joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53d870
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x5d5d23
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.005c8029
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], method.CBrush.virtual_0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.005cd6c8
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.005ced21
test eax, eax
je 0x53d98c
mov ecx, dword [esp + 0x3c]
call fcn.005cd6f5
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x53d950
push edi
mov ecx, esi
call fcn.005cad59
mov ecx, esi
call fcn.0053db30
cmp dword [esp + 0x38], 1
jne 0x53d985
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.005cae94
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x53fb70
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x53fba3
push esi
call fcn.0054df40
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x53fb9c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x53fc29
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x53fc12
mov eax, dword [esi + 8]
test eax, eax
je 0x53fbc7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x53fc0e
cmp eax, 2
je 0x53fc12
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x53fbba
cmp eax, 3
je 0x53fbed
cmp eax, 1
jne 0x53fbba
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x53fbba
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x53fbba
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0053fc50
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x53fc38
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0053fc50
add esp, 4
pop esi
ret

Function at 0x5404d0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x5404f1
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x5404f1
mov eax, dword [eax + 0x44]
test eax, eax
je 0x5404f1
mov edx, dword [esp + 8]
push edx
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x55b500
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
xor edi, edi
cmp ebx, edi
mov word [ebp], di
je 0x55b638
mov esi, dword [esp + 0x1c]
cmp esi, edi
je 0x55b638
push 0xf0000000
push 1
push edi
lea eax, [esp + 0x28]
push edi
push eax
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], edi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x55b610
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push edi
push edi
push 0x8003
push edx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x55b610
mov eax, dword [esp + 0x18]
push edi
push esi
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x55b610
mov edx, dword [esp + 0x18]
mov esi, dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
lea ecx, [esp + 0x20]
push edi
push ecx
push edi
push 2
push edx
mov dword [esp + 0x34], 4
call esi
test eax, eax
je 0x55b610
mov eax, dword [esp + 0x20]
push eax
call fcn.005b5827
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x55b610
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x20]
push edi
push ecx
push ebx
push 2
push edx
call esi
test eax, eax
je 0x55b602
mov eax, dword [esp + 0x20]
xor esi, esi
test eax, eax
jbe 0x55b602
mov al, byte [esi + ebx]
lea edx, [ebp + edi*2]
mov byte [esp + 0x10], al
mov ecx, dword [esp + 0x10]
and ecx, 0xff
push ecx
push str._02x
push edx
call fcn.005b695d
add esp, 0xc
add edi, eax
mov eax, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x55b5d3
push ebx
call fcn.005b573e
add esp, 4
mov edi, 1
mov eax, dword [esp + 0x18]
test eax, eax
je 0x55b61f
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x55b630
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x55bf50
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0xc
test eax, eax
je 0x55bf77
cmp word [eax], 0x5a4d
jne 0x55bf77
mov ecx, dword [eax + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x55bf77
test word [eax + 4], 0x14c
jne 0x55bf7f
xor eax, eax
add esp, 0xc
ret 8
mov edx, dword [eax + 0x54]
mov cx, word [eax + 6]
push ebx
mov dword [esp + 4], edx
push ebp
xor edx, edx
mov dx, word [eax + 0x14]
push esi
mov esi, dword [eax + 0x50]
push edi
mov edi, dword [esp + 0x24]
mov word [esp + 0x14], cx
lea ecx, [edx + eax + 0x18]
mov eax, dword [edi]
mov dword [esp + 0x18], ecx
test eax, eax
jne 0x55bfc8
cmp esi, dword [0x729c30]
jne 0x55bfb8
xor esi, esi
push 0
push esi
mov ecx, edi
call fcn.0055e300
mov edx, dword [edi]
mov dword [edx], esi
jmp 0x55c006
mov ebx, dword [eax]
mov eax, dword [eax + 0xc]
cmp eax, esi
jae 0x55bfe2
lea eax, [eax + esi + 0x1000]
push 0
push eax
mov ecx, edi
call fcn.0055e300
mov ecx, dword [edi]
cmp esi, ebx
mov dword [ecx], esi
mov eax, dword [edi]
mov edx, dword [eax + 8]
mov eax, dword [eax]
mov byte [edx + eax], 0
ja 0x55c006
jae 0x55c006
mov ecx, dword [edi]
inc esi
cmp esi, ebx
mov edx, dword [ecx + 8]
mov byte [edx + esi - 1], 0
jb 0x55bff7
mov edi, dword [edi]
test edi, edi
je 0x55c011
mov ebp, dword [edi + 8]
jmp 0x55c013
xor ebp, ebp
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0x20]
mov eax, ecx
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [esp + 0x24], ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x14]
test cx, cx
jbe 0x55c094
mov ebx, dword [esp + 0x18]
lea eax, [ebx + 0xc]
lea edx, [ebx + 0x14]
add ebx, 0x10
and ecx, 0xffff
mov dword [esp + 0x10], ecx
mov edi, dword [eax]
test edi, edi
je 0x55c080
mov ecx, dword [ebx]
test ecx, ecx
je 0x55c080
mov esi, dword [edx]
add edi, ebp
add esi, dword [esp + 0x20]
mov ebp, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
mov ebp, dword [esp + 0x24]
and ecx, 3
add ebx, 0x28
add edx, 0x28
add eax, 0x28
rep movsb byte es:[edi], byte [esi]
jmp 0x55c089
add ebx, 0x28
add edx, 0x28
add eax, 0x28
mov ecx, dword [esp + 0x10]
dec ecx
mov dword [esp + 0x10], ecx
jne 0x55c04f
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
Function at 0x55c900
Capabilities:
Check os version

Disassembly:
mov edx, dword [0x7ecbd4]
sub esp, 0x23c
test edx, edx
push esi
push edi
jne 0x55c946
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edx, eax
test edx, edx
mov dword [0x7ecbd4], edx
jne 0x55c946
push eax
push 0x790cd0
push 0x790cc0
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
xor eax, eax
pop esi
add esp, 0x23c
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, 0x46
xor eax, eax
lea edi, [esp + 0xc]
mov dword [esp + 8], 0x11c
push str.RtlGetVersion
rep stosd dword es:[edi], eax
push edx
call esi
test eax, eax
je 0x55c989
lea ecx, [esp + 8]
push ecx
call eax
mov esi, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
mov al, byte [esp + 0x122]
jmp 0x55ca03
mov ecx, 0x45
xor eax, eax
lea edi, [esp + 0x128]
lea edx, [esp + 0x128]
rep stosd dword es:[edi], eax
push edx
mov dword [esp + 0x12c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x55c93b
mov eax, dword [0x7ecbd4]
push str.RtlGetNtVersionNumbers
push eax
call esi
lea ecx, [esp + 0x134]
lea edx, [esp + 0x130]
push ecx
lea ecx, [esp + 0x130]
push edx
push ecx
call eax
mov al, byte [esp + 0x24e]
mov esi, dword [esp + 0x138]
mov ecx, dword [esp + 0x13c]
mov edi, dword [esp + 0x140]
add esp, 0xc
mov byte [esp + 0x122], al
mov edx, dword [esp + 0x248]
test edx, edx
je 0x55ca26
mov dword [edx + 8], edi
mov edi, dword [esp + 0x122]
and edi, 0xff
mov dword [edx], esi
mov dword [edx + 4], ecx
mov dword [edx + 0xc], edi
cmp esi, 5
jne 0x55ca9e
test ecx, ecx
jne 0x55ca3d
pop edi
mov eax, 0x14
pop esi
add esp, 0x23c
ret
cmp ecx, 1
jne 0x55ca50
pop edi
mov eax, 0x13
pop esi
add esp, 0x23c
ret
cmp ecx, 2
jne 0x55c93b
cmp al, 1
jne 0x55ca6b
pop edi
mov eax, 0x12
pop esi
add esp, 0x23c
ret
cmp word [esp + 0x120], 0x8000
jne 0x55ca85
pop edi
mov eax, 0xf
pop esi
add esp, 0x23c
ret
xor eax, eax
pop edi
cmp word [esp + 0x118], ax
pop esi
setne al
add eax, 0x10
add esp, 0x23c
ret
cmp esi, 6
jne 0x55cb05
test ecx, ecx
jne 0x55cab9
dec al
pop edi
neg al
sbb eax, eax
pop esi
add eax, 0xd
add esp, 0x23c
ret
cmp ecx, 1
jne 0x55cad0
dec al
pop edi
neg al
sbb eax, eax
pop esi
add eax, 0xb
add esp, 0x23c
ret
cmp ecx, 2
jne 0x55cae7
dec al
pop edi
neg al
sbb eax, eax
pop esi
add eax, 9
add esp, 0x23c
ret
cmp ecx, 3
jne 0x55c93b
xor edx, edx
cmp al, 1
setne dl
add edx, 6
pop edi
mov eax, edx
pop esi
add esp, 0x23c
ret
cmp esi, 0xa
jne 0x55c93b
test ecx, ecx
jne 0x55c93b
dec al
pop edi
neg al
sbb eax, eax
pop esi
and al, 0xfe
add eax, 5
add esp, 0x23c
ret
Function at 0x55cb30
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
push ebx
call fcn.0055cc60
add esp, 4
mov edi, eax
push 0x40
push 0x3000
push edi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x55cb5c
pop edi
pop esi
pop ebx
ret
mov ecx, edi
xor eax, eax
mov edx, ecx
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push esi
and ecx, 3
push ebx
rep stosb byte es:[edi], al
call fcn.0055cc90
add esp, 8
test eax, eax
jne 0x55cb82
pop edi
pop esi
pop ebx
ret
push esi
call fcn.0055cd30
add esp, 4
test eax, eax
jne 0x55cb93
pop edi
pop esi
pop ebx
ret
push esi
call fcn.0055cdb0
add esp, 4
test eax, eax
jne 0x55cba4
pop edi
pop esi
pop ebx
ret
push esi
call fcn.0055ce70
add esp, 4
test eax, eax
jne 0x55cbb5
pop edi
pop esi
pop ebx
ret
push 0
push esi
call fcn.0055ce90
add esp, 8
neg eax
sbb eax, eax
pop edi
and eax, esi
pop esi
pop ebx
ret

Function at 0x55cbd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
xor edx, edx
mov eax, dword [esi + 0x3c]
xor edi, edi
mov eax, dword [eax + esi + 0x78]
add eax, esi
mov ecx, dword [eax + 0x20]
mov ebx, dword [eax + 0x24]
mov ebp, dword [eax + 0x1c]
mov eax, dword [eax + 0x18]
add ecx, esi
add ebx, esi
add ebp, esi
mov dword [esp + 0x10], eax
test eax, eax
jbe 0x55cc4c
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
push edx
mov eax, dword [ecx]
add eax, esi
push eax
call fcn.005b6ae0
add esp, 8
test eax, eax
je 0x55cc3a
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
inc edi
add ecx, 4
cmp edi, eax
mov dword [esp + 0x18], ecx
jb 0x55cc04
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
xor eax, eax
mov ax, word [ebx + edi*2]
pop edi
mov eax, dword [ebp + eax*4]
add eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
mov eax, edx
pop ebx
pop ecx
ret

Function at 0x55cc60
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [esp + 4]
cmp word [ecx], 0x5a4d
je 0x55cc6e
xor eax, eax
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
je 0x55cc7e
xor eax, eax
ret
mov eax, dword [eax + 0x50]
ret
Function at 0x55cc90
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
push ebp
push esi
mov esi, dword [esp + 0x10]
xor ecx, ecx
push edi
mov edi, dword [esp + 0x18]
mov eax, dword [esi + 0x3c]
add eax, esi
mov cx, word [eax + 0x14]
mov bp, word [eax + 6]
lea edx, [ecx + eax + 0x18]
mov ecx, dword [eax + 0x54]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
test bp, bp
rep movsb byte es:[edi], byte [esi]
jbe 0x55cd20
push ebx
lea ebx, [edx + 0xc]
lea eax, [edx + 0x14]
add edx, 0x10
and ebp, 0xffff
mov dword [esp + 0x10], ebp
mov edi, dword [ebx]
test edi, edi
je 0x55cd01
mov ecx, dword [edx]
test ecx, ecx
je 0x55cd01
mov esi, dword [eax]
mov ebp, dword [esp + 0x18]
add esi, ebp
mov ebp, dword [esp + 0x1c]
add edi, ebp
mov ebp, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x10]
add edx, 0x28
add eax, 0x28
add ebx, 0x28
dec ecx
mov dword [esp + 0x10], ecx
jne 0x55ccd9
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
pop ecx
ret
pop edi
pop esi
mov eax, 1
pop ebp
pop ecx
ret
Function at 0x5632c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x563326
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x563326
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x563307
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x5636b0
Capabilities:
Create http request

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x5636e8
mov edx, dword [esi + 4]
xor eax, eax
push 0
push 0
mov ecx, dword [edx - 8]
test ecx, ecx
setne al
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edx
neg eax
sbb eax, eax
push ecx
and eax, 2
inc eax
push eax
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.0_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi], eax
mov ecx, dword [esi]
xor eax, eax
test ecx, ecx
setne al
pop esi
ret
Function at 0x5643b0
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x5643f9
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x564870
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5d6480
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00564420
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.005644a0
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.005644a0
lea ecx, [esi + 0xc]
call fcn.005c69dc
lea ecx, [esi + 0x10]
call fcn.005c69dc
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.00565a30
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.00565a30
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.00565a30
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.005c6a51
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.005c6a51
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x56ebc9
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0xff
push 1
mov ebx, 0x184
call fcn.00591670
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp + 0xc]
mov ebx, dword [ebx]
test ebx, ebx
je 0x56ec17
push ebx
call fcn.00590626
add esp, 4
pop eax
mov ebx, dword [ebp + 0xc]
mov dword [ebx], eax
push 0x80000301
push 0
push 0xff
push 1
mov ebx, 0x184
call fcn.00591670
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp + 0x14]
mov ebx, dword [ebx]
test ebx, ebx
je 0x56ec54
push ebx
call fcn.00590626
add esp, 4
pop eax
mov ebx, dword [ebp + 0x14]
mov dword [ebx], eax
push 0x80000101
push 0
push 0x5c
push 1
mov ebx, 0x140
call fcn.00590d10
add esp, 0x10
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
mov ebx, dword [ebp + 8]
push dword [ebx]
mov ecx, 2
call fcn.00565e35
add esp, 8
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x56eca3
push ebx
call fcn.00590626
add esp, 4
mov dword [ebp - 0x14], esp
push 0xff
mov ebx, dword [ebp + 0x14]
push dword [ebx]
mov eax, 0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
mov eax, 0xff
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 8]
push eax
push 0xff
mov ebx, dword [ebp + 0xc]
push dword [ebx]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x56ecf5
push 6
call fcn.00590632
add esp, 4
mov dword [ebp - 0x20], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x56ed08
push ebx
call fcn.00590626
add esp, 4
cmp dword [ebp - 0x20], 0
je 0x56ed3a
push 0x80000401
push dword [ebp - 4]
push dword [ebp - 8]
push 1
mov ebx, 0x168
call fcn.00590a40
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
jmp 0x56ed63
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00590d10
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
jmp 0x56ed63
mov esp, ebp
pop ebp
ret 0x14
Function at 0x57c65c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
inc eax
push dword [eax]
pop word [ebp - 4]
cmp dword [ebp - 4], 0xc25e
je 0x57c691
cmp dword [ebp - 4], 0xc35e
je 0x57c691
jmp 0x57c694
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x57c676
cmp dword [ebp - 4], 0xc25e
jne 0x57c720
push eax
mov dword [ebp - 0xc], esp
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push dword [ebp - 8]
push 0xffffffff
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x57c6dd
push 6
call fcn.00590632
add esp, 4
pop eax
push 0x9090c35e
pop dword [eax]
mov dword [ebp - 0xc], esp
mov eax, 0
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
push 4
push dword [ebp - 8]
push 0xffffffff
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x57c720
push 6
call fcn.00590632
add esp, 4
mov esp, ebp
pop ebp
ret 4

Function at 0x57f3f1
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], esp
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x57f421
push 6
call fcn.00590632
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
mov eax, 0
setne al
jmp 0x57f435
mov esp, ebp
pop ebp
ret 4

Function at 0x580b56
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov ebx, dword [ebp + 0x14]
mov dword [ebx], 0
mov dword [ebp - 8], esp
mov eax, 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x580baf
push 6
call fcn.00590632
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp + 0x18], 0
jne 0x580be3
mov dword [ebp - 8], esp
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x580bde
push 6
call fcn.00590632
add esp, 4
jmp 0x580beb
mov eax, dword [ebp - 4]
mov ebx, dword [ebp + 0x14]
mov dword [ebx], eax
cmp dword [ebp - 4], 0
mov eax, 0
setne al
jmp 0x580bfc
mov esp, ebp
pop ebp
ret 0x14

Function at 0x581e1b
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], 0x581ece
mov eax, dword [ebp + 8]
leave
sub esp, 0x60
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]

Function at 0x590e20
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x590e3e
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x590e33
pop esi
ret
Function at 0x591510
Capabilities:
Query environment variable

Disassembly:
push ebp
push esi
push edi
push 0x104
call fcn.005907b0
mov ebp, dword [esp + 0x18]
add esp, 4
mov edi, eax
push 0x104
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
cmp esi, 0x104
jbe 0x591567
push ebx
push edi
call fcn.00590840
push esi
mov ebx, esi
call fcn.005907b0
add esp, 8
mov edi, eax
push esi
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
cmp esi, ebx
ja 0x59153e
mov eax, edi
pop ebx
pop edi
pop esi
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebp
ret