joyce8/EMBER2024-capa huggingface dataset:
Function at 0x531718
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
push esp
call sub.KERNEL32.dll_GlobalMemoryStatus
mov eax, dword [esp + 8]
add esp, 0x20
ret

Function at 0x53172c
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
push esp
call sub.KERNEL32.dll_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret

Function at 0x531740
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
push esp
call sub.KERNEL32.dll_GlobalMemoryStatus
mov eax, dword [esp + 0x10]
add esp, 0x20
ret

Function at 0x531754
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
push esp
call sub.KERNEL32.dll_GlobalMemoryStatus
mov eax, dword [esp + 0x14]
add esp, 0x20
ret

Function at 0x5317d8
Capabilities:
Get session user name

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, edx
mov dword [esp + 4], 0x400
mov eax, dword [esp + 4]
call fcn.0040a414
mov dword [esp], eax
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.ADVAPI32.dll_GetUserNameA
mov eax, ebx
mov edx, dword [esp]
call fcn.00404ae4
mov eax, dword [esp]
call fcn.0040a470
pop ecx
pop edx
pop ebx
ret

Function at 0x531818
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, edx
mov dword [esp + 4], 0x10
mov eax, dword [esp + 4]
call fcn.0040a414
mov dword [esp], eax
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.KERNEL32.dll_GetComputerNameA
mov eax, ebx
mov edx, dword [esp]
call fcn.00404ae4
mov eax, dword [esp]
call fcn.0040a470
pop ecx
pop edx
pop ebx
ret

Function at 0x531858
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, edx
xor eax, eax
push ebp
push 0x531962
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
push eax
call sub.KERNEL32.dll_GetSystemInfo
mov eax, dword [ebp - 0x10]
cmp eax, 0x7d0
jg 0x5318a6
je 0x5318f9
sub eax, 0x182
je 0x5318bd
sub eax, 0x64
je 0x5318cc
sub eax, 0x64
je 0x5318db
sub eax, 0x112
je 0x5318ea
jmp 0x531935
sub eax, 0xbb8
je 0x531908
sub eax, 0x3e8
je 0x531917
sub eax, 0x42a8
je 0x531926
jmp 0x531935
lea eax, [ebp - 4]
mov edx, 0x531978
call fcn.00404984
jmp 0x531942
lea eax, [ebp - 4]
mov edx, 0x53198c
call fcn.00404984
jmp 0x531942
lea eax, [ebp - 4]
mov edx, 0x5319a0
call fcn.00404984
jmp 0x531942
lea eax, [ebp - 4]
mov edx, 0x5319b8
call fcn.00404984
jmp 0x531942
lea eax, [ebp - 4]
mov edx, 0x5319cc
call fcn.00404984
jmp 0x531942
lea eax, [ebp - 4]
mov edx, 0x5319e0
call fcn.00404984
jmp 0x531942
lea eax, [ebp - 4]
mov edx, 0x5319f4
call fcn.00404984
jmp 0x531942
lea eax, [ebp - 4]
mov edx, 0x531a08
call fcn.00404984
jmp 0x531942
lea eax, [ebp - 4]
mov edx, 0x531a1c
call fcn.00404984
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00404940
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x531969
lea eax, [ebp - 4]
call fcn.004048ec
ret
Function at 0x532dd8
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
call sub.KERNEL32.dll_GetTickCount_1
mov ebx, eax
rdtsc
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
call sub.KERNEL32.dll_GetTickCount_1
lea edx, [ebx + 0x3e8]
cmp eax, edx
jb 0x532dee
rdtsc
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
xor eax, eax
mov edx, 1
call fcn.0040598c
push edx
push eax
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 8]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
fild qword [ebp - 0x28]
fdiv dword [0x532e4c]
fstp xword [ebp - 0x20]
wait
fld xword [ebp - 0x20]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x55b8a8
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
call sub.KERNEL32.dll_GetCurrentProcess
push eax
call sub.KERNEL32.dll_GetPriorityClass
mov ebx, eax
call sub.KERNEL32.dll_GetCurrentThread
push eax
call sub.KERNEL32.dll_GetThreadPriority
mov esi, eax
push pe_nt_image_headers32
call sub.KERNEL32.dll_GetCurrentProcess
push eax
call sub.KERNEL32.dll_SetPriorityClass
push 0xf
call sub.KERNEL32.dll_GetCurrentThread
push eax
call sub.KERNEL32.dll_SetThreadPriority
push 0xa
call sub.KERNEL32.dll_Sleep_1
rdtsc
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
push 0x64
call sub.KERNEL32.dll_Sleep_1
rdtsc
sub eax, dword [ebp - 4]
sbb edx, dword [ebp - 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
push esi
call sub.KERNEL32.dll_GetCurrentThread
push eax
call sub.KERNEL32.dll_SetThreadPriority
push ebx
call sub.KERNEL32.dll_GetCurrentProcess
push eax
call sub.KERNEL32.dll_SetPriorityClass
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x14], eax
fild qword [ebp - 0x18]
fdiv dword [0x55b944]
fstp qword [ebp - 0x10]
wait
fld qword [ebp - 0x10]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x55c474
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404d9c
mov ebx, 0x5a6f08
xor eax, eax
push ebp
push 0x55c5fe
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00404dac
push eax
call sub.KERNEL32.dll_GetDiskFreeSpaceA
test eax, eax
je 0x55c4e8
mov eax, dword [ebx]
mov eax, dword [eax + 0x31c]
mov edx, dword [ebp - 0x14]
call fcn.0055774c
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x10]
mov eax, dword [ebx]
mov eax, dword [eax + 0x31c]
call fcn.005577fc
jmp 0x55c4f7
mov eax, dword [ebx]
mov eax, dword [eax + 0x31c]
xor edx, edx
call fcn.005577fc
mov eax, dword [ebp - 0x14]
imul dword [ebp - 8]
imul dword [ebp - 0xc]
shr eax, 0xa
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x18]
call fcn.004098f0
lea eax, [ebp - 0x18]
mov edx, 0x55c614
call fcn.00404bb4
mov edx, dword [ebp - 0x18]
mov eax, dword [ebx]
mov eax, dword [eax + 0x33c]
call fcn.004517ec
mov eax, dword [ebp - 0x10]
imul dword [ebp - 8]
imul dword [ebp - 0xc]
shr eax, 0xa
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.004098f0
lea eax, [ebp - 0x1c]
mov edx, 0x55c614
call fcn.00404bb4
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov eax, dword [eax + 0x354]
call fcn.004517ec
mov eax, dword [ebx]
mov eax, dword [eax + 0x30c]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x74]
mov eax, dword [ebx]
mov eax, dword [eax + 0x30c]
mov edx, dword [eax]
call dword [edx + 0x98]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x20], eax
fild qword [ebp - 0x24]
add esp, 0xfffffff8
fstp qword [esp]
wait
mov eax, dword [ebx]
mov eax, dword [eax + 0x30c]
mov ecx, 0xf0caa6
mov edx, 0x55c620
call fcn.00555f14
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x20], eax
fild qword [ebp - 0x24]
add esp, 0xfffffff8
fstp qword [esp]
wait
mov eax, dword [ebx]
mov eax, dword [eax + 0x30c]
mov ecx, 0xff0000
mov edx, 0x55c634
call fcn.00555f14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55c605
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00404910
lea eax, [ebp - 4]
call fcn.004048ec
ret
Function at 0x55c640
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x118], ecx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x110], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404d9c
xor eax, eax
push ebp
push 0x55c85d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404dac
mov esi, eax
push esi
call sub.KERNEL32.dll_GetDriveTypeA
cmp eax, 6
ja case.default.0x55c693
jmp dword [eax*4 + 0x55c69a]
mov edx, 0x55c874
mov eax, dword [ebx + 0x358]
call fcn.004517ec
jmp 0x55c744
mov edx, 0x55c884
mov eax, dword [ebx + 0x358]
call fcn.004517ec
jmp 0x55c744
mov edx, 0x55c898
mov eax, dword [ebx + 0x358]
call fcn.004517ec
jmp 0x55c744
mov edx, 0x55c8ac
mov eax, dword [ebx + 0x358]
call fcn.004517ec
jmp 0x55c744
mov edx, 0x55c8c0
mov eax, dword [ebx + 0x358]
call fcn.004517ec
jmp 0x55c744
mov edx, 0x55c8d4
mov eax, dword [ebx + 0x358]
call fcn.004517ec
jmp 0x55c744
mov edx, 0x55c8e8
mov eax, dword [ebx + 0x358]
call fcn.004517ec
jmp 0x55c744
mov edx, 0x55c874
mov eax, dword [ebx + 0x358]
call fcn.004517ec
push 0x32
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0xc8
lea eax, [ebp - 0xd9]
push eax
push esi
call sub.KERNEL32.dll_GetVolumeInformationA
test eax, eax
je 0x55c800
cmp dword [ebp - 8], 0
jne 0x55c788
xor edx, edx
mov eax, dword [ebx + 0x344]
call fcn.004517ec
jmp 0x55c7b0
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x110]
mov eax, 8
call fcn.00409940
mov edx, dword [ebp - 0x110]
mov eax, dword [ebx + 0x344]
call fcn.004517ec
lea eax, [ebp - 0x114]
lea edx, [ebp - 0xd9]
mov ecx, 0xc9
call fcn.00404b5c
mov edx, dword [ebp - 0x114]
mov eax, dword [ebx + 0x35c]
call fcn.004517ec
lea eax, [ebp - 0x118]
lea edx, [ebp - 0x10c]
mov ecx, 0x33
call fcn.00404b5c
mov edx, dword [ebp - 0x118]
mov eax, dword [ebx + 0x340]
call fcn.004517ec
jmp 0x55c82d
xor edx, edx
mov eax, dword [ebx + 0x344]
call fcn.004517ec
mov edx, 0x55c8fc
mov eax, dword [ebx + 0x35c]
call fcn.004517ec
mov edx, 0x55c918
mov eax, dword [ebx + 0x340]
call fcn.004517ec
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0055c474
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55c864
lea eax, [ebp - 0x118]
mov edx, 3
call fcn.00404910
lea eax, [ebp - 4]
call fcn.004048ec
ret
Function at 0x55f084
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff684
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x97c], edx
mov dword [ebp - 0x978], edx
mov dword [ebp - 0x974], edx
mov dword [ebp - 0x96c], edx
mov dword [ebp - 0x970], edx
mov dword [ebp - 0x968], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov ebx, eax
lea eax, [ebp - 0x164]
mov edx, dword [0x4085e8]
call fcn.00405390
xor eax, eax
push ebp
push 0x55f31c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x41c720]
call fcn.00403a4c
mov esi, eax
lea eax, [ebp - 4]
mov ecx, 0x55f334
mov edx, ebx
call fcn.00404bf8
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00409f34
lea ecx, [ebp - 0x164]
mov edx, 0x3f
mov eax, dword [ebp - 4]
call fcn.00409e04
mov ebx, eax
test ebx, ebx
jne 0x55f1e7
lea eax, [ebp - 0x968]
mov ecx, dword [ebp - 0x158]
mov edx, dword [ebp - 8]
call fcn.00404bf8
mov eax, dword [ebp - 0x968]
call fcn.00404dac
push eax
push 0x800
lea eax, [ebp - 0x964]
push eax
push 0
push 0x55f33c
push 0x55f340
call sub.KERNEL32.dll_GetPrivateProfileStringA
mov ecx, eax
lea edx, [ebp - 0x964]
lea eax, [ebp - 0xc]
call fcn.004049dc
push 0x55f35c
push dword [ebp - 0xc]
push 0x55f370
lea eax, [ebp - 0x970]
push eax
mov eax, dword [ebp - 0x158]
call fcn.00404bac
mov ecx, eax
sub ecx, 4
mov edx, 1
mov eax, dword [ebp - 0x158]
call fcn.00404e0c
push dword [ebp - 0x970]
push 0x55f37c
push 0x55f38c
lea eax, [ebp - 0x96c]
mov edx, 6
call fcn.00404c6c
mov edx, dword [ebp - 0x96c]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x164]
call fcn.00409e54
mov ebx, eax
test ebx, ebx
je 0x55f124
lea eax, [ebp - 0x974]
mov ecx, 0x55f39c
mov edx, dword [ebp - 8]
call fcn.00404bf8
mov eax, dword [ebp - 0x974]
lea ecx, [ebp - 0x164]
mov edx, 0x3f
call fcn.00409e04
mov ebx, eax
test ebx, ebx
jne 0x55f2a7
test dword [ebp - 0x15c], 0x10
jle 0x55f292
mov eax, dword [ebp - 0x158]
cmp byte [eax], 0x2e
je 0x55f292
mov edx, 0x55f38c
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x978]
mov ecx, 0x55f38c
mov edx, dword [ebp - 0x158]
call fcn.00404bf8
mov edx, dword [ebp - 0x978]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push dword [ebp - 8]
push 0x55f3ac
push dword [ebp - 0x158]
lea eax, [ebp - 0x97c]
mov edx, 3
call fcn.00404c6c
mov eax, dword [ebp - 0x97c]
call fcn.0055f084
mov edx, eax
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x40]
lea eax, [ebp - 0x164]
call fcn.00409e54
mov ebx, eax
test ebx, ebx
je 0x55f21a
lea eax, [ebp - 0x164]
call fcn.00409e78
mov ebx, esi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55f323
lea eax, [ebp - 0x97c]
call fcn.004048ec
lea eax, [ebp - 0x978]
call fcn.004048ec
lea eax, [ebp - 0x974]
call fcn.004048ec
lea eax, [ebp - 0x970]
call fcn.004048ec
lea eax, [ebp - 0x96c]
mov edx, 2
call fcn.00404910
lea eax, [ebp - 0x164]
mov edx, dword [0x4085e8]
call fcn.00405460
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404910
ret
Function at 0x566ee4
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404d9c
xor eax, eax
push ebp
push 0x566f3d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4400
push 0x160
push 0x5a6f90
push 0
mov eax, dword [ebp - 4]
call fcn.00404dac
push eax
call sub.SHELL32.dll_SHGetFileInfo
mov ebx, dword [0x5a6f94]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x566f44
lea eax, [ebp - 4]
call fcn.004048ec
ret

Function at 0x568bc0
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, ecx
push esp
push edx
mov eax, dword [0x5a4ec0]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.SHELL32.dll_SHGetSpecialFolderLocation
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.SHELL32.dll_SHGetPathFromIDList
mov edx, ebx
lea eax, [esp + 4]
call fcn.0040a400
add esp, 0x104
pop ebx
ret
Function at 0x58b5b4
Capabilities:
Create process on windows
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404d9c
mov eax, dword [ebp - 8]
call fcn.00404d9c
xor eax, eax
push ebp
push 0x58b684
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x3c
call fcn.00403388
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x40], 0x40
mov eax, dword [0x5a4ec0]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 4]
call fcn.00404dac
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 8]
call fcn.00404dac
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 1
lea eax, [ebp - 0x44]
push eax
call sub.SHELL32.dll_ShellExecuteEx
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x58b669
jmp 0x58b657
mov eax, dword [0x5a4ec0]
mov eax, dword [eax]
call fcn.00471bc4
mov eax, dword [0x5a4ec0]
mov eax, dword [eax]
cmp byte [eax + 0x9c], 0
jne 0x58b669
push 0x64
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x58b63b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58b68b
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404910
ret

Function at 0x58e340
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x124], ebx
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0x114], ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404d9c
xor eax, eax
push ebp
push 0x58e4d9
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xff
lea eax, [ebp - 0x110]
push eax
call sub.KERNEL32.dll_GetWindowsDirectoryA
lea edx, [ebp - 0x114]
lea eax, [ebp - 0x110]
call fcn.0040a400
push dword [ebp - 0x114]
push 0x58e4f0
push dword [ebp - 4]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404c6c
mov dl, 1
mov eax, dword [0x41c720]
call fcn.00403a4c
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x47789c]
call fcn.0047794c
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x58e4a7
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x58e500
lea eax, [ebp - 0x11c]
push eax
mov ecx, 0x58e518
mov edx, 0x58e52c
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi]
mov ecx, dword [ebp - 0x11c]
lea eax, [ebp - 0x118]
mov edx, 0x58e53c
call fcn.00404bf8
mov edx, dword [ebp - 0x118]
mov eax, ebx
call fcn.004517ec
mov ecx, dword [ebp - 0x10]
mov edx, 0x58e554
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x40]
push 0x58e570
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x14]
inc eax
lea edx, [ebp - 0x124]
call fcn.00409804
push dword [ebp - 0x124]
push 0x58e588
lea eax, [ebp - 0x120]
mov edx, 3
call fcn.00404c6c
mov edx, dword [ebp - 0x120]
mov eax, esi
call fcn.004517ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58e4ae
mov eax, dword [ebp - 0xc]
call fcn.00403a7c
mov eax, dword [ebp - 0x10]
call fcn.00403a7c
ret
Function at 0x58eb00
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor ecx, ecx
mov dword [ebp - 0x10c], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404d9c
xor eax, eax
push ebp
push 0x58ebaa
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xff
lea eax, [ebp - 0x108]
push eax
call sub.KERNEL32.dll_GetWindowsDirectoryA
push 0
lea eax, [ebp - 8]
push eax
mov ecx, 0x58ebc0
mov edx, dword [ebp - 4]
mov eax, 0x80000002
call fcn.0058dbd8
lea edx, [ebp - 0x10c]
lea eax, [ebp - 0x108]
call fcn.0040a400
push dword [ebp - 0x10c]
push 0x58ebd0
push dword [ebp - 8]
mov eax, ebx
mov edx, 3
call fcn.00404c6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58ebb1
lea eax, [ebp - 0x10c]
call fcn.004048ec
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404910
ret
Function at 0x58ebd8
Capabilities:
Contain obfuscated stackstrings
Copy file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x58ebe0
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404d9c
mov ecx, 2
lea eax, [ebp - 0x28]
mov edx, dword [0x40110c]
call fcn.004053c0
xor eax, eax
push ebp
push 0x58edcb
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov byte [ebp - 0x1d], 0x2f
mov byte [ebp - 0x1c], 0x5c
mov byte [ebp - 0x1b], 0x2a
mov byte [ebp - 0x1a], 0x3a
mov byte [ebp - 0x19], 0x3f
mov byte [ebp - 0x18], 0x22
mov byte [ebp - 0x17], 0x3c
mov byte [ebp - 0x16], 0x3e
mov byte [ebp - 0x15], 0x7c
mov ebx, 9
lea esi, [ebp - 0x1d]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
mov dl, byte [esi]
call fcn.00404ad4
mov edx, dword [ebp - 0x30]
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.0044aef0
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 4]
call fcn.00404984
inc esi
dec ebx
jne 0x58ec4a
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 4]
call fcn.0040955c
mov edx, dword [ebp - 0x34]
lea eax, [ebp - 4]
call fcn.00404984
lea eax, [ebp - 0x28]
mov edx, 0x58ede4
call fcn.00404984
lea eax, [ebp - 0x24]
mov edx, dword [ebp - 4]
call fcn.00404984
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x28]
call fcn.00404984
xor ebx, ebx
lea esi, [ebp - 0x24]
mov eax, dword [ebp - 0x14]
call fcn.00409d4c
test al, al
jne 0x58ecce
mov eax, dword [ebp - 0x14]
call fcn.0040a1dc
test al, al
je 0x58ed88
lea eax, [ebx + 1]
dec eax
jg 0x58eceb
push dword [ebp - 0x14]
push 0x58edf4
push dword [esi]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404c6c
inc ebx
add esi, 4
cmp ebx, 2
jne 0x58ecb2
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x58ed84
inc esi
xor ebx, ebx
mov eax, dword [0x5a4ec0]
mov eax, dword [eax]
call fcn.00471bc4
push 0x58ee00
push dword [ebp - 4]
push 0x58edf4
lea ecx, [ebp - 0x40]
mov edx, ebx
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x3c]
call fcn.00409ffc
push dword [ebp - 0x3c]
lea eax, [ebp - 0x38]
mov edx, 4
call fcn.00404c6c
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x10]
call fcn.0040955c
push 0
mov eax, dword [ebp - 0x10]
call fcn.00404dac
push eax
lea ecx, [ebp - 0x44]
mov edx, ebx
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x44]
call fcn.00404dac
push eax
call sub.KERNEL32.dll_CopyFileA
inc ebx
dec esi
jne 0x58ed0e
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58edd2
lea eax, [ebp - 0x44]
mov edx, 7
call fcn.00404910
lea eax, [ebp - 0x28]
mov ecx, 2
mov edx, dword [0x40110c]
call fcn.004054ac
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00404910
lea eax, [ebp - 4]
call fcn.004048ec
ret
Function at 0x590c34
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov edi, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
call fcn.00404d9c
xor eax, eax
push ebp
push 0x590e2f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x41c720]
call fcn.00403a4c
mov dword [ebp - 4], eax
push 0x590e40
push 0x590e44
mov eax, dword [0x5a6668]
push eax
call sub.KERNEL32.dll_FindResourceA
mov ebx, eax
push ebx
mov eax, dword [0x5a6668]
push eax
call sub.KERNEL32.dll_LoadResource
mov ebx, eax
push ebx
call sub.KERNEL32.dll_LockResource
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x14]
call fcn.00404ae4
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, ebx
call fcn.00407f88
push ebx
call sub.KERNEL32.dll_FreeResource
lea eax, [ebp - 0x10]
call fcn.004048ec
xor esi, esi
jmp 0x590dd4
mov eax, dword [ebp - 8]
mov bl, byte [eax + esi - 1]
cmp bl, 0x7f
jbe 0x590dac
cmp dword [ebp - 0x10], 0
jne 0x590d50
push ebp
lea eax, [ebp - 0x24]
mov edx, ebx
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x24]
lea eax, [ebp - 0x28]
call fcn.0040326c
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 8]
mov dl, byte [edx + esi]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x2c]
lea eax, [ebp - 0x28]
mov cl, 2
call fcn.0040323c
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x20]
call fcn.00404b50
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x1c]
mov edx, edi
call fcn.005908e8
pop ecx
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x10]
call fcn.00404984
jmp 0x590da7
push ebp
lea eax, [ebp - 0x24]
mov edx, ebx
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x24]
lea eax, [ebp - 0x28]
call fcn.0040326c
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 8]
mov dl, byte [edx + esi]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x2c]
lea eax, [ebp - 0x28]
mov cl, 2
call fcn.0040323c
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x34]
call fcn.00404b50
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x30]
mov edx, edi
call fcn.005908e8
pop ecx
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 0x10]
call fcn.00404bb4
add esi, 2
jmp 0x590dd4
cmp dword [ebp - 0x10], 0
jne 0x590dbe
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00404ad4
jmp 0x590dd3
lea eax, [ebp - 0x38]
mov edx, ebx
call fcn.00404ad4
mov edx, dword [ebp - 0x38]
lea eax, [ebp - 0x10]
call fcn.00404bb4
inc esi
mov eax, dword [ebp - 8]
call fcn.00404bac
cmp esi, eax
jle 0x590ce1
mov eax, dword [ebp - 4]
call fcn.00403a7c
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.0040955c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x590e36
lea eax, [ebp - 0x38]
mov edx, 3
call fcn.00404910
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00404910
lea eax, [ebp - 0x10]
call fcn.004048ec
lea eax, [ebp - 8]
call fcn.004048ec
ret