joyce8/EMBER2024-capa huggingface dataset:
Function at 0x550960
Capabilities:
Create thread
Inject thread

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffdc
mov ebx, ecx
mov edi, edx
mov dword [esp], eax
mov byte [esp + 4], 0
mov al, 1
call fcn.005508c0
mov eax, edi
call fcn.00405274
add eax, eax
inc eax
call fcn.00402bb8
mov esi, eax
mov eax, edi
call fcn.00405274
mov ecx, eax
add ecx, ecx
inc ecx
mov edx, esi
mov eax, edi
call fcn.00406038
test ebx, ebx
jbe 0x5509aa
mov dword [esp + 8], ebx
jmp 0x5509b8
lea ecx, [esp + 8]
xor edx, edx
mov eax, dword [esp]
call fcn.00550784
cmp dword [esp + 8], 0
je 0x5509cc
mov eax, dword [esp + 8]
call fcn.0054a148
test al, al
je 0x5509d8
mov eax, esi
call fcn.00402be8
jmp 0x550b27
mov eax, dword [esp + 8]
push eax
push 0
push 0x2a
call sub.KERNEL32.DLL_OpenProcess
mov ebx, eax
push esi
call sub.KERNEL32.DLL_lstrlenW
inc eax
mov edi, eax
add edi, edi
push 4
push 0x1000
push edi
push 0
push ebx
call sub.KERNEL32.DLL_VirtualAllocEx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
push edi
push esi
mov eax, dword [esp + 0x18]
push eax
push ebx
call sub.KERNEL32.DLL_WriteProcessMemory
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x550a6f
push 0x550b34
push 0x550b48
call sub.KERNEL32.DLL_GetModuleHandleA_1
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x24]
push eax
push 0
push 0
push ebx
call sub.KERNEL32.DLL_CreateRemoteThread
mov dword [esp + 0x20], eax
cmp dword [esp + 0x20], 0
je 0x550af4
push 0xffffffffffffffff
mov eax, dword [esp + 0x24]
push eax
call sub.KERNEL32.DLL_WaitForSingleObject
xor eax, eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x24]
push eax
call sub.KERNEL32.DLL_GetExitCodeThread
push 0x550b54
push 0x550b48
call sub.KERNEL32.DLL_GetModuleHandleA_1
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
push 0
mov eax, dword [esp + 0x24]
push eax
mov eax, dword [esp + 0x24]
push eax
push 0
push 0
push ebx
call sub.KERNEL32.DLL_CreateRemoteThread
mov ebp, eax
push 0xffffffffffffffff
push ebp
call sub.KERNEL32.DLL_WaitForSingleObject
xor eax, eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push eax
push ebp
call sub.KERNEL32.DLL_GetExitCodeThread
mov eax, dword [esp + 0x1c]
mov byte [esp + 4], al
mov eax, esi
call fcn.00402be8
cmp dword [esp + 0x10], 0
je 0x550b13
push 0x4000
push edi
mov eax, dword [esp + 0x18]
push eax
push ebx
call sub.KERNEL32.DLL_VirtualFreeEx
test ebp, ebp
je 0x550b1d
push ebp
call sub.KERNEL32.DLL_CloseHandle
test ebx, ebx
je 0x550b27
push ebx
call sub.KERNEL32.DLL_CloseHandle
mov al, byte [esp + 4]
add esp, 0x24
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x553fe0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405464
xor eax, eax
push ebp
push 0x554039
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 4]
call fcn.00405474
mov esi, eax
push esi
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, 2
je 0x554021
push esi
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, 5
jne 0x554023
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x554040
lea eax, [ebp - 4]
call fcn.00404fb4
ret

Function at 0x554048
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405464
xor eax, eax
push ebp
push 0x5540ac
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xe
lea eax, [ebp - 0x1a]
push eax
mov eax, dword [ebp - 4]
call fcn.00405474
push eax
call sub.KERNEL32.DLL_GetVolumeInformationA
mov edx, ebx
lea eax, [ebp - 0x1a]
call fcn.0040b2e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5540b3
lea eax, [ebp - 4]
call fcn.00404fb4
ret

Function at 0x554bd4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405464
xor eax, eax
push ebp
push 0x554cd0
push dword fs:[eax]
mov dword fs:[eax], esp
mov ax, word [esi + 4]
mov word [ebx + 4], ax
mov ax, word [esi + 6]
mov word [ebx + 6], ax
mov ax, word [esi + 8]
mov word [ebx + 8], ax
mov ax, word [esi + 0xa]
mov word [ebx + 0x64], ax
mov eax, dword [esi + 0xc]
call fcn.00553b28
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x18], eax
mov ax, word [esi + 0x1c]
mov word [ebx + 0x1c], ax
mov ax, word [esi + 0x1e]
mov word [ebx + 0x1e], ax
mov ax, word [esi + 0x20]
mov word [ebx + 0x22], ax
mov ax, word [esi + 0x22]
mov word [ebx + 0x24], ax
mov ax, word [esi + 0x24]
mov word [ebx + 0x26], ax
mov eax, dword [esi + 0x26]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2a]
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00551254
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00556274
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.005511f4
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.005562ec
lea eax, [ebx + 0x50]
call fcn.00404fb4
mov byte [ebx + 0x54], 0
mov byte [ebx + 0x56], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x554cd7
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404fd8
ret
Function at 0x554ce0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405464
xor eax, eax
push ebp
push 0x554dec
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebx + 4], 0
mov ax, word [esi + 4]
mov word [ebx + 6], ax
mov ax, word [esi + 6]
mov word [ebx + 8], ax
mov ax, word [esi + 8]
mov word [ebx + 0x64], ax
mov eax, dword [esi + 0xa]
call fcn.00553b28
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0xe]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x12]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x16]
mov dword [ebx + 0x18], eax
mov ax, word [esi + 0x1a]
mov word [ebx + 0x1c], ax
mov ax, word [esi + 0x1c]
mov word [ebx + 0x20], ax
mov word [ebx + 0x22], 0
mov word [ebx + 0x24], 0
mov word [ebx + 0x26], 0
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
cmp dword [ebp - 4], 0
je 0x554daf
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00551254
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00556274
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.005511f4
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.005562ec
jmp 0x554dc1
xor edx, edx
mov eax, ebx
call fcn.00556274
xor edx, edx
mov eax, ebx
call fcn.005562ec
lea eax, [ebx + 0x50]
call fcn.00404fb4
mov byte [ebx + 0x54], 0
mov byte [ebx + 0x56], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x554df3
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404fd8
ret
Function at 0x55747d
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 4], edx
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0xefcdab89
mov edx, dword [ebp + 8]
mov dword [edx + 0x10], 0x98badcfe
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x14], 0x10325476
mov eax, dword [ebp + 8]
mov dword [eax + 0x18], 0xc3d2e1f0
pop ebp
ret

Function at 0x5579f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
mov dword [ebp - 4], eax
push 0x104
push dword [ebp + 8]
mov edx, dword [ebp + 8]
add edx, 0x104
push edx
call fcn.00557108
add esp, 0xc
cmp dword [ebp - 4], 0x104
jae 0x557a48
mov ecx, 0x104
sub ecx, dword [ebp - 4]
push ecx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
push eax
mov edx, dword [ebp + 8]
call dword [edx + 0x20c]
add esp, 8
add dword [ebp - 4], eax
cmp dword [ebp - 4], 0x104
jb 0x557a20
xor ecx, ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov cl, byte [edx + eax + 0x104]
not cl
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 8]
xor byte [edx + eax], cl
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x104
jb 0x557a4d
push dword [ebp + 8]
call fcn.00557940
pop ecx
mov ecx, dword [ebp + 8]
add ecx, 0x104
push ecx
call fcn.00557940
pop ecx
pop ecx
pop ebp
ret

Function at 0x558f2e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
cmp dword [eax + 0x9c], 0xffffffff
je 0x558fdc
mov edx, dword [ebp + 0x10]
cmp dword [edx + 0x9c], 0x40
jbe 0x558f6d
mov ecx, dword [ebp + 0x10]
add ecx, 0x40
push ecx
push dword [ebp + 0x10]
call fcn.0055755d
add esp, 8
mov eax, dword [ebp + 0x10]
mov dword [eax + 0x9c], 0x14
mov edx, 0x40
mov ecx, dword [ebp + 0x10]
sub edx, dword [ecx + 0x9c]
push edx
push 0
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0x10]
add eax, dword [edx + 0x9c]
push eax
call fcn.005570f0
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0x10]
xor dword [edx + eax*4], 0x36363636
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x10
jb 0x558f98
mov ecx, dword [ebp + 0x10]
add ecx, 0x40
push ecx
call fcn.0055747d
pop ecx
mov eax, dword [ebp + 0x10]
add eax, 0x40
push eax
push 0x40
push dword [ebp + 0x10]
call fcn.005574c1
add esp, 0xc
mov edx, dword [ebp + 0x10]
mov dword [edx + 0x9c], 0xffffffff
cmp dword [ebp + 0xc], 0
je 0x558ff7
mov ecx, dword [ebp + 0x10]
add ecx, 0x40
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.005574c1
add esp, 0xc
pop ecx
pop ebp
ret
Function at 0x558ffa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov eax, dword [ebp + 0x10]
cmp dword [eax + 0x9c], 0xffffffff
je 0x55901b
push dword [ebp + 0x10]
push 0
push 0
call fcn.00558f2e
add esp, 0xc
mov edx, dword [ebp + 0x10]
add edx, 0x40
push edx
lea ecx, [ebp - 0x18]
push ecx
call fcn.0055755d
add esp, 8
xor eax, eax
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
mov ecx, dword [ebp + 0x10]
xor dword [ecx + edx*4], 0x6a6a6a6a
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x10
jb 0x559033
mov eax, dword [ebp + 0x10]
add eax, 0x40
push eax
call fcn.0055747d
pop ecx
mov edx, dword [ebp + 0x10]
add edx, 0x40
push edx
push 0x40
push dword [ebp + 0x10]
call fcn.005574c1
add esp, 0xc
mov ecx, dword [ebp + 0x10]
add ecx, 0x40
push ecx
push 0x14
lea eax, [ebp - 0x18]
push eax
call fcn.005574c1
add esp, 0xc
mov edx, dword [ebp + 0x10]
add edx, 0x40
push edx
lea ecx, [ebp - 0x18]
push ecx
call fcn.0055755d
add esp, 8
xor eax, eax
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
cmp edx, dword [ebp + 0xc]
jae 0x5590ba
mov ecx, dword [ebp - 4]
mov al, byte [ebp + ecx - 0x18]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov byte [edx + ecx], al
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
jb 0x55909f
mov esp, ebp
pop ebp
ret
Function at 0x55a560
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde8
lea eax, [ebp - 0xd8]
push eax
call fcn.00558e7c
pop ecx
lea edx, [ebp - 0xd8]
push edx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00558e93
add esp, 0xc
push 0xa0
lea ecx, [ebp - 0xd8]
push ecx
lea eax, [ebp - 0x178]
push eax
call fcn.00557108
add esp, 0xc
lea edx, [ebp - 0x178]
push edx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.00558f2e
add esp, 0xc
mov eax, dword [ebp + 0x20]
dec eax
mov ecx, 0x14
xor edx, edx
div ecx
inc eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x10]
jae 0x55a6f4
push 0x14
push 0
lea ecx, [ebp - 0x38]
push ecx
call fcn.005570f0
add esp, 0xc
push 0xa0
lea eax, [ebp - 0x178]
push eax
lea edx, [ebp - 0x218]
push edx
call fcn.00557108
add esp, 0xc
mov ecx, dword [ebp - 4]
inc ecx
shr ecx, 0x18
mov byte [ebp - 0x24], cl
mov eax, dword [ebp - 4]
inc eax
shr eax, 0x10
mov byte [ebp - 0x23], al
mov edx, dword [ebp - 4]
inc edx
shr edx, 8
mov byte [ebp - 0x22], dl
mov cl, byte [ebp - 4]
inc ecx
mov byte [ebp - 0x21], cl
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 4
mov edx, dword [ebp - 8]
cmp edx, dword [ebp + 0x18]
jae 0x55a6ae
lea ecx, [ebp - 0x218]
push ecx
push dword [ebp - 0xc]
lea eax, [ebp - 0x24]
push eax
call fcn.00558f2e
add esp, 0xc
lea edx, [ebp - 0x218]
push edx
push 0x14
lea ecx, [ebp - 0x24]
push ecx
call fcn.00558ffa
add esp, 0xc
xor eax, eax
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
mov cl, byte [ebp + edx - 0x24]
mov eax, dword [ebp - 0xc]
xor byte [ebp + eax - 0x38], cl
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x14
jb 0x55a671
push 0xa0
lea edx, [ebp - 0xd8]
push edx
lea ecx, [ebp - 0x218]
push ecx
call fcn.00557108
add esp, 0xc
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x18]
jb 0x55a641
xor edx, edx
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 4]
shl ecx, 2
lea ecx, [ecx + ecx*4]
mov dword [ebp - 0xc], ecx
jmp 0x55a6d7
mov eax, dword [ebp - 8]
mov dl, byte [ebp + eax - 0x38]
mov ecx, dword [ebp + 0x1c]
mov eax, dword [ebp - 0xc]
mov byte [ecx + eax], dl
inc dword [ebp - 8]
inc dword [ebp - 0xc]
cmp dword [ebp - 8], 0x14
jae 0x55a6e5
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0x20]
jb 0x55a6c1
inc dword [ebp - 4]
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x55a5dd
mov esp, ebp
pop ebp
ret

Function at 0x55ba70
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov ecx, dword [edi + 0x170]
mov edx, ebx
mov eax, edi
call fcn.0055bb6c
mov esi, eax
mov dword [edi + 0x170], esi
and esi, 0xff
add dword [edi + 0x174], esi
imul esi, dword [edi + 0x174], 0x8088405
inc esi
mov dword [edi + 0x174], esi
mov edx, esi
shr edx, 0x18
mov ecx, dword [edi + 0x178]
mov eax, edi
call fcn.0055bb6c
mov dword [edi + 0x178], eax
pop edi
pop esi
pop ebx
ret
Function at 0x55c6fc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x55c8e5
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
jle 0x55c8a1
mov eax, dword [ebp - 4]
call fcn.0055dd88
cmp ebx, eax
jge 0x55c8a1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x118]
mov edx, ebx
call fcn.00552838
mov edx, dword [0x55460c]
call fcn.004042e4
mov esi, eax
mov eax, esi
call fcn.005561cc
test al, al
je 0x55c897
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov eax, dword [esi + 0x50]
call fcn.00405274
test eax, eax
jne 0x55c88a
xor eax, eax
push ebp
push 0x55c883
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0055cb68
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
call fcn.00421624
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push dword [esi + 0x34]
push dword [esi + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
lea edx, [ebp - 0x46]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, 0x2e
mov esi, dword [eax]
call dword [esi + 0xc]
movzx eax, word [ebp - 0x2a]
movzx edx, word [ebp - 0x28]
add eax, edx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x18]
movzx esi, word [ebp - 0x26]
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.00405600
mov eax, dword [ebp - 8]
call fcn.004054cc
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, esi
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
mov al, byte [eax + 0x28]
mov byte [ebp - 9], al
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0055ca64
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
mov dl, byte [ebp - 9]
mov byte [eax + 0x28], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55c8cf
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
jne 0x55c882
mov eax, dword [ebp - 4]
call fcn.0055cbec
ret
mov eax, dword [ebp - 8]
mov edx, dword [esi + 0x50]
call fcn.00405008
jmp 0x55c8cf
mov eax, dword [ebp - 8]
call fcn.00404fb4
jmp 0x55c8cf
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x4c], 0
lea eax, [ebp - 0x50]
push eax
push 0
lea edx, [ebp - 0x54]
mov eax, 0xb3
call fcn.0040a700
mov ecx, dword [ebp - 0x54]
mov dl, 1
mov eax, dword [0x41c038]
call fcn.0040e840
call fcn.00404908
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55c8ec
lea eax, [ebp - 0x54]
call fcn.00404fb4
ret
Function at 0x562b6c
Capabilities:
Get disk size

Disassembly:
push ebx
add esp, 0xffffffc4
mov ebx, eax
call fcn.005629dc
test al, al
je 0x562b99
lea edx, [esp + 0x10]
mov eax, ebx
call fcn.00562ad4
test al, al
jne 0x562b8f
call fcn.004100a8
mov eax, dword [esp + 0x14]
imul dword [esp + 0x18]
jmp 0x562bca
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
mov eax, ebx
call fcn.00405474
push eax
call sub.KERNEL32.DLL_GetDiskFreeSpaceA
test eax, eax
jne 0x562bc3
call fcn.004100a8
mov eax, dword [esp]
imul dword [esp + 4]
add esp, 0x3c
pop ebx
ret

Function at 0x568b6c
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffed0
mov ebx, edx
mov esi, eax
cmp dword [esi + 0x5c8], 0
je 0x568b90
mov eax, dword [esi + 0x5c8]
call fcn.00550f24
test al, al
jne 0x568bab
push esp
push 0x12d
call sub.KERNEL32.DLL_GetTempPathA
mov eax, ebx
mov edx, esp
mov ecx, 0x12d
call fcn.00405224
jmp 0x568bb8
mov eax, ebx
mov edx, dword [esi + 0x5c8]
call fcn.00405008
mov eax, dword [ebx]
call fcn.00405274
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
je 0x568bd4
mov eax, ebx
mov edx, 0x568be8
call fcn.0040527c
add esp, 0x130
pop esi
pop ebx
ret

Function at 0x568cc4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x568df5
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, dword [0x58f5d0]
call fcn.004d6a5c
lea eax, [ebp - 4]
mov edx, dword [ebp - 0xc]
mov ecx, 0x568e04
call fcn.00406fc8
lea eax, [ebp - 8]
mov edx, dword [ebp - 0xc]
mov ecx, 0x568e14
call fcn.00406fc8
push 0
lea eax, [ebp - 0x10]
mov edx, ebx
mov ecx, 0x401
call fcn.00405850
mov eax, dword [ebp - 0x10]
call fcn.00405878
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
push 2
lea eax, [ebx + 0x1814]
push eax
push 0x401
lea eax, [ebx + 0x401]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
push 0x401
lea eax, [ebx + 0x1004]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
push 0x401
lea eax, [ebx + 0x802]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x28]
push 0x401
lea eax, [ebx + 0xc03]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x20]
lea eax, [ebx + 0x1808]
push eax
push 0x401
lea eax, [ebx + 0x1405]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x40]
lea eax, [ebx + 0x180c]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
lea eax, [ebx + 0x1810]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x38]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x568dfc
lea eax, [ebp - 0x10]
call fcn.004056fc
lea eax, [ebp - 0xc]
call fcn.00406f84
lea eax, [ebp - 8]
call fcn.00406f84
lea eax, [ebp - 4]
call fcn.00406f84
ret
Function at 0x56be5c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x56c03c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
mov edx, 0x24
call fcn.0056fab0
lea eax, [ebp - 0x28]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov eax, dword [ebp - 0x14]
mov dword [0x58e9c8], eax
mov eax, dword [ebp - 0xc]
mov dword [0x58e9cc], eax
mov eax, dword [ebp - 0x24]
mov dword [0x58e9d0], eax
mov eax, dword [0x590034]
cmp dword [eax], 2
sete byte [0x58e2ac]
push 0x56c048
call sub.KERNEL32.DLL_GetModuleHandleA_1
lea edx, [ebp - 4]
call fcn.0056f4f0
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp byte [0x58e2ac], 0
jne 0x56beeb
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.0056f634
test al, al
je 0x56beeb
mov eax, dword [ebp - 0x4c]
mov dword [0x593344], eax
jmp 0x56bef2
xor eax, eax
mov dword [0x593344], eax
call fcn.0056bb94
and eax, 0x7f
cmp eax, 0x12
ja case.0x56bf03.0
jmp dword [eax*4 + 0x56bf0a]
mov byte [0x58e298], 1
jmp case.0x56bf03.0
mov byte [0x58e29c], 1
jmp case.0x56bf03.0
mov byte [0x58e2a0], 1
jmp case.0x56bf03.0
mov byte [0x58e2a4], 1
jmp case.0x56bf03.0
mov byte [0x58e2a8], 1
jmp case.0x56bf03.0
mov byte [0x58e2b0], 1
mov byte [0x58e2b4], 1
jmp case.0x56bf03.0
mov byte [0x58e2b0], 1
mov byte [0x58e2b8], 1
jmp case.0x56bf03.0
mov byte [0x58e2b0], 1
mov byte [0x58e2b8], 1
mov byte [0x58e2bc], 1
jmp case.0x56bf03.0
mov byte [0x58e2c0], 1
jmp case.0x56bf03.0
mov byte [0x58e2c4], 1
jmp case.0x56bf03.0
mov byte [0x58e2c8], 1
jmp case.0x56bf03.0
mov byte [0x58e2cc], 1
jmp case.0x56bf03.0
mov byte [0x58e2d0], 1
jmp case.0x56bf03.0
mov byte [0x58e2d4], 1
jmp case.0x56bf03.0
mov byte [0x58e2d8], 1
jmp case.0x56bf03.0
mov byte [0x58e2dc], 1
jmp case.0x56bf03.0
mov byte [0x58e2e0], 1
jmp case.0x56bf03.0
mov byte [0x58e2e4], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56c043
lea eax, [ebp - 4]
call fcn.00404fb4
ret

Function at 0x56db24
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x56db88
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00405224
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GetACP
mov edx, eax
pop eax
call fcn.0040a424
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56db8f
lea eax, [ebp - 0xc]
call fcn.00404fb4
ret