joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c28f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
sub esp, 8
mov eax, dword [0x7f319c]
test eax, eax
je 0x5c297b
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x5c2917
cmp dword [eax + 4], 0
mov esi, eax
je 0x5c2917
add esi, 8
jmp 0x5c292f
mov eax, dword [0x7f319c]
test eax, eax
je 0x5c298a
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
xor esi, esi
cmp eax, 1
jne 0x5c2936
mov eax, esi
add esp, 8
pop esi
ret
test eax, eax
mov esi, eax
jne 0x5c299f
movzx eax, byte [0x7f50e0]
xor ecx, ecx
mov edx, 0xc
call fcn.005bfb70
test eax, eax
je 0x5c29e2
mov dword [eax], 0x7f319c
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x7f319c]
test eax, eax
jne 0x5c2996
mov ecx, 0x7f319c
call fcn.006334f0
jmp 0x5c2997
mov ecx, 0x7f319c
call fcn.006334f0
jmp 0x5c28fe
mov ecx, 0x7f319c
call fcn.006334f0
jmp 0x5c2921
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call fcn.00633bd0
mov edx, dword [esi + 4]
mov ecx, dword [esi + 8]
test edx, edx
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esi + 4], 1
mov dword [esi + 8], eax
je 0x5c2912
test ecx, ecx
je 0x5c2912
lock dec dword [ecx]
jne 0x5c2912
lea ecx, [esp + 4]
call fcn.005bd610
jmp 0x5c2912
mov ecx, 4
mov edx, 0xc
call fcn.0062d0a0
int3

Function at 0x5c2b30
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [0x7f31bc]
test eax, eax
je 0x5c2c12
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x5c2b61
mov esi, eax
mov eax, dword [eax]
or eax, dword [esi + 4]
jne 0x5c2c07
mov eax, dword [0x7f31bc]
test eax, eax
je 0x5c2c21
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x5c2be4
mov esi, eax
test eax, eax
jne 0x5c2bc4
movzx eax, byte [0x7f50e0]
xor ecx, ecx
mov edx, 0x20
call fcn.005bfb70
test eax, eax
je 0x5c2c3c
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0x18], 0x7f31bc
mov esi, eax
mov eax, dword [0x7f31bc]
test eax, eax
je 0x5c2c30
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xorps xmm0, xmm0
mov eax, esp
movaps xmmword [esp], xmm0
push 2
push 0x10
push eax
push 0
call dword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x5c2be8
movaps xmm0, xmmword [esp]
jmp 0x5c2bf6
xor esi, esi
jmp 0x5c2c0a
lea ecx, [esp + 0x10]
call fcn.005bdcc0
movups xmm0, xmmword [esp + 0x10]
mov dword [esi + 4], 0
mov dword [esi], 1
movups xmmword [esi + 8], xmm0
add esi, 8
mov eax, esi
lea esp, [ebp - 4]
pop esi
pop ebp
ret
mov ecx, 0x7f31bc
call fcn.006334f0
jmp 0x5c2b48
mov ecx, 0x7f31bc
call fcn.006334f0
jmp 0x5c2b6f
mov ecx, 0x7f31bc
call fcn.006334f0
jmp 0x5c2bbc
mov ecx, 8
mov edx, 0x20
call fcn.0062d0a0
int3
Function at 0x5d20c0
Capabilities:
Connect socket

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov ebp, dword [esp + 0x34]
mov esi, ecx
cmp dl, 4
jne 0x5d211b
mov eax, dword [0x7f5054]
cmp eax, 3
jne 0x5d21cb
mov edx, dword [ebp]
lea edi, [esp + 4]
mov ecx, edi
push 1
call fcn.005b4e70
pop eax
mov al, byte [edi]
cmp al, 4
jne 0x5d2136
mov eax, dword [esp + 8]
cmp word [ebp], 0
mov dword [esp], eax
je 0x5d2151
movups xmm0, xmmword [ebp + 4]
mov edx, dword [ebp + 0x18]
lea eax, [ebp + 0x14]
add ebp, 0x1c
push 0x1c
pop ecx
mov bx, 0x17
jmp 0x5d2161
mov eax, edx
shr eax, 8
mov word [esi + 1], ax
mov eax, edx
shr eax, 0x18
mov byte [esi + 3], al
mov byte [esi], dl
mov dword [esi + 4], ebp
jmp 0x5d21c3
mov cl, byte [esp + 7]
movzx edi, word [esp + 5]
mov edx, dword [esp + 8]
mov byte [esi + 3], cl
mov word [esi + 1], di
mov byte [esi], al
mov dword [esi + 4], edx
jmp 0x5d21c3
lea eax, [ebp + 2]
add ebp, 6
push 0x10
pop ecx
mov bx, 2
xorps xmm0, xmm0
movzx ebp, word [ebp]
mov eax, dword [eax]
mov word [esp + 4], bx
rol bp, 8
mov word [esp + 6], bp
mov dword [esp + 8], eax
movups xmmword [esp + 0xc], xmm0
mov dword [esp + 0x1c], edx
push ecx
push edi
mov edi, dword [esp + 8]
push edi
call dword [sym.imp.ws2_32.dll_connect]
cmp eax, 0xffffffff
je 0x5d219c
mov dword [esi + 4], edi
mov byte [esi], 4
jmp 0x5d21c3
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov ecx, eax
mov edx, eax
shr eax, 0x18
mov byte [esi], 0
shr ecx, 8
shl edx, 0x18
mov byte [esi + 7], al
mov dword [esi + 1], edx
mov word [esi + 5], cx
push edi
call dword [sym.imp.ws2_32.dll_closesocket]
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.00633a80
jmp 0x5d20e0
Function at 0x5d7429
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
mov edx, eax
xor edx, 3
lock cmpxchg dword [ecx], edx
jne 0x5d742b
test al, 1
je 0x5d7442
test al, 2
jne 0x5d7454
xor eax, 3
ret
push 0x23
pop edx
mov ecx, str.assertion_failed:_prev.is_running__
push 0x78bb70
call fcn.0062d4b0
push 0x25
pop edx
mov ecx, 0x78bb80
push 0x78bba8
call fcn.0062d4b0

Function at 0x5d8a78
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x38
mov dword [esp], ecx
mov eax, dword [edx + 8]
mov ecx, dword [edx + 0x10]
mov esi, dword [esp + 0x50]
mov ebx, dword [edx + 0xc]
lea ebp, [esp + 4]
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0x2c]
mov ecx, ebp
push dword [esp + 0x4c]
call fcn.005d8622
pop eax
mov edx, dword [esp + 4]
cmp edx, 2
je 0x5d8bfe
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0xc]
test edx, edx
jne 0x5d8c06
mov dword [esp + 0x30], ecx
mov ecx, esi
mov dword [esp + 0x34], eax
call fcn.005d7920
cmp ebx, 0xffffffff
je 0x5d8c46
mov ecx, 0x7fffffff
cmp edx, ecx
cmovae edx, ecx
push 0
push edx
push eax
mov edi, ebx
push ebx
call dword [sym.imp.ws2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x5d8b12
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov esi, eax
xor eax, eax
cmp esi, 0x274a
jne 0x5d8b6c
mov dword [esp + 0x14], eax
mov byte [esp + 0x10], 4
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
cmp bl, 4
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], ebx
je 0x5d8c10
lea ecx, [esp + 0x18]
call fcn.0051a5f8
cmp al, 0xd
jne 0x5d8c36
mov ecx, dword [esp + 0x28]
lea edx, [esp + 0x30]
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
call fcn.005d8765
push ebp
call fcn.00454e00
pop eax
mov esi, dword [esp + 0x50]
mov ebx, edi
jmp 0x5d8a9f
lea ecx, [esp + 0x10]
mov byte [esp + 0x10], 0
mov dword [esp + 0x14], esi
call fcn.00412758
cmp al, 0xd
jne 0x5d8b1b
mov dword [esp + 0x20], esi
mov esi, dword [esp + 0x24]
test esi, esi
je 0x5d8bec
mov eax, dword [esi + 4]
mov edx, dword [esi]
lock inc dword [eax]
jle 0x5d8c50
add edx, 8
mov ecx, ebp
push dword [esi + 0xc]
push dword [esi + 8]
push eax
call fcn.00515b68
add esp, 0xc
push 4
pop ecx
call fcn.00514b36
cmp byte [esp + 4], 4
je 0x5d8b1b
mov ebx, dword [esp + 4]
mov edx, dword [esp + 0x20]
cmp bl, 4
je 0x5d8b1b
mov esi, dword [esp + 8]
xor ecx, ecx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], esi
call fcn.00514b36
jmp 0x5d8b34
and dword [esp + 8], 0
mov dword [esp + 4], 4
jmp 0x5d8b1b
mov eax, dword [esp]
mov byte [eax], 5
jmp 0x5d8c3e
mov edx, dword [esp]
mov dword [edx], ecx
mov dword [edx + 4], eax
jmp 0x5d8c3e
mov ecx, dword [esp + 0x50]
mov eax, esi
add eax, dword [ecx + 8]
cmp eax, dword [ecx + 0xc]
jbe 0x5d8c21
mov dword [ecx + 0xc], eax
mov edx, esi
push 0x789f08
call fcn.004be6d4
pop eax
mov eax, dword [esp]
mov byte [eax], 4
jmp 0x5d8c3e
mov eax, dword [esp]
mov dword [eax], ebx
mov dword [eax + 4], esi
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x789ef8
call fcn.0062d7f0
ud2
Function at 0x5d8c78
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x38
mov edi, dword [edx + 8]
mov eax, dword [esp + 0x54]
mov ebx, dword [edx + 0x10]
mov esi, 0x7fffffff
lea ebp, [esp + 0xc]
mov dword [esp], ecx
mov dword [esp + 0x24], edx
mov dword [esp + 0x2c], edi
mov edi, dword [edx + 0xc]
cmp eax, esi
mov dword [esp + 0x20], ebx
cmovb esi, eax
mov dword [esp + 0x28], esi
mov edx, dword [esp + 0x2c]
mov ecx, ebp
push dword [esp + 0x4c]
call fcn.005d8c52
pop eax
mov edx, dword [esp + 0xc]
cmp edx, 2
je 0x5d8de5
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
test edx, edx
jne 0x5d8ded
cmp edi, 0xffffffff
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], eax
je 0x5d8e0f
push 0
push dword [esp + 0x2c]
push dword [esp + 0x58]
push edi
call dword [sym.imp.ws2_32.dll_send]
cmp eax, 0xffffffff
je 0x5d8d0f
mov dword [esp + 8], eax
mov byte [esp + 4], 4
jmp 0x5d8d9a
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov esi, eax
xor eax, eax
lea ecx, [esp + 4]
mov byte [esp + 4], al
and word [esp + 5], 0
mov byte [esp + 7], al
mov dword [esp + 8], esi
call fcn.00412758
cmp al, 0xd
jne 0x5d8d9a
test ebx, ebx
je 0x5d8d8d
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
lock inc dword [eax]
jle 0x5d8e19
add edx, 8
mov ecx, ebp
push dword [ebx + 0xc]
push dword [ebx + 8]
push eax
call fcn.00515b68
add esp, 0xc
push 4
pop ecx
call fcn.00514b36
cmp byte [esp + 0xc], 4
je 0x5d8d9a
mov ebx, dword [esp + 0xc]
cmp bl, 4
je 0x5d8d9a
mov ebp, dword [esp + 0x10]
xor ecx, ecx
mov edx, esi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebp
call fcn.00514b36
jmp 0x5d8daf
and dword [esp + 0x10], 0
mov dword [esp + 0xc], 4
mov ebx, dword [esp + 4]
mov ebp, dword [esp + 8]
cmp bl, 4
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x18], ebx
je 0x5d8df7
lea ecx, [esp + 0x18]
call fcn.0051a5f8
cmp al, 0xd
jne 0x5d8dff
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x30]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.005d8765
lea ebp, [esp + 0xc]
push ebp
call fcn.00454e00
pop eax
mov ebx, dword [esp + 0x20]
jmp 0x5d8cad
mov eax, dword [esp]
mov byte [eax], 5
jmp 0x5d8e07
mov edx, dword [esp]
mov dword [edx], ecx
mov dword [edx + 4], eax
jmp 0x5d8e07
mov eax, dword [esp]
mov byte [eax], 4
jmp 0x5d8e04
mov eax, dword [esp]
mov dword [eax], ebx
mov dword [eax + 4], ebp
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x789f18
call fcn.0062d7f0
ud2
Function at 0x5e7800
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 0xc]
movups xmm2, xmmword [eax]
mov ecx, dword [edx + 0xf0]
mov eax, dword [esp + 8]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
lea edx, [edx + 0x20]
xorps xmm2, xmm0
aesenc xmm2, xmm1
dec ecx
movups xmm1, xmmword [edx]
lea edx, [edx + 0x10]
jne 0x5e7822
aesenclast xmm2, xmm1
pxor xmm0, xmm0
pxor xmm1, xmm1
movups xmmword [eax], xmm2
pxor xmm2, xmm2
ret
Function at 0x5ea700
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 0xc]
movups xmm2, xmmword [eax]
mov ecx, dword [edx + 0xf0]
mov eax, dword [esp + 8]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
lea edx, [edx + 0x20]
xorps xmm2, xmm0
aesenc xmm2, xmm1
dec ecx
movups xmm1, xmmword [edx]
lea edx, [edx + 0x10]
jne 0x5ea722
aesenclast xmm2, xmm1
pxor xmm0, xmm0
pxor xmm1, xmm1
movups xmmword [eax], xmm2
pxor xmm2, xmm2
ret
Function at 0x5ee160
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x7f325c]
xor eax, ebp
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x1f0fff
call dword [sym.imp.kernel32.dll_OpenProcess]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x5ee245
lea eax, [ebp - 0x1c]
push eax
push 0x20
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.advapi32.dll_OpenProcessToken]
test eax, eax
je 0x5ee23b
lea edx, [ebp - 0x24]
push edx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.advapi32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x5ee1d4
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x5ee245
mov dword [ebp - 0x14], 1
mov edx, 0xc
imul eax, edx, 0
mov ecx, dword [ebp - 0x24]
mov dword [ebp + eax - 0x10], ecx
mov edx, dword [ebp - 0x20]
mov dword [ebp + eax - 0xc], edx
mov eax, 0xc
imul ecx, eax, 0
mov dword [ebp + ecx - 8], 2
push 0
push 0
push 0x10
lea edx, [ebp - 0x14]
push edx
push 0
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.advapi32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x5ee231
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x5ee245
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00615a5d
mov esp, ebp
pop ebp
ret

Function at 0x5ef2c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push 0x7f50ec
lea ecx, [ebp - 0x1c]
call fcn.005f5eb0
mov ecx, 0x7f5130
call fcn.005f6980
cmp eax, 0xffffffff
je 0x5ef2f7
mov ecx, 0x7f5134
call fcn.005f6980
cmp eax, 0xffffffff
jne 0x5ef2f7
cmp dword [ebp + 8], 0
jne 0x5ef30e
mov dword [ebp - 8], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.005f6650
mov eax, dword [ebp - 8]
jmp 0x5ef3d1
mov eax, dword [ebp + 8]
mov dword [0x7f5290], eax
mov ecx, 0x7f510c
call fcn.005f6980
push eax
call dword [sym.imp.kernel32.dll_ResetEvent]
mov ecx, 0x7f5108
call fcn.005f6980
push eax
call dword [sym.imp.kernel32.dll_ResetEvent]
mov ecx, 0x7f5104
call fcn.005f6980
push eax
call dword [sym.imp.kernel32.dll_ResetEvent]
lea ecx, [ebp - 0x14]
push ecx
push 0
push 0
push 0x5f1220
push 0
push 0
call fcn.0061a692
add esp, 0x18
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x5ef39e
mov ecx, 0x7f5108
call fcn.005f6980
push eax
call dword [sym.imp.kernel32.dll_SetEvent]
push 0xffffffffffffffff
mov ecx, 0x7f5134
call fcn.005f6f50
mov dword [ebp - 0xc], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.005f6650
mov eax, dword [ebp - 0xc]
jmp 0x5ef3d1
mov edx, dword [ebp - 4]
push edx
mov ecx, 0x7f5134
call fcn.005f6f50
push 0xffffffffffffffff
mov ecx, 0x7f5104
call fcn.005f6980
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x1c]
call fcn.005f6650
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x5efb70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov dword [ebp - 8], 0
mov ecx, 0x7f5128
call fcn.005f6980
mov dword [ebp - 0x38], eax
mov ecx, 0x7f510c
call fcn.005f6980
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
add ecx, 0x10
xor edx, edx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
cmp eax, dword [0x7f53b8]
jb 0x5efbca
ja 0x5efbc0
mov ecx, dword [ebp - 0x28]
cmp ecx, dword [0x7f53b4]
jbe 0x5efbca
mov eax, 0xfffffffc
jmp 0x5efd63
movzx edx, byte [0x7f523c]
test edx, edx
je 0x5efbf1
mov ecx, 0x7f5130
call fcn.005f6980
cmp eax, 0xffffffff
je 0x5efbf1
mov eax, dword [0x7f53ac]
or eax, dword [0x7f53b0]
jne 0x5efbfb
mov eax, 0xfffffffd
jmp 0x5efd63
push 0x7f5110
lea ecx, [ebp - 0x30]
call fcn.005f5eb0
mov ecx, dword [ebp - 0x28]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [0x7f53ac]
push eax
call fcn.00616830
add esp, 0xc
push 0x14
push 0
lea ecx, [ebp - 0x4c]
push ecx
call fcn.00616db0
add esp, 0xc
mov ecx, 0x7f5128
call fcn.005f6980
mov dword [ebp - 0x3c], eax
lea edx, [ebp - 0x4c]
push edx
push 0
push 8
lea eax, [ebp - 0x28]
push eax
mov ecx, 0x7f5130
call fcn.005f6980
push eax
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
jne 0x5efc80
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x5efc80
mov dword [ebp - 0x10], 0xfffffffc
lea ecx, [ebp - 0x30]
call fcn.005f6650
mov eax, dword [ebp - 0x10]
jmp 0x5efd63
push 0xffffffffffffffff
push 0
lea ecx, [ebp - 0x38]
push ecx
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x5efcc1
mov ecx, 0x7f5130
call fcn.005f6980
push eax
call dword [sym.imp.KERNEL32.dll_CancelIo]
mov dword [ebp - 0x14], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.005f6650
mov eax, dword [ebp - 0x14]
jmp 0x5efd63
push 0
mov ecx, 0x7f510c
call fcn.005f6980
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x5efd02
mov ecx, 0x7f5130
call fcn.005f6980
push eax
call dword [sym.imp.KERNEL32.dll_CancelIo]
mov dword [ebp - 0x18], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.005f6650
mov eax, dword [ebp - 0x18]
jmp 0x5efd63
push 0
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x4c]
push eax
mov ecx, 0x7f5130
call fcn.005f6980
push eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x5efd35
mov dword [ebp - 0x1c], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.005f6650
mov eax, dword [ebp - 0x1c]
jmp 0x5efd63
jmp 0x5efd3c
cmp dword [ebp - 8], 0
je 0x5efd4b
mov dword [ebp - 0xc], 0
jmp 0x5efd52
mov dword [ebp - 0xc], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x30]
call fcn.005f6650
mov eax, dword [ebp - 0x20]
mov esp, ebp
pop ebp
ret
Function at 0x5f2080
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63452f
mov eax, dword fs:[0]
push eax
sub esp, 0x4b8
mov eax, dword [0x7f325c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x4bc]
call fcn.005f5dd0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x428]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x5f22d8
lea ecx, [ebp - 0x428]
mov dword [ebp - 0x4ac], ecx
jmp 0x5f2104
mov edx, dword [ebp - 0x4ac]
push edx
call fcn.0061a0fd
add esp, 4
mov ecx, dword [ebp - 0x4ac]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 0x4ac], edx
mov eax, dword [ebp - 0x4ac]
lea ecx, [ebp - 0x428]
sub eax, ecx
sar eax, 1
cmp eax, 0x104
jae 0x5f22d8
mov edx, dword [ebp - 0x4ac]
movzx eax, word [edx]
test eax, eax
je 0x5f22d8
mov ecx, dword [ebp - 0x4ac]
mov dx, word [ecx]
mov word [ebp - 0x18], dx
mov eax, 0x3a
mov word [ebp - 0x16], ax
xor ecx, ecx
mov word [ebp - 0x14], cx
push 0x104
lea edx, [ebp - 0x220]
push edx
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.kernel32.dll_QueryDosDeviceW]
test eax, eax
je 0x5f22d3
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x48c]
call fcn.005f5c80
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x474]
call fcn.005f5fa0
mov byte [ebp - 4], 2
push 0x7b330c
lea ecx, [ebp - 0x48c]
call fcn.005f6ea0
lea edx, [ebp - 0x220]
push edx
lea ecx, [ebp - 0x474]
call fcn.005f67a0
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x45c]
call fcn.005f67a0
lea ecx, [ebp - 0x220]
push ecx
call fcn.0061a0fd
add esp, 4
mov dword [ebp - 0x444], eax
lea edx, [ebp - 0x474]
push edx
lea ecx, [ebp - 0x4bc]
call fcn.005fbde0
lea ecx, [ebp - 0x48c]
call fcn.005f8e50
push eax
call dword [sym.imp.kernel32.dll_GetDriveTypeW]
mov dword [ebp - 0x4b0], eax
cmp dword [ebp - 0x4b0], 5
je 0x5f22b5
cmp dword [ebp - 0x4b0], 4
je 0x5f22b5
lea ecx, [ebp - 0x440]
call fcn.005f5cf0
mov byte [ebp - 4], 3
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x4a4]
call fcn.005f5c80
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x440]
push ecx
lea edx, [ebp - 0x4a4]
push edx
call fcn.005f1f20
add esp, 8
mov byte [ebp - 0x4a5], al
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x4a4]
call fcn.005f6490
movzx eax, byte [ebp - 0x4a5]
test eax, eax
je 0x5f22a6
lea ecx, [ebp - 0x440]
push ecx
lea ecx, [ebp - 0x474]
call fcn.005f6730
lea ecx, [ebp - 0x440]
call fcn.005fb900
mov dword [ebp - 0x444], eax
lea edx, [ebp - 0x474]
push edx
lea ecx, [ebp - 0x4bc]
call fcn.005fbde0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x440]
call fcn.005f6490
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x474]
call fcn.005f66a0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x48c]
call fcn.005f6490
jmp 0x5f20e5
push 0x7f521c
lea ecx, [ebp - 0x4c4]
call fcn.005f5eb0
mov byte [ebp - 4], 5
lea eax, [ebp - 0x4bc]
push eax
mov ecx, 0x7f5210
call fcn.005f67c0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c4]
call fcn.005f6650
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4bc]
call fcn.005f65b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00615a5d
mov esp, ebp
pop ebp
ret
Function at 0x5fb6f0
Capabilities:
Create thread
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 0x14
call fcn.005f6980
push eax
call dword [sym.imp.kernel32.dll_ResetEvent]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov dword [eax], ecx
cmp dword [ebp + 8], 0
jg 0x5fb736
lea edx, [ebp - 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x20]
mov dword [ebp + 8], eax
cmp dword [ebp + 8], 0
jne 0x5fb736
mov dword [ebp + 8], 1
mov dword [ebp - 8], 0
jmp 0x5fb748
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp edx, dword [ebp + 8]
jge 0x5fb78b
lea eax, [ebp - 0x10]
push eax
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x5f89d0
push 0
push 0
call fcn.0061a692
add esp, 0x18
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x5fb789
cmp dword [ebp - 0xc], 0xffffffff
je 0x5fb789
lea edx, [ebp - 0xc]
push edx
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.005fbdc0
jmp 0x5fb73f
mov al, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x5fc080
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c4
mov eax, dword [0x7f325c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1ac], 0
mov dword [ebp - 0x1b0], 0
mov dword [ebp - 0x1b8], 0
mov eax, dword [ebp + 8]
push eax
push str..CtrlSM
push str._s_s
push 0x104
lea ecx, [ebp - 0x108]
push ecx
call fcn.005fd030
add esp, 0x14
push 0
push 0x40000000
push 3
push 0
push 0
push 0xc0000000
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.kernel32.dll_CreateFileA]
mov dword [ebp - 0x1ac], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1b8], eax
mov eax, dword [0x7f50e8]
and eax, 4
je 0x5fc110
jmp 0x5fc153
cmp dword [ebp - 0x1ac], 0xffffffff
jne 0x5fc14f
mov ecx, dword [ebp - 0x1b0]
add ecx, 1
mov dword [ebp - 0x1b0], ecx
mov edx, dword [ebp - 0x1b0]
mov dword [ebp - 0x1bc], edx
cmp dword [ebp - 0x1bc], 1
je 0x5fc13f
jmp 0x5fc14f
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.005fca10
add esp, 8
jmp 0x5fc0d3
jmp 0x5fc153
cmp dword [ebp - 0x1ac], 0xffffffff
je 0x5fc2ea
push 0x9c
push 0
lea ecx, [ebp - 0x1a4]
push ecx
call fcn.00616db0
add esp, 0xc
mov dword [ebp - 0x1a4], 0x9c
lea edx, [ebp - 0x1a4]
push edx
call dword [sym.imp.kernel32.dll_GetVersionExA]
mov byte [ebp - 0x1a5], 0
cmp dword [ebp - 0x1ac], 0xffffffff
je 0x5fc1e3
mov dword [ebp - 0x1c0], 0
push 0
lea eax, [ebp - 0x1c4]
push eax
push 4
lea ecx, [ebp - 0x1c0]
push ecx
push 0
push 0
push 0x22019c
mov edx, dword [ebp - 0x1ac]
push edx
call dword [sym.imp.kernel32.dll_DeviceIoControl]
test eax, eax
je 0x5fc1e3
cmp dword [ebp - 0x1c4], 0
jbe 0x5fc1e3
mov byte [ebp - 0x1a5], 1
movzx eax, byte [ebp - 0x1a5]
test eax, eax
je 0x5fc215
push 0x7b3438
call fcn.005fcfa0
add esp, 4
movzx ecx, al
test ecx, ecx
je 0x5fc210
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.005fccd0
add esp, 8
jmp 0x5fc2ea
cmp dword [ebp - 0x1a0], 6
jb 0x5fc238
cmp dword [ebp - 0x1a0], 6
jne 0x5fc2ea
cmp dword [ebp - 0x19c], 1
ja 0x5fc2ea
mov dword [ebp - 0x1b4], 0
push str.nisdrv
call fcn.005fcfa0
add esp, 4
movzx eax, al
test eax, eax
jne 0x5fc295
push str.360netmon
call fcn.005fcfa0
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x5fc295
push str.symnets
call fcn.005fcfa0
add esp, 4
movzx edx, al
test edx, edx
jne 0x5fc295
lea eax, [ebp - 0x1b4]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0
call fcn.005fc900
add esp, 0xc
jmp 0x5fc2c8
lea edx, [ebp - 0x1b4]
push edx
mov eax, dword [ebp + 8]
push eax
push 1
call fcn.005fc900
add esp, 0xc
movzx ecx, al
test ecx, ecx
je 0x5fc2c8
cmp dword [ebp - 0x1b4], 0
jne 0x5fc2c8
push 0
mov edx, dword [ebp + 8]
push edx
call fcn.005fc4b0
add esp, 8
push str.aswstm
call fcn.005fcfa0
add esp, 4
movzx eax, al
test eax, eax
je 0x5fc2ea
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.005fccd0
add esp, 8
mov edx, dword [ebp - 0x1b8]
push edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x1ac]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00615a5d
mov esp, ebp
pop ebp
ret