joyce8/EMBER2024-capa huggingface dataset:
Function at 0x570770
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x40
mov esi, edx
mov edi, ecx
mov eax, dword [0x5f3418]
xor eax, ebp
mov dword [ebp - 0x10], eax
xorps xmm0, xmm0
lea ebx, [ebp - 0x4c]
movups xmmword [ebx + 0xc], xmm0
push 0x2454
push 0
push edx
call fcn.005191b0
add esp, 0xc
mov dword [ebx], 0x3c
lea eax, [esi + 8]
mov dword [ebx + 4], eax
mov dword [ebx + 8], 0x20
lea eax, [esi + 0x2148]
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x14], 0x100
lea eax, [esi + 0x48]
mov dword [ebx + 0x2c], eax
mov eax, 0x800
mov dword [ebx + 0x30], eax
lea ecx, [esi + 0x1048]
mov dword [ebx + 0x34], ecx
mov dword [ebx + 0x38], eax
lea eax, [esi + 0x2348]
mov dword [ebx + 0x1c], eax
mov eax, 0x80
mov dword [ebx + 0x20], eax
lea ecx, [esi + 0x2048]
mov dword [ebx + 0x24], ecx
mov dword [ebx + 0x28], eax
push edi
call fcn.00510eb5
add esp, 4
push ebx
push dword [ebp + 8]
push eax
push edi
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x570851
mov eax, dword [ebp - 0x40]
xor ebx, ebx
cmp eax, 4
ja 0x570853
mov ecx, 0x1a
bt ecx, eax
jae 0x570853
mov dword [esi + 0x2448], 0
mov byte [esi + 0x244c], 0
movzx ecx, word [ebp - 0x34]
mov word [esi], cx
mov dword [esi + 4], eax
mov dword [esi + 0x2450], 0xffffffff
mov bl, 1
jmp 0x570853
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512ee3
mov eax, ebx
add esp, 0x40
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x570870
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x5f3418]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [ecx + 0xc], 0
je 0x57089f
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512ee3
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, ecx
lea edi, [ecx + 0x5d530]
push str.MetalinkFile
push edi
call fcn.005196eb
add esp, 8
test eax, eax
je 0x5708d0
mov word [eax], 0
add eax, 0x1a
push eax
call fcn.00530db9
add esp, 4
mov dword [esi + 0x2694], eax
mov eax, dword [esi + 0x62ce0]
cmp eax, dword [esi + 0x62cdc]
je 0x570929
sub esp, 0x10
movaps xmm0, xmmword [0x5d6dd0]
movups xmmword [esp], xmm0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x2464], eax
mov bl, 1
test eax, eax
je 0x57088b
xor eax, eax
lea ecx, [ebp - 0x14]
mov dword [ecx], eax
mov dword [esi + 0x5d0f8], 8
push ecx
push eax
push esi
push 0x570970
push eax
push eax
call fcn.00527965
add esp, 0x18
mov dword [esi + 0xc], eax
jmp 0x57088b
lea edx, [esi + 0x10]
mov ecx, edi
push 0
call fcn.00570770
add esp, 4
test al, al
je 0x570889
jmp 0x5708de
Function at 0x572250
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov esi, esp
mov edi, edx
mov ebx, ecx
mov eax, dword [0x5f3418]
xor eax, ebp
mov dword [esi + 0x28], eax
lea eax, [ecx + 0x61850]
xor ecx, ecx
cmp word [ebx + 0x61850], 0
cmove eax, ecx
sub esp, 0x14
movaps xmm0, xmmword [0x5def90]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [edi + 0x14], eax
test eax, eax
je 0x5723ec
mov dword [esi + 0xc], edi
mov ecx, dword [edi + 0x20]
lea edx, [ecx + 0x2048]
cmp word [ecx + 0x2348], 0
je 0x5722c2
mov edi, ecx
add edi, 0x2348
jne 0x5722db
mov dword [esi + 8], edx
lea edx, [ebx + 0x60608]
xor edi, edi
cmp word [ebx + 0x60608], 0
cmovne edi, edx
mov edx, dword [esi + 8]
test edx, edx
je 0x5722e9
cmp word [ecx + 0x2048], 0
jne 0x572300
lea edx, [ebx + 0x60708]
mov dword [esi + 8], edx
xor edx, edx
cmp word [ebx + 0x60708], 0
cmovne edx, dword [esi + 8]
mov dword [esi + 8], edx
xor edx, edx
cmp dword [ecx + 4], 1
setne dl
lea ecx, [edx + edx + 1]
mov dword [esi + 0x10], ecx
push 0x571320
push eax
call dword [sym.imp.WININET.dll_InternetSetStatusCallbackW]
mov edx, dword [esi + 0xc]
mov eax, dword [edx + 0x20]
movzx ecx, word [eax]
add eax, 0x2148
push edx
push dword [ebx + 0x26d4]
push dword [esi + 0x10]
push dword [esi + 8]
push edi
mov edi, edx
push ecx
push eax
push dword [edx + 0x14]
call dword [sym.imp.WININET.dll_InternetConnectW]
mov dword [edi + 0x18], eax
test eax, eax
je 0x5723ec
cmp word [ebx + 0x60808], 0
je 0x5723e8
xor edi, edi
mov dword [esi + 0x14], 3
add ebx, 0x60808
je 0x5723ca
push ebx
call fcn.00510eb5
add esp, 4
cmp eax, 0x3ffffffe
jg 0x5723ca
lea ecx, [eax + eax]
add ecx, 2
mov dword [esi + 8], ecx
add eax, eax
add eax, 5
and eax, 0xfffffffc
call fcn.00517ca0
mov edi, esp
and edi, 0xfffffff0
mov esp, edi
push ecx
push 0xff
push edi
call fcn.005191b0
add esp, 0xc
mov byte [edi], 0
xor eax, eax
push eax
push eax
push dword [esi + 8]
push edi
push 0xffffffffffffffff
push ebx
push eax
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
cmove edi, eax
lea eax, [esi + 0x14]
mov dword [eax + 4], edi
mov dword [eax + 8], 0x5da01a
push 0xc
push eax
push 0x26
mov eax, dword [esi + 0xc]
push dword [eax + 0x14]
call dword [sym.imp.WININET.dll_InternetSetOptionA]
mov bl, 1
jmp 0x5723ee
xor ebx, ebx
mov ecx, dword [esi + 0x28]
xor ecx, ebp
call fcn.00512ee3
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5724c0
Capabilities:
Send data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov eax, dword [0x5f3418]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [ecx + 0x26d8]
mov ecx, dword [ecx + 0x26dc]
sub ecx, eax
sar ecx, 2
cmp ecx, edx
jbe 0x57259e
mov edi, dword [eax + edx*4]
mov dword [edi + 0x28], 2
mov eax, dword [edi + 0x20]
cmp dword [eax + 4], 1
jne 0x572526
cmp dword [edi], 0
jne 0x57257a
mov eax, dword [edi + 4]
test eax, eax
je 0x57257a
mov dword [edi + 0x18], eax
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512ee3
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
mov bl, 1
cmp dword [esi + 0x2480], 0
je 0x572512
lea eax, [ebp - 0x14]
mov dword [eax], 0
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp - 0x14]
push eax
push dword [esi + 0x2484]
push dword [esi + 0x2480]
push dword [edi + 0x1c]
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
je 0x57256b
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x572512
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x572512
jmp 0x572597
mov dword [edi + 0x28], 0
mov ecx, esi
push 1
call fcn.00573c20
add esp, 4
mov bl, 1
test al, al
jne 0x572512
xor ebx, ebx
jmp 0x572512
push str.vector___index_out_of_bounds
push str.__n___size__
push 0x587
push str....._buildtools_third_partylibc_trunkinclude_vector
push str._s:_d:_assertion__s_failed:__s
call fcn.005495a0
int3
Function at 0x572eb0
Capabilities:
Send data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov eax, dword [0x5f3418]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [ecx + 0x26d8]
mov ecx, dword [ecx + 0x26dc]
sub ecx, eax
sar ecx, 2
cmp ecx, edx
jbe 0x572f91
mov edi, edx
mov ebx, dword [eax + edx*4]
mov dword [ebx + 0x28], 6
mov eax, dword [ebx + 0x20]
cmp dword [eax + 4], 1
jne 0x572f18
cmp dword [ebx], 0
jne 0x572f68
mov eax, dword [ebx + 4]
test eax, eax
je 0x572f68
mov dword [ebx + 0x18], eax
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512ee3
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
cmp dword [esi + 0x2480], 0
je 0x572f02
lea edi, [ebp - 0x14]
mov dword [edi], 0
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push edi
push dword [esi + 0x2484]
push dword [esi + 0x2480]
push dword [ebx + 0x1c]
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
je 0x572f58
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x572f02
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
sete bl
jmp 0x572f04
mov dword [ebx + 0x28], 4
mov ecx, esi
mov edx, edi
push 1
call fcn.00573c20
add esp, 4
mov bl, 1
test al, al
jne 0x572f04
mov ecx, esi
mov edx, edi
call fcn.00573b30
jmp 0x572f04
push str.vector___index_out_of_bounds
push str.__n___size__
push 0x587
push str....._buildtools_third_partylibc_trunkinclude_vector
push str._s:_d:_assertion__s_failed:__s
call fcn.005495a0
int3
Function at 0x573410
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [ecx + 0x26d8]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ecx + 0x26dc]
sub ecx, eax
sar ecx, 2
cmp ecx, edx
jbe 0x573545
mov dword [ebp - 0x14], edx
mov ebx, dword [eax + edx*4]
xor eax, eax
mov dword [ebx + 0x8068], eax
xorps xmm0, xmm0
movups xmmword [ebx + 0x8058], xmm0
movups xmmword [ebx + 0x8048], xmm0
mov dword [ebx + 0x8044], 0x28
lea esi, [ebx + 0x40]
mov edi, 0x8000
push edi
push eax
push esi
call fcn.005191b0
add esp, 0xc
mov dword [ebx + 0x8058], esi
lea esi, [ebx + 0x805c]
mov dword [ebx + 0x805c], edi
mov ecx, dword [ebx + 0x8040]
test ecx, ecx
je 0x573500
mov edx, dword [ecx + 8]
mov eax, dword [ecx + 0x10]
add edx, dword [ecx + 0x18]
sub eax, edx
inc eax
mov ecx, 0x8000
cmp eax, ecx
cmovl ecx, eax
mov dword [esi], ecx
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [ebx + 0x28], 9
mov eax, dword [ebx + 0x20]
cmp dword [eax + 4], 1
jne 0x5734d6
push esi
push dword [ebx + 0x805c]
push dword [ebx + 0x8058]
push dword [ebx + 0x1c]
call dword [sym.imp.WININET.dll_InternetReadFile]
jmp 0x5734e9
lea eax, [ebx + 0x8044]
push ebx
push 1
push eax
push dword [ebx + 0x1c]
call dword [sym.imp.WININET.dll_InternetReadFileExA]
test eax, eax
je 0x573524
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov al, 1
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx + 0x5d100]
mov ecx, dword [ecx + 0x5d104]
and ecx, eax
cmp ecx, 0xffffffff
je 0x5734a5
mov ecx, dword [ebp - 0x10]
sub eax, dword [ecx + 0x5d110]
jmp 0x573499
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov al, 1
cmp ecx, 0x3e5
je 0x5734f8
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
call fcn.00573b30
xor eax, eax
jmp 0x5734f8
push str.vector___index_out_of_bounds
push str.__n___size__
push 0x587
push str....._buildtools_third_partylibc_trunkinclude_vector
push str._s:_d:_assertion__s_failed:__s
call fcn.005495a0
int3
Function at 0x573950
Capabilities:
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1044
call fcn.00517ca0
mov esi, ecx
mov eax, dword [0x5f3418]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor ebx, ebx
cmp dword [ecx + 0x2480], ebx
mov eax, 0x5da01c
mov ecx, str.POST
cmove ecx, eax
mov dword [ebp - 0x1050], ecx
mov edi, edx
movsd xmm0, qword [0x5df020]
lea eax, [ebp - 0x18]
movsd qword [eax], xmm0
lea eax, [ebp - 0x1018]
push 0x1000
push ebx
push eax
call fcn.005191b0
add esp, 0xc
mov eax, dword [edi + 0x20]
lea ecx, [eax + 0x1048]
add eax, 0x48
sub esp, 0x14
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x1018]
mov dword [esp], eax
call fcn.00574640
add esp, 0x14
xor eax, eax
mov dword [ebp - 0x104c], esi
cmp dword [esi + 0x62cb4], ebx
mov esi, edi
setne al
shl eax, 0x13
mov ecx, dword [edi + 0x20]
cmp dword [ecx + 4], 4
mov ecx, 0x8480f300
mov edx, 0x8400c300
cmove edx, ecx
or edx, eax
push edi
push edx
lea eax, [ebp - 0x18]
push eax
push ebx
push str.HTTP_1.1
lea eax, [ebp - 0x1018]
push eax
push dword [ebp - 0x1050]
push dword [edi + 0x18]
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov dword [edi + 0x1c], eax
test eax, eax
je 0x573ab5
lea ecx, [ebp - 0x101c]
mov dword [ecx], 0x3a98
mov ebx, 4
mov edi, dword [sym.imp.WININET.dll_InternetSetOptionW]
push ebx
push ecx
push 2
push eax
call edi
lea eax, [ebp - 0x1020]
mov dword [eax], 1
push ebx
push eax
push 0x41
push dword [esi + 0x1c]
call edi
mov edi, eax
xorps xmm0, xmm0
movups xmmword [ebp - 0x1034], xmm0
movups xmmword [ebp - 0x1044], xmm0
mov dword [ebp - 0x1024], 0
mov dword [ebp - 0x1048], 0x28
push 0xa2d0
call fcn.00510d94
add esp, 4
test eax, eax
jne 0x573acc
lea eax, [ebp - 0x1048]
push esi
push 1
push 0
push eax
push dword [esi + 0x1c]
call dword [sym.imp.WININET.dll_HttpSendRequestExW]
mov esi, eax
test esi, esi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512ee3
mov eax, ebx
add esp, 0x1044
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebx, eax
xor eax, eax
test edi, edi
setne al
mov edi, eax
xor eax, eax
push 0xa2d0
push eax
push ebx
call fcn.005191b0
add esp, 0xc
mov ecx, dword [ebp - 0x104c]
mov edx, esi
push edi
push ebx
call fcn.005746a0
add esp, 8
lea edi, [ebp - 0x1048]
mov dword [edi + 8], ebx
push ebx
call fcn.00510eb5
add esp, 4
mov dword [edi + 0xc], eax
push esi
push 1
xor eax, eax
push eax
push edi
push dword [esi + 0x1c]
call dword [sym.imp.WININET.dll_HttpSendRequestExW]
mov esi, eax
push ebx
call fcn.00510d5f
add esp, 4
jmp 0x573ab0
Function at 0x574410
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, edx
mov eax, dword [0x5f3418]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [edx + 0x805c]
mov edx, dword [edx + 0x20]
cmp dword [edx + 4], 1
cmove eax, esi
mov edi, ecx
mov ebx, dword [eax]
cmp byte [ecx + 0x26f0], 0
jne 0x57447c
xor eax, eax
lea ecx, [ebp - 0x14]
mov dword [ecx], eax
lea edx, [esi + 0x40]
push eax
push ecx
push ebx
push edx
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x574466
cmp dword [ebp - 0x14], ebx
je 0x5744fc
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512ee3
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, edi
call fcn.00574d00
mov edx, dword [esi + 0x8040]
mov eax, dword [edx + 0x18]
add eax, dword [edx + 8]
mov ecx, dword [edx + 0x1c]
mov dword [ebp - 0x1c], edx
adc ecx, dword [edx + 0xc]
lea edx, [ebp - 0x14]
mov dword [edx], ecx
push 0
push edx
push eax
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x57451d
xor eax, eax
lea ecx, [ebp - 0x18]
mov dword [ecx], eax
lea edx, [esi + 0x40]
push eax
push ecx
push ebx
push edx
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x574466
cmp dword [ebp - 0x18], ebx
jne 0x574466
mov eax, dword [ebp - 0x1c]
add dword [eax + 0x18], ebx
adc dword [eax + 0x1c], 0
add dword [edi + 0x5d110], ebx
adc dword [edi + 0x5d114], 0
mov ecx, edi
mov edx, esi
push ebx
call fcn.00574ee0
add esp, 4
mov ecx, edi
call fcn.00574df0
jmp 0x574516
add dword [edi + 0x5d110], ebx
adc dword [edi + 0x5d114], 0
mov ecx, edi
mov edx, esi
push ebx
call fcn.00574ee0
add esp, 4
mov bl, 1
jmp 0x574468
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x574466
jmp 0x5744af
Function at 0x574d00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x214
mov esi, ecx
mov eax, dword [0x5f3418]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor edi, edi
lea ebx, [ebp - 0x21c]
mov dword [ebx], edi
mov dword [ebp - 0x220], edi
lea eax, [ebp - 0x218]
push 0x208
push edi
push eax
call fcn.005191b0
add esp, 0xc
push 2
push edi
push 0xffffffffffffff96
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
push ebx
push 0x6a
lea eax, [ebp - 0x218]
push eax
mov edi, esi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebx], 0x6a
jne 0x574dd6
mov esi, ebx
push str.546865576F726C64_86C36F73_2C25_4a7d_91EA_F5581018A42D
lea eax, [ebp - 0x218]
push eax
call fcn.005341be
add esp, 8
test eax, eax
jne 0x574dd6
mov eax, 0xfffffffc
sub eax, dword [ebp - 0x21c]
xor ecx, ecx
inc ecx
xor edx, edx
push ecx
push edx
push eax
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea ebx, [ebp - 0x220]
xor eax, eax
push eax
push esi
push 4
push ebx
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebx]
add eax, dword [ebp - 0x21c]
neg eax
xor ecx, ecx
inc ecx
push ecx
xor ecx, ecx
push ecx
push eax
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512ee3
add esp, 0x214
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x574df0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov eax, dword [0x5f3418]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov edi, dword [ecx + 0x26e8]
mov ebx, dword [ecx + 0x26e4]
mov ecx, edi
sub ecx, ebx
sar ecx, 2
mov dword [ebp - 0x18], ecx
push 2
push eax
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp edi, ebx
je 0x574ebe
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x18]
push 0
push eax
push 4
push ecx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 0x26e4]
cmp dword [esi + 0x26e8], eax
je 0x574e8e
mov ebx, 4
xor edi, edi
push 0
lea ecx, [ebp - 0x14]
push ecx
push 0x20
push dword [eax + edi*4]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
add ebx, 0x20
inc edi
mov eax, dword [esi + 0x26e4]
mov ecx, dword [esi + 0x26e8]
sub ecx, eax
sar ecx, 2
cmp edi, ecx
jb 0x574e5f
jmp 0x574e93
mov ebx, 4
mov dword [ebp - 0x18], ebx
xor eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
lea edi, [ebp - 0x14]
push edi
push 4
lea eax, [ebp - 0x18]
push eax
push dword [esi + 8]
call ebx
xor eax, eax
push eax
push edi
push 0x6a
push str.546865576F726C64_86C36F73_2C25_4a7d_91EA_F5581018A42D
push dword [esi + 8]
call ebx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512ee3
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x575780
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [0x5f3418]
xor eax, ebp
mov dword [esp + 0x20], eax
lea esi, [esp + 0xc]
mov dword [esi], 0xffffffff
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push esi
push 0x28
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x575815
lea eax, [esp + 0x14]
push eax
push 0x5df30c
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x575819
lea eax, [esp + 0x10]
mov dword [eax], 1
mov dword [eax + 0xc], 2
xor ecx, ecx
push ecx
push ecx
push 0x10
push eax
push ecx
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov esi, eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x20]
xor ecx, ebp
call fcn.00512ee3
mov eax, esi
lea esp, [ebp - 4]
pop esi
pop ebp
ret
xor esi, esi
jmp 0x575802
xor esi, esi
jmp 0x5757f8
Function at 0x575a70
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x5f3418]
xor eax, ebp
mov dword [ebp - 0x10], eax
call fcn.00421010
xor esi, esi
cmp eax, 1
jne 0x575b02
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x575ae4
mov dword [ebp - 0x14], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xc]
mov edi, dword [eax + 0xc]
mov ebx, dword [edi]
xor esi, esi
dec esi
cmp ebx, edi
je 0x575b02
cmp dword [ebx + 0x1c], 0
je 0x575ae0
movzx eax, word [ebx + 0x2c]
shr eax, 1
push eax
push dword [ebp + 8]
push dword [ebx + 0x30]
call fcn.0052fefc
add esp, 0xc
test eax, eax
je 0x575afa
mov ebx, dword [ebx]
jmp 0x575abd
cmp byte [ebp + 0xc], 0
je 0x575b16
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
jne 0x575a9c
int3
mov word [ebx + 0x38], 0xffff
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512ee3
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
dec esi
jmp 0x575b02
Function at 0x576a70
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x2d18
call fcn.00517ca0
mov eax, dword [0x5f3418]
xor eax, ebp
mov dword [esp + 0x2d10], eax
xor ebx, ebx
test ecx, ecx
je 0x576baf
mov esi, ecx
xor ebx, ebx
mov eax, 0x200
push eax
push 0xff
lea edi, [esp + 0x2b18]
push edi
call fcn.005191b0
add esp, 0xc
push ebx
push str..PhysicalDrive_d
mov eax, 0x200
push eax
push edi
call fcn.00576700
sub esp, 0xc
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
movaps xmm0, xmmword [0x5df520]
movups xmmword [esp + 4], xmm0
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x576ba3
mov dword [esp], eax
xor edi, edi
mov dword [esp + 4], edi
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
mov dword [esp + 0x10], edi
mov eax, 0x2710
push eax
push edi
lea eax, [esp + 0x408]
push eax
call fcn.005191b0
add esp, 0xc
push edi
mov edi, dword [esp + 4]
lea eax, [esp + 8]
push eax
mov eax, 0x2710
push eax
lea eax, [esp + 0x40c]
push eax
push 0xc
lea eax, [esp + 0x1c]
push eax
push 0x2d1400
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x576b9c
push 0x3e8
push 0
lea edi, [esp + 0x20]
push edi
call fcn.005191b0
add esp, 0xc
push edi
mov edi, dword [esp + 4]
push 1
push dword [esp + 0x420]
lea eax, [esp + 0x40c]
push eax
call fcn.00587620
add esp, 0x10
xor eax, eax
mov cl, byte [esp + eax + 0x18]
test cl, cl
je 0x576bc7
mov byte [esi + eax], cl
inc eax
cmp eax, 0x64
jne 0x576b86
mov byte [esi + eax - 1], 0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, 0x10
jne 0x576a9f
xor ebx, ebx
mov ecx, dword [esp + 0x2d10]
xor ecx, ebp
call fcn.00512ee3
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov byte [esi + eax], 0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
jmp 0x576baf