joyce8/EMBER2024-capa huggingface dataset:
Function at 0x517e14
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [eax]
push edx
call fcn.00554308
pop ecx
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0x41
jb 0x517e3a
cmp byte [ebp - 0x1d], 0x5a
jbe 0x517e41
xor eax, eax
jmp 0x517f75
lea edx, [ebp - 0x18]
push edx
push 0
push 0
push 1
push 1
call sub.MPR.dll_WNetOpenEnumA
test eax, eax
je 0x517e5d
xor eax, eax
jmp 0x517f75
mov dword [ebp - 0x14], 0xffffffff
xor edx, edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 8], 0x640
push dword [ebp - 8]
call fcn.00557db4
pop ecx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x517f5b
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0xc]
push edx
push dword [ebp - 4]
lea ecx, [ebp - 0x10]
push ecx
push dword [ebp - 0x18]
call sub.MPR.dll_WNetEnumResourceA
cmp eax, 0xea
jne 0x517ecd
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.00558280
add esp, 8
test eax, eax
je 0x517f5b
mov dword [ebp - 4], eax
jmp 0x517e86
test eax, eax
jne 0x517f5b
xor esi, esi
mov eax, dword [ebp - 4]
lea ebx, [eax + 0x10]
jmp 0x517f51
mov edi, dword [ebx]
test edi, edi
je 0x517f4d
xor eax, eax
mov al, byte [edi]
push eax
call fcn.00554308
pop ecx
xor edx, edx
mov dl, byte [ebp - 0x1d]
cmp eax, edx
jne 0x517f4d
mov ecx, dword [ebp + 8]
mov eax, dword [ebx + 4]
mov esi, ecx
mov edi, eax
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 0xc]
cmp byte [eax + 1], 0x3a
jne 0x517f44
mov edx, dword [ebp + 0xc]
cmp byte [edx + 2], 0x5c
jne 0x517f44
mov ecx, dword [ebp + 0xc]
add ecx, 2
push ecx
push dword [ebp + 8]
call fcn.0054c1f4
add esp, 8
mov dword [ebp - 0x1c], 1
jmp 0x517f5b
inc esi
add ebx, 0x20
cmp esi, dword [ebp - 0x10]
jl 0x517edf
jmp 0x517e86
cmp dword [ebp - 4], 0
je 0x517f6a
push dword [ebp - 4]
call fcn.00557ca0
pop ecx
push dword [ebp - 0x18]
call sub.MPR.dll_WNetCloseEnum
mov eax, dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x517fda
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp eax, 2
jne 0x51800d
push 0
push 0x56cb5e
push 0
push ebx
push 0x56cb58
push dword [0x56cee8]
call sub.SHELL32.dll_ShellExecuteA
jmp 0x5180ea
dec eax
jne 0x518017
mov esi, 1
jmp 0x518019
xor esi, esi
cmp dword [0x56cae0], 0
je 0x51802b
cmp dword [0x56cae4], 0
jne 0x518097
cmp dword [0x56cae0], 0
je 0x518038
test esi, esi
je 0x518049
push ebx
push str.__s_____0xFFFFFFFF_0x4_________
push edi
call sub.USER32.dll_wsprintfA
add esp, 0xc
jmp 0x518058
push ebx
push str.__s_____0x0_0x4_________
push edi
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0xffffffffffffffff
push 2
push 0x56cbaa
push edi
push str.WWW_OpenURL
call fcn.00469c81
test eax, eax
je 0x518097
cmp dword [0x56cae4], 0
je 0x5180ea
test esi, esi
jne 0x5180ea
push 0xffffffffffffffff
push 2
push 0x56cbcc
push str.0xFFFFFFFF_0x0
push str.WWW_Activate
call fcn.00469c81
jmp 0x5180ea
call fcn.004f56a4
cmp byte [0x5847c4], 0
jne 0x5180c1
push 5
push 0x57fd38
push 0
push ebx
push 0x56cbd0
push dword [0x56cee8]
call sub.SHELL32.dll_ShellExecuteA
jmp 0x5180ea
push 5
push 0x57fd38
push ebx
push 0x5847c4
push str.open
push dword [0x56cee8]
call sub.SHELL32.dll_ShellExecuteA
cmp eax, 0x1f
jae 0x5180ea
push 0
call fcn.0042c4bf
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x525737
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebx + 0x424], 1
lea eax, [ebx + 0x448]
push eax
push 0x104
lea edx, [ebp - 0x104]
push edx
call fcn.0042e322
cmp dword [0x56a0f0], 0
jne 0x52579a
cmp byte [ebx + 0x448], 0
je 0x52579a
push 0
push 0x1772
call fcn.0042c564
push eax
lea ecx, [ebx + 0x448]
push ecx
call fcn.0054c494
add esp, 8
test eax, eax
jne 0x5257d9
push 0x64
lea esi, [ebx + 0x448]
push esi
call sub.WSOCK32.dll_gethostname
test eax, eax
je 0x5257d9
push 0
push 0x1772
call fcn.0042c564
push esi
mov edi, eax
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
cmp dword [0x56a0f4], 0
jne 0x525819
cmp dword [ebx + 0x510], 0
je 0x525819
lea eax, [ebx + 0x448]
lea edx, [ebp - 0x104]
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x525819
test cl, cl
je 0x525813
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x525819
add eax, 2
add edx, 2
test cl, cl
jne 0x5257f7
je 0x525980
push 0
push 0x1772
call fcn.0042c564
push eax
lea eax, [ebx + 0x448]
push eax
call fcn.0054c494
add esp, 8
test eax, eax
jne 0x5258d5
push 0
push 0x1772
call fcn.0042c564
lea edx, [ebx + 0x4ac]
mov edi, eax
mov esi, edx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
mov dword [ebx + 0x510], eax
cmp dword [ebx + 0x420], 0
je 0x5258ce
mov dword [0x56ac10], 1
push dword [0x55f8a0]
push 0
push 0x1777
call fcn.0042c564
push eax
push dword [ebx]
call fcn.004ef100
mov dword [ebx + 0x440], 1
push ebx
call fcn.0052527e
test eax, eax
jne 0x5258c3
push ebx
push 2
call fcn.00458c56
jmp 0x5258ce
push ebx
push 0x56d627
call fcn.00525130
xor eax, eax
jmp 0x525982
push 0x400
lea esi, [ebx + 0x1c]
push esi
call fcn.0042e3f0
push 0x400
push esi
lea eax, [ebx + 0x448]
push eax
push 0x800a
push dword [0x56cee8]
call sub.WSOCK32.dll_WSAAsyncGetHostByName
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
jne 0x525980
xor eax, eax
mov dword [ebx + 0x424], eax
cmp dword [ebx + 0x41c], 0
je 0x52591e
xor eax, eax
jmp 0x525982
xor edx, edx
mov dword [ebx + 0x510], edx
cmp dword [ebx + 0x420], 0
je 0x52597c
mov dword [0x56ac10], 1
push dword [0x55f8a0]
push 0
push 0x1778
call fcn.0042c564
push eax
push dword [ebx]
call fcn.004ef100
mov dword [ebx + 0x440], 2
push ebx
call fcn.0052527e
test eax, eax
jne 0x525971
push ebx
push 2
call fcn.00458c56
jmp 0x52597c
push ebx
push 0x56d62b
call fcn.00525130
xor eax, eax
jmp 0x525982
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x526a26
Capabilities:
Initialize winsock library

Disassembly:
push ebx
add esp, 0xfffffe70
call fcn.00526a7f
mov dword [0x56d694], 1
mov ax, 0x101
push esp
push eax
call sub.WSOCK32.dll_WSAStartup
mov ebx, eax
test ebx, ebx
jne 0x526a54
mov eax, 1
jmp 0x526a77
xor edx, edx
mov dword [0x56d694], edx
push 0x10
push str.mIRC
push ebx
call fcn.005269d0
push eax
push dword [0x56cee8]
call sub.USER32.dll_MessageBoxA
xor eax, eax
add esp, 0x190
pop ebx
ret

Function at 0x526bb6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ecx, dword [ebp + 0x1c]
mov eax, dword [ebp + 8]
mov edx, dword [eax]
inc edx
xor eax, eax
mov al, byte [edx]
test eax, eax
jne 0x526bdc
mov ecx, dword [ebp + 0xc]
mov dword [ecx], str._at_end_of_pattern
jmp 0x526d40
cmp eax, 0x30
jl 0x526d40
cmp eax, 0x7a
jg 0x526d40
movsx ebx, word [eax*2 + 0x56d64c]
mov dword [ebp - 4], ebx
test ebx, ebx
je 0x526c05
mov eax, dword [ebp - 4]
jmp 0x526d40
mov ebx, eax
sub ebx, 0x30
je 0x526c7a
dec ebx
sub ebx, 9
jb 0x526c29
sub ebx, 0x29
je 0x526d03
sub ebx, 0x15
je 0x526cbb
jmp 0x526d2f
cmp dword [ebp + 0x18], 0
jne 0x526c69
mov esi, edx
sub eax, 0x30
jmp 0x526c45
inc edx
add eax, eax
lea eax, [eax + eax*4]
xor ebx, ebx
mov bl, byte [edx]
add eax, ebx
add eax, 0xffffffd0
xor ebx, ebx
mov bl, byte [edx + 1]
mov edi, dword [ecx + 0xc]
test byte [edi + ebx], 4
jne 0x526c36
cmp eax, 0xa
jl 0x526c5d
cmp eax, dword [ebp + 0x10]
jg 0x526c67
add eax, 0xc
neg eax
jmp 0x526d40
mov edx, esi
xor eax, eax
mov al, byte [edx]
cmp eax, 0x38
jl 0x526c7a
dec edx
xor eax, eax
jmp 0x526d40
sub eax, 0x30
jmp 0x526c8c
inc edx
shl eax, 3
xor ebx, ebx
mov bl, byte [edx]
add eax, ebx
add eax, 0xffffffd0
mov ebx, dword [ebp - 4]
inc dword [ebp - 4]
cmp ebx, 2
jge 0x526cb1
xor ebx, ebx
mov bl, byte [edx + 1]
mov esi, dword [ecx + 0xc]
test byte [esi + ebx], 4
je 0x526cb1
cmp byte [edx + 1], 0x38
je 0x526cb1
cmp byte [edx + 1], 0x39
jne 0x526c7f
and eax, 0xff
jmp 0x526d40
xor eax, eax
jmp 0x526ce8
inc edx
mov esi, 0x30
xor ebx, ebx
mov bl, byte [edx]
mov edi, dword [ecx + 0xc]
test byte [edi + ebx], 4
jne 0x526cd5
add esi, 0x27
xor ebx, ebx
mov bl, byte [edx]
mov edi, dword [ecx]
movzx ebx, byte [edi + ebx]
shl eax, 4
add ebx, eax
sub ebx, esi
mov eax, ebx
mov ebx, dword [ebp - 4]
inc dword [ebp - 4]
cmp ebx, 2
jge 0x526d40
xor ebx, ebx
mov bl, byte [edx + 1]
mov esi, dword [ecx + 0xc]
test byte [esi + ebx], 8
jne 0x526cbf
jmp 0x526d40
inc edx
xor eax, eax
mov al, byte [edx]
test eax, eax
jne 0x526d19
mov edx, dword [ebp + 0xc]
mov dword [edx], str.c_at_end_of_pattern
xor eax, eax
jmp 0x526d45
cmp eax, 0x61
jl 0x526d2a
cmp eax, 0x7a
jg 0x526d2a
mov ecx, dword [ecx + 4]
movzx eax, byte [ecx + eax]
xor eax, 0x40
jmp 0x526d40
test byte [ebp + 0x14], 0x40
je 0x526d40
mov ecx, eax
mov ecx, dword [ebp + 0xc]
mov dword [ecx], str.unrecognized_character_follows__
mov ecx, dword [ebp + 8]
mov dword [ecx], edx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x18
Function at 0x53103c
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x14], 0xca
jne 0x53106d
push ebx
call fcn.005367e9
cmp byte [ebx + 0x40], 0
je 0x531066
mov dword [ebx + 0x14], 0xcf
mov al, 1
jmp 0x5310fc
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x5310d9
mov edx, dword [ebx + 0x190]
cmp byte [edx + 0x10], 0
je 0x5310ce
cmp dword [ebx + 8], 0
je 0x53108e
push ebx
mov ecx, dword [ebx + 8]
call dword [ecx]
push ebx
mov eax, dword [ebx + 0x190]
call dword [eax]
test eax, eax
jne 0x53109f
xor eax, eax
jmp 0x5310fc
cmp eax, 2
je 0x5310ce
cmp dword [ebx + 8], 0
je 0x531082
cmp eax, 3
je 0x5310b2
dec eax
jne 0x531082
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x531082
mov edx, dword [ebx + 0x11c]
add dword [eax + 8], edx
jmp 0x531082
mov ecx, dword [ebx + 0x7c]
mov dword [ebx + 0x84], ecx
jmp 0x5310f6
cmp dword [ebx + 0x14], 0xcc
je 0x5310f6
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
push ebx
mov ecx, dword [ebx]
call dword [ecx]
push ebx
call fcn.00531101
pop ebx
pop ebp
ret 4
Function at 0x54187c
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
cmp byte [edx + 8], 3
je 0x541a12
xor ebx, ebx
xor esi, esi
mov ecx, dword [edx]
mov dword [ebp - 4], ecx
test byte [edx + 8], 2
je 0x5418d5
xor ecx, ecx
mov cl, byte [edx + 9]
movzx edi, byte [eax]
sub ecx, edi
mov dword [ebp + ebx*4 - 0x20], ecx
inc ebx
xor ecx, ecx
mov cl, byte [edx + 9]
movzx edi, byte [eax + 1]
sub ecx, edi
mov dword [ebp + ebx*4 - 0x20], ecx
inc ebx
xor ecx, ecx
mov cl, byte [edx + 9]
movzx edi, byte [eax + 2]
sub ecx, edi
mov dword [ebp + ebx*4 - 0x20], ecx
inc ebx
jmp 0x5418e5
xor ecx, ecx
mov cl, byte [edx + 9]
movzx edi, byte [eax + 3]
sub ecx, edi
mov dword [ebp + ebx*4 - 0x20], ecx
inc ebx
test byte [edx + 8], 4
je 0x5418fb
xor ecx, ecx
mov cl, byte [edx + 9]
movzx eax, byte [eax + 4]
sub ecx, eax
mov dword [ebp + ebx*4 - 0x20], ecx
inc ebx
xor ecx, ecx
lea eax, [ebp - 0x20]
cmp ebx, ecx
jle 0x54191b
cmp dword [eax], 0
jg 0x54190f
xor edi, edi
mov dword [eax], edi
jmp 0x541913
mov si, 1
inc ecx
add eax, 4
cmp ebx, ecx
jg 0x541904
test si, si
je 0x541a12
mov al, byte [edx + 9]
sub al, 2
je 0x541940
sub al, 2
je 0x541960
sub al, 4
je 0x54199b
sub al, 8
je 0x5419c2
jmp 0x541a12
mov ecx, dword [edx + 4]
mov eax, dword [ebp + 0xc]
xor edx, edx
cmp ecx, edx
jbe 0x541a12
shr byte [eax], 1
and byte [eax], 0x55
inc eax
inc edx
cmp ecx, edx
ja 0x541950
jmp 0x541a12
mov eax, dword [ebp + 0xc]
mov edx, dword [edx + 4]
mov esi, dword [ebp - 0x20]
mov ecx, esi
mov ebx, 0xf0
sar ebx, cl
and bl, 0xf0
mov ecx, esi
mov esi, 0xf
sar esi, cl
mov ecx, esi
or bl, cl
xor esi, esi
cmp edx, esi
jbe 0x541a12
mov ecx, dword [ebp - 0x20]
shr byte [eax], cl
and byte [eax], bl
inc eax
inc esi
cmp edx, esi
ja 0x54198c
jmp 0x541a12
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
imul ebx
mov dword [ebp - 8], eax
xor esi, esi
cmp esi, dword [ebp - 8]
jae 0x541a12
mov eax, esi
xor edx, edx
div ebx
mov ecx, dword [ebp + edx*4 - 0x20]
shr byte [edi], cl
inc edi
inc esi
cmp esi, dword [ebp - 8]
jb 0x5419ad
jmp 0x541a12
mov edi, dword [ebp + 0xc]
mov eax, ebx
imul dword [ebp - 4]
mov dword [ebp - 0x10], eax
xor edx, edx
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 0x10]
jae 0x541a12
movzx esi, byte [edi]
shl esi, 8
xor eax, eax
mov al, byte [edi + 1]
add si, ax
mov eax, dword [ebp - 0xc]
xor edx, edx
div ebx
mov ecx, dword [ebp + edx*4 - 0x20]
shr si, cl
movzx eax, si
sar eax, 8
mov byte [edi], al
inc edi
mov edx, esi
and dl, 0xff
mov byte [edi], dl
inc edi
inc dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 0x10]
jb 0x5419da
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5496da
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, 0x571850
test edx, edx
jne 0x5496f8
xor eax, eax
jmp 0x5497e0
xor eax, 0xffffffff
cmp ebx, 8
jb 0x5497c0
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ecx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ecx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ecx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ecx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ecx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ecx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ecx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ecx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
sub ebx, 8
cmp ebx, 8
jae 0x549704
test ebx, ebx
je 0x5497dd
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ecx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
dec ebx
jne 0x5497c4
xor eax, 0xffffffff
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x5522a0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp ebx, dword [0x57590c]
jb 0x5522c4
push 6
call fcn.005527f0
pop ecx
jmp 0x552355
push ebx
call fcn.00552474
pop ecx
mov esi, dword [ebx*4 + 0x58812c]
push 0x22
push 0
push edi
call fcn.0054c150
add esp, 0xc
push esi
call sub.KERNEL32.dll_GetFileType
dec eax
je 0x5522f8
dec eax
je 0x5522f0
dec eax
je 0x552344
jmp 0x55234a
mov word [edi + 4], 0x2000
jmp 0x55234a
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 8]
push edx
lea ecx, [ebp - 0x10]
push ecx
push esi
call sub.KERNEL32.dll_GetFileTime
dec eax
je 0x552316
call fcn.0055285c
mov esi, eax
jmp 0x55234c
push 0
push esi
call sub.KERNEL32.dll_GetFileSize
push eax
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 8]
push edx
lea ecx, [ebp - 0x10]
push ecx
xor eax, eax
test byte [ebx*4 + 0x575911], 1
jne 0x552338
inc eax
push eax
push edi
call fcn.0055a97c
add esp, 0x18
jmp 0x55234a
mov word [edi + 4], 0x1000
xor esi, esi
push ebx
call fcn.00552508
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x55235c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x104
call fcn.00557db4
pop ecx
mov ebx, eax
test eax, eax
jne 0x552380
xor eax, eax
jmp 0x552429
lea edx, [ebp - 4]
push edx
push ebx
push 0x104
mov ecx, dword [ebp + 0xc]
push ecx
call sub.KERNEL32.dll_GetFullPathNameA
mov esi, eax
test esi, esi
je 0x5523a1
cmp esi, 0x104
jb 0x5523ac
push ebx
call fcn.00557ca0
pop ecx
xor eax, eax
jmp 0x552429
cmp byte [ebx + 1], 0x3a
jne 0x5523dc
mov dl, byte [ebx]
lea ecx, [ebp - 8]
mov byte [ebp - 8], dl
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], 0x5c
mov byte [ebp - 5], 0
push ecx
call sub.KERNEL32.dll_GetDriveTypeA
cmp eax, 2
jae 0x5523dc
push ebx
call fcn.00557ca0
pop ecx
xor eax, eax
jmp 0x552429
inc esi
test edi, edi
je 0x55241f
cmp esi, dword [ebp + 0x10]
jbe 0x5523f1
push ebx
call fcn.00557ca0
pop ecx
xor eax, eax
jmp 0x552429
push edi
mov esi, edi
xor eax, eax
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
push ebx
call fcn.00557ca0
pop ecx
mov eax, edi
jmp 0x552429
push esi
push ebx
call fcn.00558280
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x552e88
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.00552430
test byte [ebp + 0xd], 0xc0
jne 0x552eac
mov eax, dword [0x5759dc]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x552eb9
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x552ee6
je 0x552ef8
sub ecx, 0x100
je 0x552f06
sub ecx, 0x100
je 0x552f0d
sub ecx, 0x100
je 0x552eff
jmp 0x552f14
sub ecx, 0x600
je 0x552f0d
sub ecx, 0x100
je 0x552ef8
jmp 0x552f14
mov edi, 1
jmp 0x552f19
mov edi, 2
jmp 0x552f19
mov edi, 4
jmp 0x552f19
mov edi, 5
jmp 0x552f19
mov edi, 3
test byte [ebp + 0xd], 1
je 0x552f40
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x575fb8]
test al, 0x80
je 0x552f39
mov ebx, 0x80
jmp 0x552f52
mov ebx, 1
jmp 0x552f52
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x552f52
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x552f64
je 0x552f6d
dec eax
je 0x552f76
jmp 0x552f7f
mov dword [ebp - 4], 0x80000000
jmp 0x552f8e
mov dword [ebp - 4], 0x40000000
jmp 0x552f8e
mov dword [ebp - 4], 0xc0000000
jmp 0x552f8e
push 1
call fcn.005527f0
pop ecx
mov ebx, eax
jmp 0x55307a
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x552faa
sub eax, 0x10
je 0x552fb1
sub eax, 0x10
je 0x552fba
sub eax, 0x10
je 0x552fc3
jmp 0x552fc3
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x552fca
mov dword [ebp - 8], 1
jmp 0x552fca
mov dword [ebp - 8], 2
jmp 0x552fca
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.dll_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x553033
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x553028
test byte [ebp + 0xd], 1
mov ebx, 0x50
jne 0x553028
add ebx, 0xffffffb2
push ebx
call fcn.005527f0
pop ecx
mov ebx, eax
jmp 0x55307a
mov edi, esi
push edi
call fcn.00552dec
pop ecx
test eax, eax
je 0x553047
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x553053
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.00552530
add esp, 8
mov ebx, eax
inc eax
jne 0x55307a
push 4
call fcn.005527f0
pop ecx
push esi
call sub.KERNEL32.dll_CloseHandle
call fcn.00552464
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5580b4
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.dll_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret
Function at 0x558554
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
cmp dword [0x576b10], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x55860c
cmp byte [0x55c11e], 0
je 0x5585c6
push 0x50
lea eax, [ebp - 0x54]
push eax
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x54]
push edx
call fcn.00557454
add esp, 8
mov ebx, eax
test eax, eax
jne 0x5585af
push 0x3a
lea edx, [ebp - 0x54]
push edx
call fcn.00557454
add esp, 8
mov ebx, eax
test eax, eax
jne 0x5585af
lea ebx, [ebp - 0x54]
jmp 0x5585b0
inc ebx
call fcn.0055850c
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.dll_MessageBoxA
jmp 0x55862d
push 0xfffffffffffffff4
call sub.KERNEL32.dll_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x576b14
push ebx
call sub.KERNEL32.dll_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.0054c2d0
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.dll_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x576b17
push ebx
call sub.KERNEL32.dll_WriteFile
jmp 0x55862d
cmp dword [0x576b10], 0xffffffff
je 0x55862d
mov eax, dword [0x576b10]
test eax, eax
je 0x55862d
cmp byte [eax], 0
je 0x55862d
push esi
push eax
call fcn.005586bc
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x558da0
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
push esi
call fcn.0054c2d0
pop ecx
inc eax
push eax
call fcn.00557db4
pop ecx
mov ebx, eax
test eax, eax
jne 0x558dce
call fcn.005584e0
mov dword [eax], 8
or eax, 0xffffffff
jmp 0x558e47
xor eax, eax
push esi
mov edi, esi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, ebx
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
push 0x3d
push ebx
call fcn.00557288
add esp, 8
mov esi, eax
test eax, eax
jne 0x558e19
call fcn.005584e0
mov dword [eax], 0x13
push ebx
call fcn.00557ca0
pop ecx
or eax, 0xffffffff
jmp 0x558e47
mov byte [esi], 0
cmp byte [esi + 1], 0
jne 0x558e26
xor edx, edx
jmp 0x558e29
lea edx, [esi + 1]
push edx
push ebx
call sub.KERNEL32.dll_SetEnvironmentVariableA
dec eax
je 0x558e3c
call fcn.0055285c
mov esi, eax
jmp 0x558e3e
xor esi, esi
push ebx
call fcn.00557ca0
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret