joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55c918
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x55c947
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0055dca4
jmp 0x55c965
call sub.KERNEL32.DLL_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.0055c8a0
mov edi, eax
test ebx, ebx
je 0x55c965
cmp dword [esi], 0
je 0x55c965
dec ebx
jmp 0x55c94e
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x55cbc0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x5af208], 0x8088405
inc edx
mov dword [0x5af208], edx
mul edx
mov eax, edx
ret

Function at 0x55cd8c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x5a974c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x55ce24
push reloc.WS2_32.DLL_bind
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x55ce04
xor eax, eax
push ebp
push 0x55cdfd
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x55ce40
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55ce04
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov ax, word [0x5a974c]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x5a974c], ax
mov esp, ebp
pop ebp
ret

Function at 0x55db70
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.0055c6d4
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x5af20d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x55db38
push eax
push esi
push ebx
call sub.KERNEL32.DLL_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x55fc1c
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x55fdd8
push reloc.WS2_32.DLL_accept
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x55fc7d
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x55fdf4
push reloc.WS2_32.DLL_accept
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x55fcef
xor eax, eax
push ebp
push 0x55fce8
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
call fcn.0055fa74
push eax
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x55fcd1
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x55fe14
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55fcef
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_GetThreadLocale
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x55fdd0
cmp byte [ebp - 0xd], 0
jne 0x55fd31
cmp byte [ebp - 0x12], 0
je 0x55fdd0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x55fd4a
dec ebx
cmp byte [ebx], 0x2e
je 0x55fd59
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x55fd49
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x55fdd0
inc ebx
cmp byte [ebp - 0x12], 0
je 0x55fd86
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x55fdd0
cmp byte [ebp - 0xd], 0
je 0x55fdd0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x55fdd0
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5603b0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
push ebp
push 0x560498
push dword fs:[eax]
mov dword fs:[eax], esp
sub dword [0x5af5f0], 1
jae 0x56048a
xor eax, eax
mov dword [0x5af1fc], eax
xor eax, eax
mov dword [0x5af204], eax
xor eax, eax
mov dword [0x5af208], eax
mov byte [0x5af20e], 2
mov byte [0x5af20f], 2
mov byte [0x5af210], 3
mov word [0x5af5b8], 0
mov word [0x5af5c8], 1
mov word [0x5af5d8], 0xa
mov dword [0x5af5e0], 0x80020004
mov dword [0x5af5ac], 0x55eb84
mov dword [0x5af5b0], 0x55eb7c
mov dword [0x5af5b4], 0x55eb84
call fcn.0055cd5c
test al, al
je 0x560449
call fcn.0055cd8c
call fcn.0055ce50
mov eax, 0x5af214
mov edx, 0x5604a4
call fcn.0055a3b2
mov eax, 0x5af3e0
mov edx, 0x5604a4
call fcn.0055a3b2
call sub.KERNEL32.DLL_GetCommandLineA
mov dword [0x5af1f4], eax
call fcn.0055b390
mov dword [0x5af1f0], eax
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [0x5af1e8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56049f
ret

Function at 0x5621c8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x5621e4
call fcn.00563e20
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x562200
test bl, 1
je 0x562200
call fcn.0056aa84
mov dword [eax], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x5623e4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.005639bc
test byte [ebp + 0xd], 0xc0
jne 0x562408
mov eax, dword [0x5aa5c8]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x562415
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x562442
je 0x562454
sub ecx, 0x100
je 0x562462
sub ecx, 0x100
je 0x562469
sub ecx, 0x100
je 0x56245b
jmp 0x562470
sub ecx, 0x600
je 0x562469
sub ecx, 0x100
je 0x562454
jmp 0x562470
mov edi, 1
jmp 0x562475
mov edi, 2
jmp 0x562475
mov edi, 4
jmp 0x562475
mov edi, 5
jmp 0x562475
mov edi, 3
test byte [ebp + 0xd], 1
je 0x56249c
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x5aa024]
test al, 0x80
je 0x562495
mov ebx, 0x80
jmp 0x5624ae
mov ebx, 1
jmp 0x5624ae
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x5624ae
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x5624c0
je 0x5624c9
dec eax
je 0x5624d2
jmp 0x5624db
mov dword [ebp - 4], accept
jmp 0x5624ea
mov dword [ebp - 4], 0x40000000
jmp 0x5624ea
mov dword [ebp - 4], 0xc0000000
jmp 0x5624ea
push 1
call fcn.00563db4
pop ecx
mov ebx, eax
jmp 0x5625d6
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x562506
sub eax, 0x10
je 0x56250d
sub eax, 0x10
je 0x562516
sub eax, 0x10
je 0x56251f
jmp 0x56251f
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x562526
mov dword [ebp - 8], 1
jmp 0x562526
mov dword [ebp - 8], 2
jmp 0x562526
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x56258f
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x562584
test byte [ebp + 0xd], 1
mov ebx, 0x50
jne 0x562584
add ebx, 0xffffffb2
push ebx
call fcn.00563db4
pop ecx
mov ebx, eax
jmp 0x5625d6
mov edi, esi
push edi
call fcn.00562348
pop ecx
test eax, eax
je 0x5625a3
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x5625af
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.00563adc
add esp, 8
mov ebx, eax
inc eax
jne 0x5625d6
push 4
call fcn.00563db4
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
call fcn.005639f0
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x562a7c
Capabilities:
Get common file path
Set current directory
Set environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_SetCurrentDirectoryA
dec eax
je 0x562a98
call fcn.00563e20
jmp 0x562b07
lea edx, [ebp - 0x108]
push edx
push 0x104
call sub.KERNEL32.DLL_GetCurrentDirectoryA
test eax, eax
jne 0x562ab4
call fcn.00563e20
jmp 0x562b07
cmp dword [0x5affec], 1
je 0x562b05
movsx ecx, byte [ebp - 0x108]
push ecx
call fcn.0056a904
pop ecx
cmp al, 0x41
jl 0x562b05
cmp al, 0x5a
jg 0x562b05
cmp byte [ebp - 0x107], 0x3a
jne 0x562b05
mov byte [ebp - 4], 0x3d
mov byte [ebp - 3], al
lea eax, [ebp - 0x108]
mov byte [ebp - 2], 0x3a
mov byte [ebp - 1], 0
push eax
lea edx, [ebp - 4]
push edx
call sub.KERNEL32.DLL_SetEnvironmentVariableA
dec eax
je 0x562b05
call fcn.00563e20
jmp 0x562b07
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x562b0c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
lea eax, [ebp - 0x104]
push eax
push 0x104
call sub.KERNEL32.DLL_GetCurrentDirectoryA
cmp byte [ebp - 0x104], 0x61
jl 0x562b3b
movsx edx, byte [ebp - 0x104]
add edx, 0xffffffa0
jmp 0x562b45
movsx edx, byte [ebp - 0x104]
add edx, 0xffffffc0
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov esp, ebp
pop ebp
ret

Function at 0x562b50
Capabilities:
Get disk information
Query environment variable
Set current directory
Set environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
xor eax, eax
lea ecx, [ebp - 4]
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
lea edi, [ebp - 0x108]
mov dword [esi], eax
mov byte [ebp - 4], 0x3d
mov dl, byte [ebp + 8]
add dl, 0x40
mov byte [ebp - 3], dl
mov byte [ebp - 2], 0x3a
mov byte [ebp - 1], 0
push 0x104
push edi
push ecx
call sub.KERNEL32.DLL_GetEnvironmentVariableA
test eax, eax
jne 0x562bb6
mov al, byte [ebp - 3]
mov byte [edi], al
mov byte [edi + 1], 0x3a
mov byte [edi + 2], 0x5c
mov byte [edi + 3], 0
push edi
lea edx, [ebp - 4]
push edx
call sub.KERNEL32.DLL_SetEnvironmentVariableA
dec eax
je 0x562bb6
call fcn.00563e20
jmp 0x562bf1
push edi
call sub.KERNEL32.DLL_SetCurrentDirectoryA
dec eax
je 0x562bc6
call fcn.00563e20
jmp 0x562bf1
mov byte [edi + 1], 0x3a
mov byte [edi + 2], 0x5c
mov byte [edi + 3], 0
mov byte [edi], 0x41
jmp 0x562bec
push edi
call sub.KERNEL32.DLL_GetDriveTypeA
mov ebx, eax
test eax, eax
je 0x562bea
cmp ebx, 1
je 0x562bea
inc dword [esi]
inc byte [edi]
cmp byte [edi], 0x5a
jle 0x562bd7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x562e30
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0xff
mov eax, dword [ebp + 8]
push eax
push 0x5afcac
call fcn.00563718
add esp, 0xc
lea edx, [ebp - 8]
push 0
push 0
push 0
push edx
push 0x5afcac
call fcn.00563148
add esp, 0x14
push 0x5aa5c0
lea ecx, [ebp - 8]
push ecx
call fcn.00560f50
add esp, 8
mov byte [0x5afcac], 0
push 0
push 0
push 0
push 0
push 0
push 0xff
push 0x5afcac
lea eax, [ebp - 8]
push eax
call sub.KERNEL32.DLL_GetVolumeInformationA
test eax, eax
je 0x562ea3
mov eax, 0x5afcac
jmp 0x562ea5
xor eax, eax
pop ecx
pop ecx
pop ebp
ret
Function at 0x562f5c
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov ebx, dword [esi]
test byte [ebx + 8], 8
je 0x562f81
cmp dword [ebx + 4], 0xfffffffe
jne 0x562f81
or eax, 0xffffffff
jmp 0x5630b9
test byte [ebx + 8], 8
je 0x562fee
cmp dword [ebx + 4], 0xffffffff
jne 0x562fee
mov dword [esi + 8], 8
mov edx, dword [ebx + 0xc]
push edx
call fcn.00562e30
pop ecx
mov edi, eax
test edi, edi
je 0x562fd6
add esi, 0x10
xor eax, eax
push esi
push edi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov dword [ebx + 4], 0xfffffffe
xor eax, eax
jmp 0x5630b9
call fcn.00563e00
test eax, eax
jne 0x562fe6
xor eax, eax
jmp 0x5630b9
or eax, 0xffffffff
jmp 0x5630b9
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
je 0x562ffb
cmp eax, 0xfffffffe
jne 0x563022
mov dword [ebx + 4], 0xffffffff
lea edx, [ebp - 0x148]
push edx
mov ecx, dword [ebx + 0xc]
push ecx
call sub.KERNEL32.DLL_FindFirstFileA
mov edi, eax
mov dword [ebx + 4], edi
cmp edi, 0xffffffff
setne al
and eax, 1
jmp 0x563032
lea edx, [ebp - 0x148]
push edx
mov ecx, dword [ebx + 4]
push ecx
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
jne 0x563048
call fcn.00563e00
test eax, eax
jne 0x563043
xor eax, eax
jmp 0x5630b9
or eax, 0xffffffff
jmp 0x5630b9
mov eax, dword [ebp - 0x148]
test al, 0x16
je 0x56305c
mov edx, dword [ebx + 8]
and edx, eax
test dl, 0x16
je 0x562fee
mov ecx, dword [ebp - 0x148]
mov dword [esi + 8], ecx
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x134]
push edx
call sub.KERNEL32.DLL_FileTimeToLocalFileTime
lea ecx, [esi + 0xc]
push ecx
lea eax, [esi + 0xe]
push eax
lea edx, [ebp - 8]
push edx
call sub.KERNEL32.DLL_FileTimeToDosDateTime
mov ecx, dword [ebp - 0x128]
xor eax, eax
mov dword [esi + 4], ecx
add esi, 0x10
push esi
lea edi, [ebp - 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x563718
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x104
call fcn.005609cc
pop ecx
mov ebx, eax
test eax, eax
jne 0x56373c
xor eax, eax
jmp 0x5637e5
lea edx, [ebp - 4]
push edx
push ebx
push 0x104
mov ecx, dword [ebp + 0xc]
push ecx
call sub.KERNEL32.DLL_GetFullPathNameA
mov esi, eax
test esi, esi
je 0x56375d
cmp esi, 0x104
jb 0x563768
push ebx
call fcn.005609dc
pop ecx
xor eax, eax
jmp 0x5637e5
cmp byte [ebx + 1], 0x3a
jne 0x563798
mov dl, byte [ebx]
lea ecx, [ebp - 8]
mov byte [ebp - 8], dl
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], 0x5c
mov byte [ebp - 5], 0
push ecx
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, 2
jae 0x563798
push ebx
call fcn.005609dc
pop ecx
xor eax, eax
jmp 0x5637e5
inc esi
test edi, edi
je 0x5637db
cmp esi, dword [ebp + 0x10]
jbe 0x5637ad
push ebx
call fcn.005609dc
pop ecx
xor eax, eax
jmp 0x5637e5
push edi
mov esi, edi
xor eax, eax
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
push ebx
call fcn.005609dc
pop ecx
mov eax, edi
jmp 0x5637e5
push esi
push ebx
call fcn.005609ec
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x56384c
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x563892
lea eax, [ebp - 0x10c]
push eax
push 0x103
call sub.KERNEL32.DLL_GetCurrentDirectoryA
test eax, eax
je 0x563880
cmp eax, dword [ebp + 0x10]
jle 0x56391b
call fcn.0056aa84
mov dword [eax], 8
xor eax, eax
jmp 0x563988
cmp dword [0x5affec], 1
jne 0x5638d7
mov eax, ebx
lea ecx, [ebp - 0x10c]
mov edx, eax
add dl, 0x40
add ecx, 3
mov byte [ebp - 0x10c], dl
mov dl, al
mov byte [ebp - 0x10b], 0x3a
mov byte [ebp - 0x10a], 0x5c
mov byte [ebp - 0x109], 0
mov ah, 0x47
mov esi, ecx
int 0x21
jae 0x56391b
xor eax, eax
jmp 0x563988
call sub.KERNEL32.DLL_GetLogicalDrives
lea ecx, [ebx - 1]
mov edx, 1
shl edx, cl
test edx, eax
je 0x563917
add bl, 0x40
lea eax, [ebp - 8]
mov byte [ebp - 4], bl
lea edx, [ebp - 0x10c]
mov byte [ebp - 3], 0x3a
mov byte [ebp - 2], 0x2e
mov byte [ebp - 1], 0
push eax
push edx
lea ecx, [ebp - 4]
push 0x103
push ecx
call sub.KERNEL32.DLL_GetFullPathNameA
jmp 0x56391b
xor eax, eax
jmp 0x563988
lea edx, [ebp - 0x10c]
push edx
call fcn.00560fe0
pop ecx
cmp eax, dword [ebp + 0x10]
jl 0x56393c
call fcn.0056aa84
mov dword [eax], 0x22
xor eax, eax
jmp 0x563988
test edi, edi
jne 0x56395f
mov edx, dword [ebp + 0x10]
push edx
call fcn.005609cc
pop ecx
mov edi, eax
test eax, eax
jne 0x56395f
call fcn.0056aa84
mov dword [eax], 8
xor eax, eax
jmp 0x563988
push edi
mov esi, edi
xor eax, eax
lea edi, [ebp - 0x10c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x567460
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea eax, [ebp - 0x200]
push eax
push 0x1001
mov edx, dword [ebx + 4]
push edx
call sub.KERNEL32.DLL_GetLocaleInfoA
push str._._n
lea ecx, [ebp - 0x200]
push ecx
call fcn.00560f50
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.00560fe0
pop ecx
mov edx, pe_nt_image_headers32
sub edx, eax
push edx
lea ecx, [ebp - 0x200]
push ecx
call fcn.00560fe0
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
push 0x1002
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
push 0x5ab2e9
lea ecx, [ebp - 0x200]
push ecx
call fcn.00560f50
add esp, 8
push 0xa
lea eax, [ebp - 0x200]
push eax
call fcn.00560fe0
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
mov ecx, dword [ebx]
push ecx
call fcn.00568644
add esp, 0xc
cmp dword [ebx + 0x24], 0
jne 0x567571
push esi
call fcn.00560fe0
pop ecx
mov edi, eax
lea eax, [ebp - 0x200]
push eax
call fcn.00560fe0
pop ecx
add edi, eax
add edi, 3
push edi
call fcn.005609cc
pop ecx
mov edi, eax
mov dword [ebx + 0x24], edi
test edi, edi
jne 0x567548
xor eax, eax
jmp 0x5675f8
push esi
call fcn.00560fe0
pop ecx
push eax
lea edx, [ebp - 0x200]
push edx
call fcn.00560fe0
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push 0
push edi
call fcn.00560eac
add esp, 0xc
jmp 0x5675b1
mov edi, dword [ebx + 0x24]
push edi
call fcn.00560fe0
pop ecx
push eax
push esi
call fcn.00560fe0
pop ecx
pop edx
add edx, eax
push edx
lea eax, [ebp - 0x200]
push eax
call fcn.00560fe0
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push edi
call fcn.005609ec
add esp, 8
mov dword [ebx + 0x24], eax
cmp dword [ebx + 0x24], 0
jne 0x5675b1
xor eax, eax
jmp 0x5675f8
push esi
mov edx, dword [ebx + 0x24]
push edx
call fcn.00560f50
add esp, 8
push 0x5ab2eb
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.00560f50
add esp, 8
lea eax, [ebp - 0x200]
push eax
mov edx, dword [ebx + 0x24]
push edx
call fcn.00560f50
add esp, 8
push 0x5ab2ed
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.00560f50
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x56aa1c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x56aa7e
call fcn.0056a9cc
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.00560fe0
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.00560fe0
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x56aafc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x5ab964], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x56abd6
cmp dword [0x5ab960], 0
jne 0x56abd6
cmp dword [0x5abb6c], 0
je 0x56ab90
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.0056a8ac
add esp, 8
mov ebx, eax
test eax, eax
jne 0x56ab76
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.0056a8ac
add esp, 8
mov ebx, eax
test eax, eax
jne 0x56ab76
lea ebx, [ebp - 0x84]
jmp 0x56ab77
inc ebx
call fcn.0056aab8
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x56ac11
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x5ab968
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.00560fe0
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x5ab96b
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x56ac11
cmp dword [0x5ab960], 0
je 0x56abf0
cmp dword [0x5ab960], 0xffffffff
je 0x56ac11
push esi
call dword [0x5ab960]
pop ecx
mov eax, dword [0x5ab964]
test eax, eax
je 0x56ac11
cmp dword [0x5ab964], 0xffffffff
je 0x56ac11
cmp byte [eax], 0
je 0x56ac11
push esi
push eax
call fcn.0056aa1c
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5717f4
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x571822
mov eax, ebx
call fcn.00572298
cmp dword [ebx + 0x3c], 0
je 0x57181b
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x571893
mov edx, dword [ebx + 0x1a6]
cmp dword [edx + 0x10], 0
je 0x571885
cmp dword [ebx + 8], 0
je 0x571844
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1a6]
call dword [edx]
test eax, eax
jne 0x571856
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x571885
cmp dword [ebx + 8], 0
je 0x571837
cmp eax, 3
je 0x571869
dec eax
jne 0x571837
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x571837
mov edx, dword [ebx + 0x132]
add dword [eax + 8], edx
jmp 0x571837
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x5718b1
cmp dword [ebx + 0x10], 0xcc
je 0x5718b1
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.005718bc
pop ebx
ret
Function at 0x40895b
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4085d8
call fcn.00408983
inc edx
sub edx, edx
xor dword [edi], eax
sub ebx, ebx
add edi, 1
add ebx, 0xf37fb306
sub edx, 0xab537ccc
cmp edi, ecx
jne fcn.0040895b
ret