joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49295b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push dword [ebp + 0x10]
mov ebx, ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x49297b
xor eax, eax
jmp 0x4929da
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp + 0x10], eax
test eax, eax
je 0x492977
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x492977
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp + 8], eax
test eax, eax
je 0x492977
push edi
mov ecx, ebx
call fcn.004924ad
push dword [ebp + 0x10]
lea ecx, [ebx + 4]
push dword [ebp + 8]
call fcn.0049248f
mov ecx, ebx
mov dword [ebx], esi
call fcn.00492a36
test eax, eax
jne 0x4929d9
xor ecx, ecx
mov dword [ebx + 4], ecx
mov dword [ebx + 0xc], ecx
mov dword [ebx + 8], ecx
or dword [ebx], 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x492c70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
push 0xc
pop edi
mov eax, dword [esi]
sub eax, edi
mov dword [ebp - 4], ebx
push eax
call fcn.00493d9f
mov dword [ebp + 0xc], eax
pop ecx
test eax, eax
je 0x492ce6
cmp dword [esi], edi
jbe 0x492cd0
movzx eax, word [ebx + 0x18]
mov ecx, dword [ebp - 4]
or eax, 2
mov ebx, eax
xor ebx, 1
imul ebx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
shr ebx, 8
xor bl, byte [eax + edi]
mov byte [ebp - 8], bl
push dword [ebp - 8]
call fcn.00492e03
mov eax, dword [ebp + 0xc]
mov byte [eax + edi - 0xc], bl
inc edi
mov ebx, dword [ebp - 4]
cmp edi, dword [esi]
jb 0x492c99
mov ebx, dword [ebp + 8]
push dword [ebx]
call fcn.00493d9a
mov eax, dword [ebp + 0xc]
mov dword [ebx], eax
xor eax, eax
add dword [esi], 0xfffffff4
inc eax
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x492d31
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4f31b4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0xc
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x18], ecx
jae 0x492d52
xor eax, eax
jmp 0x492d9a
push edi
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
xor esi, esi
push ebx
movzx eax, word [ecx + 0x18]
or eax, 2
mov ebx, eax
xor ebx, 1
imul ebx, eax
shr ebx, 8
xor bl, byte [ebp + esi - 0x10]
mov byte [ebp - 0x14], bl
push dword [ebp - 0x14]
call fcn.00492e03
mov ecx, dword [ebp - 0x18]
mov byte [ebp + esi - 0x10], bl
inc esi
cmp esi, 0xc
jl 0x492d5d
mov ecx, dword [ebp + 0x10]
xor eax, eax
shr ecx, 0x18
cmp byte [ebp - 5], cl
pop ebx
sete al
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00493b18
mov esp, ebp
pop ebp
ret 0xc
Function at 0x492e03
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [ebp + 8]
push esi
push edi
mov edi, ecx
mov edx, dword [edi + 0x10]
xor eax, edx
mov esi, dword [edi + 0xc]
mov ecx, dword [edi + 0x18]
movzx eax, al
shr edx, 8
mov eax, dword [esi + eax*4]
xor eax, edx
mov dword [edi + 0x10], eax
movzx eax, al
add eax, dword [edi + 0x14]
imul eax, eax, 0x8088405
inc eax
mov dword [edi + 0x14], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [esi + eax*4]
mov dword [edi + 0x18], ecx
pop edi
pop esi
pop ebp
ret 4

Function at 0x495c5a
Capabilities:
Write file on windows

Disassembly:
push 0x20
mov eax, 0x4c8835
call fcn.004c32a0
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x495d77
cmp byte [ebx + 0x3e], 0
je 0x495d77
mov eax, dword [ebx]
mov edi, 0xffff
push edi
mov esi, dword [eax + 0xc]
mov ecx, esi
call fcn.00494917
mov ecx, ebx
call esi
movzx eax, ax
cmp di, ax
sete al
test al, al
je 0x495ca6
xor al, al
jmp 0x495d79
xor eax, eax
mov dword [ebp - 0x14], 0xf
push eax
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.0040e800
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov edx, ecx
cmp eax, 0x10
jae 0x495cd6
lea edx, [ebp - 0x28]
mov ecx, edx
mov edi, dword [ebx + 0x38]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
add eax, edx
mov esi, dword [edi]
push eax
push ecx
lea eax, [ebx + 0x40]
mov ecx, dword [esi + 0x20]
push eax
call fcn.00494917
mov ecx, edi
call dword [esi + 0x20]
sub eax, 0
je 0x495d0b
sub eax, 1
je 0x495d0f
dec eax
sub eax, 1
je 0x495d65
xor bl, bl
jmp 0x495d67
mov byte [ebx + 0x3e], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
mov edx, ecx
cmp eax, 0x10
jae 0x495d1f
lea edx, [ebp - 0x28]
mov esi, dword [ebp - 0x2c]
sub esi, edx
je 0x495d47
cmp eax, 0x10
jae 0x495d2e
lea ecx, [ebp - 0x28]
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.0049d47a
add esp, 0x10
cmp esi, eax
jne 0x495d07
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
cmp byte [ebx + 0x3e], 0
je 0x495d65
test esi, esi
jne 0x495cca
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.0040e8d0
jmp 0x495cc4
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00405510
mov al, bl
jmp 0x495d79
mov al, 1
call fcn.004c325b
ret
Function at 0x49627a
Capabilities:
Write file on windows

Disassembly:
push 0x30
mov eax, 0x4c888a
call fcn.004c32a0
mov esi, ecx
mov dword [ebp - 0x30], esi
mov edi, dword [ebp + 8]
mov ebx, 0xffff
cmp bx, di
jne 0x49629f
xor eax, eax
jmp 0x496418
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x4962cb
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
lea eax, [ecx + eax*2]
cmp ecx, eax
jae 0x4962cb
dec dword [edx]
mov ax, di
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], di
jmp 0x496418
cmp dword [esi + 0x4c], 0
je 0x496415
mov ecx, esi
call fcn.00495ea7
xor eax, eax
cmp dword [esi + 0x38], eax
jne 0x4962fe
push dword [esi + 0x4c]
push edi
call fcn.00495830
pop ecx
pop ecx
test al, al
je 0x496415
movzx ebx, di
jmp 0x496415
push eax
push 8
lea ecx, [ebp - 0x28]
mov word [ebp - 0x2c], di
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.0040e800
and dword [ebp - 4], 0
lea eax, [esi + 0x40]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov edx, ecx
cmp eax, 0x10
jae 0x496336
lea edx, [ebp - 0x28]
mov ecx, edx
mov edi, dword [esi + 0x38]
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x18]
add eax, edx
mov esi, dword [edi]
push eax
push ecx
lea eax, [ebp - 0x3c]
mov ecx, dword [esi + 0x1c]
push eax
lea eax, [ebp - 0x2a]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x34]
call fcn.00494917
mov ecx, edi
call dword [esi + 0x1c]
test eax, eax
js 0x496409
cmp eax, 1
jg 0x4963e4
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
mov edx, ecx
cmp eax, 0x10
jae 0x49637f
lea edx, [ebp - 0x28]
mov edi, dword [ebp - 0x38]
sub edi, edx
je 0x4963ac
cmp eax, 0x10
jae 0x49638e
lea ecx, [ebp - 0x28]
mov esi, dword [ebp - 0x30]
push dword [esi + 0x4c]
push edi
push 1
push ecx
call fcn.0049d47a
add esp, 0x10
cmp edi, eax
jne 0x4963df
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
jmp 0x4963af
mov esi, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
mov byte [esi + 0x3e], 1
cmp dword [ebp - 0x3c], edx
jne 0x4963d9
test edi, edi
jne 0x49632a
cmp dword [ebp - 0x18], 0x20
jae 0x496403
push edi
push 8
lea ecx, [ebp - 0x28]
call fcn.0040e8d0
jmp 0x496324
mov eax, dword [ebp + 8]
movzx ebx, ax
movzx ebx, bx
jmp 0x496403
cmp eax, 3
jne 0x496409
mov eax, dword [ebp - 0x30]
push dword [eax + 0x4c]
push dword [ebp - 0x2c]
call fcn.00495830
pop ecx
pop ecx
test al, al
je 0x496403
mov eax, dword [ebp + 8]
movzx ebx, ax
movzx eax, bx
movzx ebx, ax
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00405510
mov ax, bx
call fcn.004c325b
ret 4

Function at 0x4b4367
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004b402a

Function at 0x4b4372
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004b41ab

Function at 0x4b83dc
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004b82e1

Function at 0x4ba97c
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004ba63c
Function at 0x4c24f9
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x4c2506
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.004c2512
Function at 0x1002aadf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x1002aaee
pop dword [ebp - 0x20]
mov eax, 0x1002aaee
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x2166712d
sub dword [ebp - 0x30], 0xd3142be2
mov dword [ebp - 0x2c], 0xb5a6c78b
add dword [ebp - 0x2c], 0x7c8c84ba
mov dword [ebp - 0x28], 0xa986a260
sub dword [ebp - 0x28], 0x5d3a5e32
mov dword [ebp - 0x24], 0x2762707d
add dword [ebp - 0x24], 0xd89d8f83
lea eax, [ebp - 0x30]
push eax
mov eax, 0x2993b40d
add eax, 0xe66f0c2b
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x7c16b70c
add dword [ebp - 0x30], 0xf85bb24a
mov dword [ebp - 0x2c], 0x8f770739
sub dword [ebp - 0x2c], 0x4e0aa5c4
mov dword [ebp - 0x28], 0x564b0906
add dword [ebp - 0x28], 0xd246366
mov dword [ebp - 0x24], 0x35775d12
sub dword [ebp - 0x24], 0x35775d12
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0xff2140a1
sub eax, 0xef1e8079
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x353dc
push 0
call eax
mov ecx, 0xf02f7a3e
sub ecx, 0xf02f3726
xor edi, edi
add edi, eax
mov ebx, 0x10039600
add ebx, dword [ebp - 0x20]
mov esi, 0xc89ed5f9
add esi, 0xf3ee04de
sub dword [ebp - 0x1c], ebx
mov edx, dword [ebx]
xor dword [ebp - 0x14], 0x87710ae5
sub edx, esi
sub dword [ebp - 4], ebx
mov dword [edi], edx
mov dword [ebp - 8], 0x4b0bd1ee
add edi, 0xc46f4a12
add edi, 0x3b90b5f2
add ebx, 4
loop 0x1002ac07
add eax, 0x417aa83f
sub eax, 0x4179a90c
mov ebx, eax
add eax, 0x7dc2d400
add eax, 0x823d2c05
mov ecx, 0x10000000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x55ce10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x64
push ebx
push ebp
push esi
lea eax, [esp + 0x50]
push edi
mov esi, ecx
push eax
mov edi, edx
push esi
call dword [sym.imp.GDI32.dll_GetClipBox]
lea ecx, [esp + 0x34]
push ecx
push edi
call dword [sym.imp.USER32.dll_GetClientRect]
mov edi, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push esi
call edi
mov ebp, eax
push esi
mov dword [esp + 0x28], ebp
call edi
mov ebx, eax
mov edi, dword [esp + 0x78]
push edi
call fcn.0055cc40
mov edx, dword [esp + 0x40]
mov ecx, dword [esp + 0x38]
sub edx, ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x3c]
push edx
sub eax, dword [esp + 0x38]
push eax
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push ebp
mov dword [esp + 0x38], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [esp + 0x10]
push 0
push ecx
push esi
mov dword [esp + 0x2c], eax
call dword [sym.imp.GDI32.dll_SelectPalette]
push esi
mov dword [esp + 0x30], eax
call dword [sym.imp.GDI32.dll_RealizePalette]
push edi
call fcn.0055cd40
mov ebp, eax
push edi
call fcn.0055cd60
push edi
mov dword [esp + 0x7c], eax
call fcn.0055cd80
push 0
push edi
push ebp
push 4
push edi
push esi
mov dword [esp + 0x2c], eax
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov ebp, eax
push ebp
push ebx
mov dword [esp + 0x24], ebp
call dword [sym.imp.GDI32.dll_SelectObject]
mov edi, dword [esp + 0x34]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x28], eax
sub edx, edi
xor eax, eax
test edx, edx
jle 0x55cf84
mov edi, dword [esp + 0x38]
mov edx, dword [esp + 0x40]
mov ecx, dword [esp + 0x78]
mov ebp, edx
mov dword [esp + 0x44], eax
add ecx, eax
sub ebp, edi
xor eax, eax
test ebp, ebp
mov dword [esp + 0x18], ecx
mov dword [esp + 0x4c], ecx
jle 0x55cf6c
mov edi, dword [esp + 0x14]
mov dword [esp + 0x48], eax
lea edx, [esp + 0x44]
lea ecx, [esp + 0x64]
lea ebp, [eax + edi]
lea eax, [esp + 0x54]
push edx
push eax
push ecx
mov dword [esp + 0x5c], ebp
call dword [sym.imp.USER32.dll_IntersectRect]
test eax, eax
je 0x55cf56
mov edx, dword [esp + 0x78]
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x44]
push 0xcc0020
push 0
push 0
push ebx
push edi
push edx
push eax
push ecx
push esi
call dword [sym.imp.GDI32.dll_BitBlt]
mov edx, dword [esp + 0x40]
mov edi, dword [esp + 0x38]
mov ecx, edx
mov eax, ebp
sub ecx, edi
cmp eax, ecx
jl 0x55cf0d
mov ecx, dword [esp + 0x18]
mov ebp, dword [esp + 0x34]
mov eax, ecx
mov ecx, dword [esp + 0x3c]
sub ecx, ebp
cmp eax, ecx
jl 0x55cef1
mov ebp, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
push edx
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [esp + 0x28]
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [esp + 0x2c]
push 1
push ecx
push esi
call dword [sym.imp.GDI32.dll_SelectPalette]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
mov edx, dword [esp + 0x30]
push edx
call esi
push ebp
call esi
mov eax, dword [esp + 0x10]
push eax
call esi
mov esi, dword [sym.imp.GDI32.dll_DeleteDC]
push edi
call esi
push ebx
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret 4
Function at 0x55dc00
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, edx
cmp word [esi], 3
jne 0x55dc20
mov eax, dword [esp + 0xc]
mov ecx, dword [esi + 0x14]
push eax
push edi
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov eax, edi
jmp 0x55dc2e
mov edx, dword [esp + 0x10]
mov ecx, esi
push edx
mov edx, edi
call fcn.0055da10
test eax, eax
jne 0x55dc35
lea eax, [esi + 0x1c]
pop edi
pop esi
ret 8
Function at 0x5600f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x56014a
lea ecx, [esp + 8]
lea edx, [esp + 0xc]
push ecx
push edx
push eax
mov eax, dword [esp + 0x10]
push eax
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
lea ecx, [esp + 0xc]
mov edx, dword [esp + 0x114]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 4

Function at 0x560160
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x20c
mov eax, dword [esp + 0x210]
push ebx
push ebp
mov ebp, edx
push edi
push ebp
mov edi, ecx
push 0
push eax
push edi
push 0x567240
push 0
mov dword [esp + 0x24], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jg 0x560256
mov ecx, edi
call fcn.0055e260
test eax, eax
jne 0x5601ae
pop edi
pop ebp
pop ebx
add esp, 0x20c
ret 4
lea ecx, [esp + 0x10]
mov edx, 0x567238
push ecx
mov ecx, 0x80000000
call fcn.005600f0
test eax, eax
jne 0x56025e
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x10]
push 0x567224
push edx
call ebx
lea eax, [esp + 0x10]
lea edx, [esp + 0x10]
push eax
mov ecx, 0x80000000
call fcn.005600f0
test eax, eax
jne 0x56025e
push esi
lea ecx, [esp + 0x14]
push 0x56721c
push ecx
call fcn.00565170
mov esi, eax
add esp, 8
test esi, esi
jne 0x560235
lea edx, [esp + 0x14]
push 0x567218
push edx
call fcn.00565170
mov esi, eax
add esp, 8
test esi, esi
jne 0x560235
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x560238
mov byte [esi], 0
push 0x5670b4
push esi
call ebx
push edi
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x1f
pop esi
jbe 0x56025e
mov dword [esp + 0xc], 1
mov eax, dword [esp + 0xc]
pop edi
pop ebp
pop ebx
add esp, 0x20c
ret 4
Function at 0x560940
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x56ad80]
push ebx
push ebp
push esi
mov esi, dword [ecx + 6]
push edi
mov edi, edx
mov edx, dword [ecx + 2]
xor edx, eax
mov eax, edx
mov dword [ecx + 2], edx
mov edx, dword [ecx + 0xa]
xor esi, eax
mov eax, dword [esp + 0x14]
xor esi, edx
add esi, eax
xor edx, edx
mov eax, esi
mov ebx, dword [ecx + 6]
mov ebp, dword [eax]
xor ebp, ebx
inc edx
mov dword [eax], ebp
mov ebx, dword [ecx + 0xa]
mov ebp, dword [eax + 4]
add eax, 4
xor ebp, ebx
inc edx
mov dword [eax], ebp
add eax, 4
cmp edx, 0x14
jl 0x560969
mov ecx, dword [edi]
call fcn.00564440
mov dword [edi], 0
cmp word [0x56ae10], 0
je 0x5609ac
cmp word [0x56729a], 0
je 0x5609ac
call esi
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x560a10
Capabilities:
Get common file path
Get disk information

Disassembly:
sub esp, 0x318
lea eax, [esp + 0x110]
mov byte [0x56ac44], 0
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x560a43
mov byte [esp + 0x110], 0x63
mov byte [esp + 0x111], al
push edi
lea edi, [esp + 0x114]
or ecx, 0xffffffff
xor eax, eax
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x560a85
cmp byte [esp + edx + 0x114], 0x5c
je 0x560a7d
lea edi, [esp + 0x114]
or ecx, 0xffffffff
xor eax, eax
inc edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp edx, ecx
jl 0x560a5b
jmp 0x560a85
mov byte [esp + edx + 0x115], 0
lea ecx, [esp + 0x10]
push 0x104
lea edx, [esp + 0x10]
push ecx
lea eax, [esp + 0x10]
push edx
lea ecx, [esp + 0x10]
push eax
push ecx
lea edx, [esp + 0x22c]
push 0x104
lea eax, [esp + 0x12c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x560bde
mov edx, dword [esp + 4]
lea ecx, [esp + 0x10]
push 0xa
push ecx
push edx
call fcn.00564f4e
add esp, 0xc
xor eax, eax
mov dl, 0x38
mov cl, byte [esp + eax + 0x10]
cmp cl, 0x30
jl 0x560aef
cmp cl, 0x39
jg 0x560aef
mov byte [eax + 0x56ac3c], cl
jmp 0x560af5
mov byte [eax + 0x56ac3c], dl
inc eax
cmp eax, 8
jl 0x560ad9
mov edi, 0x56ac3c
or ecx, 0xffffffff
xor eax, eax
push esi
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x14]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov al, byte [esp + 0x19]
mov dl, byte [esp + 0x1b]
xor al, 0x7f
xor dl, 0x7f
mov byte [0x56ac3d], al
mov al, byte [esp + 0x17]
mov cl, byte [esp + 0x14]
xor al, 0x7f
xor dl, 0x7f
mov byte [0x56ac3e], al
mov al, byte [esp + 0x16]
mov byte [0x56ac3f], dl
mov dl, byte [0x56ac3e]
xor al, 0x7f
xor dl, 0x7f
xor cl, 0x7f
mov byte [0x56ac40], dl
mov dl, byte [0x56ac3d]
xor al, 0x7f
xor cl, 0x7f
xor dl, 0x7f
cmp al, 0x30
mov byte [0x56ac41], 0
mov byte [0x56ac3c], al
mov byte [0x56ac3e], cl
mov byte [0x56ac3d], dl
pop esi
jne 0x560b96
mov byte [0x56ac3c], 0x31
mov eax, 1
mov dl, 0x35
mov cl, byte [eax + 0x56ac3c]
cmp cl, 0x30
jb 0x560bad
cmp cl, 0x39
jbe 0x560bb3
mov byte [eax + 0x56ac3c], dl
inc eax
cmp eax, 5
jl 0x560b9d
mov edx, 0x567338
mov ecx, 0x56ac3c
call fcn.005648e0
xor ecx, ecx
mov dword [0x56ac48], eax
test eax, eax
setne cl
mov eax, ecx
pop edi
add esp, 0x318
ret
mov edx, 0x567330
mov ecx, 0x567318
call fcn.00564450
xor eax, eax
pop edi
add esp, 0x318
ret
Function at 0x561580
Capabilities:
Delete registry key

Disassembly:
push ecx
mov ecx, dword [0x56ae14]
mov eax, 0x60000
test eax, ecx
jne 0x5615a8
mov edx, ecx
mov ecx, dword [0x56ad80]
or edx, eax
xor ecx, eax
mov dword [0x56ae14], edx
mov dword [0x56ad80], ecx
lea eax, [esp]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push eax
push 0x567258
push 0x80000000
call esi
test eax, eax
je 0x561628
lea ecx, [esp + 4]
push ecx
push 0x567258
push 0x80000001
call esi
test eax, eax
jne 0x5615ec
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80000001
pop esi
pop ecx
ret
lea eax, [esp + 4]
push eax
push 0x567258
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x5615e4
push 0x567258
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80000000
pop esi
pop ecx
ret
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80000000
pop esi
pop ecx
ret
Function at 0x562050
Capabilities:
Get common file path

Disassembly:
sub esp, 0x190
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
mov ebx, ecx
push 0x104
mov edi, edx
push eax
mov dword [esp + 0x18], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x562081
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x190
ret
push 0x104
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
test esi, esi
jne 0x5620a6
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x190
ret
push 0
push ebx
call dword [sym.imp.KERNEL32.dll__lopen]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push 0x1a3
push 0x5673a0
push edx
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [esp + 0x14]
push 0
push eax
call dword [sym.imp.KERNEL32.dll__lcreat]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x56210d
mov edi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll__lclose]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x190
ret
lea ecx, [edi - 0x104]
test ecx, ecx
jle 0x56213f
push 0x104
push esi
push ebp
call dword [sym.imp.KERNEL32.dll__lread]
push 0x104
push esi
push ebx
call dword [sym.imp.KERNEL32.dll__lwrite]
sub edi, 0x104
cmp edi, 0x104
jg 0x562117
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll__lread]
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll__lwrite]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll__lclose]
call ebp
push ebx
call ebp
lea edx, [esp + 0x118]
mov edi, dword [esp + 0x10]
push 0x200
push edx
push edi
call dword [sym.imp.KERNEL32.dll_OpenFile]
lea eax, [esp + 0x14]
push 0
push eax
call dword [sym.imp.KERNEL32.dll__lopen]
mov ebx, eax
push 6
push edi
call dword [sym.imp.KERNEL32.dll__lcreat]
mov edi, eax
cmp edi, 0xffffffff
jne 0x5621be
mov edi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebx
call ebp
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x190
ret
push 0x104
push esi
push ebx
call dword [sym.imp.KERNEL32.dll__lread]
cmp eax, 0x104
jne 0x5621f3
push 0x104
push esi
push edi
call dword [sym.imp.KERNEL32.dll__lwrite]
push 0x104
push esi
push ebx
call dword [sym.imp.KERNEL32.dll__lread]
cmp eax, 0x104
je 0x5621d2
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll__lwrite]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push edi
call ebp
push ebx
call ebp
lea ecx, [esp + 0x118]
lea edx, [esp + 0x14]
push 0x200
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_OpenFile]
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x190
ret