joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cf270
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4cf36a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.0042cc20
test eax, eax
jne 0x4cf2a4
mov byte [ebp - 5], 1
jmp 0x4cf354
xor edx, edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.0042cc30
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jle 0x4cf2cd
cmp dword [ebp - 0x10], 0xff
jg 0x4cf2cd
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
dec dword [edx + eax*4 + 0x44]
lea ecx, [ebp - 0xc]
xor edx, edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.0042cbf0
xor edx, edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.0042caa0
mov eax, dword [ebp - 0xc]
call fcn.00406aa4
push eax
mov eax, dword [ebp - 4]
add eax, 0x10
call fcn.00406b68
push eax
lea eax, [ebp - 0xc]
call fcn.00406b68
pop edx
pop ecx
call fcn.00404860
push 0x4ceb30
mov eax, dword [ebp - 4]
add eax, 0x2c
push eax
mov eax, dword [ebp - 0xc]
call fcn.00406aa4
push eax
mov eax, dword [ebp - 4]
add eax, 0x10
call fcn.00406b68
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x448]
push eax
call sub.kernel32.dll_WriteFileEx
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x4cf354
mov eax, dword [ebp - 4]
mov byte [eax + 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cf371
lea eax, [ebp - 0xc]
call fcn.004065e8
ret
Function at 0x4cf870
Capabilities:
Connect pipe

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov byte [ebp - 0xd], 0
mov byte [ebp - 0x16], 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
push eax
call sub.kernel32.dll_ResetEvent
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_ConnectNamedPipe
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x15], al
call sub.kernel32.dll_GetLastError_2
mov dword [ebp - 0x14], eax
cmp byte [ebp - 0x15], 0
je 0x4cf8e3
mov eax, dword [0x58e4dc]
mov eax, dword [eax]
mov ecx, 0x4cf98c
mov edx, 0x4cf9b0
call fcn.00436260
push 0x4cf98c
mov eax, dword [0x58e4dc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
xor edx, edx
call fcn.00436400
mov eax, dword [ebp - 0x14]
sub eax, 0x217
je 0x4cf8f6
sub eax, 0x1ce
je 0x4cf93c
jmp 0x4cf942
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
push eax
call sub.kernel32.dll_SetEvent
test eax, eax
jne 0x4cf970
call sub.kernel32.dll_GetLastError_2
mov dword [ebp - 0x14], eax
mov eax, dword [0x58e4dc]
mov eax, dword [eax]
mov ecx, 0x4cf98c
mov edx, 0x4cf9f4
call fcn.00436260
push 0x4cf98c
mov eax, dword [0x58e4dc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
xor edx, edx
call fcn.00436400
jmp 0x4cf976
mov byte [ebp - 0x16], 1
jmp 0x4cf970
mov eax, dword [0x58e4dc]
mov eax, dword [eax]
mov ecx, 0x4cf98c
mov edx, 0x4cf9b0
call fcn.00436260
push 0x4cf98c
mov eax, dword [0x58e4dc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
xor edx, edx
call fcn.00436400
jmp 0x4cf976
mov al, byte [ebp - 0x16]
mov byte [ebp - 0xd], al
mov al, byte [ebp - 0xd]
mov esp, ebp
pop ebp
ret

Function at 0x4cfc50
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4cfd2b
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x54]
push eax
push 0x1388
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
push eax
push 0xff
push 6
push 0x40000003
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
call fcn.00407218
push eax
call sub.kernel32.dll_CreateNamedPipeW
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0xffffffff
jne 0x4cfd02
call sub.kernel32.dll_GetLastError_2
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x40]
mov edx, 0x4cfd48
call fcn.00407408
mov edx, dword [ebp - 0x18]
mov eax, dword [0x58e4dc]
mov eax, dword [eax]
mov ecx, 0x4cfd8c
call fcn.00436260
push 0x4cfd8c
mov eax, dword [0x58e4dc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
xor edx, edx
call fcn.00436400
jmp 0x4cfd15
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004cf870
mov byte [ebp - 0xd], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cfd32
lea eax, [ebp - 0x18]
call fcn.004065c4
ret
Function at 0x4e8910
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x2c
jne 0x4e8937
mov eax, dword [ebp - 8]
mov edx, 0x4e89d0
call fcn.00406988
jmp 0x4e89c0
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
call sub.user32.dll_GetKeyboardLayout
push eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_MapVirtualKeyExW
shl eax, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0x21
jbe 0x4e8967
cmp dword [ebp - 4], 0x2f
jae 0x4e8967
or dword [ebp - 0xc], 0x1000000
cmp dword [ebp - 4], 0x90
jne 0x4e8977
mov dword [ebp - 0xc], 0xc1450001
cmp dword [ebp - 4], 0x13
jne 0x4e8984
mov dword [ebp - 0xc], 0xc0450001
cmp dword [ebp - 0xc], 0
je 0x4e89c0
push pe_nt_image_headers32
lea eax, [ebp - 0x20c]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_GetKeyNameTextW
test eax, eax
je 0x4e89b8
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x20c]
mov ecx, pe_nt_image_headers32
call fcn.004072c4
jmp 0x4e89c0
mov eax, dword [ebp - 8]
call fcn.004065c4
mov esp, ebp
pop ebp
ret

Function at 0x504550
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x50466a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetSystemInfo_1
xor eax, eax
push ebp
push 0x50463e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x58e3e0]
cmp dword [eax], 0
je 0x504634
push 1
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x504528]
call fcn.004084fc
add esp, 4
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x58e3e0]
mov eax, dword [eax]
call eax
mov eax, dword [ebp - 0xc]
mov ecx, 0x18
xor edx, edx
div ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x504528]
call fcn.004084fc
add esp, 4
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x58e3e0]
mov eax, dword [eax]
call eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
dec eax
test eax, eax
jb 0x50462e
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 8]
mov eax, dword [edx + eax*8 + 4]
sub eax, 1
jae 0x504626
inc dword [ebp - 0x18]
inc dword [ebp - 0x14]
dec dword [ebp - 0x1c]
jne 0x504611
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x504648
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x504671
lea eax, [ebp - 8]
mov edx, dword [0x504528]
call fcn.00408508
ret
Function at 0x505ad0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x505c67
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetLogicalDrives
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, 0x1f
ja 0x505b08
bt dword [ebp - 8], eax
jae 0x505c37
mov ax, word [ebp - 4]
add ax, 0x41
mov word [ebp - 0xa], ax
lea eax, [ebp - 0x34]
mov dx, word [ebp - 0xa]
call fcn.00407230
mov edx, dword [ebp - 0x34]
lea eax, [ebp - 0x10]
mov ecx, 0x505c80
call fcn.00407408
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.004069d0
mov eax, dword [ebp - 0x14]
call fcn.00407218
push eax
call sub.kernel32.dll_GetDriveTypeW
cmp eax, 3
jne 0x505c37
mov eax, dword [0x58e77c]
cmp dword [eax], 0
je 0x505c44
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x10]
call fcn.00407218
push eax
mov eax, dword [0x58e77c]
mov eax, dword [eax]
call eax
test eax, eax
je 0x505c37
mov eax, dword [0x598b60]
call fcn.00408348
inc eax
push eax
mov eax, 0x598b60
mov ecx, 1
mov edx, dword [0x502728]
call fcn.004084fc
add esp, 4
mov eax, dword [0x598b60]
call fcn.00408350
lea eax, [eax + eax*2]
mov edx, dword [0x598b60]
mov cx, word [ebp - 0xa]
mov word [edx + eax*8], cx
mov eax, dword [0x598b60]
call fcn.00408350
lea eax, [eax + eax*2]
mov edx, dword [0x598b60]
mov ecx, dword [ebp - 0x20]
mov dword [edx + eax*8 + 0x10], ecx
mov ecx, dword [ebp - 0x1c]
mov dword [edx + eax*8 + 0x14], ecx
mov eax, dword [0x598b60]
call fcn.00408350
lea eax, [eax + eax*2]
mov edx, dword [0x598b60]
mov ecx, dword [ebp - 0x28]
mov dword [edx + eax*8 + 8], ecx
mov ecx, dword [ebp - 0x24]
mov dword [edx + eax*8 + 0xc], ecx
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x1a
jne 0x505afc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x505c6e
lea eax, [ebp - 0x34]
call fcn.004065c4
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00406624
ret
Function at 0x533040
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 8], eax
lea eax, [ebp - 0x18]
mov edx, dword [0x532f68]
call fcn.004078d4
xor eax, eax
push ebp
push 0x53310e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
push 0
lea eax, [ebp - 0x14]
mov ecx, 1
mov edx, dword [0x532f1c]
call fcn.004084fc
add esp, 4
lea eax, [ebp - 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
push 0x532fa0
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 0x14]
call fcn.00408348
test eax, eax
jne 0x5330aa
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x5330f2
mov eax, dword [ebp - 0x14]
call fcn.00408350
test eax, eax
jl 0x5330ea
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov eax, dword [eax + edx*4]
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5330e2
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov eax, dword [eax + edx*4]
mov dword [ebp - 0xc], eax
jmp 0x5330f2
inc dword [ebp - 0x10]
dec dword [ebp - 0x1c]
jne 0x5330c1
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x533115
lea eax, [ebp - 0x18]
mov edx, dword [0x532f68]
call fcn.004079ac
ret
Function at 0x54cac0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x54cb79
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
inc dword [eax - 4]
lea ecx, [ebp - 0xc]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.0042c360
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 4]
call fcn.0042b710
lea edx, [ebp - 0x10]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0041d69c
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0x10]
lea eax, [ebp - 8]
call fcn.00407408
push 1
mov eax, dword [ebp - 8]
call fcn.00407218
push eax
mov eax, dword [ebp - 4]
call fcn.00407218
push eax
call sub.kernel32.dll_MoveFileExW
test eax, eax
je 0x54cb4c
push 4
push 0
mov eax, dword [ebp - 8]
call fcn.00407218
push eax
call sub.kernel32.dll_MoveFileExW
jmp 0x54cb5e
push 4
push 0
mov eax, dword [ebp - 4]
call fcn.00407218
push eax
call sub.kernel32.dll_MoveFileExW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54cb80
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00406624
ret
Function at 0x5544b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
test dl, dl
je 0x5544c8
add esp, 0xfffffff0
call fcn.004052b0
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x554571
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
add eax, 0x20
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 0x18]
call fcn.00406a24
mov eax, dword [ebp - 4]
mov dword [eax + 0x28], 0
mov dword [eax + 0x2c], 0
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov ecx, dword [edx + 0x10]
mov dword [eax + 0x30], ecx
mov ecx, dword [edx + 0x14]
mov dword [eax + 0x34], ecx
mov eax, dword [ebp - 4]
add eax, 0x7c
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 0xc]
call fcn.00406a24
mov eax, dword [ebp - 4]
add eax, 0x78
mov edx, dword [ebp + 8]
call fcn.00406a24
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0046cb30
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00551560
mov eax, dword [ebp - 4]
add eax, 0x38
mov edx, dword [ebp - 4]
mov edx, dword [edx + 4]
call fcn.004072e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x554578
lea eax, [ebp - 0x10]
call fcn.004065e8
ret

Function at 0x555b30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
test dl, dl
je 0x555b48
add esp, 0xfffffff0
call fcn.004052b0
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x555c01
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
add eax, 0x20
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 0x18]
call fcn.00406a24
mov eax, dword [ebp - 4]
mov dword [eax + 0x28], 0
mov dword [eax + 0x2c], 0
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov ecx, dword [edx + 0x10]
mov dword [eax + 0x30], ecx
mov ecx, dword [edx + 0x14]
mov dword [eax + 0x34], ecx
mov eax, dword [ebp - 4]
add eax, 0x80
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 0xc]
call fcn.00406a24
mov eax, dword [ebp - 4]
lea edx, [eax + 0x7c]
mov eax, dword [ebp + 8]
call fcn.00409db0
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x28]
mov eax, dword [ebp - 4]
call fcn.00555f80
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0046cb30
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00551560
mov eax, dword [ebp - 4]
add eax, 0x38
mov edx, dword [ebp - 4]
mov edx, dword [edx + 4]
call fcn.004072e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x555c08
lea eax, [ebp - 0x10]
call fcn.004065e8
ret
Function at 0x55b480
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x55b58d
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00428790
mov eax, dword [0x58e0fc]
call fcn.0042c390
dec eax
cmp eax, 0
jl 0x55b572
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0x14]
mov edx, dword [ebp - 0xc]
mov eax, dword [0x58e0fc]
call fcn.0042c360
mov byte [ebp - 0x19], 0
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov eax, dword [ebp - 0x14]
call fcn.00407744
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jl 0x55b565
cmp byte [ebp - 0x19], 0
jne 0x55b53d
mov byte [ebp - 0x19], 1
lea eax, [ebp - 0x18]
mov edx, 0x105
call fcn.00407330
mov eax, dword [ebp - 0x18]
call fcn.00407218
push eax
push 0
push 0
mov edx, dword [ebp - 0xc]
mov eax, dword [0x58e0fc]
call fcn.0042c210
push eax
push 0
call sub.shell32.dll_SHGetFolderPathW
test eax, eax
jne 0x55b535
lea eax, [ebp - 0x18]
call fcn.0042abd0
jmp 0x55b53d
lea eax, [ebp - 0x18]
call fcn.004065c4
mov eax, dword [ebp - 0x14]
call fcn.00406a98
mov ecx, eax
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.00407620
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call fcn.00407684
jmp 0x55b4d8
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffff
jne 0x55b4c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55b594
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00406624
ret

Function at 0x569a70
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x569b3b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.00569970
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x569b16
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
mov edx, 0x105
call fcn.00407330
push 0
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x1c]
call fcn.00406a98
push eax
mov eax, dword [ebp - 0x1c]
call fcn.00407218
push eax
mov eax, dword [ebp - 0xc]
call fcn.00407218
push eax
call sub.kernel32.dll_GetVolumeInformationW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x569b1d
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x57a2f0
Capabilities:
Accept command line arguments
Check os version
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x4c
push 0
push 0
dec ecx
jne 0x57a2f8
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x57ae5c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x58e610]
mov edx, dword [eax]
mov dword [ebp - 0x24], edx
mov edx, dword [eax + 4]
mov dword [ebp - 0x20], edx
lea edx, [ebp - 0x1c0]
mov eax, 1
call fcn.00427ea0
mov eax, dword [ebp - 0x1c0]
mov edx, 0x57ae78
call fcn.004075a0
jne 0x57a353
mov eax, dword [0x58e354]
mov dword [eax], 3
jmp 0x57ade3
mov byte [ebp - 3], 0
mov eax, 0x57aea8
call fcn.0042b4c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57ae63
lea eax, [ebp - 0x264]
mov edx, 5
call fcn.00406624
lea eax, [ebp - 0x23c]
mov edx, 3
call fcn.00406624
lea eax, [ebp - 0x228]
call fcn.004065c4
lea eax, [ebp - 0x224]
call fcn.004065e8
lea eax, [ebp - 0x220]
mov edx, 0xc
call fcn.00406624
lea eax, [ebp - 0x1c8]
mov edx, 3
call fcn.00406624
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00406624
lea eax, [ebp - 8]
call fcn.004065c4
ret
Function at 0x405440
Capabilities:
Hash data using sha256

Disassembly:
cmp dword [0x441e58], 2
jl 0x405465
movaps xmm0, xmmword [0x430460]
movaps xmmword [0x43ab70], xmm0
movaps xmm0, xmmword [0x430450]
movaps xmmword [0x43ab80], xmm0
push esi
mov esi, dword [esp + 8]
mov ecx, esi
call fcn.00405811
xor edx, edx
mov ecx, dword [esi + 0xf4]
mov eax, dword [edx + 0x430428]
mov dword [edx + ecx], eax
add edx, 4
cmp edx, 0x20
jl 0x405473
mov eax, dword [esi + 0xf4]
xor dword [eax], 0x2080020
mov ecx, dword [esi + 0xf4]
mov eax, dword [esp + 0xc]
xor dword [ecx + 8], eax
mov ecx, dword [esi + 0xf4]
mov eax, dword [esp + 0x10]
or eax, 0x2000
shl eax, 0x10
xor dword [ecx + 0xc], eax
pop esi
ret 0xc

Function at 0x405bae
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x405be0
test dl, 7
je 0x405be0
movzx ecx, byte [edx]
movzx eax, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x43ab90]
inc edx
mov dword [ebp + 0xc], edx
sub esi, 1
jne 0x405bc0
cmp esi, 8
jb 0x405c70
push edi
mov edi, esi
shr edi, 3
xor ebx, dword [edx]
sub esi, 8
mov edx, dword [edx + 4]
mov ecx, edx
shr ecx, 0x18
mov eax, edx
shr eax, 0x10
movzx eax, al
mov ecx, dword [ecx*4 + 0x43ab90]
xor ecx, dword [eax*4 + 0x43af90]
mov eax, edx
shr eax, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x43b390]
mov eax, ebx
shr eax, 0x18
xor ecx, dword [eax*4 + 0x43bb90]
mov eax, ebx
shr eax, 0x10
movzx eax, al
xor ecx, dword [eax*4 + 0x43bf90]
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x43c390]
movzx eax, dl
mov edx, dword [ebp + 0xc]
add edx, 8
mov dword [ebp + 0xc], edx
xor ecx, dword [eax*4 + 0x43b790]
movzx eax, bl
xor ecx, dword [eax*4 + 0x43c790]
mov ebx, ecx
sub edi, 1
jne 0x405bef
pop edi
test esi, esi
je 0x405c8c
movzx ecx, byte [edx]
movzx eax, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x43ab90]
inc edx
sub esi, 1
jne 0x405c74
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 0xc

Function at 0x405df9
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
xor ebx, ebx
push 0x20
pop ebp
cmp dword [esi], 2
jne 0x405e50
mov eax, dword [esi + 4]
push edi
push ebx
push ebx
push ebx
push ebx
mov dword [esp + 0x44], eax
lea eax, [esp + 0x20]
push eax
push 4
lea eax, [esp + 0x4c]
push eax
push ebp
push dword [esp + 0x58]
call fcn.004064eb
mov dword [esi + 4], ebx
mov edx, ebx
mov edi, ebx
movzx eax, byte [esp + edx + 0x10]
mov ecx, edx
and ecx, 3
shl ecx, 3
shl eax, cl
xor edi, eax
inc edx
cmp edx, ebp
jb 0x405e36
mov dword [esi + 4], edi
pop edi
cmp dword [esi], 3
jne 0x405e7c
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x1c]
add esi, 4
push eax
push ebp
push esi
push ebp
push dword [esp + 0x54]
call fcn.004064eb
push ebp
lea eax, [esp + 0x10]
push eax
push esi
call fcn.0041d6c0
add esp, 0xc
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 8