joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5510ec
Capabilities:
Create thread
Inject thread

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffdc
mov ebx, ecx
mov edi, edx
mov dword [esp], eax
mov byte [esp + 4], 0
mov al, 1
call fcn.0055104c
mov eax, edi
call fcn.00405274
add eax, eax
inc eax
call fcn.00402bb8
mov esi, eax
mov eax, edi
call fcn.00405274
mov ecx, eax
add ecx, ecx
inc ecx
mov edx, esi
mov eax, edi
call fcn.00406038
test ebx, ebx
jbe 0x551136
mov dword [esp + 8], ebx
jmp 0x551144
lea ecx, [esp + 8]
xor edx, edx
mov eax, dword [esp]
call fcn.00550f10
cmp dword [esp + 8], 0
je 0x551158
mov eax, dword [esp + 8]
call fcn.0054a9e8
test al, al
je 0x551164
mov eax, esi
call fcn.00402be8
jmp 0x5512b3
mov eax, dword [esp + 8]
push eax
push 0
push 0x2a
call sub.KERNEL32.DLL_OpenProcess
mov ebx, eax
push esi
call sub.KERNEL32.DLL_lstrlenW
inc eax
mov edi, eax
add edi, edi
push 4
push 0x1000
push edi
push 0
push ebx
call sub.KERNEL32.DLL_VirtualAllocEx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
push edi
push esi
mov eax, dword [esp + 0x18]
push eax
push ebx
call sub.KERNEL32.DLL_WriteProcessMemory
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x5511fb
push 0x5512c0
push 0x5512d4
call sub.KERNEL32.DLL_GetModuleHandleA_1
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x24]
push eax
push 0
push 0
push ebx
call sub.KERNEL32.DLL_CreateRemoteThread
mov dword [esp + 0x20], eax
cmp dword [esp + 0x20], 0
je 0x551280
push 0xffffffffffffffff
mov eax, dword [esp + 0x24]
push eax
call sub.KERNEL32.DLL_WaitForSingleObject
xor eax, eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x24]
push eax
call sub.KERNEL32.DLL_GetExitCodeThread
push 0x5512e0
push 0x5512d4
call sub.KERNEL32.DLL_GetModuleHandleA_1
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
push 0
mov eax, dword [esp + 0x24]
push eax
mov eax, dword [esp + 0x24]
push eax
push 0
push 0
push ebx
call sub.KERNEL32.DLL_CreateRemoteThread
mov ebp, eax
push 0xffffffffffffffff
push ebp
call sub.KERNEL32.DLL_WaitForSingleObject
xor eax, eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push eax
push ebp
call sub.KERNEL32.DLL_GetExitCodeThread
mov eax, dword [esp + 0x1c]
mov byte [esp + 4], al
mov eax, esi
call fcn.00402be8
cmp dword [esp + 0x10], 0
je 0x55129f
push 0x4000
push edi
mov eax, dword [esp + 0x18]
push eax
push ebx
call sub.KERNEL32.DLL_VirtualFreeEx
test ebp, ebp
je 0x5512a9
push ebp
call sub.KERNEL32.DLL_CloseHandle
test ebx, ebx
je 0x5512b3
push ebx
call sub.KERNEL32.DLL_CloseHandle
mov al, byte [esp + 4]
add esp, 0x24
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x55476c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405464
xor eax, eax
push ebp
push 0x5547c5
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 4]
call fcn.00405474
mov esi, eax
push esi
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, 2
je 0x5547ad
push esi
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, 5
jne 0x5547af
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5547cc
lea eax, [ebp - 4]
call fcn.00404fb4
ret

Function at 0x5547d4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405464
xor eax, eax
push ebp
push 0x554838
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xe
lea eax, [ebp - 0x1a]
push eax
mov eax, dword [ebp - 4]
call fcn.00405474
push eax
call sub.KERNEL32.DLL_GetVolumeInformationA
mov edx, ebx
lea eax, [ebp - 0x1a]
call fcn.0040b2f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55483f
lea eax, [ebp - 4]
call fcn.00404fb4
ret

Function at 0x555360
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405464
xor eax, eax
push ebp
push 0x55545c
push dword fs:[eax]
mov dword fs:[eax], esp
mov ax, word [esi + 4]
mov word [ebx + 4], ax
mov ax, word [esi + 6]
mov word [ebx + 6], ax
mov ax, word [esi + 8]
mov word [ebx + 8], ax
mov ax, word [esi + 0xa]
mov word [ebx + 0x64], ax
mov eax, dword [esi + 0xc]
call fcn.005542b4
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x18], eax
mov ax, word [esi + 0x1c]
mov word [ebx + 0x1c], ax
mov ax, word [esi + 0x1e]
mov word [ebx + 0x1e], ax
mov ax, word [esi + 0x20]
mov word [ebx + 0x22], ax
mov ax, word [esi + 0x22]
mov word [ebx + 0x24], ax
mov ax, word [esi + 0x24]
mov word [ebx + 0x26], ax
mov eax, dword [esi + 0x26]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2a]
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.005519e0
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00556a00
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00551980
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.00556a78
lea eax, [ebx + 0x50]
call fcn.00404fb4
mov byte [ebx + 0x54], 0
mov byte [ebx + 0x56], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x555463
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404fd8
ret
Function at 0x55546c
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405464
xor eax, eax
push ebp
push 0x555578
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebx + 4], 0
mov ax, word [esi + 4]
mov word [ebx + 6], ax
mov ax, word [esi + 6]
mov word [ebx + 8], ax
mov ax, word [esi + 8]
mov word [ebx + 0x64], ax
mov eax, dword [esi + 0xa]
call fcn.005542b4
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0xe]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x12]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x16]
mov dword [ebx + 0x18], eax
mov ax, word [esi + 0x1a]
mov word [ebx + 0x1c], ax
mov ax, word [esi + 0x1c]
mov word [ebx + 0x20], ax
mov word [ebx + 0x22], 0
mov word [ebx + 0x24], 0
mov word [ebx + 0x26], 0
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
cmp dword [ebp - 4], 0
je 0x55553b
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.005519e0
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00556a00
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00551980
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.00556a78
jmp 0x55554d
xor edx, edx
mov eax, ebx
call fcn.00556a00
xor edx, edx
mov eax, ebx
call fcn.00556a78
lea eax, [ebx + 0x50]
call fcn.00404fb4
mov byte [ebx + 0x54], 0
mov byte [ebx + 0x56], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55557f
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404fd8
ret
Function at 0x557c09
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 4], edx
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0xefcdab89
mov edx, dword [ebp + 8]
mov dword [edx + 0x10], 0x98badcfe
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x14], 0x10325476
mov eax, dword [ebp + 8]
mov dword [eax + 0x18], 0xc3d2e1f0
pop ebp
ret

Function at 0x558180
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
mov dword [ebp - 4], eax
push 0x104
push dword [ebp + 8]
mov edx, dword [ebp + 8]
add edx, 0x104
push edx
call fcn.00557894
add esp, 0xc
cmp dword [ebp - 4], 0x104
jae 0x5581d4
mov ecx, 0x104
sub ecx, dword [ebp - 4]
push ecx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
push eax
mov edx, dword [ebp + 8]
call dword [edx + 0x20c]
add esp, 8
add dword [ebp - 4], eax
cmp dword [ebp - 4], 0x104
jb 0x5581ac
xor ecx, ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov cl, byte [edx + eax + 0x104]
not cl
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 8]
xor byte [edx + eax], cl
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x104
jb 0x5581d9
push dword [ebp + 8]
call fcn.005580cc
pop ecx
mov ecx, dword [ebp + 8]
add ecx, 0x104
push ecx
call fcn.005580cc
pop ecx
pop ecx
pop ebp
ret

Function at 0x5596ba
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
cmp dword [eax + 0x9c], 0xffffffff
je 0x559768
mov edx, dword [ebp + 0x10]
cmp dword [edx + 0x9c], 0x40
jbe 0x5596f9
mov ecx, dword [ebp + 0x10]
add ecx, 0x40
push ecx
push dword [ebp + 0x10]
call fcn.00557ce9
add esp, 8
mov eax, dword [ebp + 0x10]
mov dword [eax + 0x9c], 0x14
mov edx, 0x40
mov ecx, dword [ebp + 0x10]
sub edx, dword [ecx + 0x9c]
push edx
push 0
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0x10]
add eax, dword [edx + 0x9c]
push eax
call fcn.0055787c
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0x10]
xor dword [edx + eax*4], 0x36363636
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x10
jb 0x559724
mov ecx, dword [ebp + 0x10]
add ecx, 0x40
push ecx
call fcn.00557c09
pop ecx
mov eax, dword [ebp + 0x10]
add eax, 0x40
push eax
push 0x40
push dword [ebp + 0x10]
call fcn.00557c4d
add esp, 0xc
mov edx, dword [ebp + 0x10]
mov dword [edx + 0x9c], 0xffffffff
cmp dword [ebp + 0xc], 0
je 0x559783
mov ecx, dword [ebp + 0x10]
add ecx, 0x40
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00557c4d
add esp, 0xc
pop ecx
pop ebp
ret
Function at 0x559786
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov eax, dword [ebp + 0x10]
cmp dword [eax + 0x9c], 0xffffffff
je 0x5597a7
push dword [ebp + 0x10]
push 0
push 0
call fcn.005596ba
add esp, 0xc
mov edx, dword [ebp + 0x10]
add edx, 0x40
push edx
lea ecx, [ebp - 0x18]
push ecx
call fcn.00557ce9
add esp, 8
xor eax, eax
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
mov ecx, dword [ebp + 0x10]
xor dword [ecx + edx*4], 0x6a6a6a6a
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x10
jb 0x5597bf
mov eax, dword [ebp + 0x10]
add eax, 0x40
push eax
call fcn.00557c09
pop ecx
mov edx, dword [ebp + 0x10]
add edx, 0x40
push edx
push 0x40
push dword [ebp + 0x10]
call fcn.00557c4d
add esp, 0xc
mov ecx, dword [ebp + 0x10]
add ecx, 0x40
push ecx
push 0x14
lea eax, [ebp - 0x18]
push eax
call fcn.00557c4d
add esp, 0xc
mov edx, dword [ebp + 0x10]
add edx, 0x40
push edx
lea ecx, [ebp - 0x18]
push ecx
call fcn.00557ce9
add esp, 8
xor eax, eax
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
cmp edx, dword [ebp + 0xc]
jae 0x559846
mov ecx, dword [ebp - 4]
mov al, byte [ebp + ecx - 0x18]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov byte [edx + ecx], al
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
jb 0x55982b
mov esp, ebp
pop ebp
ret
Function at 0x55acec
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde8
lea eax, [ebp - 0xd8]
push eax
call fcn.00559608
pop ecx
lea edx, [ebp - 0xd8]
push edx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0055961f
add esp, 0xc
push 0xa0
lea ecx, [ebp - 0xd8]
push ecx
lea eax, [ebp - 0x178]
push eax
call fcn.00557894
add esp, 0xc
lea edx, [ebp - 0x178]
push edx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.005596ba
add esp, 0xc
mov eax, dword [ebp + 0x20]
dec eax
mov ecx, 0x14
xor edx, edx
div ecx
inc eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x10]
jae 0x55ae80
push 0x14
push 0
lea ecx, [ebp - 0x38]
push ecx
call fcn.0055787c
add esp, 0xc
push 0xa0
lea eax, [ebp - 0x178]
push eax
lea edx, [ebp - 0x218]
push edx
call fcn.00557894
add esp, 0xc
mov ecx, dword [ebp - 4]
inc ecx
shr ecx, 0x18
mov byte [ebp - 0x24], cl
mov eax, dword [ebp - 4]
inc eax
shr eax, 0x10
mov byte [ebp - 0x23], al
mov edx, dword [ebp - 4]
inc edx
shr edx, 8
mov byte [ebp - 0x22], dl
mov cl, byte [ebp - 4]
inc ecx
mov byte [ebp - 0x21], cl
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 4
mov edx, dword [ebp - 8]
cmp edx, dword [ebp + 0x18]
jae 0x55ae3a
lea ecx, [ebp - 0x218]
push ecx
push dword [ebp - 0xc]
lea eax, [ebp - 0x24]
push eax
call fcn.005596ba
add esp, 0xc
lea edx, [ebp - 0x218]
push edx
push 0x14
lea ecx, [ebp - 0x24]
push ecx
call fcn.00559786
add esp, 0xc
xor eax, eax
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
mov cl, byte [ebp + edx - 0x24]
mov eax, dword [ebp - 0xc]
xor byte [ebp + eax - 0x38], cl
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x14
jb 0x55adfd
push 0xa0
lea edx, [ebp - 0xd8]
push edx
lea ecx, [ebp - 0x218]
push ecx
call fcn.00557894
add esp, 0xc
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x18]
jb 0x55adcd
xor edx, edx
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 4]
shl ecx, 2
lea ecx, [ecx + ecx*4]
mov dword [ebp - 0xc], ecx
jmp 0x55ae63
mov eax, dword [ebp - 8]
mov dl, byte [ebp + eax - 0x38]
mov ecx, dword [ebp + 0x1c]
mov eax, dword [ebp - 0xc]
mov byte [ecx + eax], dl
inc dword [ebp - 8]
inc dword [ebp - 0xc]
cmp dword [ebp - 8], 0x14
jae 0x55ae71
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0x20]
jb 0x55ae4d
inc dword [ebp - 4]
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x55ad69
mov esp, ebp
pop ebp
ret

Function at 0x55c1fc
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov ecx, dword [edi + 0x170]
mov edx, ebx
mov eax, edi
call fcn.0055c2f8
mov esi, eax
mov dword [edi + 0x170], esi
and esi, 0xff
add dword [edi + 0x174], esi
imul esi, dword [edi + 0x174], 0x8088405
inc esi
mov dword [edi + 0x174], esi
mov edx, esi
shr edx, 0x18
mov ecx, dword [edi + 0x178]
mov eax, edi
call fcn.0055c2f8
mov dword [edi + 0x178], eax
pop edi
pop esi
pop ebx
ret
Function at 0x55ce88
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x55d071
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
jle 0x55d02d
mov eax, dword [ebp - 4]
call fcn.0055e514
cmp ebx, eax
jge 0x55d02d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x118]
mov edx, ebx
call fcn.00552fc4
mov edx, dword [0x554d98]
call fcn.004042e4
mov esi, eax
mov eax, esi
call fcn.00556958
test al, al
je 0x55d023
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov eax, dword [esi + 0x50]
call fcn.00405274
test eax, eax
jne 0x55d016
xor eax, eax
push ebp
push 0x55d00f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0055d2f4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
call fcn.004217e0
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push dword [esi + 0x34]
push dword [esi + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
lea edx, [ebp - 0x46]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, 0x2e
mov esi, dword [eax]
call dword [esi + 0xc]
movzx eax, word [ebp - 0x2a]
movzx edx, word [ebp - 0x28]
add eax, edx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x18]
movzx esi, word [ebp - 0x26]
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.00405600
mov eax, dword [ebp - 8]
call fcn.004054cc
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, esi
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
mov al, byte [eax + 0x28]
mov byte [ebp - 9], al
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0055d1f0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
mov dl, byte [ebp - 9]
mov byte [eax + 0x28], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55d05b
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
jne 0x55d00e
mov eax, dword [ebp - 4]
call fcn.0055d378
ret
mov eax, dword [ebp - 8]
mov edx, dword [esi + 0x50]
call fcn.00405008
jmp 0x55d05b
mov eax, dword [ebp - 8]
call fcn.00404fb4
jmp 0x55d05b
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x4c], 0
lea eax, [ebp - 0x50]
push eax
push 0
lea edx, [ebp - 0x54]
mov eax, 0xb3
call fcn.0040a718
mov ecx, dword [ebp - 0x54]
mov dl, 1
mov eax, dword [0x41c13c]
call fcn.0040e858
call fcn.00404908
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55d078
lea eax, [ebp - 0x54]
call fcn.00404fb4
ret
Function at 0x5632f8
Capabilities:
Get disk size

Disassembly:
push ebx
add esp, 0xffffffc4
mov ebx, eax
call fcn.00563168
test al, al
je 0x563325
lea edx, [esp + 0x10]
mov eax, ebx
call fcn.00563260
test al, al
jne 0x56331b
call fcn.004100c0
mov eax, dword [esp + 0x14]
imul dword [esp + 0x18]
jmp 0x563356
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
mov eax, ebx
call fcn.00405474
push eax
call sub.KERNEL32.DLL_GetDiskFreeSpaceA
test eax, eax
jne 0x56334f
call fcn.004100c0
mov eax, dword [esp]
imul dword [esp + 4]
add esp, 0x3c
pop ebx
ret

Function at 0x5692f8
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffed0
mov ebx, edx
mov esi, eax
cmp dword [esi + 0x5c8], 0
je 0x56931c
mov eax, dword [esi + 0x5c8]
call fcn.005516b0
test al, al
jne 0x569337
push esp
push 0x12d
call sub.KERNEL32.DLL_GetTempPathA
mov eax, ebx
mov edx, esp
mov ecx, 0x12d
call fcn.00405224
jmp 0x569344
mov eax, ebx
mov edx, dword [esi + 0x5c8]
call fcn.00405008
mov eax, dword [ebx]
call fcn.00405274
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
je 0x569360
mov eax, ebx
mov edx, 0x569374
call fcn.0040527c
add esp, 0x130
pop esi
pop ebx
ret

Function at 0x569450
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x569581
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, dword [0x58f5d0]
call fcn.004d6ea8
lea eax, [ebp - 4]
mov edx, dword [ebp - 0xc]
mov ecx, 0x569590
call fcn.00406fc8
lea eax, [ebp - 8]
mov edx, dword [ebp - 0xc]
mov ecx, 0x5695a0
call fcn.00406fc8
push 0
lea eax, [ebp - 0x10]
mov edx, ebx
mov ecx, 0x401
call fcn.00405850
mov eax, dword [ebp - 0x10]
call fcn.00405878
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
push 2
lea eax, [ebx + 0x1814]
push eax
push 0x401
lea eax, [ebx + 0x401]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
push 0x401
lea eax, [ebx + 0x1004]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
push 0x401
lea eax, [ebx + 0x802]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x28]
push 0x401
lea eax, [ebx + 0xc03]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x20]
lea eax, [ebx + 0x1808]
push eax
push 0x401
lea eax, [ebx + 0x1405]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x40]
lea eax, [ebx + 0x180c]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
lea eax, [ebx + 0x1810]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x38]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x569588
lea eax, [ebp - 0x10]
call fcn.004056fc
lea eax, [ebp - 0xc]
call fcn.00406f84
lea eax, [ebp - 8]
call fcn.00406f84
lea eax, [ebp - 4]
call fcn.00406f84
ret
Function at 0x56c5e8
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x56c7c8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
mov edx, 0x24
call fcn.0057023c
lea eax, [ebp - 0x28]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov eax, dword [ebp - 0x14]
mov dword [0x58e9cc], eax
mov eax, dword [ebp - 0xc]
mov dword [0x58e9d0], eax
mov eax, dword [ebp - 0x24]
mov dword [0x58e9d4], eax
mov eax, dword [0x59002c]
cmp dword [eax], 2
sete byte [0x58e2b0]
push 0x56c7d4
call sub.KERNEL32.DLL_GetModuleHandleA_1
lea edx, [ebp - 4]
call fcn.0056fc7c
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp byte [0x58e2b0], 0
jne 0x56c677
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.0056fdc0
test al, al
je 0x56c677
mov eax, dword [ebp - 0x4c]
mov dword [0x59332c], eax
jmp 0x56c67e
xor eax, eax
mov dword [0x59332c], eax
call fcn.0056c320
and eax, 0x7f
cmp eax, 0x12
ja case.0x56c68f.0
jmp dword [eax*4 + 0x56c696]
mov byte [0x58e29c], 1
jmp case.0x56c68f.0
mov byte [0x58e2a0], 1
jmp case.0x56c68f.0
mov byte [0x58e2a4], 1
jmp case.0x56c68f.0
mov byte [0x58e2a8], 1
jmp case.0x56c68f.0
mov byte [0x58e2ac], 1
jmp case.0x56c68f.0
mov byte [0x58e2b4], 1
mov byte [0x58e2b8], 1
jmp case.0x56c68f.0
mov byte [0x58e2b4], 1
mov byte [0x58e2bc], 1
jmp case.0x56c68f.0
mov byte [0x58e2b4], 1
mov byte [0x58e2bc], 1
mov byte [0x58e2c0], 1
jmp case.0x56c68f.0
mov byte [0x58e2c4], 1
jmp case.0x56c68f.0
mov byte [0x58e2c8], 1
jmp case.0x56c68f.0
mov byte [0x58e2cc], 1
jmp case.0x56c68f.0
mov byte [0x58e2d0], 1
jmp case.0x56c68f.0
mov byte [0x58e2d4], 1
jmp case.0x56c68f.0
mov byte [0x58e2d8], 1
jmp case.0x56c68f.0
mov byte [0x58e2dc], 1
jmp case.0x56c68f.0
mov byte [0x58e2e0], 1
jmp case.0x56c68f.0
mov byte [0x58e2e4], 1
jmp case.0x56c68f.0
mov byte [0x58e2e8], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56c7cf
lea eax, [ebp - 4]
call fcn.00404fb4
ret

Function at 0x56e2b0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x56e314
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00405224
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GetACP
mov edx, eax
pop eax
call fcn.0040a43c
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56e31b
lea eax, [ebp - 0xc]
call fcn.00404fb4
ret