joyce8/EMBER2024-capa huggingface dataset:
Function at 0x587b21
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x587bbe
push ebx
push esi
call fcn.00587c0f
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.005876d3
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x587b6b
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x587bbd
push edi
push eax
call fcn.004f1b70
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x587b8b
call fcn.00561960
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x587bbc
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.005876d3
add esp, 0x20
test eax, eax
jne 0x587baa
push edi
call fcn.00561960
jmp 0x587bb2
push ebx
call fcn.00561960
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x587bc1
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x587bd2
pop esi
ret
push ebx
push edi
push esi
call fcn.00587c0f
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.004f1b70
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x587bfa
push ebx
push esi
push edi
call fcn.00568550
add esp, 0xc
push 0
call fcn.00561960
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x587c51
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00587ebc
Function at 0x5b46c0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
je 0x5b46cf
dec eax
mov dword [ecx + 4], eax
pop ebp
jmp fcn.005b46e0
Function at 0x5b4fd0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xb0
mov ebx, edx
mov dword [esp + 8], ecx
mov eax, dword [0x646040]
xor eax, ebp
mov dword [esp + 0xa8], eax
mov dword [esp + 0x20], 0xa
mov al, byte [0x64b456]
test al, al
jne 0x5b51f9
xor edi, edi
dec edi
mov dword [esp + 0x98], edi
mov dword [esp + 0x9c], edi
mov dword [esp + 0xa0], edi
lea esi, [esp + 0x50]
mov ecx, ebx
push esi
call fcn.00416cb0
cmp byte [esi + 0xb], 0
mov dword [esp + 0xc], ebx
js 0x5b50ba
mov eax, dword [esp + 0x58]
mov dword [esp + 0xa0], eax
movq xmm0, qword [esp + 0x50]
movq qword [esp + 0x98], xmm0
lea ebx, [esp + 0x50]
mov ecx, ebx
call fcn.0055c200
lea esi, [esp + 0x8c]
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov ecx, dword [esp + 0xc]
push esi
call fcn.005bc4c0
pxor xmm0, xmm0
movq qword [ebx + 0x34], xmm0
pxor xmm0, xmm0
movdqu xmmword [ebx + 0x24], xmm0
mov dword [ebx], 0x3c
mov dword [ebx + 4], 0x40
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], str.runas
cmp byte [esp + 0xa3], 0
js 0x5b50d0
lea ecx, [esp + 0x98]
jmp 0x5b50d7
lea ecx, [esp + 0x98]
push dword [esp + 0x54]
push dword [esp + 0x54]
call fcn.005421d0
jmp 0x5b5054
mov ecx, dword [esp + 0x98]
mov edi, dword [esp + 8]
mov al, byte [ebp + 8]
mov dword [esp + 0x60], ecx
cmp byte [esp + 0x97], 0
jns 0x5b50f3
mov esi, dword [esp + 0x8c]
mov dword [esp + 0x64], esi
xor esi, esi
mov dword [esp + 0x68], esi
xor al, 1
movzx eax, al
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], esi
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x5b5178
cmp byte [ebp + 0xc], 0
je 0x5b5171
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x20]
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea esi, [esp + 0x10]
push 0x9f
push str.launch_win.cc
push str.LaunchElevatedProcess
push esi
call fcn.00509c60
add esp, 0x10
mov ecx, ebx
push 0
push esi
call fcn.00520b90
push 0xffffffffffffffff
push dword [esp + 0x8c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, ebx
lea ebx, [esp + 0x50]
call fcn.00540880
mov esi, dword [esp + 0x88]
mov ecx, edi
push esi
call fcn.0040f9b0
cmp byte [esp + 0x97], 0
jns 0x5b5199
push dword [esp + 0x8c]
call fcn.00564050
add esp, 4
cmp byte [esp + 0xa3], 0
jns 0x5b51b2
push dword [esp + 0x98]
call fcn.00564050
add esp, 4
mov dword [esp + 0x20], 0xa
mov al, byte [0x64b456]
test al, al
jne 0x5b51db
mov ecx, dword [esp + 0xa8]
xor ecx, ebp
call fcn.00567335
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
movzx eax, al
mov dword [esp + 0x50], 0
lea ecx, [esp + 0x20]
push 2
push ebx
push ecx
push eax
call fcn.00591070
add esp, 0x10
jmp 0x5b51c3
movzx eax, al
lea ecx, [esp + 0x50]
mov dword [ecx], str.LaunchElevatedProcess
lea edx, [esp + 0x20]
push 1
push ecx
push edx
push eax
call fcn.00591070
add esp, 0x10
jmp 0x5b5008
Function at 0x5babd0
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x230
mov eax, dword [0x646040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov bl, 1
cmp dword [0x64c794], 0
je 0x5bac08
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00567335
mov eax, ebx
add esp, 0x230
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [0x64c798]
test esi, esi
je 0x5bad0d
test byte [0x6480b4], 1
je 0x5babf1
xorps xmm0, xmm0
movups xmmword [ebp - 0x22c], xmm0
movups xmmword [ebp - 0x23c], xmm0
mov dword [ebp - 0x21c], 0
cmp byte [esi + 0xb], 0
jns 0x5bac42
mov esi, dword [esi]
lea eax, [ebp - 0x23c]
push eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x5bac7f
mov eax, dword [ebp - 0x220]
cmp dword [ebp - 0x21c], 0x40000001
sbb eax, 0
jb 0x5bac7f
mov eax, dword [0x64c798]
cmp byte [eax + 0xb], 0
jns 0x5bac78
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [0x64c798]
cmp byte [eax + 0xb], 0
jns 0x5bac8c
mov eax, dword [eax]
sub esp, 0x1c
movaps xmm0, xmmword [0x630e20]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x64c794], eax
mov bl, 1
inc eax
cmp eax, 1
ja 0x5babf1
lea esi, [ebp - 0x216]
push 0x206
push 0xff
push esi
call fcn.00568ad0
add esp, 0xc
mov word [esi - 2], 0
lea esi, [ebp - 0x218]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add eax, 0xfffffefb
cmp eax, 0xfffffefc
jae 0x5bada6
xor ebx, ebx
jmp 0x5babf1
push 0xc
call fcn.00564055
add esp, 4
mov esi, eax
lea edi, [ebp - 0x218]
push 0x208
push 0xff
push edi
call fcn.00568ad0
add esp, 0xc
push 0x104
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
dec eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov ecx, esi
push edi
call fcn.00556510
movsx eax, byte [esi + 0xb]
mov ecx, esi
test eax, eax
jns 0x5bad62
mov eax, dword [esi + 4]
mov ecx, dword [esi]
test eax, eax
jne 0x5bad7f
mov ecx, esi
push 9
push str.debug.log
call fcn.0053bb20
mov dword [0x64c798], esi
jmp 0x5bac16
add eax, eax
test eax, eax
je 0x5bad66
lea edx, [eax - 2]
cmp word [ecx + eax - 2], 0x5c
mov eax, edx
jne 0x5bad81
cmp edx, 0xfffffffe
je 0x5bad66
sar edx, 1
inc edx
mov ecx, esi
push 0xffffffffffffffff
push edx
call fcn.0050b170
jmp 0x5bad66
mov ecx, dword [0x64c798]
push esi
call fcn.00424f70
mov ecx, dword [0x64c798]
call fcn.005b1f70
cmp word [eax], 0x5c
je 0x5badd5
mov ecx, dword [0x64c798]
push 1
push 0x625b46
call fcn.0053bb20
mov ecx, dword [0x64c798]
push 9
push str.debug.log
call fcn.0053bb20
mov eax, dword [0x64c798]
cmp byte [eax + 0xb], 0
jns 0x5badf4
mov eax, dword [eax]
movaps xmm0, xmmword [0x630e20]
sub esp, 0x1c
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x64c794], eax
inc eax
cmp eax, 1
ja 0x5babf1
mov dword [0x64c794], 0
jmp 0x5bad06
Function at 0x5d3c60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov eax, dword [0x646040]
xor eax, ebp
mov dword [esp + 0x78], eax
lea esi, [esp + 0x1c]
mov dword [esi], 0xffffffff
mov edx, esi
call fcn.0044a720
mov ebx, dword [esi]
mov edi, 3
mov esi, dword [ebp + 8]
test ebx, ebx
jne 0x5d3ccd
lea ecx, [esp + 0x1c]
call fcn.00449ef0
test esi, esi
je 0x5d3cb6
mov ecx, esi
call fcn.005e4760
push esi
call fcn.00564050
add esp, 4
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.00567335
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
lea edi, [ebp + 8]
mov al, byte [esi + 0x1c]
mov byte [esp + 0xc], al
xor eax, eax
push eax
call fcn.0057a03b
add esp, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], edx
mov esi, dword [edi]
lea eax, [esi + 0xc]
mov dword [esp + 0x10], eax
lea edi, [esp + 0x20]
mov ecx, edi
call fcn.005e4670
movups xmm0, xmmword [esi + 0x38]
movaps xmmword [edi], xmm0
lea edi, [esp + 0x30]
mov ecx, edi
push dword [esp + 0x10]
call fcn.00545db0
mov eax, dword [esp + 0x14]
mov dword [edi + 0x1c], eax
mov eax, dword [esp + 0x18]
mov dword [edi + 0x18], eax
xor eax, eax
mov dword [edi + 0x40], eax
mov al, byte [esp + 0xc]
mov byte [edi + 0x35], al
lea ecx, [ebx + 0x28]
lea edx, [esp + 0x20]
call fcn.005d53d0
mov byte [ebx + 0x24], 1
cmp byte [edi + 0x17], 0
jns 0x5d3d50
push dword [esp + 0x3c]
call fcn.00564050
add esp, 4
cmp byte [esp + 0x3b], 0
jns 0x5d3d63
push dword [esp + 0x30]
call fcn.00564050
add esp, 4
lea ecx, [esi + 8]
lea eax, [esp + 0x20]
push eax
call fcn.005d3e20
cmp byte [esp + 0x2b], 0
jns 0x5d3d83
push dword [esp + 0x20]
call fcn.00564050
add esp, 4
mov edi, dword [esi + 0x20]
mov ebx, dword [esi + 0x24]
jmp 0x5d3d95
mov ecx, dword [edi]
call fcn.005e5c20
add edi, 4
cmp edi, ebx
jne 0x5d3d8b
lea eax, [esi + 0x38]
mov dword [esp + 0xc], eax
mov ebx, dword [esi + 0x2c]
mov edi, dword [esi + 0x30]
jmp 0x5d3dca
mov ecx, ebx
lea eax, [esp + 0x20]
push eax
call fcn.005d3e20
cmp byte [esp + 0x2b], 0
jns 0x5d3dc7
push dword [esp + 0x20]
call fcn.00564050
add esp, 4
add ebx, 0x14
cmp ebx, edi
jne 0x5d3da8
mov eax, dword [esp + 0xc]
movups xmm0, xmmword [eax]
mov eax, dword [ebp + 0xc]
movups xmmword [eax], xmm0
xor edi, edi
push edi
call fcn.005d9430
add esp, 4
mov eax, dword [esi]
mov ecx, dword [eax + 4]
mov ecx, dword [ecx + 4]
lea ebx, [eax + ecx]
add ebx, 4
mov eax, dword [ebx]
mov ecx, dword [eax]
mov dword [esp + 0xc], ecx
call dword [0x6401dc]
mov ecx, ebx
push 2
push edi
push edi
call dword [esp + 0x18]
push edx
push eax
call fcn.005d9490
add esp, 8
jmp 0x5d3c99
Function at 0x5d3f60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x646040]
xor eax, ebp
mov dword [ebp - 0x10], eax
movups xmm0, xmmword [edx]
movups xmmword [ebp - 0x20], xmm0
mov esi, dword [ecx + 0x28]
mov ebx, dword [ecx + 0x2c]
cmp esi, ebx
je 0x5d3fa3
mov dword [ebp - 0x24], ecx
lea edi, [ebp - 0x20]
mov ecx, esi
push edi
call fcn.005e6970
test al, al
jne 0x5d3f9d
add esi, 0x58
cmp esi, ebx
jne 0x5d3f8a
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax + 0x2c]
cmp esi, ebx
je 0x5d3fda
cmp byte [esi + 0x1b], 0
js 0x5d3fb2
lea eax, [esi + 0x10]
jmp 0x5d3fb5
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
xor edi, edi
inc edi
cmp eax, 0xffffffff
cmovne edi, ecx
test edi, edi
jne 0x5d3fdd
mov eax, dword [ebp + 8]
mov dword [eax], esi
xor edi, edi
jmp 0x5d3fdd
xor edi, edi
inc edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00567335
mov eax, edi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x5d4120
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x646040]
xor eax, ebp
mov dword [ebp - 0x10], eax
movups xmm0, xmmword [edx]
movups xmmword [ebp - 0x20], xmm0
mov edi, dword [ecx + 0x28]
mov esi, dword [ecx + 0x2c]
cmp edi, esi
je 0x5d4163
mov dword [ebp - 0x24], ecx
lea ebx, [ebp - 0x20]
mov ecx, edi
push ebx
call fcn.005e6970
test al, al
jne 0x5d415d
add edi, 0x58
cmp edi, esi
jne 0x5d414a
mov ecx, dword [ebp - 0x24]
mov esi, dword [ecx + 0x2c]
xor ebx, ebx
inc ebx
cmp edi, esi
je 0x5d41b3
mov eax, dword [edi + 0x50]
cmp eax, dword [ebp + 8]
jne 0x5d41a7
cmp byte [edi + 0x1b], 0
js 0x5d417f
mov esi, ecx
lea eax, [edi + 0x10]
jmp 0x5d4184
mov esi, ecx
mov eax, dword [edi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x5d41b3
shr eax, 3
and eax, 2
mov ebx, eax
jne 0x5d41b3
mov eax, dword [ebp + 0xc]
mov byte [esi + 0x24], 1
mov dword [eax], edi
xor ebx, ebx
jmp 0x5d41b3
xor ecx, ecx
cmp eax, 1
sete cl
lea ebx, [ecx + ecx*2]
inc ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00567335
mov eax, ebx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5e2470
Capabilities:
Terminate process

Disassembly:
cmp dword [ecx + 8], 0
mov eax, dword [ecx]
je 0x5e2486
push ebp
mov ebp, esp
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop ebp
ret
test eax, eax
jne 0x5e2478
cmp dword [ecx + 0xc], 0
jne 0x5e2478
cmp dword [ecx + 4], 0
jne 0x5e2478
jmp 0x5e2485
Function at 0x5e61c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xa4
mov edi, dword [ebp + 8]
mov eax, dword [0x646040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x5e61e3
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x5e6207
mov ebx, eax
mov al, byte [ebp + 0xc]
mov ecx, ebx
shr ecx, 0xa
xor al, 1
test cl, al
jne 0x5e625b
and ebx, 0x10
shr ebx, 4
jmp 0x5e625d
push 2
call fcn.00561770
add esp, 4
test al, al
je 0x5e625b
call fcn.004f17a0
lea esi, [ebp - 0xb0]
mov ecx, esi
push eax
push 2
push 0x80
push str.filesystem_win.cc
call fcn.005bb140
lea eax, [ebp - 0xa8]
push 0x12
push str.GetFileAttributes
push eax
call fcn.0052f110
add esp, 0xc
push edi
push eax
call fcn.005bc200
add esp, 8
mov ecx, esi
call fcn.005bb1a0
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00567335
mov eax, ebx
add esp, 0xa4
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x5e6280
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xa4
mov edi, dword [ebp + 8]
mov eax, dword [0x646040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x5e62a3
mov eax, dword [edi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
jne 0x5e6318
cmp byte [ebp + 0x10], 0
je 0x5e62c5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x5e632f
push 2
call fcn.00561770
add esp, 4
test al, al
je 0x5e6316
call fcn.004f17a0
lea esi, [ebp - 0xb0]
mov ecx, esi
push eax
push 2
push 0x61
push str.filesystem_win.cc
call fcn.005bb140
lea eax, [ebp - 0xa8]
push 0x10
push str.CreateDirectory
push eax
call fcn.0052f110
add esp, 0xc
push edi
push eax
call fcn.005bc200
add esp, 8
mov ecx, esi
call fcn.005bb1a0
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00567335
mov eax, ebx
add esp, 0xa4
pop esi
pop edi
pop ebx
pop ebp
ret
push 1
push edi
call fcn.005e61c0
add esp, 8
test al, al
jne 0x5e6318
push 2
call fcn.00561770
add esp, 4
test al, al
je 0x5e6316
lea esi, [ebp - 0xb0]
mov ecx, esi
push 2
push 0x5c
push str.filesystem_win.cc
call fcn.004096e0
lea eax, [ebp - 0xa8]
push edi
push eax
call fcn.005bc200
add esp, 8
push 0x10
push str._not_a_directory
push eax
call fcn.0052f110
add esp, 0xc
mov ecx, esi
call fcn.00407fc0
jmp 0x5e6316
Function at 0x5e6390
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xa4
mov edi, dword [ebp + 8]
mov eax, dword [0x646040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x5e63b3
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x5e63de
test eax, 0x410
sete bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00567335
mov eax, ebx
add esp, 0xa4
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.00561770
add esp, 4
test al, al
je 0x5e642f
call fcn.004f17a0
lea esi, [ebp - 0xb0]
mov ecx, esi
push eax
push 2
push 0x73
push str.filesystem_win.cc
call fcn.005bb140
lea eax, [ebp - 0xa8]
push 0x12
push str.GetFileAttributes
push eax
call fcn.0052f110
add esp, 0xc
push edi
push eax
call fcn.005bc200
add esp, 8
mov ecx, esi
call fcn.005bb1a0
xor ebx, ebx
jmp 0x5e63c7

Function at 0x5e6440
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xa4
mov esi, dword [ebp + 8]
mov eax, dword [0x646040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x5e6463
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
sete cl
not eax
test eax, 0x410
setne al
or al, cl
je 0x5e6506
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x5e648c
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov bl, 1
test eax, eax
jne 0x5e64ef
push 2
call fcn.00561770
add esp, 4
test al, al
je 0x5e64ed
call fcn.004f17a0
lea edi, [ebp - 0xb0]
mov ecx, edi
push eax
push 2
push 0x93
push str.filesystem_win.cc
call fcn.005bb140
lea eax, [ebp - 0xa8]
push 0xb
push str.DeleteFile
push eax
call fcn.0052f110
add esp, 0xc
push esi
push eax
call fcn.005bc200
add esp, 8
mov ecx, edi
call fcn.005bb1a0
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00567335
mov eax, ebx
add esp, 0xa4
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00567335
mov ecx, esi
add esp, 0xa4
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.005e6530

Function at 0x5e6530
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xa4
mov esi, ecx
mov eax, dword [0x646040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x5e6552
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov edi, eax
test eax, eax
je 0x5e657b
test edi, edi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00567335
mov eax, ebx
add esp, 0xa4
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.00561770
add esp, 4
test al, al
je 0x5e655f
call fcn.004f17a0
lea ebx, [ebp - 0xb0]
mov ecx, ebx
push eax
push 2
push 0x2f
push str.filesystem_win.cc
call fcn.005bb140
lea eax, [ebp - 0xa8]
push 0x10
push str.RemoveDirectory
push eax
call fcn.0052f110
add esp, 0xc
push esi
push eax
call fcn.005bc200
add esp, 8
mov ecx, ebx
call fcn.005bb1a0
jmp 0x5e655f
Function at 0x5ecef0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xa8
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [0x646040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ecx + 8], edi
mov eax, dword [0x65a734]
mov ecx, dword [0x64984c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x5ed14e
mov ecx, dword [0x65a730]
test ecx, ecx
je 0x5ed006
lea ebx, [ebp - 0x14]
mov dword [ebx], 0xffffffff
call dword [0x6401dc]
push ebx
push edi
call ecx
test eax, eax
je 0x5ecfbf
cmp dword [ebp - 0x14], 0
setne byte [esi + 0x5d]
je 0x5ed00a
mov byte [esi + 0x5c], 0
lea eax, [esi + 0x30]
lea ebx, [esi + 0x28]
mov ecx, edi
mov edx, esi
push eax
push ebx
call fcn.005ed1a0
add esp, 8
test al, al
jne 0x5ed098
push 2
call fcn.00561770
add esp, 4
test al, al
je 0x5ed07d
lea esi, [ebp - 0xb4]
mov ecx, esi
push 2
push 0x244
push str.process_info.cc
call fcn.004096e0
lea eax, [ebp - 0xac]
push 0x21
push str.GetProcessBasicInformation_failed
jmp 0x5ed06d
push 2
call fcn.00561770
add esp, 4
test al, al
je 0x5ed006
call fcn.004f17a0
lea ebx, [ebp - 0xb4]
mov ecx, ebx
push eax
push 2
push 0x4e
push str.process_info.cc
call fcn.005bb140
lea eax, [ebp - 0xac]
push 0xe
push 0x635b2c
push eax
call fcn.0052f110
add esp, 0xc
mov ecx, ebx
call fcn.005bb1a0
mov byte [esi + 0x5d], 0
pcmpeqd xmm0, xmm0
lea ebx, [ebp - 0xb4]
movdqu xmmword [ebx + 0x10], xmm0
movdqu xmmword [ebx], xmm0
mov dword [ebx + 0x20], 0xffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebx], 9
sete byte [esi + 0x5c]
jne 0x5ecf66
push 2
call fcn.00561770
add esp, 4
test al, al
je 0x5ed07d
lea esi, [ebp - 0xb4]
mov ecx, esi
push 2
push 0x236
push str.process_info.cc
call fcn.004096e0
lea eax, [ebp - 0xac]
push 0x32
push str.Reading_x64_process_from_x86_process_not_supported
push eax
call fcn.0052f110
add esp, 0xc
mov ecx, esi
call fcn.00407fc0
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00567335
mov eax, ebx
add esp, 0xa8
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov edx, dword [esi + 0x28]
mov eax, dword [esi + 0x2c]
cmp byte [esi + 0x5c], 1
je 0x5ed0af
mov ecx, edi
push esi
push eax
call fcn.005ed8d0
jmp 0x5ed0b8
mov ecx, edi
push esi
push eax
call fcn.005ed2c0
add esp, 8
test al, al
jne 0x5ed0f8
push 2
call fcn.00561770
add esp, 4
test al, al
je 0x5ed07d
lea esi, [ebp - 0xb4]
mov ecx, esi
push 2
push 0x24d
push str.process_info.cc
call fcn.004096e0
lea eax, [ebp - 0xac]
push 0x16
push str.ReadProcessData_failed
jmp 0x5ed06d
movzx edx, byte [esi + 0x5c]
mov ecx, edi
push esi
call fcn.005ec530
add esp, 4
mov bl, 1
test al, al
jne 0x5ed07f
push 2
call fcn.00561770
add esp, 4
test al, al
je 0x5ed07d
lea esi, [ebp - 0xb4]
mov ecx, esi
push 2
push 0x252
push str.process_info.cc
call fcn.004096e0
lea eax, [ebp - 0xac]
push 0x15
push str.ReadMemoryInfo_failed
jmp 0x5ed06d
push 0x65a734
call fcn.00565714
add esp, 4
cmp dword [0x65a734], 0xffffffff
jne 0x5ecf2f
push 0
push str.::IsWow64Process
push 0x62539e
call fcn.004f3d00
add esp, 0xc
mov dword [0x65a730], eax
push 0x65a734
call fcn.00565763
add esp, 4
jmp 0x5ecf2f
Function at 0x5f74a0
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.005e6440
Function at 0x5fa4c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x646040]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
lea esi, [ebp - 0x14]
mov dword [esi], eax
lea edi, [ebp - 0x18]
mov dword [edi], eax
lea eax, [ebp - 0x1c]
mov dword [eax], 4
push eax
push edi
push esi
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esi]
xor ecx, 4
or ecx, eax
sete bl
jne 0x5fa50a
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00567335
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x5fa5b0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0xc4
mov eax, dword [0x646040]
xor eax, ebp
mov dword [ebp - 0xc], eax
pcmpeqd xmm0, xmm0
lea esi, [ebp - 0x30]
movdqu xmmword [esi + 0x10], xmm0
movdqu xmmword [esi], xmm0
mov dword [esi + 0x20], 0xffffffff
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [esi + 0x14], 0x100
jb 0x5fa630
push 1
call fcn.00561770
add esp, 4
test al, al
je 0x5fa630
lea esi, [ebp - 0xcc]
mov ecx, esi
push 1
push 0x10a
push str.system_snapshot_win.cc
call fcn.004096e0
lea eax, [ebp - 0xc4]
push 0x2c
push str.dwNumberOfProcessors_exceeds_uint8_t_storage
push eax
call fcn.0052f110
add esp, 0xc
mov ecx, esi
call fcn.00407fc0
mov eax, dword [ebp - 0x1c]
cmp eax, 0x100
mov ebx, 0xff
cmovb ebx, eax
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00567335
mov eax, ebx
add esp, 0xc4
pop esi
pop ebx
pop ebp
ret