joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5355bc
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa4
mov dword [esp + 4], ecx
mov dword [esp], edx
mov esi, 0x30
mov edi, 0x582398
mov ecx, dword [esp]
lea edx, [esp + 0xc]
movzx ebx, byte [edi]
movzx ebx, byte [eax + ebx - 1]
xor bl, byte [ecx]
mov byte [edx], bl
inc edx
inc ecx
inc edi
dec esi
jne 0x5355db
mov esi, 1
mov edx, 0x5824a0
mov ecx, esi
dec ecx
mov eax, ecx
add eax, eax
lea eax, [eax + eax*2]
add ecx, ecx
add ecx, ecx
movzx ebx, byte [esp + eax + 0xc]
mov edi, ebx
add edi, edi
movzx ebx, byte [esp + eax + 0x11]
add edi, ebx
movzx ebx, byte [esp + eax + 0xd]
add ebx, ebx
add ebx, ebx
add ebx, ebx
movzx ebp, byte [esp + eax + 0xe]
add ebp, ebp
add ebp, ebp
add ebx, ebp
movzx ebp, byte [esp + eax + 0xf]
add ebp, ebp
add ebx, ebp
movzx eax, byte [esp + eax + 0x10]
add ebx, eax
mov dword [esp + 8], ebx
mov eax, 1
mov ebx, eax
dec ebx
je 0x535654
dec ebx
je 0x535676
dec ebx
je 0x535698
dec ebx
je 0x5356b9
jmp 0x5356d3
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 8
movzx ebx, bl
shr ebx, 3
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x5356d3
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 4
movzx ebx, bl
shr ebx, 2
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x5356d3
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 2
movzx ebx, bl
shr ebx, 1
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x5356d3
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 1
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
inc eax
cmp eax, 5
jne 0x535644
inc esi
add edx, 0x40
cmp esi, 9
jne 0x5355f7
mov esi, 0x20
mov eax, 0x5823c8
mov edx, dword [esp + 4]
movzx ecx, byte [eax]
movzx ecx, byte [esp + ecx + 0x3b]
mov byte [edx], cl
inc edx
inc eax
dec esi
jne 0x5356f8
add esp, 0x5c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x535734
Capabilities:
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], ecx
mov esi, eax
movzx eax, dl
movzx ebx, byte [eax + 0x58244f]
test bl, bl
jbe 0x535765
lea eax, [esi + 0x3e0]
call fcn.00535710
lea eax, [esi + 0x3fc]
call fcn.00535710
dec bl
jne 0x53574b
mov cl, 0x30
mov edi, 0x582420
mov eax, dword [esp]
movzx edx, byte [edi]
cmp dl, 0x1c
ja 0x535786
movzx edx, dl
movzx edx, byte [esi + edx + 0x3df]
mov byte [eax], dl
jmp 0x535793
movzx edx, dl
movzx edx, byte [esi + edx + 0x3df]
mov byte [eax], dl
inc eax
inc edi
dec cl
jne 0x53576f
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x5357a0
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbdc
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov bl, 1
lea esi, [ebp - 0x421]
mov eax, edi
mov edx, ebx
call fcn.00535554
mov byte [esi], al
inc ebx
inc esi
cmp bl, 0x41
jne 0x5357bc
mov bl, 0x1c
mov esi, str.91__
lea edi, [ebp - 0x41]
movzx edx, byte [esi]
mov eax, dword [ebp - 8]
call fcn.00535554
mov byte [edi], al
movzx edx, byte [esi + 0x1c]
mov eax, dword [ebp - 8]
call fcn.00535554
mov byte [edi + 0x1c], al
inc edi
inc esi
dec bl
jne 0x5357d8
mov bl, 1
lea esi, [ebp - 0x3a1]
mov ecx, esi
lea eax, [ebp - 0x421]
mov edx, ebx
call fcn.00535734
inc ebx
add esi, 0x30
cmp bl, 0x11
jne 0x535802
mov bl, 1
mov eax, 0x582318
lea edx, [ebp - 0xa1]
cmp bl, 0x20
ja 0x53583b
movzx ecx, byte [eax]
movzx ecx, byte [ebp + ecx - 0x422]
mov byte [edx], cl
jmp 0x535848
movzx ecx, byte [eax]
movzx ecx, byte [ebp + ecx - 0x422]
mov byte [edx], cl
inc ebx
inc edx
inc eax
cmp bl, 0x41
jne 0x535827
mov byte [ebp - 9], 1
lea esi, [ebp - 0x3a1]
cmp byte [ebp + 8], 0
je 0x535872
lea ecx, [ebp - 0x61]
mov edx, esi
lea eax, [ebp - 0x81]
call fcn.005355bc
jmp 0x535899
movzx eax, byte [ebp - 9]
mov edx, 0x11
sub edx, eax
mov eax, edx
add eax, eax
lea eax, [eax + eax*2]
lea edx, [ebp + eax*8 - 0x3d1]
lea ecx, [ebp - 0x61]
lea eax, [ebp - 0x81]
call fcn.005355bc
mov bl, 0x20
lea eax, [ebp - 0xa1]
movzx edx, byte [eax]
xor byte [eax + 0x40], dl
inc eax
dec bl
jne 0x5358a1
push esi
lea esi, [ebp - 0x81]
lea edi, [ebp - 0xa1]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
push esi
lea esi, [ebp - 0x61]
lea edi, [ebp - 0x81]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
inc byte [ebp - 9]
add esi, 0x30
cmp byte [ebp - 9], 0x11
jne 0x53585a
mov bl, 0x40
mov esi, 0x582358
lea eax, [ebp - 0x3e1]
movzx edx, byte [esi]
cmp dl, 0x20
ja 0x535907
movzx edx, dl
movzx edx, byte [ebp + edx - 0x82]
mov byte [eax], dl
jmp 0x535914
movzx edx, dl
movzx edx, byte [ebp + edx - 0xc2]
mov byte [eax], dl
inc eax
inc esi
dec bl
jne 0x5358f0
mov bl, 1
lea esi, [ebp - 0x3e1]
movzx ecx, byte [esi]
mov eax, dword [ebp - 4]
mov edx, ebx
call fcn.0053557c
inc ebx
inc esi
cmp bl, 0x41
jne 0x535922
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x535a54
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebp, ecx
mov dword [esp], edx
mov esi, eax
movzx edx, byte [esi]
mov byte [esp + 4], dl
shl edx, 7
and dl, 0xff
movzx eax, byte [esi + 1]
movzx ecx, al
shr ecx, 1
or dl, cl
mov byte [esp + 5], dl
shl eax, 6
and al, 0xff
movzx edx, byte [esi + 2]
movzx ecx, dl
shr ecx, 2
or al, cl
mov byte [esp + 6], al
shl edx, 5
and dl, 0xff
movzx eax, byte [esi + 3]
movzx ecx, al
shr ecx, 3
or dl, cl
mov byte [esp + 7], dl
shl eax, 4
and al, 0xff
movzx edx, byte [esi + 4]
shr edx, 4
or al, dl
mov byte [esp + 8], al
movzx eax, byte [esi + 4]
add eax, eax
add eax, eax
add eax, eax
and al, 0xff
movzx edx, byte [esi + 5]
shr edx, 5
or al, dl
mov byte [esp + 9], al
movzx eax, byte [esi + 5]
add eax, eax
add eax, eax
and al, 0xff
movzx edx, byte [esi + 6]
shr edx, 6
or al, dl
mov byte [esp + 0xa], al
movzx eax, byte [esi + 6]
add eax, eax
and al, 0xff
mov byte [esp + 0xb], al
mov edi, 8
lea eax, [esp + 4]
mov edx, 1
xor esi, esi
mov ecx, edx
movzx ebx, byte [eax]
shl ebx, cl
mov ecx, ebx
xor ecx, esi
and ecx, 1
mov esi, ecx
inc edx
cmp edx, 8
jne 0x535b05
movzx edx, byte [eax]
and dl, 0xfe
mov ecx, esi
or dl, cl
mov byte [eax], dl
inc eax
dec edi
jne 0x535b00
mov eax, ebp
mov edx, 8
call fcn.00405d04
push 1
mov eax, ebp
call fcn.00405ad4
mov edx, eax
lea ecx, [esp + 8]
mov eax, dword [esp + 4]
call fcn.005357a0
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x53d4e8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push 0x53d578
call sub.kernel32.dll_LoadLibraryA
mov ebx, eax
test ebx, ebx
je 0x53d573
push 0x53d588
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x58d538], eax
push 0x58d550
push 0x40
push 8
mov eax, dword [0x58d538]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x53d536
mov eax, 0x58d540
mov ecx, 5
mov edx, dword [0x58d538]
call fcn.00408954
push 0x53d590
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x58d53c], eax
push 0x58d558
push 0x40
push 8
mov eax, dword [0x58d53c]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x53d573
mov eax, 0x58d548
mov ecx, 5
mov edx, dword [0x58d53c]
call fcn.00408954
pop ebx
ret

Function at 0x53db00
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
xor ebx, ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00405a64
mov eax, dword [ebp - 8]
call fcn.00405a64
xor eax, eax
push ebp
push 0x53dc6f
push dword fs:[eax]
mov dword fs:[eax], esp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 8]
call fcn.0040d9a4
mov eax, dword [ebp - 0x2c]
push eax
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 4]
call fcn.0040d9a4
mov eax, dword [ebp - 0x30]
pop edx
call fcn.0040c794
test eax, eax
jne 0x53dbc6
mov dword [ebp - 0x22], 4
jmp 0x53dbcd
mov dword [ebp - 0x22], 2
lea eax, [ebp - 0x34]
mov ecx, 0x53dc84
mov edx, dword [ebp - 4]
call fcn.004058fc
mov eax, dword [ebp - 0x34]
call fcn.00405a74
mov dword [ebp - 0x1e], eax
lea eax, [ebp - 0x38]
mov ecx, 0x53dc84
mov edx, dword [ebp - 8]
call fcn.004058fc
mov eax, dword [ebp - 0x38]
call fcn.00405a74
mov dword [ebp - 0x1a], eax
mov word [ebp - 0x16], 0x410
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea eax, [ebp - 0x26]
push eax
call sub.shell32.dll_SHFileOperationA
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53dc76
lea eax, [ebp - 0x38]
mov edx, 4
call fcn.00405608
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405608
ret
Function at 0x545ba8
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004055e4
xor eax, eax
push ebp
push 0x545be9
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 0
push 0x545cf8
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x545c06
cmp dword [ebp - 4], 0
je 0x545cf1
xor eax, eax
push ebp
push 0x545c47
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80000000
push 0
push 0
mov eax, esi
call fcn.00405a74
push eax
mov eax, dword [ebp - 4]
push eax
call sub.wininet.dll_InternetOpenUrlA
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x545c64
cmp dword [ebp - 8], 0
jne 0x545c75
mov eax, dword [ebp - 4]
push eax
call sub.wininet.dll_InternetCloseHandle
jmp 0x545cf1
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, 0x1e00000
xor edx, edx
push ebp
push 0x545caa
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0xc]
push edx
push eax
push 0x58d6b8
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetReadFile
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x545ccd
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 4]
push eax
call sub.wininet.dll_InternetCloseHandle
cmp dword [ebp - 0xc], 0
jbe 0x545cf1
mov edx, ebx
mov eax, 0x58d6b8
call fcn.0040df04
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x546920
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [0x584168]
cmp dword [eax], 0x1e
jge 0x546938
mov eax, dword [0x584168]
mov dword [eax], 0x1e
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x50]
xor edx, edx
push edx
push eax
mov eax, dword [0x584168]
imul eax, dword [eax], 0x3e8
cdq
cmp edx, dword [esp + 4]
jne 0x54695f
cmp eax, dword [esp]
pop edx
pop eax
jae 0x546972
jmp 0x546963
pop edx
pop eax
jge 0x546972
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x50], eax
mov eax, ebx
call fcn.0054cc00
pop ebx
ret
Function at 0x55f7ec
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405a64
xor eax, eax
push ebp
push 0x55f9c8
push dword fs:[eax]
mov dword fs:[eax], esp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0
call sub.ole32.dll_OleInitialize
xor eax, eax
push ebp
push 0x55f98b
push dword fs:[eax]
mov dword fs:[eax], esp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ebx
xor ecx, ecx
mov edx, 0x628
call fcn.00403e38
lea edx, [ebp - 8]
mov eax, dword [0x583a58]
call fcn.004952dc
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
mov ecx, 0x55f9d4
call fcn.00407444
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
mov ecx, 0x55f9e4
call fcn.00407444
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.00405f60
push 0
mov eax, dword [ebp - 0x14]
call fcn.00405f70
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
push 2
lea eax, [ebp - 0x154]
push eax
push 0x400
push ebx
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
push 0x104
lea eax, [ebx + 0x105]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x20]
lea eax, [ebx + 0x310]
push eax
push 0x104
lea eax, [ebx + 0x20a]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x40]
push 0x400
lea eax, [ebx + 0x314]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x28]
push 0x400
lea eax, [ebx + 0x314]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
lea eax, [ebx + 0x620]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x38]
lea eax, [ebx + 0x624]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea eax, [ebp - 0x10]
call fcn.00407400
lea eax, [ebp - 0xc]
call fcn.00407400
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55f992
call sub.ole32.dll_OleUninitialize
ret
Function at 0x560fcc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
xor ecx, ecx
mov dword [ebp - 0x5c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405a64
xor eax, eax
push ebp
push 0x5610a9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040895c
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebp - 0x18], bx
mov dword [ebp - 0x1c], 0x10
mov dword [ebp - 0x20], 0x18
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.0040d9a4
mov eax, dword [ebp - 0x5c]
call fcn.00405a74
push eax
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00405a74
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x561088
mov ebx, dword [ebp - 0x50]
jmp 0x56108b
or ebx, 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5610b0
lea eax, [ebp - 0x5c]
call fcn.004055e4
lea eax, [ebp - 4]
call fcn.004055e4
ret

Function at 0x56116c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405a64
xor eax, eax
push ebp
push 0x561291
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x44
call fcn.00403e38
lea eax, [ebp - 0x50]
push eax
call sub.kernel32.dll_GetStartupInfoA_1
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040d9a4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x68], eax
mov byte [ebp - 0x64], 0xb
lea edx, [ebp - 0x68]
xor ecx, ecx
mov eax, 0x5612a8
call fcn.0040e790
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x50]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00405a74
push eax
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00405a74
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x561253
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x561298
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405608
ret
Function at 0x56aa50
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405a64
xor eax, eax
push ebp
push 0x56ac5c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00405638
cmp dword [ebp - 4], 0
je 0x56ac2c
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.0040c588
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
add al, 0xbf
sub al, 0x1a
jae 0x56ac2c
mov esi, 3
lea ebx, [esi + 0x41]
mov eax, ebx
add al, 0xbc
sub al, 0x17
jae 0x56ab8c
lea eax, [ebp - 0x28]
mov edx, ebx
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x2c]
call fcn.00403d1c
mov edx, 0x56ac6c
lea eax, [ebp - 0x2c]
mov cl, 2
call fcn.00403cec
lea edx, [ebp - 0x2c]
lea eax, [ebp - 8]
call fcn.00405848
mov eax, dword [ebp - 8]
call fcn.00405a74
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x56ab8c
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.00405a74
push eax
mov eax, dword [0x58393c]
mov eax, dword [eax]
call eax
fild qword [ebp - 0x10]
fdiv dword [0x56ac70]
fdiv dword [0x56ac70]
fdiv dword [0x56ac70]
fcomp dword [0x56ac74]
wait
fnstsw ax
sahf
jbe 0x56ab8c
lea eax, [ebp - 0x30]
mov edx, ebx
call fcn.004057cc
push dword [ebp - 0x30]
push 0x56ac80
lea eax, [ebp - 0x34]
mov edx, dword [0x583710]
add edx, 0x320
call fcn.00405848
push dword [ebp - 0x34]
push 0x56ac8c
mov eax, edi
mov edx, 4
call fcn.00405978
jmp 0x56ac2c
inc esi
cmp esi, 0x1a
jne 0x56aabc
xor esi, esi
lea ebx, [esi + 0x41]
mov eax, ebx
add al, 0xbc
sub al, 0x17
jae 0x56ac22
lea eax, [ebp - 0x28]
mov edx, ebx
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x2c]
call fcn.00403d1c
mov edx, 0x56ac6c
lea eax, [ebp - 0x2c]
mov cl, 2
call fcn.00403cec
lea edx, [ebp - 0x2c]
lea eax, [ebp - 8]
call fcn.00405848
mov eax, dword [ebp - 8]
call fcn.00405a74
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x56ac22
lea eax, [ebp - 0x38]
mov edx, ebx
call fcn.004057cc
push dword [ebp - 0x38]
push 0x56ac80
lea eax, [ebp - 0x3c]
mov edx, dword [0x583710]
add edx, 0x320
call fcn.00405848
push dword [ebp - 0x3c]
push 0x56ac8c
mov eax, edi
mov edx, 4
call fcn.00405978
jmp 0x56ac2c
inc esi
cmp esi, 0x1a
jne 0x56ab98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56ac63
lea eax, [ebp - 0x3c]
mov edx, 4
call fcn.00405608
lea eax, [ebp - 0x24]
call fcn.004055e4
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405608
ret
Function at 0x100136c4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10013715
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.10013ce2
mov ecx, dword [ebp - 0x20]
mov cx, word [ecx]
mov word [eax], cx
jmp 0x1001373e
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1001373e
push 0
push 0
push 0
push 0
push 0x1a1c
push 1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esp, ebp
pop ebp
ret
Function at 0x10016697
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push edi
mov bl, cl
mov edi, edx
push 2
lea ecx, [ebp - 0x24]
mov byte [ebp - 1], bl
call fcn.100139c6
xor edx, edx
mov dword [ebp - 8], 0xfffffff7
mov dword [ebp - 8], edx
jmp 0x100166ce
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x24]
mov dword [eax + ecx*4], 0x342eb90d
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x100166be
mov dword [ebp - 8], 1
cmp dword [ebp - 8], edx
jl 0x100167a0
push esi
mov dword [ebp - 0xc], edx
mov dword [ebp - 0xc], edx
jmp 0x100166fb
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x18], 0xac453072
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x100166ed
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x24]
cmp dword [eax + ecx*4], edx
jne 0x1001679c
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 1
jg 0x10016793
mov dword [ebp - 0xc], 0x2ba7b7e8
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
cmp dword [eax + ecx*4], edx
je 0x10016774
mov eax, dword [ebp - 8]
xor ebx, ebx
mov dword [ebp - 0xc], 0xfff9
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
cmp dword [eax + ecx*4], 0xfffffffe
setne bl
imul eax, dword [ebp - 0xc], 0x9855
sub eax, dword [ebp - 8]
neg eax
sbb eax, eax
xor edx, edx
inc eax
cmp ebx, eax
mov eax, dword [ebp - 0x24]
sete dl
xor ecx, ecx
cmp dword [eax + esi*4], edx
setle cl
cmp ecx, 1
jg 0x10016772
xor esi, esi
inc esi
jmp 0x10016776
xor edx, edx
mov esi, edx
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x24]
push 0
cmp esi, dword [eax + ecx*4]
sete dl
mov dword [ebp - 0xc], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
pop edx
jle 0x10016719
dec dword [ebp - 8]
jns 0x100166e5
mov bl, byte [ebp - 1]
pop esi
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
je 0x100167be
push edx
push edx
push edx
push edx
push 0x1a1c
push 1
push edx
push edx
push edx
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
lea ecx, [ebp - 0x24]
call fcn.10013a48
test bl, bl
je 0x100167d7
push 0x47e
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10016824
mov dword [ebp - 0xc], 0xcea5d6c0
xor ebx, ebx
mov dword [ebp - 0xc], 0xfffffffa
mov dword [ebp - 0xc], 0xfffffffd
cmp dword [ebp - 0xc], ebx
jl 0x1001681c
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x10016817
push ebx
push 0x63
push 0x7f7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
inc dword [ebp - 0xc]
jns 0x100167f3
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
dec dword [edi]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10018111
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10018161
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push dword [eax]
mov ecx, dword [ebp - 0x14]
call fcn.10013a64
mov dword [eax], 0x4401d1b9
mov eax, dword [ebp - 0x18]
mov dword [eax], 0x4401d1b9
jmp 0x1001817e
push 0
push 0
push 0
push 0
push 0x1a1c
push 1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esp, ebp
pop ebp
ret