joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5277dc
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 0x18], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x52784b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
xor ecx, ecx
mov edx, 0x10
call fcn.0069985c
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
call sub.KERNEL32.DLL_GetComputerNameA
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x14]
call fcn.006920b4
mov edx, dword [ebp - 0x18]
mov eax, ebx
mov ecx, 0xff
call fcn.0069ab90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x527852
lea eax, [ebp - 0x18]
call fcn.0069a934
ret

Function at 0x527858
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
xor edx, edx
mov dword [ebp - 0x120], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x527932
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x105
lea eax, [ebp - 0x111]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x118]
mov edx, ebx
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x118]
lea eax, [ebp - 0x11c]
call fcn.0069971c
mov edx, 0x527944
lea eax, [ebp - 0x11c]
mov cl, 3
call fcn.006996ec
mov eax, dword [ebp - 0x11c]
push eax
call sub.KERNEL32.DLL_GetVolumeInformationA
lea eax, [ebp - 0x120]
lea edx, [ebp - 0x111]
mov ecx, 0x105
call fcn.0069ab64
mov eax, dword [ebp - 0x120]
mov edx, 0x527950
call fcn.00690f70
test eax, eax
jne 0x52790b
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], connect
jmp 0x527919
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x527939
lea eax, [ebp - 0x120]
call fcn.0069a934
ret

Function at 0x527958
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5279b9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10c]
mov edx, ebx
call fcn.0069ab58
mov edx, dword [ebp - 0x10c]
lea eax, [ebp - 0x105]
call fcn.00691ee8
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5279c0
lea eax, [ebp - 0x10c]
call fcn.0069a934
ret

Function at 0x527dd8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x527e3f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10c]
mov edx, ebx
call fcn.0069ab58
mov edx, dword [ebp - 0x10c]
lea eax, [ebp - 0x105]
call fcn.00691ee8
push eax
call sub.KERNEL32.DLL_DeleteFileA
neg eax
sbb eax, eax
neg eax
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x527e46
lea eax, [ebp - 0x10c]
call fcn.0069a934
ret
Function at 0x527e50
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x527ee4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x210]
mov edx, esi
call fcn.0069ab58
mov edx, dword [ebp - 0x210]
lea eax, [ebp - 0x20a]
call fcn.00691ee8
push eax
lea eax, [ebp - 0x214]
mov edx, ebx
call fcn.0069ab58
mov edx, dword [ebp - 0x214]
lea eax, [ebp - 0x105]
call fcn.00691ee8
push eax
call sub.KERNEL32.DLL_MoveFileA
neg eax
sbb eax, eax
neg eax
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x527eeb
lea eax, [ebp - 0x214]
mov edx, 2
call fcn.0069a958
ret
Function at 0x5545b8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20c], ebx
mov dword [ebp - 0x210], ebx
mov dword [ebp - 0x208], ebx
mov dword [ebp - 0x204], ebx
test dl, dl
je 0x5545ea
add esp, 0xfffffff0
call fcn.00699fbc
mov esi, ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x5547a7
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
xor edx, edx
mov eax, edi
call fcn.00694d34
mov word [edi + 0xc], si
lea edx, [ebp - 0xff]
mov eax, esi
call sym.MassSender.exe__Dbisamen_GetErrorString_qqruspc
lea edx, [ebp - 0x200]
xor eax, eax
call sym.MassSender.exe__Dbisamen_GetErrorContext_qqri
lea edx, [ebp - 0x200]
lea eax, [edi + 0x18]
call fcn.0069ab58
lea edx, [ebp - 0x200]
mov eax, 1
call sym.MassSender.exe__Dbisamen_GetErrorContext_qqri
lea edx, [ebp - 0x200]
lea eax, [edi + 0x1c]
call fcn.0069ab58
lea edx, [ebp - 0x200]
mov eax, 2
call sym.MassSender.exe__Dbisamen_GetErrorContext_qqri
lea edx, [ebp - 0x200]
lea eax, [edi + 0x20]
call fcn.0069ab58
lea edx, [ebp - 0x200]
mov eax, 3
call sym.MassSender.exe__Dbisamen_GetErrorContext_qqri
lea edx, [ebp - 0x200]
lea eax, [edi + 0x24]
call fcn.0069ab58
lea edx, [ebp - 0x200]
mov eax, 4
call sym.MassSender.exe__Dbisamen_GetErrorContext_qqri
lea edx, [ebp - 0x200]
lea eax, [edi + 0x28]
call fcn.0069ab58
lea edx, [ebp - 0x200]
mov eax, 5
call sym.MassSender.exe__Dbisamen_GetErrorContext_qqri
lea edx, [ebp - 0x200]
lea eax, [edi + 0x2c]
call fcn.0069ab58
lea edx, [ebp - 0x200]
mov eax, 6
call sym.MassSender.exe__Dbisamen_GetErrorContext_qqri
lea edx, [ebp - 0x200]
lea eax, [edi + 0x30]
call fcn.0069ab58
lea edx, [ebp - 0x200]
mov eax, 7
call sym.MassSender.exe__Dbisamen_GetErrorContext_qqri
lea edx, [ebp - 0x200]
lea eax, [ebp - 0x204]
call fcn.0069ab58
mov eax, dword [ebp - 0x204]
call fcn.006914dc
mov dword [edi + 0x10], eax
lea edx, [ebp - 0x200]
mov eax, 8
call sym.MassSender.exe__Dbisamen_GetErrorContext_qqri
lea edx, [ebp - 0x200]
lea eax, [ebp - 0x208]
call fcn.0069ab58
mov eax, dword [ebp - 0x208]
call fcn.006914dc
mov dword [edi + 0x14], eax
push 0x5547d4
lea edx, [ebp - 0x20c]
movzx eax, si
call fcn.006913fc
push dword [ebp - 0x20c]
push 0x5547f4
lea edx, [ebp - 0x210]
lea eax, [ebp - 0xff]
call fcn.006920b4
push dword [ebp - 0x210]
lea eax, [edi + 4]
mov edx, 4
call fcn.0069ac74
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5547ae
lea eax, [ebp - 0x210]
mov edx, 4
call fcn.0069a958
ret

Function at 0x573284
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
xor ecx, ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x57336c
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 8]
Function at 0x5735c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0065fbfc
push eax
call sub.USER32.DLL_IsWindowVisible
test eax, eax
je 0x5735e9
push 0
mov eax, dword [ebp - 4]
call fcn.0065fbfc
push eax
call sub.USER32.DLL_ShowWindow
pop ecx
pop ebp
ret

Function at 0x57ecf0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
add esp, 0xfffffef0
mov esi, eax
mov eax, esi
invalid
call fcn.0069a934
xor ebx, ebx
push esp
push 0x20019
push 0
push 0x57ed68
push reloc.WSOCK32.DLL_bind
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x57ed5d
mov dword [esp + 4], 0x105
lea eax, [esp + 4]
push eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x57ed88
mov eax, dword [esp + 0x14]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
mov eax, dword [esp]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
lea edx, [esp + 8]
mov eax, esi
mov ecx, dword [esp + 4]
call fcn.0069aa1c
mov bl, 1
mov eax, ebx
add esp, 0x110
pop esi
pop ebx
ret
Function at 0x594bfc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
add edi, 0xfffffffc
mov eax, dword [edi]
mov al, byte [eax + 0x372]
mov byte [ebp - 5], al
call sub.KERNEL32.DLL_GetTickCount
mov esi, eax
jmp 0x594c2b
mov eax, dword [0x7c9318]
mov eax, dword [eax]
call fcn.0064bcbc
call sub.KERNEL32.DLL_GetTickCount
cmp esi, eax
jle 0x594c41
mov eax, dword [edi]
mov al, byte [eax + 0x372]
cmp al, byte [ebp - 5]
je 0x594c1f
mov eax, dword [0x7c9318]
mov eax, dword [eax]
call fcn.0064bcbc
mov eax, dword [edi]
mov al, byte [eax + 0x372]
cmp al, byte [ebp - 5]
jne 0x594e09
mov eax, dword [edi]
mov eax, dword [eax + 0x374]
cmp eax, 7
ja case.0x594c6b.0
jmp dword [eax*4 + 0x594c72]
mov ebx, 0x190
jmp 0x594cc5
mov ebx, 0x12c
jmp 0x594cc5
mov ebx, 0xc8
jmp 0x594cc5
mov ebx, 0x82
jmp 0x594cc5
mov ebx, 0x4e
jmp 0x594cc5
mov ebx, 0x30
jmp 0x594cc5
mov ebx, 0x1e
jmp 0x594cc5
xor ebx, ebx
call sub.KERNEL32.DLL_GetTickCount
mov esi, eax
add esi, ebx
mov ebx, dword [0x7ca610]
mov eax, dword [0x7ca614]
mov dword [ebp - 4], eax
mov eax, dword [edi]
mov al, byte [eax + 0x372]
dec al
je 0x594d01
dec al
je 0x594d37
dec al
je 0x594d84
dec al
je 0x594dae
jmp 0x594df2
mov eax, dword [edi]
mov eax, dword [eax + 0x214]
call sym.MassSender.exe__Plusmemou_TPlusNavigatorU_GetLineNb_qqrv
test eax, eax
jle 0x594d22
push 0
mov eax, dword [edi]
xor ecx, ecx
mov edx, 0x115
call fcn.0065a774
mov eax, dword [edi]
mov eax, dword [eax + 0x374]
neg eax
lea eax, [eax + eax*2]
mov dword [ebp - 4], eax
jmp 0x594df2
mov eax, dword [edi]
mov eax, dword [eax + 0x214]
call sym.MassSender.exe__Plusmemou_TPlusNavigatorU_GetLineNb_qqrv
mov edx, dword [edi]
mov edx, dword [edx + 0x1fc]
mov ecx, dword [edi]
sub edx, dword [ecx + 0x308]
cmp eax, edx
jg 0x594d6b
push 0
mov eax, dword [edi]
mov ecx, 1
mov edx, 0x115
call fcn.0065a774
mov eax, dword [edi]
call fcn.00659228
mov edx, dword [edi]
mov edx, dword [edx + 0x374]
lea edx, [edx + edx*2]
add eax, edx
mov dword [ebp - 4], eax
jmp 0x594df2
mov eax, dword [edi]
cmp dword [eax + 0x220], 0
jle 0x594d9f
push 0
mov eax, dword [edi]
xor ecx, ecx
mov edx, 0x114
call fcn.0065a774
mov eax, dword [edi]
mov eax, dword [eax + 0x374]
neg eax
lea ebx, [eax + eax*2]
jmp 0x594df2
mov eax, dword [edi]
call fcn.006591e4
mov edx, dword [edi]
mov edx, dword [edx + 0x318]
sub edx, eax
mov eax, dword [edi]
cmp edx, dword [eax + 0x220]
jle 0x594ddc
push 0
mov eax, dword [edi]
mov ecx, 1
mov edx, 0x114
call fcn.0065a774
mov eax, dword [edi]
call fcn.006591e4
mov ebx, eax
mov eax, dword [edi]
mov eax, dword [eax + 0x374]
lea eax, [eax + eax*2]
add ebx, eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [edi]
mov ecx, ebx
mov dl, byte [0x594e24]
mov bx, 0xffd9
call fcn.00699e58
mov eax, dword [edi]
mov al, byte [eax + 0x372]
cmp al, byte [ebp - 5]
je 0x594c2b
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x5ac328
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0069ad68
xor eax, eax
push ebp
push 0x5ac3a6
push dword fs:[eax]
mov dword fs:[eax], esp
inc word [ebx + 0x30]
push 0
push 1
push 1
push 0
push 0
push 0
lea edx, [ebx + 0x32]
mov cx, word [ebx + 0x30]
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0x30]
push 0xf
push 1
lea edx, [ebx + 0x3e]
mov ecx, dword [ebp - 4]
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0x34]
mov dword [ebx + 0x234], eax
add dword [ebx + 0x234], 0xc
movzx esi, word [ebx + 0x30]
mov eax, ebx
call sym.MassSender.exe__Dnsquery_TDnsQuery_SendQuery_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ac3ad
lea eax, [ebp - 4]
call fcn.0069a934
ret

Function at 0x5ac3b4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0069ad68
xor eax, eax
push ebp
push 0x5ac432
push dword fs:[eax]
mov dword fs:[eax], esp
inc word [ebx + 0x30]
push 0
push 1
push 1
push 0
push 0
push 0
lea edx, [ebx + 0x32]
mov cx, word [ebx + 0x30]
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0x30]
push 1
push 1
lea edx, [ebx + 0x3e]
mov ecx, dword [ebp - 4]
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0x34]
mov dword [ebx + 0x234], eax
add dword [ebx + 0x234], 0xc
movzx esi, word [ebx + 0x30]
mov eax, ebx
call sym.MassSender.exe__Dnsquery_TDnsQuery_SendQuery_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ac439
lea eax, [ebp - 4]
call fcn.0069a934
ret

Function at 0x5ac440
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0069ad68
xor eax, eax
push ebp
push 0x5ac4c0
push dword fs:[eax]
mov dword fs:[eax], esp
inc word [ebx + 0x30]
push 0
push 1
push 1
push 0
push 0
push 0
lea edx, [ebx + 0x32]
mov cx, word [ebx + 0x30]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x30]
push esi
push 1
lea edx, [ebx + 0x3e]
mov ecx, dword [ebp - 4]
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0x34]
mov dword [ebx + 0x234], eax
add dword [ebx + 0x234], 0xc
movzx esi, word [ebx + 0x30]
mov eax, ebx
call sym.MassSender.exe__Dnsquery_TDnsQuery_SendQuery_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ac4c7
lea eax, [ebp - 4]
call fcn.0069a934
ret
Function at 0x5ac4d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0069ad68
xor eax, eax
push ebp
push 0x5ac572
push dword fs:[eax]
mov dword fs:[eax], esp
inc word [ebx + 0x30]
push 0
push 1
push 1
push 0
push 0
push 0
lea edx, [ebx + 0x32]
mov cx, word [ebx + 0x30]
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0x30]
push 0xc
push 1
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call sym.MassSender.exe__Dnsquery_ReverseIP_qqrx17System_AnsiString
lea eax, [ebp - 8]
mov edx, 0x5ac58c
call fcn.0069abbc
mov ecx, dword [ebp - 8]
lea edx, [ebx + 0x3e]
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0x34]
mov dword [ebx + 0x234], eax
add dword [ebx + 0x234], 0xc
movzx esi, word [ebx + 0x30]
mov eax, ebx
call sym.MassSender.exe__Dnsquery_TDnsQuery_SendQuery_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ac579
lea eax, [ebp - 8]
mov edx, 2
call fcn.0069a958
ret

Function at 0x5ad2d8
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe70
push ebx
push esi
push edi
test dl, dl
je 0x5ad2f0
add esp, 0xfffffff0
call fcn.00699fbc
mov ebx, edx
mov edi, eax
mov dword [edi + 0x14], 0xffffffff
mov dword [edi + 0x44], 0x38
mov dword [edi + 0x4c], 0x40
mov dword [edi + 0x48], 0xfa0
lea eax, [ebp - 0x190]
push eax
push 0x101
call sub.WSOCK32.DLL_WSAStartup

Function at 0x5ad518
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x5ad5e2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x34]
call fcn.0069ad78
push eax
call sub.WSOCK32.DLL_inet_addr
mov esi, eax
mov dword [ebx + 0x40], esi
inc esi
je 0x5ad554
lea eax, [ebx + 0x38]
mov edx, dword [ebx + 0x34]
call fcn.0069a988
jmp 0x5ad5a8
mov eax, dword [ebx + 0x34]
call fcn.0069ad78
push eax
call sub.WSOCK32.DLL_gethostbyname
mov esi, eax
test esi, esi
jne 0x5ad594
call sub.KERNEL32.DLL_GetLastError
mov dword [ebx + 0x70], eax
cmp word [ebx + 0x5a], 0
je 0x5ad5c7
lea eax, [ebp - 4]
mov ecx, dword [ebx + 0x34]
mov edx, 0x5ad5f8
call fcn.0069ac00
mov ecx, dword [ebp - 4]
mov edx, ebx
mov eax, dword [ebx + 0x5c]
call dword [ebx + 0x58]
jmp 0x5ad5c7
mov eax, dword [esi + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebx + 0x40], eax
lea eax, [ebx + 0x38]
mov edx, dword [esi]
call fcn.0069aaec
push dword [ebx + 0x40]
call sub.WSOCK32.DLL_inet_ntoa
lea edx, [ebp - 8]
call fcn.006920b4
mov edx, dword [ebp - 8]
lea eax, [ebx + 0x3c]
call fcn.0069a988
mov byte [ebx + 0x74], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ad5e9
lea eax, [ebp - 8]
mov edx, 2
call fcn.0069a958
ret

Function at 0x5ade6c
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x58
call fcn.0069985c
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret
Function at 0x5b343f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SoftwareBorlandDatabase_Engine
push reloc.WSOCK32.DLL_bind
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x5b3497
movzx edx, word [ebp + 8]
mov dword [ebp - 8], edx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push 0
push 0
push str.DLLPATH
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x5b348d
mov bx, 0x2a04
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
jmp 0x5b349b
mov bx, 0x2a04
mov eax, ebx
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x5ca50c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5ca5e4
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x7ca8f0], 0
jne 0x5ca5c8
lea eax, [ebp - 4]
mov edx, 0x5ca5fc
call fcn.0069a9cc

Function at 0x5cdc0a
Capabilities:
Get file version info

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
push esp
push 0x5cdc64
call sub.VERSION.DLL_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jne 0x5cdbff
call sub.KERNEL32.DLL_GetLastError
mov dword [esp], eax
mov bl, 1
jmp 0x5cdc58
mov eax, edi
call fcn.006990b0
mov esi, eax
push esi
push edi
push 0
push 0x5cdc64
call sub.VERSION.DLL_GetFileVersionInfoA
lea eax, [esp + 4]
push eax
lea eax, [esp + 0xc]
push eax
push 0x5cdc74
push esi
call sub.VERSION.DLL_VerQueryValueA
mov eax, dword [esp + 8]
mov edx, dword [eax + 8]
shr edx, 0x10
mov ax, word [eax + 8]
and ax, 0xffff
cmp dx, 4
jb 0x5cdc49
cmp ax, 0x46
ja 0x5cdc4d
xor ebx, ebx
jmp 0x5cdc4f
mov bl, 1
mov edx, edi
mov eax, esi
call fcn.006990c8
mov eax, ebx
add esp, 0xc
pop edi
pop esi
pop ebx
ret

Function at 0x5ceb84
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x5cebd5
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x5cebbc
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x5cebac
jmp 0x5cebd5
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x5cebbd
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5d1bb4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
push ecx
mov byte [esp], cl
mov esi, edx
mov ebx, eax
push 0x12
call sub.USER32.DLL_GetKeyState
test ax, ax
jge 0x5d1bcf
or byte [esp], 2
mov eax, ebx
call fcn.0061b8fc
test al, al
je 0x5d1bfd
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x174]
test al, al
jne 0x5d1bfd
cmp word [esi], 0x1b
jne 0x5d1bfd
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x140]
mov word [esi], 0
mov edx, esi
mov cl, byte [esp]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x138]
mov edx, esi
mov cl, byte [esp]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x13c]
mov edx, esi
mov cl, byte [esp]
mov eax, ebx
call fcn.0065e7d4
cmp word [esi], 0x2e
je 0x5d1c39
cmp word [esi], 0x2d
jne 0x5d1c44
test byte [esp], 1
je 0x5d1c44
mov eax, dword [ebx + 0x214]
call fcn.005f0c34
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x5d6054
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
mov eax, 0x7bcf98
call fcn.006a8c14
mov dword [ebp - 0x2c], 0x100
mov dword [ebp - 0x30], 0x100
push dword [ebp - 0x30]
call fcn.0069e4c8
pop ecx
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x5d60c9
push dword [ebp - 0x34]
push dword [ebp - 0x30]
call sub.KERNEL32.DLL_GetCurrentDirectoryA
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0x100
jbe 0x5d60c9
push dword [ebp - 0x30]
push dword [ebp - 0x34]
call fcn.0069e4e8
add esp, 8
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x5d60c9
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x34], edx
push dword [ebp - 0x34]
push dword [ebp - 0x30]
call sub.KERNEL32.DLL_GetCurrentDirectoryA
mov dword [ebp - 0x30], eax
mov word [ebp - 0x18], 8
mov word [ebp - 0x18], 0x14
cmp dword [ebp - 0x30], 0
je 0x5d60e6
cmp dword [ebp - 0x34], 0
je 0x5d60e6
mov edx, dword [ebp - 0x34]
jmp 0x5d60eb
mov edx, 0x7bcc04
lea eax, [ebp - 4]
call fcn.006b5bd0
inc dword [ebp - 0xc]
mov word [ebp - 0x18], 0x20
push dword [ebp - 0x34]
call fcn.0069e4d8
pop ecx
mov word [ebp - 0x18], 0x2c
lea edx, [ebp - 4]
mov eax, dword [ebp + 8]
call fcn.006b5da4
mov eax, dword [ebp + 8]
mov word [ebp - 0x18], 0x38
push eax
dec dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 2
call fcn.006b5d74
pop eax
mov word [ebp - 0x18], 0x20
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
jmp 0x5d6169
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5e1dac
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5e1f1d
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.KERNEL32.DLL_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5e1ef8
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x111], 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x105
lea eax, [ebp - 0x111]
push eax
lea eax, [ebp - 0x118]
mov edx, ebx
call fcn.0069aadc
lea eax, [ebp - 0x118]
mov edx, 0x5e1f34
call fcn.0069abbc
mov eax, dword [ebp - 0x118]
call fcn.0069ad78
push eax
call sub.KERNEL32.DLL_GetVolumeInformationA
test eax, eax
je 0x5e1e6a
lea eax, [ebp - 0x111]
call fcn.00691df8
mov ecx, eax
lea edx, [ebp - 0x111]
mov eax, esi
call fcn.0069aa1c
jmp 0x5e1e71
mov eax, esi
call fcn.0069a934
cmp bl, 0x61
jae 0x5e1e92
lea edx, [ebp - 0x11c]
mov eax, dword [esi]
call fcn.00695a40
mov edx, dword [ebp - 0x11c]
mov eax, esi
call fcn.0069a988
jmp 0x5e1eac
lea edx, [ebp - 0x120]
mov eax, dword [esi]
call fcn.006959b4
mov edx, dword [ebp - 0x120]
mov eax, esi
call fcn.0069a988
lea eax, [ebp - 0x124]
push eax
mov eax, dword [esi]
mov dword [ebp - 0x12c], eax
mov byte [ebp - 0x128], 0xb
lea edx, [ebp - 0x12c]
xor ecx, ecx
mov eax, 0x5e1f40
call fcn.006925fc
mov edx, dword [ebp - 0x124]
mov eax, esi
call fcn.0069a988
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e1eff
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_SetErrorMode
ret

Function at 0x5e520c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0069ad78
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
je 0x5e5225
test al, 0x10
jne 0x5e5229
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x60e144
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x60e1cd
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x7ca96c
push 0x101
call sub.WSOCK32.DLL_WSAStartup
mov ebx, eax
test ebx, ebx
je 0x60e1b7
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.006944e8
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xb
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 0
mov eax, 0x60e1e4
mov dword [ebp - 8], eax
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x18]
push eax
push 2
mov ecx, dword [0x7c9958]
mov dl, 1
mov eax, dword [0x60d990]
call fcn.00694e2c
call fcn.0069a414
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60e1d4
lea eax, [ebp - 0x1c]
call fcn.0069a934
ret