joyce8/EMBER2024-capa huggingface dataset:
Function at 0x541db0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
test edi, edi
je 0x541f02
mov eax, edi
call fcn.004dc0fc
dec eax
mov edx, dword [ebp + 8]
cmp dword [edx - 4], 0
sete dl
and edx, 0x7f
imul edx
add eax, ebx
sub eax, ebx
jl 0x541eba
inc eax
mov dword [ebp - 0xc], eax
mov eax, edi
call fcn.004dc7e0
cmp ebx, eax
sete byte [ebp - 5]
mov eax, 0x10
call fcn.004027a0
mov esi, eax
lea ecx, [ebp - 0x24]
mov edx, ebx
mov eax, edi
call fcn.004db734
mov eax, dword [ebp - 0x20]
dec eax
mov dl, byte [ebp - 5]
xor dl, 1
and edx, 0x7f
add edx, edx
add eax, edx
push eax
lea ecx, [ebp - 0x34]
mov edx, ebx
mov eax, edi
call fcn.004db734
mov eax, dword [ebp - 0x34]
sub eax, 2
mov dl, byte [ebp - 5]
xor dl, 1
and edx, 0x7f
add eax, edx
lea ecx, [ebp - 0x14]
pop edx
call fcn.0041f760
mov eax, dword [ebp - 0x14]
mov dword [esi], eax
mov eax, dword [ebp - 0x10]
mov dword [esi + 4], eax
lea ecx, [ebp - 0x24]
mov edx, ebx
mov eax, edi
call fcn.004db734
mov eax, dword [ebp - 0x18]
sub eax, dword [esi + 4]
inc eax
push eax
lea ecx, [ebp - 0x34]
mov edx, ebx
mov eax, edi
call fcn.004db734
mov eax, dword [ebp - 0x2c]
sub eax, dword [esi]
mov dl, byte [ebp - 5]
xor dl, 1
and edx, 0x7f
sub eax, edx
lea ecx, [ebp - 0x14]
pop edx
call fcn.0041f760
mov eax, dword [ebp - 0x14]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x94]
mov ecx, esi
mov edx, dword [ebp - 4]
call fcn.00541b64
inc ebx
dec dword [ebp - 0xc]
jne 0x541ded
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x94]
mov edx, dword [ebp - 4]
call fcn.00541acc
dec eax
jne 0x541ee8
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x94]
mov edx, dword [ebp - 4]
xor ecx, ecx
mov dword [eax + edx*4 + 0xc], ecx
jmp 0x541f02
mov eax, edi
call fcn.004dc7e0
mov edx, dword [ebp + 8]
mov edx, dword [edx - 8]
mov edx, dword [edx + 0x94]
mov ecx, dword [ebp - 4]
mov dword [edx + ecx*4 + 0xc], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x555ddc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x55603c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x555e3f
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.005558a4
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0041126c
cmp al, 1
jne 0x555e3f
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.00555bbc
test al, al
je 0x555fcb
cmp dword [ebp - 8], 0
jge 0x555e5d
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.005558a4
mov eax, dword [ebp - 0x210]
call fcn.00404c4c
cmp ebx, eax
jge 0x555ea7
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.005558a4
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x5cc4ac]
and eax, 0xff
bt dword [edx], eax
jae 0x555ea7
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x555ebb
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00555db8
cmp ebx, dword [ebp - 8]
je 0x555fbd
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x555ee7
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403c74
and eax, 0x7f
movzx eax, word [eax*2 + 0x5bb50c]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x555faa
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403c74
and eax, 0x7f
movzx eax, word [eax*2 + 0x5bb50c]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.004b2308
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403c74
and eax, 0x7f
movzx eax, word [eax*2 + 0x5bb50c]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.004b2308
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x555fb1
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x55601e
cmp dword [ebp - 8], 0
jge 0x555fd6
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.005558a4
mov eax, dword [ebp - 0x218]
call fcn.00404c4c
cmp eax, dword [ebp - 8]
jg 0x556010
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.005558a4
mov eax, dword [ebp - 0x21c]
call fcn.00404c4c
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00555db8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x556043
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.0040498c
ret
Function at 0x5684a4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov esi, edx
lea edi, [esp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, dword [esp + 8]
test ebx, ebx
je 0x568500
push esp
push 0x40
push 6
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x5684cf
call fcn.00411f80
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
mov ecx, 6
call fcn.00402b04
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
push 6
mov eax, dword [esp + 0x14]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x568500
call fcn.00411f80
add esp, 0x14
pop edi
pop esi
pop ebx
ret

Function at 0x56bff8
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, dword [0x5cbe20]
cmp byte [eax], 0
jne 0x56c026
mov ecx, 0xb0
mov edx, 0x56c074
mov eax, 0x56c0bc
call fcn.004048c4
mov eax, ebx
call fcn.004050b8
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
test eax, eax
je 0x56c065
push 0x200
lea edx, [ebp - 0x202]
push edx
push eax
call sub.user32.dll_GetKeyNameTextW
mov eax, ebx
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.0040525c
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x56c0d0
Capabilities:
Log keystrokes

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [0x5cbe20]
cmp byte [eax], 0
jne 0x56c0f1
mov ecx, 0xbc
mov edx, 0x56c108
mov eax, 0x56c150
call fcn.004048c4
push 2
movzx eax, bx
push eax
call sub.user32.dll_MapVirtualKeyW
pop ebx
ret
Function at 0x579c3c
Capabilities:
Parse credit card information

Disassembly:
call fcn.0057794d
call fcn.0057794d
call fcn.0057794d
cmp al, 0x43
jne 0x579c4a
call fcn.00579e2e
jmp 0x579daa
cmp al, 0x44
jne 0x579c58
call fcn.00579e22
jmp 0x579daa
cmp al, 0x17
jne 0x579c88
call fcn.00579e22
call fcn.0057b05a
mov dh, 1
call fcn.00579b82
mov dh, 2
call fcn.0057b06a
mov eax, dword [ecx*4 + 0xfb2e5b]
dec ecx
call fcn.0057a1c4
mov ebx, eax
jmp 0x579daa
cmp al, 0x18
jne 0x579c93
push 0x57a1ea
jmp 0x579c9c
cmp al, 0x19
jne 0x579ce4
push 0x57a1ed
call fcn.00579e2e
push dword [0xf5b756]
push dword [0xf5b75a]
call fcn.0057b05a
mov dh, 2
call fcn.00579b82
mov dh, 1
call fcn.0057b06a
pop dword [0xf5b75a]
pop dword [0xf5b756]
mov eax, dword [ecx*4 + 0xfb2e5b]
dec ecx
pop ebx
call ebx
jb 0x5770f6
mov ebx, eax
jmp 0x579daa
test byte [0xfb2e56], 2
je 0x579cf2
call fcn.0057b128
call fcn.00579dc5
je 0x579dac
cmp al, 0x3d
jne 0x579d21
test byte [0xfb2e56], 2
je 0x57753c
call fcn.00579e2e
mov ebx, dword [0xf9bd16]
shr ebx, 2
jmp 0x579daa
cmp al, 0x42
jne 0x579d3f
test byte [0xfb2e56], 2
je 0x5775d3
call fcn.00579e2e
or ebx, 0x1e0
jmp 0x579daa
cmp al, 0x4f
jne 0x579d56
call fcn.0057b09a
mov al, 0x51
mov ah, bh
call fcn.0057b16b
jmp fcn.00579c3c
cmp al, 0xc
jne 0x579d77
call fcn.00579e2e
call fcn.00579553
call fcn.00579dad
je 0x579da7
call fcn.00579dc5
je 0x579dac
jmp 0x576bc4
call fcn.00579dad
jne 0x579dac
call fcn.00579e2e
test byte [0xfb2e56], 2
je 0x579da7
shr ebx, 0x10
test bl, 3
jne 0x5768bd
shr ebx, 2
cmp ebx, 0x1f0
jae 0x5768d6
movzx ebx, bx
cmp al, al
ret
Function at 0x57ac23
Capabilities:
Encode data using base64

Disassembly:
call fcn.0057794d
inc ebp
js 0x576c57
arpl word gs:[ebp + 0x64], si
call fcn.0057794d
inc ebp
js 0x576cbe
arpl word gs:[ebp + 0x64], si
cmp al, 0x43
je fcn.0057b5e9
cmp al, 0x44
je fcn.0057b5e9
cmp al, 0x1a
je 0x57ad68
cmp al, 0x1b
je 0x57ad7c
cmp al, 0x17
je 0x57add8
cmp al, 0x18
je 0x57add8
cmp al, 0x19
je 0x57add8
cmp al, 9
mov cl, 2
je 0x57ade7
mov cl, 0
cmp al, 0x53
je 0x57adf9
cmp al, 0x4f
je 0x57ae13
call fcn.0057b2df
cmp al, 0x31
je 0x57ae72
cmp al, 0x32
je 0x57aed3
cmp al, 0x33
je 0x57aee8
cmp al, 0x34
je 0x57aef6
cmp al, 0x36
je 0x57af04
cmp al, 0x37
je 0x57af44
cmp al, 0x39
je 0x57af12
cmp al, 0x3a
je 0x57af12
cmp al, 0xc
je 0x57b01a
cmp al, 0x11
mov dh, 0xa0
je 0x57b507
cmp al, 0x12
mov dh, 0xb0
je 0x57b507
cmp al, 0xe
mov dh, 0x90
je 0x57b500
cmp al, 0xf
mov dh, 0x94
je 0x57b500
cmp al, 0x10
mov dh, 0x88
je 0x57b500
call fcn.0057b456
jne 0x576bdf
call fcn.00579553
cmp al, 0x11
mov dh, 0xa8
je 0x57b50c
cmp al, 0x12
mov dh, 0xb8
je 0x57b50c
cmp al, 0x10
mov dh, 0x8c
je fcn.0057b516
cmp al, 0xe
mov dh, 0x98
je fcn.0057b516
cmp al, 0xf
mov dh, 0x9c
je fcn.0057b516
cmp al, 0x13
mov dh, 0x80
je 0x57b4f9
cmp al, 0x16
jne 0x57ad5c
mov dh, 0xc0
or dh, bl
call fcn.00579553
cmp al, 6
je 0x57b4f9
call fcn.00579856
call fcn.00579856
mov dl, 0
jmp fcn.0057b518
call fcn.0057b05a
call fcn.00579b37
call fcn.0057b5e9
jmp fcn.0057b06a
cmp dword [0xfb32cf], 0
je 0x577741
call fcn.0057b05a
call fcn.0057a8de
call fcn.00579b37
jb 0x57ada6
or ebx, ebx
je 0x57ada6
cmp ebx, 0xff
jbe 0x57adab
jmp fcn.00577695
call fcn.0057a93c
call fcn.0057b0ea
je 0x57ad93
mov bl, 0
call fcn.0057a93c
mov al, 0x87
call fcn.0057b345
call fcn.0057a959
mov al, 0x80
call fcn.0057b345
mov al, 0
jmp fcn.0057b345
call fcn.00579856
call fcn.00579b37
jmp fcn.0057b5e9
call fcn.0057b279
jne 0x57ae28
mov al, 0x51
mov ah, bh
call fcn.0057b16b
jmp fcn.0057b5e9
mov cl, bl
mov al, 0x31
mov ah, 1
call fcn.0057a7c9
mov eax, 0x57ae8c
call fcn.0057a782
jmp fcn.0057a82e
mov al, 0x38
call fcn.0057b345
mov al, 4
call fcn.0057b345
mov al, 0x80
jmp fcn.0057b345
mov al, 0x35
call fcn.0057b345
mov al, 0xc0
jmp fcn.0057b345
mov al, 0x34
call fcn.0057b345
mov al, 0x80
jmp fcn.0057b345
mov al, 0x3f
call fcn.0057b345
mov al, 0x89
jmp fcn.0057b345
call fcn.0057b445
cmp ch, 0x42
je 0x576c46
cmp ch, 0x14
je 0x576c46
mov dl, 3
jmp fcn.0057b518
Function at 0x5839a8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x583a2f
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.005837b0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x20]
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.0040b75c
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.00583554
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x583a36
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0040498c
ret

Function at 0x583e8c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x583ef0
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040c83c
mov eax, dword [ebp - 4]
call fcn.00583dec
test al, al
je 0x583ec5
mov byte [ebp - 5], 1
jmp 0x583eda
mov eax, dword [ebp - 0xc]
call fcn.00404e44
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
sete byte [ebp - 5]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x583ef7
lea eax, [ebp - 0xc]
call fcn.00404968
ret

Function at 0x5841ec
Capabilities:
Encode data using xor

Disassembly:
and edx, edx
je 0x58420f
and ecx, ecx
jle 0x58420f
push ebx
push edi
xor ebx, ebx
lea edi, cs:[0x584215]
mov bl, al
shr eax, 8
xor bl, byte [edx]
xor eax, dword [edi + ebx*4]
inc edx
dec ecx
jne 0x5841ff
pop edi
pop ebx
ret
Function at 0x58ccb8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x113]
mov edx, 0x58cd40
call fcn.0040ce40
mov eax, dword [ebp - 4]
cmp dword [eax + 0x4c], 0
je 0x58ccf3
lea eax, [ebp - 0x108]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x4c]
call fcn.0040ce40
jmp 0x58cd04
lea eax, [ebp - 0x108]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 0x218]
push eax
push 0
lea eax, [ebp - 0x113]
push eax
lea eax, [ebp - 0x108]
push eax
call sub.kernel32.dll_GetTempFileNameA
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x218]
mov ecx, 0x105
call fcn.00404be0
mov esp, ebp
pop ebp
ret

Function at 0x598920
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
xor eax, eax
push ebp
push 0x598a72
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x1619f], 0
mov eax, dword [ebp - 4]
call fcn.00598b94
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
push eax
push 0x596e4c
call sub.kernel32.dll_QueueUserAPC
mov eax, dword [ebp - 4]
call fcn.00598f20
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
push eax
push 0x596e4c
call sub.kernel32.dll_QueueUserAPC
mov dl, 0xf9
mov eax, dword [ebp - 4]
call fcn.00598a9c
mov eax, dword [ebp - 4]
mov byte [eax + 0x1619c], 0x50
mov ebx, 0xfa
push ebp
call fcn.005988d0
pop ecx
mov edx, eax
or dl, 0xfe
mov eax, dword [ebp - 4]
call fcn.00598a9c
dec ebx
jne 0x598997
mov ebx, 0x102
mov dl, 0xf9
mov eax, dword [ebp - 4]
call fcn.00598a9c
dec ebx
jne 0x5989b3
mov eax, dword [ebp - 4]
call fcn.00598fd8
mov ebx, 0xfa
push 0
push 0x64
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00598d94
push eax
push ebp
call fcn.005988d0
pop ecx
pop edx
cmp dl, al
je 0x5989f4
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00598b58
dec ebx
jne 0x5989cd
mov ebx, 8
push 0
push 0x32
mov cl, 1
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00598d94
shl eax, 7
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x1619d]
shr edx, 1
and dl, 0x7f
or al, dl
mov edx, dword [ebp - 4]
mov byte [edx + 0x1619d], al
dec ebx
jne 0x5989fc
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1619e], 0
je 0x598a5a
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00598ab0
mov eax, dword [ebp - 4]
call fcn.00598fd8
mov eax, dword [ebp - 4]
call fcn.00598f20
mov eax, dword [ebp - 4]
call fcn.00598af8
mov eax, dword [ebp - 4]
mov byte [eax + 0x1619f], 1
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x598a92
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x598d94
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov byte [ebp - 6], cl
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
lea esi, [ebp - 4]
mov eax, dword [esi]
xor edx, edx
mov dword [eax + 0x80], edx
mov eax, dword [esi]
xor edx, edx
mov dword [eax + 0x84], edx
push ebp
call fcn.00598d2c
pop ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov eax, dword [esi]
mov eax, dword [eax + 0x16094]
mov edx, dword [esi]
cmp eax, dword [edx + 0x16098]
jne 0x598eb3
mov eax, dword [esi]
xor edx, edx
mov dword [eax + 0x16094], edx
push 0
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
push eax
push 0x596e4c
call sub.kernel32.dll_QueueUserAPC
cmp byte [ebp - 5], 0
je 0x598e19
mov dl, 0xf9
mov eax, dword [esi]
call fcn.00598a9c
mov eax, dword [esi]
call fcn.00598fd8
push 0x64
call sub.kernel32.dll_Sleep_1
mov eax, dword [esi]
add eax, 0x78
push eax
lea eax, [ebp - 0x14]
push eax
push pe_nt_image_headers32
mov eax, dword [esi]
add eax, 0x1609c
push eax
mov eax, dword [esi]
mov eax, dword [eax + 0x58]
push eax
call sub.kernel32.dll_ReadFile_1
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x598e8d
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x3e5
je 0x598e58
push ebp
call fcn.00598ce0
pop ecx
push 0x3e8
mov eax, dword [esi]
mov eax, dword [eax + 0x8c]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov edi, eax
cmp edi, 0xffffffff
jne 0x598e7e
mov edx, 0x1b
mov eax, dword [esi]
call fcn.00598b34
cmp edi, 0x102
jne 0x598e8d
push ebp
call fcn.00598ce0
pop ecx
push 0xffffffffffffffff
mov eax, dword [esi]
add eax, 0x16098
push eax
mov eax, dword [esi]
add eax, 0x78
push eax
mov eax, dword [esi]
mov eax, dword [eax + 0x58]
push eax
call sub.kernel32.dll_GetOverlappedResult
test eax, eax
jne 0x598eb3
push ebp
call fcn.00598ce0
pop ecx
mov eax, dword [esi]
mov eax, dword [eax + 0x16094]
mov edx, dword [esi]
cmp eax, dword [edx + 0x16098]
je 0x598ee8
mov edx, dword [esi]
mov bl, byte [edx + eax + 0x1609c]
sub bl, 0xfe
mov eax, dword [esi]
inc dword [eax + 0x16094]
test bl, 0xfe
je 0x598f15
mov dl, byte [ebp - 6]
mov eax, dword [esi]
call fcn.00598b58
push ebp
call fcn.00598d2c
pop ecx
sub eax, dword [ebp - 0x10]
sbb edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0xc]
jne 0x598f05
cmp eax, dword [ebp + 8]
jbe 0x598dca
jmp 0x598f0b
jle 0x598dca
mov dl, byte [ebp - 6]
mov eax, dword [esi]
call fcn.00598b58
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x598fd8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
or edi, 0xffffffff
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x80], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x84], edx
mov eax, dword [ebp - 4]
add eax, 0x78
push eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x90]
push eax
mov eax, dword [ebp - 4]
add eax, 0x94
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x58]
push eax
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x5990bc
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x3e5
je 0x599048
push ebp
call fcn.00598f8c
pop ecx
push 0x7d0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x8c]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x599070
mov edx, 0x1b
mov eax, dword [ebp - 4]
call fcn.00598b34
cmp ebx, 0x102
jne 0x5990b8
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x58]
push eax
call sub.kernel32.dll_ClearCommError
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x90]
sub esi, dword [ebp - 0x10]
cmp esi, edi
jne 0x5990a3
push ebp
call fcn.00598f8c
pop ecx
mov edi, esi
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
push eax
push 0x596e4c
call sub.kernel32.dll_QueueUserAPC
test ebx, ebx
jne 0x599048
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x90], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x599b54
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x2e
push 0
push 0
dec ecx
jne 0x599b5c
push ecx
push ebx
push esi
push edi
mov ebx, eax
mov esi, dword [0x5cc110]
xor eax, eax
push ebp
push 0x599d6a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5cbeec]
cmp byte [eax], 0
je 0x599d3f
cmp dword [esi], 0
je 0x599d3f
lea eax, [ebp - 0x150]
push eax
mov edx, dword [esi]
lea eax, [ebp - 0x154]
mov ecx, 0x599d80
call fcn.00404c98
mov eax, dword [ebp - 0x154]
call fcn.00404e44
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x599d3f
mov dl, 1
mov eax, dword [0x41eb20]
call fcn.00403a48
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x599d38
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
lea eax, [ebp - 0x124]
call fcn.0040cfe4
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x13c]
call fcn.0059971c
lea edx, [ebp - 0x158]
lea eax, [ebp - 0x124]
call fcn.0040cfe4
mov edx, dword [ebp - 0x158]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x150]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x599c04
jmp 0x599c89
lea ecx, [ebp - 0x164]
xor edx, edx
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov ecx, dword [ebp - 0x164]
mov edx, dword [esi]
lea eax, [ebp - 0x160]
call fcn.00404c98
mov eax, dword [ebp - 0x160]
call fcn.00404e44
mov edx, eax
lea eax, [ebp - 0x15c]
call fcn.00404b68
mov eax, dword [ebp - 0x15c]
call fcn.0040c644
xor edx, edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jg 0x599c39
lea edx, [ebp - 0x168]
mov eax, dword [ebp - 8]
call fcn.005999e8
mov eax, dword [ebp - 0x168]
call fcn.0059e428
neg eax
push eax
push 0x599d9c
push dword [ebp - 0xc]
push 0x599db4
push 0x599de8
push 0x599df8
lea edx, [ebp - 0x170]
mov eax, dword [ebp - 8]
call fcn.005999e8
push dword [ebp - 0x170]
push 0x599e0c
lea edx, [ebp - 0x174]
mov eax, dword [ebp - 8]
call fcn.00599a70
push dword [ebp - 0x174]
lea eax, [ebp - 0x16c]
mov edx, 8
call fcn.00404d0c
mov edx, dword [ebp - 0x16c]
mov eax, ebx
pop ecx
call fcn.00599e10
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x599d3f
cmp dword [ebp - 4], 0xffffffff
je 0x599d2f
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_FindClose_1
mov eax, dword [ebp - 0x10]
call fcn.00403a78
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x599d71
lea eax, [ebp - 0x174]
mov edx, 9
call fcn.0040498c
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0040498c
ret