joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48aab0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x84
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x98]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x14], 0x80
push eax
mov ebp, dword [edi + 0x1c4]
or esi, 0xffffffff
mov ebx, dword [edi]
push ebp
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x48ab04
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x80
push eax
lea eax, [esp + 0x18]
push eax
push ebp
call dword [sym.imp.WS2_32.dll_accept]
mov esi, eax
push ebp
push edi
call fcn.0045fd90
add esp, 8
cmp esi, 0xffffffff
jne 0x48ab31
push str.Error_accept__ing_server_connect
push ebx
call fcn.0045e600
add esp, 8
mov eax, 0x1e
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x84
ret
push str.Connection_accepted_from_server_n
push ebx
call fcn.0045e540
push 1
push esi
mov byte [edi + 0x2b0], 0
mov dword [edi + 0x1c4], esi
call fcn.004710b0
add esp, 0x10
mov byte [edi + 0x1d1], 1
cmp dword [ebx + 0x610], 0
je 0x48aba7
push 1
push ebx
call fcn.0044c510
mov eax, dword [ebx + 0x610]
push 1
push esi
push dword [ebx + 0x614]
call eax
push 0
push ebx
mov esi, eax
call fcn.0044c510
add esp, 0x1c
test esi, esi
je 0x48aba7
push edi
call fcn.0048aa00
add esp, 4
mov eax, 0x2a
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x84
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x84
ret
Function at 0x49479d
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004947a8
Function at 0x499370
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x18]
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
test eax, eax
je 0x499387
mov ecx, dword [esi + 0xc]
jmp 0x49938a
mov ecx, dword [ebp + 0x20]
cmp dword [ebp + 0x1c], 0
mov dword [ebp - 8], ecx
jne 0x4993b5
test eax, eax
jne 0x4993b5
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0
push dword [esi + 0x14]
push dword [esi + 8]
push 0
push dword [ebp + 0x24]
push ecx
push dword [esi]
call sub.bcrypt.dll_BCryptDecrypt
jmp 0x4993d2
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0
push dword [esi + 0x14]
push dword [esi + 8]
push 0
push dword [ebp + 0x24]
push ecx
push dword [esi]
call sub.bcrypt.dll_BCryptEncrypt
mov edi, eax
test edi, edi
js 0x4994a6
push ebx
push dword [ebp - 4]
call fcn.0042da5e
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4994a0
cmp dword [ebp + 0x1c], 0
jne 0x49941f
cmp dword [ebp + 0x18], 0
jne 0x49941f
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push ebx
push dword [esi + 0x14]
push dword [esi + 8]
push 0
push dword [ebp + 0x24]
push dword [ebp - 8]
push dword [esi]
call sub.bcrypt.dll_BCryptDecrypt
jmp 0x49943e
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push ebx
push dword [esi + 0x14]
push dword [esi + 8]
push 0
push dword [ebp + 0x24]
push dword [ebp - 8]
push dword [esi]
call sub.bcrypt.dll_BCryptEncrypt
mov edi, eax
test edi, edi
js 0x499466
cmp dword [ebp + 0x18], 0
mov eax, dword [ebp + 0x20]
je 0x499490
push dword [ebp + 0x24]
push ebx
push eax
push eax
call fcn.0049b860
push dword [esi + 0x1c]
push dword [esi + 0xc]
call fcn.0049b930
add esp, 0x18
mov esi, dword [ebp - 4]
test esi, esi
je 0x49947b
mov eax, ebx
nop
mov byte [eax], 0
lea eax, [eax + 1]
sub esi, 1
jne 0x499470
push ebx
call fcn.0041d2d7
add esp, 4
sar edi, 0x1f
mov eax, edi
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 4]
push esi
push ebx
push eax
call fcn.00418f20
add esp, 0xc
jmp 0x499469
mov edi, 0xc0000017
pop ebx
sar edi, 0x1f
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x49ab10
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
je 0x49acf0
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x49acf0
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x49acf0
mov ecx, dword [ebp + 0x14]
test ecx, ecx
je 0x49acf0
mov ecx, dword [ecx + 4]
mov esi, dword [eax + 4]
add ecx, 0x18
add esi, ecx
mov dword [ebp - 8], 0x18
push esi
call fcn.0042da5e
mov edi, eax
add esp, 4
mov dword [ebp - 0x14], edi
test edi, edi
je 0x49acf0
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov dword [edi], 0x31415352
mov ecx, dword [eax + 4]
shl ecx, 3
mov dword [edi + 4], ecx
mov ecx, dword [edx + 4]
mov dword [edi + 8], ecx
mov eax, dword [eax + 4]
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
push dword [edx + 4]
mov eax, dword [ebp - 8]
push dword [edx]
add eax, edi
push eax
call fcn.00418f20
mov eax, dword [ebp + 0x14]
push dword [eax + 4]
push dword [eax]
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 4]
add eax, edi
add eax, dword [ebp - 8]
push eax
call fcn.00418f20
add esp, 0x18
mov dword [ebp - 8], 0
lea eax, [ebp - 0xc]
push 0
push esi
push edi
push eax
push str.RSAPUBLICBLOB
push 0
push dword [0x521bec]
call sub.bcrypt.dll_BCryptImportKeyPair
mov edi, eax
test edi, edi
js 0x49acc3
push 1
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0
push 0
push 0
push dword [ebx + 4]
push dword [ebx]
push dword [ebp - 0xc]
call sub.bcrypt.dll_BCryptEncrypt
mov edi, eax
test edi, edi
js 0x49acbb
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.0049aab0
add esp, 8
test eax, eax
jne 0x49acb6
mov ecx, dword [ebp - 4]
cmp dword [ebx + 4], ecx
cmova ecx, dword [ebx + 4]
push ecx
mov dword [ebp - 4], ecx
call fcn.0042da5e
mov edi, eax
add esp, 4
mov dword [ebp - 0x10], edi
test edi, edi
je 0x49acb6
push dword [ebx + 4]
push dword [ebx]
push dword [ebp - 4]
push edi
call fcn.0049a170
mov ebx, dword [ebp + 8]
lea eax, [ebp - 8]
add esp, 0x10
push 1
push eax
push dword [ebx + 4]
push dword [ebx]
push 0
push 0
push 0
push dword [ebp - 4]
push edi
push dword [ebp - 0xc]
call sub.bcrypt.dll_BCryptEncrypt
mov ecx, dword [ebp - 4]
mov edi, eax
mov edx, dword [ebp - 0x10]
test ecx, ecx
je 0x49ac9b
mov eax, edx
nop dword [eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x49ac90
push edx
call fcn.0041d2d7
add esp, 4
test edi, edi
js 0x49acbb
push dword [ebp - 8]
push ebx
call fcn.0049aab0
add esp, 8
jmp 0x49acbb
mov edi, 0xc0000017
push dword [ebp - 0xc]
call sub.bcrypt.dll_BCryptDestroyKey
mov ecx, dword [ebp - 0x14]
test esi, esi
je 0x49acdb
mov eax, ecx
nop dword [eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub esi, 1
jne 0x49acd0
push ecx
call fcn.0041d2d7
add esp, 4
sar edi, 0x1f
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49b130
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
sub esp, 8
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 0x10]
mov dword [eax], 0
test edi, edi
jne 0x49b15a
mov edi, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x49b151
sub edi, ecx
mov esi, dword [ebp + 8]
lea ecx, [edi*4]
mov eax, 0xaaaaaaab
mul ecx
mov eax, dword [esi + 4]
shr edx, 1
add edx, 4
push esi
push edx
call eax
add esp, 8
mov dword [ebp - 4], eax
mov esi, eax
mov dword [ebp - 8], esi
test eax, eax
jne 0x49b18d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x49b256
xor edx, edx
xor eax, eax
nop dword [eax]
test edi, edi
je 0x49b1ab
mov cl, byte [ebx]
inc edx
inc ebx
dec edi
jmp 0x49b1b6
cmp eax, 3
jae 0x49b273
xor cl, cl
mov byte [ebp + eax + 8], cl
inc eax
cmp eax, 3
jl 0x49b1a0
mov ah, byte [ebp + 8]
mov cl, byte [ebp + 9]
mov al, ah
shr al, 2
and ah, 3
mov byte [ebp + 0xf], al
mov al, cl
shl ah, 4
and cl, 0xf
shr al, 4
or ah, al
shl cl, 2
mov byte [ebp + 0x13], ah
mov ah, byte [ebp + 0xa]
mov al, ah
and ah, 0x3f
shr al, 6
or cl, al
sub edx, 1
je 0x49b21c
sub edx, 1
je 0x49b20f
movzx eax, ah
mov dl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
movzx eax, cl
mov ch, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
jmp 0x49b220
movzx eax, cl
mov dl, 0x3d
mov ch, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
jmp 0x49b220
mov dl, 0x3d
mov ch, dl
movzx eax, byte [ebp + 0xf]
mov esi, dword [ebp - 4]
mov cl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
movzx eax, byte [ebp + 0x13]
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi], cl
mov byte [esi + 1], al
mov eax, dword [ebp - 4]
mov esi, dword [ebp - 8]
mov byte [eax + 2], ch
mov byte [eax + 3], dl
add eax, 4
mov dword [ebp - 4], eax
test edi, edi
jne 0x49b195
mov byte [eax], 0
mov eax, dword [ebp + 0x14]
mov dword [eax], esi
lea eax, [esi + 1]
mov cl, byte [esi]
inc esi
test cl, cl
jne 0x49b261
sub esi, eax
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0043fcdb
int3
Function at 0x49b860
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x14]
xor ebx, ebx
test edi, edi
je 0x49b923
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
cmp edi, 0x40
jb 0x49b906
lea ecx, [esi - 1]
lea edx, [eax - 1]
add ecx, edi
add edx, edi
cmp eax, ecx
ja 0x49b894
cmp edx, esi
jae 0x49b906
mov edx, dword [ebp + 0xc]
lea ecx, [edx - 1]
add ecx, edi
cmp eax, ecx
ja 0x49b8a9
lea ecx, [edi - 1]
add ecx, eax
cmp ecx, edx
jae 0x49b909
mov ecx, edi
and ecx, 0xffffffc0
nop
movups xmm0, xmmword [esi]
add ebx, 0x40
movups xmm1, xmmword [edx]
pxor xmm1, xmm0
movups xmm0, xmmword [esi + 0x10]
movups xmmword [eax], xmm1
movups xmm1, xmmword [edx + 0x10]
pxor xmm1, xmm0
movups xmm0, xmmword [esi + 0x20]
movups xmmword [eax + 0x10], xmm1
movups xmm1, xmmword [edx + 0x20]
pxor xmm1, xmm0
movups xmm0, xmmword [esi + 0x30]
add esi, 0x40
movups xmmword [eax + 0x20], xmm1
movups xmm1, xmmword [edx + 0x30]
add edx, 0x40
pxor xmm1, xmm0
movups xmmword [eax + 0x30], xmm1
add eax, 0x40
cmp ebx, ecx
jb 0x49b8b0
mov dword [ebp + 0x14], ebx
cmp ebx, edi
jae 0x49b922
jmp 0x49b909
mov edx, dword [ebp + 0xc]
sub edx, eax
sub esi, eax
sub edi, ebx
nop
mov cl, byte [esi + eax]
lea eax, [eax + 1]
xor cl, byte [edx + eax - 1]
mov byte [eax - 1], cl
sub edi, 1
jne 0x49b910
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4aa8d3
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4e81c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp eax, 0x1a
jbe 0x4aa916
call fcn.0042da7c
mov dword [eax], 0xf
call fcn.0042da69
mov dword [eax], 0xd
call fcn.0042a6c7
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042fae0
leave
ret
test eax, eax
jne 0x4aa91d
inc eax
jmp 0x4aa90a
add eax, 0x40
push 0x3a
mov word [ebp - 0xc], ax
pop eax
mov word [ebp - 0xa], ax
push 0x5c
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, eax
test ecx, ecx
je 0x4aa908
xor eax, eax
cmp ecx, 1
setne al
jmp 0x4aa90a
Function at 0x4aebf1
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.004aed88
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x4aed60
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x4aed60
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x4aed15
jg 0x4aec4d
test eax, eax
je 0x4aed0b
push 1
push 0x1000
call fcn.0042a930
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x4aec70
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x4aed02
push 0x8000
push ebx
call fcn.004aeaeb
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x4aec99
jg 0x4aec94
cmp ecx, 0x1000
jb 0x4aec99
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.00463092
add esp, 0x10
cmp eax, 0xffffffff
je 0x4aecde
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x4aec94
jl 0x4aecc5
test ecx, ecx
jne 0x4aec86
push dword [ebp - 0xc]
push ebx
call fcn.004aeaeb
push esi
call fcn.0042a98d
add esp, 0xc
xor ebx, ebx
jmp 0x4aed6e
cmp byte [edi + 0x24], 0
je 0x4aecf5
cmp dword [edi + 0x20], 5
jne 0x4aecf5
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x4aed00
mov ebx, dword [edi + 0x18]
jmp 0x4aed02
xor ebx, ebx
push esi
call fcn.0042a98d
pop ecx
jmp 0x4aed6e
test ecx, ecx
jg 0x4aecd7
jl 0x4aed15
test eax, eax
jae 0x4aecd7
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0043b510
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x4aed35
cmp byte [edi + 0x1c], 0
je 0x4aecd7
jmp 0x4aed66
push ebx
call fcn.0044b341
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x4aecd7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x4aed6e
cmp byte [edi + 0x1c], 0
je 0x4aed6b
mov ebx, dword [edi + 0x18]
jmp 0x4aed6e
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.0043b510
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4af11f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x4af1bc
push ebx
push esi
call fcn.004af20d
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0043dbff
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4af169
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4af1bb
push edi
push eax
call fcn.0042a9c7
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x4af189
call fcn.0042a98d
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4af1ba
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0043dbff
add esp, 0x20
test eax, eax
jne 0x4af1a8
push edi
call fcn.0042a98d
jmp 0x4af1b0
push ebx
call fcn.0042a98d
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x4af1bf
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x4af1d0
pop esi
ret
push ebx
push edi
push esi
call fcn.004af20d
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.0042a9c7
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4af1f8
push ebx
push esi
push edi
call fcn.00418f20
add esp, 0xc
push 0
call fcn.0042a98d
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x4af24f
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004af4ba
Function at 0x4af9a0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0xc
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0x4e81d0]
mov esi, eax
add esp, 4
test esi, esi
jne 0x4af9cb
pop esi
pop ebp
add esp, 0xc
ret
lea ecx, [esi + 0xc]
mov dword [esi], ebp
mov dword [esi + 4], ecx
mov eax, dword [ebp + 0xc]
add eax, ecx
push ebx
mov ebx, dword [esp + 0x24]
mov dword [esi + 8], eax
push edi
lea edi, [ebp + 4]
cmp ebx, dword [ebp + 0x10]
jbe 0x4afa1a
mov eax, dword [ebp]
push ecx
call eax
mov eax, dword [edi]
push ebx
push dword [esp + 0x2c]
push dword [esi + 4]
call eax
mov eax, dword [esi + 8]
add eax, dword [ebp + 0xc]
push dword [esi + 4]
mov dword [esp + 0x28], eax
push eax
mov eax, dword [ebp + 8]
call eax
mov ebx, dword [ebp + 0x14]
add esp, 0x18
mov dword [esp + 0x28], ebx
jmp 0x4afa22
mov eax, dword [esp + 0x24]
mov dword [esp + 0x14], eax
push dword [esi + 4]
mov eax, dword [ebp]
call eax
push dword [esi + 8]
mov eax, dword [ebp]
call eax
mov eax, dword [esp + 0x30]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x4afa93
mov ebp, dword [esp + 0x14]
mov ebx, eax
mov dword [esp + 0x18], eax
lea esp, [esp]
movzx eax, byte [ebp]
xor al, 0x36
mov byte [esp + 0x13], al
lea eax, [esp + 0x13]
push 1
push eax
push dword [esi + 4]
mov eax, dword [edi]
call eax
movzx eax, byte [ebp]
lea ebp, [ebp + 1]
xor al, 0x5c
mov byte [esp + 0x1f], al
lea eax, [esp + 0x1f]
push 1
push eax
push dword [esi + 8]
mov eax, dword [edi]
call eax
add esp, 0x18
sub ebx, 1
jne 0x4afa50
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x20]
cmp ebx, dword [ebp + 0x10]
jae 0x4afac5
jmp 0x4afaa0
mov eax, dword [edi]
push 1
push 0x4bd0c8
push dword [esi + 4]
call eax
mov eax, dword [edi]
push 1
push 0x4bd0c9
push dword [esi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [ebp + 0x10]
jb 0x4afaa0
pop edi
pop ebx
mov eax, esi
pop esi
pop ebp
add esp, 0xc
ret
Function at 0x545e23
Capabilities:
Get common file path

Disassembly:
push ebx
xor eax, eax
push eax
push eax
call fcn.00417e10
push dword [esp + 0x14]
call fcn.00401220
push edx
call fcn.00417fa0
pop edx
push eax
push edx
call fcn.00417fa0
pop edx
push eax
push 0x104
call fcn.00416b00
lea eax, [esp + 8]
push eax
call fcn.00417d00
lea eax, [esp]
push eax
push dword [esp + 0x14]
push 0
call sub.SHELL32.dll_SHGetSpecialFolderLocation
mov ebx, eax
and ebx, ebx
jne 0x545f0f
mov eax, dword [esp + 4]
push eax
push dword [esp + 4]
call sub.SHELL32.dll_SHGetPathFromIDListW
and eax, eax
je 0x545f0f
push dword [esp]
call sub.ole32.dll_CoTaskMemFree
push edx
call fcn.00417fa0
pop edx
push eax
push edx
call fcn.00417fa0
pop edx
push eax
push 1
push dword [esp + 0x10]
call fcn.00416a80
call fcn.00417fd0
mov edx, 0x4d39f8
call fcn.00401210
mov ecx, eax
call fcn.00401230
jne 0x545ef1
mov edx, dword [esp + 4]
push edx
call fcn.00417fa0
pop edx
push eax
push edx
call fcn.00417eb0
mov edx, 0x4d39f8
push edx
call fcn.00417eb0
lea eax, [esp + 8]
push eax
call fcn.00417d00
mov edx, dword [esp + 4]
push edx
call fcn.00417fa0
pop edx
push eax
push edx
call fcn.00417eb0
pop eax
push eax
call fcn.004011e0
pop edx
add eax, edx
jmp 0x545f19
call fcn.00417f80
mov word [eax], 0
push dword [esp + 4]
call fcn.00417f00
add esp, 8
pop ebx
ret 4
Function at 0x5566b2
Capabilities:
Get geographical location

Disassembly:
push ebp
push ebx
push edi
mov edx, 7
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x5566ba
call fcn.00417e10
mov edx, dword [esp + 0x2c]
lea ecx, [esp]
call fcn.004011b0
push edx
call fcn.00417fa0
pop edx
push eax
push edx
call fcn.00417fa0
pop edx
push eax
mov edx, str.http:__ip_api.com_json_
push edx
call fcn.00417eb0
mov edx, dword [esp + 8]
push edx
call fcn.00417eb0
mov edx, str._fieldsstatus_message_continent_continentCode_country_countryCode_region_regionName_city_district_zip_lat_lon_timezone_offset_currency_isp_org_as_asname_reverse_query
push edx
call fcn.00417eb0
call fcn.00417fd0
push 0
call fcn.004011f2
add dword [esp + 4], edx
call fcn.00405e41
call fcn.00401220
cdq
push edx
push eax
pop dword [esp + 8]
pop dword [esp + 8]
push dword [esp + 8]
push dword [esp + 8]
pop ebx
pop edi
cmp ebx, 0
jne 0x556748
cmp edi, 0
jne 0x556748
xor eax, eax
jmp 0x55674d
mov eax, 1
or eax, eax
je 0x556857
push edx
call fcn.00417fa0
pop edx
push eax
push edx
call fcn.00417fa0
pop edx
push eax
push 1
mov eax, dword [esp + 0x10]
push eax
call fcn.00405dba
lea eax, [esp + 0x1c]
push eax
call fcn.00417d00
mov eax, dword [esp + 4]
push eax
call fcn.00405c6b
push 2
push dword [esp + 0x1c]
push 0xffffffff
call fcn.004059b7
cdq
push edx
push eax
pop dword [esp + 0x10]
pop dword [esp + 0x10]
push dword [esp + 0x10]
push dword [esp + 0x10]
pop ebx
pop edi
cmp ebx, 0
jne 0x5567be
cmp edi, 0
jne 0x5567be
xor eax, eax
jmp 0x5567c3
mov eax, 1
or eax, eax
je 0x556857
push 0x4da62c
push 0x54
push 0x4e8dc0
call fcn.004179d0
push str.IPLocaleInfo
push 0x54
push dword [esp + 0x38]
mov eax, dword [esp + 0x18]
push eax
call fcn.004058e7
push eax
call fcn.00405483
mov eax, dword [esp + 0xc]
push eax
call fcn.00404e47
mov ebp, dword [esp + 0x30]
push dword [ebp + 4]
mov edx, str.success
pop ecx
call fcn.00401230
je 0x556857
push edx
call fcn.00417fa0
pop edx
push eax
push edx
call fcn.00417fa0
pop edx
push eax
call fcn.00412bca
push edx
push eax
mov eax, str.:__yyyy__mm__dd__hh:_ii:_ss
push eax
call fcn.00412e9c
mov ebp, dword [0x51ed1c]
lea eax, [ebp + 0x180]
push eax
call fcn.00417d00
mov dword [esp + 0x14], 1
mov eax, dword [esp + 0x14]
jmp 0x55685f
push dword [esp + 0x18]
call fcn.00417f00
push dword [esp]
call fcn.00417f00
add esp, 0x1c
pop edi
pop ebx
pop ebp
ret 8
Function at 0x55c774
Capabilities:
Get disk information

Disassembly:
push ebp
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00417e10
push dword [esp + 0x20]
call fcn.00401220
mov ebp, dword [0x51ed14]
lea eax, [ebp + 0x90]
push dword [eax + 4]
push dword [eax]
add dword [esp], 1
adc dword [esp + 4], 0
lea eax, [ebp + 0x90]
pop dword [eax]
pop dword [eax + 4]
mov ebp, dword [0x51ed0c]
cmp dword [ebp + 0x38], 0
je 0x55c7c1
jmp 0x55c934
mov edx, 0x4d302e
lea ecx, [esp + 0x10]
call fcn.004011b8
push dword [esp + 4]
push 0
call sub.KERNEL32.dll_GetLogicalDriveStringsW
mov dword [esp], eax
mov ebx, dword [esp]
inc ebx
add ebx, ebx
push ebx
call fcn.004176b0
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
je 0x55c915
push dword [esp + 4]
push dword [esp + 4]
call sub.KERNEL32.dll_GetLogicalDriveStringsW
mov eax, dword [esp + 4]
mov dword [esp + 0xc], eax
mov ebp, dword [esp + 0xc]
movzx ebx, word [ebp]
xor eax, eax
cmp ebx, eax
je 0x55c886
mov ebx, dword [esp + 0xc]
add ebx, 2
mov dword [esp + 8], ebx
mov ebp, dword [esp + 8]
movzx ebx, word [ebp]
xor eax, eax
cmp ebx, eax
je 0x55c83e
add dword [esp + 8], 2
jmp 0x55c829
mov edx, dword [esp + 0x10]
push edx
call fcn.00417fa0
pop edx
push eax
push edx
call fcn.00417eb0
push edx
call fcn.00417fa0
pop edx
push eax
push edx
call fcn.00417fa0
pop edx
push eax
push 1
push dword [esp + 0x1c]
call fcn.004177e0
pop eax
lea eax, [esp + 0x14]
push eax
call fcn.00417d00
mov ebx, dword [esp + 8]
add ebx, 2
mov dword [esp + 0xc], ebx
jmp 0x55c810
push dword [esp + 4]
call fcn.00417740
mov ebp, dword [0x51ed0c]
mov ebx, dword [ebp + 0x280]
cmp ebx, 0x5e0
jge 0x55c8f5
push edx
call fcn.00417fa0
pop edx
push eax
push edx
call fcn.00417fa0
pop edx
push eax
mov eax, 0x4d3a86
push eax
push dword [esp + 0x1c]
call fcn.00415f70
lea eax, [esp + 0x14]
push eax
call fcn.00417d00
push edx
call fcn.00417fa0
pop edx
push eax
push edx
call fcn.00417fa0
pop edx
push eax
mov eax, 0x4d3aa4
push eax
push dword [esp + 0x1c]
call fcn.00415f70
lea eax, [esp + 0x14]
push eax
call fcn.00417d00
mov edx, dword [esp + 0x10]
push edx
call fcn.00417fa0
pop edx
push eax
push edx
call fcn.00417eb0
pop eax
push eax
call fcn.004011e0
pop edx
add eax, edx
jmp 0x55c93e
mov edx, str.CDEFGHIJKLMNOPQRSTUVWXYZ
push edx
call fcn.00417fa0
pop edx
push eax
push edx
call fcn.00417eb0
pop eax
push eax
call fcn.004011e0
pop edx
add eax, edx
jmp 0x55c93e
call fcn.00417f80
mov word [eax], 0
push dword [esp + 0x10]
call fcn.00417f00
add esp, 0x14
pop ebx
pop ebp
ret