joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46c380
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x106c
call fcn.0052d270
mov eax, dword [0x5e8ea4]
xor eax, esp
mov dword [esp + 0x1068], eax
push ebx
push esi
push edi
mov word [esp + 0x12], dx
lea eax, [esp + 0x870]
mov edi, ecx
mov esi, 0x800
mov byte [eax], 0
lea eax, [eax + 1]
sub esi, 1
jne 0x46c3b4
mov ecx, 0x800
lea eax, [esp + 0x70]
nop dword [eax + eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x46c3d0
mov ecx, 0x44
lea eax, [esp + 0x28]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x46c3e4
mov ecx, 0x10
lea eax, [esp + 0x14]
nop dword [eax + eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x46c400
push edi
lea eax, [esp + 0x874]
mov word [esp + 0x5c], dx
push eax
mov dword [esp + 0x30], 0x44
mov dword [esp + 0x5c], 1
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [esp + 0x24]
xor bl, bl
push eax
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
test esi, esi
je 0x46c47a
push dword [esi]
lea eax, [esp + 0x74]
push 0x400
push eax
call fcn.00550106
add esp, 0xc
lea eax, [esp + 0x70]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
cmp word [esp + 0x70], 0
mov eax, 1
movzx ebx, bl
push esi
cmovne ebx, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [esp + 0x14]
xor ecx, ecx
push eax
lea eax, [esp + 0x2c]
test bl, bl
push eax
lea eax, [esp + 0x78]
cmove eax, ecx
push eax
push ecx
xor eax, eax
mov ecx, 0x8000000
cmp word [esp + 0x22], ax
cmove eax, ecx
push eax
push 0
push 0
push 0
lea eax, [esp + 0x890]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, dword [esp + 0x1c]
test eax, eax
je 0x46c510
lea eax, [esp + 0x870]
push eax
push str.___Success_run:__s
call fcn.004612c0
add esp, 8
cmp byte [ebp + 8], 0
je 0x46c4e7
push dword [ebp + 0xc]
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x14]
call esi
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1068]
xor ecx, esp
call fcn.0052c886
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x874]
push eax
push str.___Failed_to_run:__s__Code__lu.
call fcn.004612c0
mov ecx, dword [esp + 0x1080]
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0052c886
mov esp, ebp
pop ebp
ret
Function at 0x46df10
Capabilities:
Enumerate services

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5713d8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x5e8ea4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
push 0xf003f
push 0
push 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
mov dword [ebp - 0x24], ebx
test ebx, ebx
je 0x46e116
mov edi, dword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 3
push 0x30
push ebx
call edi
test eax, eax
jne 0x46e10f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x46e10f
mov esi, dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x20], eax
push ecx
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push dword [ebp - 0x14]
push eax
push 3
push 0x30
push ebx
call edi
test eax, eax
mov eax, dword [ebp - 0x20]
je 0x46e0ff
mov esi, eax
test eax, eax
je 0x46e0ff
xor ebx, ebx
cmp dword [ebp - 0x18], ebx
jbe 0x46e0fc
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIW]
nop dword [eax + eax]
push 0x5db81c
push dword [esi]
call edi
test eax, eax
jne 0x46e055
push str.backup
push dword [esi]
call edi
test eax, eax
jne 0x46e055
push str.database
push dword [esi]
call edi
test eax, eax
jne 0x46e055
push 0x5db81c
push dword [esi + 4]
call edi
test eax, eax
jne 0x46e055
push str.backup
push dword [esi + 4]
call edi
test eax, eax
jne 0x46e055
push str.database
push dword [esi + 4]
call edi
test eax, eax
je 0x46e0ec
mov edx, dword [esi]
xor eax, eax
mov word [ebp - 0x44], ax
mov eax, edx
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 7
lea ecx, [eax + 2]
mov dword [ebp - 0x28], ecx
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x46e073
sub eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x44]
sar eax, 1
push eax
push edx
call fcn.0044a890
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 4], 0
call fcn.00456bf0
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x30]
cmp edx, 8
jb 0x46e0dd
mov ecx, dword [ebp - 0x44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x46e0d3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x46e132
push edx
push ecx
call fcn.0052cac7
add esp, 8
push dword [esi]
push str.___Added_service:__s
call fcn.004612c0
add esp, 8
inc ebx
add esi, 0x24
cmp ebx, dword [ebp - 0x18]
jb 0x46e000
mov eax, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x24]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052c886
mov esp, ebp
pop ebp
ret
call fcn.00548571
int3
Function at 0x472040
Capabilities:
Clear windows event logs

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x571850
mov eax, dword fs:[0]
push eax
mov eax, dword [0x5e8ea4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [0x5ef9ba], 0
je 0x4720c5
call dword [sym.imp.Everything32.dll_Everything_DeleteRunHistory]
call dword [sym.imp.Everything32.dll_Everything_Exit]
call dword [sym.imp.Everything32.dll_Everything_CleanUp]
push 0x2710
push 0
xor edx, edx
mov dword [ebp - 4], 0xffffffff
mov ecx, str.wevtutil.exe_cl_security
call fcn.0046c380
push 0x2710
push 0
xor edx, edx
mov ecx, str.wevtutil.exe_cl_system
call fcn.0046c380
push 0x2710
push 0
xor edx, edx
mov ecx, str.wevtutil.exe_cl_application
call fcn.0046c380
add esp, 0x18
call fcn.00459250
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x472840
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5718f8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5e8ea4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.004720e0
test al, al
je 0x4729e2
mov edi, dword [0x5e9da4]
xor ebx, ebx
push str.___Search_mask:
mov esi, 0x1f4
call fcn.004612c0
add esp, 4
test edi, edi
jle 0x472960
nop word [eax + eax]
cmp esi, edi
mov dword [ebp - 0x1c], 0
mov eax, edi
mov dword [ebp - 0x18], 7
cmovle eax, esi
mov esi, eax
xor eax, eax
mov word [ebp - 0x2c], ax
mov eax, dword [0x5e9da4]
cmp eax, ebx
jb 0x472a05
sub eax, ebx
mov ecx, esi
cmp eax, esi
cmovb ecx, eax
cmp dword [0x5e9da8], 8
mov eax, 0x5e9d94
cmovae eax, dword [0x5e9d94]
push ecx
lea ecx, [ebp - 0x2c]
lea eax, [eax + ebx*2]
push eax
call fcn.0044a890
mov dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
cmovae eax, dword [ebp - 0x2c]
push eax
push 0x5d6c28
call fcn.004612c0
mov dword [ebp - 4], 0xffffffff
add esp, 8
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x472954
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x47294a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x472a00
push edx
push ecx
call fcn.0052cac7
add esp, 8
sub edi, esi
add ebx, esi
test edi, edi
jg 0x4728a0
push 0
push 0
push 0
push 0x472770
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x4729ce
push 0xea60
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4729ab
call dword [sym.imp.Everything32.dll_Everything_GetLastError]
push eax
push str.____Timeout_waiting_Everything_SetSearch._LastError___lu.
call fcn.004612c0
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4729e2
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [ebp - 0x14], 1
push esi
je 0x4729a3
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x4729e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.____Failed_to_create_thread__Everything_SetSearch_._LastError___lu.
call fcn.004612c0
add esp, 8
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052c886
mov esp, ebp
pop ebp
ret
call fcn.00548571
call fcn.0044ac30
int3
Function at 0x473610
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5719b8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x5e8ea4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [0x5ef9ba], 0
je 0x47378b
call fcn.00453eb0
mov ecx, eax
cmp dword [eax + 0x14], 0x10
jb 0x473657
mov ecx, dword [eax]
mov edi, dword [eax + 0x10]
add edi, ecx
call fcn.00453eb0
mov esi, eax
cmp dword [esi + 0x14], 0x10
jb 0x47366b
mov esi, dword [esi]
xor eax, eax
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
lea ecx, [ebp - 0x28]
mov eax, edi
mov dword [ebp - 0x14], 7
sub eax, esi
push eax
call fcn.0044bc00
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x28]
push edi
push esi
call fcn.0044bd90
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x18]
push 0
lea ebx, [eax + eax]
lea eax, [ebp - 0x2c]
push eax
push 0
push 0x20106
push 0
push 0
push 0
push str.SOFTWAREMICROSOFTWindowsCurrentVersionPoliciesSystem
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4736f9
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push ebx
cmovae eax, dword [ebp - 0x28]
push eax
push 1
push 0
push str.legalnoticetext
push dword [ebp - 0x2c]
call esi
push dword [ebp - 0x2c]
call edi
push 1
push 0x5d5eec
lea ecx, [ebp - 0x28]
call fcn.0044a890
mov eax, dword [ebp - 0x18]
push 0
lea ebx, [eax + eax]
lea eax, [ebp - 0x2c]
push eax
push 0
push 0x20106
push 0
push 0
push 0
push str.SOFTWAREMICROSOFTWindowsCurrentVersionPoliciesSystem
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x473755
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push ebx
cmovae eax, dword [ebp - 0x28]
push eax
push 1
push 0
push str.legalnoticecaption
push dword [ebp - 0x2c]
call esi
push dword [ebp - 0x2c]
call edi
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x47378b
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x473781
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4737a7
push edx
push ecx
call fcn.0052cac7
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052c886
mov esp, ebp
pop ebp
ret
call fcn.00548571
int3
Function at 0x4758c0
Capabilities:
Bypass uac via icmluautil
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x85c
mov eax, dword [0x5e8ea4]
xor eax, esp
mov dword [esp + 0x858], eax
push ebx
push esi
push edi
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 4
push eax
lea eax, [esp + 0x1c]
mov edi, edx
push eax
push 0
push 0x10010
push str.ConsentPromptBehaviorAdmin
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.OLEAUT32.dll_SysReAllocString
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
cmp dword [esp + 0x18], 2
jne 0x47593a
push str.____Abort_elevation__Max_UAC_level_
call fcn.004612c0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x858]
xor ecx, esp
call fcn.0052c886
mov esp, ebp
pop ebp
ret
push esi
lea eax, [esp + 0x24c]
push 0x104
push eax
call fcn.00550106
add esp, 0xc
lea eax, [esp + 0x248]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push esi
lea eax, [esp + 0x65c]
push 0x104
push eax
call fcn.00550106
add esp, 0xc
lea eax, [esp + 0x450]
push edi
push 0x104
push eax
call fcn.00550106
add esp, 0xc
xor esi, esi
call fcn.00475620
test eax, eax
je 0x475a72
push 2
push esi
mov edi, 0xc0000022
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov ebx, eax
mov dword [esp + 0x10], esi
mov ecx, 0x24
lea eax, [esp + 0x1c]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x4759b6
push str.Elevation:Administrator_new:
lea eax, [esp + 0x44]
mov dword [esp + 0x20], 0x24
push 0x104
push eax
mov dword [esp + 0x3c], 4
call fcn.00550106
add esp, 0xc
lea eax, [esp + 0x40]
push str.3E5FC7F9_9A51_4367_9063_A120244FBEC7
push 0x104
push eax
call fcn.00550780
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push 0x5dcedc
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.ole32.dll_CoGetObject]
mov esi, dword [esp + 0x10]
test eax, eax
jne 0x475a50
test esi, esi
je 0x475a5c
mov eax, dword [esi]
lea ecx, [esp + 0x248]
push 5
push 0
push ecx
mov eax, dword [eax + 0x24]
lea ecx, [esp + 0x45c]
push ecx
lea ecx, [esp + 0x668]
push ecx
push esi
call eax
xor ecx, ecx
test eax, eax
cmovns edi, ecx
test esi, esi
je 0x475a5c
mov eax, dword [esi]
push esi
mov eax, dword [eax + 8]
call eax
test ebx, ebx
jne 0x475a66
call dword [sym.imp.ole32.dll_CoUninitialize]
xor esi, esi
mov eax, 1
test edi, edi
cmove esi, eax
mov ecx, dword [esp + 0x864]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0052c886
mov esp, ebp
pop ebp
ret
Function at 0x48e410
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 4
call fcn.0052d270
push edi
mov edi, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 4], eax
test edi, edi
je 0x48e490
mov cl, byte [edi]
test cl, cl
je 0x48e490
push ebx
push esi
mov ebx, 0x100
nop word [eax + eax]
movd xmm1, dword [esp + 0xc]
lea edi, [edi + 1]
movsx esi, cl
mov edx, 0x20
or esi, ebx
add ebx, 0x100
mov ecx, esi
shr ecx, 2
xor ecx, esi
imul esi, esi
and ecx, 0xf
sub edx, ecx
shl eax, cl
mov cl, byte [edi]
movd xmm0, edx
psrlq xmm1, xmm0
movd edx, xmm1
or eax, edx
xor eax, esi
mov dword [esp + 0xc], eax
test cl, cl
jne 0x48e440
mov ecx, eax
pop esi
shr ecx, 0x10
pop ebx
xor eax, ecx
pop edi
pop ecx
ret
xor eax, eax
pop edi
pop ecx
ret

Function at 0x48e530
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.0052d270
push ebx
mov ebx, dword [esp + 0xc]
push esi
xor esi, esi
mov dword [esp + 8], esi
test ebx, ebx
je 0x48e5b3
mov al, byte [ebx]
test al, al
je 0x48e5b3
push ebp
push edi
mov ebp, 0x100
movsx eax, al
push eax
call fcn.0048d710
movd xmm1, dword [esp + 0x14]
lea ebx, [ebx + 1]
mov edi, eax
mov edx, 0x20
or edi, ebp
add esp, 4
mov ecx, edi
add ebp, 0x100
shr ecx, 2
xor ecx, edi
imul edi, edi
and ecx, 0xf
sub edx, ecx
shl esi, cl
movd xmm0, edx
psrlq xmm1, xmm0
movd eax, xmm1
or esi, eax
mov al, byte [ebx]
xor esi, edi
mov dword [esp + 0x10], esi
test al, al
jne 0x48e557
mov eax, esi
pop edi
shr eax, 0x10
pop ebp
xor eax, esi
pop esi
pop ebx
pop ecx
ret
pop esi
xor eax, eax
pop ebx
pop ecx
ret

Function at 0x504100
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 0x18], 0
je 0x504114
mov dword [esp + 0x18], fcn.005028e0
jmp fcn.004fbe70
mov dword [esp + 0x18], fcn.00501b80
jmp fcn.004fbb70

Function at 0x52ebe6
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x552593
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0052d270
mov eax, dword [0x5e8ea4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.005520cb
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x5525d5
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x552731
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.0056e890
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x5ef1f8]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.00560112
mov ecx, dword [esi*4 + 0x5ef1f8]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x55272a
cmp eax, dword [edi + ecx + 0x24]
jne 0x55272a
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x55272a
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00560112
add esp, 0x14
test edx, edx
jl 0x55272a
jg 0x5526a0
test eax, eax
jb 0x55272a
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x55272a
jl 0x5526ba
cmp dword [ebp - 0x1008], eax
ja 0x55272a
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x5526d8
test ebx, ebx
je 0x552711
cmp ecx, edi
jae 0x552711
mov al, byte [ecx]
cmp al, 0xd
jne 0x5526f2
lea eax, [edi - 1]
cmp ecx, eax
jae 0x5526fe
cmp byte [ecx + 1], 0xa
jne 0x5526fe
inc ecx
jmp 0x5526fe
movzx eax, al
movsx eax, byte [eax + 0x5e91e8]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x5526d8
cmp edx, ebx
jne 0x5526d8
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x55272f
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0052c886
leave
ret
Function at 0x55337d
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5e8ea4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x5cc424
push esi
call fcn.00562dad
pop ecx
pop ecx
test eax, eax
jne 0x5533ab
xor al, al
jmp 0x553428
push ebx
lea eax, [ebp - 0x210]
xor ebx, ebx
push eax
push 0x104
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], ebx
push esi
push eax
call fcn.005530c0
mov edx, eax
add esp, 0x10
test edx, edx
jne 0x5533e5
push dword [ebp - 0x210]
call fcn.0054823a
xor al, al
jmp 0x553426
mov ecx, edx
push edi
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x5533eb
sub ecx, edi
sar ecx, 1
pop edi
cmp ecx, 3
je 0x55340b
push edx
call fcn.005532b3
pop ecx
test al, al
je 0x5533d6
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x553419
mov bl, 1
push dword [ebp - 0x210]
call fcn.0054823a
mov al, bl
pop ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0052c886
leave
ret
Function at 0x55eab8
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0055e753

Function at 0x55eac3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0055e8e2

Function at 0x55ef9f
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x5ce738
push 0x5ce730
push str.FlsAlloc
push 0x1e
call fcn.0055edcc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x55efd3
push dword [ebp + 8]
mov ecx, esi
call dword [0x5755b4]
call esi
jmp 0x55efd9
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x55f01d
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x5ce748
push 0x5ce740
push str.FlsGetValue
push 0x20
call fcn.0055edcc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x55f054
push dword [ebp + 8]
mov ecx, esi
call dword [0x5755b4]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x55f5ca
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x5ef1f8]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x55f60a
cmp byte [ebx], 0xa
jne 0x55f60a
or byte [eax + edi + 0x28], 4
jmp 0x55f60f
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x55f70d
mov al, byte [edx]
cmp al, 0x1a
je 0x55f6ef
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x55f63e
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x55f663
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x55f66d
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x55f620
jmp 0x55f70d
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x55f6ea
cmp dword [ebp - 0xc], 0
je 0x55f6ea
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x5ef1f8]
test byte [eax + edi + 0x28], 0x48
je 0x55f6c4
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x55f6af
mov byte [esi], dl
jmp 0x55f6c0
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x5ef1f8]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x55f70d
cmp byte [ebp - 1], 0xa
jne 0x55f6d3
cmp esi, ebx
jne 0x55f6d3
mov byte [esi], 0xa
jmp 0x55f70c
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00560130
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x55f70d
mov byte [esi], 0xd
jmp 0x55f70c
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x5ef1f8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x55f709
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x55f70d
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret