joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49ad7d
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
lea eax, [ebp - 0x30]
push edi
push eax
push dword [ebp + 8]
call fcn.0049a54a
mov eax, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x30]
mov dword [ebp - 0x10], eax
sub eax, ebx
mov dword [ebp - 0xc], eax
pop ecx
fild dword [ebp - 0xc]
pop ecx
mov dword [ebp - 8], ebx
fmul dword [0x627408]
fadd qword [0x6250c0]
call fcn.0044d7bc
push 1
pop esi
cmp eax, esi
mov dword [ebp - 4], esi
jl 0x49adc6
mov dword [ebp - 4], eax
fild dword [ebp - 4]
fmul dword [0x62efb0]
fadd qword [0x6250c0]
call fcn.0044d7bc
cmp eax, esi
mov edi, esi
jl 0x49ade2
mov edi, eax
push dword [ebp + 0x10]
add dword [ebp - 4], ebx
mov dword [ebp - 0xc], edi
call fcn.0059bbcd
fstp dword [ebp - 0x14]
pop ecx
call fcn.0059d186
xor ebx, ebx
mov dword [ebp - 0x18], eax
test edi, edi
jle 0x49aee9
fild dword [ebp - 0xc]
mov esi, edi
fstp qword [ebp - 0x20]
jmp 0x49ae13
mov esi, dword [ebp + 0x10]
cmp word [ebp + 0x14], 0
mov ecx, dword [ebp - 4]
je 0x49ae33
sub ecx, dword [ebp - 8]
mov eax, ecx
imul eax, ebx
cdq
idiv edi
add eax, dword [ebp - 8]
mov dword [ebp - 0x30], eax
lea eax, [ebx + 1]
jmp 0x49ae47
sub ecx, dword [ebp - 8]
lea eax, [esi - 1]
imul eax, ecx
cdq
idiv edi
add eax, dword [ebp - 8]
mov dword [ebp - 0x30], eax
mov eax, esi
imul eax, ecx
cdq
idiv edi
add eax, dword [ebp - 8]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x30]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0049a57f
mov ecx, dword [ebp - 0x10]
add esp, 0xc
cmp word [ebp + 0x14], 0
je 0x49ae85
sub ecx, dword [ebp - 4]
lea eax, [esi - 1]
imul eax, ecx
cdq
idiv edi
add eax, dword [ebp - 4]
mov dword [ebp - 0x30], eax
mov eax, esi
jmp 0x49ae99
sub ecx, dword [ebp - 4]
mov eax, ecx
imul eax, ebx
cdq
idiv edi
add eax, dword [ebp - 4]
mov dword [ebp - 0x30], eax
lea eax, [ebx + 1]
imul eax, ecx
cdq
idiv edi
add eax, dword [ebp - 4]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x30]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0049a57f
add esp, 0xc
inc ebx
mov dword [ebp - 0xc], ebx
dec esi
fild dword [ebp - 0xc]
mov dword [ebp + 0x10], esi
fmul dword [ebp - 0x14]
fmul qword [0x62efa8]
fdiv qword [ebp - 0x20]
call fcn.0044d7bc
mov esi, dword [ebp - 0x18]
sub esi, eax
call fcn.0059d186
cmp eax, esi
jbe 0x49aed8
cmp ebx, edi
jl 0x49ae10
pop edi
pop esi
pop ebx
leave
ret
Function at 0x49bc06
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
mov ebx, dword [ebp + 0x18]
imul ebx, dword [ebp + 0x1c]
mov dword [ebp - 8], ebx
push esi
fild dword [ebp - 8]
push edi
fmul qword [ebp + 0x20]
call fcn.0044d7bc
push 1
pop ecx
cmp ebx, ecx
jle 0x49bc31
shl ecx, 1
cmp ecx, ebx
jl 0x49bc2b
dec ecx
test eax, eax
mov dword [ebp + 0x24], ecx
jle 0x49bc8f
mov dword [ebp - 4], eax
call fcn.0059bd56
movsx eax, ax
and eax, dword [ebp + 0x24]
cmp eax, ebx
jl 0x49bc4f
sar eax, 1
jmp 0x49bc47
mov ecx, dword [ebp + 0x14]
mov edi, dword [ecx + eax*8]
lea esi, [ecx + eax*8]
mov eax, dword [ecx + eax*8 + 4]
mov dword [ebp - 0x10], eax
call fcn.0059bd56
movsx eax, ax
and eax, dword [ebp + 0x24]
cmp eax, ebx
jl 0x49bc72
sar eax, 1
jmp 0x49bc6a
mov ecx, dword [ebp + 0x14]
dec dword [ebp - 4]
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [esi], ecx
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [ebp - 0x10]
mov dword [eax], edi
mov dword [eax + 4], ecx
jne 0x49bc3c
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 8]
call fcn.0049a54a
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 8]
call fcn.0049a54a
mov edi, dword [ebp + 0x14]
call fcn.0059d186
push dword [ebp + 0x10]
mov dword [ebp + 0x24], eax
call fcn.0059bbcd
and dword [ebp + 0x14], 0
add esp, 0x14
fstp qword [ebp - 0x14]
test ebx, ebx
jle 0x49bd64
fild dword [ebp - 8]
fstp qword [ebp - 0xc]
mov esi, dword [ebp - 0x1c]
mov ecx, dword [edi]
sub esi, dword [ebp - 0x24]
mov eax, ecx
imul eax, esi
cdq
idiv dword [ebp + 0x18]
add eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], eax
lea eax, [ecx + 1]
imul eax, esi
cdq
idiv dword [ebp + 0x18]
mov esi, dword [ebp - 0x18]
mov ecx, dword [edi + 4]
sub esi, dword [ebp - 0x20]
add eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, ecx
imul eax, esi
cdq
idiv dword [ebp + 0x1c]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
lea eax, [ecx + 1]
imul eax, esi
cdq
idiv dword [ebp + 0x1c]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0049a57f
add esp, 0xc
inc dword [ebp + 0x14]
fild dword [ebp + 0x14]
fmul qword [ebp - 0x14]
fmul qword [0x62efa8]
fdiv qword [ebp - 0xc]
call fcn.0044d7bc
mov esi, dword [ebp + 0x24]
sub esi, eax
call fcn.0059d186
cmp eax, esi
jbe 0x49bd4f
add edi, 8
cmp dword [ebp + 0x14], ebx
jl 0x49bcd2
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4c09c4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
push 0x25
call fcn.0045d7b1
pop ecx
mov esi, dword [ebp + 8]
mov ecx, eax
and ecx, 7
mov dword [ebp - 8], ecx
mov ecx, eax
shr ecx, 3
shr eax, 7
and ecx, 0xf
and eax, 0xf
cmp word [esi + 0x104], 0
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], eax
je 0x4c0b65
cmp dword [esi + 0xdc], 0xffffffff
je 0x4c0b65
lea eax, [ebp - 0x18]
push eax
push esi
call fcn.0049e9de
push esi
call fcn.004767f2
add esp, 0xc
cmp dword [esi + 0x100], eax
jne 0x4c0b65
lea eax, [ebp - 0x20]
push eax
push esi
call fcn.00476815
mov ax, word [esi + 0xfc]
pop ecx
pop ecx
mov word [ebp - 0x3e], ax
mov cx, word [esi + 0xfe]
lea edx, [eax + 6]
cmp dx, word [ebp - 0x20]
mov word [ebp - 0x40], dx
lea edi, [ecx + 6]
lea ebx, [ecx + 0xc]
mov word [ebp - 0x34], di
mov word [ebp - 0x32], bx
mov word [ebp - 0x3c], ax
mov word [ebp - 0x30], cx
mov word [ebp - 0x3a], dx
mov word [ebp - 0x2e], di
mov word [ebp - 0x18], ax
mov word [ebp - 0x16], cx
mov word [ebp - 0x14], dx
mov word [ebp - 0x12], bx
jl 0x4c0b65
cmp ax, word [ebp - 0x1c]
jg 0x4c0b65
cmp cx, word [ebp - 0x1a]
jg 0x4c0b65
cmp bx, word [ebp - 0x1e]
jl 0x4c0b65
call fcn.004a2a75
mov eax, dword [ebp - 8]
test eax, eax
jbe 0x4c0b5d
mov dword [ebp + 8], eax
cmp dword [ebp - 4], 1
jne 0x4c0ad9
push 1
lea eax, [ebp - 0x34]
push 4
push eax
lea eax, [ebp - 0x40]
push eax
push esi
call fcn.00474f08
add esp, 0x14
jmp 0x4c0b41
cmp dword [ebp - 4], 2
jne 0x4c0b41
mov ax, word [esi + 0xfe]
mov cx, word [esi + 0xfc]
push 1
push 4
lea edi, [eax + 6]
lea ebx, [eax + 0xb]
add eax, 2
lea edx, [ecx + 5]
mov word [ebp - 8], ax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x40]
inc ecx
push eax
push esi
mov word [ebp - 0x28], dx
mov word [ebp - 0xc], di
mov word [ebp - 0x26], cx
mov word [ebp - 0xa], bx
mov word [ebp - 0x24], cx
mov word [ebp - 0x22], dx
mov word [ebp - 6], di
call fcn.00474f08
push 1
lea eax, [ebp - 0xc]
push 4
push eax
lea eax, [ebp - 0x28]
push eax
push esi
call fcn.00474f08
add esp, 0x28
call fcn.0059d186
mov edi, eax
add edi, dword [ebp - 0x10]
call fcn.0059d186
cmp eax, edi
jb 0x4c0b4b
dec dword [ebp + 8]
jne 0x4c0abc
and word [esi + 0x104], 0
pop edi
pop esi
pop ebx
leave
ret
Function at 0x51461a
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag

Disassembly:
mov eax, 0x61a868
call fcn.0044c164
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.AcroStdBase.0
lea eax, [esi + 0x84]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [eax], edi
mov dword [eax + 4], edi
lea ecx, [esi + 0x90]
mov byte [ebp - 4], 1
call fcn.005146df
lea eax, [esi + 0x10]
push 0xe
push eax
mov byte [ebp - 4], 2
mov dword [esi], vtable._t_PDPrintController.0
mov dword [esi + 4], edi
mov dword [esi + 0xc], edi
mov dword [esi + 8], edi
call fcn.0059ac37
lea eax, [esi + 0x1e]
push 0xe
push eax
call fcn.0059ac37
push 1
mov word [esi + 0x2c], di
mov word [esi + 0x2e], di
mov dword [esi + 0x38], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x3c], edi
mov word [esi + 0x4c], di
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
call fcn.00574466
mov dword [esi + 0x68], eax
lea eax, [esi + 0x70]
push 0x10
push eax
mov word [esi + 0x6c], di
call fcn.0059ac37
mov ecx, dword [ebp - 0xc]
add esp, 0x1c
mov dword [esi + 0x80], edi
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x53a962
Capabilities:
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 8], 3
jne 0x53a9a1
lea eax, [esi + 0x28]
push eax
push dword [esi + 0x20]
push dword [esi + 0x1c]
call fcn.0053a878
add esp, 0xc
test ax, ax
jne 0x53a98b
mov dword [esi + 0xc], 2
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 2
push dword [esi + 0x1c]
call edi
push 2
push dword [esi + 0x20]
call edi
pop edi
pop esi
ret

Function at 0x53ab93
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
push esi
push edi
call fcn.0057e4a4
push 0
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push 1
and dword [0x6b7010], 0
pop ebp
mov ebx, str.acroct.ini
mov edi, str.WinFntSvr
push ebx
push ebp
push str.FontResPublic
push edi
mov dword [0x6b2558], eax
mov dword [0x6b7008], ebp
mov dword [0x6b700c], ebp
call esi
push ebx
push 0
push str.T1ToTTDisabled
push edi
mov dword [0x6b7008], eax
call esi
push ebx
push ebp
push str.TTToSysDisabled
push edi
mov dword [0x6b7010], eax
call esi
push 0
push 0x564dd3
push 0
push 0x3b
mov dword [0x6b700c], eax
call fcn.004e7f9f
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x55c132
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x61f44e
call fcn.0044c164
push ecx
push ebx
mov ebx, ecx
push esi
push edi
mov dword [ebp - 0x10], ebx
mov dword [ebx], vtable.AcroStdBase.0
mov esi, dword [ebp + 8]
and dword [ebp - 4], 0
lea ecx, [ebx + 4]
lea edi, [esi + 4]
push edi
call fcn.00534586
mov eax, dword [edi + 4]
mov dword [ebx + 8], eax
lea eax, [esi + 0xc]
lea ecx, [ebx + 0xc]
push eax
mov byte [ebp - 4], 1
call fcn.00542ce4
push 6
add esi, 0x14
lea edi, [ebx + 0x14]
pop ecx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 8]
lea ecx, [ebx + 0x2c]
mov byte [ebp - 4], 2
lea edi, [esi + 0x2c]
push edi
call fcn.00534586
mov eax, dword [edi + 4]
add esi, 0x40
mov dword [ebx + 0x30], eax
mov eax, dword [esi - 0xc]
mov dword [ebx + 0x34], eax
mov eax, dword [esi - 8]
mov dword [ebx + 0x38], eax
mov al, byte [esi - 4]
lea edi, [ebx + 0x40]
mov byte [ebx + 0x3c], al
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0xc]
mov eax, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
mov dword [ebx], vtable.CommonShadingInfo.0
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x563ab7
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
mov eax, dword [0x6b2700]
test eax, eax
je 0x563adb
push 0
push 0x563c55
push eax
call fcn.005a4ccf
push dword [0x6b2700]
call fcn.005a4d16
add esp, 0x10
mov eax, dword [0x6b2704]
and dword [0x6b2700], 0
test eax, eax
je 0x563af2
push eax
call fcn.005a4d16
pop ecx
and dword [0x6b2704], 0
call fcn.00563d9c
test ax, ax
je 0x563b08
jmp fcn.00563b09
ret
Function at 0x56408b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x37c
push esi
lea eax, [ebp - 0x23c]
push edi
push eax
push 0x104
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x564117
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x138]
push str._sFOR.
push eax
call fcn.005932e4
mov esi, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
add esp, 0xc
lea eax, [ebp - 0x37c]
push eax
lea eax, [ebp - 0x138]
push eax
call esi
cmp eax, 0xffffffff
jne 0x564114
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x138]
push str._sZTR.
push eax
call fcn.005932e4
add esp, 0xc
lea eax, [ebp - 0x37c]
push eax
lea eax, [ebp - 0x138]
push eax
call esi
cmp eax, 0xffffffff
je 0x564117
push 1
pop edi
mov ax, di
pop edi
pop esi
leave
ret
Function at 0x5657a1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xdc
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
push eax
mov dword [ebp + 0xc], eax
push dword [ebp + 8]
lea eax, [ebp - 0x78]
lea esi, [ebp - 0x78]
lea edi, [ebp - 0xdc]
push eax
call fcn.0059acbb
xor ebx, ebx
add esp, 0xc
cmp word [ebp + 0x24], bx
je 0x56583c
push dword [ebp + 0x1c]
lea eax, [ebp - 0x14]
push dword [ebp + 0x18]
push eax
call fcn.0059acbb
add esp, 0xc
push dword [ebp + 0x1c]
lea eax, [ebp - 0x14]
push dword [ebp + 0x18]
push eax
call fcn.0059acbb
xor eax, eax
add esp, 0xc
cmp ebx, eax
je 0x56580d
cmp dword [ebp + 0x1c], eax
jle 0x56580d
xor byte [ebp + eax - 0x14], bl
inc eax
cmp eax, dword [ebp + 0x1c]
jl 0x565803
push dword [ebp + 0x20]
lea eax, [ebp - 0x14]
push dword [ebp + 0x1c]
push eax
lea eax, [ebp + 8]
push eax
push edi
push dword [ebp + 0xc]
push esi
call fcn.004e032a
mov eax, esi
add esp, 0x1c
mov esi, edi
mov edi, eax
mov eax, dword [ebp + 8]
inc ebx
cmp ebx, 0x14
mov dword [ebp + 0xc], eax
jl 0x5657e6
jmp 0x565890
push 0x13
pop ebx
push dword [ebp + 0x1c]
lea eax, [ebp - 0x14]
push dword [ebp + 0x18]
push eax
call fcn.0059acbb
xor eax, eax
add esp, 0xc
cmp ebx, eax
je 0x565866
cmp dword [ebp + 0x1c], eax
jle 0x565866
xor byte [ebp + eax - 0x14], bl
inc eax
cmp eax, dword [ebp + 0x1c]
jl 0x56585c
push dword [ebp + 0x20]
lea eax, [ebp - 0x14]
push dword [ebp + 0x1c]
push eax
lea eax, [ebp + 8]
push eax
push edi
push dword [ebp + 0xc]
push esi
call fcn.004e0397
mov eax, esi
mov esi, edi
mov edi, eax
mov eax, dword [ebp + 8]
add esp, 0x1c
dec ebx
mov dword [ebp + 0xc], eax
jns 0x56583f
push eax
push esi
push dword [ebp + 0x10]
call fcn.0059acbb
mov eax, dword [ebp + 0x14]
add esp, 0xc
test eax, eax
pop edi
pop esi
pop ebx
je 0x5658ac
mov ecx, dword [ebp + 0xc]
mov dword [eax], ecx
leave
ret
Function at 0x598ea2
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
push esi
push edi
mov esi, 0x692e18
lea edi, [ebp - 0x58]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov byte [ebp - 0x54], 0x43
movsx eax, byte [ebp - 0x54]
test eax, eax
je 0x598ff3
mov al, byte [ebp - 0x54]
mov byte [ebp - 0x58], al
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 4
jne 0x598fd9
mov al, byte [ebp - 0x54]
mov byte [ebp - 0x58], al
mov dword [ebp - 0x5c], 0x50
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x58]
push eax
call sub.MPR.dll_WNetGetConnectionA
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jne 0x598fd9
lea eax, [ebp - 0x50]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x70]
movsx eax, byte [eax]
cmp eax, 0x5c
jne 0x598f23
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
jmp 0x598f0f
push 0x692e14
push dword [ebp - 0x70]
call fcn.00593244
pop ecx
pop ecx
mov dword [ebp - 0x6c], eax
push 0x3a
push dword [ebp - 0x70]
call fcn.0059320c
pop ecx
pop ecx
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x6c], 0
je 0x598f52
mov eax, dword [ebp - 0x6c]
and byte [eax], 0
jmp 0x598f5e
cmp dword [ebp - 0x64], 0
je 0x598f5e
mov eax, dword [ebp - 0x64]
and byte [eax], 0
push dword [ebp - 0x70]
call fcn.00598ff9
pop ecx
push dword [ebp - 0x70]
mov eax, dword [ebp + 8]
inc eax
push eax
call fcn.00593244
pop ecx
pop ecx
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
je 0x598fd9
mov eax, dword [ebp + 8]
inc eax
cmp dword [ebp - 0x68], eax
jne 0x598fd9
push dword [ebp + 8]
call fcn.005931a2
pop ecx
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
je 0x598fd9
mov eax, dword [ebp + 8]
mov byte [eax], 0x2f
mov eax, dword [ebp + 8]
mov cl, byte [ebp - 0x54]
mov byte [eax + 1], cl
mov eax, dword [ebp + 8]
and byte [eax + 2], 0
push dword [ebp - 0x70]
call fcn.00593008
pop ecx
mov ecx, dword [ebp - 0x74]
lea eax, [ecx + eax + 1]
push eax
push dword [ebp + 8]
call fcn.00593265
pop ecx
pop ecx
push dword [ebp - 0x74]
call fcn.00593542
pop ecx
push 1
pop eax
jmp 0x598ff5
mov al, byte [ebp - 0x54]
add al, 1
mov byte [ebp - 0x54], al
movsx eax, byte [ebp - 0x54]
cmp eax, 0x5a
jle 0x598fee
and byte [ebp - 0x54], 0
jmp 0x598eb9
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x5990be
Capabilities:
Connect network resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
cmp dword [ebp + 8], 0
je 0x599196
and dword [ebp - 0x28], 0
push 0x20
lea eax, [ebp - 0x20]
push eax
call fcn.0059ac37
pop ecx
pop ecx
mov dword [ebp - 0x1c], 1
lea eax, [ebp - 0x12c]
mov dword [ebp - 0xc], eax
push 0x692e10
lea eax, [ebp - 0x12c]
push eax
call fcn.0059301d
pop ecx
pop ecx
lea eax, [ebp - 0x12c]
push eax
call fcn.00593008
pop ecx
lea eax, [ebp + eax - 0x12c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
movsx eax, byte [eax]
test eax, eax
je 0x59916b
mov eax, dword [ebp + 8]
movsx eax, byte [eax]
cmp eax, 0x2f
jne 0x599147
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jne 0x599147
jmp 0x59916b
lea eax, [ebp - 0x29]
cmp dword [ebp - 0x24], eax
jne 0x599151
jmp 0x59916b
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + 8]
mov cl, byte [ecx]
mov byte [eax], cl
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp + 8], eax
jmp 0x599123
mov eax, dword [ebp - 0x24]
and byte [eax], 0
lea eax, [ebp - 0x12c]
push eax
call fcn.0059919a
pop ecx
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call sub.MPR.dll_WNetAddConnection2A
test eax, eax
jne 0x599196
push 1
pop eax
jmp 0x599198
xor eax, eax
leave
ret
Function at 0x5991e1
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
or dword [ebp - 8], 0xffffffff
mov dword [ebp - 0x1c], 0x640
and dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
movsx eax, byte [eax]
push eax
call fcn.0044d620
pop ecx
mov byte [ebp - 0x14], al
movsx eax, byte [ebp - 0x14]
cmp eax, 0x41
jl 0x599219
movsx eax, byte [ebp - 0x14]
cmp eax, 0x5a
jle 0x599220
xor eax, eax
jmp 0x599373
mov eax, dword [ebp + 0xc]
movsx eax, byte [eax + 1]
cmp eax, 0x3a
jne 0x599238
mov eax, dword [ebp + 0xc]
movsx eax, byte [eax + 2]
cmp eax, 0x5c
je 0x59923f
xor eax, eax
jmp 0x599373
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 1
push 1
call sub.MPR.dll_WNetOpenEnumA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x599260
xor eax, eax
jmp 0x599373
push dword [ebp - 0x1c]
call fcn.0044e6f5
pop ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x599277
jmp 0x599359
push 1
pop eax
test eax, eax
je 0x599359
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x18]
call sub.MPR.dll_WNetEnumResourceA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xea
jne 0x5992d6
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x1c]
push dword [ebp - 0x10]
call fcn.0044e455
pop ecx
pop ecx
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x5992ce
jmp 0x599359
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x10], eax
jmp 0x599277
cmp dword [ebp - 0xc], 0
je 0x5992de
jmp 0x599359
and dword [ebp - 0x24], 0
jmp 0x5992eb
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x20]
jge 0x599354
mov eax, dword [ebp - 0x24]
shl eax, 5
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + eax + 0x10], 0
je 0x599352
movsx esi, byte [ebp - 0x14]
mov eax, dword [ebp - 0x24]
shl eax, 5
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx + eax + 0x10]
movsx eax, byte [eax]
push eax
call fcn.0044d620
pop ecx
cmp esi, eax
jne 0x599352
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x24]
shl eax, 5
mov ecx, dword [ebp - 0x10]
push dword [ecx + eax + 0x14]
push dword [ebp + 8]
call fcn.0044bca0
pop ecx
pop ecx
mov eax, dword [ebp + 0xc]
inc eax
inc eax
push eax
push dword [ebp + 8]
call fcn.0044bcb0
pop ecx
pop ecx
jmp 0x599359
jmp 0x5992e4
jmp 0x599277
push dword [ebp - 0x18]
call sub.MPR.dll_WNetCloseEnum
cmp dword [ebp - 0x10], 0
je 0x599370
push dword [ebp - 0x10]
call fcn.0044dbbe
pop ecx
mov eax, dword [ebp - 4]
pop esi
leave
ret
Function at 0x599e02
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x599e94
test byte [ebp + 0xc], 4
je 0x599e20
mov eax, 0xc0000000
xor ecx, ecx
push 2
jmp 0x599e53
test byte [ebp + 0xc], 2
je 0x599e43
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 1
je 0x599e3a
mov eax, 0x400a0010
pop ebp
ret
mov eax, 0xc0000000
xor ecx, ecx
jmp 0x599e51
push 1
pop ecx
cmp word [ebp + 0xc], cx
jne 0x599e56
mov eax, Ordinal_3
push 3
pop edx
jmp 0x599e5f
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0xc]
push 0
push 0x10000080
push edx
push 0
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x599e8b
call dword [sym.imp.KERNEL32.dll_GetLastError]
and eax, 0xffff
or eax, 0x400d0000
pop ebp
ret
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 0x10]
and dword [eax], 0
mov eax, 0x400a0001
pop ebp
ret
Function at 0x59a0e1
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x440
push esi
lea eax, [ebp - 0x140]
push 0x100
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_OpenFile]
cmp eax, 0xffffffff
je 0x59a247
lea eax, [ebp - 0x340]
and byte [ebp + 8], 0
push eax
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x440]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x138]
push eax
call fcn.0044d458
add esp, 0x14
lea eax, [ebp + 8]
push 1
push eax
lea eax, [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_OemToCharBuffA]
lea eax, [ebp + 8]
push 1
push eax
call dword [sym.imp.USER32.dll_CharUpperBuffA]
lea eax, [ebp + 8]
push 1
push eax
lea eax, [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_CharToOemBuffA]
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0044bca0
lea eax, [ebp - 8]
push 0x66d34c
push eax
call fcn.0044bcb0
add esp, 0x10
lea eax, [ebp - 0xb8]
mov dword [ebp - 0xb8], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x59a247
cmp dword [ebp - 0xa8], 1
jne 0x59a1e9
mov eax, dword [ebp - 0xac]
and eax, 0xffff
cmp eax, 0x3e8
ja 0x59a1e9
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x59a247
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 0x10]
imul eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x18]
mov dword [ecx], eax
jmp 0x59a23a
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x59a247
push str.GetDiskFreeSpaceExA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x59a240
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 8]
push ecx
call eax
test eax, eax
je 0x59a240
cmp dword [ebp - 0xc], 0
mov eax, dword [ebp + 0x10]
jbe 0x59a22e
or dword [eax], 0xffffffff
jmp 0x59a233
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ax, 1
jmp 0x59a24a
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor ax, ax
pop esi
leave
ret