joyce8/EMBER2024-capa huggingface dataset:
Function at 0x595d34
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
add esi, 0xfffffff0
xor ebx, ebx
mov eax, dword [0x66f038]
test byte [eax], 8
setne al
and eax, 0x7f
mov edx, dword [eax*4 + 0x66b720]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 8]
mov ecx, 1
call fcn.00658f04
mov edi, eax
mov eax, dword [esi]
mov dword [eax + 0x164], edi
inc edi
je 0x595dac
mov eax, dword [0x66f038]
test byte [eax], 8
je 0x595d93
mov eax, dword [esi]
mov byte [eax + 0x3f6], 1
mov eax, dword [esi]
mov byte [eax + 0x3f7], 1
mov eax, dword [ebp + 8]
add eax, 0xffffffd4
mov edx, dword [ebp + 8]
mov edx, dword [edx - 8]
mov edx, dword [edx + 8]
call fcn.004038bc
jmp 0x595f15
call sub.kernel32.dll_GetLastError
cmp eax, 0x20
jne 0x595e40
mov eax, dword [esi]
cmp byte [eax + 0x45e], 0
jne 0x595df2
mov eax, dword [0x66f038]
test byte [eax], 0x40
jne 0x595df2
push 0
mov eax, dword [ebp + 8]
mov edx, dword [eax - 8]
mov edx, dword [edx + 8]
mov eax, dword [0x66f14c]
mov eax, dword [eax]
mov cl, 3
call fcn.0062010c
cmp ax, 7
je 0x595f17
mov eax, dword [ebp + 8]
push eax
call fcn.00565c30
pop ecx
test al, al
je 0x595f17
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, 1
mov edx, 0xc0000000
call fcn.00658f04
mov edx, dword [esi]
mov dword [edx + 0x164], eax
mov eax, dword [ebp + 8]
add eax, 0xffffffd4
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
call fcn.004038bc
mov eax, dword [esi]
mov byte [eax + 0x3f5], 1
jmp 0x595f15
mov edx, dword [0x66f038]
test byte [edx], 8
jne 0x595eec
sub eax, 5
je 0x595e5d
sub eax, 0x3c
jne 0x595eec
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 8]
mov ecx, 1
mov edx, 0x80000000
call fcn.00658f04
mov edi, eax
mov eax, dword [esi]
mov dword [eax + 0x164], edi
inc edi
jne 0x595eab
mov ax, word [0x595f20]
push eax
mov eax, dword [ebp + 8]
mov edx, dword [eax - 8]
mov edx, dword [edx + 8]
mov eax, dword [0x66eb48]
mov eax, dword [eax]
mov cl, 1
call fcn.0061fe54
cmp ax, 2
je 0x595f17
jmp 0x595d42
mov eax, dword [esi]
mov byte [eax + 0x3f6], 1
mov eax, dword [ebp + 8]
add eax, 0xffffffd4
mov edx, dword [ebp + 8]
mov edx, dword [edx - 8]
mov edx, dword [edx + 8]
call fcn.004038bc
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x2c]
push eax
call sub.kernel32.dll_GetFileAttributesW
test al, 1
jne 0x595f15
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0x2c]
mov eax, dword [0x66fb58]
mov eax, dword [eax]
call fcn.0064f5b4
jmp 0x595f15
mov ax, word [0x595f20]
push eax
mov eax, dword [ebp + 8]
mov edx, dword [eax - 8]
mov edx, dword [edx + 8]
mov eax, dword [0x66eb48]
mov eax, dword [eax]
mov cl, 1
call fcn.0061fe54
cmp ax, 2
je 0x595f17
jmp 0x595d42
mov bl, 1
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x59933c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
xor eax, eax
push ebp
push 0x599420
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
cmp byte [eax - 1], 0xff
jne 0x5993ff
xor ebx, ebx
lea edx, [ebp - 4]
mov eax, 0x20
call fcn.006216fc
cmp dword [ebp - 4], 0
je 0x599390
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x160]
mov edx, dword [ebp - 4]
call fcn.00655098
test al, al
je 0x599390
mov bl, 1
jmp 0x5993f7
lea eax, [ebp - 4]
mov edx, 0x104
call fcn.00403dd4
mov eax, dword [ebp - 4]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathW
test eax, eax
jne 0x5993b9
lea eax, [ebp - 4]
call fcn.00403880
jmp 0x5993d7
lea eax, [ebp - 4]
call fcn.00654ad4
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0061c180
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.004038bc
cmp dword [ebp - 4], 0
je 0x5993f7
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x160]
mov edx, dword [ebp - 4]
call fcn.00655098
test al, al
je 0x5993f7
mov bl, 1
mov eax, dword [ebp + 8]
mov byte [eax - 1], bl
jmp 0x599405
mov eax, dword [ebp + 8]
mov bl, byte [eax - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x599427
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403898
ret
Function at 0x59a5cc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov byte [ebp - 1], cl
mov edi, edx
mov ebx, eax
lea eax, [ebp - 0x40]
mov edx, dword [0x543578]
call fcn.00403e38
xor eax, eax
push ebp
push 0x59a772
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebx + 0x42b], 1
mov eax, dword [ebx + 0x164]
mov dword [ebp - 0xc], eax
mov eax, edi
call fcn.00658f24
mov esi, eax
mov dword [ebx + 0x164], esi
inc esi
jne 0x59a647
xor edx, edx
mov eax, edi
call fcn.0062016c
cmp ax, 2
jne 0x59a60d
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0x164], eax
mov byte [ebx + 0x42b], 0
mov byte [ebp - 2], 2
jmp 0x59a74e
lea eax, [ebp - 8]
mov edx, dword [ebx + 0x160]
call fcn.004038bc
lea eax, [ebx + 0x160]
mov edx, edi
call fcn.004038bc
mov byte [ebp - 0x40], 0
mov eax, dword [0x670050]
test byte [eax + 1], 0x20
je 0x59a699
mov eax, ebx
call fcn.005c208c
test al, al
je 0x59a699
lea edx, [ebp - 0x60]
mov eax, dword [ebx + 0x300]
call fcn.00547e28
lea esi, [ebp - 0x60]
lea edi, [ebp - 0x3c]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
jmp 0x59a6c6
lea edx, [ebp - 0x60]
mov eax, ebx
call fcn.005c5b44
lea esi, [ebp - 0x60]
lea edi, [ebp - 0x3c]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
cmp byte [ebx + 0x433], 0
je 0x59a6c6
lea edx, [ebp - 0x2c]
or ecx, 0xffffffff
mov eax, ebx
call fcn.005c5ac0
mov eax, dword [ebx + 0x168]
mov dword [ebp - 0x1c], eax
mov al, byte [0x59a784]
mov byte [ebp - 0x3e], al
mov eax, dword [ebx + 0x16c]
mov dword [ebp - 0x18], eax
mov al, byte [ebx + 0x170]
mov byte [ebp - 0x3f], al
test byte [ebp - 1], 1
je 0x59a6fa
or byte [ebp - 0x3e], 2
mov dword [ebp - 0x1c], 6
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.004038bc
lea edx, [ebp - 0x40]
mov eax, ebx
call fcn.005b944c
mov byte [ebp - 2], al
mov eax, dword [ebx + 0x164]
push eax
call sub.kernel32.dll_CloseHandle
cmp byte [ebp - 2], 0
je 0x59a730
mov eax, dword [ebx + 0x160]
push eax
call sub.kernel32.dll_DeleteFileW
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0x164], eax
lea eax, [ebx + 0x160]
mov edx, dword [ebp - 8]
call fcn.004038bc
mov byte [ebx + 0x42b], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59a779
lea eax, [ebp - 0x40]
mov edx, dword [0x543578]
call fcn.00403f00
lea eax, [ebp - 8]
call fcn.00403880
ret
Function at 0x59a788
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 4], edx
mov ebx, eax
lea eax, [ebp - 0x38]
mov edx, dword [0x543578]
call fcn.00403e38
xor eax, eax
push ebp
push 0x59a9a5
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x442], 0
jne 0x59a979
cmp byte [ebx + 0x440], 0
je 0x59a979
cmp byte [ebx + 0x38], 0
jne 0x59a7e4
cmp byte [ebx + 0x43d], 0
je 0x59a979
cmp byte [ebx + 0x45c], 0
jne 0x59a979
cmp byte [ebx + 0x43d], 0
jne 0x59a839
lea edx, [ebp - 0x3c]
mov al, 1
call fcn.0061cd68
mov edx, dword [ebp - 0x3c]
lea eax, [ebx + 0x30]
call fcn.004038bc
mov eax, dword [ebx + 0x30]
call fcn.00658f24
mov esi, eax
mov dword [ebx + 0x34], esi
inc esi
jne 0x59a839
xor edx, edx
mov eax, dword [ebx + 0x30]
call fcn.0062016c
cmp ax, 2
jne 0x59a80f
xor eax, eax
mov dword [ebx + 0x34], eax
jmp 0x59a979
mov eax, dword [0x66f230]
inc dword [eax]
mov byte [ebp - 0x38], 0
lea edx, [ebp - 0x5c]
mov eax, ebx
call fcn.005c5b44
lea esi, [ebp - 0x5c]
lea edi, [ebp - 0x34]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebx + 0x168], 4
jne 0x59a879
cmp dword [ebx + 0x178], 0
je 0x59a879
mov dword [ebp - 0x14], 4
lea eax, [ebp - 8]
mov edx, dword [ebx + 0x160]
call fcn.004038bc
mov al, byte [0x59a9b4]
mov byte [ebp - 0x36], al
lea eax, [ebp - 4]
mov edx, dword [ebx + 0x160]
call fcn.004038bc
lea eax, [ebx + 0x160]
mov edx, dword [ebx + 0x30]
call fcn.004038bc
mov esi, dword [ebx + 0x164]
mov eax, dword [ebx + 0x34]
mov dword [ebx + 0x164], eax
mov byte [ebx + 0x441], 1
mov byte [ebx + 0x442], 1
lea edx, [ebp - 0x38]
mov eax, ebx
call fcn.005b944c
test al, al
jne 0x59a925
mov byte [ebx + 0x43d], 1
mov byte [ebx + 0x440], 0
mov eax, dword [ebx + 0x4b0]
mov dword [ebx + 0x4b8], eax
mov eax, 0x811
call fcn.004ab0f8
mov eax, dword [0x66faf0]
mov eax, dword [eax]
mov byte [eax + 6], 1
mov eax, dword [ebx + 0x34]
push eax
call sub.kernel32.dll_CloseHandle
mov ecx, 1
mov edx, 0xc0000000
mov eax, dword [ebx + 0x30]
call fcn.00658f04
mov dword [ebx + 0x34], eax
jmp 0x59a94b
cmp byte [ebx + 0x43d], 0
jne 0x59a94b
mov eax, dword [ebx + 0x164]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebx + 0x160]
push eax
call sub.kernel32.dll_DeleteFileW
xor eax, eax
mov dword [ebx + 0x34], eax
mov byte [ebx + 0x441], 0
mov dword [ebx + 0x164], esi
lea eax, [ebx + 0x160]
mov edx, dword [ebp - 4]
call fcn.004038bc
call fcn.00506ba4
mov byte [ebx + 0x442], 0
mov eax, dword [0x66f230]
dec dword [eax]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59a9ac
lea eax, [ebp - 0x3c]
call fcn.00403880
lea eax, [ebp - 0x38]
mov edx, dword [0x543578]
call fcn.00403f00
lea eax, [ebp - 4]
call fcn.00403880
ret
Function at 0x59bffc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
cmp dword [eax - 0x3c], 0
jle 0x59c0b4
mov eax, dword [ebp + 8]
cmp dword [eax - 0x14], 4
jne 0x59c054
call fcn.004306f4
mov edx, dword [ebp + 8]
cmp dword [edx - 0x40], 0
jne 0x59c040
mov edx, dword [ebp + 8]
mov ecx, dword [edx - 0x3c]
sub ecx, 0x2a
mov edx, dword [0x67343c]
mov edx, dword [edx + 4]
add edx, 0x2a
call fcn.00430498
jmp 0x59c054
mov edx, dword [ebp + 8]
mov ecx, dword [edx - 0x3c]
mov edx, dword [0x67343c]
mov edx, dword [edx + 4]
call fcn.00430498
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x3c]
push eax
mov eax, dword [0x67343c]
mov eax, dword [eax + 4]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x44]
mov eax, dword [eax + 0x164]
push eax
call sub.kernel32.dll_WriteFile
test eax, eax
jne 0x59c0a0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x44]
mov eax, dword [eax + 0x160]
mov dl, 2
call fcn.0062016c
cmp ax, 2
jne 0x59c054
call fcn.00656a70
jmp 0x59c054
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x3c]
mov edx, dword [ebp + 8]
add dword [edx - 0x40], eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax - 0x3c], edx
pop ecx
pop ebp
ret

Function at 0x5ae47c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5ae581
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x5ae598
mov eax, esi
call fcn.004c2288
mov edx, 0x5ae5a8
call fcn.004c2260
mov esi, eax
lea eax, [ebp - 4]
push eax
mov edi, dword [ebx + 0x24]
mov edx, dword [edi + 0x34]
mov eax, dword [edi + 0x2c]
call fcn.0061f000
mov dword [ebp - 0x18], eax
fild dword [ebp - 0x18]
fld xword [0x5ae5b0]
fmulp st(1)
fstp xword [ebp - 0x24]
wait
lea eax, [ebp - 0x24]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 3
mov eax, dword [ebx + 0x24]
mov edx, dword [eax + 0x38]
mov eax, dword [ebx + 0x24]
mov eax, dword [eax + 0x30]
call fcn.0061f000
mov dword [ebp - 0x28], eax
fild dword [ebp - 0x28]
fld xword [0x5ae5b0]
fmulp st(1)
fstp xword [ebp - 0x34]
wait
lea eax, [ebp - 0x34]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 3
lea edx, [ebp - 0x14]
mov eax, 0x5ae5bc
mov ecx, 1
call fcn.00655a28
mov ecx, dword [ebp - 4]
mov edx, 0x5ae5dc
mov eax, esi
call fcn.004c2044
mov edx, 0x5ae5ec
mov eax, esi
call fcn.004c2260
mov esi, eax
mov eax, dword [ebp + 8]
push eax
lea edx, [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.005ae28c
pop ecx
mov ecx, dword [ebp - 4]
mov edx, 0x5ae600
mov eax, esi
call fcn.004c2044
xor ecx, ecx
mov edx, 0x5ae610
mov eax, esi
call fcn.004c2044
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ae588
lea eax, [ebp - 4]
call fcn.00403274
ret
Function at 0x5b9b70
Capabilities:
Set file attributes

Disassembly:
push ebx
mov ebx, eax
mov byte [ebx + 0x3f7], 1
mov eax, ebx
call fcn.005b9b50
cmp byte [ebx + 0x3f6], 0
jne 0x5b9ba7
mov eax, dword [ebx + 0x160]
call fcn.00654ea8
test al, al
je 0x5b9ba7
push 0x20
mov eax, dword [ebx + 0x160]
push eax
call sub.kernel32.dll_SetFileAttributesW
pop ebx
ret
Function at 0x5bdf2c
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x3cc]
push eax
call sub.gdi32.dll_GetRegionData
mov ebx, eax
mov eax, ebx
call fcn.00401e58
mov esi, eax
push esi
push ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x3cc]
push eax
call sub.gdi32.dll_GetRegionData
mov ebx, dword [esi + 8]
dec ebx
cmp ebx, 0
jl 0x5bdfaf
lea eax, [esi + 0x20]
mov edx, ebx
shl edx, 4
add eax, edx
push 0xcc0020
mov edi, dword [eax + 4]
push edi
mov edx, dword [eax]
push edx
mov ecx, dword [0x66fe14]
mov ecx, dword [ecx]
push ecx
mov ecx, dword [eax + 0xc]
sub ecx, edi
push ecx
mov ecx, dword [eax + 8]
sub ecx, edx
push ecx
push edi
push edx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
call sub.gdi32.dll_BitBlt
dec ebx
cmp ebx, 0xffffffff
jne 0x5bdf70
mov eax, esi
call fcn.00401fac
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x60c7cc
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
cmp byte [ebx + 0x155], 0
je 0x60c82e
cmp dword [0x673744], 0
je 0x60c80d
mov eax, dword [0x673744]
cmp ebx, dword [eax + 0x1a8]
jne 0x60c80d
push 0
mov eax, dword [0x673744]
call fcn.00643864
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x673744]
xor edx, edx
mov dword [eax + 0x1a8], edx
push 0
mov eax, dword [ebx + 0x15c]
call fcn.00643864
push eax
call sub.user32.dll_ShowWindow
mov byte [ebx + 0x155], 0
mov eax, ebx
call fcn.0060c060
mov eax, ebx
call fcn.0060c8e0
xor eax, eax
mov dword [ebx + 0x14c], eax
xor eax, eax
mov dword [ebx + 0x148], eax
pop ebx
ret

Function at 0x60c8e0
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
cmp byte [ebx + 0x156], 0
je 0x60c8f9
mov eax, dword [ebx + 0x160]
call fcn.0060c8e0
pop ebx
ret
xor eax, eax
mov dword [ebx + 0x12c], eax
mov eax, ebx
call fcn.0060c8ac
test al, al
je 0x60c935
push 0
mov eax, dword [0x673748]
call fcn.00643864
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x673748]
xor edx, edx
mov dword [eax + 0x128], edx
call fcn.00465e68
xor edx, edx
mov dword [eax + 0x38], edx
pop ebx
ret
Function at 0x61bb2c
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov dword [esp], eax
mov byte [esp + 0x10], 0
mov eax, dword [esp]
mov eax, dword [eax]
call fcn.004036e0
mov edi, eax
mov dword [esp + 8], edi
mov eax, dword [esp + 8]
mov dword [esp + 4], eax
mov eax, dword [esp]
mov eax, dword [eax]
call fcn.0040351c
test al, 3
jne 0x61bc89
shr eax, 2
cmp eax, 1
jl 0x61bc89
mov dword [esp + 0xc], eax
xor edx, edx
xor eax, eax
xor ecx, ecx
mov cl, byte [edi]
cmp ecx, 0x3d
jg 0x61bb9a
je 0x61bc4a
sub ecx, 0x2b
je 0x61bbc7
sub ecx, 4
je 0x61bbcb
dec ecx
sub ecx, 0xa
jb 0x61bbbd
jmp 0x61bbcf
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x61bbac
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x61bbb3
jmp 0x61bbcf
mov bl, byte [edi]
sub bl, 0x41
jmp 0x61bbd3
mov bl, byte [edi]
add bl, 0x1a
sub bl, 0x61
jmp 0x61bbd3
mov bl, byte [edi]
add bl, 0x34
sub bl, 0x30
jmp 0x61bbd3
mov bl, 0x3e
jmp 0x61bbd3
mov bl, 0x3f
jmp 0x61bbd3
xor edx, edx
jmp 0x61bc4a
mov ecx, eax
sub ecx, 1
jb 0x61bbe1
je 0x61bbee
dec ecx
je 0x61bc0f
jmp 0x61bc33
mov esi, ebx
and esi, 0xff
shl esi, 2
jmp 0x61bc3c
mov ecx, ebx
and cl, 0xf
and ecx, 0xff
shl ecx, 0xc
mov ebp, ebx
and ebp, 0xff
shr ebp, 4
or esi, ebp
or ecx, esi
mov esi, ecx
jmp 0x61bc3c
mov ecx, ebx
and cl, 3
and ecx, 0xff
shl ecx, 0x16
mov ebp, ebx
and ebp, 0xff
shr ebp, 2
shl ebp, 8
or esi, ebp
or ecx, esi
mov esi, ecx
jmp 0x61bc3c
xor ecx, ecx
mov cl, bl
shl ecx, 0x10
or esi, ecx
add edx, 6
inc edi
inc eax
cmp eax, 4
jne 0x61bb79
test edx, edx
jne 0x61bc55
mov byte [esp + 0x10], 0
jmp 0x61bc89
mov eax, edx
shr eax, 3
dec eax
cmp eax, 0
jl 0x61bc75
mov edx, esi
mov ecx, dword [esp + 8]
mov byte [ecx], dl
shr esi, 8
inc dword [esp + 8]
dec eax
cmp eax, 0xffffffff
jne 0x61bc60
mov byte [esp + 0x10], 1
dec dword [esp + 0xc]
cmp dword [esp + 0xc], 0
jne 0x61bb75
cmp byte [esp + 0x10], 0
je 0x61bca2
mov edx, dword [esp + 8]
sub edx, dword [esp + 4]
mov eax, dword [esp]
call fcn.00403804
jmp 0x61bcaa
mov eax, dword [esp]
call fcn.00403274
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x61c4bc
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
xor ebx, ebx
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push eax
call sub.kernel32.dll_CreateFileW
mov esi, eax
cmp esi, 0xffffffff
je 0x61c51c
push 0
lea eax, [esp + 8]
push eax
push 3
lea eax, [esp + 0xc]
push eax
push esi
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x61c510
cmp dword [esp + 4], 3
jne 0x61c510
mov eax, dword [esp]
and eax, 0xffffff
cmp eax, 0xbfbbef
je 0x61c514
xor ebx, ebx
jmp 0x61c516
mov bl, 1
push esi
call sub.kernel32.dll_CloseHandle
mov eax, ebx
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x61c524
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00403e18
xor eax, eax
push ebp
push 0x61c5be
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.0061c97c
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
call fcn.00403b14
mov ecx, 1
mov edx, 0x80000000
mov esi, dword [ebp - 4]
mov eax, esi
call fcn.00658f04
cmp eax, 0xffffffff
setne bl
test bl, bl
je 0x61c586
push eax
call sub.kernel32.dll_CloseHandle
jmp 0x61c5a3
mov eax, esi
call fcn.00658f24
cmp eax, 0xffffffff
setne bl
test bl, bl
je 0x61c5a3
push eax
call sub.kernel32.dll_CloseHandle
push esi
call sub.kernel32.dll_DeleteFileW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61c5c5
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403898
ret

Function at 0x61caec
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x23c], edx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x61cc4d
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x6738c4], 0
jne 0x61cb26
call fcn.0064d630
mov dword [0x6738c4], eax
lea edx, [ebp - 4]
mov eax, esi
call fcn.00655260
mov edx, dword [ebp - 4]
mov eax, dword [0x6738c4]
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov ebx, eax
test ebx, ebx
jge 0x61cc1e
xor ebx, ebx
mov eax, esi
call fcn.0061ca94
cmp eax, 2
jne 0x61cb5c
mov bl, 1
jmp 0x61cc0b
cmp eax, 3
jne 0x61cc0b
lea eax, [ebp - 0x23c]
mov ecx, dword [ebp - 4]
mov edx, 0x61cc64
call fcn.00403b14
mov eax, dword [ebp - 0x23c]
mov ecx, 3
mov edx, 0x80000000
call fcn.00658f04
mov esi, eax
cmp esi, 0xffffffff
je 0x61cc0b
lea eax, [ebp - 0x22c]
mov edx, 0x224
call fcn.00658ea4
mov dword [ebp - 0x228], 0x224
xor eax, eax
mov dword [ebp - 0x238], eax
xor eax, eax
mov dword [ebp - 0x234], eax
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x228]
push eax
lea eax, [ebp - 0x22c]
push eax
push 0xc
lea eax, [ebp - 0x238]
push eax
push 0x2d1400
push esi
call sub.kernel32.dll_DeviceIoControl
test eax, eax
je 0x61cc05
mov edi, dword [ebp - 0x210]
cmp edi, 4
je 0x61cc03
cmp edi, 7
je 0x61cc03
cmp byte [ebp - 0x222], 0
je 0x61cc05
mov bl, 1
push esi
call sub.kernel32.dll_CloseHandle
xor ecx, ecx
mov cl, bl
mov edx, dword [ebp - 4]
mov eax, dword [0x6738c4]
call fcn.0064f61c
jmp 0x61cc2c
mov edx, ebx
mov eax, dword [0x6738c4]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61cc54
lea eax, [ebp - 0x23c]
call fcn.00403880
lea eax, [ebp - 4]
call fcn.00403880
ret
Function at 0x61cdc4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd90
xor eax, eax
mov dword [ebp - 0x26c], eax
mov dword [ebp - 0x270], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x268]
mov edx, dword [0x653000]
call fcn.00403e38
xor eax, eax
push ebp
push 0x61cf21
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
call fcn.00626d08
test eax, eax
jne 0x61ceea
lea eax, [ebp - 4]
call fcn.0061c97c
lea eax, [ebp - 0x26c]
mov ecx, 0x61cf30
mov edx, dword [ebp - 4]
call fcn.00403b14
mov eax, dword [ebp - 0x26c]
lea ecx, [ebp - 0x268]
mov edx, 0x39
call fcn.00654fa0
test eax, eax
jne 0x61ceaf
mov edx, dword [ebp - 0x260]
mov eax, 0x61cf3c
call fcn.00654a6c
dec eax
jne 0x61cea0
test byte [ebp - 0x264], 0x10
je 0x61ce80
lea eax, [ebp - 0x26c]
mov ecx, dword [ebp - 0x260]
mov edx, dword [ebp - 4]
call fcn.00403b14
mov eax, dword [ebp - 0x26c]
xor edx, edx
call fcn.00622138
jmp 0x61cea0
lea eax, [ebp - 0x26c]
mov ecx, dword [ebp - 0x260]
mov edx, dword [ebp - 4]
call fcn.00403b14
mov eax, dword [ebp - 0x26c]
push eax
call sub.kernel32.dll_DeleteFileW
lea eax, [ebp - 0x268]
call fcn.00655044
test eax, eax
je 0x61ce41
lea eax, [ebp - 0x268]
call fcn.00655068
lea edx, [ebp - 0x270]
mov eax, 0x61cf48
call fcn.00654d58
mov ecx, dword [ebp - 0x270]
lea eax, [ebp - 0x26c]
mov edx, dword [ebp - 4]
call fcn.00403b14
mov eax, dword [ebp - 0x26c]
push eax
call sub.kernel32.dll_DeleteFileW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61cf28
lea eax, [ebp - 0x270]
mov edx, 2
call fcn.00403898
lea eax, [ebp - 0x268]
mov edx, dword [0x653000]
call fcn.00403f00
lea eax, [ebp - 4]
call fcn.00403880
ret

Function at 0x61d818
Capabilities:
Create process on windows

Disassembly:
add esp, 0xffffffc4
mov eax, esp
mov edx, 0x3c
call fcn.00658ea4
mov dword [esp], 0x3c
mov eax, 0x61d868
mov dword [esp + 0xc], eax
mov eax, dword [0x66ef3c]
mov eax, dword [eax]
mov dword [esp + 0x10], eax
mov eax, dword [0x66fb24]
mov eax, dword [eax]
call fcn.00403a98
mov dword [esp + 0x14], eax
mov eax, dword [0x66fc14]
mov eax, dword [eax]
mov dword [esp + 0x18], eax
push esp
call sub.shell32.dll_ShellExecuteExW
add esp, 0x3c
ret
Function at 0x61d874
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
xor eax, eax
mov dword [ebp - 0x40], eax
xor eax, eax
push ebp
push 0x61d921
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x67390c], 0
je 0x61d90b
push 5
push 0
mov eax, dword [0x673910]
call fcn.00403a98
push eax
mov eax, dword [0x67390c]
push eax
push 0x61d92c
push 0
call sub.shell32.dll_ShellExecuteW
call sub.kernel32.dll_GetLastError
cmp eax, 0x2e4
jne 0x61d90b
lea eax, [ebp - 0x3c]
mov edx, 0x3c
call fcn.00658ea4
mov dword [ebp - 0x3c], 0x3c
mov eax, 0x61d938
mov dword [ebp - 0x30], eax
mov eax, dword [0x67390c]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x673910]
mov dword [ebp - 0x28], eax
lea edx, [ebp - 0x40]
mov eax, dword [0x67390c]
call fcn.00655234
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x3c]
push eax
call sub.shell32.dll_ShellExecuteExW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61d928
lea eax, [ebp - 0x40]
call fcn.00403880
ret