov ebx, eax
push edi
call sub.kernel32.dll_Sleep
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 5
jb 0x5316f9
call fcn.005316c8
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
lea eax, [esp + 0x18]
push eax
call sub.kernel32.dll_QueryPerformanceCounter
lea eax, [esp + 0x20]
push eax
call sub.kernel32.dll_QueryPerformanceFrequency
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, dword [esp + 8]
sbb edx, dword [esp + 0xc]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], edx
fild qword [esp + 0x28]
fild qword [esp + 0x20]
fdivp st(1)
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
sub eax, dword [esp]
sbb edx, dword [esp + 4]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], edx
fild qword [esp + 0x30]
fdivrp st(1)
fdiv dword [0x531788]
call fcn.0040348c
mov ebx, eax
mov dword [esi], ebx
mov eax, ebx
call fcn.0053137c
mov dword [esi + 4], eax
mov dword [esi + 8], edi
add esp, 0x38
pop edi
pop esi
pop ebx
ret

Function at 0x53c554
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe24
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1dc], ecx
mov esi, edx
xor eax, eax
push ebp
push 0x53c625
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1d8]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, esi
call fcn.0040539c
push 0x40
lea eax, [ebp - 0x48]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x48]
push eax
call sub.wsock32.dll_gethostbyname
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x53c60c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov dword [ebp - 8], eax
xor ebx, ebx
jmp 0x53c5e8
push dword [esi]
push dword [edi]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 0x1dc]
call fcn.00405594
push dword [ebp - 0x1dc]
push 0x53c63c
mov eax, esi
mov edx, 3
call fcn.00405738
inc ebx
mov eax, dword [ebp - 8]
mov edi, dword [eax + ebx*4]
test edi, edi
jne 0x53c5ba
mov eax, dword [esi]
call fcn.00405678
mov edx, eax
mov eax, esi
mov ecx, 1
call fcn.00405918
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53c62c
lea eax, [ebp - 0x1dc]
call fcn.0040539c
ret