joyce8/EMBER2024-capa huggingface dataset:
Function at 0x514e08
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x514e1f
add esp, 0xfffffff0
call fcn.005483a0
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0053adf0
mov byte [ebx + 0x28], 0
mov dl, 1
mov eax, dword [0x534564]
call fcn.00548070
mov dword [ebx + 0x80], eax
mov dl, 1
mov eax, dword [0x534564]
call fcn.00548070
mov dword [ebx + 0x98], eax
xor eax, eax
mov dword [ebx + 0x50], eax
xor eax, eax
mov dword [ebx + 0x74], eax
mov dword [ebx + 0x4c], 0x80000018
mov dword [ebx + 0x68], 0x1f4
mov byte [ebx + 0x6c], 1
xor eax, eax
mov dword [ebx + 0x70], eax
mov dword [ebx + 0x64], 0x9c4
mov byte [ebx + 0x78], 0
mov byte [ebx + 0x8d], 1
mov dl, 1
mov eax, dword [0x502590]
call fcn.00509bbc
mov esi, eax
mov dword [ebx + 0x88], esi
push 0x514f94
mov eax, dword [0x59efb4]
mov eax, dword [eax]
push eax
call sub.USER32.DLL_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00509f8c
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5169b8
push 0x100
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x59efb4]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_GetModuleFileNameA
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.USER32.DLL_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0054474c
test eax, eax
je 0x514f12
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.005428f8
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.00544774
test eax, eax
je 0x514f26
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.USER32.DLL_CharLowerA
lea eax, [ebx + 0x7c]
lea edx, [ebp - 0x101]
mov ecx, 0x100
call fcn.00548f2c
mov eax, dword [0x59efbc]
cmp byte [eax], 0
jne 0x514f57
mov eax, ebx
call fcn.00515080
mov byte [ebx + 0x49], 1
mov byte [ebx + 0x4a], 1
mov byte [ebx + 0x4b], 1
mov byte [ebx + 0x8e], 1
xor eax, eax
mov dword [ebx + 0x90], eax
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x514f89
call fcn.005483f8
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5152f0
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x5a81c8]
cmp dword [eax + 0x24], 0
je 0x515393
cmp dword [ebx + 0x84], 0
jne 0x51538d
mov eax, dword [ebx + 0x24]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x515280
call sub.USER32.DLL_EnumWindows
mov eax, dword [ebx + 0x80]
cmp dword [eax + 8], 0
je 0x51538d
push 3
mov eax, dword [esp + 4]
push eax
call sub.USER32.DLL_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.USER32.DLL_GetWindowLongA
test al, 8
je 0x515356
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x80]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x51538d
Function at 0x515da0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x94], 0
je 0x515dd5
push 0x100
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x24]
push eax
call sub.USER32.DLL_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00548de4
jmp 0x515ddf
mov eax, esi
mov edx, dword [ebx + 0x7c]
call fcn.00548d50
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x516d2c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x74]
test esi, esi
je 0x516d64
mov eax, esi
call fcn.00526584
test al, al
je 0x516d64
mov eax, dword [ebx + 0x74]
call fcn.00526288
push eax
call sub.USER32.DLL_IsWindowVisible
test eax, eax
je 0x516d64
push 0
mov eax, dword [ebx + 0x74]
call fcn.00526288
push eax
call sub.USER32.DLL_ShowWindow
pop esi
pop ebx
ret

Function at 0x51df4c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
push 0x11
call sub.USER32.DLL_GetKeyState
test ax, 0x8000
setne al
cmp dword [0x5a8264], 0
sete dl
or al, dl
jne 0x51e08c
mov eax, dword [0x5a8268]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x5a8264]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x51e05b
inc esi
xor edi, edi
mov edx, edi
mov eax, dword [0x5a8264]
call fcn.00535c98
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x51e053
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x168], 0
je 0x51e053
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x4c]
test al, al
je 0x51e053
mov eax, dword [ebp - 0x14]
call fcn.00526288
push eax
call sub.USER32.DLL_IsWindowVisible
test eax, eax
je 0x51e053
push ebp
call fcn.0051df08
pop ecx
test al, al
jne 0x51e053
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x90]
cmp eax, dword [ebp - 0x14]
jne 0x51e00f
mov eax, dword [ebp - 0x14]
call fcn.00524c14
dec eax
jle 0x51e053
mov byte [ebp - 1], 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov bx, 0xffc1
call fcn.0054827c
cmp byte [ebp - 1], 0
je 0x51e053
push dword [ebp - 8]
push dword [ebp - 0xc]
lea eax, [ebp - 0x28]
push eax
call sub.USER32.DLL_PtInRect
test eax, eax
je 0x51e053
mov edx, dword [ebp - 0x14]
mov eax, dword [0x5a8268]
call fcn.0051d754
inc edi
dec esi
jne 0x51dfa2
mov eax, dword [0x5a8268]
cmp dword [eax + 8], 0
jle 0x51e073
mov eax, dword [0x5a8268]
call fcn.0051d7e4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x51e08c
push ebp
mov eax, dword [ebp - 0x18]
call fcn.0051dd70
pop ecx
test al, al
jne 0x51e08c
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x523c20
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov eax, dword [esi]
cmp eax, 0x84
jg 0x523c51
je 0x523cab
sub eax, 7
je 0x523c72
dec eax
je 0x523c9c
sub eax, 0x17
je 0x523d50
jmp 0x523d8e
add eax, 0xffffff00
sub eax, 9
jb 0x523d3c
add eax, 0xffffff09
sub eax, 0xb
jb 0x523d04
jmp 0x523d8e
mov eax, ebx
call fcn.0050d9ec
mov edi, eax
test edi, edi
je 0x523dee
mov edx, ebx
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xd4]
test al, al
je 0x523df7
jmp 0x523dee
test byte [ebx + 0x44], 0x20
jne 0x523df7
jmp 0x523dee
mov edx, esi
mov eax, ebx
call fcn.00521220
cmp dword [esi + 0xc], 0xffffffff
jne 0x523df7
push 0
lea edx, [ebp - 0x120]
mov eax, dword [esi + 8]
call fcn.0053ebfc
lea edx, [ebp - 0x120]
lea ecx, [ebp - 0x118]
mov eax, ebx
call fcn.0051fd54
lea edx, [ebp - 0x118]
xor ecx, ecx
mov eax, ebx
call fcn.00523af8
test eax, eax
je 0x523df7
mov dword [esi + 0xc], 1
jmp 0x523df7
mov edx, esi
mov eax, ebx
call fcn.00523b8c
test al, al
je 0x523dee
cmp dword [esi + 0xc], 0
jne 0x523df7
mov eax, dword [esi + 8]
push eax
mov eax, dword [esi + 4]
push eax
mov eax, dword [esi]
push eax
mov eax, ebx
call fcn.00526288
push eax
call sub.USER32.DLL_DefWindowProcA
jmp 0x523df7
mov eax, ebx
call fcn.005208bc
test al, al
jne 0x523df7
jmp 0x523dee
mov eax, ebx
call fcn.00526288
mov edi, eax
call sub.USER32.DLL_GetCapture
cmp edi, eax
jne 0x523dee
cmp dword [0x599c5c], 0
je 0x523dee
mov eax, dword [0x599c5c]
cmp ebx, dword [eax + 0x24]
jne 0x523dee
push 0
xor ecx, ecx
mov edx, 0x1f
mov eax, dword [0x599c5c]
call fcn.00521154
jmp 0x523dee
mov eax, dword [0x5a822c]
cmp byte [eax + 0x20], 0
je 0x523dee
mov eax, dword [0x5a822c]
cmp dword [eax + 0x1c], 0
je 0x523dee
mov eax, dword [esi]
mov edx, dword [0x5a822c]
cmp eax, dword [edx + 0x1c]
jne 0x523dee
lea eax, [ebp - 0x110]
push eax
call sub.USER32.DLL_GetKeyboardState
mov eax, dword [esi]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x110]
call fcn.0050d930
mov byte [ebp - 0xc], al
mov ax, word [esi + 4]
mov word [ebp - 0xa], ax
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, ebx
mov bx, 0xffb7
call fcn.0054827c
jmp 0x523df7
mov edx, esi
mov eax, ebx
call fcn.00521220
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5242b8
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1e8], 0
je 0x5242d4
cmp dword [esi + 4], 0
je 0x524301
test byte [ebx + 0x45], 1
jne 0x5242f3
mov eax, ebx
call fcn.005231f0
test eax, eax
jne 0x5242f3
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x524411
mov edx, esi
mov eax, ebx
call fcn.00523f30
jmp 0x524411
push 0
call sub.USER32.DLL_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.GDI32.DLL_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.USER32.DLL_ReleaseDC
push 0
call sub.GDI32.DLL_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x52440a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00526288
push eax
call sub.USER32.DLL_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.00521154
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.005242b8
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.GDI32.DLL_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00526288
push eax
call sub.USER32.DLL_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x524411
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.DLL_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x543464
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x54349d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00548de4
jmp 0x5434a6
mov eax, ebx
mov edx, esi
call fcn.00548d50
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x5434b0
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x5434d1
mov al, byte [esp]
jmp 0x5434d3
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x547b98
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x547bc7
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00548de4
jmp 0x547be5
call sub.KERNEL32.DLL_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.00547b20
mov edi, eax
test ebx, ebx
je 0x547be5
cmp dword [esi], 0
je 0x547be5
dec ebx
jmp 0x547bce
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x547f18
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x59a0ac]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x547fb0
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x547f90
xor eax, eax
push ebp
push 0x547f89
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x547fcc
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x547f90
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov ax, word [0x59a0ac]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x59a0ac], ax
mov esp, ebp
pop ebp
ret

Function at 0x548cb0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00547954
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x5a857d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x548c78
push eax
push esi
push ebx
call sub.KERNEL32.DLL_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x54a5f8
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x54a7b4
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x54a659
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x54a7d0
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x54a6cb
xor eax, eax
push ebp
push fcn.0054a6c4
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
call fcn.0054a450
push eax
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x54a6ad
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x54a7f0
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54a6cb
invalid
inc ebp
Function at 0x54aba0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
push ebp
push 0x54ac88
push dword fs:[eax]
mov dword fs:[eax], esp
sub dword [0x5a8960], 1
jae 0x54ac7a
xor eax, eax
mov dword [0x5a856c], eax
xor eax, eax
mov dword [0x5a8574], eax
xor eax, eax
mov dword [0x5a8578], eax
mov byte [0x5a857e], 2
mov byte [0x5a857f], 2
mov byte [0x5a8580], 3
mov word [0x5a8928], 0
mov word [0x5a8938], 1
mov word [0x5a8948], 0xa
mov dword [0x5a8950], 0x80020004
mov dword [0x5a891c], 0x549a34
mov dword [0x5a8920], 0x549a2c
mov dword [0x5a8924], 0x549a34
call fcn.00547ee8
test al, al
je 0x54ac39
call fcn.00547f18
call fcn.00547fdc
mov eax, 0x5a8584
mov edx, 0x54ac94
call fcn.0054566a
mov eax, 0x5a8750
mov edx, 0x54ac94
call fcn.0054566a
call sub.KERNEL32.DLL_GetCommandLineA
mov dword [0x5a8564], eax
call fcn.00546610
mov dword [0x5a8560], eax
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [0x5a8558], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54ac8f
ret

Function at 0x54d000
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x54d01c
call fcn.0054e51c
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x54d038
test bl, 1
je 0x54d038
call fcn.00554bf4
mov dword [eax], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x54d21c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.0054e0b8
test byte [ebp + 0xd], 0xc0
jne 0x54d240
mov eax, dword [0x59b06c]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x54d24d
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x54d27a
je 0x54d28c
sub ecx, 0x100
je 0x54d29a
sub ecx, 0x100
je 0x54d2a1
sub ecx, 0x100
je 0x54d293
jmp 0x54d2a8
sub ecx, 0x600
je 0x54d2a1
sub ecx, 0x100
je 0x54d28c
jmp 0x54d2a8
mov edi, 1
jmp 0x54d2ad
mov edi, 2
jmp 0x54d2ad
mov edi, 4
jmp 0x54d2ad
mov edi, 5
jmp 0x54d2ad
mov edi, 3
test byte [ebp + 0xd], 1
je 0x54d2d4
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x59aae4]
test al, 0x80
je 0x54d2cd
mov ebx, 0x80
jmp 0x54d2e6
mov ebx, 1
jmp 0x54d2e6
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x54d2e6
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x54d2f8
je 0x54d301
dec eax
je 0x54d30a
jmp 0x54d313
mov dword [ebp - 4], 0x80000000
jmp 0x54d322
mov dword [ebp - 4], 0x40000000
jmp 0x54d322
mov dword [ebp - 4], 0xc0000000
jmp 0x54d322
push 1
call fcn.0054e4b0
pop ecx
mov ebx, eax
jmp 0x54d412
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x54d33e
sub eax, 0x10
je 0x54d345
sub eax, 0x10
je 0x54d34e
sub eax, 0x10
je 0x54d357
jmp 0x54d357
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x54d35e
mov dword [ebp - 8], 1
jmp 0x54d35e
mov dword [ebp - 8], 2
jmp 0x54d35e
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x54d3cb
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x54d3c0
test byte [ebp + 0xd], 1
je 0x54d3bb
mov ebx, 0x50
jmp 0x54d3c0
mov ebx, 2
push ebx
call fcn.0054e4b0
pop ecx
mov ebx, eax
jmp 0x54d412
mov edi, esi
push edi
call fcn.0054d180
pop ecx
test eax, eax
je 0x54d3df
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x54d3eb
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.0054e1d8
add esp, 8
mov ebx, eax
inc eax
jne 0x54d412
push 4
call fcn.0054e4b0
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
call fcn.0054e0ec
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5518f8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea eax, [ebp - 0x200]
push eax
push 0x1001
mov edx, dword [ebx + 4]
push edx
call sub.KERNEL32.DLL_GetLocaleInfoA
push str._._n
lea ecx, [ebp - 0x200]
push ecx
call fcn.0054bddc
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.0054be6c
pop ecx
mov edx, pe_nt_image_headers32
sub edx, eax
push edx
lea ecx, [ebp - 0x200]
push ecx
call fcn.0054be6c
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
push 0x1002
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
push 0x59bc8d
lea ecx, [ebp - 0x200]
push ecx
call fcn.0054bddc
add esp, 8
push 0xa
lea eax, [ebp - 0x200]
push eax
call fcn.0054be6c
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
mov ecx, dword [ebx]
push ecx
call fcn.00552a94
add esp, 0xc
cmp dword [ebx + 0x24], 0
jne 0x551a09
push esi
call fcn.0054be6c
pop ecx
mov edi, eax
lea eax, [ebp - 0x200]
push eax
call fcn.0054be6c
pop ecx
add edi, eax
add edi, 3
push edi
call fcn.0054b858
pop ecx
mov edi, eax
mov dword [ebx + 0x24], edi
test edi, edi
jne 0x5519e0
xor eax, eax
jmp 0x551a90
push esi
call fcn.0054be6c
pop ecx
push eax
lea edx, [ebp - 0x200]
push edx
call fcn.0054be6c
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push 0
push edi
call fcn.0054bd38
add esp, 0xc
jmp 0x551a49
mov edi, dword [ebx + 0x24]
push edi
call fcn.0054be6c
pop ecx
push eax
push esi
call fcn.0054be6c
pop ecx
pop edx
add edx, eax
push edx
lea eax, [ebp - 0x200]
push eax
call fcn.0054be6c
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push edi
call fcn.0054b878
add esp, 8
mov dword [ebx + 0x24], eax
cmp dword [ebx + 0x24], 0
jne 0x551a49
xor eax, eax
jmp 0x551a90
push esi
mov edx, dword [ebx + 0x24]
push edx
call fcn.0054bddc
add esp, 8
push 0x59bc8f
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.0054bddc
add esp, 8
lea eax, [ebp - 0x200]
push eax
mov edx, dword [ebx + 0x24]
push edx
call fcn.0054bddc
add esp, 8
push 0x59bc91
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.0054bddc
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x554b8c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x554bee
call fcn.00554b3c
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.0054be6c
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.0054be6c
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x554c6c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x59c320], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x554d46
cmp dword [0x59c31c], 0
jne 0x554d46
cmp dword [0x59c520], 0
je 0x554d00
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.00554a3c
add esp, 8
mov ebx, eax
test eax, eax
jne 0x554ce6
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.00554a3c
add esp, 8
mov ebx, eax
test eax, eax
jne 0x554ce6
invalid

Function at 0x55c940
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x55c96e
mov eax, ebx
call fcn.0055d3e4
cmp dword [ebx + 0x3c], 0
je 0x55c967
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x55c9df
mov edx, dword [ebx + 0x1a6]
cmp dword [edx + 0x10], 0
je 0x55c9d1
cmp dword [ebx + 8], 0
je 0x55c990
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1a6]
call dword [edx]
test eax, eax
jne 0x55c9a2
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x55c9d1
cmp dword [ebx + 8], 0
je 0x55c983
cmp eax, 3
je 0x55c9b5
dec eax
jne 0x55c983
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x55c983
mov edx, dword [ebx + 0x132]
add dword [eax + 8], edx
jmp 0x55c983
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x55c9fd
cmp dword [ebx + 0x10], 0xcc
je 0x55c9fd
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0055ca08
pop ebx
ret