joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48bcf0
Capabilities:
Get common file path
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59fef8
push 0x413b60
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x22c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov eax, dword [0x5f3744]
xor ebx, ebx
cmp eax, ebx
jne 0x48be50
mov byte [ebp - 0x11c], bl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x11b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x48be4b
mov byte [ebp - 0x224], bl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x223]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push str.user32.dll
lea ecx, [ebp - 0x11c]
push ecx
push 0x5d4f10
lea edx, [ebp - 0x224]
push edx
call fcn.00415a2b
add esp, 0x10
mov dword [ebp - 0x22c], ebx
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x224]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x120], eax
push eax
call fcn.0057985d
add esp, 4
mov esi, eax
mov dword [ebp - 0x238], esi
cmp esi, ebx
je 0x48be4b
push esi
mov edx, dword [ebp - 0x120]
push edx
mov eax, dword [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x224]
push ecx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x48be42
mov dword [ebp - 0x230], ebx
lea edx, [ebp - 0x120]
push edx
lea eax, [ebp - 0x230]
push eax
push str.VarFileInfoTranslation
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x48be42
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x234], eax
mov ecx, dword [eax]
mov dword [0x5f3744], ecx
mov dword [ebp - 4], 0xffffffff
jmp 0x48be42
push esi
call fcn.00579886
add esp, 4
mov eax, dword [0x5f3744]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48d8a0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x58fb9c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x5d8b34]
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea edi, [esi + 8]
mov dword [edi], eax
mov ecx, dword [0x5d8b34]
lea ebp, [esi + 0x18]
xor ebx, ebx
mov dword [esp + 0x1c], ebx
mov dword [ebp], ecx
mov edx, dword [0x5d8b34]
mov dword [esi + 0x20], edx
lea ecx, [esi + 0x28]
mov byte [esp + 0x1c], 2
call fcn.00577b9d
mov eax, dword [esp + 0x24]
mov ecx, edi
push eax
mov byte [esp + 0x20], 3
mov dword [esi], 0x59ff04
mov dword [esi + 4], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x1c], ebx
mov word [esi + 0x24], 0xffff
call fcn.00579da7
mov eax, dword [esp + 0x28]
mov cx, word [esp + 0x30]
test eax, 0xffff0000
mov word [esi + 0x24], cx
mov dword [esi + 0x14], eax
je 0x48d943
push eax
mov ecx, ebp
call fcn.00579da7
mov edx, dword [ebp]
mov dword [esi + 0x14], edx
mov eax, dword [esp + 0x2c]
test eax, 0xffff0000
mov dword [esi + 0x1c], eax
je 0x48d961
lea edi, [esi + 0x20]
push eax
mov ecx, edi
call fcn.00579da7
mov eax, dword [edi]
mov dword [esi + 0x1c], eax
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x10
Function at 0x4913c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59ff50
push 0x413b60
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov ecx, dword [ebp + 8]
xor edx, edx
cmp ecx, edx
je 0x491452
mov dword [ebp - 4], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], ecx
cmp word [ecx], 0x5a4d
jne 0x49144b
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x20], eax
cmp dword [eax], 0x4550
jne 0x49144b
cmp word [eax + 0x14], dx
je 0x49144b
cmp dword [ebp + 0xc], edx
je 0x491425
cmp word [eax + 4], 0x14c
jne 0x49144b
mov dword [ebp - 4], 0xffffffff
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x491540
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
test ebx, ebx
push edi
je 0x49158d
mov edi, dword [esp + 0x18]
test edi, edi
je 0x49158d
mov eax, dword [ebx + 0x3c]
xor ecx, ecx
add eax, ebx
xor edx, edx
mov cx, word [eax + 0x14]
mov dx, word [eax + 6]
lea esi, [ecx + eax + 0x18]
xor ecx, ecx
test edx, edx
mov dword [esp + 0x14], esi
jbe 0x49158d
lea eax, [esi + 0x10]
mov esi, dword [eax - 4]
cmp edi, esi
jb 0x491585
mov ebp, dword [eax]
add ebp, esi
cmp edi, ebp
jb 0x491594
inc ecx
add eax, 0x28
cmp ecx, edx
jb 0x491576
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov eax, dword [esp + 0x14]
lea edx, [ecx + ecx*4]
mov esi, dword [eax + edx*8 + 0xc]
lea ecx, [eax + edx*8]
mov eax, dword [eax + edx*8 + 0x14]
sub eax, esi
add eax, ebx
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x491e40
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59ff60
push 0x413b60
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 0x20], ebx
lea eax, [ebp - 0x20]
push eax
mov edi, dword [ebp + 0x14]
push edi
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004916a0
add esp, 0x10
mov esi, eax
cmp esi, ebx
je 0x491ef3
mov eax, dword [esi]
push eax
mov eax, dword [ebp - 0x20]
push eax
call edi
add esp, 8
mov dword [ebp - 0x24], eax
mov edi, dword [ebp + 0x10]
sub edi, dword [ebp - 0x20]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x30], ebx
lea ecx, [ebp - 0x30]
push ecx
push 0x40
push 4
push esi
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call ebx
test eax, eax
je 0x491eec
mov dword [esi], edi
lea edx, [ebp - 0x30]
push edx
mov eax, dword [ebp - 0x30]
push eax
push 4
push esi
call ebx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49e000
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x590c2b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x210
mov eax, dword [0x59f144]
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], eax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
push 0x104
push ecx
mov dword [esp + 0x228], 0
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea edx, [esp + 0x10]
mov ecx, esi
push edx
call fcn.0042d550
lea eax, [esp + 8]
push 1
push eax
mov ecx, esi
call fcn.0042f830
mov ecx, dword [eax]
push 0x5d5210
push ecx
call fcn.00414e8b
add esp, 8
lea ecx, [esp + 8]
mov edi, eax
call fcn.0042d270
test edi, edi
je 0x49e080
push 0x5d5210
mov ecx, esi
call fcn.0042deb0
mov ecx, dword [esp + 0x218]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x21c
ret

Function at 0x49e1e0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x590c6b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x210
mov eax, dword [0x59f144]
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], eax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
push 0x104
push ecx
mov dword [esp + 0x228], 0
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea edx, [esp + 0x10]
mov ecx, esi
push edx
call fcn.0042d550
lea eax, [esp + 8]
push 1
push eax
mov ecx, esi
call fcn.0042f830
mov ecx, dword [eax]
push 0x5d5210
push ecx
call fcn.00414e8b
add esp, 8
lea ecx, [esp + 8]
mov edi, eax
call fcn.0042d270
test edi, edi
je 0x49e260
push 0x5d5210
mov ecx, esi
call fcn.0042deb0
mov ecx, dword [esp + 0x218]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x21c
ret
Function at 0x4a0a90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x59100f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [0x59f144]
push esi
push edi
xor edi, edi
mov esi, ecx
mov dword [esp + 0x1c], edi
mov dword [esp + 8], eax
mov dword [esp + 0x28], 1
mov dword [esp + 0xc], eax
mov eax, dword [esi + 8]
mov byte [esp + 0x28], 2
cmp eax, edi
jle 0x4a0bb0
push ebx
push ebp
mov bl, 4
mov eax, dword [esi + 4]
mov ecx, dword [eax + edi*8]
mov edx, dword [eax + edi*8 + 4]
lea eax, [eax + edi*8]
cmp ecx, edx
ja 0x4a0ba2
jne 0x4a0b1a
lea edx, [esp + 0x18]
push ecx
push edx
call fcn.0049f640
add esp, 8
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x34], 3
call fcn.0042d420
mov byte [esp + 0x30], 2
lea ecx, [esp + 0x18]
jmp 0x4a0b76
mov eax, dword [eax + 4]
lea ecx, [esp + 0x20]
push eax
push ecx
call fcn.0049f640
mov ebp, eax
mov edx, dword [esi + 4]
lea ecx, [esp + 0x24]
mov byte [esp + 0x38], bl
mov eax, dword [edx + edi*8]
push eax
push ecx
call fcn.0049f640
add esp, 0x10
mov edx, dword [ebp]
mov eax, dword [eax]
push edx
push eax
lea ecx, [esp + 0x1c]
push str._s__s
push ecx
mov byte [esp + 0x40], 5
call fcn.00430280
add esp, 0x10
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], bl
call fcn.0042d270
mov byte [esp + 0x30], 2
lea ecx, [esp + 0x20]
call fcn.0042d270
mov edx, dword [esp + 0x10]
mov eax, dword [edx - 8]
test eax, eax
je 0x4a0b94
push 0x5debb8
lea ecx, [esp + 0x14]
call fcn.0042deb0
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
push eax
call fcn.0042df10
mov eax, dword [esi + 8]
inc edi
cmp edi, eax
jl 0x4a0adb
pop ebp
pop ebx
mov esi, dword [esp + 0x30]
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.0042c7f0
mov dword [esp + 0x1c], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 1
call fcn.0042d270
lea ecx, [esp + 8]
mov byte [esp + 0x28], 0
call fcn.0042d270
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret 4
Function at 0x4fc2a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x599055
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov edx, dword [esp + 0x18]
push ebx
push esi
mov esi, dword [esp + 0x1c]
lea eax, [edx + edx*2]
push edi
mov edi, esi
lea ecx, [eax + eax*4]
xor eax, eax
shl ecx, 3
mov ebx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, ebx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, edx
dec edx
test eax, eax
je 0x4fc394
inc edx
push ebp
mov dword [esp + 0x28], edx
mov dword [esp + 0x10], esi
test esi, esi
mov dword [esp + 0x1c], 0
je 0x4fc375
mov ecx, dword [0x59f144]
mov dword [esi], ecx
mov edx, dword [0x59f144]
lea edi, [esi + 4]
mov dword [edi], edx
lea ebp, [esi + 8]
mov byte [esp + 0x1c], 2
mov ecx, ebp
call fcn.0049fe30
lea ebx, [esi + 0x3c]
mov byte [esp + 0x1c], 3
mov ecx, ebx
call fcn.0049fe30
mov eax, dword [0x59f144]
mov dword [esi + 0x74], eax
push 0x5efb00
mov ecx, esi
mov byte [esp + 0x20], 5
call fcn.0042d550
push 0x5efb00
mov ecx, edi
call fcn.0042d550
mov ecx, ebp
call fcn.004a00d0
mov ecx, ebx
call fcn.004a00d0
push 0x5efb00
lea ecx, [esi + 0x74]
mov dword [esi + 0x70], 0
call fcn.0042d550
mov eax, dword [esp + 0x28]
add esi, 0x78
dec eax
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], eax
jne 0x4fc2ed
pop ebp
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x4fc3b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5990a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov edx, dword [esp + 0x18]
push ebx
mov ecx, edx
push esi
mov esi, dword [esp + 0x1c]
push edi
shl ecx, 4
add ecx, edx
xor eax, eax
shl ecx, 3
mov ebx, ecx
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, ebx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, edx
dec edx
test eax, eax
je 0x4fc4b6
inc edx
push ebp
mov dword [esp + 0x28], edx
mov dword [esp + 0x10], esi
test esi, esi
mov dword [esp + 0x1c], 0
je 0x4fc494
mov ecx, dword [0x59f144]
mov dword [esi], ecx
mov edx, dword [0x59f144]
lea edi, [esi + 4]
mov dword [edi], edx
lea ebp, [esi + 8]
mov byte [esp + 0x1c], 2
mov ecx, ebp
call fcn.0049fe30
lea ebx, [esi + 0x3c]
mov byte [esp + 0x1c], 3
mov ecx, ebx
call fcn.0049fe30
mov eax, dword [0x59f144]
mov dword [esi + 0x80], eax
push 0x5efb00
mov ecx, esi
mov byte [esp + 0x20], 5
call fcn.0042d550
push 0x5efb00
mov ecx, edi
call fcn.0042d550
mov ecx, ebp
call fcn.004a00d0
mov ecx, ebx
call fcn.004a00d0
xor eax, eax
push 0x5efb00
mov dword [esi + 0x78], eax
lea ecx, [esi + 0x80]
mov dword [esi + 0x70], eax
mov dword [esi + 0x7c], eax
call fcn.0042d550
mov eax, dword [esp + 0x28]
add esi, 0x88
dec eax
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], eax
jne 0x4fc3fe
pop ebp
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x4fe010
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x599480
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
push edi
mov esi, ecx
push str.___:_:
lea ecx, [esp + 0x1c]
mov dword [esp + 0x2c], 0
call fcn.00579c8c
push 0x5efa58
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 1
call fcn.00579c8c
push 0x5e28c0
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], 2
call fcn.00579c8c
push 0x5efa58
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 3
call fcn.00579c8c
lea edi, [esi + 0x144]
push 0x5efa58
mov ecx, edi
mov byte [esp + 0x2c], 4
call fcn.00579da7
mov eax, dword [esp + 0x30]
xor esi, esi
mov ecx, dword [eax - 8]
test ecx, ecx
jle 0x4fe11e
mov al, byte [esi + eax]
mov byte [esp + 0x1c], al
movsx eax, al
push eax
call fcn.00417964
add esp, 4
test eax, eax
je 0x4fe106
push 0x5efa58
lea ecx, [esp + 0x14]
call fcn.00579c8c
push esi
lea ecx, [esp + 0x14]
push 0x59cfb4
push ecx
mov byte [esp + 0x34], 5
call fcn.0057703b
add esp, 0xc
lea edx, [esp + 0x10]
lea ecx, [esp + 8]
push edx
call fcn.0057a036
mov eax, dword [esp + 0x1c]
mov ecx, edi
push eax
call fcn.0057a021
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 4
call fcn.00579c1e
jmp 0x4fe114
mov ecx, dword [esp + 0x1c]
push ecx
lea ecx, [esp + 0x10]
call fcn.0057a021
mov eax, dword [esp + 0x30]
inc esi
cmp esi, dword [eax - 8]
jl 0x4fe09f
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x18]
push edx
push eax
call fcn.00413ed7
add esp, 8
test eax, eax
pop edi
pop esi
je 0x4fe1a8
mov ecx, dword [esp]
mov edx, dword [esp + 0xc]
push ecx
push edx
call fcn.00413ed7
add esp, 8
test eax, eax
je 0x4fe1a8
lea ecx, [esp]
mov byte [esp + 0x20], 3
call fcn.00579c1e
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 2
call fcn.00579c1e
lea ecx, [esp + 4]
mov byte [esp + 0x20], 1
call fcn.00579c1e
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 0
call fcn.00579c1e
lea ecx, [esp + 0x28]
mov dword [esp + 0x20], 0xffffffff
call fcn.00579c1e
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret 4
lea ecx, [esp]
mov byte [esp + 0x20], 3
call fcn.00579c1e
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 2
call fcn.00579c1e
lea ecx, [esp + 4]
mov byte [esp + 0x20], 1
call fcn.00579c1e
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 0
call fcn.00579c1e
lea ecx, [esp + 0x28]
mov dword [esp + 0x20], 0xffffffff
call fcn.00579c1e
mov ecx, dword [esp + 0x18]
mov eax, 1
mov dword fs:[0], ecx
add esp, 0x24
ret 4
Function at 0x5030d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x59958f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x5d8b34]
push esi
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
xor ecx, ecx
xor edx, edx
mov dword [esp + 0x14], 1
mov cl, byte [eax + 0xf]
mov dl, byte [eax + 0xe]
push ecx
push edx
xor ecx, ecx
xor edx, edx
mov cl, byte [eax + 0xd]
mov dl, byte [eax + 0xc]
push ecx
push edx
xor ecx, ecx
xor edx, edx
mov cl, byte [eax + 0xb]
mov dl, byte [eax + 0xa]
push ecx
push edx
xor ecx, ecx
xor edx, edx
mov cl, byte [eax + 9]
mov dl, byte [eax + 8]
push ecx
push edx
xor ecx, ecx
xor edx, edx
mov cx, word [eax + 6]
mov dx, word [eax + 4]
mov eax, dword [eax]
push ecx
push edx
push eax
lea ecx, [esp + 0x30]
push str._08lX__04lX__04lX__02lX_02lX__02lX_02lX_02lX_02lX_02lX_02lX
push ecx
call fcn.0057703b
mov esi, dword [esp + 0x50]
add esp, 0x34
lea edx, [esp + 4]
mov ecx, esi
push edx
call fcn.00579993
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call fcn.00579c1e
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x5057f0
Capabilities:
Get user security identifier

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x14]
lea eax, [esp + 0x18]
push edi
mov edi, dword [esp + 0x1c]
lea ecx, [esp + 0xc]
xor ebx, ebx
push eax
push ecx
lea edx, [esp + 0x18]
push ebx
push edx
push ebx
push ebp
push ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ebx
mov dword [edi], ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x50583b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x50583b
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x10]
push esi
push eax
call fcn.0057985d
mov ecx, dword [esp + 0x14]
mov dword [edi], eax
lea edx, [ecx + ecx]
push edx
call fcn.0057985d
mov esi, eax
mov eax, dword [edi]
add esp, 8
test eax, eax
je 0x505880
test esi, esi
je 0x505891
lea ecx, [esp + 0x20]
lea edx, [esp + 0x10]
push ecx
push edx
lea ecx, [esp + 0x1c]
push esi
push ecx
push eax
push ebp
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov ebx, eax
test esi, esi
je 0x50588d
push esi
call fcn.00579886
add esp, 4
test ebx, ebx
jne 0x5058a0
mov edi, dword [edi]
test edi, edi
je 0x5058a0
push edi
call fcn.00579886
add esp, 4
pop esi
pop edi
mov eax, ebx
pop ebp
pop ebx
add esp, 8
ret

Function at 0x509470
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x108]
push edi
mov dword [esp + 0x14], ecx
xor edx, edx
xor eax, eax
mov al, byte [edx + str.80_]
mov ecx, eax
and eax, 7
sar ecx, 3
mov bl, byte [eax*2 + 0x5a4104]
mov cl, byte [ecx + esi]
test bl, cl
setne al
mov byte [esp + edx + 0x50], al
inc edx
cmp edx, 0x38
jl 0x509487
mov eax, 0x1e
xor ebx, ebx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x110], 1
je 0x5094c8
lea eax, [ebx + ebx]
lea edi, [esp + eax*4 + 0x8c]
lea ebp, [esp + eax*4 + 0x88]
xor eax, eax
xor ecx, ecx
mov cl, byte [ebx + 0x5a41ac]
mov dword [edi], 0
mov esi, ecx
mov dword [ebp], 0
mov edx, esi
cmp edx, 0x1c
jge 0x5094fc
mov cl, byte [esp + edx + 0x50]
jmp 0x509500
mov cl, byte [esp + edx + 0x34]
mov byte [esp + eax + 0x18], cl
inc eax
inc edx
cmp eax, 0x1c
jl 0x5094f1
mov eax, 0x1c
lea edx, [esi + 0x1c]
cmp edx, 0x38
jge 0x50951e
mov cl, byte [esp + edx + 0x50]
jmp 0x509522
mov cl, byte [esp + edx + 0x34]
mov byte [esp + eax + 0x18], cl
inc eax
inc edx
cmp eax, 0x38
jl 0x509513
xor edx, edx
mov eax, 0x5a4114
xor ecx, ecx
mov cl, byte [edx + 0x5a41bc]
cmp byte [esp + ecx + 0x18], 0
je 0x50954d
mov ecx, dword [eax]
mov esi, dword [ebp]
or esi, ecx
mov dword [ebp], esi
xor ecx, ecx
mov cl, byte [edx + 0x5a41d4]
cmp byte [esp + ecx + 0x18], 0
je 0x509564
mov ecx, dword [eax]
mov esi, dword [edi]
or esi, ecx
mov dword [edi], esi
add eax, 4
inc edx
cmp eax, str.80_
jl 0x509534
mov eax, dword [esp + 0x10]
inc ebx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x5094bb
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x88]
push edx
call fcn.005095b0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf8
ret 8
Function at 0x509d60
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5998a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esp
xor eax, eax
push 0x5efa58
lea ecx, [esi + 0x20]
mov dword [ebp - 0x14], esi
mov dword [esi + 0xc], esi
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x24], edi
call fcn.00579da7
mov eax, dword [ebp + 0xc]
lea ebx, [esi + 0x28]
push eax
mov ecx, ebx
call fcn.00579da7
mov ecx, ebx
call fcn.005772f2
mov ecx, ebx
call fcn.005771fb
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 0x30]
test eax, eax
jne 0x509df2
mov dword [esi + 0x2c], eax
mov dword [esi + 8], eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esi + 4]
push 0
push edi
mov dword [esi + 0x2c], 1
mov dword [ebp - 4], 0
call fcn.00523680
mov ecx, dword [esi + 4]
call fcn.00523870
mov ecx, dword [esi + 4]
push 0
mov dword [esi + 8], eax
call fcn.00523fa0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x513c70
Capabilities:
Get disk information

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x599c80
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [esp + 0x34]
push edi
push 0xffffffffffffffff
push 0
mov ecx, esi
call fcn.00434050
mov edi, dword [esp + 0x3c]
push 0xffffffffffffffff
push 0
mov ecx, edi
call fcn.00434050
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebp, eax
mov eax, dword [0x5f447c]
test eax, eax
je 0x513d28
cmp ebp, eax
jne 0x513d28
mov eax, dword [0x5f4480]
test eax, eax
je 0x513d28
cmp ebx, eax
jb 0x513d28
add eax, 0x493e0
cmp eax, ebx
jb 0x513d28
mov ebp, dword [0x5f4484]
push 1
inc ebp
push 0x5f4398
lea ecx, [esp + 0x18]
mov dword [0x5f4484], ebp
call fcn.00512ec0
push 0x5f43c8
mov ecx, esi
mov dword [esp + 0x34], 0
call fcn.004342a0
push 0x5f43b8
mov ecx, edi
call fcn.004342a0
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x10]
jmp 0x513d9e
push edi
push esi
mov dword [0x5f4484], 0
call fcn.005140a0
add esp, 8
lea ecx, [esp + 0x1c]
push 1
push 0x5f4398
call fcn.00512ec0
push 0xffffffffffffffff
push 0
mov ecx, 0x5f43c8
mov dword [esp + 0x38], 1
mov dword [0x5f447c], ebp
mov dword [0x5f4480], ebx
call fcn.00434050
push esi
mov ecx, 0x5f43c8
call fcn.004342a0
push 0xffffffffffffffff
push 0
mov ecx, 0x5f43b8
call fcn.00434050
push edi
mov ecx, 0x5f43b8
call fcn.004342a0
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.00512f20
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret