joyce8/EMBER2024-capa huggingface dataset:
Function at 0x508600
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x508728
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, esi
call fcn.00506fe8
xor eax, eax
push ebp
push 0x508703
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x2c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.005075e8
test al, al
je 0x5086e7
mov eax, dword [ebp + 8]
push eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.005084e0
pop ecx
mov ecx, dword [ebp - 0x20]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.00409c90
mov ebx, dword [ebp - 0x24]
dec ebx
test ebx, ebx
jl 0x5086e7
inc ebx
xor edi, edi
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040a5ec
push eax
push edi
push esi
call sub.advapi32.dll_RegEnumValueW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00506f48
test al, al
je 0x5086e3
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0040a5ec
mov edx, eax
lea eax, [ebp - 0x30]
call fcn.0040a654
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.005084e0
pop ecx
inc edi
dec ebx
jne 0x50868b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50870a
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x10]
call fcn.00506fe8
ret
Function at 0x508738
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
xor ecx, ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x508986
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 8]
call fcn.00506fe8
xor eax, eax
push ebp
push 0x50895c
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x44]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.005075e8
test al, al
je 0x508940
mov ecx, dword [ebp - 0x40]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.00409c90
mov eax, dword [ebp - 0x44]
dec eax
test eax, eax
jl 0x508940
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.0040a5ec
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00506f48
test al, al
je 0x508934
mov eax, dword [ebp - 4]
call fcn.0040a5ec
mov edx, eax
lea eax, [ebp - 0x48]
call fcn.0040a654
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00508040
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x508934
xor eax, eax
push ebp
push 0x50892d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0xc]
call fcn.00506fe8
xor eax, eax
push ebp
push 0x50890f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040a5ec
mov edx, eax
lea eax, [ebp - 0x4c]
call fcn.0040a654
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00506fec
mov eax, dword [ebp - 4]
call fcn.0040a5ec
mov edx, eax
lea eax, [ebp - 0x50]
call fcn.0040a654
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00508040
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x5088ec
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.00508600
pop ecx
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.00508738
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5088f3
mov eax, dword [ebp - 0x24]
push eax
call sub.advapi32.dll_RegCloseKey
ret
inc dword [ebp - 0x14]
dec dword [ebp - 0x28]
jne 0x5087c3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x508963
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x18]
call fcn.00506fe8
ret
Function at 0x516768
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffdc
mov ebx, eax
mov eax, ebx
call fcn.00409b08
mov dword [esp], 0xf
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x516799
lea edx, [esp + 4]
mov eax, ebx
mov ecx, dword [esp]
call fcn.00409c90
add esp, 0x24
pop ebx
ret

Function at 0x51cc50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
mov eax, esi
mov edx, dword [0x51af80]
call fcn.00407f9c
test al, al
je 0x51cd69
mov edx, dword [ebx + 0xc]
mov eax, dword [esi + 0xc]
mov ecx, dword [eax]
call dword [ecx + 8]
mov edx, dword [ebx + 0x54]
mov eax, dword [esi + 0x54]
mov ecx, dword [eax]
call dword [ecx + 8]
lea eax, [esi + 8]
mov edx, dword [ebx + 8]
call fcn.00409ee8
lea eax, [esi + 0x10]
mov edx, dword [ebx + 0x10]
call fcn.00409ee8
lea eax, [esi + 0x14]
mov edx, dword [ebx + 0x14]
call fcn.00409ee8
lea eax, [esi + 0x18]
mov edx, dword [ebx + 0x18]
call fcn.00409ee8
lea eax, [esi + 0x1c]
mov edx, dword [ebx + 0x1c]
call fcn.00409ee8
lea eax, [esi + 0x20]
mov edx, dword [ebx + 0x20]
call fcn.00409ee8
lea eax, [esi + 0x4c]
mov edx, dword [ebx + 0x4c]
call fcn.00409ee8
lea eax, [esi + 0x50]
mov edx, dword [ebx + 0x50]
call fcn.00409ee8
mov eax, dword [ebx + 0x28]
mov dword [esi + 0x28], eax
mov eax, dword [ebx + 0x2c]
mov dword [esi + 0x2c], eax
mov eax, dword [ebx + 0x30]
mov dword [esi + 0x30], eax
mov eax, dword [ebx + 0x34]
mov dword [esi + 0x34], eax
mov eax, dword [ebx + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [ebx + 0x3c]
mov dword [esi + 0x3c], eax
mov eax, dword [ebx + 0x40]
mov dword [esi + 0x40], eax
mov eax, dword [ebx + 0x44]
mov dword [esi + 0x44], eax
lea eax, [esi + 0x48]
mov edx, dword [ebx + 0x48]
call fcn.00409ee8
mov eax, dword [ebx + 0x58]
mov dword [esi + 0x58], eax
mov eax, dword [ebx + 0x5c]
mov dword [esi + 0x5c], eax
lea eax, [esi + 0x68]
mov edx, dword [ebx + 0x68]
call fcn.00409ee8
mov eax, dword [ebx + 0x60]
mov dword [esi + 0x60], eax
mov eax, dword [ebx + 0x64]
mov dword [esi + 0x64], eax
mov eax, dword [ebx + 0x70]
mov dword [esi + 0x70], eax
mov eax, dword [ebx + 0x74]
mov dword [esi + 0x74], eax
lea eax, [esi + 0x78]
mov edx, dword [ebx + 0x78]
call fcn.00409ee8
movzx eax, byte [ebx + 0x7c]
mov byte [esi + 0x7c], al
lea eax, [esi + 0x80]
mov edx, dword [ebx + 0x80]
call fcn.00409ee8
pop esi
pop ebx
ret
mov edx, esi
mov eax, ebx
call fcn.004a73b0
pop esi
pop ebx
ret
Function at 0x5406e4
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x5406ec
push ecx
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5408a1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x18]
mov ecx, dword [eax + 0xc]
lea eax, [ebp - 4]
mov edx, 0x5408bc
call fcn.0040a858
push esi
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
mov eax, dword [ebx + 0x2c]
push eax
lea eax, [ebp - 0x18]
push eax
movzx ecx, word [ebx + 0x30]
mov eax, dword [ebx + 0x1c]
xor edx, edx
call fcn.0053e2bc
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0x11
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x5408d0
call fcn.004e5e58
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x540767
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x5407a8
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebx + 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
movzx ecx, word [ebx + 0x30]
mov eax, dword [ebx + 0xc]
xor edx, edx
call fcn.0053e2bc
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x540938
call fcn.004e5e58
mov edx, dword [ebp - 0x1c]
mov eax, esi
call fcn.0040a800
mov eax, esi
mov edx, 0x540964
call fcn.0040a800
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x5407c0
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x54082e
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x540978
call fcn.004e5e58
mov edx, dword [ebp - 0x2c]
mov eax, esi
call fcn.0040a800
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x5407f7
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x540822
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x5409a8
call fcn.004e5e58
mov edx, dword [ebp - 0x30]
mov eax, esi
call fcn.0040a800
mov eax, esi
mov edx, 0x540964
call fcn.0040a800
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x54083a
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x540865
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x5409d4
call fcn.004e5e58
mov edx, dword [ebp - 0x34]
mov eax, esi
call fcn.0040a800
mov eax, esi
mov edx, 0x540964
call fcn.0040a800
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5408a8
lea eax, [ebp - 0x34]
mov edx, 4
call fcn.00409b68
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00409b68
lea eax, [ebp - 4]
call fcn.00409b08
ret
Function at 0x56dcfc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor edx, edx
mov dword [ebp - 0x14], edx
xor edx, edx
push ebp
push 0x56dd60
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 0xe]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xe]
mov ecx, 7
call fcn.0040a6a8
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.0041f958
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56dd67
lea eax, [ebp - 0x14]
call fcn.00409b08
ret

Function at 0x56eb0c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x56eba2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x58967c]
cmp dword [eax], 2
jne 0x56eb4c
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push edi
push esi
push ebx
call sub.advapi32.dll_RegQueryValueExW
mov ebx, eax
jmp 0x56eb84
lea eax, [ebp - 8]
mov edx, esi
call fcn.0040a400
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, 0
call fcn.0040a27c
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push edi
mov eax, dword [ebp - 4]
call fcn.0040a2f0
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56eba9
lea eax, [ebp - 8]
call fcn.00409b50
lea eax, [ebp - 4]
call fcn.00409b2c
ret

Function at 0x56ef40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esi], eax
xor eax, eax
mov dword [ebp - 8], eax
push 0x20019
lea eax, [ebp - 8]
push eax
mov eax, edi
call fcn.0040a5ec
mov edx, eax
mov eax, ebx
call fcn.0056e978
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.0056ea54
test eax, eax
sete al
mov ebx, eax
test bl, bl
je 0x56efb2
push 0
push 0
push esi
push 0
mov eax, dword [ebp - 4]
call fcn.0040a5ec
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
sete bl
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x57073c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x5707ee
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
mov eax, esi
call fcn.0040a5ec
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
jbe 0x5707d8
lea eax, [ebp - 4]
mov edx, edi
call fcn.0040a780
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
push eax
push edi
mov eax, dword [ebp - 0x10]
push eax
mov eax, esi
call fcn.0040a5ec
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x5707d8
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x570800
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x5707d8
cmp dword [ebp - 0xc], 0x34
jne 0x5707d8
mov bl, 1
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 8]
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5707f5
lea eax, [ebp - 4]
call fcn.00409b08
ret
Function at 0x574ce0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x574f5a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
mov edx, 0x24
call fcn.00570804
lea eax, [ebp - 0x28]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x14]
mov dword [0x5888c0], eax
mov eax, dword [ebp - 0xc]
mov dword [0x5888c4], eax
mov eax, dword [ebp - 0x24]
mov dword [0x5888c8], eax
mov eax, dword [0x58967c]
cmp dword [eax], 2
sete byte [0x58805d]
push 0x574f68
call sub.kernel32.dll_GetModuleHandleW
lea edx, [ebp - 4]
call fcn.0057070c
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp byte [0x58805d], 0
jne 0x574d6f
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.0057073c
test al, al
je 0x574d6f
mov eax, dword [ebp - 0x4c]
mov dword [0x612008], eax
jmp 0x574d76
xor eax, eax
mov dword [0x612008], eax
call fcn.005708bc
and eax, 0x7f
cmp eax, 0x1c
ja case.0x574d87.0
jmp dword [eax*4 + 0x574d8e]
mov byte [0x588058], 1
jmp case.0x574d87.0
mov byte [0x588059], 1
jmp case.0x574d87.0
mov byte [0x58805a], 1
jmp case.0x574d87.0
mov byte [0x58805b], 1
jmp case.0x574d87.0
mov byte [0x58805c], 1
jmp case.0x574d87.0
mov byte [0x58805e], 1
mov byte [0x58805f], 1
jmp case.0x574d87.0
mov byte [0x58805e], 1
mov byte [0x588060], 1
jmp case.0x574d87.0
mov byte [0x58805e], 1
mov byte [0x588060], 1
mov byte [0x588061], 1
jmp case.0x574d87.0
mov byte [0x588062], 1
jmp case.0x574d87.0
mov byte [0x588063], 1
jmp case.0x574d87.0
mov byte [0x588064], 1
jmp case.0x574d87.0
mov byte [0x588065], 1
jmp case.0x574d87.0
mov byte [0x588066], 1
jmp case.0x574d87.0
mov byte [0x588067], 1
jmp case.0x574d87.0
mov byte [0x588068], 1
jmp case.0x574d87.0
mov byte [0x588069], 1
jmp case.0x574d87.0
mov byte [0x58806a], 1
jmp case.0x574d87.0
mov byte [0x58806b], 1
jmp case.0x574d87.0
mov byte [0x58806c], 1
jmp case.0x574d87.0
mov byte [0x58806d], 1
jmp case.0x574d87.0
mov byte [0x58806e], 1
jmp case.0x574d87.0
mov byte [0x58806f], 1
jmp case.0x574d87.0
mov byte [0x588070], 1
jmp case.0x574d87.0
mov byte [0x588071], 1
jmp case.0x574d87.0
mov byte [0x588072], 1
jmp case.0x574d87.0
mov byte [0x588073], 1
jmp case.0x574d87.0
mov byte [0x588074], 1
jmp case.0x574d87.0
mov byte [0x588075], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x574f61
lea eax, [ebp - 4]
call fcn.00409b08
ret
Function at 0x575474
Capabilities:
Acquire debug privileges

Disassembly:
push ebx
add esp, 0xffffffc8
mov byte [esp], al
xor ebx, ebx
xor eax, eax
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push 0x20
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x57555b
lea eax, [esp + 0x10]
push eax
push 0x575564
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
test eax, eax
je 0x57555b
mov eax, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], 1
xor eax, eax
mov dword [esp + 0x34], eax
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x1c]
push eax
push 0x10
lea eax, [esp + 0x34]
push eax
push 0
mov eax, dword [esp + 0x1c]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], 1
cmp byte [esp], 1
jne 0x57551c
mov eax, dword [esp + 0x34]
or eax, 2
mov dword [esp + 0x24], eax
jmp 0x575527
mov eax, dword [esp + 0x34]
and eax, 0xfffffffd
mov dword [esp + 0x24], eax
lea eax, [esp + 4]
push eax
push 0
mov eax, dword [esp + 0xc]
push eax
lea eax, [esp + 0x24]
push eax
push 0
mov eax, dword [esp + 0x1c]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
cmp eax, 1
sbb ebx, ebx
inc ebx
cmp dword [esp + 8], 0
jbe 0x57555b
mov eax, dword [esp + 8]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, ebx
add esp, 0x38
pop ebx
ret

Function at 0x575578
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x57563d
push dword fs:[eax]
mov dword fs:[eax], esp
or esi, 0xffffffff
lea eax, [ebp - 4]
call fcn.00570880
cmp dword [ebp - 4], 0
je 0x57561f
lea eax, [ebp - 0x18]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040a9c8
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 4]
mov edx, 0x575658
call fcn.0040a858
push 0
push 0
push 3
push 0
push 3
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.0040a5ec
push eax
call sub.kernel32.dll_CreateFileW
mov ebx, eax
cmp ebx, 0xffffffff
je 0x57561f
push 0
lea eax, [ebp - 8]
push eax
push 0xc
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0x2d1080
push ebx
call sub.kernel32.dll_DeviceIoControl
cmp eax, 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x575619
mov esi, dword [ebp - 0x10]
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x575644
lea eax, [ebp - 0x18]
call fcn.00409b08
lea eax, [ebp - 4]
call fcn.00409b08
ret
Function at 0xac7363
Capabilities:
Encode data using xor

Disassembly:
add edi, 1
call fcn.00bbeec7
not dword [ebx]
xchg ecx, eax
stosd dword es:[edi], eax
mov ebp, dword [esi + 0x2d83ff2]
pop ecx
jnp 0xac737c
add bh, dh
adc edx, dword [ecx - 0xd517455]
aas
fadd dword [edx]
lodsd eax, dword [esi]
in al, 0x96
nop
fnstcw word [ebx]
mov dword [0xc88798e8], eax
imul edi, ecx, 0x1b
mov byte [ebx + 0x38df93be], bh
fldenv [esi - 0x5d]
mov esi, 0xfeec91e7
pop ebx
push ds
xor edi, dword [ebp + 0x32d71e44]
out dx, eax
xchg ecx, eax
loopne 0xac736a
dec ebx
xchg esi, eax
outsd dx, dword [esi]
xor dword [ebp - 0x71c10c95], esi
int3

Function at 0xb697f1
Capabilities:
Encode data using base64

Disassembly:
inc edx
xor dword [esp + edi - 0x21bffeef], 0xd0b8ca2a
inc bp
xor edi, edi
dec eax
lea ecx, [esp + ecx + 0x18]
inc edx
not byte [esp + edi - 0x21befff2]
inc ebp
add bh, byte [edi + ecx - 0x21bf0000]
dec ecx
sub eax, 2
inc bp
mov dword [eax], edi
push 0xa801923
call fcn.010e5ae8
push es
jae 0xb698a4
or byte [ecx + 0x7b], bh
invalid
adc al, 0x91
mov eax, 0x6d10edd6
xchg byte [eax + 0x45f4083], ah
cld
outsb dx, byte [esi]
invalid

Function at 0xb80f8d
Capabilities:
Encode data using base64

Disassembly:
mov dx, word [esi + edx*2 - 0x65112178]
call fcn.010e07b5
mov esi, 0x373709b1
lodsb al, byte [esi]
lahf
pop es
xor bl, bl
and eax, 0xb3423956
xor ax, 0xf310
pop edx
stosd dword es:[edi], eax
xchg bl, al
pop ebp
fdivr qword [edx + edx*4]
push esp
inc ebp
stosb byte es:[edi], al
mov byte [0xbf3b3253], al
in al, dx
mov byte [0xd5eb8fad], al
pop ss
fsubrp st(2)
dec esp
sub esi, 0x7b223be5
and dword [ebp - 0x2d79b44c], 0x4b8f1a0e
cwde
sub cl, byte [eax - 0x7fd892c4]
mov cl, 0xfb
pop ss
xchg esi, eax
inc ecx
push cs
sbb cl, byte [edi - 0x77d567b5]
cmp al, 0x6d
daa
xor byte [ecx - 0x3978e805], 0x41
inc esi
mov ds, word [edi - 0x29]
jbe 0xb80f74
sub byte [ebx - 0x13], dh
mov dh, 0xe2
shr edx, cl
rcr dword [eax - 0x7e], 0xe3
pop eax
into
mov dl, 0xe4
das
pop edi
scasd eax, dword es:[edi]
pop ebx
mov edi, 0xc85c9fc9
jae 0xb80fd4
push ebp
push ecx
in eax, 0xfe
push edx
inc esi
imul esi, dword [esi], 0xffffffb8
rcr byte [ebx + 0x31], 1
iretd

Function at 0xb92429
Capabilities:
Encode data using base64

Disassembly:
je 0xd616fd
movzx edx, byte [ecx]
shl esi, 8
jmp 0x10beedb
dec esi
mov esp, dword [esp + esi + 8]
dec esi
mov edi, dword [esp + esi*8 + 0x10]
jae 0xba654a
adc al, 0x11
pop esp
pop edx
outsd dx, dword [esi]
inc ebp
les ebx, [ecx - 0x3228d160]
add dword fs:[edx + esi], ebx
cmp ebp, ecx
in al, dx
cmp esp, ecx
fidiv dword [edx]
xchg esp, eax
fucomi st(3)
ret 0x260f
dec edx
mov dword [esp + esi + 0x10], 0x8a2057b7
push dword [esp + 0x18]
popfd
dec esi
mov ecx, dword [esp + esi*4 + 0x20]
call fcn.00baae1c
inc ecx
cmc
clc
cmp edi, 5
jmp 0x10e0e83
cmp ecx, dword [ebp - 0x40]
jmp 0xb79950
inc edi
cmc
cmp bp, 0xa30e
or esi, edx
jmp 0xba6562
jl 0xbc1dad
mov dword [ebp - 8], ecx
rcl edi, 0x18
shrd dx, bp, 0xbf
test di, ax
lea esp, [esp]
or di, 0xfd1b
bsf cx, bp