joyce8/EMBER2024-capa huggingface dataset:
Function at 0x57f6a4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], ecx
mov byte [ebp - 9], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405294
xor eax, eax
push ebp
push 0x57f745
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.00404e14
mov eax, dword [ebp - 4]
test eax, eax
je 0x57f6e8
sub eax, 4
mov eax, dword [eax]
mov edi, eax
test edi, edi
jle 0x57f717
mov esi, 1
mov eax, dword [ebp - 4]
movzx ebx, byte [eax + esi - 1]
xor bl, byte [ebp - 9]
lea eax, [ebp - 0x14]
mov edx, ebx
call fcn.00404ffc
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 8]
call fcn.004050e0
inc esi
dec edi
jne 0x57f6f3
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00404e68
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57f74c
lea eax, [ebp - 0x14]
call fcn.00404e14
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404e38
ret

Function at 0x57f81c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
xor eax, eax
mov dword [ebp - 0x110], eax
xor eax, eax
push ebp
push 0x57f8ae
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x109]
xor ecx, ecx
mov edx, 0x104
call fcn.00403730
lea eax, [ebp - 4]
push eax
push 0x1a
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x109]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
lea eax, [ebp - 0x110]
lea edx, [ebp - 0x109]
mov ecx, 0x105
call fcn.00405084
mov edx, dword [ebp - 0x110]
mov eax, 0x5c64fc
mov ecx, 0x57f8c4
call fcn.0040512c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57f8b5
lea eax, [ebp - 0x110]
call fcn.00404e14
ret

Function at 0x57f8c8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov esi, eax
mov eax, esi
call fcn.00404e14
push esp
push 1
push 0
push 0x57f960
push 0x80000000
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x57f957
mov dword [esp + 4], 0x104
push 4
push 0x1000
mov eax, dword [esp + 0xc]
push eax
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, dword [esp + 4]
call fcn.00403730
lea eax, [esp + 4]
push eax
mov edi, ebx
push edi
push 0
push 0
push 0x57f99c
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x57f941
mov eax, esi
mov edx, edi
call fcn.0040500c
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
push 0x8000
push 0
push ebx
call sub.kernel32.dll_VirtualFree_1
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x57f9a0
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe5c
push ebx
xor edx, edx
mov dword [ebp - 0x1a4], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
Function at 0x58019c
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffd4
mov dword [esp], eax
cmp dword [esp], 0
je 0x580331
mov eax, dword [esp]
cmp word [eax], 0x5a4d
jne 0x580331
mov eax, dword [eax + 0x3c]
add eax, dword [esp]
cmp dword [eax], 0x4550
jne 0x580331
mov edx, dword [eax + 0x80]
test edx, edx
je 0x580331
cmp dword [eax + 0x84], 0
je 0x580331
mov esi, edx
add esi, dword [esp]
jmp 0x580327
mov eax, dword [esp]
add eax, dword [esi + 0xc]
mov dword [esp + 4], eax
mov edx, 0x58033c
mov eax, dword [esp + 4]
call fcn.0040ad4c
test eax, eax
je 0x580219
add esi, 0x14
jmp 0x580327
mov ebx, dword [esp]
add ebx, dword [esi]
mov edi, 1
jmp 0x58031a
cmp ebp, 0x80000013
jne 0x58029f
mov eax, 0x5b3938
mov dword [esp + 8], eax
mov eax, dword [esp]
add eax, dword [esi + 0x10]
mov edx, edi
dec edx
add edx, edx
add edx, edx
add eax, edx
mov dword [0x5c651c], eax
mov eax, dword [0x5c651c]
mov eax, dword [eax]
mov dword [0x5c652c], eax
push 0x1c
lea eax, [esp + 0x14]
push eax
mov eax, dword [0x5c651c]
push eax
call sub.kernel32.dll_VirtualQuery_1
lea eax, [esp + 0x18]
push eax
push 4
mov eax, dword [esp + 0x24]
push eax
mov eax, dword [0x5c651c]
push eax
call sub.kernel32.dll_VirtualProtect
push 0x5c6534
push 4
lea eax, [esp + 0x10]
push eax
mov eax, dword [0x5c651c]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_WriteProcessMemory
cmp dword [ebx], 0x80000010
jne 0x580316
mov eax, 0x5b3b7c
mov dword [esp + 0xc], eax
mov eax, dword [esp]
add eax, dword [esi + 0x10]
mov edx, edi
dec edx
add edx, edx
add edx, edx
add eax, edx
mov dword [0x5c6520], eax
mov eax, dword [0x5c6520]
mov eax, dword [eax]
mov dword [0x5c6530], eax
push 0x1c
lea eax, [esp + 0x14]
push eax
mov eax, dword [0x5c6520]
push eax
call sub.kernel32.dll_VirtualQuery_1
lea eax, [esp + 0x18]
push eax
push 4
mov eax, dword [esp + 0x24]
push eax
mov eax, dword [0x5c6520]
push eax
call sub.kernel32.dll_VirtualProtect
push 0x5c6534
push 4
lea eax, [esp + 0x14]
push eax
mov eax, dword [0x5c6520]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_WriteProcessMemory
inc edi
add ebx, 4
mov ebp, dword [ebx]
test ebp, ebp
jne 0x580228
add esi, 0x14
cmp dword [esi + 0x10], 0
jne 0x5801f5
add esp, 0x2c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x583b94
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x2001f
push 0
push 0x583c2c
push 0
mov eax, ebx
call fcn.004052a4
push eax
mov eax, dword [ebp + 8]
push eax
call sub.advapi32.dll_RegCreateKeyExA
mov ebx, eax
test ebx, ebx
jne 0x583c07
mov ebx, esi
test ebx, ebx
je 0x583bdd
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
push ebx
mov eax, esi
call fcn.004052a4
push eax
push 1
push 0
mov eax, edi
call fcn.004052a4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
test ebx, ebx
je 0x583c22
mov ecx, dword [0x5bed58]
mov dl, 1
mov eax, dword [0x582940]
call fcn.0040e680
call fcn.0040476c
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x583d60
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x408244]
call fcn.00405a60
xor eax, eax
push ebp
push 0x583f01
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x5bccc0], 0
jne 0x583dbb
mov ecx, dword [0x5be9bc]
mov dl, 1
mov eax, dword [0x408b44]
call fcn.0040e680
call fcn.0040476c
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x10
call fcn.00403730
mov eax, ebx
call fcn.00405768
mov dword [ebp - 0x24], eax
mov esi, 0x583f10
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x38]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.00406bec
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
call fcn.00405778
test eax, eax
jle 0x583ea4
mov dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x583e90
lea eax, [ebp - 0x4c]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00405084
mov edi, dword [ebp - 0x4c]
test edi, edi
je 0x583e36
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x50]
mov edx, ebx
call fcn.0040509c
mov esi, dword [ebp - 0x50]
test esi, esi
je 0x583e4c
sub esi, 4
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x54]
mov edx, ebx
call fcn.0040509c
mov eax, dword [ebp - 0x54]
call fcn.004052a4
push eax
push edi
lea eax, [ebp - 0x58]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00405084
mov eax, dword [ebp - 0x58]
call fcn.004052a4
push eax
push 1
push 0x400
call sub.kernel32.dll_CompareStringA_1
sub eax, 2
test eax, eax
sete al
jmp 0x583e92
xor eax, eax
test al, al
je 0x583e9d
mov ebx, 0x15
jmp 0x583ea9
mov ebx, 0x10
jmp 0x583ea9
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x28]
push eax
push ebx
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [0x5bccc0]
call fcn.00583b2c
mov eax, dword [ebp - 4]
call fcn.00583b2c
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.00406c04
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x583f08
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.00404e38
lea eax, [ebp - 0xc]
mov edx, dword [0x408244]
call fcn.00405b30
ret
Function at 0x587814
Capabilities:
Hide graphical window

Disassembly:
push ebx
add esp, 0xfffffff0
mov ebx, eax
mov eax, ebx
call fcn.00587274
test byte [ebx + 0x285], 4
jne 0x5878a9
mov edx, esp
mov eax, ebx
call fcn.0044c8c4
push esp
mov eax, ebx
call fcn.00454ebc
push eax
push 0
mov eax, ebx
test eax, eax
je 0x587849
sub eax, 0xfffffd34
push eax
push 0
push 0xfffffffffffffffb
mov eax, dword [ebx + 0x260]
push eax
mov eax, dword [eax]
call dword [eax + 0x2c]
cmp dword [ebx + 0x274], 0
jne 0x58787a
mov ecx, dword [0x5beed4]
mov dl, 1
mov eax, dword [0x582818]
call fcn.0040e680
call fcn.0040476c
mov eax, ebx
call fcn.00587dec
cmp byte [ebx + 0x57], 0
jne 0x5878b0
mov eax, ebx
call fcn.004550cc
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5878b0
push 0
mov eax, ebx
call fcn.004550cc
push eax
call sub.user32.dll_ShowWindow
jmp 0x5878b0
mov eax, ebx
call fcn.004512b8
add esp, 0x10
pop ebx
ret

Function at 0x58bdc8
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x58be2f
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
call sub.user32.dll_GetWindowTextLengthA
mov ebx, eax
lea edi, [ebx + 1]
mov edx, edi
lea eax, [ebp - 4]
call fcn.00405534
push edi
mov eax, dword [ebp - 4]
call fcn.004052a4
push eax
push esi
call sub.user32.dll_GetWindowTextA
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404e68
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58be36
lea eax, [ebp - 4]
call fcn.00404e14
ret

Function at 0x5930a8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
push 0x40
push 0x1000
push pe_nt_image_headers32
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x593132
xor edx, edx
push ebp
push 0x593113
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov dword [eax], 0x448b5050
mov dword [eax + 4], 0x44890824
mov dword [eax + 8], 0x58b0424
lea edx, [ebx + 4]
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], 0x8244489
mov dword [eax + 0x14], 0x25ff9058
mov dword [eax + 0x18], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x593132
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x594370
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405294
mov eax, dword [ebp - 8]
call fcn.00405294
mov eax, dword [ebp - 0xc]
call fcn.00405294
xor eax, eax
push ebp
push 0x59449f
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov ebx, 0x14
mov dword [ebp - 0x28], 0x14
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 3
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0x48], 2
mov dword [ebp - 0x40], 2
mov eax, dword [ebp - 8]
call fcn.004052a4
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x34], 3
mov eax, dword [ebp - 0xc]
call fcn.004052a4
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0xc]
call fcn.0043db50
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x18], eax
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
call fcn.004052a4
push eax
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x594484
xor eax, eax
push ebp
push 0x59447d
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
lea eax, [ebp - 0x28]
push eax
push 0x4b
push 0
call sub.wininet.dll_InternetSetOptionA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x59445d
push 0
push 0
push 0x25
push 0
call sub.wininet.dll_InternetSetOptionA
test eax, eax
jne 0x594461
xor eax, eax
jmp 0x594463
mov al, 1
mov byte [ebp - 0xd], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x594484
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5944a6
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404e38
ret
Function at 0x5944b0
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405294
mov eax, dword [ebp - 8]
call fcn.00405294
mov eax, dword [ebp - 0xc]
call fcn.00405294
mov eax, dword [ebp + 0xc]
call fcn.00405294
xor eax, eax
push ebp
push 0x59461a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov ebx, 0x14
mov dword [ebp - 0x28], 0x14
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 3
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x40], 2
mov eax, dword [ebp - 8]
call fcn.004052a4
mov esi, eax
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x34], 3
mov eax, 0x594630
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x18], eax
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
call fcn.004052a4
push eax
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x5945f7
xor edx, edx
push ebp
push 0x5945f0
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
push 3
mov eax, dword [ebp + 0xc]
call fcn.004052a4
push eax
mov eax, dword [ebp - 0xc]
call fcn.004052a4
push eax
movzx eax, word [ebp + 8]
push eax
push esi
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetConnectA
test eax, eax
je 0x5945d9
push ebx
lea eax, [ebp - 0x28]
push eax
push 0x4b
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetSetOptionA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x5945d0
push 0
push 0
push 0x25
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetSetOptionA
test eax, eax
jne 0x5945d4
xor eax, eax
jmp 0x5945d6
mov al, 1
mov byte [ebp - 0xd], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5945f7
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x594621
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404e38
lea eax, [ebp + 0xc]
call fcn.00404e14
ret
Function at 0x594638
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
mov byte [ebp - 1], 0
mov ebx, 0x14
mov dword [ebp - 0x1c], 0x14
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 3
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x3c], 3
mov dword [ebp - 0x34], 2
mov eax, 0x594700
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 3
mov eax, 0x594704
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 1
push 0x594700
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x5946f7
xor eax, eax
push ebp
push 0x5946f0
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
lea eax, [ebp - 0x1c]
push eax
push 0x4b
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetSetOptionA
push 0
push 0
push 0x25
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetSetOptionA
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5946f7
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
movzx eax, byte [ebp - 1]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x59497c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
xor edx, edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x594b8e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x20], 0x105
mov eax, dword [ebp - 0x20]
call fcn.00402fac
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x5949fa
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
test eax, eax
je 0x5949e4
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x10]
call fcn.0040500c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x594a01
mov eax, dword [ebp - 0x10]
call fcn.00402fc8
ret

Function at 0x596b20
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov bl, 2
lea eax, [ebp - 0xa]
xor ecx, ecx
mov edx, 0xa
call fcn.00403730
push 0xa
lea eax, [ebp - 0xa]
push eax
push 0xd
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
je 0x596b5a
cmp byte [ebp - 0xa], 0x31
jne 0x596b58
mov bl, 1
jmp 0x596b5a
xor ebx, ebx
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x59fde8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor edx, edx
mov dword [ebp - 0x24], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x59fe6b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1e]
xor ecx, ecx
mov edx, 0x1e
call fcn.00403730
xor eax, eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], 3
lea eax, [ebp - 0x24]
mov ecx, 0x59fe84
mov edx, ebx
call fcn.0040512c
mov eax, dword [ebp - 0x24]
call fcn.004052a4
mov dword [ebp - 0x16], eax
mov eax, 0x59fe88
mov dword [ebp - 0x12], eax
mov word [ebp - 0xe], 0x14
lea eax, [ebp - 0x1e]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59fe72
lea eax, [ebp - 0x24]
call fcn.00404e14
ret

Function at 0x59fe8c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
xor eax, eax
mov dword [ebp - 0x10c], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x59ff3f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x108]
xor ecx, ecx
mov edx, pe_nt_image_headers32
call fcn.00403730
lea eax, [ebp - 8]
push eax
push 0x1a
mov eax, dword [0x5bf158]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x108]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
lea edx, [ebp - 0x10c]
lea eax, [ebp - 0x108]
call fcn.0040ae38
mov edx, dword [ebp - 0x10c]
lea eax, [ebp - 4]
mov ecx, 0x59ff54
call fcn.0040512c
mov eax, dword [ebp - 4]
call fcn.0040a6bc
test al, al
je 0x59ff1e
mov eax, dword [ebp - 4]
call fcn.0059fde8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59ff46
lea eax, [ebp - 0x10c]
call fcn.00404e14
lea eax, [ebp - 4]
call fcn.00404e14
ret
Function at 0x5a37e4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x18]
xor eax, eax
mov dword [ebp - 0xc], eax
test ebx, ebx
je 0x5a3817
movzx eax, byte [ebx]
mov edx, dword [0x5bd870]
cmp al, byte [edx]
jne 0x5a3817
cmp dword [ebp + 8], 0x38
je 0x5a3821
mov eax, 0xfffffffa
jmp 0x5a39e7
lea eax, [esi + 0x18]
call fcn.00404e14
cmp dword [esi + 0x20], 0
jne 0x5a383b
mov dword [esi + 0x20], 0x5a36f4
xor eax, eax
mov dword [esi + 0x28], eax
cmp dword [esi + 0x24], 0
jne 0x5a3848
mov dword [esi + 0x24], 0x5a36ec
cmp dword [ebp - 4], 0xffffffff
jne 0x5a3855
mov dword [ebp - 4], 6
test edi, edi
jge 0x5a3862
mov dword [ebp - 0xc], 1
neg edi
cmp dword [ebp + 0x14], 1
jl 0x5a3896
cmp dword [ebp + 0x14], 9
jg 0x5a3896
cmp dword [ebp - 8], 8
jne 0x5a3896
cmp edi, 8
jl 0x5a3896
cmp edi, 0xf
jg 0x5a3896
cmp dword [ebp - 4], 0
jl 0x5a3896
cmp dword [ebp - 4], 9
jg 0x5a3896
cmp dword [ebp + 0x10], 0
jl 0x5a3896
cmp dword [ebp + 0x10], 2
jle 0x5a38a0
mov eax, 0xfffffffe
jmp 0x5a39e7
mov eax, esi
mov ecx, 0x16bc
mov edx, 1
call fcn.005a3700
mov ebx, eax
test ebx, ebx
jne 0x5a38c1
mov eax, 0xfffffffc
jmp 0x5a39e7
mov dword [esi + 0x1c], ebx
mov dword [ebx], esi
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0x18], eax
mov eax, edi
mov dword [ebx + 0x28], eax
mov ecx, eax
mov edx, 1
shl edx, cl
mov dword [ebx + 0x24], edx
dec edx
mov dword [ebx + 0x2c], edx
mov eax, dword [ebp + 0x14]
add eax, 7
mov dword [ebx + 0x48], eax
mov ecx, eax
mov edx, 1
shl edx, cl
mov dword [ebx + 0x44], edx
dec edx
mov dword [ebx + 0x4c], edx
mov eax, dword [ebx + 0x48]
add eax, 3
dec eax
mov ecx, 3
xor edx, edx
div ecx
mov dword [ebx + 0x50], eax
mov eax, esi
mov ecx, 2
mov edx, dword [ebx + 0x24]
call fcn.005a3700
mov dword [ebx + 0x30], eax
mov eax, esi
mov ecx, 2
mov edx, dword [ebx + 0x24]
call fcn.005a3700
mov dword [ebx + 0x38], eax
mov eax, esi
mov ecx, 2
mov edx, dword [ebx + 0x44]
call fcn.005a3700
mov dword [ebx + 0x3c], eax
mov ecx, dword [ebp + 0x14]
add ecx, 6
mov edi, 1
shl edi, cl
mov dword [ebx + 0x1690], edi
mov eax, esi
mov ecx, 4
mov edx, edi
call fcn.005a3700
mov dword [ebx + 8], eax
mov edx, dword [ebx + 0x1690]
add edx, edx
add edx, edx
mov dword [ebx + 0xc], edx
cmp dword [ebx + 0x30], 0
je 0x5a398c
cmp dword [ebx + 0x38], 0
je 0x5a398c
cmp dword [ebx + 0x3c], 0
je 0x5a398c
cmp dword [ebx + 8], 0
jne 0x5a39a7
lea eax, [esi + 0x18]
mov edx, 0x5bd8f8
call fcn.00405078
mov eax, esi
call fcn.005a3d94
mov eax, 0xfffffffc
jmp 0x5a39e7
mov edx, dword [ebx + 0x1690]
shr edx, 1
lea eax, [eax + edx*2]
mov dword [ebx + 0x1698], eax
mov eax, dword [ebx + 0x1690]
lea eax, [eax + eax*2]
mov edx, dword [ebx + 8]
lea eax, [edx + eax]
mov dword [ebx + 0x168c], eax
mov eax, dword [ebp - 4]
mov dword [ebx + 0x78], eax
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0x7c], eax
movzx eax, byte [ebp - 8]
mov byte [ebx + 0x1d], al
mov eax, esi
call fcn.005a3a18
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14