joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52f8a0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x52f8a9
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov byte [ebp - 5], cl
mov esi, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x52fa4f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0052fbe8
xor eax, eax
push ebp
push 0x52fa2d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
test byte [eax + 0x1c], 8
je 0x52f8f8
call fcn.00404fc4
jmp 0x52fa34
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 8
je 0x52f9bb
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 1
je 0x52f949
mov eax, dword [ebp - 4]
cmp word [eax + 0x3a], 0
je 0x52f949
lea eax, [ebp - 0x10]
call fcn.0052f664
push dword [ebp - 0x10]
push 0x52fa68
push ebx
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405978
mov eax, dword [ebp - 0xc]
push eax
mov edi, dword [ebp - 4]
movzx ecx, byte [ebp - 5]
mov edx, esi
mov eax, dword [edi + 0x3c]
call dword [edi + 0x38]
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 4
je 0x52f97e
lea eax, [ebp - 0x18]
call fcn.0052f664
push dword [ebp - 0x18]
push 0x52fa68
push ebx
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00405978
mov eax, dword [ebp - 0x14]
call fcn.00405a74
push eax
call sub.kernel32.dll_OutputDebugStringA
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 2
je 0x52fa17
lea eax, [ebp - 0x20]
call fcn.0052f664
push dword [ebp - 0x20]
push 0x52fa68
push ebx
push 0x52fa74
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.00405978
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.0052f868
jmp 0x52fa17
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 1
je 0x52f9de
mov eax, dword [ebp - 4]
cmp word [eax + 0x3a], 0
je 0x52f9de
push ebx
mov edi, dword [ebp - 4]
movzx ecx, byte [ebp - 5]
mov edx, esi
mov eax, dword [edi + 0x3c]
call dword [edi + 0x38]
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 4
je 0x52f9f4
mov eax, ebx
call fcn.00405a74
push eax
call sub.kernel32.dll_OutputDebugStringA
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 2
je 0x52fa17
lea eax, [ebp - 0x24]
mov ecx, 0x52fa74
mov edx, ebx
call fcn.004058fc
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.0052f868
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52fa34
mov eax, dword [ebp - 4]
call fcn.0052fbf4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52fa56
lea eax, [ebp - 0x24]
mov edx, 7
call fcn.00405608
ret
Function at 0x5321e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov esi, eax
mov byte [esp], 0
xor eax, eax
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], eax
mov edi, 1
jmp 0x532201
inc edi
mov eax, esi
call fcn.004058a4
cmp edi, eax
jg 0x532213
cmp byte [esi + edi - 1], 0x20
je 0x532200
mov eax, esi
test eax, eax
je 0x53221e
sub eax, 4
mov eax, dword [eax]
cmp eax, edi
jl 0x5322e0
cmp byte [esi + edi - 1], 0x2e
je 0x532304
jmp 0x5322e0
cmp byte [esi + edi - 1], 0x2e
jne 0x532288
inc dword [esp + 4]
cmp dword [esp + 4], 3
jg 0x532304
cmp dword [esp + 8], 0xff
jg 0x532304
xor eax, eax
mov dword [esp + 8], eax
mov ebp, esi
test ebp, ebp
je 0x53226c
sub ebp, 4
mov ebp, dword [ebp]
cmp ebp, edi
jg 0x532274
mov bl, 1
jmp 0x532282
movzx eax, byte [esi + edi]
add al, 0xd0
sub al, 0xa
setb bl
xor bl, 1
test bl, bl
jne 0x532304
jmp 0x5322df
movzx eax, byte [esi + edi - 1]
add al, 0xd0
sub al, 0xa
jae 0x5322ad
mov eax, dword [esp + 8]
add eax, eax
lea eax, [eax + eax*4]
movzx edx, byte [esi + edi - 1]
add eax, edx
sub eax, 0x30
mov dword [esp + 8], eax
jmp 0x5322df
inc edi
mov eax, esi
call fcn.004058a4
cmp edi, eax
jg 0x5322bf
cmp byte [esi + edi - 1], 0x20
je 0x5322ac
mov dword [esp + 0xc], esi
cmp dword [esp + 0xc], 0
je 0x5322d7
mov eax, dword [esp + 0xc]
sub eax, 4
mov eax, dword [eax]
mov dword [esp + 0xc], eax
cmp edi, dword [esp + 0xc]
jle 0x532304
jmp 0x5322ef
inc edi
mov eax, esi
call fcn.004058a4
cmp edi, eax
jle 0x532236
cmp dword [esp + 4], 3
jne 0x532304
cmp dword [esp + 8], 0xff
jg 0x532304
mov byte [esp], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x541920
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push 0x5419b0
call sub.kernel32.dll_LoadLibraryA
mov ebx, eax
test ebx, ebx
je 0x5419ab
push 0x5419c0
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x592674], eax
push 0x59268c
push 0x40
push 8
mov eax, dword [0x592674]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x54196e
mov eax, 0x59267c
mov ecx, 5
mov edx, dword [0x592674]
call fcn.0040894c
push 0x5419c8
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x592678], eax
push 0x592694
push 0x40
push 8
mov eax, dword [0x592678]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x5419ab
mov eax, 0x592684
mov ecx, 5
mov edx, dword [0x592678]
call fcn.0040894c
pop ebx
ret

Function at 0x541c1c
Capabilities:
Encrypt data using blowfish

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe4
mov esi, eax
lea edi, [esp + 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebp, edx
mov edx, ebp
mov eax, 0x5849ac
mov ecx, 0x48
call fcn.004035b8
lea edx, [ebp + 0x48]
mov eax, 0x5849f4
mov ecx, 0x1000
call fcn.004035b8
xor edi, edi
mov esi, 0x12
mov dword [esp + 8], ebp
xor edx, edx
mov eax, 4
shl edx, 8
movzx ecx, byte [esp + edi + 0xc]
or edx, ecx
inc edi
cmp edi, 0x10
jl 0x541c76
xor edi, edi
dec eax
jne 0x541c64
mov eax, dword [esp + 8]
xor dword [eax], edx
add dword [esp + 8], 4
dec esi
jne 0x541c5d
xor eax, eax
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
xor esi, esi
mov edx, esp
mov eax, ebp
mov cl, 1
call fcn.00541cf8
mov eax, dword [esp]
mov dword [ebp + esi*4], eax
mov eax, dword [esp + 4]
mov dword [ebp + esi*4 + 4], eax
add esi, 2
cmp esi, 0x11
jle 0x541c94
mov edi, 4
mov ebx, ebp
xor esi, esi
mov edx, esp
mov eax, ebp
mov cl, 1
call fcn.00541cf8
mov eax, dword [esp]
mov dword [ebx + esi*4 + 0x48], eax
mov eax, dword [esp + 4]
mov dword [ebx + esi*4 + 0x4c], eax
add esi, 2
cmp esi, 0xff
jle 0x541cbf
add ebx, 0x400
dec edi
jne 0x541cbd
add esp, 0x1c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x541cf8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov byte [esp], cl
mov esi, edx
mov ebx, eax
lea edi, [esp + 1]
mov edx, edi
mov eax, esi
mov ecx, 8
call fcn.004035b8
cmp byte [esp], 0
je 0x541d9c
mov eax, dword [ebx]
xor dword [esi], eax
mov eax, 1
movzx edx, byte [edi + 3]
mov edx, dword [ebx + edx*4 + 0x48]
movzx ecx, byte [edi + 2]
add edx, dword [ebx + ecx*4 + 0x448]
movzx ecx, byte [edi + 1]
xor edx, dword [ebx + ecx*4 + 0x848]
movzx ecx, byte [edi]
add edx, dword [ebx + ecx*4 + 0xc48]
mov ecx, dword [ebx + eax*4]
xor ecx, dword [esi + 4]
xor edx, ecx
mov dword [esi + 4], edx
movzx edx, byte [edi + 7]
mov edx, dword [ebx + edx*4 + 0x48]
movzx ecx, byte [edi + 6]
add edx, dword [ebx + ecx*4 + 0x448]
movzx ecx, byte [edi + 5]
xor edx, dword [ebx + ecx*4 + 0x848]
movzx ecx, byte [edi + 4]
add edx, dword [ebx + ecx*4 + 0xc48]
mov ecx, dword [ebx + eax*4 + 4]
xor ecx, dword [esi]
xor edx, ecx
mov dword [esi], edx
add eax, 2
cmp eax, 0x10
jle 0x541d26
mov eax, dword [ebx + 0x44]
xor dword [esi + 4], eax
jmp 0x541e19
mov eax, dword [ebx + 0x44]
xor dword [esi + 4], eax
mov eax, 0x10
movzx edx, byte [edi + 7]
mov edx, dword [ebx + edx*4 + 0x48]
movzx ecx, byte [edi + 6]
add edx, dword [ebx + ecx*4 + 0x448]
movzx ecx, byte [edi + 5]
xor edx, dword [ebx + ecx*4 + 0x848]
movzx ecx, byte [edi + 4]
add edx, dword [ebx + ecx*4 + 0xc48]
mov ecx, dword [ebx + eax*4]
xor ecx, dword [esi]
xor edx, ecx
mov dword [esi], edx
movzx edx, byte [edi + 3]
mov edx, dword [ebx + edx*4 + 0x48]
movzx ecx, byte [edi + 2]
add edx, dword [ebx + ecx*4 + 0x448]
movzx ecx, byte [edi + 1]
xor edx, dword [ebx + ecx*4 + 0x848]
movzx ecx, byte [edi]
add edx, dword [ebx + ecx*4 + 0xc48]
mov ecx, dword [ebx + eax*4 - 4]
xor ecx, dword [esi + 4]
xor edx, ecx
mov dword [esi + 4], edx
sub eax, 2
cmp eax, 1
jge 0x541da7
mov eax, dword [ebx]
xor dword [esi], eax
add esp, 0xc
pop edi
pop esi
pop ebx
ret

Function at 0x5425fc
Capabilities:
Hash data with md5

Disassembly:
push ebx
add esp, 0xffffffa8
mov ebx, eax
mov edx, esp
mov eax, ebx
mov ecx, 0x58
call fcn.004035b8
xor eax, eax
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], 0x67452301
mov dword [esp + 0xc], 0xefcdab89
mov dword [esp + 0x10], 0x98badcfe
mov dword [esp + 0x14], 0x10325476
mov edx, ebx
mov eax, esp
mov ecx, 0x58
call fcn.004035b8
add esp, 0x58
pop ebx
ret

Function at 0x542c24
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov ebx, eax
mov edi, esp
mov ebp, 0x585a34
mov eax, dword [ebp]
mov dword [ebx + 4], eax
push edi
call sub.kernel32.dll_GetLocalTime
mov ecx, dword [ebp]
and ecx, 0xf
mov esi, dword [ebx + 4]
shl esi, cl
movzx eax, word [edi + 8]
or ax, word [edi + 0xc]
movzx eax, ax
shl eax, 0x10
movzx edx, word [edi + 0xa]
or dx, word [edi + 0xe]
movzx edx, dx
or eax, edx
xor esi, eax
mov dword [ebx + 4], esi
mov dword [ebp], esi
inc dword [ebp]
cmp dword [ebx + 4], 0
je 0x542c34
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5460d0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x1010], ebx
mov dword [ebp - 0x100c], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
xor eax, eax
push ebp
push 0x546207
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx], 0x1000
jle 0x54612f
lea edx, [ebp - 0x100c]
mov eax, dword [0x588454]
call fcn.00407974
mov ecx, dword [ebp - 0x100c]
mov dl, 1
mov eax, dword [0x40b744]
call fcn.00411a0c
call fcn.00404f18
xor ecx, ecx
mov eax, dword [ebx]
mov dword [ebp - 8], eax
movzx eax, byte [ebp + 8]
mov byte [ebp + ecx - 0x1008], al
inc ecx
cmp dword [ebx], 0x7f
jle 0x546187
mov eax, dword [ebx]
mov esi, 0xff
cdq
idiv esi
mov esi, eax
test esi, esi
jne 0x54615c
mov esi, 1
mov eax, esi
or al, 0x80
mov byte [ebp + ecx - 0x1008], al
add ecx, esi
mov eax, esi
test eax, eax
jle 0x546182
mov edx, dword [ebx]
and dl, 0xff
mov byte [ebp + ecx - 0x1008], dl
shr dword [ebx], 8
dec ecx
dec eax
jne 0x54616f
inc esi
add ecx, esi
jmp 0x546191
mov eax, dword [ebx]
mov byte [ebp + ecx - 0x1008], al
inc ecx
mov eax, dword [ebp - 8]
add eax, ecx
mov dword [ebx], eax
cmp dword [ebx], 0x1000
jle 0x5461c7
lea edx, [ebp - 0x1010]
mov eax, dword [0x588454]
call fcn.00407974
mov ecx, dword [ebp - 0x1010]
mov dl, 1
mov eax, dword [0x40b744]
call fcn.00411a0c
call fcn.00404f18
lea edx, [ebp + ecx - 0x1008]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
call fcn.004035b8
mov ecx, dword [ebx]
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1008]
call fcn.004035b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54620e
lea eax, [ebp - 0x1010]
mov edx, 2
call fcn.00405608
ret
Function at 0x548134
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
xor ebx, ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00405a64
mov eax, dword [ebp - 8]
call fcn.00405a64
xor eax, eax
push ebp
push 0x5482f3
push dword fs:[eax]
mov dword fs:[eax], esp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 8]
call fcn.0040d99c
mov eax, dword [ebp - 0x2c]
push eax
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 4]
call fcn.0040d99c
mov eax, dword [ebp - 0x30]
pop edx
call fcn.0040c78c
test eax, eax
jne 0x5481ca
mov dword [ebp - 0x22], 4
jmp 0x5481d1
mov dword [ebp - 0x22], 2
lea eax, [ebp - 0x34]
mov ecx, 0x548308
mov edx, dword [ebp - 4]
call fcn.004058fc
mov eax, dword [ebp - 0x34]
call fcn.00405a74
mov dword [ebp - 0x1e], eax
lea eax, [ebp - 0x38]
mov ecx, 0x548308
mov edx, dword [ebp - 8]
call fcn.004058fc
mov eax, dword [ebp - 0x38]
call fcn.00405a74
mov dword [ebp - 0x1a], eax
mov word [ebp - 0x16], 0x410
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea eax, [ebp - 0x26]
push eax
call sub.shell32.dll_SHFileOperationA
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5482fa
lea eax, [ebp - 0x38]
mov edx, 4
call fcn.00405608
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405608
ret
Function at 0x5514f4
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004055e4
xor eax, eax
push ebp
push 0x551535
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 0
push 0x551644
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x551552
cmp dword [ebp - 4], 0
je 0x55163d
xor eax, eax
push ebp
push 0x551593
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80000000
push 0
push 0
mov eax, esi
call fcn.00405a74
push eax
mov eax, dword [ebp - 4]
push eax
call sub.wininet.dll_InternetOpenUrlA
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5515b0
cmp dword [ebp - 8], 0
jne 0x5515c1
mov eax, dword [ebp - 4]
push eax
call sub.wininet.dll_InternetCloseHandle
jmp 0x55163d
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, 0x1e00000
xor edx, edx
push ebp
push 0x5515f6
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0xc]
push edx
push eax
push 0x592818
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetReadFile
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x551619
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 4]
push eax
call sub.wininet.dll_InternetCloseHandle
cmp dword [ebp - 0xc], 0
jbe 0x55163d
mov edx, ebx
mov eax, 0x592818
call fcn.0040defc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5527e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [0x589150]
cmp dword [eax], 0x1e
jge 0x5527f8
mov eax, dword [0x589150]
mov dword [eax], 0x1e
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x50]
xor edx, edx
push edx
push eax
mov eax, dword [0x589150]
imul eax, dword [eax], 0x3e8
cdq
cmp edx, dword [esp + 4]
jne 0x55281f
cmp eax, dword [esp]
pop edx
pop eax
jae 0x552832
jmp 0x552823
pop edx
pop eax
jge 0x552832
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x50], eax
mov eax, ebx
call fcn.005593d0
pop ebx
ret
Function at 0x559c08
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x559cb3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.004055e4
mov esi, 3
lea ebx, [esi + 0x41]
lea eax, [ebp - 8]
mov edx, ebx
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 8]
lea eax, [ebp - 0xc]
call fcn.00403d1c
mov edx, 0x559cc4
lea eax, [ebp - 0xc]
mov cl, 2
call fcn.00403cec
lea edx, [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.00405848
mov eax, dword [ebp - 4]
call fcn.00405a74
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x559c8f
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.004057cc
mov edx, dword [ebp - 0x10]
mov eax, edi
call fcn.004058b0
inc esi
cmp esi, 0x1a
jne 0x559c35
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x559cba
lea eax, [ebp - 0x10]
call fcn.004055e4
lea eax, [ebp - 4]
call fcn.004055e4
ret

Function at 0x55a294
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
xor ecx, ecx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x55a324
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 8]
push edx
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x10d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
lea eax, [ebp - 0x114]
lea edx, [ebp - 0x10d]
mov ecx, 0x105
call fcn.00405854
mov eax, dword [ebp - 0x114]
lea edx, [ebp - 4]
call fcn.004127b8
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00405638
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55a32b
lea eax, [ebp - 0x114]
call fcn.004055e4
lea eax, [ebp - 4]
call fcn.004055e4
ret
Function at 0x55b86c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], edx
xor eax, eax
push ebp
push 0x55ba78
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x588700]
cmp dword [eax + 0x26c], 0
jle 0x55ba5a
mov eax, dword [0x588700]
cmp dword [eax + 0x268], 0
jle 0x55ba5a
xor ebx, ebx
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x14], 0
lea edx, [ebp - 0x18]
xor ecx, ecx
mov eax, 0x55ba8c
call fcn.0040e788
mov ecx, dword [ebp - 0x10]
mov edx, dword [0x588d18]
mov edx, dword [edx]
lea eax, [ebp - 4]
call fcn.004058fc
mov eax, dword [ebp - 4]
call fcn.0040d524
test al, al
je 0x55b905
mov eax, dword [ebp - 4]
call fcn.00405a74
push eax
call sub.kernel32.dll_DeleteFileA
mov eax, dword [ebp - 4]
call fcn.0040d524
test al, al
je 0x55b905
inc ebx
jmp 0x55b8af
mov eax, dword [0x588700]
mov eax, dword [eax + 0x268]
cdq
push edx
push eax
mov eax, dword [0x588adc]
mov eax, dword [eax]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
push 0xffff
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x41c270]
call fcn.00421594
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x55b979
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x588700]
mov eax, dword [eax + 0x26c]
cdq
push edx
push eax
mov eax, dword [0x588adc]
mov eax, dword [eax]
mov edx, dword [ebp - 8]
call fcn.0055b764
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55b980
mov eax, dword [ebp - 8]
call fcn.004046a4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55ba7f
lea eax, [ebp - 0x10]
call fcn.004055e4
lea eax, [ebp - 4]
call fcn.004055e4
ret
Function at 0x5644ac
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
xor ecx, ecx
mov dword [ebp - 0x5c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405a64
xor eax, eax
push ebp
push 0x564609
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00408954
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebp - 0x18], bx
mov dword [ebp - 0x1c], 0x10
mov dword [ebp - 0x20], 0x18
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.0040d99c
mov eax, dword [ebp - 0x5c]
call fcn.00405a74
push eax
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00405a74
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x5645e8
mov ebx, dword [ebp - 0x50]
jmp 0x5645eb
or ebx, 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x564610
lea eax, [ebp - 0x5c]
call fcn.004055e4
lea eax, [ebp - 4]
call fcn.004055e4
ret
Function at 0x5646cc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405a64
xor eax, eax
push ebp
push 0x5648f1
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x44
call fcn.00403e38
lea eax, [ebp - 0x50]
push eax
call sub.kernel32.dll_GetStartupInfoA_1
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040d99c
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x68], eax
mov byte [ebp - 0x64], 0xb
lea edx, [ebp - 0x68]
xor ecx, ecx
mov eax, 0x564908
call fcn.0040e788
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x50]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00405a74
push eax
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00405a74
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x564880
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5648f8
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405608
ret