joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5b70b2
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
mov ebx, edx
push 0x44
mov esi, ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x5c]
xor edi, edi
push edi
push eax
call fcn.006f59b0
push 0xffffffffffffffff
mov edx, esi
mov dword [ebp - 0x5c], 0x44
xor ecx, ecx
call fcn.005b0c60
add esp, 0x10
mov esi, eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x5c]
push eax
push ebx
push edi
push dword [ebp + 8]
push edi
push edi
push edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x5b7115
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x14]
push esi
call fcn.00702f96
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x5b716f
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0xee37e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
mov word [ebp - 8], 0x500
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x5b71b3
xor al, al
jmp 0x5b71d3
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
push eax
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [ebp - 0x14], ebx
setne al
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.006f3e28
leave
ret

Function at 0x5b770f
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, ecx
mov bl, dl
test edi, edi
sete cl
call fcn.00420997
test edi, edi
je 0x5b7793
test bl, bl
jne 0x5b773d
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x5b7793
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
mov ecx, edi
call fcn.005b0bf2
inc eax
mov dword [ebp - 4], eax
add eax, eax
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x5b7781
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x5b7771
mov edx, dword [ebp - 4]
mov ecx, eax
push edi
call fcn.005b26f2
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test bl, bl
jne 0x5b778b
call dword [sym.imp.USER32.dll_CloseClipboard]
test esi, esi
pop esi
setne al
jmp 0x5b7795
xor al, al
pop edi
pop ebx
leave
ret
Function at 0x5b7799
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov esi, ecx
test esi, esi
jne 0x5b77aa
xor al, al
jmp 0x5b77f6
push edi
lea eax, [ebp - 0x18]
push eax
push 0x18
push esi
call dword [sym.imp.GDI32.dll_GetObjectW]
cmp dword [ebp - 4], 0
je 0x5b77e5
push 0
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 0
push esi
call dword [sym.imp.USER32.dll_CopyImage]
mov esi, eax
push esi
push 2
call dword [sym.imp.USER32.dll_SetClipboardData]
push esi
mov edi, eax
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x5b77f0
push esi
push 2
call dword [sym.imp.USER32.dll_SetClipboardData]
mov edi, eax
test edi, edi
pop edi
setne al
pop esi
leave
ret

Function at 0x5b8053
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0
push 0
mov eax, edx
mov edi, ecx
push 0xe
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, eax
lea esi, [ebx*2 + 4]
call fcn.005b45bd
mov edx, esi
mov ecx, eax
call fcn.005b3af2
mov esi, eax
test esi, esi
jne 0x5b8092
and dword [edi], eax
and dword [edi + 4], eax
jmp 0x5b80a7
push esi
lea eax, [ebx + 1]
push eax
push 0xd
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [edi], esi
mov dword [edi + 4], ebx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x5b866f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0xee37e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
xor edi, edi
lea eax, [ebp - 0x210]
push edi
push eax
mov ebx, ecx
xor esi, esi
call fcn.006f59b0
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x5b8702
cmp eax, 0x104
jae 0x5b8702
push edi
mov edx, str.explorer.exe
lea ecx, [ebp - 0x210]
call fcn.005b4b63
pop ecx
push esi
mov edi, eax
call fcn.00702f96
pop ecx
mov ecx, edi
call fcn.005b5305
test al, al
je 0x5b8702
push ebx
push edi
push str.__s____s_
call fcn.005b24d2
add esp, 0xc
mov esi, eax
push 0
call fcn.00702f96
pop ecx
test esi, esi
je 0x5b8702
mov ebx, esi
push 0
xor edx, edx
mov ecx, ebx
call fcn.005b70b2
pop ecx
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x214], eax
call fcn.005b8651
push edi
call fcn.00702f96
pop ecx
push esi
call fcn.00702f96
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006f3e28
leave
ret
Function at 0x5b873c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0xa
push 2
push 0
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
sete cl
call fcn.00420997
test edi, edi
je 0x5b87b2
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
sete cl
call fcn.00420997
test ebx, ebx
je 0x5b87b2
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
sete cl
call fcn.00420997
test edi, edi
je 0x5b87b2
mov ebx, dword [ebp - 4]
mov edx, edi
push ebx
xor ecx, ecx
call fcn.005b0c13
pop ecx
mov dword [esi], eax
mov dword [esi + 4], ebx
jmp 0x5b87b9
and dword [esi], 0
and dword [esi + 4], 0
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x5b8932
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push 2
push eax
push 0xd
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor eax, eax
cmp word [ebp - 4], 0x30
setne al
leave
ret

Function at 0x5b9502
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d0
mov eax, dword [0xee37e4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, edx
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp esi, eax
je 0x5b95d1
push esi
push str._r_nThread:__x_r_n
push edi
call fcn.005b1d7c
add esp, 0xc
push esi
push 0
push 0x4a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
test esi, esi
jne 0x5b9559
push 0xffffffffffffffff
push str.Failed_to_OpenThread___r_n
mov ecx, edi
call fcn.005b1c86
jmp 0x5b95d1
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x5b9574
push eax
push str.Failed_to_SuspendThread___r_n
mov ecx, edi
call fcn.005b1c86
jmp 0x5b95ca
push 0x2c8
lea eax, [ebp - 0x2cc]
push 0
push eax
call fcn.006f59b0
add esp, 0xc
mov dword [ebp - 0x2d0], 0x10007
lea eax, [ebp - 0x2d0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov ecx, edi
test eax, eax
je 0x5b95b7
push esi
lea edx, [ebp - 0x2d0]
call fcn.005b9369
pop ecx
jmp 0x5b95c3
push 0xffffffffffffffff
push str.Failed_to_GetThreadContext___r_n
call fcn.005b1c86
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.006f3e28
leave
ret
Function at 0x5b96c8
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0xee37e4]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 4
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffff
jne 0x5b96ed
jmp 0x5b9741
mov dword [ebp - 0x20], 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_Thread32First]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x5b9738
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x2c]
jne 0x5b9726
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
call fcn.005b9502
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_Thread32Next]
mov dword [ebp - 0x28], eax
jmp 0x5b970d
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006f3e28
leave
ret

Function at 0x5bc5f7
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp byte [0xf03676], 0
push edi
mov edi, edx
mov dword [ebp - 4], edi
jne 0x5bc662
push ebx
push esi
xor esi, esi
inc esi
and dword [0xf08920], 0
lea ecx, [esi + 0x7f]
mov eax, esi
lea ebx, [ecx*4 + 0xf08920]
and al, 1
mov edi, ecx
movzx eax, al
neg eax
sbb eax, eax
shr esi, 1
and eax, 0xedb88320
shl edi, 3
xor esi, eax
xor edx, edx
mov eax, dword [edx + 0xf08920]
add edx, edi
xor eax, esi
mov dword [ebx], eax
add ebx, edi
cmp edx, 0x400
jb 0x5bc63c
shr ecx, 1
jne 0x5bc61a
mov edi, dword [ebp - 4]
pop esi
mov byte [0xf03676], 1
pop ebx
mov edx, dword [ebp + 8]
or ecx, 0xffffffff
test edx, edx
je 0x5bc684
movzx eax, byte [edi]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0xf08920]
inc edi
sub edx, 1
jne 0x5bc66c
not ecx
mov eax, ecx
pop edi
leave
ret
Function at 0x5bc9b2
Capabilities:
Check http status code
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x424
mov eax, dword [0xee37e4]
xor eax, esp
mov dword [esp + 0x420], eax
push ebx
push esi
push edi
mov esi, ecx
mov dword [esp + 0x10], edx
push esi
push str.HttpGet:_url:__s_n
call fcn.005b3949
xor ebx, ebx
mov dword [esp + 0x20], 4
push 0xffffffffffffffff
mov edx, esi
lea ecx, [esp + 0x2c]
mov edi, ebx
call fcn.005b47cf
mov esi, dword [esp + 0x1c]
add esp, 0xc
mov eax, dword [eax]
push ebx
push ebx
push ebx
push ebx
push str.SumatraPdfHTTP
mov dword [esp + 0x28], eax
mov dword [esi + 0x3c], ebx
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x5bca2a
push str.HttpGet:_InternetOpen_failed_n
jmp 0x5bcabb
push ebx
push 0x84000000
push ebx
push ebx
push dword [esp + 0x24]
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov edi, eax
test edi, edi
jne 0x5bca4a
push str.HttpGet:_InternetOpenUrl_failed_n
jmp 0x5bcabb
push ebx
lea eax, [esp + 0x1c]
push eax
lea eax, [esi + 0x40]
push eax
push 0x20000013
push edi
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
jne 0x5bca98
push str.HttpGet:_HttpQueryInfoW_failed_n
jmp 0x5bcabb
cmp dword [esp + 0x10], ebx
je 0x5bcae0
lock inc dword [0xefcb80]
push dword [esp + 0x10]
lea eax, [esp + 0x2c]
push eax
lea ecx, [esi + 8]
call fcn.005b1c86
lock dec dword [0xefcb80]
test al, al
je 0x5bcb1d
lea eax, [esp + 0x10]
mov dword [esp + 0x10], ebx
push eax
push 0x400
lea eax, [esp + 0x30]
push eax
push edi
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x5bca6b
push str.HttpGet:_InternetReadFile_failed_n
call fcn.005b3949
pop ecx
xor ecx, ecx
call fcn.005b66cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x3c], eax
test eax, eax
jne 0x5bcadc
mov dword [esi + 0x3c], 0x1f
test edi, edi
je 0x5bcae7
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x5bcaf6
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
cmp dword [esi + 0x3c], ebx
jne 0x5bcb06
cmp dword [esi + 0x40], 0xc8
jne 0x5bcb06
mov bl, 1
mov ecx, dword [esp + 0x42c]
mov al, bl
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.006f3e28
mov esp, ebp
pop ebp
ret
push str.HttpGet:_data.Append_failed_n
call fcn.005b3949
pop ecx
jmp 0x5bcac8
Function at 0x5bcb2a
Capabilities:
Check http status code
Create http request
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0xee37e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov eax, edx
mov esi, ecx
push eax
push esi
push str.HttpGetToFile:_url:__s__file:__s_n
mov dword [ebp - 0x410], eax
call fcn.005b3949
add esp, 0xc
mov dword [ebp - 0x420], 4
xor ebx, ebx
lea ecx, [ebp - 0x42c]
mov edx, esi
mov dword [ebp - 0x40c], ebx
mov edi, ebx
mov dword [ebp - 0x418], ebx
push 0xffffffffffffffff
call fcn.005b47cf
mov esi, dword [ebp - 0x410]
mov edx, esi
pop ecx
push 0xffffffffffffffff
mov eax, dword [eax]
lea ecx, [ebp - 0x434]
mov dword [ebp - 0x414], eax
call fcn.005b47cf
pop ecx
push ebx
push 0x80
mov eax, dword [eax]
push 2
push ebx
push 1
push 0x40000000
push eax
mov dword [ebp - 0x424], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x410], eax
cmp eax, 0xffffffff
jne 0x5bcbe6
push esi
push str.HttpGetToFile:_CreateFileW__s__failed_n
call fcn.005b3949
pop ecx
pop ecx
xor ecx, ecx
call fcn.005b66cf
mov esi, ebx
jmp 0x5bcca2
push ebx
push ebx
push ebx
push ebx
push str.SumatraPdfHTTP
call dword [sym.imp.WININET.dll_InternetOpenW]
mov esi, eax
test esi, esi
je 0x5bcca2
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x414]
push esi
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov edi, eax
test edi, edi
je 0x5bcca2
push ebx
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x418]
push eax
push 0x20000013
push edi
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x5bcca2
cmp dword [ebp - 0x418], 0xc8
jmp 0x5bcc7e
cmp dword [ebp - 0x40c], ebx
je 0x5bcca0
push ebx
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x40c]
lea eax, [ebp - 0x408]
push eax
push dword [ebp - 0x410]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x5bcca2
mov eax, dword [ebp - 0x414]
cmp eax, dword [ebp - 0x40c]
jne 0x5bcca2
lea eax, [ebp - 0x40c]
push eax
push 0x400
lea eax, [ebp - 0x408]
push eax
push edi
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x5bcc45
jmp 0x5bcca2
mov bl, 1
push dword [ebp - 0x410]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x5bccb9
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
test esi, esi
je 0x5bccc4
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
test bl, bl
jne 0x5bccd3
mov ecx, dword [ebp - 0x424]
call fcn.005b54a1
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006f3e28
leave
ret

Function at 0x5bd057
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
xor ecx, ecx
lea eax, [esi + 8]
mov dword [esi], ecx
push eax
push dword [ebp + 8]
mov dword [esi + 4], 1
mov dword [eax], ecx
mov dword [esi + 0xc], ecx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [esi], eax
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x5be6d6
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0xf0000000
push 1
xor ebx, ebx
lea eax, [ebp - 0xc]
push str.Microsoft_Base_Cryptographic_Provider_v1.0
push ebx
push eax
mov esi, edx
mov dword [ebp - 0xc], ebx
mov edi, ecx
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
sete cl
call fcn.00420997
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push 0x8003
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
sete cl
call fcn.00420997
xor cl, cl
call fcn.00420997
push ebx
push esi
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
sete cl
call fcn.00420997
mov edi, dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
lea eax, [ebp - 0x10]
push 4
mov dword [ebp - 8], ebx
pop ebx
push 0
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0x10], ebx
push eax
push ebx
push dword [ebp - 4]
call edi
cmp dword [ebp - 0x10], ebx
mov esi, eax
setne cl
call fcn.00420997
test esi, esi
sete cl
call fcn.00420997
cmp dword [ebp - 8], 0x10
setne cl
call fcn.00420997
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
push 2
push dword [ebp - 4]
call edi
test eax, eax
sete cl
call fcn.00420997
cmp dword [ebp - 8], 0x10
setne cl
call fcn.00420997
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push 0
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x5bfb71
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0xee37e4]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov dword [ebp - 0x260], edx
mov esi, ecx
call fcn.005b49ea
push 0x250
mov edi, eax
xor ebx, ebx
lea eax, [ebp - 0x25c]
push ebx
push eax
call fcn.006f59b0
add esp, 0xc
lea eax, [ebp - 0x25c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x5bfc30
test byte [ebp - 0x25c], 0x10
je 0x5bfbdf
cmp byte [ebp + 8], bl
je 0x5bfc0b
lea ecx, [ebp - 0x230]
call fcn.005bfa44
test al, al
jmp 0x5bfbe2
cmp byte [ebp + 8], bl
jne 0x5bfc0b
push ebx
lea edx, [ebp - 0x230]
mov ecx, edi
call fcn.005b4b63
pop ecx
mov ecx, dword [ebp - 0x260]
mov dword [ebp - 0x264], eax
lea eax, [ebp - 0x264]
push eax
call fcn.004354ee
lea eax, [ebp - 0x25c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x5bfbc2
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x260]
cmp dword [eax + 4], ebx
seta bl
push edi
call fcn.00702f96
pop ecx
mov ecx, dword [ebp - 8]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006f3e28
leave
ret
Function at 0x5bfc48
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
mov eax, dword [0xee37e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push dword [ebp + 0xc]
mov esi, edx
mov dword [ebp - 0x264], ecx
push dword [ebp + 8]
lea ecx, [ebp - 0x260]
mov dword [ebp - 0x268], esi
call fcn.005b4817
mov ecx, dword [ebp - 0x260]
xor ebx, ebx
push ebx
mov edx, 0xe7a724
call fcn.005b4b63
add esp, 0xc
mov dword [ebp - 0x26c], eax
lea ecx, [ebp - 0x258]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x5bfd5a
mov ecx, dword [ebp - 0x258]
call fcn.005bfa29
test al, al
je 0x5bfd3b
push 0xffffffffffffffff
lea edx, [ebp - 0x22c]
lea ecx, [ebp - 0x27c]
call fcn.005b471e
mov edx, dword [ebp - 0x27c]
pop ecx
mov ecx, dword [ebp + 8]
push ebx
call fcn.005b48ad
pop ecx
push eax
lea ecx, [ebp - 0x274]
call fcn.0042784f
mov ecx, dword [esi + 0x24]
mov esi, dword [ebp - 0x274]
test ecx, ecx
je 0x5bfd22
mov eax, dword [ebp - 0x270]
lea edx, [ebp - 0x260]
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x260], esi
mov eax, dword [ecx]
push edx
mov eax, dword [eax + 8]
call eax
test al, al
je 0x5bfd2e
mov ecx, dword [ebp - 0x264]
push esi
call fcn.005b2fee
push esi
call fcn.00702f96
mov esi, dword [ebp - 0x268]
pop ecx
lea eax, [ebp - 0x258]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x5bfcb2
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov bl, 1
push dword [ebp - 0x26c]
call fcn.00702f96
pop ecx
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006f3e28
leave
ret

Function at 0x5c097f
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
push 0x28
mov esi, ecx
call fcn.006f40bd
mov edi, eax
xor ebx, ebx
pop ecx
mov dword [edi + 0x24], ebx
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x5c09a2
mov eax, dword [ecx]
push edi
call dword [eax]
mov dword [edi + 0x24], eax
push ebx
push ebx
push edi
push 0x5c0949
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
pop ebx
test eax, eax
je 0x5c09c5
cmp eax, 0xffffffff
je 0x5c09c5
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
ret
Function at 0x5c9e99
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [0xefd358]
mov ebx, edx
push edi
mov edi, ecx
test esi, esi
jne 0x5c9eff
cmp byte [0xefd354], 0
jne 0x5c9eff
call fcn.005d15eb
mov dword [0xefd350], eax
test eax, eax
je 0x5c9eeb
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CryptProtectMemory
push eax
call esi
push str.CryptUnprotectMemory
push dword [0xefd350]
mov dword [0xefd358], eax
call esi
mov dword [0xefd35c], eax
jmp 0x5c9ef0
mov eax, dword [0xefd35c]
mov esi, dword [0xefd358]
mov byte [0xefd354], 1
jmp 0x5c9f04
mov eax, dword [0xefd35c]
movzx edx, byte [ebp + 0xc]
mov ecx, ebx
and ecx, 0xfffffff0
cmp byte [ebp + 8], 0
je 0x5c9f3d
test esi, esi
je 0x5c9f51
push edx
push ecx
push edi
call esi
test eax, eax
jne 0x5c9f71
push str.CryptProtectMemory_failed
mov esi, 0xef8e90
push esi
call fcn.005d0f6a
pop ecx
pop ecx
push 2
mov ecx, esi
call fcn.005d102d
jmp 0x5c9f71
test eax, eax
je 0x5c9f51
push edx
push ecx
push edi
call eax
test eax, eax
jne 0x5c9f71
push str.CryptUnprotectMemory_failed
jmp 0x5c9f25
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov dword [ebp + 0xc], eax
test ebx, ebx
je 0x5c9f71
add al, 0x4b
lea ecx, [edx + edi]
add al, dl
xor byte [ecx], al
inc edx
mov eax, dword [ebp + 0xc]
cmp edx, ebx
jb 0x5c9f60
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x5ccd22
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.00722ce0
mov eax, dword [0xee37e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
xor eax, eax
mov ebx, edx
mov dword [ebp - 0x1008], eax
cmp word [edi], ax
je 0x5ccee0
call fcn.005cc843
mov esi, edi
xor edx, edx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, dx
jne 0x5ccd5d
sub esi, ecx
mov ecx, edi
sar esi, 1
call fcn.005ccc57
test al, al
je 0x5cce06
mov ecx, edi
call fcn.005cc843
test al, al
je 0x5ccdb6
lea eax, [esi + 4]
mov esi, 0x800
cmp eax, esi
jae 0x5ccee0
push esi
mov edx, 0xeaa34c
mov ecx, ebx
call fcn.005cc069
push esi
mov edx, edi
mov ecx, ebx
call fcn.005cc097
pop ecx
pop ecx
mov al, 1
jmp 0x5ccee2
push 0x5c
pop eax
cmp word [edi], ax
jne 0x5ccee0
cmp word [edi + 2], ax
jne 0x5ccee0
lea eax, [esi + 6]
mov esi, 0x800
cmp eax, esi
jae 0x5ccee0
push esi
mov edx, 0xeaa34c
mov ecx, ebx
call fcn.005cc069
push esi
mov edx, 0xeac1c8
mov ecx, ebx
call fcn.005cc097
lea edx, [edi + 2]
push esi
mov ecx, ebx
call fcn.005cc097
add esp, 0xc
jmp 0x5ccdaf
lea eax, [ebp - 0x1004]
push eax
push 0x7ff
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x5ccee0
cmp eax, 0x7ff
ja 0x5ccee0
movzx ecx, word [edi]
call fcn.005cc833
test al, al
je 0x5cce6f
lea eax, [esi + 6]
mov esi, 0x800
cmp eax, esi
jae 0x5ccee0
push esi
mov edx, 0xeaa34c
mov ecx, ebx
call fcn.005cc069
xor eax, eax
lea edx, [ebp - 0x1004]
push esi
mov ecx, ebx
mov word [ebp - 0x1000], ax
call fcn.005cc097
mov edx, edi
jmp 0x5ccdf9
lea ecx, [ebp - 0x1004]
call fcn.005cc871
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x1008]
jne 0x5cce7d
sub ecx, edx
lea eax, [esi + 4]
sar ecx, 1
mov esi, 0x800
add eax, ecx
cmp eax, esi
jae 0x5ccee0
push esi
mov edx, 0xeaa34c
mov ecx, ebx
call fcn.005cc069
push esi
lea edx, [ebp - 0x1004]
mov ecx, ebx
call fcn.005cc097
cmp word [edi], 0x2e
pop ecx
pop ecx
jne 0x5cced1
movzx ecx, word [edi + 2]
call fcn.005cc833
test al, al
je 0x5cced1
add edi, 4
push esi
mov edx, edi
mov ecx, ebx
call fcn.005cc097
jmp 0x5ccdae
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006f3e28
leave
ret

Function at 0x5cd7cd
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x21b8], 0
mov dword [esi], 0xeac1d8
je 0x5cd7ff
push edi
mov edi, dword [esi + 0x21bc]
test edi, edi
je 0x5cd7fe
mov ecx, edi
call fcn.005cc4cf
push 0x9500
push edi
call fcn.006f3e3b
pop ecx
pop ecx
pop edi
lea ecx, [esi + 0x6728]
call fcn.005c9b2b
lea ecx, [esi + 0x43d8]
call fcn.005c9b2b
lea ecx, [esi + 0x21d8]
call fcn.005de7d5
lea ecx, [esi + 0x20e8]
call fcn.005d3984
lea ecx, [esi + 0x1024]
call fcn.005de583
mov ecx, esi
pop esi
jmp fcn.005d28b1