joyce8/EMBER2024-capa huggingface dataset:
Function at 0x543f6c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.00543b8c
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.0055bb04
push eax
mov eax, dword [ebx + 4]
push eax
call sub.ADVAPI32.DLL_RegSetValueExA
test eax, eax
je 0x543fca
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x5cefb4]
mov dl, 1
mov eax, dword [0x543a84]
call fcn.0054b758
call fcn.0055b2b4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x543fd4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.0055bb04
push eax
mov eax, dword [ebx + 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x54402c
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x5cefb0]
mov dl, 1
mov eax, dword [0x543a84]
call fcn.0054b758
call fcn.0055b2b4
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00543bbc
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x54aeb4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x54aeed
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.0055b744
jmp 0x54aef6
mov eax, ebx
mov edx, esi
call fcn.0055b6a8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x54af00
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x54af21
mov al, byte [esp]
jmp 0x54af23
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x54c4b8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x54c51c
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.0055b8bc
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GetACP
mov edx, eax
pop eax
call fcn.00547c78
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54c523
lea eax, [ebp - 0xc]
call fcn.0055b654
ret
Function at 0x559df8
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.0055b654
test esi, esi
jne 0x559e2e
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.0055b744
jmp 0x559e4c
call sub.KERNEL32.DLL_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00559d0c
mov edi, eax
test esi, esi
je 0x559e4c
cmp dword [ebx], 0
je 0x559e4c
dec esi
jmp 0x559e35
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x55a978
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x5c6fec]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x55aa10
push reloc.WSOCK32.DLL_bind
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x55a9f0
xor eax, eax
push ebp
push 0x55a9e9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x55aa2c
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55a9f0
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov ax, word [0x5c6fec]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x5c6fec], ax
mov esp, ebp
pop ebp
ret

Function at 0x55b4d8
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x5d001c], 0
je 0x55b539
cmp word [0x5d01f0], 0xd7b2
jne 0x55b501
cmp dword [0x5d01f8], 0
jbe 0x55b501
mov eax, 0x5d01ec
call dword [0x5d0208]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x55b560
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
pop edx
ret
cmp byte [0x5c6ffc], 0
jne 0x55b555
push 0
push 0x5c7054
push str.Runtime_error_____at_00000000
push 0
call sub.USER32.DLL_MessageBoxA
pop edx
ret
Function at 0x55d000
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x55d230
push bind
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x55d083
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x55d230
push reloc.WSOCK32.DLL_bind
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x55d083
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x55d24c
push bind
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x55d10c
xor eax, eax
push ebp
push 0x55d105
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.0055ce48
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x55d0ea
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x55d26c
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x55d0ea
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55d10c
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_GetThreadLocale
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x55d226
cmp byte [ebp - 0xd], 0
jne 0x55d153
cmp byte [ebp - 0x12], 0
je 0x55d226
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x55d16c
dec ebx
cmp byte [ebx], 0x2e
je 0x55d17b
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x55d16b
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x55d226
inc ebx
cmp byte [ebp - 0x12], 0
je 0x55d1b8
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x55d226
cmp byte [ebp - 0xd], 0
je 0x55d226
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x55d226
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x55d9d8
Capabilities:
Accept command line arguments

Disassembly:
sub dword [0x5d0590], 1
jae 0x55da5e
mov byte [0x5c6fe8], 2
mov dword [0x5cffe0], 0x5926dc
mov dword [0x5cffe4], 0x5926ee
mov byte [0x5d001e], 2
mov dword [0x5cffcc], 0x55c630
call fcn.0055a948
test al, al
je 0x55da1b
call fcn.0055a978
call fcn.0055aa3c
mov word [0x5d0024], 0xd7b0
mov word [0x5d01f0], 0xd7b0
mov word [0x5d03bc], 0xd7b0
call fcn.0055c500
call sub.KERNEL32.DLL_GetCommandLineA
mov dword [0x5d0010], eax
call fcn.00558704
mov dword [0x5d000c], eax
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [0x5d0004], eax
ret
Function at 0x5698dc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.00569ff0
test byte [ebp + 0xd], 0xc0
jne 0x569900
mov eax, dword [0x5cb5c8]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x56990d
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x56993a
je 0x56994c
sub ecx, 0x100
je 0x56995a
sub ecx, 0x100
je 0x569961
sub ecx, 0x100
je 0x569953
jmp 0x569968
sub ecx, 0x600
je 0x569961
sub ecx, 0x100
je 0x56994c
jmp 0x569968
mov edi, 1
jmp 0x56996d
mov edi, 2
jmp 0x56996d
mov edi, 4
jmp 0x56996d
mov edi, 5
jmp 0x56996d
mov edi, 3
test byte [ebp + 0xd], 1
je 0x569994
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x5cb040]
test al, 0x80
je 0x56998d
mov ebx, 0x80
jmp 0x5699a6
mov ebx, 1
jmp 0x5699a6
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
mov ebx, eax
cmp eax, 0xffffffff
jne 0x5699a6
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x5699b8
je 0x5699c1
dec eax
je 0x5699ca
jmp 0x5699d3
mov dword [ebp - 4], bind
jmp 0x5699e2
mov dword [ebp - 4], 0x40000000
jmp 0x5699e2
mov dword [ebp - 4], 0xc0000000
jmp 0x5699e2
push 1
call fcn.0056a3e8
pop ecx
mov ebx, eax
jmp 0x569ad2
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x5699fe
sub eax, 0x10
je 0x569a05
sub eax, 0x10
je 0x569a0e
sub eax, 0x10
je 0x569a17
jmp 0x569a17
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x569a1e
mov dword [ebp - 8], 1
jmp 0x569a1e
mov dword [ebp - 8], 2
jmp 0x569a1e
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileW
mov esi, eax
cmp eax, 0xffffffff
jne 0x569a8b
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x569a80
test byte [ebp + 0xd], 1
je 0x569a7b
mov ebx, 0x50
jmp 0x569a80
mov ebx, 2
push ebx
call fcn.0056a3e8
pop ecx
mov ebx, eax
jmp 0x569ad2
mov edi, esi
push edi
call fcn.00569488
pop ecx
test eax, eax
je 0x569a9f
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x569aab
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.0056a110
add esp, 8
mov ebx, eax
inc eax
jne 0x569ad2
push 4
call fcn.0056a3e8
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
call fcn.0056a024
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x569f1c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x104
call fcn.0055e66c
pop ecx
mov ebx, eax
test eax, eax
jne 0x569f40
xor eax, eax
jmp 0x569fe9
lea edx, [ebp - 4]
push edx
push ebx
push 0x104
mov ecx, dword [ebp + 0xc]
push ecx
call sub.KERNEL32.DLL_GetFullPathNameA
mov esi, eax
test esi, esi
je 0x569f61
cmp esi, 0x104
jb 0x569f6c
push ebx
call fcn.0055e67c
pop ecx
xor eax, eax
jmp 0x569fe9
cmp byte [ebx + 1], 0x3a
jne 0x569f9c
mov dl, byte [ebx]
lea ecx, [ebp - 8]
mov byte [ebp - 8], dl
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], 0x5c
mov byte [ebp - 5], 0
push ecx
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, 2
jae 0x569f9c
push ebx
call fcn.0055e67c
pop ecx
xor eax, eax
jmp 0x569fe9
inc esi
test edi, edi
je 0x569fdf
cmp esi, dword [ebp + 0x10]
jbe 0x569fb1
push ebx
call fcn.0055e67c
pop ecx
xor eax, eax
jmp 0x569fe9
push edi
mov esi, edi
xor eax, eax
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
push ebx
call fcn.0055e67c
pop ecx
mov eax, edi
jmp 0x569fe9
push esi
push ebx
call fcn.0055e68c
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x56de7c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea eax, [ebp - 0x200]
push eax
push 0x1001
mov edx, dword [ebx + 4]
push edx
call sub.KERNEL32.DLL_GetLocaleInfoA
push str._._n
lea ecx, [ebp - 0x200]
push ecx
call fcn.00567f80
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.0056808c
pop ecx
mov edx, pe_nt_image_headers32
sub edx, eax
push edx
lea ecx, [ebp - 0x200]
push ecx
call fcn.0056808c
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
push 0x1002
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
push 0x5cc2fd
lea ecx, [ebp - 0x200]
push ecx
call fcn.00567f80
add esp, 8
push 0xa
lea eax, [ebp - 0x200]
push eax
call fcn.0056808c
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
mov ecx, dword [ebx]
push ecx
call fcn.0056f708
add esp, 0xc
cmp dword [ebx + 0x24], 0
jne 0x56df8d
push esi
call fcn.0056808c
pop ecx
mov edi, eax
lea eax, [ebp - 0x200]
push eax
call fcn.0056808c
pop ecx
add edi, eax
add edi, 3
push edi
call fcn.0055e66c
pop ecx
mov edi, eax
mov dword [ebx + 0x24], edi
test edi, edi
jne 0x56df64
xor eax, eax
jmp 0x56e014
push esi
call fcn.0056808c
pop ecx
push eax
lea edx, [ebp - 0x200]
push edx
call fcn.0056808c
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push 0
push edi
call fcn.00567edc
add esp, 0xc
jmp 0x56dfcd
mov edi, dword [ebx + 0x24]
push edi
call fcn.0056808c
pop ecx
push eax
push esi
call fcn.0056808c
pop ecx
pop edx
add edx, eax
push edx
lea eax, [ebp - 0x200]
push eax
call fcn.0056808c
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push edi
call fcn.0055e68c
add esp, 8
mov dword [ebx + 0x24], eax
cmp dword [ebx + 0x24], 0
jne 0x56dfcd
xor eax, eax
jmp 0x56e014
push esi
mov edx, dword [ebx + 0x24]
push edx
call fcn.00567f80
add esp, 8
push 0x5cc2ff
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.00567f80
add esp, 8
lea eax, [ebp - 0x200]
push eax
mov edx, dword [ebx + 0x24]
push edx
call fcn.00567f80
add esp, 8
push 0x5cc301
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.00567f80
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x571bc4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x571c26
call fcn.00571b74
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.0056808c
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.0056808c
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x571ca4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x5cc938], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x571d7e
cmp dword [0x5cc934], 0
jne 0x571d7e
cmp dword [0x5ccb38], 0
je 0x571d38
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.00571a54
add esp, 8
mov ebx, eax
test eax, eax
jne 0x571d1e
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.00571a54
add esp, 8
mov ebx, eax
test eax, eax
jne 0x571d1e
lea ebx, [ebp - 0x84]
jmp 0x571d1f
inc ebx
call fcn.00571c60
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x571db9
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x5cc93c
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.0056808c
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x5cc93f
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x571db9
cmp dword [0x5cc934], 0
je 0x571d98
cmp dword [0x5cc934], 0xffffffff
je 0x571db9
push esi
call dword [0x5cc934]
pop ecx
mov eax, dword [0x5cc938]
test eax, eax
je 0x571db9
cmp dword [0x5cc938], 0xffffffff
je 0x571db9
cmp byte [eax], 0
je 0x571db9
push esi
push eax
call fcn.00571bc4
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5731c8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x1c]
mov esi, dword [ebp + 0xc]
cmp esi, 0x10
jge 0x5731ee
test esi, esi
je 0x5731ee
call fcn.00571c2c
mov dword [eax], 0x13
or eax, 0xffffffff
jmp 0x573260
call fcn.00572edc
mov ebx, eax
test eax, eax
jne 0x573209
call fcn.00571c2c
mov dword [eax], 8
or eax, 0xffffffff
jmp 0x573260
mov edx, dword [ebp + 0x10]
mov dword [ebx + 4], edx
lea edx, [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [ebx + 0x14], ecx
mov eax, dword [ebp + 0x20]
mov dword [ebx + 0x54], eax
push edx
mov ecx, dword [ebp + 0x18]
push ecx
push ebx
push 0x573124
push esi
mov eax, dword [ebp + 0x14]
push eax
call sub.KERNEL32.DLL_CreateThread
test eax, eax
jne 0x573254
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x718
jne 0x57324d
push 0x59
call fcn.0056a3e8
pop ecx
jmp 0x573260
call fcn.0056a454
jmp 0x573260
mov dword [ebx + 8], eax
test edi, edi
je 0x573260
mov edx, dword [ebp - 4]
mov dword [edi], edx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x57a9c4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebp, edx
mov esi, eax
mov ebx, esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
mov edi, ebx
push edi
call sub.KERNEL32.DLL_VirtualProtect
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x57a9f1
call fcn.0054cbc4
mov byte [ebx], 0xe9
mov eax, ebp
sub eax, esi
sub eax, 5
mov edx, eax
and dl, 0xff
mov byte [ebx + 1], dl
mov edx, eax
shr edx, 8
and dl, 0xff
mov byte [ebx + 2], dl
mov edx, eax
shr edx, 0x10
and dl, 0xff
mov byte [ebx + 3], dl
shr eax, 0x18
and al, 0xff
mov byte [ebx + 4], al
push esp
mov eax, dword [esp + 8]
push eax
push 5
push edi
call sub.KERNEL32.DLL_VirtualProtect
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x57aa3e
call fcn.0054cbc4
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x57aa70
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov ebp, edx
mov edi, eax
mov eax, dword [esp]
mov edx, ebp
call fcn.0055b6a8
mov eax, edi
call fcn.0055b90c
test eax, eax
jle 0x57aad2
mov eax, ebp
call fcn.0055b90c
mov esi, eax
test esi, esi
jle 0x57aad2
mov ebx, 1
mov eax, edi
call fcn.0055b90c
push eax
mov eax, ebx
dec eax
pop edx
mov ecx, edx
cdq
idiv ecx
inc edx
mov al, byte [edi + edx - 1]
mov dl, byte [ebp + ebx - 1]
xor al, dl
push eax
mov eax, dword [esp + 4]
call fcn.0055bb5c
pop edx
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x57aaa3
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x401063
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
push edi
push esi
push 0x80
push 4
push esi
push 3
push 0xc0000000
mov dword [ebp - 4], esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4010ce
mov eax, dword [ebp + 0xc]
cmp eax, esi
jge 0x40109a
push 2
pop ecx
jmp 0x40109c
xor ecx, ecx
cmp eax, esi
jge 0x4010a2
xor eax, eax
push ecx
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp - 4]
push esi
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp edi, esi
je 0x4010c9
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
jmp 0x4010d0
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x40116d
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
sub esp, 0x100
push ebx
push ebp
push esi
xor ebx, ebx
push edi
push ebx
push ebx
push ebx
push ebx
push 4
call dword [sym.imp.USER32.dll_mouse_event]
mov ebp, dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
cmp esi, 0x14
je 0x40120f
cmp esi, 0x90
je 0x40120f
cmp esi, 0x91
je 0x40120f
push esi
call ebp
test ah, 0x80
jne 0x4011d6
cmp esi, 8
je 0x4011cc
cmp esi, 1
je 0x4011c4
cmp esi, 2
je 0x4011c4
push esi
call edi
jmp 0x4011c7
push esi
call ebp
shr eax, 0xf
jmp 0x4011cf
push esi
call edi
and eax, 1
cmp eax, ebx
je 0x40120f
cmp esi, 0x21
jl 0x4011e0
cmp esi, 0x2e
jle 0x4011f8
cmp esi, 0x11
je 0x4011f8
cmp esi, 0x5b
je 0x4011f8
cmp esi, 0x5c
je 0x4011f8
cmp esi, 0x5d
je 0x4011f8
xor eax, eax
jmp 0x4011fb
push 1
pop eax
or al, 2
push ebx
push eax
push ebx
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push esi
call dword [sym.imp.USER32.dll_keybd_event]
inc esi
cmp esi, 0x100
jl 0x401193
push 0x3f
xor eax, eax
pop ecx
lea edi, [esp + 0x11]
mov byte [esp + 0x10], bl
push 0x100
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x14]
push ebx
push eax
call fcn.00403450
add esp, 0xc
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
xor esi, esi
push esi
call ebp
inc esi
cmp esi, 0xff
jl 0x40124e
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret
Function at 0x40160b
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push esi
push edi
push 0x40
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x103]
mov byte [ebp - 0x104], bl
mov esi, dword [ebp + 8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
cmp esi, ebx
stosb byte es:[edi], al
je 0x40163a
cmp byte [esi], bl
jne 0x401654
lea eax, [ebp - 0x104]
push 0x103
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp esi, ebx
je 0x40165c
cmp byte [esi], bl
jne 0x401662
lea esi, [ebp - 0x104]
push ebx
push 0x80
push 3
push ebx
push 3
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
inc eax
neg eax
sbb eax, eax
and eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x402b54
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor ebx, ebx
push edi
push ebx
push 0x80
push 3
push ebx
push 3
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, dword [ebp + 0x10]
mov dword [ebp + 8], eax
cmp edi, ebx
je 0x402bbe
cmp eax, ebx
je 0x402bbe
cmp dword [ebp + 0xc], ebx
jge 0x402b97
push 2
pop eax
jmp 0x402b99
xor eax, eax
push eax
push ebx
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp + 0x14]
cmp eax, dword [ebp + 8]
jb 0x402bb0
mov eax, dword [ebp + 8]
lea ecx, [ebp + 8]
push ebx
push ecx
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 8]
mov byte [eax + edi], bl
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret