joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c2485
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov al, byte [0x743198]
sub esp, 0x468
test al, 1
push ebx
push ebp
push esi
push edi
jne 0x5c24b8
mov esi, dword [esp + 0x47c]
test esi, esi
jl 0x5c265b
cmp esi, dword [0x7440e4]
jl 0x5c266d
jmp 0x5c265b
mov ebx, dword [esp + 0x480]
cmp ebx, 0x80
jg 0x5c2648
cmp dword [esp + 0x484], 0x80
jg 0x5c2648
mov esi, dword [esp + 0x47c]
test esi, esi
jl 0x5c24ef
cmp esi, dword [0x7440e4]
jl 0x5c2501
push 0x7ca0bc
push 0x7354c8
call fcn.005a03fc
add esp, 8
mov ecx, dword [0x7440e0]
mov edi, dword [ecx + esi*4]
test edi, edi
mov eax, edi
je 0x5c2539
mov edx, dword [eax + 4]
mov ecx, dword [edx]
xor edx, edx
mov dl, byte [ecx + 0x40]
cmp edx, ebx
jne 0x5c2532
xor edx, edx
mov dl, byte [ecx + 0x41]
mov ecx, dword [esp + 0x484]
cmp edx, ecx
je 0x5c2675
mov eax, dword [eax + 0x2d]
test eax, eax
jne 0x5c2510
mov eax, dword [edi]
mov ecx, dword [0x7440d4]
mov edx, dword [edi + 4]
lea eax, [eax + eax*2]
mov esi, dword [ecx + eax*4]
mov eax, dword [edx]
push eax
call fcn.005d9e7e
mov ecx, dword [esp + 0x488]
add esp, 4
lea edx, [esp + 0x78]
mov ebp, eax
push ecx
push ebx
push esi
push 0x7ca0d0
push edx
call fcn.00674915
mov esi, dword [edi + 0x10]
add esp, 0x14
lea ecx, [esp + 0x38]
or esi, 0x800
call fcn.005f8b49
mov dword [esp + 0x10], 0
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], 0
mov dword [esp + 0x6c], edx
mov edx, dword [esp + 0x18]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x14], 0
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x78]
mov dword [esp + 0x74], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x70], ecx
mov ecx, dword [esp + 0x484]
lea edx, [esp + 0x1c]
mov eax, 1
push 0
push edx
mov dword [esp + 0x30], ebp
mov dword [esp + 0x3c], eax
mov dword [esp + 0x68], esi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x70], 0
mov dword [esp + 0x6c], eax
call fcn.005c2386
mov esi, eax
add esp, 8
test esi, esi
jl 0x5c260e
cmp esi, dword [0x7440e4]
jl 0x5c2620
push 0x7ca0bc
push 0x7354c8
call fcn.005a03fc
add esp, 8
mov eax, dword [0x7440e0]
mov esi, dword [eax + esi*4]
mov ecx, dword [esi + 4]
mov ecx, dword [ecx]
call fcn.005d62d6
mov edx, dword [edi + 0x2d]
mov eax, esi
mov dword [esi + 0x2d], edx
mov dword [edi + 0x2d], esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x468
ret
mov esi, dword [esp + 0x47c]
test esi, esi
jl 0x5c265b
cmp esi, dword [0x7440e4]
jl 0x5c266d
push 0x7ca0bc
push 0x7354c8
call fcn.005a03fc
add esp, 8
mov eax, dword [0x7440e0]
mov eax, dword [eax + esi*4]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x468
ret
Function at 0x5c4bbc
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x68f048
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push esi
mov esi, ecx
xor eax, eax
push edi
mov dword [esp + 8], esi
mov dword [esi + 4], eax
mov edi, dword [esp + 0x58]
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x88]
mov dword [esi], 0x7dc910
mov dword [esi + 0x40], eax
mov eax, dword [esp + 0x5c]
lea ecx, [esp + 0xc]
fld dword [eax]
fsub dword [edi]
push ecx
lea ecx, [esp + 0x1c]
fstp dword [esp + 0x10]
fld dword [eax + 4]
fsub dword [edi + 4]
fstp dword [esp + 0x14]
fld dword [eax + 8]
fsub dword [edi + 8]
fstp dword [esp + 0x18]
call fcn.0046bd69
fld dword [0x73f15c]
fld dword [esp + 0x18]
fmul st(1)
lea edx, [esp + 0x24]
lea ecx, [esp + 0x30]
push edx
fstp dword [esp + 0x28]
fld dword [esp + 0x20]
fmul st(1)
fstp dword [esp + 0x2c]
fld dword [esp + 0x24]
fmul st(1)
fstp dword [esp + 0x30]
fstp st(0)
call fcn.0046bd69
lea eax, [esp + 0x30]
lea ecx, [esp + 0x3c]
push eax
push ecx
mov ecx, edi
call fcn.0049ce53
mov edx, dword [eax]
mov dword [esi + 0x1c], edx
mov ecx, dword [eax + 4]
mov dword [esi + 0x20], ecx
mov edx, dword [eax + 8]
mov ecx, dword [esp + 0x70]
lea eax, [esi + 0x34]
mov dword [esi + 0x24], edx
mov edx, eax
mov edi, dword [ecx]
mov dword [edx], edi
mov edi, dword [ecx + 4]
mov dword [edx + 4], edi
mov ecx, dword [ecx + 8]
mov dword [edx + 8], ecx
mov edx, dword [esp + 0x74]
fld dword [eax]
fmul dword [0x7dc85c]
mov ecx, dword [esp + 0x6c]
fstp dword [eax]
fld dword [eax + 4]
fmul dword [0x7dc85c]
fstp dword [eax + 4]
fld dword [eax + 8]
fmul dword [0x7dc85c]
fstp dword [eax + 8]
fld dword [esp + 0x64]
fld dword [esp + 0x60]
mov eax, dword [esp + 0x68]
mov dword [esi + 0x44], edx
fld dword [esp + 0x64]
fsub dword [esp + 0x60]
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
fcomp dword [0x7dc83c]
fnstsw ax
test ah, 0x41
jne 0x5c4d15
fld dword [0x7dc83c]
fmul dword [0x7dc860]
fxch st(1)
fsub st(1)
fld dword [esp + 0x64]
fxch st(1)
fxch st(2)
fxch st(1)
fsub st(2)
fcomp dword [0x7dc83c]
fnstsw ax
test ah, 0x41
je 0x5c4cf6
fstp st(0)
fld st(0)
fsub dword [esp + 0x64]
fcomp dword [0x7dc83c]
fnstsw ax
test ah, 0x41
jne 0x5c4d51
fld dword [0x7dc83c]
fmul dword [0x7dc860]
fxch st(2)
fsub st(2)
fld st(1)
fxch st(1)
fxch st(3)
fxch st(1)
fsub st(3)
fcomp dword [0x7dc83c]
fnstsw ax
test ah, 0x41
je 0x5c4d34
fstp st(0)
fxch st(1)
fsub st(1)
fld dword [esp + 0x78]
fld dword [esp + 0x7c]
fxch st(2)
fmul dword [0x73f15c]
fld dword [esp + 0x80]
fxch st(2)
fstp dword [esi + 0x48]
mov edx, dword [esp + 0x84]
mov ecx, dword [esp + 0x48]
fadd st(3)
fxch st(2)
fstp dword [esi + 0x14]
mov dword [esi + 0x4c], edx
mov eax, esi
fstp dword [esi + 0x18]
pop edi
fstp dword [esi + 0x10]
fstp st(0)
mov dword fs:[0], ecx
pop esi
add esp, 0x4c
ret 0x34
Function at 0x5d6052
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
mov ebx, ecx
push esi
push edi
mov eax, dword [ebx]
mov dword [ebp - 4], ebx
test eax, eax
jne 0x5d606b
call fcn.005d6fee
mov eax, dword [ebx]
mov ecx, 6
lea edi, [ebp - 0x2c]
mov eax, dword [eax + 0x10]
lea esi, [eax + 0x2d]
mov al, byte [ebp + 0xc]
test al, al
rep movsd dword es:[edi], dword [esi]
je 0x5d6109
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x1c]
mov ecx, dword [eax + 0x18]
imul edx, dword [eax + 0x10]
shr edx, 3
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + 0x20]
mov dword [ebp + 0xc], edx
mov edx, dword [eax + 0x24]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
push esi
push edi
mov ebx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov eax, 0xfbea
xor edx, edx
mov edi, dword [ebp - 8]
push ebx
push ecx
mov ecx, dword [ebp + 0xc]
mov dl, byte [ebx]
xor dl, al
inc ebx
shr eax, 8
dec ecx
mov esi, dword [edx*4 + 0x7dcb64]
je 0x5d60e7
xor eax, esi
mov dl, byte [ebx]
xor dl, al
inc ebx
shr eax, 8
dec ecx
mov esi, dword [edx*4 + 0x7dcb64]
jne 0x5d60d3
xor eax, esi
pop ecx
pop ebx
add ebx, edi
dec ecx
jne 0x5d60bc
pop edi
pop esi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [eax + 0x44]
je 0x5d61b3
mov dword [eax + 0x44], ecx
mov ebx, eax
mov ecx, dword [ebx]
mov eax, dword [ecx]
call dword [eax + 0x18]
mov edi, dword [ebp + 8]
mov esi, eax
push 0
lea ecx, [ebp - 0x2c]
push esi
lea edx, [edi + 0x1c]
push ecx
push edx
lea ecx, [ebp - 0x54]
call fcn.005f8b60
lea eax, [ebp - 0x54]
push edi
push eax
call fcn.005d4fd1
mov ecx, dword [ebx]
add esp, 8
mov edx, dword [ecx]
push esi
call dword [edx + 0x1c]
mov edx, dword [ebx + 4]
xor esi, esi
cmp edx, esi
je 0x5d61b3
test byte [0x743198], 1
je 0x5d616f
mov esi, dword [ebx]
xor eax, eax
mov al, byte [ebx + 0x43]
xor ecx, ecx
mov cl, byte [ebx + 0x42]
push eax
push ecx
mov ecx, dword [edx + 0xc]
push esi
call fcn.005d58e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [edx + 4]
xor ecx, ecx
cmp eax, esi
je 0x5d61b3
cmp eax, ebx
je 0x5d618e
mov ecx, eax
mov eax, dword [eax + 0x14]
cmp eax, esi
jne 0x5d6178
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp ecx, esi
je 0x5d61a7
mov edx, dword [eax + 0x14]
mov dword [ecx + 0x14], edx
mov dword [ebx + 0x14], esi
mov dword [ebx + 4], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [eax + 0x14]
mov dword [edx + 4], eax
mov dword [ebx + 0x14], esi
mov dword [ebx + 4], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5ed946
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, dword [esi]
cmp dword [eax + 0x88], edi
jne 0x5eda77
mov edx, dword [eax + 0x10]
lea ecx, [eax + 0x10]
cmp edx, edi
jne 0x5ed981
cmp dword [eax + 0xc], edi
je 0x5ed981
mov dword [esi + 0x3e4], 1
mov eax, dword [eax + 0xc]
push ecx
push 0x7dea74
mov edx, dword [eax]
push eax
call dword [edx]
mov ecx, esi
call fcn.005edeab
mov dword [esi + 0x4c], eax
mov eax, dword [esi]
mov dword [eax + 0x1c], edi
mov ecx, dword [esi]
mov dword [ecx + 0x20], edi
mov edx, dword [esi]
mov eax, dword [edx + 4]
test ah, 8
jne 0x5eda0d
mov ecx, esi
call fcn.005edb5e
mov eax, dword [esi]
mov edx, dword [eax + 0x14]
lea ecx, [eax + 0x2c]
push ecx
mov ecx, dword [eax + 0x10]
call fcn.005eda7a
mov eax, dword [esi]
cmp dword [eax + 0x48], 8
jne 0x5eda0d
test dword [eax + 4], 0x4000000
jne 0x5eda0d
push 0x400
call fcn.006775c6
mov edx, dword [esi]
add esp, 4
mov dword [edx + 0x28], eax
mov eax, dword [esi]
push edi
mov ecx, dword [eax + 0x10]
lea edi, [eax + 0x24]
mov eax, dword [eax + 0x28]
push edi
mov edx, dword [ecx]
push eax
push 0x44
push ecx
call dword [edx + 0x14]
mov edx, dword [esi]
mov ecx, 0x100
xor eax, eax
mov edi, dword [edx + 0x28]
rep stosd dword es:[edi], eax
mov eax, dword [esi]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0x24]
push eax
push ecx
mov edx, dword [ecx]
call dword [edx + 0x7c]
mov eax, dword [esi]
test dword [eax + 4], 0x100000
jne 0x5eda1f
mov dword [eax + 0x78], 0x64
mov ecx, esi
call fcn.005ed45c
mov ecx, dword [esi]
mov edx, esi
add ecx, 0x2c
call fcn.005edba2
mov eax, 0xfffffe00
cmp eax, 0xffffff80
mov ecx, eax
jge 0x5eda45
mov ecx, 0xffffff80
jmp 0x5eda4f
cmp eax, 0x7f
jle 0x5eda4f
mov ecx, 0x7f
lea edx, [eax - 0x180]
add ecx, 0x80
and edx, 0x3ff
inc eax
cmp eax, 0x200
mov dword [edx*4 + 0x7fdf30], ecx
jl 0x5eda37
mov dword [esi + 0x3c], 1
pop edi
pop esi
ret
Function at 0x5f7381
Capabilities:
Create directory

Disassembly:
mov eax, dword [esp + 8]
lea ecx, [esp + 8]
push eax
push 0x104
push 0x77b688
push ecx
call fcn.005fa95b
add esp, 0x10
push 0
push 0x77b688
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [esp + 4]
neg eax
sbb eax, eax
neg eax
dec eax
mov dword [ecx], eax
mov eax, ecx
ret

Function at 0x5f73ba
Capabilities:
Delete directory

Disassembly:
mov eax, dword [esp + 8]
lea ecx, [esp + 8]
push eax
push 0x104
push 0x77b688
push ecx
call fcn.005fa95b
add esp, 0x10
push 0x77b688
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
mov eax, dword [esp + 4]
je 0x5f73f0
mov dword [eax], 0
ret
mov dword [eax], 0xffffffff
ret

Function at 0x5f74ed
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x108
lea ecx, [esp + 4]
lea edx, [esp]
push eax
push 0x104
push ecx
push edx
call fcn.005fa95b
add esp, 0x10
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x5f7533
mov eax, dword [esp + 0x10c]
mov dword [eax], 0xffffffff
add esp, 0x108
ret
mov ecx, dword [esp + 0x114]
mov dword [ecx], eax
mov eax, dword [esp + 0x10c]
mov dword [eax], 0
add esp, 0x108
ret

Function at 0x5f7550
Capabilities:
Set file attributes

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x108
lea ecx, [esp + 4]
lea edx, [esp]
push eax
push 0x104
push ecx
push edx
call fcn.005fa95b
mov eax, dword [esp + 0x124]
add esp, 0x10
lea ecx, [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
mov eax, dword [esp + 0x10c]
jne 0x5f759d
mov dword [eax], 0xffffffff
add esp, 0x108
ret
mov dword [eax], 0
add esp, 0x108
ret

Function at 0x5f760b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x108
lea ecx, [esp + 4]
lea edx, [esp]
push eax
push 0x104
push ecx
push edx
call fcn.005fa95b
add esp, 0x10
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
add esp, 0x108
ret

Function at 0x5f7649
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x108
lea ecx, [esp + 4]
lea edx, [esp]
push eax
push 0x104
push ecx
push edx
call fcn.005fa95b
add esp, 0x10
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x5f7684
xor eax, eax
add esp, 0x108
ret
and eax, 0x10
add esp, 0x108
ret

Function at 0x5f768e
Capabilities:
Delete file

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x108
lea ecx, [esp + 4]
lea edx, [esp]
push eax
push 0x104
push ecx
push edx
call fcn.005fa95b
add esp, 0x10
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
mov eax, dword [esp + 0x10c]
jne 0x5f76d3
mov dword [eax], 0xffffffff
add esp, 0x108
ret
mov dword [eax], 0
add esp, 0x108
ret
Function at 0x5f76e0
Capabilities:
Enumerate files on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebx + 0x140], eax
je 0x5f77c1
mov eax, dword [esp + 0x20]
or ecx, 0xffffffff
mov dword [ebx + 0x144], eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea ebp, [ebx + 0x148]
mov edx, ecx
mov esi, edi
mov edi, ebp
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0067768e
add esp, 8
cmp eax, ebp
mov dword [ebx + 0x24c], eax
jbe 0x5f7761
mov eax, dword [ebx + 0x24c]
dec eax
mov cl, byte [eax]
cmp cl, 0x5c
je 0x5f7761
cmp cl, 0x2f
je 0x5f7761
cmp eax, ebp
mov dword [ebx + 0x24c], eax
ja 0x5f7744
mov esi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov eax, dword [ebx]
test eax, eax
jne 0x5f7776
cmp dword [ebx + 0x144], 0xffffffff
je 0x5f778e
test dword [ebx + 0x144], eax
jne 0x5f778e
mov eax, dword [ebx + 0x140]
push ebx
push eax
call esi
test eax, eax
je 0x5f77c1
jmp 0x5f7767
lea edi, [ebx + 0x2c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, dword [esp + 0x14]
mov edx, ecx
mov esi, edi
mov edi, dword [ebx + 0x24c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [eax], 0
pop edi
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov dword [eax], 0xffffffff
pop ebx
ret

Function at 0x5f7877
Capabilities:
Move file

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
mov eax, dword [esp + 4]
jne 0x5f7896
mov dword [eax], 0xffffffff
ret
mov dword [eax], 0
ret
Function at 0x5fa49b
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x68f9e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0xc]
call fcn.005fa64b
mov dword [esp + 0xc], 0x7deb8c
mov eax, dword [esp + 0x2c]
push 0x400
lea ecx, [esp + 0x30]
push eax
push ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], 0
call fcn.006195be
push 0
push 0
lea ecx, [esp + 0x14]
call fcn.005fa6e7
test eax, eax
jne 0x5fa560
mov eax, dword [esp + 0x28]
mov ecx, dword [eax + 0x18]
test ecx, ecx
je 0x5fa560
mov edx, dword [esi]
lea ebx, [esi + 4]
lea ecx, [esp + 0xc]
push ebx
push ecx
push eax
lea eax, [esp + 0x38]
mov ecx, esi
push eax
call dword [edx + 8]
mov edx, dword [eax]
xor ecx, ecx
test edx, edx
setge cl
xor ecx, 1
jne 0x5fa560
mov eax, dword [esp + 0x30]
test eax, eax
je 0x5fa554
mov ecx, 6
mov esi, ebx
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebx + 0x18]
mov dword [eax + 0x18], edx
mov ecx, dword [ebx + 0x1c]
mov dword [eax + 0x1c], ecx
mov edx, dword [ebx + 0x20]
mov dword [eax + 0x20], edx
mov ecx, dword [ebx + 0x24]
mov dword [eax + 0x24], ecx
mov esi, dword [esp + 0x24]
mov dword [esi], 0
jmp 0x5fa56a
mov esi, dword [esp + 0x24]
mov dword [esi], 0xffffffff
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.005fa679
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x14
ret 0x10

Function at 0x5fb7fc
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x20
lea eax, [esp]
mov dword [esp], 0x20
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [esp + 8]
add esp, 0x20
ret
Function at 0x5fb81a
Capabilities:
Get disk information

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x68fa19
push eax
mov dword fs:[0], esp
sub esp, 0x120
lea eax, [esp + 0x20]
push ebx
push ebp
push esi
push edi
push eax
push 0xff
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
je 0x5fb97a
cmp eax, 0x100
jae 0x5fb97a
mov al, byte [esp + 0x30]
lea ebp, [esp + 0x30]
test al, al
je 0x5fb96b
mov esi, dword [esp + 0x148]
mov ebx, dword [esp + 0x144]
and esi, 1
mov dword [esp + 0x10], esi
jmp 0x5fb887
mov esi, dword [esp + 0x10]
push ebp
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
test esi, esi
je 0x5fb897
cmp eax, 2
je 0x5fb8cf
mov edx, dword [esp + 0x148]
mov ecx, edx
and ecx, 2
je 0x5fb8aa
cmp eax, 3
je 0x5fb8cf
test dl, 4
je 0x5fb8b4
cmp eax, 4
je 0x5fb8cf
test dl, 8
je 0x5fb8be
cmp eax, 5
je 0x5fb8cf
test ecx, ecx
je 0x5fb94f
cmp eax, 3
jne 0x5fb94f
push ebp
lea ecx, [esp + 0x20]
call fcn.005fbd93
mov edi, eax
push 0x1c
mov dword [esp + 0x13c], 0
call fcn.006749d4
mov esi, eax
add esp, 4
mov dword [esp + 0x18], esi
test esi, esi
mov byte [esp + 0x138], 1
je 0x5fb91a
sub esp, 0x14
mov ecx, esp
mov dword [esp + 0x28], esp
push edi
call fcn.005fbd25
mov ecx, esi
call fcn.005a8ecc
jmp 0x5fb91c
xor eax, eax
mov ecx, dword [ebx + 8]
mov dword [eax + 0x18], ecx
mov ecx, dword [ebx + 8]
test ecx, ecx
jne 0x5fb92e
mov dword [ebx + 4], eax
jmp 0x5fb931
mov dword [ecx + 0x14], eax
mov dword [ebx + 8], eax
mov eax, dword [ebx + 0xc]
inc eax
lea ecx, [esp + 0x1c]
mov dword [ebx + 0xc], eax
mov dword [esp + 0x138], 0xffffffff
call fcn.005fbe5e
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov al, byte [ebp + ecx + 1]
lea ebp, [ebp + ecx + 1]
test al, al
jne 0x5fb883
mov eax, dword [esp + 0x140]
mov dword [eax], 0
jmp 0x5fb987
mov eax, dword [esp + 0x140]
mov dword [eax], 0xffffffff
mov ecx, dword [esp + 0x130]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x12c
ret 0xc

Function at 0x5fba3b
Capabilities:
Get disk information

Disassembly:
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push 0
push 0
push 0
push 0
push 0
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
mov eax, dword [esp + 4]
je 0x5fba6b
mov dword [eax], 0
ret 0x10
mov dword [eax], 0xffffffff
ret 0x10

Function at 0x5fe1ff
Capabilities:
Check mutex on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov esi, ecx
push eax
push 0
push 0
mov byte [esi], 0
mov dword [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, eax
test edi, edi
je 0x5fe235
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x5fe232
mov byte [esi], 1
mov dword [esi + 4], edi
mov eax, esi
pop edi
pop esi
ret 4
Function at 0x6199ad
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, ecx
lea eax, [ebp + 4]
mov edx, dword [esi]
lea ecx, [ebp + 0x2c]
mov dword [esp + 0x20], ecx
push 0xe
push 0x77d760
mov ecx, esi
mov dword [esp + 0x18], eax
lea ebx, [ebp + 0x430]
call dword [edx + 8]
cmp eax, 0xe
jne 0x619b65
cmp word [0x77d760], 0x4d42
jne 0x619b65
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
cmp dword [0x77d762], eax
jne 0x619b65
mov edx, dword [esi]
push 0x28
push ebx
mov ecx, esi
call dword [edx + 8]
cmp eax, 0x28
jne 0x619b65
add edi, 0x3c
mov ecx, 0xa
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
cmp dword [ebx], 0x28
jne 0x619b65
mov eax, dword [ebx + 4]
test eax, eax
jle 0x619b65
mov eax, dword [ebx + 8]
test eax, eax
jle 0x619b65
cmp word [ebx + 0xc], 1
jne 0x619b65
mov ax, word [ebx + 0xe]
cmp ax, 8
je 0x619a6c
cmp ax, 0x18
je 0x619a6c
cmp ax, 4
jne 0x619b65
mov dword [ebp + 0x42c], 0
cmp word [ebx + 0xe], 0x18
je 0x619af3
mov esi, dword [ebx + 0x20]
test esi, esi
je 0x619aec
cmp esi, 0x100
jae 0x619a99
mov edi, dword [esp + 0x20]
mov ecx, 0x100
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
lea edi, [esi*4]
mov eax, dword [ecx]
push edi
push edx
call dword [eax + 8]
cmp eax, edi
jne 0x619b65
mov eax, dword [esp + 0x20]
mov dword [ebp + 0x42c], 1
test esi, esi
jbe 0x619aec
mov cl, byte [eax + 2]
mov dl, byte [eax]
xor dl, cl
mov byte [eax], dl
mov cl, dl
mov dl, byte [eax + 2]
add eax, 4
xor dl, cl
mov byte [eax - 2], dl
mov cl, dl
mov dl, byte [eax - 4]
xor dl, cl
dec esi
mov byte [eax - 4], dl
jne 0x619ac9
cmp word [ebx + 0xe], 0x18
jne 0x619b07
mov eax, dword [esp + 0x10]
mov ecx, 6
mov esi, 0x77bdf8
mov edi, eax
rep movsd dword es:[edi], dword [esi]
jmp 0x619b1b
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov ecx, 6
mov esi, 0x77be28
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [eax + 0x10]
mov edx, dword [ebx + 4]
add ecx, 7
mov dword [eax + 0x1c], edx
shr ecx, 3
imul ecx, dword [ebx + 4]
mov dword [eax + 0x24], ecx
mov edx, dword [ebx + 8]
mov ecx, dword [esp + 0x1c]
mov dword [eax + 0x20], edx
mov edx, dword [0x77d76a]
push 0
mov eax, dword [ecx]
push edx
call dword [eax + 0x10]
mov ecx, dword [0x77d76a]
cmp eax, ecx
mov eax, dword [esp + 0x18]
jne 0x619b69
mov dword [eax], 0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
mov dword [eax], 0xffffffff
pop ebx
pop ecx
ret 0xc
Function at 0x61c14b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x10c
lea edx, [esp + 4]
push edi
mov edi, ecx
push eax
lea ecx, [esp + 0x10]
push 0x104
push ecx
push edx
call fcn.005fa95b
add esp, 0x10
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x61c1cc
mov edx, dword [edi + 0x10]
push esi
lea esi, [edi + 0x10]
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call dword [edx + 0x14]
mov ecx, dword [edi + 0x18]
mov edx, dword [edi + 0x14]
mov al, byte [ecx + edx - 1]
cmp al, 0x5c
je 0x61c1b4
cmp al, 0x2f
je 0x61c1b4
mov eax, dword [esi]
lea ecx, [esp + 0xb]
push ecx
mov ecx, esi
mov byte [esp + 0xf], 0x5c
call dword [eax + 0x24]
mov eax, dword [esp + 0x118]
pop esi
mov dword [eax], 0
pop edi
add esp, 0x10c
ret 8
mov eax, dword [esp + 0x114]
pop edi
mov dword [eax], 0xffffffff
add esp, 0x10c
ret 8

Function at 0x61c474
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x6902f3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
mov dword [esp + 8], esi
call fcn.0061f24e
xor eax, eax
mov dword [esi], 0x7df41c
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov cl, byte [esp + 7]
mov dword [esp + 0x14], eax
mov byte [esi + 0x10], cl
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
lea ecx, [esi + 0x40]
mov byte [esp + 0x14], 1
call fcn.0061f25e
mov ecx, dword [esp + 0xc]
mov dword [esi], 0x7df3f4
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0x14
ret