joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51320c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x51323d
dec al
je 0x513278
dec al
je 0x5132bd
dec al
je 0x513326
jmp 0x5133b0
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x5133b0
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x51324d
jmp 0x5133b0
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5133b0
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x513288
jmp 0x5133b0
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5133b0
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x5132ec
xor ebp, ebp
jmp 0x5132fc
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x513305
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x5132cd
jmp 0x5133b0
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5133b0
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x51337f
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.0051029c
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x51333a
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x51e1c0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x51e211
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x51e1f8
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x51e1e8
jmp 0x51e211
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x51e1f9
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x537648
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
mov dword [ebp - 4], edx
mov dword [ebp - 0x2c], eax
mov eax, 0x5d09ec
call fcn.005ae2c8
mov dword [ebp - 0xc], 1
lea edx, [ebp - 4]
lea eax, [ebp - 4]
call fcn.005bbcf4
inc dword [ebp - 0xc]
mov word [ebp - 0x18], 0xc
xor edx, edx
mov dword [ebp - 0x30], edx
xor ecx, ecx
mov dword [ebp - 0x34], ecx
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
cmp dword [ebp - 4], 0
je 0x5376a0
mov eax, dword [ebp - 4]
jmp 0x5376a5
mov eax, 0x5cfc44
push eax
call sub.KERNEL32.DLL_CreateFileW
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xffffffff
jne 0x5376dc
push dword [ebp - 0x34]
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
push eax
dec dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 2
call fcn.005bbe44
pop eax
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
jmp 0x537710
push 0
push dword [ebp - 0x34]
call sub.KERNEL32.DLL_GetFileSize
mov dword [ebp - 0x30], eax
push dword [ebp - 0x34]
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 0x30]
push eax
dec dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 2
call fcn.005bbe44
pop eax
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
mov esp, ebp
pop ebp
ret

Function at 0x539410
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd4
push esi
push edi
mov eax, 0x5d11d0
call fcn.005ae2c8
mov esi, 0x5cf58c
lea edi, [ebp - 0x42c]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
mov word [ebp - 0x1c], 0x18
mov edx, str.DOCUMENTS
lea eax, [ebp - 4]
call fcn.005bbcb4
inc dword [ebp - 0x10]
lea edx, [ebp - 4]
mov eax, dword [ebp + 8]
add eax, 0xb4
call fcn.005bbe6c
dec dword [ebp - 0x10]
lea eax, [ebp - 4]
mov edx, 2
call fcn.005bbe44
push 1
push 5
lea ecx, [ebp - 0x42c]
push ecx
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderPathA
mov word [ebp - 0x1c], 0x24
lea edx, [ebp - 0x42c]
lea eax, [ebp - 8]
call fcn.005bbcb4
inc dword [ebp - 0x10]
lea edx, [ebp - 8]
mov eax, dword [ebp + 8]
add eax, 0xb8
call fcn.005bbe6c
dec dword [ebp - 0x10]
lea eax, [ebp - 8]
mov edx, 2
call fcn.005bbe44
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xbc], 0x18
mov eax, dword [ebp - 0x2c]
mov dword fs:[0], eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x539690
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
mov dword [ebp - 4], ecx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], eax
mov eax, 0x5d12d0
call fcn.005ae2c8
mov dword [ebp - 0xc], 1
lea edx, [ebp - 4]
lea eax, [ebp - 4]
call fcn.005bbcf4
inc dword [ebp - 0xc]
mov word [ebp - 0x18], 0xc
push 1
push 0
push 0
cmp dword [ebp - 4], 0
je 0x5396d5
mov edx, dword [ebp - 4]
jmp 0x5396da
mov edx, 0x5cfd6c
push edx
push 0x5cfd62
mov eax, dword [0x5e7530]
mov ecx, dword [eax]
push dword [ecx + 0x170]
call sub.SHELL32.DLL_ShellExecuteW
dec dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 2
call fcn.005bbe44
mov ecx, dword [ebp - 0x28]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x53ac2c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d8
push esi
push edi
mov eax, 0x5d242c
call fcn.005ae2c8
mov dword [ebp - 0xc], 1
lea edx, [ebp + 0xc]
lea eax, [ebp + 0xc]
call fcn.005bbcf4
inc dword [ebp - 0xc]
mov word [ebp - 0x18], 0xc
mov esi, 0x5d1a38
lea edi, [ebp - 0x828]
mov ecx, pe_nt_image_headers32
rep movsd dword es:[edi], dword [esi]
push 0x400
lea eax, [ebp - 0x828]
push eax
cmp dword [ebp + 0xc], 0
je 0x53ac85
mov edx, dword [ebp + 0xc]
jmp 0x53ac8a
mov edx, 0x5d226e
push edx
call sub.KERNEL32.DLL_ExpandEnvironmentStringsW
mov word [ebp - 0x18], 0x24
lea edx, [ebp - 0x828]
lea eax, [ebp - 4]
call fcn.005bbde0
inc dword [ebp - 0xc]
lea edx, [ebp - 4]
mov eax, dword [ebp + 8]
call fcn.005bbe6c
mov eax, dword [ebp + 8]
mov word [ebp - 0x18], 0x30
push eax
dec dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 2
call fcn.005bbe44
dec dword [ebp - 0xc]
lea eax, [ebp + 0xc]
mov edx, 2
call fcn.005bbe44
pop eax
mov word [ebp - 0x18], 0x24
inc dword [ebp - 0xc]
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x53e6e4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
mov dword [ebp - 4], ecx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], eax
mov eax, 0x5d3504
call fcn.005ae2c8
mov dword [ebp - 0xc], 1
lea edx, [ebp - 4]
lea eax, [ebp - 4]
call fcn.005bbcf4
inc dword [ebp - 0xc]
mov word [ebp - 0x18], 0xc
push 1
push 0
push 0
cmp dword [ebp - 4], 0
je 0x53e729
mov edx, dword [ebp - 4]
jmp 0x53e72e
mov edx, 0x5d2b08
push edx
push 0x5d2afe
mov eax, dword [0x5e7530]
mov ecx, dword [eax]
push dword [ecx + 0x170]
call sub.SHELL32.DLL_ShellExecuteW
dec dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 2
call fcn.005bbe44
mov ecx, dword [ebp - 0x28]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x556418
Capabilities:
Create process on windows
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
mov dword [ebp - 0x40], eax
mov eax, 0x5db300
call fcn.005ae2c8
mov eax, dword [ebp - 0x40]
call sym.default.exe__TWMAction_rActionManager_qqrv
cmp dword [eax + 0x88], 0x11
jne 0x556588
mov word [ebp - 0x2c], 0xc
mov eax, dword [ebp - 0x40]
call sym.default.exe__TWMAction_rActionManager_qqrv
xor edx, edx
mov dword [ebp - 4], edx
lea edx, [ebp - 4]
inc dword [ebp - 0x20]
call sym.default.exe__TWMActionManager_rGamePath_qqrv
lea eax, [ebp - 4]
push eax
mov edx, str.editmaterialsMafiaIIMaterialsMerger.exe
lea eax, [ebp - 8]
call fcn.005bbcb4
inc dword [ebp - 0x20]
lea edx, [ebp - 8]
xor eax, eax
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0xc]
inc dword [ebp - 0x20]
pop eax
call fcn.005bbe94
lea eax, [ebp - 0xc]
mov eax, dword [eax]
mov dl, 1
call fcn.00468c4c
test al, al
je 0x5564a2
mov ecx, dword [ebp - 0x40]
cmp byte [ecx + 0x8a2], 0
jne 0x5564a6
xor eax, eax
jmp 0x5564ab
mov eax, 1
push eax
dec dword [ebp - 0x20]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.005bbe44
dec dword [ebp - 0x20]
lea eax, [ebp - 8]
mov edx, 2
call fcn.005bbe44
dec dword [ebp - 0x20]
lea eax, [ebp - 4]
mov edx, 2
call fcn.005bbe44
pop ecx
test cl, cl
je 0x556588
mov word [ebp - 0x2c], 0x18
mov eax, dword [ebp - 0x40]
call sym.default.exe__TWMAction_rActionManager_qqrv
xor edx, edx
mov dword [ebp - 0x10], edx
lea edx, [ebp - 0x10]
inc dword [ebp - 0x20]
call sym.default.exe__TWMActionManager_rGamePath_qqrv
lea eax, [ebp - 0x10]
push eax
mov edx, str.editmaterials
lea eax, [ebp - 0x14]
call fcn.005bbcb4
inc dword [ebp - 0x20]
lea edx, [ebp - 0x14]
xor eax, eax
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x18]
inc dword [ebp - 0x20]
pop eax
call fcn.005bbe94
cmp dword [ebp - 0x18], 0
je 0x556536
mov edx, dword [ebp - 0x18]
jmp 0x55653b
mov edx, 0x5d9650
push edx
call sub.KERNEL32.DLL_SetCurrentDirectoryW
dec dword [ebp - 0x20]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.005bbe44
dec dword [ebp - 0x20]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.005bbe44
dec dword [ebp - 0x20]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.005bbe44
push 1
push 0
push 0
push str.MafiaIIMaterialsMerger.exe
push str.open
push 0
call sub.SHELL32.DLL_ShellExecuteW
mov eax, dword [ebp - 0x3c]
mov dword fs:[0], eax
mov esp, ebp
pop ebp
ret
Function at 0x55b990
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x60], 0
jne 0x55ba81
mov edx, dword [ebp - 4]
cmp word [edx + 0x4a], 0
je 0x55ba16
mov ecx, dword [ebp - 4]
add ecx, 0x48
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0xd]
mov ebx, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 4]
call dword [ebx]
movsx edx, byte [ebp - 0xd]
dec edx
jne 0x55b9ee
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x58]
call fcn.004cbc1c
mov edx, dword [ebp - 0xc]
mov byte [edx], 0
jmp 0x55ba81
movsx ecx, byte [ebp - 0xd]
cmp ecx, 3
jne 0x55ba81
push 6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x58]
call fcn.004ee420
push eax
call sub.USER32.DLL_ShowWindow
mov edx, dword [ebp - 0xc]
mov byte [edx], 0
jmp 0x55ba81
mov ecx, dword [ebp - 4]
cmp byte [ecx + 0x54], 0
je 0x55ba81
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x58]
xor ecx, ecx
mov cl, byte [edx + 0x341]
test ecx, ecx
jle 0x55ba39
mov eax, dword [ebp - 0xc]
mov byte [eax], 0
jmp 0x55ba60
mov edx, dword [ebp - 0xc]
mov byte [edx], 2
mov ecx, dword [ebp - 4]
cmp word [ecx + 0x42], 0
je 0x55ba60
mov eax, dword [ebp - 4]
add eax, 0x40
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 4]
mov ebx, dword [ebp - 0x18]
mov edx, dword [ebp - 8]
call dword [ebx]
mov dl, 0xff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x58]
call fcn.004cc654
mov edx, dword [ebp - 4]
mov byte [edx + 0x55], 0
mov dl, 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50]
call fcn.004d483c
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x56f818
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
xor eax, eax
mov ecx, edx
test ecx, ecx
je 0x56f827
sub ecx, 4
mov ecx, dword [ecx]
test ecx, ecx
jle 0x56f848
mov ebx, 1
mov esi, eax
add esi, esi
add esi, esi
shr eax, 0x1e
or esi, eax
movzx eax, word [edx + ebx*2 - 2]
xor esi, eax
mov eax, esi
inc ebx
dec ecx
jne 0x56f830
pop esi
pop ebx
ret

Function at 0x570b9c
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebx + 4]
call fcn.004857f8
push eax
push 0x800
lea eax, [ebp - 0x1000]
push eax
mov eax, dword [ebp + 0xc]
call fcn.004857f8
push eax
mov eax, edi
call fcn.004857f8
push eax
mov eax, esi
call fcn.004857f8
push eax
call sub.KERNEL32.DLL_GetPrivateProfileStringW
mov ecx, eax
lea edx, [ebp - 0x1000]
mov eax, dword [ebp + 8]
call fcn.00484b1c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x570c68
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x570ddb
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x570db0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x8000
call fcn.00482378
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
call fcn.00433070
xor eax, eax
push ebp
push 0x570d93
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [esi + 4]
call fcn.004857f8
push eax
push 0x4000
mov eax, dword [ebp - 0x10]
push eax
push 0
push 0
push 0
call sub.KERNEL32.DLL_GetPrivateProfileStringW
mov ebx, eax
cmp ebx, 0x3ffe
jne 0x570d4d
lea edx, [ebp - 4]
mov eax, dword [esi + 4]
call fcn.00417ccc
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0047246c
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.00472b44
mov ebx, eax
mov edx, 1
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov edx, eax
imul edx, ebx
lea eax, [ebp - 0x10]
call fcn.004823ac
mov eax, dword [esi + 4]
call fcn.004857f8
push eax
push ebx
mov eax, dword [ebp - 0x10]
push eax
push 0
push 0
push 0
call sub.KERNEL32.DLL_GetPrivateProfileStringW
mov ebx, eax
test ebx, ebx
je 0x570d7d
mov ebx, dword [ebp - 0x10]
jmp 0x570d77
lea eax, [ebp - 0x14]
mov edx, ebx
call fcn.00485848
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, ebx
call fcn.00469518
inc eax
add eax, eax
add ebx, eax
cmp word [ebx], 0
jne 0x570d56
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x570d9a
mov eax, dword [ebp - 8]
call fcn.00433138
ret

Function at 0x570ea8
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 4], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], 0x400
mov eax, dword [ebp - 0x1c]
add eax, eax
call fcn.00482378
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x570f34
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 4]
call fcn.004857f8
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
mov eax, dword [ebp - 0x18]
call fcn.004857f8
push eax
call sub.KERNEL32.DLL_GetPrivateProfileStringW
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
sub eax, 2
cmp eax, dword [ebp - 8]
jle 0x570f1b
push ebp
call fcn.00570de8
pop ecx
call fcn.00484290
jmp 0x570f4a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x570f3b
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.00482394
ret
mov esp, ebp
pop ebp
ret
Function at 0x58a598
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x58a6c0
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, word [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.0058a484
mov eax, dword [esi]
call fcn.004869a0
add eax, 0x28
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x58ab68]
call fcn.00486b68
add esp, 4
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1c]
mov ecx, 0x1c
call fcn.004825cc
mov ebx, 0x1c
mov eax, dword [ebp - 4]
lea edx, [eax + ebx]
lea eax, [ebp - 0x2c]
mov ecx, 0x1c
call fcn.004825cc
add ebx, 0x1c
mov eax, dword [esi]
call fcn.004869a0
mov dword [ebp - 0xc], eax
mov eax, dword [0x5e7694]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
lea edx, [ebp - 4]
mov ecx, ebx
call fcn.0058ecac
add ebx, 4
mov eax, dword [ebp - 4]
add eax, ebx
xor ecx, ecx
mov edx, 3
call fcn.004829f4
add ebx, 3
mov eax, dword [ebp - 4]
mov byte [eax + ebx], 0x3a
inc ebx
mov eax, dword [esi]
mov byte [eax + 2], 0
mov eax, dword [esi]
mov byte [eax + 3], 0
push ebx
mov eax, dword [esi]
call fcn.004869a0
push eax
lea ecx, [ebp - 4]
mov eax, dword [esi]
xor edx, edx
call fcn.0058ec88
mov edx, dword [ebp - 4]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x94]
mov ebx, eax
mov eax, ebx
call fcn.0058ebc0
mov edx, esi
mov ecx, dword [ebp + 0x10]
call fcn.0058eca4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58a6c7
lea eax, [ebp - 4]
mov edx, dword [0x58ab68]
call fcn.00486c8c
ret

Function at 0x5a1f7c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5a2012
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5e7214]
cmp dword [eax], 2
jne 0x5a1fbc
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push edi
push esi
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExW
mov ebx, eax
jmp 0x5a1ff4
lea eax, [ebp - 8]
mov edx, esi
call fcn.0048551c
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, 0
call fcn.00485138
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push edi
mov eax, dword [ebp - 4]
call fcn.004852f0
push eax
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a2019
lea eax, [ebp - 8]
call fcn.004849dc
lea eax, [ebp - 4]
call fcn.004849b8
ret
Function at 0x5a2444
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esi], eax
xor eax, eax
mov dword [ebp - 8], eax
push 0x20019
lea eax, [ebp - 8]
push eax
mov eax, edi
call fcn.004857f8
mov edx, eax
mov eax, ebx
call fcn.005a1de8
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.005a1ec4
test eax, eax
sete al
mov ebx, eax
test bl, bl
je 0x5a24b6
push 0
push 0
push esi
push 0
mov eax, dword [ebp - 4]
call fcn.004857f8
push eax
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExW
test eax, eax
sete bl
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x5a5ae4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor edx, edx
mov dword [ebp - 0x14], edx
xor edx, edx
push ebp
push 0x5a5b48
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 0xe]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoW
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xe]
mov ecx, 7
call fcn.0048589c
mov eax, dword [ebp - 0x14]
push eax
call sub.KERNEL32.DLL_GetACP
mov edx, eax
pop eax
call fcn.00468708
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a5b4f
lea eax, [ebp - 0x14]
call fcn.00484994
ret
Function at 0x5a685c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5a6ab6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
mov edx, 0x24
call fcn.005a5e18
lea eax, [ebp - 0x28]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov eax, dword [ebp - 0x14]
mov dword [0x5e2a84], eax
mov eax, dword [ebp - 0xc]
mov dword [0x5e2a88], eax
mov eax, dword [ebp - 0x24]
mov dword [0x5e2a8c], eax
mov eax, dword [0x5e7214]
cmp dword [eax], 2
sete byte [0x5e221c]
push 0x5a6ac4
call sub.KERNEL32.DLL_GetModuleHandleW
lea edx, [ebp - 4]
call fcn.005a7a84
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp byte [0x5e221c], 0
jne 0x5a68eb
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.005a7c98
test al, al
je 0x5a68eb
mov eax, dword [ebp - 0x4c]
mov dword [0x5eec18], eax
jmp 0x5a68f2
xor eax, eax
mov dword [0x5eec18], eax
call fcn.005a5efc
and eax, 0x7f
cmp eax, 0x1a
ja case.0x5a6903.0
jmp dword [eax*4 + 0x5a690a]
mov byte [0x5e2208], 1
jmp case.0x5a6903.0
mov byte [0x5e220c], 1
jmp case.0x5a6903.0
mov byte [0x5e2210], 1
jmp case.0x5a6903.0
mov byte [0x5e2214], 1
jmp case.0x5a6903.0
mov byte [0x5e2218], 1
jmp case.0x5a6903.0
mov byte [0x5e2220], 1
mov byte [0x5e2224], 1
jmp case.0x5a6903.0
mov byte [0x5e2220], 1
mov byte [0x5e2228], 1
jmp case.0x5a6903.0
mov byte [0x5e2220], 1
mov byte [0x5e2228], 1
mov byte [0x5e222c], 1
jmp case.0x5a6903.0
mov byte [0x5e2230], 1
jmp case.0x5a6903.0
mov byte [0x5e2234], 1
jmp case.0x5a6903.0
mov byte [0x5e2238], 1
jmp case.0x5a6903.0
mov byte [0x5e223c], 1
jmp case.0x5a6903.0
mov byte [0x5e2240], 1
jmp case.0x5a6903.0
mov byte [0x5e2244], 1
jmp case.0x5a6903.0
mov byte [0x5e2248], 1
jmp case.0x5a6903.0
mov byte [0x5e224c], 1
jmp case.0x5a6903.0
mov byte [0x5e2250], 1
jmp case.0x5a6903.0
mov byte [0x5e2254], 1
jmp case.0x5a6903.0
mov byte [0x5e2258], 1
jmp case.0x5a6903.0
mov byte [0x5e225c], 1
jmp case.0x5a6903.0
mov byte [0x5e2260], 1
jmp case.0x5a6903.0
mov byte [0x5e2264], 1
jmp case.0x5a6903.0
mov byte [0x5e2268], 1
jmp case.0x5a6903.0
mov byte [0x5e226c], 1
jmp case.0x5a6903.0
mov byte [0x5e2270], 1
jmp case.0x5a6903.0
mov byte [0x5e2274], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a6abd
lea eax, [ebp - 4]
call fcn.00484994
ret