joyce8/EMBER2024-capa huggingface dataset:
Function at 0x590208
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
push ebx
push esi
push edi
mov bl, 1
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x10]
cmp byte [eax + 0x473], 0
jne 0x5902eb
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x14]
call fcn.00401e58
mov edx, dword [ebp + 8]
mov dword [edx - 0x1c], eax
push 0
push 0
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x10]
mov eax, dword [eax + 0x15c]
push eax
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 0x11c]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x14]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x1c]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x10]
mov eax, dword [eax + 0x15c]
push eax
call sub.kernel32.dll_ReadFile
call fcn.00656a20
mov dword [ebp - 8], eax
call fcn.00656a20
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x114], 0x4e4
xor eax, eax
push ebp
push 0x5902c4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x1c]
mov dword [ebp - 4], eax
push ebp
call fcn.0058f84c
pop ecx
push ebp
call fcn.0058ffa0
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5902d0
mov eax, dword [ebp - 0xc]
call fcn.00656ff0
mov eax, dword [ebp - 8]
call fcn.00656ff0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x1c]
call fcn.00401fac
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x595919
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebp, dword [esp + 0x18]
mov eax, dword fs:[0x30]
mov edi, dword [eax + 0xc]
add edi, 0xc
mov edi, dword [edi]
mov eax, dword [edi + 0x30]
test eax, eax
je 0x59592d
test ebp, ebp
je 0x59593d
mov dword [ebp], eax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x59597d
mov edx, dword [edi + 0x30]
movzx eax, word [edx]
test ax, ax
je 0x59592d
add edx, 2
xor ecx, ecx
lea esi, [esi]
lea esi, [eax - 0x41]
lea ebx, [eax + 0x20]
cmp si, 0x1a
cmovb eax, ebx
add edx, 2
movzx eax, ax
add ecx, eax
movzx eax, word [edx - 2]
test ax, ax
jne 0x595959
cmp dword [esp + 0x14], ecx
jne 0x59592d
pop ebx
mov eax, dword [edi + 0x18]
pop esi
pop edi
pop ebp
ret
Function at 0x595989
Capabilities:
Access peb ldr_data
Terminate process

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
add eax, 0xc
mov eax, dword [eax]
mov esi, dword [eax + 0x30]
test esi, esi
je 0x59599c
mov eax, dword [eax + 0x18]
mov dword [esp + 4], 0
mov dword [esp + 0x1c], eax
mov eax, dword [0x664b30]
mov dword [esp], eax
call fcn.00595919
mov ecx, dword [0x664b24]
mov edi, eax
mov eax, dword [ecx]
test eax, eax
je 0x595a25
movzx edx, word [esi]
movzx ebp, byte [ecx]
test dx, dx
je 0x595b4c
xor eax, eax
lea esi, [esi]
nop
add eax, 1
cmp word [esi + eax*2], 0
jne 0x5959e9
mov ebx, ebp
cmp bl, al
je 0x595a02
cmp byte [ecx + 1], al
jne 0x595b3f
lea eax, [esi + 2]
xor esi, esi
nop
add eax, 2
add esi, edx
movzx edx, word [eax - 2]
test dx, dx
jne 0x595a09
cmp dword [ecx + 4], esi
je 0x595a25
cmp dword [ecx + 8], esi
jne 0x595b3f
mov eax, dword [0x664b3c]
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0x1000
mov dword [esp], 0
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_VirtualAlloc]
mov ecx, dword [0x664b2c]
xor edx, edx
sub esp, 0x10
test ecx, ecx
je 0x595a87
lea esi, [esi]
mov ecx, dword [0x664b20]
mov ecx, dword [ecx + edx]
mov dword [eax + edx], ecx
mov ecx, dword [0x664b44]
add edx, ecx
mov ecx, dword [0x664b2c]
cmp ecx, edx
ja 0x595a69
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.005957c9
mov edi, eax
test eax, eax
je 0x595b3f
mov esi, dword [0x664b08]
lea ebp, [esp + 0x2c]
mov edx, dword [0x664b2c]
mov dword [esp + 0xc], ebp
mov eax, dword [0x664b04]
mov dword [esp], esi
mov dword [esp + 8], edx
mov dword [esp + 4], eax
call edi
mov eax, dword [0x664b40]
sub esp, 0x10
mov edx, dword [0x664b04]
mov ebx, dword [esp + 0x1c]
add ebx, eax
mov eax, 8
mov ecx, dword [ebx + 4]
cmp edx, 8
jbe 0x595b03
lea esi, [esi]
nop
mov edx, dword [ebx + eax]
add edx, ecx
mov dword [esi + eax], edx
mov edx, dword [0x664b44]
add eax, edx
mov edx, dword [0x664b04]
cmp edx, eax
ja 0x595ae9
mov eax, dword [0x664b14]
mov edx, dword [esp + 0x2c]
mov dword [esi + 8], eax
mov eax, dword [0x664b04]
mov dword [esp + 8], edx
mov dword [esp], esi
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
call edi
mov eax, dword [0x664b10]
mov edx, dword [0x664b10]
sub esp, 0x10
add eax, dword [esi + 0xc]
add eax, esi
add esi, edx
mov dword [esp], esi
call eax
mov dword [esp], 0
mov eax, ebp
test al, al
je 0x595b58
cmp byte [ecx + 1], 0
jne 0x595b3f
xor esi, esi
jmp 0x595a17
Function at 0x59a930
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
xor eax, eax
push ebp
push 0x59aa1b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
cmp dword [eax - 4], 0x80000000
jne 0x59a9fa
xor ebx, ebx
lea edx, [ebp - 4]
mov eax, 0x20
call fcn.0062ad1c
cmp dword [ebp - 4], 0
je 0x59a987
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x158]
mov edx, dword [ebp - 4]
call fcn.0065ce44
test al, al
je 0x59a987
mov bl, 1
jmp 0x59a9ee
lea eax, [ebp - 4]
mov edx, 0x104
call fcn.00403de4
mov eax, dword [ebp - 4]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathW
test eax, eax
jne 0x59a9b0
lea eax, [ebp - 4]
call fcn.00403880
jmp 0x59a9ce
lea eax, [ebp - 4]
call fcn.0065c7b8
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00625948
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.004038bc
cmp dword [ebp - 4], 0
je 0x59a9ee
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x158]
mov edx, dword [ebp - 4]
call fcn.0065ce44
test al, al
je 0x59a9ee
mov bl, 1
xor eax, eax
mov al, bl
mov edx, dword [ebp + 8]
mov dword [edx - 4], eax
jmp 0x59aa00
mov eax, dword [ebp + 8]
mov bl, byte [eax - 4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59aa22
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403898
ret
Function at 0x59c208
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 8], ebx
mov byte [ebp - 1], cl
mov edi, edx
mov ebx, eax
lea eax, [ebp - 0x40]
mov edx, dword [0x543b14]
call fcn.00403e48
xor eax, eax
push ebp
push 0x59c3d3
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebx + 0x422], 1
mov eax, dword [ebx + 0x15c]
mov dword [ebp - 0xc], eax
mov eax, edi
call fcn.00660d7c
mov esi, eax
mov dword [ebx + 0x15c], esi
inc esi
jne 0x59c29d
lea ecx, [ebp - 0x44]
mov eax, 0x59c3e4
mov edx, edi
call fcn.0065d968
mov eax, dword [ebp - 0x44]
mov cx, word [0x59c400]
mov dl, 1
call fcn.0062941c
cmp ax, 2
jne 0x59c24c
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0x15c], eax
mov byte [ebx + 0x422], 0
mov byte [ebp - 2], 2
jmp 0x59c3a7
lea eax, [ebp - 8]
mov edx, dword [ebx + 0x158]
call fcn.004038bc
lea eax, [ebx + 0x158]
mov edx, edi
call fcn.004038bc
mov byte [ebp - 0x40], 0
call fcn.004da2b4
test byte [eax + 0x2d], 0x20
je 0x59c2ef
mov eax, ebx
call fcn.005c514c
test al, al
je 0x59c2ef
lea edx, [ebp - 0x64]
mov eax, dword [ebx + 0x2f8]
call fcn.00548294
lea esi, [ebp - 0x64]
lea edi, [ebp - 0x3c]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
jmp 0x59c31f
lea edx, [ebp - 0x64]
mov eax, ebx
call fcn.005c8d98
lea esi, [ebp - 0x64]
lea edi, [ebp - 0x3c]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
cmp byte [ebx + 0x42a], 0
je 0x59c31f
dec dword [ebp - 0x2c]
mov edx, dword [ebp - 0x2c]
mov eax, ebx
call fcn.005c0358
mov dword [ebp - 0x28], eax
mov eax, dword [ebx + 0x160]
mov dword [ebp - 0x1c], eax
mov al, byte [0x59c404]
mov byte [ebp - 0x3e], al
mov eax, dword [ebx + 0x164]
mov dword [ebp - 0x18], eax
mov al, byte [ebx + 0x168]
mov byte [ebp - 0x3f], al
test byte [ebp - 1], 1
je 0x59c353
or byte [ebp - 0x3e], 2
mov dword [ebp - 0x1c], 6
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.004038bc
lea edx, [ebp - 0x40]
mov eax, ebx
call fcn.005bc150
mov byte [ebp - 2], al
mov eax, dword [ebx + 0x15c]
push eax
call sub.kernel32.dll_CloseHandle
cmp byte [ebp - 2], 0
je 0x59c389
mov eax, dword [ebx + 0x158]
push eax
call sub.kernel32.dll_DeleteFileW
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0x15c], eax
lea eax, [ebx + 0x158]
mov edx, dword [ebp - 8]
call fcn.004038bc
mov byte [ebx + 0x422], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59c3da
lea eax, [ebp - 0x44]
call fcn.00403274
lea eax, [ebp - 0x40]
mov edx, dword [0x543b14]
call fcn.00403f10
lea eax, [ebp - 8]
call fcn.00403880
ret
Function at 0x59c408
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 4], edx
mov ebx, eax
lea eax, [ebp - 0x38]
mov edx, dword [0x543b14]
call fcn.00403e48
xor eax, eax
push ebp
push 0x59c64e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x43a], 0
jne 0x59c61a
cmp byte [ebx + 0x438], 0
je 0x59c61a
cmp byte [ebx + 0x38], 0
jne 0x59c467
cmp byte [ebx + 0x435], 0
je 0x59c61a
cmp byte [ebx + 0x454], 0
jne 0x59c61a
cmp byte [ebx + 0x435], 0
jne 0x59c4d3
lea edx, [ebp - 0x3c]
mov al, 1
call fcn.006265c4
mov edx, dword [ebp - 0x3c]
lea eax, [ebx + 0x30]
call fcn.004038bc
mov eax, dword [ebx + 0x30]
call fcn.00660d7c
mov esi, eax
mov dword [ebx + 0x34], esi
inc esi
jne 0x59c4d3
lea ecx, [ebp - 0x40]
mov eax, 0x59c65c
mov edx, dword [ebx + 0x30]
call fcn.0065d968
mov eax, dword [ebp - 0x40]
mov cx, word [0x59c678]
mov dl, 1
call fcn.0062941c
cmp ax, 2
jne 0x59c492
xor eax, eax
mov dword [ebx + 0x34], eax
jmp 0x59c61a
mov eax, dword [0x672384]
inc dword [eax]
mov byte [ebp - 0x38], 0
lea edx, [ebp - 0x60]
mov eax, ebx
call fcn.005c8d98
lea esi, [ebp - 0x60]
lea edi, [ebp - 0x34]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
cmp dword [ebx + 0x160], 4
jne 0x59c510
cmp dword [ebx + 0x170], 0
je 0x59c510
mov dword [ebp - 0x14], 4
jmp 0x59c515
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 8]
mov edx, dword [ebx + 0x158]
call fcn.004038bc
mov al, byte [0x59c67c]
mov byte [ebp - 0x36], al
lea eax, [ebp - 4]
mov edx, dword [ebx + 0x158]
call fcn.004038bc
lea eax, [ebx + 0x158]
mov edx, dword [ebx + 0x30]
call fcn.004038bc
mov esi, dword [ebx + 0x15c]
mov eax, dword [ebx + 0x34]
mov dword [ebx + 0x15c], eax
mov byte [ebx + 0x439], 1
mov byte [ebx + 0x43a], 1
lea edx, [ebp - 0x38]
mov eax, ebx
call fcn.005bc150
test al, al
jne 0x59c5c1
mov byte [ebx + 0x435], 1
mov byte [ebx + 0x438], 0
mov eax, dword [ebx + 0x4a8]
mov dword [ebx + 0x4b0], eax
mov eax, 0x811
call fcn.0049dbf8
mov eax, dword [0x6726a0]
mov eax, dword [eax]
mov byte [eax + 0xe], 1
mov eax, dword [ebx + 0x34]
push eax
call sub.kernel32.dll_CloseHandle
mov ecx, 1
mov edx, 0xc0000000
mov eax, dword [ebx + 0x30]
call fcn.00660d68
mov dword [ebx + 0x34], eax
jmp 0x59c5e7
cmp byte [ebx + 0x435], 0
jne 0x59c5e7
mov eax, dword [ebx + 0x15c]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebx + 0x158]
push eax
call sub.kernel32.dll_DeleteFileW
xor eax, eax
mov dword [ebx + 0x34], eax
mov byte [ebx + 0x439], 0
mov dword [ebx + 0x15c], esi
lea eax, [ebx + 0x158]
mov edx, dword [ebp - 4]
call fcn.004038bc
call fcn.00501d74
call fcn.0050111c
mov byte [ebx + 0x43a], 0
mov eax, dword [0x672384]
dec dword [eax]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59c655
lea eax, [ebp - 0x40]
call fcn.00403274
lea eax, [ebp - 0x3c]
call fcn.00403880
lea eax, [ebp - 0x38]
mov edx, dword [0x543b14]
call fcn.00403f10
lea eax, [ebp - 4]
call fcn.00403880
ret
Function at 0x59e144
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x59e23e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
cmp dword [eax - 0x3c], 0
jle 0x59e228
mov eax, dword [ebp + 8]
cmp dword [eax - 0x14], 4
jne 0x59e1b1
call fcn.004236a0
mov edx, dword [ebp + 8]
cmp dword [edx - 0x40], 0
jne 0x59e19d
mov edx, dword [ebp + 8]
mov ecx, dword [edx - 0x3c]
sub ecx, 0x2a
mov edx, dword [0x675318]
mov edx, dword [edx + 4]
add edx, 0x2a
call fcn.00423444
jmp 0x59e1b1
mov edx, dword [ebp + 8]
mov ecx, dword [edx - 0x3c]
mov edx, dword [0x675318]
mov edx, dword [edx + 4]
call fcn.00423444
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x3c]
push eax
mov eax, dword [0x675318]
mov eax, dword [eax + 4]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x44]
mov eax, dword [eax + 0x15c]
push eax
call sub.kernel32.dll_WriteFile
test eax, eax
jne 0x59e214
lea ecx, [ebp - 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x44]
mov edx, dword [eax + 0x158]
mov eax, 0x59e24c
call fcn.0065d968
mov eax, dword [ebp - 8]
mov cx, word [0x59e268]
mov dl, 1
call fcn.0062941c
cmp ax, 2
jne 0x59e1b1
call fcn.0065e804
jmp 0x59e1b1
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x3c]
mov edx, dword [ebp + 8]
add dword [edx - 0x40], eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax - 0x3c], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59e245
lea eax, [ebp - 8]
call fcn.00403274
ret
Function at 0x5b0fbc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5b10c1
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x5b10d8
mov eax, esi
call fcn.004b587c
mov edx, 0x5b10e8
call fcn.004b5854
mov esi, eax
lea eax, [ebp - 4]
push eax
mov edi, dword [ebx + 0x24]
mov edx, dword [edi + 0x34]
mov eax, dword [edi + 0x2c]
call fcn.00629410
mov dword [ebp - 0x18], eax
fild dword [ebp - 0x18]
fld xword [0x5b10f0]
fmulp st(1)
fstp xword [ebp - 0x24]
wait
lea eax, [ebp - 0x24]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 3
mov eax, dword [ebx + 0x24]
mov edx, dword [eax + 0x38]
mov eax, dword [ebx + 0x24]
mov eax, dword [eax + 0x30]
call fcn.00629410
mov dword [ebp - 0x28], eax
fild dword [ebp - 0x28]
fld xword [0x5b10f0]
fmulp st(1)
fstp xword [ebp - 0x34]
wait
lea eax, [ebp - 0x34]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 3
lea edx, [ebp - 0x14]
mov eax, 0x5b10fc
mov ecx, 1
call fcn.0065d7d4
mov ecx, dword [ebp - 4]
mov edx, 0x5b111c
mov eax, esi
call fcn.004b5638
mov edx, 0x5b112c
mov eax, esi
call fcn.004b5854
mov esi, eax
mov eax, dword [ebp + 8]
push eax
lea edx, [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.005b0d4c
pop ecx
mov ecx, dword [ebp - 4]
mov edx, 0x5b1140
mov eax, esi
call fcn.004b5638
xor ecx, ecx
mov edx, 0x5b1150
mov eax, esi
call fcn.004b5638
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b10c8
lea eax, [ebp - 4]
call fcn.00403274
ret
Function at 0x5b6cb4
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5b6d69
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0062a484
test al, al
je 0x5b6ce5
mov edx, esi
mov eax, ebx
call fcn.0062a4d0
jmp 0x5b6d4e
test ebx, ebx
je 0x5b6cfa
cmp word [ebx], 0x23
jne 0x5b6cfa
mov eax, esi
mov edx, ebx
call fcn.004038bc
jmp 0x5b6d4e
call fcn.0062551c
lea edx, [ebp - 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 8]
call fcn.0065cfe0
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0065d100
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 0x44]
mov eax, dword [eax + 0x158]
call fcn.0065cfe0
mov eax, dword [ebp - 8]
mov ecx, esi
pop edx
call fcn.0065d1e8
call fcn.00625578
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b6d70
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403898
ret
Function at 0x5c0ea4
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x3c4]
push eax
call sub.gdi32.dll_GetRegionData
mov ebx, eax
mov eax, ebx
call fcn.00401e58
mov esi, eax
push esi
push ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x3c4]
push eax
call sub.gdi32.dll_GetRegionData
mov ebx, dword [esi + 8]
dec ebx
cmp ebx, 0
jl 0x5c0f27
lea eax, [esi + 0x20]
mov edx, ebx
shl edx, 4
add eax, edx
push 0xcc0020
mov edi, dword [eax + 4]
push edi
mov edx, dword [eax]
push edx
mov ecx, dword [0x6727a4]
mov ecx, dword [ecx]
push ecx
mov ecx, dword [eax + 0xc]
sub ecx, edi
push ecx
mov ecx, dword [eax + 8]
sub ecx, edx
push ecx
push edi
push edx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
call sub.gdi32.dll_BitBlt
dec ebx
cmp ebx, 0xffffffff
jne 0x5c0ee8
mov eax, esi
call fcn.00401fac
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x613190
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
cmp byte [ebx + 0x155], 0
je 0x6131f2
cmp dword [0x675610], 0
je 0x6131d1
mov eax, dword [0x675610]
cmp ebx, dword [eax + 0x1a4]
jne 0x6131d1
push 0
mov eax, dword [0x675610]
call fcn.0064a424
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x675610]
xor edx, edx
mov dword [eax + 0x1a4], edx
push 0
mov eax, dword [ebx + 0x15c]
call fcn.0064a424
push eax
call sub.user32.dll_ShowWindow
mov byte [ebx + 0x155], 0
mov eax, ebx
call fcn.00612a1c
mov eax, ebx
call fcn.006132a4
xor eax, eax
mov dword [ebx + 0x14c], eax
xor eax, eax
mov dword [ebx + 0x148], eax
pop ebx
ret

Function at 0x6132a4
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
cmp byte [ebx + 0x156], 0
je 0x6132bd
mov eax, dword [ebx + 0x160]
call fcn.006132a4
pop ebx
ret
xor eax, eax
mov dword [ebx + 0x12c], eax
mov eax, ebx
call fcn.00613270
test al, al
je 0x6132f9
push 0
mov eax, dword [0x675614]
call fcn.0064a424
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x675614]
xor edx, edx
mov dword [eax + 0x128], edx
call fcn.00452ec0
xor edx, edx
mov dword [eax + 0x38], edx
pop ebx
ret
Function at 0x6252cc
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov dword [esp], eax
mov byte [esp + 0x10], 0
mov eax, dword [esp]
mov eax, dword [eax]
call fcn.004036e0
mov edi, eax
mov dword [esp + 8], edi
mov eax, dword [esp + 8]
mov dword [esp + 4], eax
mov eax, dword [esp]
mov eax, dword [eax]
call fcn.0040351c
test al, 3
jne 0x625430
shr eax, 2
cmp eax, 1
jl 0x625430
mov dword [esp + 0xc], eax
xor edx, edx
xor eax, eax
xor ecx, ecx
mov cl, byte [edi]
cmp ecx, 0x3d
jg 0x62533a
je 0x6253ea
sub ecx, 0x2b
je 0x625367
sub ecx, 4
je 0x62536b
dec ecx
sub ecx, 0xa
jb 0x62535d
jmp 0x62536f
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x62534c
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x625353
jmp 0x62536f
mov bl, byte [edi]
sub bl, 0x41
jmp 0x625373
mov bl, byte [edi]
add bl, 0x1a
sub bl, 0x61
jmp 0x625373
mov bl, byte [edi]
add bl, 0x34
sub bl, 0x30
jmp 0x625373
mov bl, 0x3e
jmp 0x625373
mov bl, 0x3f
jmp 0x625373
xor edx, edx
jmp 0x6253ea
mov ecx, eax
sub ecx, 1
jb 0x625381
je 0x62538e
dec ecx
je 0x6253af
jmp 0x6253d3
mov esi, ebx
and esi, 0xff
shl esi, 2
jmp 0x6253dc
mov ecx, ebx
and cl, 0xf
and ecx, 0xff
shl ecx, 0xc
mov ebp, ebx
and ebp, 0xff
shr ebp, 4
or esi, ebp
or ecx, esi
mov esi, ecx
jmp 0x6253dc
mov ecx, ebx
and cl, 3
and ecx, 0xff
shl ecx, 0x16
mov ebp, ebx
and ebp, 0xff
shr ebp, 2
shl ebp, 8
or esi, ebp
or ecx, esi
mov esi, ecx
jmp 0x6253dc
xor ecx, ecx
mov cl, bl
shl ecx, 0x10
or esi, ecx
add edx, 6
inc edi
inc eax
cmp eax, 4
jne 0x625319
test edx, edx
jne 0x6253f5
mov byte [esp + 0x10], 0
jmp 0x625430
mov eax, edx
test eax, eax
jns 0x6253fe
add eax, 7
sar eax, 3
dec eax
cmp eax, 0
jl 0x62541c
mov edx, esi
mov ecx, dword [esp + 8]
mov byte [ecx], dl
shr esi, 8
inc dword [esp + 8]
dec eax
cmp eax, 0xffffffff
jne 0x625407
mov byte [esp + 0x10], 1
dec dword [esp + 0xc]
cmp dword [esp + 0xc], 0
jne 0x625315
cmp byte [esp + 0x10], 0
je 0x625449
mov edx, dword [esp + 8]
sub edx, dword [esp + 4]
mov eax, dword [esp]
call fcn.00403804
jmp 0x625451
mov eax, dword [esp]
call fcn.00403274
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x625c94
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push eax
call sub.kernel32.dll_CreateFileW
mov esi, eax
cmp esi, 0xffffffff
je 0x625cf4
push 0
lea eax, [esp + 8]
push eax
push 3
lea eax, [esp + 0xc]
push eax
push esi
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x625ce6
cmp dword [esp + 4], 3
jne 0x625ce6
mov eax, dword [esp]
and eax, 0xffffff
cmp eax, 0xbfbbef
je 0x625cea
xor ebx, ebx
jmp 0x625cec
mov bl, 1
push esi
call sub.kernel32.dll_CloseHandle
jmp 0x625cf6
xor ebx, ebx
mov eax, ebx
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x625d00
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00403e28
xor eax, eax
push ebp
push 0x625d9a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.006261cc
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
call fcn.00403b24
mov ecx, 1
mov edx, 0x80000000
mov esi, dword [ebp - 4]
mov eax, esi
call fcn.00660d68
cmp eax, 0xffffffff
setne bl
test bl, bl
je 0x625d62
push eax
call sub.kernel32.dll_CloseHandle
jmp 0x625d7f
mov eax, esi
call fcn.00660d7c
cmp eax, 0xffffffff
setne bl
test bl, bl
je 0x625d7f
push eax
call sub.kernel32.dll_CloseHandle
push esi
call sub.kernel32.dll_DeleteFileW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x625da1
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403898
ret

Function at 0x626348
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x23c], edx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x6264a9
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x675760], 0
jne 0x626382
call fcn.006562d0
mov dword [0x675760], eax
lea edx, [ebp - 4]
mov eax, esi
call fcn.0065d00c
mov edx, dword [ebp - 4]
mov eax, dword [0x675760]
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov ebx, eax
test ebx, ebx
jge 0x62647a
xor ebx, ebx
mov eax, esi
call fcn.006262f0
cmp eax, 2
jne 0x6263b8
mov bl, 1
jmp 0x626467
cmp eax, 3
jne 0x626467
lea eax, [ebp - 0x23c]
mov ecx, dword [ebp - 4]
mov edx, 0x6264c0
call fcn.00403b24
mov eax, dword [ebp - 0x23c]
mov ecx, 3
mov edx, 0x80000000
call fcn.00660d68
mov esi, eax
cmp esi, 0xffffffff
je 0x626467
lea eax, [ebp - 0x22c]
mov edx, 0x224
call fcn.00660d08
mov dword [ebp - 0x228], 0x224
xor eax, eax
mov dword [ebp - 0x238], eax
xor eax, eax
mov dword [ebp - 0x234], eax
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x228]
push eax
lea eax, [ebp - 0x22c]
push eax
push 0xc
lea eax, [ebp - 0x238]
push eax
push 0x2d1400
push esi
call sub.kernel32.dll_DeviceIoControl
test eax, eax
je 0x626461
mov edi, dword [ebp - 0x210]
cmp edi, 4
je 0x62645f
cmp edi, 7
je 0x62645f
cmp byte [ebp - 0x222], 0
je 0x626461
mov bl, 1
push esi
call sub.kernel32.dll_CloseHandle
xor ecx, ecx
mov cl, bl
mov edx, dword [ebp - 4]
mov eax, dword [0x675760]
call fcn.0065779c
jmp 0x626488
mov edx, ebx
mov eax, dword [0x675760]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6264b0
lea eax, [ebp - 0x23c]
call fcn.00403880
lea eax, [ebp - 4]
call fcn.00403880
ret