joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5ed15c
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd90
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x26c], ecx
mov dword [ebp - 0x270], ecx
mov dword [ebp - 0x268], ecx
mov dword [ebp - 0x264], ecx
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x5ed328
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x5ed2fb
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, ebx
test eax, eax
je 0x5ed1b9
sub eax, 4
mov eax, dword [eax]
cmp eax, 3
jne 0x5ed1f7
mov eax, ebx
call fcn.005ebd7c
test al, al
jne 0x5ed1d7
mov byte [ebp - 5], 0
call fcn.00407448
jmp 0x5ed302
lea edx, [ebp - 0x264]
mov eax, ebx
call fcn.005eba2c
mov ecx, dword [ebp - 0x264]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, esi
call fcn.005ed58c
mov byte [ebp - 5], 1
lea eax, [ebp - 0x260]
push eax
lea edx, [ebp - 0x268]
mov eax, ebx
call fcn.00599cd0
lea eax, [ebp - 0x268]
mov edx, 0x5ed348
call fcn.00408f18
mov eax, dword [ebp - 0x268]
call fcn.00408d1c
push eax
call sub.kernel32.dll_FindFirstFileW_1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x5ed2e4
xor eax, eax
push ebp
push 0x5ed2dd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x260]
call fcn.005eb8e4
test al, al
je 0x5ed2b2
lea eax, [ebp - 4]
lea edx, [ebp - 0x234]
mov ecx, 0x104
call fcn.00408dc0
lea edx, [ebp - 0x270]
mov eax, ebx
call fcn.00599cd0
lea eax, [ebp - 0x270]
mov edx, dword [ebp - 4]
call fcn.00408f18
mov eax, dword [ebp - 0x270]
lea edx, [ebp - 0x26c]
call fcn.005eba2c
mov eax, dword [ebp - 0x26c]
push eax
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebp - 4]
mov edx, esi
call fcn.005ecb58
lea eax, [ebp - 0x260]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x5ed24b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ed2e4
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FindClose_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ed302
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetErrorMode
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ed32f
lea eax, [ebp - 0x270]
mov edx, 4
call fcn.00407cb8
lea eax, [ebp - 4]
call fcn.00407c58
ret
Function at 0x5ed624
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd8c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x270], ebx
mov dword [ebp - 0x274], ebx
mov dword [ebp - 0x26c], ebx
mov dword [ebp - 0x264], ebx
mov dword [ebp - 0x268], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x5ed81a
push dword fs:[eax]
mov dword fs:[eax], esp
test edi, edi
je 0x5ed6a9
lea edx, [ebp - 0x264]
mov eax, edi
call fcn.0059a2a4
mov eax, dword [ebp - 0x264]
push eax
lea edx, [ebp - 0x268]
mov eax, ebx
call fcn.00599cd0
mov eax, dword [ebp - 0x268]
pop edx
call fcn.00599efc
test eax, eax
jne 0x5ed6a9
lea edx, [ebp - 4]
mov eax, edi
call fcn.0059a278
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x5ed7e8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x260]
push eax
lea edx, [ebp - 0x26c]
mov eax, ebx
call fcn.00599cd0
lea eax, [ebp - 0x26c]
mov edx, 0x5ed834
call fcn.00408f18
mov eax, dword [ebp - 0x26c]
call fcn.00408d1c
push eax
call sub.kernel32.dll_FindFirstFileW_1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x5ed7d1
xor eax, eax
push ebp
push 0x5ed7ca
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x260]
call fcn.005eb8e4
test al, al
je 0x5ed79b
lea eax, [ebp - 8]
lea edx, [ebp - 0x234]
mov ecx, 0x104
call fcn.00408dc0
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.00599efc
test eax, eax
je 0x5ed79b
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebp - 8]
mov edx, esi
call fcn.005ecc4c
test eax, eax
jne 0x5ed79b
lea edx, [ebp - 0x274]
mov eax, ebx
call fcn.00599cd0
lea eax, [ebp - 0x274]
mov edx, dword [ebp - 8]
call fcn.00408f18
mov eax, dword [ebp - 0x274]
lea edx, [ebp - 0x270]
call fcn.005eba2c
mov eax, dword [ebp - 0x270]
push eax
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebp - 8]
mov edx, esi
call fcn.005ecb58
lea eax, [ebp - 0x260]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x5ed711
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ed7d1
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FindClose_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ed7ef
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x5edaf0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
mov ebx, eax
push 0x104
lea eax, [ebp - 0x208]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
lea eax, [ebp - 0x208]
call fcn.00423454
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5f0ee4
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
ret
Function at 0x5f1bf0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
mov byte [ebp - 5], 0
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.00408d1c
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
jle 0x5f1c92
mov eax, ebx
call fcn.00404b80
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x5f1c8b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
push edi
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x5f1c75
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x5f1cb4
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x5f1c75
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f1ca9
mov eax, dword [ebp - 0x10]
call fcn.00404b9c
ret
mov eax, dword [0x65d704]
cmp dword [eax], 1
je 0x5f1ca9
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.005f1a14
mov byte [ebp - 5], al
movzx eax, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5f21a4
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.005f2150
test al, al
jne 0x5f21c5
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x5f2213
xor eax, eax
push ebp
push 0x5f2203
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, esi
call fcn.00408d1c
push eax
call sub.kernel32.dll_CreateDirectoryW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_2
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f220a
lea eax, [ebp - 0xc]
call fcn.005f2190
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5f221c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.005f2150
test al, al
jne 0x5f2240
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x5f22a6
xor eax, eax
push ebp
push 0x5f2296
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x1c]
push eax
mov eax, dword [ebp + 0x20]
push eax
mov eax, dword [ebp + 0x24]
push eax
push edi
push esi
call sub.kernel32.dll_CreateProcessW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_2
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f229d
lea eax, [ebp - 0xc]
call fcn.005f2190
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
Function at 0x5f22b4
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.005f2150
test al, al
jne 0x5f22d8
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x5f2330
xor eax, eax
push ebp
push 0x5f2320
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov eax, edi
call fcn.00408d1c
push eax
mov eax, esi
call fcn.00408d1c
push eax
call sub.kernel32.dll_CopyFileW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_2
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f2327
lea eax, [ebp - 0xc]
call fcn.005f2190
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x5f233c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.005f2150
test al, al
jne 0x5f235d
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x5f23a9
xor eax, eax
push ebp
push 0x5f2399
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00408d1c
push eax
call sub.kernel32.dll_DeleteFileW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_2
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f23a0
lea eax, [ebp - 0xc]
call fcn.005f2190
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5f2514
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.005f2150
test al, al
jne 0x5f2537
mov dword [ebp - 4], 0xffffffff
jmp 0x5f2583
xor eax, eax
push ebp
push 0x5f2573
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00408d1c
push eax
call sub.kernel32.dll_GetFileAttributesW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_2
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f257a
lea eax, [ebp - 0xc]
call fcn.005f2190
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5f26b8
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.005f2150
test al, al
jne 0x5f26dc
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x5f2730
xor eax, eax
push ebp
push 0x5f2720
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00408d1c
push eax
mov eax, esi
call fcn.00408d1c
push eax
call sub.kernel32.dll_MoveFileW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_2
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f2727
lea eax, [ebp - 0xc]
call fcn.005f2190
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5f273c
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, dword [ebp + 8]
test edi, edi
jne 0x5f275f
test esi, 4
je 0x5f275f
xor edi, edi
jmp 0x5f2768
mov eax, edi
call fcn.00408d1c
mov edi, eax
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.005f2150
test al, al
jne 0x5f277d
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x5f27cc
xor eax, eax
push ebp
push 0x5f27bc
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
push edi
mov eax, dword [ebp - 4]
call fcn.00408d1c
push eax
call sub.kernel32.dll_MoveFileExW
mov dword [ebp - 8], eax
call sub.kernel32.dll_GetLastError_2
mov dword [ebp - 0x14], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f27c3
lea eax, [ebp - 0x10]
call fcn.005f2190
ret
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x5f2848
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.005f2150
test al, al
jne 0x5f2869
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x5f28b5
xor eax, eax
push ebp
push 0x5f28a5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00408d1c
push eax
call sub.kernel32.dll_RemoveDirectoryW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_2
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f28ac
lea eax, [ebp - 0xc]
call fcn.005f2190
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5f28c0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.005f2150
test al, al
jne 0x5f28e4
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x5f2931
xor eax, eax
push ebp
push 0x5f2921
push dword fs:[eax]
mov dword fs:[eax], esp
push edi
mov eax, esi
call fcn.00408d1c
push eax
call sub.kernel32.dll_SetFileAttributesW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_2
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f2928
lea eax, [ebp - 0xc]
call fcn.005f2190
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5f3708
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x5f3710
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x5f37fd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.0059b3e0
mov edx, dword [ebp - 8]
mov ecx, 0x5f3818
xor eax, eax
call fcn.005f3470
push 0
mov eax, dword [ebp - 4]
call fcn.00408d1c
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x5f37cb
call sub.kernel32.dll_GetLastError_2
mov ebx, eax
cmp ebx, 0xb7
je 0x5f372a
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 4]
mov al, 0x3b
call fcn.005a1448
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.0042216c
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x24]
mov eax, ebx
call fcn.0059c3ec
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x18]
mov ecx, 2
mov al, 0x70
call fcn.005a1418
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x41d304]
call fcn.00427c80
call fcn.00407354
jmp 0x5f372a
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00408038
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f3804
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00407cb8
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00407cb8
ret
Function at 0x5f51a4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x18]
call fcn.00407d3c
xor eax, eax
push ebp
push 0x5f5288
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp + 0x18], 0
jne 0x5f51eb
lea edx, [ebp + 0x18]
mov eax, edi
call fcn.0059a1e4
cmp dword [ebp + 0x18], 0
jne 0x5f51eb
lea eax, [ebp + 0x18]
call fcn.0059b250
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x3c
call fcn.004053f4
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x3c], 0x540
test ebx, ebx
je 0x5f5216
mov eax, ebx
call fcn.00408d1c
mov dword [ebp - 0x34], eax
mov eax, edi
call fcn.00408d1c
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
call fcn.00408d1c
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x18]
call fcn.00408d1c
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x40]
push eax
call sub.shell32.dll_ShellExecuteExW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x5f5258
call sub.kernel32.dll_GetLastError_2
mov dword [esi], eax
jmp 0x5f5272
mov dword [esi], 0x103
mov eax, dword [ebp - 8]
test eax, eax
je 0x5f5272
push esi
movzx edx, byte [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
call fcn.005f4e44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f528f
lea eax, [ebp + 0x18]
call fcn.00407c58
ret

Function at 0x5f54c8
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
mov ebx, eax
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x5f54fa
mov eax, ebx
lea edx, [ebp - 0x24]
mov ecx, 0x10
call fcn.00408dc0
jmp 0x5f5501
mov eax, ebx
call fcn.00407c58
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5f5508
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
mov ebx, eax
mov dword [ebp - 4], 0x101
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x206]
push eax
call sub.advapi32.dll_GetUserNameW
test eax, eax
je 0x5f5543
mov eax, ebx
lea edx, [ebp - 0x206]
mov ecx, 0x101
call fcn.00408dc0
jmp 0x5f554a
mov eax, ebx
call fcn.00407c58
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5f5558
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov eax, dword [0x65d704]
cmp dword [eax], 2
jne 0x5f55c1
lea eax, [ebp - 4]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x5f5581
xor eax, eax
jmp 0x5f55d0
lea eax, [ebp - 0x10]
push eax
push 0x5f55d4
push 0
call sub.advapi32.dll_LookupPrivilegeValueW
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError_2
test eax, eax
je 0x5f55c1
xor eax, eax
jmp 0x5f55d0
push 0
push 2
call sub.user32.dll_ExitWindowsEx
cmp eax, 1
sbb eax, eax
inc eax
mov esp, ebp
pop ebp
ret
Function at 0x5f55fc
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x5f5656
inc esi
xor edi, edi
cmp edi, 1
jne 0x5f5622
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep_2
jmp 0x5f5630
cmp edi, 1
jle 0x5f5630
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep_2
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.005f233c
test eax, eax
jne 0x5f5656
call sub.kernel32.dll_GetLastError_2
cmp eax, 2
je 0x5f5656
call sub.kernel32.dll_GetLastError_2
cmp eax, 3
je 0x5f5656
inc edi
dec esi
jne 0x5f5612
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x5f5ecc
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, edx
mov esi, eax
push 0
push 2
lea eax, [ebp - 4]
push eax
call fcn.0059b604
and eax, 0x7f
mov ecx, dword [eax*4 + 0x65c728]
mov edx, 0x80000002
xor eax, eax
call fcn.0059b83c
test eax, eax
jne 0x5f5f17
mov eax, esi
call fcn.00408d1c
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteValueW
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, ebx
call fcn.00408d1c
push eax
call sub.gdi32.dll_RemoveFontResourceW
test eax, eax
je 0x5f5f38
push 0
push 0
push 0x1d
push 0xffff
call sub.user32.dll_SendNotifyMessageW
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x5f5f40
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov edi, ecx
mov esi, edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x5f6089
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x5f60a0
push 0x5f60c8
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.0040f4e8
mov ebx, eax
lea edx, [ebp - 0xc]
movzx eax, byte [ebp - 1]
call fcn.005f2150
test al, al
jne 0x5f5f9f
mov byte [ebp - 2], 0
jmp 0x5f606e
xor eax, eax
push ebp
push 0x5f6067
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x5f5fe3
push 0
mov eax, dword [ebp + 8]
push eax
push edi
lea edx, [ebp - 0x24]
mov eax, esi
call fcn.0059a124
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00599cd0
mov eax, dword [ebp - 0x20]
call fcn.00408d1c
push eax
call ebx
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 2], al
jmp 0x5f6051
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x30]
mov eax, esi
call fcn.0059a124
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
call fcn.0059a210
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.00599cd0
mov eax, dword [ebp - 0x28]
call fcn.00408d1c
push eax
call sub.kernel32.dll_GetDiskFreeSpaceW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 2], al
cmp byte [ebp - 2], 0
je 0x5f6051
mov ecx, edi
mov eax, dword [ebp - 0x14]
imul dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
call fcn.0059d650
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x14]
imul dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
call fcn.0059d650
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f606e
lea eax, [ebp - 0xc]
call fcn.005f2190
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f6090
lea eax, [ebp - 0x30]
mov edx, 5
call fcn.00407cb8
ret

Function at 0x5f627c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, eax
push 2
lea eax, [ebp - 4]
push eax
push 0x20001004
movzx eax, bx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x5f62a0
mov eax, dword [ebp - 4]
jmp 0x5f62a3
or eax, 0xffffffff
pop ebx
pop ecx
pop ebp
ret
Function at 0x5f62a8
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov byte [ebp - 1], dl
mov edi, eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 2], 0
test esi, esi
je 0x5f62f5
xor ebx, ebx
jmp 0x5f62ea
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov eax, esi
call fcn.004214e0
test eax, eax
jne 0x5f62e9
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 2
jmp 0x5f63a0
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x5f62cb
movzx eax, byte [ebp - 1]
sub al, 1
jb 0x5f6301
je 0x5f630a
jmp 0x5f6313
call fcn.0059be50
mov esi, eax
jmp 0x5f6315
call sub.kernel32.dll_GetUserDefaultLangID
mov esi, eax
jmp 0x5f6315
xor esi, esi
test si, si
je 0x5f63a0
xor ebx, ebx
jmp 0x5f633b
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
movzx edx, si
cmp eax, edx
jne 0x5f633a
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x5f63a0
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x5f6322
xor ebx, ebx
jmp 0x5f6395
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
and eax, 0x3ff
mov dx, 0x3ff
and dx, si
movzx edx, dx
cmp eax, edx
jne 0x5f6394
mov ax, 0x3ff
and ax, si
cmp ax, 4
jne 0x5f6389
mov eax, dword [ebp - 8]
movzx eax, word [eax + 0x28]
call fcn.005f627c
push eax
mov eax, esi
call fcn.005f627c
pop edx
cmp edx, eax
jne 0x5f6394
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x5f63a0
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x5f634a
movzx eax, byte [ebp - 2]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4