joyce8/EMBER2024-capa huggingface dataset:
Function at 0x56ef70
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
test dl, dl
je 0x56ef85
add esp, 0xfffffff0
call fcn.004044a0
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov esi, dword [ebp + 8]
xor edx, edx
mov eax, ebx
call fcn.004040f8
lea eax, [ebx + 0xc]
mov edx, esi
call fcn.00405008
mov eax, esi
call fcn.00405474
push eax
xor eax, eax
mov al, byte [ebp + 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_CreateMutexA
mov edi, eax
mov dword [ebx + 8], edi
test edi, edi
jne 0x56efda
mov ecx, dword [0x58fe44]
mov dl, 1
mov eax, dword [0x56ed48]
call fcn.0056a2f8
call fcn.00404908
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0xb7
sete al
mov byte [ebx + 4], al
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x56f001
call fcn.004044f8
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x56fdc0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x56fe76
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.00405474
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jbe 0x56fe60
lea eax, [ebp - 0x10]
mov edx, edi
call fcn.00405600
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
push eax
push edi
mov eax, dword [ebp - 0xc]
push eax
mov eax, esi
call fcn.00405474
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x56fe60
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x56fe88
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x56fe60
cmp dword [ebp - 8], 0x34
jne 0x56fe60
mov bl, 1
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56fe7d
lea eax, [ebp - 0x10]
call fcn.00404fb4
ret
Function at 0x571db8
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x154], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405464
xor eax, eax
push ebp
push 0x571ef0
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
cmp dword [ebp - 8], 0
setne bl
mov eax, dword [ebp - 4]
call fcn.00405274
mov edx, dword [ebp - 4]
cmp byte [edx + eax - 1], 0x5c
je 0x571e16
lea eax, [ebp - 4]
mov edx, 0x571f08
call fcn.0040527c
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.0040504c
lea eax, [ebp - 4]
mov edx, 0x571f14
call fcn.0040527c
lea eax, [ebp - 0x150]
push eax
mov eax, dword [ebp - 4]
call fcn.00405474
push eax
call sub.KERNEL32.DLL_FindFirstFileA
mov edi, eax
cmp edi, 0xffffffff
je 0x571ebc
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x124]
call fcn.0040b2f8
mov eax, dword [ebp - 0xc]
mov edx, 0x571f20
call fcn.004053c0
je 0x571ea3
mov eax, dword [ebp - 0xc]
mov edx, 0x571f2c
call fcn.004053c0
je 0x571ea3
test byte [ebp - 0x150], 0x10
je 0x571ea3
inc esi
test bl, bl
je 0x571ea3
lea eax, [ebp - 0x154]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
call fcn.004052c0
mov edx, dword [ebp - 0x154]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x150]
push eax
push edi
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
jne 0x571eb7
or edi, 0xffffffff
cmp edi, 0xffffffff
jne 0x571e4a
push edi
call sub.KERNEL32.DLL_FindClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x571ef7
lea eax, [ebp - 0x154]
call fcn.00404fb4
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404fd8
lea eax, [ebp - 4]
call fcn.00404fb4
ret
Function at 0x572104
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffff684
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x197c], eax
mov dword [ebp - 0x1974], eax
mov dword [ebp - 0x1978], eax
mov dword [ebp - 0x1970], eax
mov dword [ebp - 0x196c], eax
mov dword [ebp - 0x1964], eax
mov dword [ebp - 0x1968], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x5722e5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1964]
call fcn.0054c728
mov eax, dword [ebp - 0x1964]
push eax
lea eax, [ebp - 0x1968]
call fcn.0054ca60
mov edx, dword [ebp - 0x1968]
lea eax, [ebp - 4]
pop ecx
call fcn.004052c0
mov dl, 1
mov eax, dword [0x41c9c8]
call fcn.004040f8
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
call fcn.00405274
mov ebx, eax
test ebx, ebx
jle 0x5721e2
mov esi, 1
lea eax, [ebp - 0x196c]
push eax
mov ecx, 1
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.004054d4
lea eax, [ebp - 0x196c]
mov edx, 0x5722fc
call fcn.0040527c
mov eax, dword [ebp - 0x196c]
mov ecx, dword [ebp - 0xc]
mov edx, 0x572308
call fcn.005728cc
inc esi
dec ebx
jne 0x5721a5
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x5722ba
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x5722ba
inc ebx
xor esi, esi
lea eax, [ebp - 0x1960]
xor ecx, ecx
mov edx, 0x1954
call fcn.0040379c
lea ecx, [ebp - 0x1970]
mov edx, esi
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x1970]
call fcn.00405474
push eax
lea eax, [ebp - 0x1960]
push eax
call sub.KERNEL32.DLL_lstrcpyA
lea eax, [ebp - 0x1960]
call fcn.00569450
lea eax, [ebp - 8]
lea edx, [ebp - 0x155f]
mov ecx, 0x401
call fcn.00405224
lea edx, [ebp - 0x1978]
mov eax, dword [ebp - 8]
call fcn.0040ae00
mov eax, dword [ebp - 0x1978]
lea edx, [ebp - 0x1974]
call fcn.00409b0c
mov eax, dword [ebp - 0x1974]
mov edx, 0x572318
call fcn.004053c0
jne 0x5722b2
lea ecx, [ebp - 0x197c]
mov edx, esi
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x197c]
call fcn.00405474
push eax
call sub.KERNEL32.DLL_DeleteFileA
inc esi
dec ebx
jne 0x572208
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5722ec
lea eax, [ebp - 0x197c]
mov edx, 7
call fcn.00404fd8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404fd8
ret
Function at 0x573234
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00405464
xor eax, eax
push ebp
push 0x573332
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov dl, 1
mov eax, dword [0x563a70]
call fcn.00564318
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x5732c7
inc esi
xor ebx, ebx
lea ecx, [ebp - 0x10]
mov edx, ebx
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x10]
call fcn.0040a8b0
test al, al
je 0x5732c3
lea ecx, [ebp - 0x14]
mov edx, ebx
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x3c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc ebx
dec esi
jne 0x57328f
mov dl, 1
mov eax, dword [ebp - 0xc]
call fcn.005693a4
mov dl, 1
mov eax, dword [ebp - 0xc]
call fcn.005693c4
mov eax, dword [ebp - 8]
call fcn.0040a8b0
test al, al
je 0x5732ff
mov eax, dword [ebp - 8]
call fcn.00405474
push eax
call sub.KERNEL32.DLL_DeleteFileA
push 0xc8
call sub.KERNEL32.DLL_Sleep_1
mov eax, dword [ebp - 0xc]
call fcn.005647d0
mov eax, dword [ebp - 0xc]
call fcn.00404128
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x573339
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00404fd8
lea eax, [ebp - 8]
call fcn.00404fb4
ret
Function at 0x573bd8
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x154], edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x14c], edx
mov dword [ebp - 0x150], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x573d8f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x41c9c8]
call fcn.004040f8
mov dword [ebp - 0x10], eax
xor edx, edx
mov eax, 2
call fcn.004d684c
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x13c], 0x128
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 0xc]
call fcn.004d686c
mov dword [ebp - 8], eax
jmp 0x573d45
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x573d34
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x134]
call fcn.0054a9e8
test al, al
jne 0x573d34
lea ecx, [ebp - 0x144]
mov edx, esi
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00409abc
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x150]
mov eax, dword [ebp - 0x134]
call fcn.004d68ec
mov edx, dword [ebp - 0x150]
lea eax, [ebp - 0x14c]
call fcn.0040523c
mov eax, dword [ebp - 0x14c]
lea edx, [ebp - 0x148]
call fcn.00409abc
mov edx, dword [ebp - 0x148]
pop eax
call fcn.004055b8
test eax, eax
je 0x573d2c
push 0
mov eax, dword [ebp - 0x134]
push eax
push 0
push 1
call sub.KERNEL32.DLL_OpenProcess
push eax
call sub.KERNEL32.DLL_TerminateProcess
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x573d2c
lea ecx, [ebp - 0x154]
mov edx, esi
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x154]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec ebx
jne 0x573c6f
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 0xc]
call fcn.004d688c
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x573c59
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_CloseHandle
mov ebx, dword [ebp - 0x10]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x573d96
lea eax, [ebp - 0x154]
call fcn.00404fb4
lea eax, [ebp - 0x150]
call fcn.004056fc
lea eax, [ebp - 0x14c]
mov edx, 4
call fcn.00404fd8
ret
Function at 0x574188
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405464
lea eax, [ebp - 0x168]
mov edx, dword [0x408dc0]
call fcn.00405ac4
xor eax, eax
push ebp
push 0x5742b2
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0xc]
call fcn.0040b0a8
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0040acac
mov eax, dword [ebp - 0x10]
call fcn.0040a8c0
test al, al
je 0x574286
mov eax, dword [ebp - 0x10]
call fcn.00402d80
call fcn.00402d44
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040adc8
lea ecx, [ebp - 0x168]
mov edx, 0x3f
mov eax, dword [ebp - 8]
call fcn.0040aac4
mov eax, dword [ebp - 0x15c]
call fcn.0040a8b0
test al, al
je 0x57425f
mov bl, 1
xor edx, edx
mov eax, dword [ebp - 0x15c]
call fcn.0040aa30
mov eax, dword [ebp - 0x15c]
call fcn.0040ab54
test al, al
jne 0x57425f
push 4
push 0
mov eax, dword [ebp - 0x15c]
call fcn.00405474
push eax
call sub.KERNEL32.DLL_MoveFileExA
cmp eax, 1
sbb ebx, ebx
inc ebx
lea eax, [ebp - 0x168]
call fcn.0040ab14
test eax, eax
je 0x574217
lea eax, [ebp - 0x168]
call fcn.0040ab38
mov eax, dword [ebp - 0xc]
call fcn.00402d80
call fcn.00402d44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5742b9
lea eax, [ebp - 0x168]
mov edx, dword [0x408dc0]
call fcn.00405b94
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404fd8
ret
Function at 0x574f98
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405464
xor eax, eax
push ebp
push 0x575122
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x41c9c8]
call fcn.004040f8
mov dword [ebp - 8], eax
mov dl, 1
mov eax, dword [0x41c9c8]
call fcn.004040f8
mov dl, 1
mov eax, dword [0x41c9c8]
call fcn.004040f8
mov dl, 1
mov eax, dword [0x41c9c8]
call fcn.004040f8
mov dword [ebp - 0xc], eax
mov dl, 1
mov eax, dword [0x41c9c8]
call fcn.004040f8
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [ebp - 4]
call fcn.00405474
push eax
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, 2
jne 0x575034
mov eax, dword [0x58f744]
mov eax, dword [eax]
call fcn.0045a1b8
push eax
lea edx, [ebp - 0xc]
mov cl, 1
mov eax, dword [ebp - 4]
call fcn.0054edc0
mov esi, eax
jmp 0x575050
mov eax, dword [0x58f744]
mov eax, dword [eax]
call fcn.0045a1b8
push eax
lea edx, [ebp - 0xc]
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.0054edc0
mov esi, eax
xor edx, edx
push ebp
push 0x575105
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.00572e60
test al, al
jne 0x575076
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
je 0x5750e2
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [ebp - 4]
call fcn.0054a32c
mov ebx, eax
mov eax, dword [0x58f744]
mov eax, dword [eax]
cmp byte [eax + 0x670], 0
je 0x5750ce
mov eax, ebx
call fcn.00574a38
mov edx, eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, ebx
call fcn.00574c94
mov edx, eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0xc]
call fcn.005742c0
mov edx, eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x40]
jmp 0x5750e2
mov edx, ebx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov edx, esi
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 4]
call fcn.005747c0
mov edx, eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x40]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57510c
mov ebx, dword [ebp - 8]
ret
Function at 0x575e2c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor edx, edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405464
lea eax, [ebp - 0x28]
mov edx, dword [0x571994]
call fcn.00405ac4
xor eax, eax
push ebp
push 0x575f13
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea ecx, [ebp - 0x28]
mov dx, word [0x575f24]
mov eax, dword [ebp - 4]
call fcn.00571c4c
test al, al
je 0x575eda
cmp byte [ebp - 0x18], 4
jne 0x575ece
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x14]
call fcn.0040523c
lea eax, [ebp - 8]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x575f30
call fcn.00575db0
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.004054d4
lea eax, [ebp - 0x2c]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004052c0
mov eax, dword [ebp - 0x2c]
call fcn.00405474
push eax
call sub.KERNEL32.DLL_DeleteFileA
test eax, eax
je 0x575ece
mov bl, 1
lea eax, [ebp - 0x28]
call fcn.00571ccc
test al, al
jne 0x575e7a
lea eax, [ebp - 0x28]
call fcn.00571ce8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x575f1a
lea eax, [ebp - 0x2c]
call fcn.00404fb4
lea eax, [ebp - 0x28]
mov edx, dword [0x571994]
call fcn.00405b94
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404fd8
ret

Function at 0x576598
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
xor eax, eax
push ebp
push 0x5766ac
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x41c9c8]
call fcn.004040f8
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
call fcn.0054ca60
mov eax, dword [ebp - 4]
call fcn.00405274
mov ebx, eax
test ebx, ebx
jle 0x57660d
mov esi, 1
lea eax, [ebp - 0x10]
push eax
mov ecx, 1
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.004054d4
lea eax, [ebp - 0x10]
mov edx, 0x5766c4
call fcn.0040527c
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec ebx
jne 0x5765de
lea edx, [ebp - 0x18]
mov eax, dword [0x58fc34]
mov eax, dword [eax]
call fcn.004754b0
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.0040acac
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 8]
mov ecx, 0x5766d0
call fcn.004052c0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
mov ecx, 1
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004054d4
lea eax, [ebp - 0x1c]
mov edx, 0x5766e4
call fcn.0040527c
mov eax, dword [ebp - 0x1c]
call fcn.00405474
push eax
mov eax, dword [ebp - 8]
call fcn.00405474
push eax
push 0x5766e8
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, dword [ebp - 0xc]
call fcn.00573bd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5766b3
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.00404fd8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404fd8
ret
Function at 0x57b8cc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x57b9e4
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, dword [0x58fc34]
mov eax, dword [eax]
call fcn.004754b0
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.0040acac
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, 0x57b9f8
call fcn.004052c0
cmp byte [ebx + 0x670], 0
je 0x57b963
push 1
lea edx, [ebp - 0x14]
mov eax, dword [0x58fc34]
mov eax, dword [eax]
call fcn.004754b0
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.0040acac
mov eax, dword [ebp - 0x10]
call fcn.00405474
push eax
push 0x57ba04
mov eax, dword [ebp - 4]
call fcn.00405474
push eax
push 0x57ba10
mov eax, ebx
call fcn.0045a1b8
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x57b9c9
push 0x40
lea edx, [ebp - 0x18]
mov eax, 0x57ba20
call fcn.0050ffc8
mov eax, dword [ebp - 0x18]
call fcn.00405474
push eax
lea edx, [ebp - 0x1c]
mov eax, 0x57ba2c
call fcn.0050ffc8
mov eax, dword [ebp - 0x1c]
call fcn.00405474
push eax
mov eax, ebx
call fcn.0045a1b8
push eax
call sub.user32.dll_MessageBoxA
push 1
push 0x57ba30
push 0x57ba30
mov eax, dword [0x58f474]
mov eax, dword [eax]
call fcn.00405474
push eax
push 0x57ba10
mov eax, ebx
call fcn.0045a1b8
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57b9eb
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.00404fd8
ret

Function at 0x57c6e4
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ecx
mov dword [esp], 7
push 0
lea eax, [esp + 4]
push eax
call sub.wininet.dll_InternetGetConnectedState
cmp eax, 1
sbb eax, eax
inc eax
pop edx
ret
Function at 0x5815b0
Capabilities:
Create process on windows
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x5815b8
push ebx
push esi
mov eax, 0x580e40
call fcn.00407734
xor eax, eax
push ebp
push 0x581739
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x58fc34]
mov eax, dword [eax]
call fcn.00474d58
mov eax, dword [0x58fc34]
mov eax, dword [eax]
mov edx, 0x581750
call fcn.00474940
push 0x581760
push 0
push 0
call fcn.00407a0c
mov ebx, eax
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0xb7
je 0x5816af
mov ecx, dword [0x58f744]
mov eax, dword [0x58fc34]
mov eax, dword [eax]
mov edx, dword [0x576c94]
call fcn.00474d70
lea edx, [ebp - 0x14]
mov eax, 1
call fcn.0040309c
mov eax, dword [ebp - 0x14]
mov edx, 0x581774
call fcn.004053c0
jne 0x5816a1
mov eax, dword [0x58fc34]
mov eax, dword [eax]
mov byte [eax + 0x5b], 0
push 1
push 0xa
lea edx, [ebp - 0x18]
mov eax, 0x581784
call fcn.0050ffc8
mov eax, dword [ebp - 0x18]
push eax
lea edx, [ebp - 0x1c]
mov eax, 0x581790
call fcn.0050ffc8
mov edx, dword [ebp - 0x1c]
mov eax, dword [0x58f744]
mov eax, dword [eax]
mov eax, dword [eax + 0x3b4]
pop ecx
call fcn.00496c8c
mov eax, dword [0x58f744]
mov eax, dword [eax]
mov eax, dword [eax + 0x3b0]
mov dl, 1
call fcn.00448b64
mov eax, dword [0x58fc34]
mov eax, dword [eax]
call fcn.00474df0
jmp 0x58171e
lea edx, [ebp - 0x24]
xor eax, eax
call fcn.0040309c
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.0040ad34
mov edx, dword [ebp - 0x20]
mov eax, 0x5951dc
call fcn.00405008
mov eax, dword [0x5951dc]
call fcn.00405474
mov esi, eax
push esi
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, 2
jne 0x581703
push 1
push 0x581794
push 0x581794
push esi
push 0x581798
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x581718
lea edx, [ebp - 0x28]
mov eax, 0x5817a8
call fcn.0050ffc8
mov eax, dword [ebp - 0x28]
call fcn.0044c460
push ebx
call sub.KERNEL32.DLL_ReleaseMutex
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x581740
lea eax, [ebp - 0x28]
mov edx, 6
call fcn.00404fd8
ret
Function at 0x4016e9
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.00401899
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x4017e7
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x40178a
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x4017cd
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x4017a1
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x4017bc
test al, 0x40
je 0x4017b3
mov ecx, dword [edi + 0x20]
jmp 0x4017ba
test al, 0x80
je 0x4017cd
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x4017cd
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x401759
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret