joyce8/EMBER2024-capa huggingface dataset:
Function at 0x57a9dc
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbac
xor eax, eax
mov dword [ebp - 4], eax
movsx edx, byte [ebp + 8]
push edx
push str._c:.
lea ecx, [ebp - 0x454]
push ecx
call fcn.00670e94
add esp, 0xc
lea eax, [ebp - 0x24c]
push eax
lea edx, [ebp - 0x454]
push edx
call sub.KERNEL32.DLL_FindFirstFileA
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x57ab21
push 0x81291e
lea edx, [ebp - 0x220]
push edx
call fcn.0066c9a0
add esp, 8
test eax, eax
je 0x57ab02
push 0x812920
lea ecx, [ebp - 0x220]
push ecx
call fcn.0066c9a0
add esp, 8
test eax, eax
je 0x57ab02
test byte [ebp - 0x24c], 0x10
je 0x57ab02
lea eax, [ebp - 0x220]
push eax
movsx edx, byte [ebp + 8]
push edx
push str._c:_sNTDETECT.COM
lea ecx, [ebp - 0x10c]
push ecx
call fcn.00670e94
add esp, 0x10
push 0
lea eax, [ebp - 0x10c]
push eax
call fcn.0066e7cc
add esp, 8
test eax, eax
jne 0x57aa9f
inc dword [ebp - 4]
lea edx, [ebp - 0x220]
push edx
movsx ecx, byte [ebp + 8]
push ecx
push str._c:_sSETUPLDR.BIN
lea eax, [ebp - 0x10c]
push eax
call fcn.00670e94
add esp, 0x10
push 0
lea edx, [ebp - 0x10c]
push edx
call fcn.0066e7cc
add esp, 8
test eax, eax
jne 0x57aad7
inc dword [ebp - 4]
mov ecx, dword [ebp - 4]
dec ecx
jle 0x57aafd
lea eax, [ebp - 0x220]
push eax
movsx edx, byte [ebp + 8]
push edx
push str._c:_s
push 0xd12ccc
call fcn.00670e94
add esp, 0x10
jmp 0x57ab19
xor ecx, ecx
mov dword [ebp - 4], ecx
lea eax, [ebp - 0x24c]
push eax
push dword [ebp - 8]
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
jne 0x57aa22
push dword [ebp - 8]
call sub.KERNEL32.DLL_FindClose
mov edx, dword [ebp - 4]
dec edx
jle 0x57ab2e
mov eax, 1
jmp 0x57ab30
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x57ac24
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
mov al, byte [0xd12ccc]
test al, al
jne 0x57ac40
mov eax, 1
jmp 0x57ae47
mov dword [ebp - 4], 0xd12ccc
push dword [ebp - 4]
push str._sNTDETECT.COM
lea edx, [ebp - 0x108]
push edx
call fcn.00670e94
add esp, 0xc
movsx ecx, byte [ebp + 8]
push ecx
push str._c:NTDETECT.COM
lea eax, [ebp - 0x20c]
push eax
call fcn.00670e94
add esp, 0xc
push 0
lea edx, [ebp - 0x108]
push edx
call fcn.0066e7cc
add esp, 8
test eax, eax
jne 0x57acef
push 0
lea ecx, [ebp - 0x20c]
push ecx
call fcn.0066e7cc
add esp, 8
test eax, eax
je 0x57acef
lea eax, [ebp - 0x20c]
push eax
lea edx, [ebp - 0x108]
push edx
push 0x5aad
call fcn.00402a64
pop ecx
push eax
push 0x9f2fb4
call fcn.00670e94
add esp, 0x10
mov edx, 0x9f2fb4
or ecx, 0xffffffff
mov eax, dword [sym.UltraISO.exe__frmUSBWrite]
call fcn.0056f540
push 1
lea eax, [ebp - 0x20c]
push eax
lea edx, [ebp - 0x108]
push edx
call sub.KERNEL32.DLL_CopyFileA
push 0
lea ecx, [ebp - 0x20c]
push ecx
call fcn.0066e7cc
add esp, 8
test eax, eax
je 0x57ad46
lea eax, [ebp - 0x20c]
push eax
lea edx, [ebp - 0x108]
push edx
push 0x4eaa
call fcn.00402a64
pop ecx
push eax
push 0x9f2fb4
call fcn.00670e94
add esp, 0x10
mov edx, 0x9f2fb4
mov ecx, 6
mov eax, dword [sym.UltraISO.exe__frmUSBWrite]
call fcn.0056f540
xor eax, eax
jmp 0x57ae47
push dword [ebp - 4]
push str._sSETUPLDR.BIN
lea edx, [ebp - 0x108]
push edx
call fcn.00670e94
add esp, 0xc
movsx ecx, byte [ebp + 8]
push ecx
push str._c:NTLDR
lea eax, [ebp - 0x20c]
push eax
call fcn.00670e94
add esp, 0xc
push 0
lea edx, [ebp - 0x108]
push edx
call fcn.0066e7cc
add esp, 8
test eax, eax
jne 0x57adee
push 0
lea ecx, [ebp - 0x20c]
push ecx
call fcn.0066e7cc
add esp, 8
test eax, eax
je 0x57adee
lea eax, [ebp - 0x20c]
push eax
lea edx, [ebp - 0x108]
push edx
push 0x5aad
call fcn.00402a64
pop ecx
push eax
push 0x9f2fb4
call fcn.00670e94
add esp, 0x10
mov edx, 0x9f2fb4
or ecx, 0xffffffff
mov eax, dword [sym.UltraISO.exe__frmUSBWrite]
call fcn.0056f540
push 1
lea eax, [ebp - 0x20c]
push eax
lea edx, [ebp - 0x108]
push edx
call sub.KERNEL32.DLL_CopyFileA
push 0
lea ecx, [ebp - 0x20c]
push ecx
call fcn.0066e7cc
add esp, 8
test eax, eax
je 0x57ae42
lea eax, [ebp - 0x20c]
push eax
lea edx, [ebp - 0x108]
push edx
push 0x4eaa
call fcn.00402a64
pop ecx
push eax
push 0x9f2fb4
call fcn.00670e94
add esp, 0x10
mov edx, 0x9f2fb4
mov ecx, 6
mov eax, dword [sym.UltraISO.exe__frmUSBWrite]
call fcn.0056f540
xor eax, eax
jmp 0x57ae47
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x57ae4c
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
movsx eax, byte [ebp + 8]
push eax
push str._c:_syslinux.cfg
lea edx, [ebp - 0x20c]
push edx
call fcn.00670e94
add esp, 0xc
push 0
lea ecx, [ebp - 0x20c]
push ecx
call fcn.0066e7cc
add esp, 8
test eax, eax
jne 0x57ae8d
mov eax, 1
jmp 0x57b024
movsx edx, byte [ebp + 8]
push edx
push str._c:_syslinux_syslinux.cfg
lea ecx, [ebp - 0x20c]
push ecx
call fcn.00670e94
add esp, 0xc
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.0066e7cc
add esp, 8
test eax, eax
jne 0x57aec5
mov eax, 1
jmp 0x57b024
movsx edx, byte [ebp + 8]
push edx
push str._c:_boot_syslinux_syslinux.cfg
lea ecx, [ebp - 0x20c]
push ecx
call fcn.00670e94
add esp, 0xc
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.0066e7cc
add esp, 8
test eax, eax
jne 0x57aefd
mov eax, 1
jmp 0x57b024
mov dl, byte [0xd12ccc]
test dl, dl
jne 0x57af1e
movsx ecx, byte [ebp + 8]
push ecx
push 0x8129d7
push 0xd12ccc
call fcn.00670e94
add esp, 0xc
mov dword [ebp - 4], 0xd12ccc
push dword [ebp - 4]
push str._sisolinux.cfg
lea eax, [ebp - 0x108]
push eax
call fcn.00670e94
add esp, 0xc
push dword [ebp - 4]
push str._s_syslinux.cfg
lea edx, [ebp - 0x20c]
push edx
call fcn.00670e94
add esp, 0xc
push 0
lea ecx, [ebp - 0x108]
push ecx
call fcn.0066e7cc
add esp, 8
test eax, eax
jne 0x57afcb
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.0066e7cc
add esp, 8
test eax, eax
je 0x57afcb
lea edx, [ebp - 0x20c]
push edx
lea ecx, [ebp - 0x108]
push ecx
push 0x5aad
call fcn.00402a64
pop ecx
push eax
push 0x9f2fb4
call fcn.00670e94
add esp, 0x10
mov edx, 0x9f2fb4
or ecx, 0xffffffff
mov eax, dword [sym.UltraISO.exe__frmUSBWrite]
call fcn.0056f540
push 1
lea eax, [ebp - 0x20c]
push eax
lea edx, [ebp - 0x108]
push edx
call sub.KERNEL32.DLL_CopyFileA
push 0
lea ecx, [ebp - 0x20c]
push ecx
call fcn.0066e7cc
add esp, 8
test eax, eax
je 0x57b01f
lea eax, [ebp - 0x20c]
push eax
lea edx, [ebp - 0x108]
push edx
push 0x4eaa
call fcn.00402a64
pop ecx
push eax
push 0x9f2fb4
call fcn.00670e94
add esp, 0x10
mov edx, 0x9f2fb4
mov ecx, 6
mov eax, dword [sym.UltraISO.exe__frmUSBWrite]
call fcn.0056f540
xor eax, eax
jmp 0x57b024
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x57e2f8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x61c]
test edx, edx
je 0x57e335
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x61c]
add eax, 0xc
push eax
lea edx, [ebp - 0x128]
push edx
call fcn.0066c9ec
add esp, 8
jmp 0x57e352
mov ecx, dword [ebp - 4]
push dword [ecx + 0x510]
push 0x814584
lea eax, [ebp - 0x128]
push eax
call fcn.00670e94
add esp, 0xc
push 0
push 0
push 3
push 0
push 3
push SysReAllocStringLen
lea edx, [ebp - 0x128]
push edx
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
cmp ecx, 0xffffffff
jne 0x57e3d9
call sub.KERNEL32.DLL_GetLastError
cmp eax, 5
jne 0x57e39d
push 0x5a86
call fcn.00402a64
pop ecx
push eax
push 0x9f2fb4
call fcn.00670e94
add esp, 8
jmp 0x57e3bc
call sub.KERNEL32.DLL_GetLastError
push eax
push 0x5aa4
call fcn.00402a64
pop ecx
push eax
push 0x9f2fb4
call fcn.00670e94
add esp, 0xc
push 0x9f2fb4
mov eax, dword [ebp - 4]
call fcn.00640730
push eax
call fcn.004627e0
add esp, 8
xor eax, eax
jmp 0x57e4b2
push 0
push pe_nt_image_headers32
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.006744e4
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
push 0
lea ecx, [ebp - 0x1c]
push ecx
push dword [ebp - 0x20]
push dword [ebp - 0x10]
call sub.KERNEL32.DLL_SetFilePointer
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
cmp eax, 0xffffffff
jne 0x57e448
call sub.KERNEL32.DLL_GetLastError
test eax, eax
je 0x57e448
push 0x4ef2
call fcn.00402a64
pop ecx
push eax
push 0x9f2fb4
call fcn.00670e94
add esp, 8
push 0x9f2fb4
mov eax, dword [ebp - 4]
call fcn.00640730
push eax
call fcn.004627e0
add esp, 8
xor eax, eax
jmp 0x57e4b2
push 0
lea edx, [ebp - 0x18]
push edx
push pe_nt_image_headers32
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call sub.KERNEL32.DLL_ReadFile
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x57e472
mov eax, dword [ebp - 0x18]
cmp eax, 0x200
je 0x57e4a5
push 0x4ef2
call fcn.00402a64
pop ecx
push eax
push 0x9f2fb4
call fcn.00670e94
add esp, 8
push 0x9f2fb4
mov eax, dword [ebp - 4]
call fcn.00640730
push eax
call fcn.004627e0
add esp, 8
xor eax, eax
jmp 0x57e4b2
push dword [ebp - 0x10]
call sub.KERNEL32.DLL_CloseHandle
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x57e4b8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 0x518
push eax
push 0x4ef4
call fcn.00402a64
pop ecx
push eax
push 0x9f2fb4
call fcn.00670e94
add esp, 0xc
push 0x9f2fb4
mov eax, dword [ebp - 4]
call fcn.00640730
push eax
call fcn.0046297c
add esp, 8
test eax, eax
jne 0x57e50d
xor eax, eax
jmp 0x57e6d5
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x61c]
test ecx, ecx
je 0x57e538
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x61c]
add edx, 0xc
push edx
lea ecx, [ebp - 0x128]
push ecx
call fcn.0066c9ec
add esp, 8
jmp 0x57e555
mov eax, dword [ebp - 4]
push dword [eax + 0x510]
push 0x814598
lea edx, [ebp - 0x128]
push edx
call fcn.00670e94
add esp, 0xc
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
lea ecx, [ebp - 0x128]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, 0xffffffff
jne 0x57e5dc
call sub.KERNEL32.DLL_GetLastError
cmp eax, 5
jne 0x57e5a0
push 0x5a86
call fcn.00402a64
pop ecx
push eax
push 0x9f2fb4
call fcn.00670e94
add esp, 8
jmp 0x57e5bf
call sub.KERNEL32.DLL_GetLastError
push eax
push 0x5aa4
call fcn.00402a64
pop ecx
push eax
push 0x9f2fb4
call fcn.00670e94
add esp, 0xc
push 0x9f2fb4
mov eax, dword [ebp - 4]
call fcn.00640730
push eax
call fcn.004627e0
add esp, 8
xor eax, eax
jmp 0x57e6d5
push 0
push pe_nt_image_headers32
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.006744e4
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
push 0
lea ecx, [ebp - 0x1c]
push ecx
push dword [ebp - 0x20]
push dword [ebp - 0x10]
call sub.KERNEL32.DLL_SetFilePointer
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
cmp eax, 0xffffffff
jne 0x57e64e
call sub.KERNEL32.DLL_GetLastError
test eax, eax
je 0x57e64e
push 0x4e97
call fcn.00402a64
pop ecx
push eax
push 0x9f2fb4
call fcn.00670e94
add esp, 8
push 0x9f2fb4
mov eax, dword [ebp - 4]
call fcn.00640730
push eax
call fcn.004627e0
add esp, 8
xor eax, eax
jmp 0x57e6d5
push 0
lea edx, [ebp - 0x18]
push edx
push pe_nt_image_headers32
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call sub.KERNEL32.DLL_WriteFile
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x57e678
mov eax, dword [ebp - 0x18]
cmp eax, 0x200
je 0x57e6ab
push 0x4e97
call fcn.00402a64
pop ecx
push eax
push 0x9f2fb4
call fcn.00670e94
add esp, 8
push 0x9f2fb4
mov eax, dword [ebp - 4]
call fcn.00640730
push eax
call fcn.004627e0
add esp, 8
xor eax, eax
jmp 0x57e6d5
push dword [ebp - 0x10]
call sub.KERNEL32.DLL_CloseHandle
push 0x4ef3
call fcn.00402a64
pop ecx
push eax
mov eax, dword [ebp - 4]
call fcn.00640730
push eax
call fcn.004627e0
add esp, 8
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x57eecc
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0x104
push 0
lea eax, [ebp - 0x124]
push eax
call fcn.0066c86c
add esp, 0xc
lea edx, [ebp - 0x124]
push edx
push 0x104
call sub.KERNEL32.DLL_GetLogicalDriveStringsA
mov dword [ebp - 0x10], eax
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
cmp eax, edx
jge 0x57efd4
lea ecx, [ebp - 0x124]
mov eax, dword [ebp - 0xc]
add ecx, eax
push ecx
call sub.KERNEL32.DLL_GetDriveTypeA
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
cmp edx, 2
je 0x57ef3c
mov ecx, dword [ebp - 0x14]
cmp ecx, 3
jne 0x57efb5
mov eax, dword [ebp - 0xc]
mov dl, byte [ebp + eax - 0x124]
mov byte [ebp - 0x15], dl
movsx ecx, byte [ebp - 0x15]
cmp ecx, 0x61
jl 0x57ef5f
movsx eax, byte [ebp - 0x15]
cmp eax, 0x7a
jg 0x57ef5f
add byte [ebp - 0x15], 0xe0
mov edx, dword [ebp - 0x14]
cmp edx, 2
jne 0x57ef79
movsx ecx, byte [ebp - 0x15]
cmp ecx, 0x41
je 0x57efc3
movsx eax, byte [ebp - 0x15]
cmp eax, 0x42
je 0x57efc3
lea edx, [ebp - 0x20]
push edx
lea ecx, [ebp - 0x1c]
push ecx
mov al, byte [ebp - 0x15]
push eax
call fcn.00565ca8
add esp, 0xc
test al, al
je 0x57efc3
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x510]
inc ecx
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
jne 0x57efb5
mov edx, dword [ebp - 8]
inc edx
mov ecx, dword [ebp - 0x20]
cmp edx, ecx
jne 0x57efb5
mov al, byte [ebp - 0x15]
jmp 0x57efd6
inc dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
mov cl, byte [ebp + edx - 0x124]
test cl, cl
jne 0x57efb2
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
cmp eax, edx
jl 0x57ef18
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x57efdc
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed8
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
movsx eax, byte [ebp - 5]
push eax
push str._c:_
lea edx, [ebp - 0x1c]
push edx
call fcn.00670e94
add esp, 0xc
push 1
call sub.KERNEL32.DLL_SetErrorMode
mov dword [ebp - 0x10], eax
push 0x100
push 0
push dword [ebp - 0xc]
call fcn.0066c86c
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x128]
push ecx
lea eax, [ebp - 0x24]
push eax
lea edx, [ebp - 0x20]
push edx
push 0
push 0x100
push dword [ebp - 0xc]
lea ecx, [ebp - 0x1c]
push ecx
call sub.KERNEL32.DLL_GetVolumeInformationA
push dword [ebp - 0x10]
call sub.KERNEL32.DLL_SetErrorMode
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x586944
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov eax, dword [0x8160dc]
mov edx, dword [0x8160e0]
xor dword [ebp + 8], eax
xor dword [ebp + 0xc], edx
cmp dword [ebp + 0x10], 0
jne 0x5869f7
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
xor edx, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
and eax, 1
xor edx, edx
cmp edx, 0
jne 0x586991
cmp eax, 0
je 0x5869b3
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
shrd eax, edx, 1
shr edx, 1
xor eax, dword [0x8160d4]
xor edx, dword [0x8160d8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
jmp 0x5869c5
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
shrd eax, edx, 1
shr edx, 1
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 8
jb 0x58697b
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov dword [eax*8 + 0xd12e78], edx
mov edx, dword [ebp - 8]
mov dword [eax*8 + 0xd12e7c], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x100
jb 0x58696b
jmp 0x586a3c
cmp dword [ebp + 0x14], 0
je 0x586a3c
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
xor al, byte [edx]
and al, 0xff
mov byte [ebp - 1], al
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
shrd eax, edx, 8
shr edx, 8
xor ecx, ecx
mov cl, byte [ebp - 1]
xor eax, dword [ecx*8 + 0xd12e78]
xor edx, dword [ecx*8 + 0xd12e7c]
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], edx
dec dword [ebp + 0x14]
inc dword [ebp + 0x10]
cmp dword [ebp + 0x14], 0
jne 0x5869fd
mov eax, dword [0x8160dc]
mov edx, dword [0x8160e0]
xor dword [ebp + 8], eax
xor dword [ebp + 0xc], edx
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x58d014
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 8], 0xffffffff
mov eax, dword [ebp + 8]
dec eax
je 0x58d055
dec eax
je 0x58d03b
sub eax, 2
je 0x58d066
jmp 0x58d09f
lea edx, [ebp - 0x94]
push edx
call sub.KERNEL32.DLL_GetSystemInfo
mov ecx, dword [ebp - 0x80]
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
jmp 0x58d09f
lea edx, [ebp - 0x30]
push edx
call sub.KERNEL32.DLL_GetSystemInfo
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 4], ecx
jmp 0x58d09f
mov dword [ebp - 0x70], 0x40
push 1
call fcn.0058d014
pop ecx
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
call sub.KERNEL32.DLL_GlobalMemoryStatusEx
test eax, eax
je 0x58d09f
cmp dword [ebp - 8], 0xffffffff
je 0x58d09f
mov eax, dword [ebp - 8]
cdq
push edx
push eax
mov eax, dword [ebp - 0x68]
mov edx, dword [ebp - 0x64]
call fcn.0067457f
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x5a13b5
Capabilities:
Terminate process

Disassembly:
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov ebp, eax
mov eax, dword [0x76d80e]
push eax
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov ebx, eax
mov eax, dword [0x76d822]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_LocalAlloc]
mov esi, eax
mov eax, dword [0x76d81e]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 0x104
push esi
push 0
call eax
xor edx, edx
xor eax, eax
movzx ecx, word [esi + edx*2]
cmp ecx, 0x5c
je 0x5a153c
test ecx, ecx
je 0x5a140d
inc edx
jmp 0x5a13f9
mov ecx, dword [0x76d816]
lea edx, [esi + eax*2]
cmp dword [ecx], 0
je 0x5a146e
movzx esi, word [edx + 2]
xor eax, eax
test esi, esi
je 0x5a1531
inc eax
movzx edi, word [edx + eax*2 + 2]
test edi, edi
jne 0x5a1429
movzx eax, al
cmp al, byte [ecx]
je 0x5a144b
cmp al, byte [ecx + 1]
jne 0x5a1522
test esi, esi
je 0x5a152a
xor eax, eax
xor esi, esi
movzx edi, word [edx + esi*2 + 2]
inc esi
add eax, edi
movzx edi, word [edx + esi*2 + 2]
test edi, edi
jne 0x5a144f
cmp eax, dword [ecx + 4]
je 0x5a146e
cmp eax, dword [ecx + 8]
jne 0x5a1522
mov dword [esp], 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
mov edx, eax
mov eax, dword [0x76d822]
push eax
push 0
push edx
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov edx, eax
xor eax, eax
mov ecx, dword [0x76d81a]
mov esi, dword [ecx + eax]
mov dword [eax + edx], esi
add eax, 4
cmp eax, 0x40
jl 0x5a1490
push edx
push ebx
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov edi, eax
test edi, edi
je 0x5a1522
mov esi, dword [0x76d802]
lea ebx, [esp]
push ebx
mov eax, dword [0x76d806]
push eax
push 0x7000
push esi
call edi
mov eax, dword [0x76d7f6]
add ebp, eax
xor edx, edx
mov eax, dword [ebp + 4]
mov ecx, dword [ebp + edx*8 + 8]
add ecx, eax
mov dword [esi + edx*8 + 8], ecx
mov ecx, dword [ebp + edx*8 + 0xc]
add ecx, eax
mov dword [esi + edx*8 + 0xc], ecx
inc edx
cmp edx, 0xdff
jb 0x5a14d6
mov eax, dword [0x76d80a]
push ebx
mov dword [esi + 8], eax
push dword [esp + 4]
push 0x7000
push esi
call edi
mov ecx, dword [esi + 0xc]
add ecx, esi
mov eax, dword [0x76d812]
add ecx, eax
mov edx, dword [0x76d812]
add esi, edx
push esi
call ecx
add esp, 4
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
xor eax, eax
jmp 0x5a1460
cmp byte [ecx], 0
jne 0x5a143a
jmp 0x5a152a
mov eax, edx
jmp 0x5a140a
Function at 0x5a5370
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
push 0
call fcn.00679560
pop ecx
mov ebx, eax
call fcn.006776ac
shl eax, 0x10
xor ebx, eax
push ebx
call fcn.006752ec
pop ecx
xor eax, eax
mov dword [ebp - 4], eax
call fcn.00675318
and al, 0xff
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov byte [ecx + edx], al
cmp dword [ebp - 4], 7
jne 0x5a53c5
mov eax, dword [ebp - 8]
mov dl, byte [eax + 7]
and dl, 0xf
or dl, 0x40
mov ecx, dword [ebp - 8]
mov byte [ecx + 7], dl
cmp dword [ebp - 4], 8
jne 0x5a53dd
mov eax, dword [ebp - 8]
mov dl, byte [eax + 8]
and dl, 0x3f
or dl, 0x80
mov ecx, dword [ebp - 8]
mov byte [ecx + 8], dl
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x10
jb 0x5a539d
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x5a698d
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push 0
lea eax, [ebp - 0xc]
push eax
push 8
lea edx, [ebp - 8]
push edx
push 0
push 0
push 0x7405c
push dword [ebp + 8]
call sub.KERNEL32.DLL_DeviceIoControl
test eax, eax
jne 0x5a69ce
call sub.KERNEL32.DLL_GetLastError
push eax
call fcn.005a64f0
pop ecx
mov dword [0xd1470c], eax
mov eax, 0xffffffff
mov edx, eax
jmp 0x5a69d4
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x5a69d8
Capabilities:
Get volume information via ioctl

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push 0
lea eax, [ebp - 0xc]
push eax
push 0x60
lea edx, [ebp - 0x6c]
push edx
push 0
push 0
push 0x90064
push dword [ebp + 8]
call sub.KERNEL32.DLL_DeviceIoControl
test eax, eax
jne 0x5a6a19
call sub.KERNEL32.DLL_GetLastError
push eax
call fcn.005a64f0
pop ecx
mov dword [0xd1470c], eax
mov eax, 0xffffffff
mov edx, eax
jmp 0x5a6a37
mov eax, dword [ebp - 0x44]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x64]
mov edx, dword [ebp - 0x60]
call fcn.006744e4
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov esp, ebp
pop ebp
ret