joyce8/EMBER2024-capa huggingface dataset:
Function at 0x58dcb0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push esi
mov esi, ecx
mov eax, dword [ecx + 0x134]
cmp dword [eax + 8], 1
jne 0x58dce5
mov eax, dword [edx + 0x48c]
test eax, eax
je 0x58dce5
add edx, 0x438
push eax
push str.SIZE__s
push edx
push esi
call fcn.005ba900
add esp, 0x10
test eax, eax
je 0x58dced
pop esi
ret
mov ecx, esi
pop esi
jmp fcn.0058dd00
mov ecx, esi
mov edx, 0x17
call fcn.0058bbd0
xor eax, eax
pop esi
ret

Function at 0x58dd00
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push esi
mov esi, ecx
mov eax, dword [ecx + 0x134]
cmp dword [eax + 8], 0
je 0x58dd35
cmp dword [edx + 0x48c], 0
je 0x58dd35
add edx, 0x438
push 0
push str.REST__d
push edx
push esi
call fcn.005ba900
add esp, 0x10
test eax, eax
je 0x58dd3d
pop esi
ret
mov ecx, esi
pop esi
jmp fcn.0058dd50
mov ecx, esi
mov edx, 0x1a
call fcn.0058bbd0
xor eax, eax
pop esi
ret

Function at 0x58dd50
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push esi
mov esi, ecx
mov eax, dword [ecx + 0x134]
cmp dword [eax + 8], 0
je 0x58dd7e
mov ecx, esi
mov edx, 0xd
call fcn.0058bbd0
mov ecx, esi
mov edx, 1
push 0xd
call fcn.0058c5d0
add esp, 4
pop esi
ret
cmp byte [esi + 0x712], 0
je 0x58dd91
mov ecx, esi
xor edx, edx
pop esi
jmp fcn.0058de20
mov edx, dword [esi + 0xc]
cmp byte [esi + 0x715], 0
je 0x58ddbe
mov eax, dword [edx + 0x48c]
add edx, 0x438
test eax, eax
je 0x58ddc6
cmp byte [esi + 0x721], 0
je 0x58ddec
push eax
push str.PRET_STOR__s
jmp 0x58ddf2
mov ecx, esi
pop esi
jmp fcn.0058cd80
mov eax, dword [esi + 0x54c]
test eax, eax
jne 0x58dde4
cmp byte [esi + 0xd15], 0
mov ecx, str.LIST
mov eax, str.NLST
cmove eax, ecx
push eax
push str.PRET__s
jmp 0x58ddf2
push eax
push str.PRET_RETR__s
push edx
push esi
call fcn.005ba900
add esp, 0x10
test eax, eax
je 0x58de02
pop esi
ret
mov ecx, esi
mov edx, 0x1d
call fcn.0058bbd0
xor eax, eax
pop esi
ret
Function at 0x58ec20
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, ecx
mov eax, dword [0x7c3824]
xor eax, esp
mov dword [esp + 0x14], eax
mov edi, dword [ecx + 0xc]
mov ebx, dword [edi + 0x14c]
mov dword [esp], 0x10
mov ebp, esp
lea eax, [esp + 4]
push ebp
push eax
push ebx
call dword [sym.imp.WSOCK32.dll_getsockname]
test eax, eax
je 0x58ec8a
push ebx
push edi
push esi
call fcn.00529660
add esp, 0xc
push str.Error_accept__ing_server_connect
push esi
call fcn.0051ed60
add esp, 8
mov ebx, 0x1e
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.005db451
mov eax, ebx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp], 0x10
push ebp
lea eax, [esp + 8]
push eax
push ebx
call dword [sym.imp.WSOCK32.dll_accept]
mov ebp, eax
push ebx
push edi
push esi
call fcn.00529660
add esp, 0xc
cmp ebp, 0xffffffff
je 0x58ec62
push str.Connection_accepted_from_server
push esi
call fcn.0051ec50
add esp, 8
mov byte [edi + 0x266], 0
mov dword [edi + 0x14c], ebp
push 1
push ebp
call fcn.005a1350
add esp, 8
mov byte [edi + 0x279], 1
xor ebx, ebx
cmp dword [esi + 0x1b8], 0
je 0x58ec75
push 1
push esi
call fcn.00522800
add esp, 8
push 1
push ebp
push dword [esi + 0x1bc]
call dword [esi + 0x1b8]
add esp, 0xc
mov ebp, eax
push 0
push esi
call fcn.00522800
add esp, 8
test ebp, ebp
je 0x58ec75
mov ecx, esi
mov edx, edi
call fcn.0058e550
mov ebx, 0x2a
jmp 0x58ec75
Function at 0x5964e0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov ebx, edx
mov esi, ecx
mov ecx, dword [esp + 0x18]
mov eax, dword [0x7c3824]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [esi + 0xc]
mov byte [esp + 1], 0xff
mov byte [esp + 2], bl
mov edi, ecx
mov byte [esp + 3], cl
lea ecx, [esp + 1]
push 0
push 3
push ecx
push dword [eax + 0x148]
call dword [sym.imp.WSOCK32.dll_send]
test eax, eax
jns 0x596539
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push esi
call fcn.0051ed60
add esp, 0xc
mov ecx, esi
mov edx, str.SENT
push edi
push ebx
call fcn.00595df0
add esp, 8
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.005db451
add esp, 8
pop esi
pop edi
pop ebx
ret
Function at 0x5971a0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov eax, dword [0x7c3824]
xor eax, ebp
mov dword [esp + 0x90], eax
mov dword [esp + 4], ecx
mov eax, dword [ecx + 0xc]
mov esi, dword [eax + 0x438]
mov dword [esp + 0xc], 0x80
mov eax, dword [esi + 0x13c]
add eax, 4
lea ecx, [esp + 0xc]
lea edi, [esp + 0x10]
push ecx
push edi
push 0
push eax
push dword [esi + 0x148]
push dword [esi + 0x14]
call dword [sym.imp.WSOCK32.dll_recvfrom]
mov ebx, eax
mov dword [esi + 0x134], eax
cmp dword [esi + 0x130], 0
je 0x59722c
cmp ebx, 3
jg 0x597252
push str.Received_too_short_packet
push dword [esp + 8]
call fcn.0051ed60
add esp, 8
mov dword [esi + 0xc], 7
xor edi, edi
jmp 0x597365
lea eax, [esi + 0xb0]
mov ebx, dword [esp + 0xc]
push ebx
push edi
push eax
call fcn.005e2280
add esp, 0xc
mov dword [esi + 0x130], ebx
mov ebx, dword [esi + 0x134]
cmp ebx, 3
jle 0x59720d
lea edi, [esi + 0x148]
mov ecx, edi
call fcn.00597e00
movzx ecx, ax
mov dword [esi + 0xc], ecx
add eax, 0xfffffffd
cmp ax, 3
ja case.default.0x597271
movzx eax, ax
jmp dword [eax*4 + 0x639000]
cmp ebx, 5
jl case.0x597271.1
mov eax, dword [esi + 0x144]
add eax, 1
mov dword [esp + 8], eax
mov ecx, edi
call fcn.00597de0
cmp word [esp + 8], ax
jne case.0x597271.1
add ebx, 0xfffffffc
mov eax, dword [edi]
add eax, 4
push ebx
push eax
push 1
mov ebx, dword [esp + 0x10]
push ebx
call fcn.0051f270
add esp, 0x10
test eax, eax
je 0x59737d
mov edi, eax
mov ecx, esi
mov edx, 5
call fcn.00597140
jmp 0x597365
push str.Internal_error:_Unexpected_packet
push 0x65f416
push dword [esp + 0xc]
call fcn.0051ed60
jmp 0x59731e
mov ecx, edi
call fcn.00597de0
mov edi, dword [esi + 0x148]
add edi, 4
add ebx, 0xfffffffc
movzx eax, ax
mov dword [esi + 8], eax
mov ecx, edi
mov edx, ebx
call fcn.00597e10
cmp eax, ebx
jae case.0x597271.1
push edi
push str.TFTP_error:__s
push dword [esp + 0xc]
call fcn.0051ec50
add esp, 0xc
push dword [esp + 4]
call fcn.00577ae0
add esp, 4
test eax, eax
je 0x597344
mov ecx, esi
mov edx, 5
call fcn.00597140
mov edi, 0x2a
jmp 0x597365
xor edi, edi
jmp 0x597365
add ebx, 0xfffffffe
mov edx, dword [esi + 0x148]
add edx, 2
mov ecx, esi
push ebx
call fcn.00597e30
add esp, 4
mov edi, eax
test eax, eax
je case.0x597271.1
mov ecx, dword [esp + 0x90]
xor ecx, ebp
call fcn.005db451
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esi + 0x134]
mov ecx, eax
sar ecx, 0x1f
add eax, dword [ebx + 0x90]
adc ecx, dword [ebx + 0x94]
add eax, 0xfffffffc
adc ecx, 0xffffffff
mov dword [ebx + 0x90], eax
mov dword [ebx + 0x94], ecx
push ecx
push eax
push ebx
call fcn.005780c0
jmp 0x59731e

Function at 0x597d60
Capabilities:
Send data
Send data on socket

Disassembly:
push edi
push esi
mov esi, edx
mov edi, ecx
push str.Connected_for_transmit
push 0x65f416
push dword [ecx + 0x10]
call fcn.0051ec50
add esp, 0xc
mov dword [edi], 2
mov ecx, edi
call fcn.00596f60
test eax, eax
je 0x597d8f
pop esi
pop edi
ret
mov ecx, edi
mov edx, esi
pop esi
pop edi
jmp fcn.005979e0
Function at 0x597da0
Capabilities:
Send data
Send data on socket

Disassembly:
push edi
push esi
mov esi, edx
mov edi, ecx
push str.Connected_for_receive
push 0x65f416
push dword [ecx + 0x10]
call fcn.0051ec50
add esp, 0xc
mov dword [edi], 1
mov ecx, edi
call fcn.00596f60
test eax, eax
je 0x597dcf
pop esi
pop edi
ret
mov ecx, edi
mov edx, esi
pop esi
pop edi
jmp fcn.00597760
Function at 0x59f750
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov eax, dword [0x7c3824]
xor eax, ebp
mov dword [esp + 0x20], eax
lea eax, [esp + 0x10]
push eax
call fcn.0057f2b0
add esp, 4
push edi
call fcn.0057a1d0
add esp, 4
mov edi, eax
push esi
call fcn.0057a1d0
add esp, 4
mov esi, eax
push 1
push eax
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x59f7f2
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExW]
nop word cs:[eax + eax]
nop
mov eax, esp
push eax
call fcn.0057f2b0
sub esp, 0x1c
movups xmm0, xmmword [esp + 0x30]
movups xmmword [esp + 0x10], xmm0
movups xmm0, xmmword [esp + 0x20]
movups xmmword [esp], xmm0
call fcn.0057f3a0
add esp, 0x20
cmp eax, 0x3e9
sbb edx, 0
jae 0x59f823
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push esi
push edi
call ebx
test eax, eax
je 0x59f7b0
test edi, edi
je 0x59f7ff
push edi
call fcn.005fd8d5
add esp, 4
xor edi, edi
test esi, esi
je 0x59f80e
push esi
call fcn.005fd8d5
add esp, 4
mov ecx, dword [esp + 0x20]
xor ecx, ebp
call fcn.005db451
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
test edi, edi
je 0x59f830
push edi
call fcn.005fd8d5
add esp, 4
mov edi, 1
test esi, esi
jne 0x59f805
jmp 0x59f80e
Function at 0x5a207c
Capabilities:
Encode data using base64

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebx, dword [esp + 0x20]
xor eax, eax
dec eax
test ebx, ebx
je 0x5a219e
mov edi, dword [esp + 0x24]
mov ebp, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
xor ecx, ecx
cmp edi, 3
jb 0x5a2139
lea eax, [edi - 3]
mov edx, 0xaaaaaaab
mul edx
and edx, 0xfffffffe
lea eax, [edx + edx]
add eax, 4
mov dword [esp], eax
mov edx, 4
test esi, esi
je 0x5a2123
cmp edx, ebp
ja 0x5a219b
movzx eax, byte [ebx]
shr eax, 2
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi], al
movzx eax, byte [ebx]
shl eax, 4
and eax, 0x30
movzx ecx, byte [ebx + 1]
shr ecx, 4
mov al, byte [eax + ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + 1], al
movzx eax, byte [ebx + 1]
and eax, 0xf
movzx ecx, byte [ebx + 2]
shr ecx, 6
mov al, byte [ecx + eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + 2], al
movzx eax, byte [ebx + 2]
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + 3], al
add esi, 4
jmp 0x5a2125
xor esi, esi
add edi, 0xfffffffd
add ebx, 3
add edx, 4
cmp edi, 2
ja 0x5a20c2
mov ecx, dword [esp]
xor eax, eax
dec eax
test edi, edi
je 0x5a2197
add ecx, 4
test esi, esi
je 0x5a2197
cmp ecx, ebp
ja 0x5a219e
mov ebp, ecx
xor ecx, ecx
cmp edi, 2
jne 0x5a2155
movzx ecx, byte [ebx + 1]
movzx eax, byte [ebx]
shr eax, 2
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi], al
movzx eax, byte [ebx]
shl eax, 4
and eax, 0x30
mov edx, ecx
shr edx, 4
mov al, byte [edx + eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + 1], al
mov dl, 0x3d
cmp edi, 2
jne 0x5a218c
and ecx, 0xf
mov dl, byte [ecx*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + 2], dl
mov byte [esi + 3], 0x3d
mov eax, ebp
jmp 0x5a219e
mov eax, ecx
jmp 0x5a219e
xor eax, eax
dec eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x5afd8e
Capabilities:
Get file system object information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2b8
mov edi, edx
mov esi, ecx
mov eax, dword [0x7c3824]
xor eax, esp
mov dword [esp + 0x2b4], eax
mov ebx, 0x2b4
mov eax, esp
push ebx
push 0
push eax
call fcn.005e2800
add esp, 0xc
mov ebp, 0x1010
or ebp, dword [esp + 0x2d0]
mov ecx, edi
call fcn.00443c3a
push ebp
push ebx
lea ecx, [esp + 8]
push ecx
push 0x10
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x5afdfe
lea edx, [esp + 0xc]
mov ecx, esi
push dword [esp + 0x2cc]
push dword [edx - 8]
call fcn.005afba5
add esp, 8
jmp 0x5afe0a
mov ecx, esi
push 0x7c5878
call fcn.004730a2
mov ecx, dword [esp + 0x2b4]
xor ecx, esp
call fcn.005db451
mov eax, esi
add esp, 0x2b8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5bcef0
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov esi, edx
mov edi, ecx
mov eax, dword [0x7c3824]
xor eax, ebp
mov dword [esp + 0x28], eax
mov dword [esp + 4], 8
sub esp, 0x14
movaps xmm0, xmmword [0x637860]
movups xmmword [esp + 4], xmm0
lea eax, [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x5bcfcb
mov ecx, dword [ebp + 8]
xorps xmm0, xmm0
movaps xmmword [esp + 0x10], xmm0
mov dword [esp + 0x20], 0
mov word [esp + 0x10], 0x208
mov dword [esp + 0x14], 0x6601
mov dword [esp + 0x18], 8
lea ebx, [esp + 0x1c]
mov edx, ebx
call fcn.005bd160
push 8
push ebx
call fcn.005cc460
add esp, 8
lea eax, [esp + 8]
lea ecx, [esp + 0x10]
push eax
push 0
push 0
push 0x14
push ecx
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x5bcfbf
movsd xmm0, qword [edi]
movsd qword [esi], xmm0
lea eax, [esp + 4]
push 8
push eax
push esi
push 0
push 0
push 0
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push 0
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [esp + 0x28]
xor ecx, ebp
call fcn.005db451
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5c151c
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0x5c]
test ecx, ecx
je 0x5c1529
jmp ecx
push str.Call_to_NULL_read_function
push eax
call fcn.005d0c48
push edi
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x5c1558
mov edi, dword [esp + 0x14]
push dword [esi + 0x60]
push edi
push 1
push dword [esp + 0x1c]
call fcn.005fd6df
add esp, 0x10
cmp eax, edi
jne 0x5c155b
pop esi
pop edi
ret
push str.Read_Error
push esi
call fcn.005d0c48

Function at 0x5c86f0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0x58]
test ecx, ecx
je 0x5c86fd
jmp ecx
push str.Call_to_NULL_write_function
push eax
call fcn.005d0c48
push edi
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x5c872c
mov edi, dword [esp + 0x14]
push dword [esi + 0x60]
push edi
push 1
push dword [esp + 0x1c]
call fcn.005fd8f2
add esp, 0x10
cmp eax, edi
jne 0x5c872f
pop esi
pop edi
ret
push str.Write_Error
push esi
call fcn.005d0c48
mov eax, dword [esp + 4]
mov eax, dword [eax + 0x178]
test eax, eax
je 0x5c874a
jmp eax
ret

Function at 0x5c95d9
Capabilities:
Encode data using xor

Disassembly:
push esi
and edx, 0xb
jne 0x5c95fe
mov esi, ecx
cmp word [ecx + 0x74], 0
js 0x5c9610
push str.png_set_unknown_chunks_now_expects_a_valid_location
push esi
call fcn.005d10f2
add esp, 8
mov edx, dword [esi + 0x74]
and edx, 0xb
je 0x5c9610
mov eax, edx
mov ecx, edx
neg ecx
and ecx, edx
mov edx, ecx
xor edx, eax
cmp eax, ecx
jne 0x5c95fe
pop esi
ret
push str.invalid_location_in_png_set_unknown_chunks
push esi
call fcn.005d0c48
Function at 0x5c97de
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
lea eax, [ebp - 0x18]
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x5caa40
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
xor edi, edi
xor eax, eax
xchg dword [0x7d287c], eax
mov ecx, 0x7d2878
call fcn.004454c4
test al, al
jne 0x5c9904
lea esi, [ebp - 0x44]
mov ecx, esi
push str.mpr.dll
call fcn.00406642
mov dword [ebp - 0x10], 0
mov ecx, 0x7d2878
push 2
push esi
call fcn.0044527c
mov ebx, eax
lea esi, [ebp - 0x44]
mov ecx, esi
call fcn.0043fda0
test bl, bl
mov edi, 0
je 0x5c9904
mov dword [ebp - 0x10], 0xffffffff
mov ecx, esi
push str.WNetOpenEnumW
call fcn.00406642
mov dword [ebp - 0x10], 1
mov ecx, 0x7d2878
push 0
push esi
call fcn.004454fe
mov dword [0x7d2880], eax
lea esi, [ebp - 0x44]
mov ecx, esi
call fcn.0043fda0
mov dword [ebp - 0x10], 0xffffffff
mov ecx, esi
push str.WNetEnumResourceW
call fcn.00406642
mov dword [ebp - 0x10], 2
mov ecx, 0x7d2878
push 0
push esi
call fcn.004454fe
mov dword [0x7d2884], eax
lea esi, [ebp - 0x44]
mov ecx, esi
call fcn.0043fda0
mov dword [ebp - 0x10], 0xffffffff
mov ecx, esi
push str.WNetCloseEnum
call fcn.00406642
mov dword [ebp - 0x10], 3
mov ecx, 0x7d2878
push 0
push esi
call fcn.004454fe
mov dword [0x7d2888], eax
lea ecx, [ebp - 0x44]
call fcn.0043fda0
xor edi, edi
mov ecx, dword [ebp + 8]
xor esi, esi
dec esi
mov dword [ebp - 0x10], esi
call fcn.004419f8
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov dword [ebp - 0x20], eax
inc eax
add eax, eax
cmovb eax, esi
mov dword [ebp - 0x10], 4
push eax
call fcn.005db443
add esp, 4
mov dword [ebp - 0x24], eax
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp - 0x24]
push ebx
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
cmp word [ebx], 0
je 0x5c997b
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x20], ebx
mov edx, ebx
push esi
push edi
call fcn.005c9a78
add esp, 8
mov ebx, dword [ebp - 0x20]
push ebx
call fcn.00442552
add esp, 4
lea ebx, [ebx + eax*2]
add ebx, 2
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
jmp 0x5c9949
push dword [ebp - 0x24]
call fcn.005db44c
add esp, 4
mov eax, esi
and eax, 8
mov ecx, edi
and ecx, 2
or ecx, eax
jne 0x5c99ec
lea ecx, [ebp - 0x44]
call fcn.004419f8
mov dword [ebp - 0x10], 5
lea ecx, [ebp - 0x44]
mov edx, dword [ebp + 0xc]
push dword [ebp + 0x10]
call fcn.005c9b4b
add esp, 4
test al, al
je 0x5c99e4
xor esi, esi
lea edi, [ebp - 0x44]
mov ecx, edi
call fcn.00441c66
cmp esi, eax
jae 0x5c99e4
mov ecx, edi
mov dword [ebp - 0x20], esi
push esi
call fcn.00441fa4
mov ecx, dword [ebp + 8]
push 1
push eax
call fcn.00442fa6
mov esi, dword [ebp - 0x20]
inc esi
jmp 0x5c99ba
lea ecx, [ebp - 0x44]
call fcn.004432bc
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5c9f38
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x348
mov esi, ecx
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x18]
mov dword [ecx - 4], esp
mov dword [ecx + 8], 0xffffffff
mov dword [ecx + 4], 0x5caa80
mov edx, dword fs:[0]
mov dword [ecx], edx
mov dword fs:[0], ecx
mov byte [esi + 0x40], 0
mov ecx, esi
push eax
call fcn.00402866
mov ecx, esi
call fcn.00443c3a
lea ecx, [ebp - 0x354]
push 0x200
push 0x2b4
push ecx
push 0
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov edi, eax
test eax, eax
je 0x5c9fb8
lea eax, [ebp - 0x348]
lea ecx, [esi + 0x20]
push eax
call fcn.0044a480
mov byte [esi + 0x40], 1
jmp 0x5ca061
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], esp
push eax
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x24], eax
add eax, 4
mov ecx, esi
mov dword [ebp - 0x20], eax
push eax
call fcn.004415d4
lea ecx, [ebp - 0x8c]
call fcn.0043fd32
lea ecx, [ebp - 0x6c]
call fcn.0043fd32
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x4c]
push str.Cannot_read_typename_from__s_
call fcn.00401278
mov dword [ebp - 0x10], 1
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.00445492
add esp, 0xc
lea ecx, [ebp - 0xa0]
push eax
call fcn.00447d20
mov eax, dword [ebp - 0x24]
lea esi, [ebp - 0xa0]
mov dword [eax], esi
call fcn.00449048
add esp, 0x10
mov esp, dword [ebp - 0x28]
mov ecx, esi
call fcn.00440f8a
lea ecx, [ebp - 0x4c]
call fcn.0043fda0
lea ecx, [ebp - 0x6c]
call fcn.0043fda0
lea ecx, [ebp - 0x8c]
call fcn.0043fda0
mov edi, dword [ebp - 0x2c]
test edi, edi
setne al
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x5ca208
Capabilities:
Get disk information
Get file system object information

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2f0
mov esi, ecx
lea eax, [ebp - 0x18]
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x5caaa0
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
lea ecx, [eax - 1]
cmp ecx, 4
ja 0x5ca258
mov edi, dword [eax*4 + 0x64ff98]
mov ebx, dword [eax*4 + 0x64ffac]
jmp 0x5ca260
xor ebx, ebx
inc ebx
mov edi, 5
lea eax, [ebp - 0x2fc]
push 0x800
push 0x2b4
push eax
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x5ca29a
mov eax, dword [ebp - 0x2f4]
mov ecx, eax
shr ecx, 0x10
and ecx, 4
or ecx, ebx
shr eax, 0x18
and eax, 2
or eax, ecx
mov ebx, eax
jmp 0x5ca29f
call fcn.00401cb0
mov dword [ebp - 0x20], ebx
lea ecx, [ebp - 0x28]
push edi
push ebx
call fcn.00451d04
call fcn.005ca12c
lea edi, [ebp - 0x48]
mov ecx, edi
push esi
call fcn.00406642
mov dword [ebp - 0x10], 0
mov ecx, 0x7d288c
push edi
call fcn.005ca30c
mov ecx, eax
lea eax, [ebp - 0x28]
push eax
call fcn.004686d8
lea ecx, [ebp - 0x48]
call fcn.0043fda0
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, dword [ebp - 0x20]
add esp, 0x2f0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5cae70
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, dword [esp + 0x24]
mov eax, dword [0x7c3824]
xor eax, esp
mov dword [esp + 0xc], eax
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 0x14]
lea eax, [ecx + eax*2]
add eax, 0xc
push eax
call dword [0x7c387c]
add esp, 4
mov ebx, eax
test eax, eax
je 0x5cafa8
mov esi, dword [esp + 0x2c]
mov edx, ebx
mov ebx, dword [esp + 0x28]
mov dword [edx], edi
add eax, 0xc
mov dword [edx + 4], eax
mov ecx, dword [edi + 0xc]
add ecx, eax
mov dword [edx + 8], ecx
cmp dword [edi + 0x10], esi
jae 0x5caef2
push eax
mov ebp, edx
call dword [edi]
add esp, 4
push esi
push ebx
push dword [ebp + 4]
call dword [edi + 4]
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, dword [edi + 0xc]
push dword [ebp + 4]
mov ebx, eax
push eax
call dword [edi + 8]
add esp, 8
mov esi, dword [edi + 0x14]
mov eax, dword [ebp + 4]
jmp 0x5caef4
mov ebp, edx
mov dword [esp + 4], ebx
push eax
call dword [edi]
add esp, 4
push dword [ebp + 8]
call dword [edi]
add esp, 4
test esi, esi
mov ecx, edi
je 0x5caf6a
xor edi, edi
mov dword [esp], esi
nop word cs:[eax + eax]
nop dword [eax + eax]
mov esi, dword [esp + 4]
movzx eax, byte [esi + edi]
xor al, 0x36
mov byte [esp + 0xb], al
push 1
lea eax, [esp + 0xf]
push eax
push dword [ebp + 4]
mov ebx, ebp
mov ebp, ecx
call dword [ecx + 4]
add esp, 0xc
movzx eax, byte [esi + edi]
mov esi, dword [esp]
xor al, 0x5c
mov byte [esp + 0xb], al
push 1
lea eax, [esp + 0xf]
push eax
push dword [ebx + 8]
call dword [ebp + 4]
mov ecx, ebp
mov ebp, ebx
add esp, 0xc
add edi, 1
cmp esi, edi
jne 0x5caf20
cmp esi, dword [ecx + 0x10]
mov ebx, ebp
jae 0x5cafa8
mov edi, ecx
nop word cs:[eax + eax]
nop dword [eax]
push 1
push 0x64fff0
push dword [ebx + 4]
call dword [edi + 4]
add esp, 0xc
push 1
push 0x64fff1
push dword [ebx + 8]
call dword [edi + 4]
add esp, 0xc
add esi, 1
cmp esi, dword [edi + 0x10]
jb 0x5caf80
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.005db451
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret