joyce8/EMBER2024-capa huggingface dataset:
Function at 0x57eb58
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], edx
mov ebx, eax
push 0
push 0
push 0
push 0
push 0x57ebe8
call sub.wininet.dll_InternetOpenA
mov edi, eax
push 0
push 0
push 0
push 0
mov eax, ebx
call fcn.00404fb0
push eax
push edi
call sub.wininet.dll_InternetOpenUrlA
mov ebx, eax
mov dword [esp + 4], 0x400
lea eax, [esp + 8]
push eax
lea eax, [esp + 8]
push eax
push esi
push 5
push ebx
call sub.wininet.dll_HttpQueryInfoA
mov eax, ebp
call fcn.00402794
mov esi, eax
lea eax, [esp + 0xc]
push eax
push ebp
push esi
push ebx
call sub.wininet.dll_InternetReadFile
push ebx
call sub.wininet.dll_InternetCloseHandle
push edi
call sub.wininet.dll_InternetCloseHandle
mov edx, dword [esp]
mov eax, esi
call fcn.0040a6d0
mov eax, esi
call fcn.004027b4
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x57eb6a
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], edx
mov ebx, eax
push 0
push 0
push 0
push 0
push 0x57ebe8
call sub.wininet.dll_InternetOpenA
mov edi, eax
push 0
push 0
push 0
push 0
mov eax, ebx
call fcn.00404fb0
push eax
push edi
call sub.wininet.dll_InternetOpenUrlA
mov ebx, eax
mov dword [esp + 4], 0x400
lea eax, [esp + 8]
push eax
lea eax, [esp + 8]
push eax
push esi
push 5
push ebx
call sub.wininet.dll_HttpQueryInfoA
mov eax, ebp
call fcn.00402794
mov esi, eax
lea eax, [esp + 0xc]
push eax
push ebp
push esi
push ebx
call sub.wininet.dll_InternetReadFile
push ebx
call sub.wininet.dll_InternetCloseHandle
push edi
call sub.wininet.dll_InternetCloseHandle
mov edx, dword [esp]
mov eax, esi
call fcn.0040a6d0
mov eax, esi
call fcn.004027b4
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x59e404
Capabilities:
Set socket configuration

Disassembly:
push ebx
push esi
push ecx
mov ebx, eax
test byte [ebx + 0x1c], 0x10
jne 0x59e41d
test byte [ebx + 0x1c], 2
je 0x59e41d
mov byte [ebx + 0x8068], dl
jmp 0x59e48d
cmp dword [ebx + 0x805c], 0xffffffff
jne 0x59e42e
mov byte [ebx + 0x8068], dl
jmp 0x59e486
xor esi, esi
mov eax, edx
mov byte [ebx + 0x8068], al
test al, al
je 0x59e46b
xor eax, eax
mov dword [esp], eax
push esi
push 0x448
mov eax, dword [ebx + 0x30]
push eax
mov eax, dword [ebx + 0x805c]
push eax
call sub.wsock32.dll_WSAAsyncSelect
push esp
push 0x8004667e
mov eax, dword [ebx + 0x805c]
push eax
call sub.wsock32.dll_ioctlsocket
jmp 0x59e486
mov esi, 0x33
push esi
push 0x448
mov eax, dword [ebx + 0x30]
push eax
mov eax, dword [ebx + 0x805c]
push eax
call sub.wsock32.dll_WSAAsyncSelect
mov eax, ebx
call fcn.0059e328
pop edx
pop esi
pop ebx
ret

Function at 0x59ecfc
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov byte [esp], dl
mov ebx, eax
test byte [ebx + 0x1c], 0x10
je 0x59ed19
mov al, byte [esp]
mov byte [ebx + 0x40], al
jmp 0x59ee69
test byte [ebx + 0x1c], 2
je 0x59ed2a
mov al, byte [esp]
mov byte [ebx + 0x40], al
jmp 0x59ee69
mov al, byte [ebx + 0x40]
cmp dword [ebx + 0x3c], 0xffffffff
je 0x59ed51
test al, al
jne 0x59ed51
mov byte [ebx + 0x40], 0
mov ecx, 0x59ee7c
mov dl, 1
mov eax, dword [0x59ddc4]
call fcn.0040d67c
call fcn.00404488
mov dl, byte [esp]
mov byte [ebx + 0x40], dl
test dl, dl
je 0x59ee13
test al, al
jne 0x59ee62
mov byte [ebx + 0x40], 0
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov dword [ebx + 0x3c], eax
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0x10
call fcn.00403374
mov word [esp + 4], 2
mov edx, dword [ebx + 0x38]
mov eax, ebx
call fcn.0059f0d8
mov word [esp + 6], ax
push 0
call sub.wsock32.dll_htonl
mov dword [esp + 8], eax
push 8
push 0x448
mov eax, dword [ebx + 0x30]
push eax
mov eax, dword [ebx + 0x3c]
push eax
call sub.wsock32.dll_WSAAsyncSelect
push 0x10
lea eax, [esp + 8]
push eax
mov eax, dword [ebx + 0x3c]
push eax
call sub.wsock32.dll_bind
test eax, eax
je 0x59ede8
mov ecx, 0x59eea4
mov dl, 1
mov eax, dword [0x59ddc4]
call fcn.0040d67c
call fcn.00404488
push 5
mov eax, dword [ebx + 0x3c]
push eax
call sub.wsock32.dll_listen
test eax, eax
je 0x59ee0d
mov ecx, 0x59eecc
mov dl, 1
mov eax, dword [0x59ddc4]
call fcn.0040d67c
call fcn.00404488
mov byte [ebx + 0x40], 1
jmp 0x59ee62
mov eax, dword [ebx + 0x34]
call fcn.0041aefc
mov ebp, eax
mov esi, dword [ebp + 8]
dec esi
test esi, esi
jl 0x59ee3f
inc esi
xor edi, edi
mov edx, edi
mov eax, ebp
call fcn.0041a79c
mov eax, dword [eax + 0x44]
mov byte [eax + 0x8090], 1
inc edi
dec esi
jne 0x59ee28
mov eax, dword [ebx + 0x34]
call fcn.0041af60
jmp 0x59ee50
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, ebx
call fcn.0059ecb4
test eax, eax
jg 0x59ee49
mov eax, ebx
call fcn.0059ecd0
mov eax, ebx
call fcn.0059e328
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5a3848
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404fa0
xor eax, eax
push ebp
push 0x5a3942
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
push 0x20
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x41864c]
call fcn.0041d85c
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x5a3925
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xe]
mov ecx, 2
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0xc]
cmp word [ebp - 0xe], 0x5a4d
je 0x5a38b0
call fcn.00404534
jmp 0x5a392c
xor ecx, ecx
mov edx, 0x3c
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0x14]
lea edx, [ebp - 0xe]
mov ecx, 2
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0xc]
movzx edx, word [ebp - 0xe]
xor ecx, ecx
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0x14]
lea edx, [ebp - 0xe]
mov ecx, 2
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0xc]
cmp word [ebp - 0xe], 0x4550
je 0x5a3901
cmp word [ebp - 0xe], 0x454e
je 0x5a3901
xor eax, eax
jmp 0x5a3903
mov al, 1
mov byte [ebp - 5], al
cmp word [ebp - 0xe], 0x4550
sete byte [ebx]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a392c
mov eax, dword [ebp - 0xc]
call fcn.00403cbc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a3949
lea eax, [ebp - 4]
call fcn.00404af0
ret
Function at 0x5a3dac
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
mov dword [ebp - 4], eax
mov dl, 1
mov eax, dword [0x41873c]
call fcn.00403c8c
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x1c], ebx
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp - 0x14]
call fcn.0041db28
mov eax, dword [ebp - 4]
movzx eax, word [eax + 6]
mov edx, eax
shl edx, 2
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [ebp - 4]
movzx eax, word [eax + 6]
test eax, eax
jle 0x5a3ec6
mov dword [ebp - 0x18], eax
mov dword [ebp - 8], 1
mov eax, dword [ebp - 8]
mov edx, eax
shl eax, 3
sub eax, edx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x14]
lea ebx, [edx + eax*2 - 0xe]
movzx eax, word [ebx + 0xc]
push eax
push 3
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x18]
mov dl, 1
mov eax, dword [0x418840]
call fcn.0041de30
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x5a3eb3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
call fcn.0041d344
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
dec eax
shl eax, 2
cdq
push edx
push eax
mov eax, dword [ebp - 0x14]
call fcn.0041d364
lea edx, [ebp - 0x10]
mov ecx, 4
mov eax, dword [ebp - 0x14]
mov esi, dword [eax]
call dword [esi + 0x10]
mov eax, dword [ebp - 0x10]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x14]
call fcn.0041d364
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx]
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call fcn.0041d5e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a3eba
mov eax, dword [ebp - 0xc]
call fcn.00403cbc
ret
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5a52d4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404fa0
xor eax, eax
push ebp
push 0x5a5353
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0
push 0
push 2
push 0
push 1
push 0xc0000000
mov eax, dword [ebp - 4]
call fcn.00404fb0
push eax
call sub.kernel32.dll_CreateFileA_1
mov esi, eax
cmp esi, 0xffffffff
je 0x5a533d
push 0
lea eax, [ebp - 8]
push eax
push 0x42600
push 0x5e9420
push esi
call sub.kernel32.dll_WriteFile_1
test eax, eax
je 0x5a5337
mov bl, 1
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a535a
lea eax, [ebp - 4]
call fcn.00404af0
ret
Function at 0x5a57c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor esi, esi
mov edi, 0x12
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x1048]
lea eax, [esi + 1]
xor edx, edx
div dword [ebp - 8]
mov eax, dword [ebp - 4]
xor ebx, ebx
mov bl, byte [eax + edx]
shl ebx, 0x10
mov eax, dword [ebp - 4]
movzx eax, byte [eax + esi]
shl eax, 0x18
add ebx, eax
lea eax, [esi + 2]
xor edx, edx
div dword [ebp - 8]
mov eax, dword [ebp - 4]
movzx eax, byte [eax + edx]
shl eax, 8
add ebx, eax
lea eax, [esi + 3]
xor edx, edx
div dword [ebp - 8]
mov eax, dword [ebp - 4]
movzx eax, byte [eax + edx]
add ebx, eax
xor dword [ecx], ebx
lea eax, [esi + 4]
xor edx, edx
div dword [ebp - 8]
mov esi, edx
add ecx, 4
dec edi
jne 0x5a57df
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor edi, edi
mov eax, dword [ebp + 8]
push eax
push 1
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x1048]
lea edx, [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.005a5400
pop ecx
mov eax, edi
add eax, eax
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [edx + eax*4 - 0x1048], ecx
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
mov dword [edx + eax*4 - 0x1044], ecx
inc edi
cmp edi, 9
jne 0x5a5841
mov edi, 4
mov eax, dword [ebp + 8]
lea ebx, [eax - 0x1000]
xor esi, esi
mov eax, dword [ebp + 8]
push eax
push 1
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x1048]
lea edx, [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.005a5400
pop ecx
mov eax, esi
add eax, eax
mov edx, dword [ebp - 0xc]
mov dword [ebx + eax*4], edx
mov edx, dword [ebp - 0x10]
mov dword [ebx + eax*4 + 4], edx
inc esi
cmp esi, 0x80
jne 0x5a5890
add ebx, 0x400
dec edi
jne 0x5a588e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5a58d8
Capabilities:
Encrypt data using blowfish

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffffa0
push ebx
push esi
push edi
mov byte [ebp - 0x1049], cl
mov edi, edx
mov ebx, eax
mov eax, dword [ebp + 0x14]
call fcn.00404fa0
lea esi, [ebp - 0x1058]
xor eax, eax
push ebp
push 0x5a5ab9
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
push edi
mov esi, 0x62ba20
lea edi, [ebp - 0x1048]
mov ecx, 0x12
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
mov esi, 0x62ba68
lea edi, [ebp - 0x1000]
mov ecx, 0x400
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push ebp
mov eax, dword [ebp + 0x14]
call fcn.00404db0
push eax
mov eax, dword [ebp + 0x14]
call fcn.00404fb0
pop edx
call fcn.005a57c0
pop ecx
cmp byte [ebp - 0x1049], 0
je 0x5a5974
lea eax, [ebp - 0x1048]
mov dword [ebp - 0x1050], eax
mov dword [ebp - 0x1054], 1
jmp 0x5a598a
lea eax, [ebp - 0x1004]
mov dword [ebp - 0x1050], eax
mov dword [ebp - 0x1054], 0xffffffff
shr edi, 3
dec edi
test edi, edi
jl 0x5a5aa3
inc edi
mov dword [ebp - 0x1060], edi
cmp dword [ebp + 0x10], 0
jne 0x5a59a7
cmp dword [ebp + 0xc], 0
je 0x5a5a23
mov dword [esi], 7
lea eax, [ebp + 0xc]
add eax, dword [esi]
mov dl, byte [eax]
inc edx
and dl, 0xff
mov byte [eax], dl
lea eax, [ebp + 0xc]
add eax, dword [esi]
cmp byte [eax], 0
jne 0x5a59cd
dec dword [esi]
cmp dword [esi], 0xffffffff
jne 0x5a59af
lea eax, [ebp + 0xc]
mov eax, dword [eax]
call fcn.005a53d4
mov dword [esi], eax
lea eax, [ebp + 0xc]
add eax, 4
mov eax, dword [eax]
call fcn.005a53d4
mov dword [ebp - 0x105c], eax
push ebp
mov eax, dword [ebp - 0x1054]
push eax
lea edx, [ebp - 0x105c]
mov eax, esi
mov ecx, dword [ebp - 0x1050]
call fcn.005a5400
pop ecx
mov eax, dword [esi]
call fcn.005a53d4
xor dword [ebx], eax
mov eax, dword [ebp - 0x105c]
call fcn.005a53d4
lea edx, [ebx + 4]
xor dword [edx], eax
jmp 0x5a5a94
cmp byte [ebp + 8], 0
jne 0x5a5a7b
mov edi, ebx
mov eax, dword [edi]
call fcn.005a53d4
mov dword [esi], eax
lea eax, [ebx + 4]
mov eax, dword [eax]
call fcn.005a53d4
mov dword [ebp - 0x105c], eax
push ebp
mov eax, dword [ebp - 0x1054]
push eax
lea edx, [ebp - 0x105c]
mov eax, esi
mov ecx, dword [ebp - 0x1050]
call fcn.005a5400
pop ecx
mov eax, dword [esi]
call fcn.005a53d4
mov dword [edi], eax
mov eax, dword [ebp - 0x105c]
call fcn.005a53d4
lea edx, [ebx + 4]
mov dword [edx], eax
jmp 0x5a5a94
push ebp
mov eax, dword [ebp - 0x1054]
push eax
mov edx, ebx
lea eax, [ebx + 4]
mov ecx, dword [ebp - 0x1050]
call fcn.005a5400
pop ecx
add ebx, 8
dec dword [ebp - 0x1060]
jne 0x5a599d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a5ac0
lea eax, [ebp + 0x14]
call fcn.00404af0
ret
Function at 0x5a5b68
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404fa0
xor eax, eax
push ebp
push 0x5a5be7
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0
push 0
push 2
push 0
push 1
push 0xc0000000
mov eax, dword [ebp - 4]
call fcn.00404fb0
push eax
call sub.kernel32.dll_CreateFileA_1
mov esi, eax
cmp esi, 0xffffffff
je 0x5a5bd1
push 0
lea eax, [ebp - 8]
push eax
push 0x6800
push 0x62ca68
push esi
call sub.kernel32.dll_WriteFile_1
test eax, eax
je 0x5a5bcb
mov bl, 1
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a5bee
lea eax, [ebp - 4]
call fcn.00404af0
ret
Function at 0x5ac7b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5ac8d6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov bl, 1
mov byte [ebp - 0xd], 0
mov esi, ecx
dec esi
test esi, esi
jl 0x5ac8bb
inc esi
xor edi, edi
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
mov dl, byte [edx + edi]
call fcn.00404cd8
mov eax, dword [ebp - 0x14]
mov edx, 0x5ac8f4
call fcn.004050f4
test eax, eax
je 0x5ac8b3
mov eax, dword [ebp - 4]
mov al, byte [eax + edi]
call fcn.00402c4c
mov byte [ebp - 0xe], al
test bl, bl
je 0x5ac84f
lea eax, [ebp - 0x18]
mov dl, byte [ebp - 0xe]
call fcn.00404cd8
mov eax, dword [ebp - 0x18]
mov edx, 0x5ac920
call fcn.004050f4
dec eax
shl eax, 4
mov byte [ebp - 0xd], al
jmp 0x5ac86d
lea eax, [ebp - 0x1c]
mov dl, byte [ebp - 0xe]
call fcn.00404cd8
mov eax, dword [ebp - 0x1c]
push eax
mov edx, 0x5ac920
pop eax
call fcn.004050f4
dec eax
or byte [ebp - 0xd], al
xor bl, 1
test bl, bl
je 0x5ac8b3
cmp byte [ebp + 0xc], 0
je 0x5ac8a0
mov al, byte [ebp - 0xd]
and al, 0xf
shl eax, 4
mov dl, byte [ebp - 0xd]
and dl, 0xf0
and edx, 0xff
shr edx, 4
or al, dl
mov edx, dword [ebp + 8]
mov edx, dword [edx]
mov ecx, dword [ebp - 8]
mov byte [ecx + edx], al
jmp 0x5ac8ae
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov cl, byte [ebp - 0xd]
mov byte [edx + eax], cl
mov eax, dword [ebp + 8]
inc dword [eax]
inc edi
dec esi
jne 0x5ac7f9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ac8dd
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00404b14
ret

Function at 0x5bea08
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe88
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
call fcn.00404fa0
xor eax, eax
push ebp
push 0x5beb10
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x178], 0x46464952
mov dword [ebp - 0x174], 0x24
mov dword [ebp - 0x170], 0x45564157
mov dword [ebp - 0x16c], 0x20746d66
mov dword [ebp - 0x168], 0x10
mov word [ebp - 0x164], 1
mov word [ebp - 0x162], bx
mov dword [ebp - 0x160], edi
movzx edx, bx
imul edx, edi
movzx eax, si
shr eax, 3
imul edx, eax
mov dword [ebp - 0x15c], edx
imul bx
mov word [ebp - 0x158], ax
mov word [ebp - 0x156], si
mov dword [ebp - 0x154], 0x61746164
xor eax, eax
mov dword [ebp - 0x150], eax
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x14c]
call fcn.00402fe0
mov edx, 0x2c
lea eax, [ebp - 0x14c]
call fcn.004034d4
call fcn.004028fc
lea edx, [ebp - 0x178]
lea eax, [ebp - 0x14c]
call fcn.004035e8
call fcn.004028fc
lea eax, [ebp - 0x14c]
call fcn.00403184
call fcn.004028fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5beb17
lea eax, [ebp + 8]
call fcn.00404af0
ret
Function at 0x5c5ddc
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5c5f31
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 0x43
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.005c5d60
test al, al
je 0x5c5f0c
mov byte [ebp - 7], bl
mov byte [ebp - 6], 0x3a
mov byte [ebp - 5], 0
lea eax, [ebp - 7]
push eax
call sub.kernel32.dll_GetDriveTypeA
mov esi, eax
cmp esi, 2
jne 0x5c5e4f
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.00404cd8
lea eax, [ebp - 0xc]
mov edx, 0x5c5f48
call fcn.00404db8
mov edx, dword [ebp - 0xc]
mov eax, dword [edi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
cmp esi, 3
jne 0x5c5e75
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00404cd8
lea eax, [ebp - 0x10]
mov edx, 0x5c5f54
call fcn.00404db8
mov edx, dword [ebp - 0x10]
mov eax, dword [edi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
cmp esi, 4
jne 0x5c5e9b
lea eax, [ebp - 0x14]
mov edx, ebx
call fcn.00404cd8
lea eax, [ebp - 0x14]
mov edx, 0x5c5f60
call fcn.00404db8
mov edx, dword [ebp - 0x14]
mov eax, dword [edi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
cmp esi, 5
jne 0x5c5ec1
lea eax, [ebp - 0x18]
mov edx, ebx
call fcn.00404cd8
lea eax, [ebp - 0x18]
mov edx, 0x5c5f6c
call fcn.00404db8
mov edx, dword [ebp - 0x18]
mov eax, dword [edi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
cmp esi, 6
jne 0x5c5ee7
lea eax, [ebp - 0x1c]
mov edx, ebx
call fcn.00404cd8
lea eax, [ebp - 0x1c]
mov edx, 0x5c5f48
call fcn.00404db8
mov edx, dword [ebp - 0x1c]
mov eax, dword [edi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
test esi, esi
jne 0x5c5f0c
lea eax, [ebp - 0x20]
mov edx, ebx
call fcn.00404cd8
lea eax, [ebp - 0x20]
mov edx, 0x5c5f48
call fcn.00404db8
mov edx, dword [ebp - 0x20]
mov eax, dword [edi]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc ebx
cmp bl, 0x5b
jne 0x5c5e01
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c5f38
lea eax, [ebp - 0x20]
mov edx, 6
call fcn.00404b14
ret
Function at 0x5c93d8
Capabilities:
Copy file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd98
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x268], ebx
mov dword [ebp - 0x264], ebx
mov dword [ebp - 0x25c], ebx
mov dword [ebp - 0x260], ebx
mov dword [ebp - 0x258], ebx
mov dword [ebp - 0x254], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404fa0
mov eax, dword [ebp - 8]
call fcn.00404fa0
xor eax, eax
push ebp
push 0x5c963e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x254]
call fcn.0040a47c
mov edx, dword [ebp - 0x254]
lea eax, [ebp - 0x110]
mov ecx, 0xff
call fcn.00404d8c
mov eax, dword [ebp - 4]
call fcn.00402938
call fcn.004028fc
lea eax, [ebp - 0x250]
push eax
push 0x5c9650
call sub.kernel32.dll_FindFirstFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x5c95cb
mov eax, dword [ebp - 8]
call fcn.004b40ec
test al, al
jne 0x5c9493
mov eax, dword [ebp - 8]
call fcn.004b40f4
lea eax, [ebp - 0x10]
lea edx, [ebp - 0x224]
mov ecx, 0x104
call fcn.00404d60
mov eax, dword [ebp - 0x10]
mov edx, 0x5c965c
call fcn.00404efc
je 0x5c95ae
mov eax, dword [ebp - 0x10]
mov edx, 0x5c9668
call fcn.00404efc
je 0x5c95ae
cmp dword [ebp - 0x250], 0x10
jne 0x5c957d
push dword [ebp - 8]
push 0x5c9674
push dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404e70
mov eax, dword [ebp - 0xc]
call fcn.004b40ec
test al, al
jne 0x5c9505
mov eax, dword [ebp - 0xc]
call fcn.004b40f4
mov eax, dword [ebp - 4]
call fcn.00404db0
mov edx, dword [ebp - 4]
cmp byte [edx + eax - 1], 0x5c
je 0x5c9544
push dword [ebp - 4]
push 0x5c9674
push dword [ebp - 0x10]
lea eax, [ebp - 0x258]
mov edx, 3
call fcn.00404e70
mov edx, dword [ebp - 0x258]
mov ecx, dword [ebp - 0xc]
mov eax, esi
call fcn.005c93d8
jmp 0x5c95ae
lea eax, [ebp - 0x25c]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00404dfc
mov eax, dword [ebp - 0x25c]
push eax
lea eax, [ebp - 0x260]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.00404dfc
mov edx, dword [ebp - 0x260]
mov eax, esi
pop ecx
call fcn.005c93d8
jmp 0x5c95ae
push dword [ebp - 8]
push 0x5c9674
push dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404e70
push 0xffffffffffffffff
mov eax, dword [ebp - 0xc]
call fcn.00404fb0
push eax
mov eax, dword [ebp - 0x10]
call fcn.00404fb0
push eax
call sub.kernel32.dll_CopyFileA
lea eax, [ebp - 0x250]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x5c9493
jmp 0x5c95f0
lea eax, [ebp - 0x264]
lea edx, [ebp - 0x110]
call fcn.00404d54
mov eax, dword [ebp - 0x264]
call fcn.00402938
call fcn.004028fc
xor ebx, ebx
jmp 0x5c9613
lea eax, [ebp - 0x268]
lea edx, [ebp - 0x110]
call fcn.00404d54
mov eax, dword [ebp - 0x268]
call fcn.00402938
call fcn.004028fc
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c9645
lea eax, [ebp - 0x268]
mov edx, 6
call fcn.00404b14
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404b14
ret
Function at 0x5caf90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
mov ebx, eax
lea eax, [ebp - 0x100]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathA
mov edx, ebx
lea eax, [ebp - 0x100]
call fcn.0040a6d0
pop ebx
mov esp, ebp
pop ebp
ret