joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d3630
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov dl, 1
mov eax, dword [0x4d2478]
call fcn.004d2754
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4d373e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [esi + 0x1c]
push eax
call sub.kernel32.dll_InterlockedIncrement_1
mov dword [ebx], eax
call fcn.004d32e0
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov eax, dword [ebx + 4]
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
add eax, 0x10
mov edx, dword [ebx + 0x28]
call fcn.00404b34
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
mov dword [edx + 0x2c], eax
mov eax, dword [ebx]
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
mov eax, dword [ebx + 8]
mov edx, dword [ebp - 4]
mov dword [edx + 0x30], eax
mov eax, dword [ebp - 4]
add eax, 0x34
mov edx, dword [ebx + 0xc]
call fcn.00404b34
mov eax, dword [ebx + 0x10]
mov edx, dword [ebp - 4]
mov dword [edx + 0x38], eax
mov eax, dword [ebp - 4]
add eax, 0x3c
mov edx, dword [ebx + 0x14]
call fcn.00404b34
mov eax, dword [ebx + 0x18]
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 4]
add eax, 0x44
mov edx, dword [ebx + 0x1c]
call fcn.00404b34
mov eax, dword [ebx + 0x20]
mov edx, dword [ebp - 4]
mov dword [edx + 0x48], eax
mov eax, dword [ebp - 4]
add eax, 0x4c
mov edx, dword [ebx + 0x24]
call fcn.00404b34
mov eax, dword [ebp - 4]
add eax, 0x50
mov edx, dword [ebx + 0x2c]
call fcn.00404b34
mov eax, dword [ebp - 4]
add eax, 0x54
mov edx, dword [ebx + 0x30]
mov ecx, dword [0x4d2440]
call fcn.00405cb0
mov eax, dword [ebp - 4]
add eax, 0x58
mov edx, dword [ebx + 0x40]
mov ecx, dword [0x406b6c]
call fcn.00405cb0
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.004d3830
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d3755
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4f61e4
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov eax, esi
mov edx, dword [0x4e67c4]
call fcn.0040374c
test al, al
je 0x4f6308
mov dl, byte [ebx + 4]
mov edi, esi
mov eax, edi
call fcn.004f6318
mov dl, byte [ebx + 5]
mov eax, edi
call fcn.004f6400
mov al, byte [ebx + 6]
mov byte [edi + 6], al
mov dl, byte [ebx + 7]
mov eax, edi
call fcn.004f6438
mov al, byte [ebx + 8]
mov byte [edi + 8], al
mov dl, byte [ebx + 9]
mov eax, edi
call fcn.004f651c
mov al, byte [ebx + 0xa]
mov byte [edi + 0xa], al
mov dl, byte [ebx + 0xb]
mov eax, edi
call fcn.004f6448
mov dl, byte [ebx + 0xe]
mov eax, edi
call fcn.004f6494
mov dl, byte [ebx + 0x10]
mov eax, edi
call fcn.004f6538
mov al, byte [ebx + 0xf]
mov byte [edi + 0xf], al
mov dl, byte [ebx + 0x11]
mov eax, edi
call fcn.004f6630
mov eax, ebx
call fcn.004f65b4
mov edx, eax
mov eax, edi
call fcn.004f65c0
mov dl, byte [ebx + 0x12]
mov eax, edi
call fcn.004f66ac
mov dl, byte [ebx + 0x14]
mov eax, edi
call fcn.004f65cc
mov eax, ebx
call fcn.004f65fc
mov edx, eax
mov eax, edi
call fcn.004f6608
mov dl, byte [ebx + 0x15]
mov eax, edi
call fcn.004f6738
mov dl, byte [ebx + 0x16]
mov eax, edi
call fcn.004f67b8
mov eax, dword [ebx + 0x18]
mov dword [edi + 0x18], eax
mov al, byte [ebx + 0x1c]
mov byte [edi + 0x1c], al
mov dl, byte [ebx + 0x13]
mov eax, edi
call fcn.004f638c
mov dl, byte [ebx + 0xc]
mov eax, edi
call fcn.004f6460
mov dl, byte [ebx + 0xd]
mov eax, edi
call fcn.004f6478
mov al, byte [ebx + 0x1d]
mov byte [edi + 0x1d], al
mov dl, byte [ebx + 0x17]
mov eax, edi
call fcn.004f6838
mov dl, byte [ebx + 0x1e]
mov eax, edi
call fcn.004f68b8
mov dl, byte [ebx + 0x1f]
mov eax, edi
call fcn.004f6934
mov al, byte [ebx + 0x20]
mov byte [edi + 0x20], al
jmp 0x4f6311
mov edx, esi
mov eax, ebx
call fcn.0041f080
pop edi
pop esi
pop ebx
ret
Function at 0x4fd764
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0xb
push 0
push 0
dec ecx
jne 0x4fd76d
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4fd951
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebx + 0x34]
mov eax, esi
call fcn.004e1ad8
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x3c]
mov cx, word [ebx + 0x44]
pop edx
call dword [eax + 4]
mov edx, eax
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov dx, word [ebx + 0x44]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x10]
mov eax, ebx
call fcn.004ee20c
mov edx, eax
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push dword [ebx + 0x54]
push dword [ebx + 0x50]
mov eax, esi
call fcn.004e1d40
mov eax, ebx
call fcn.00478ef4
mov edx, eax
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov dl, byte [ebx + 0x39]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x38]
mov edi, eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x30]
sub al, 1
je 0x4fd82f
add al, 0xf5
sub al, 2
jb 0x4fd82f
add al, 0xf7
sub al, 2
jb 0x4fd82f
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x30]
and eax, 0x7f
cmp eax, 0x34
jne 0x4fd917
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x38]
test eax, eax
jne 0x4fd917
mov eax, ebx
call fcn.00478ef4
cmp al, 1
je 0x4fd867
mov eax, ebx
call fcn.00478ef4
test al, al
jne 0x4fd8e5
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x90]
test al, al
jne 0x4fd8e5
lea edx, [ebp - 0x28]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x90]
lea eax, [ebp - 0x28]
call fcn.00417dfc
sub ax, 0x2011
jne 0x4fd8a1
lea edx, [ebp - 0x38]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x90]
lea eax, [ebp - 0x38]
mov edx, 1
call fcn.004182ec
mov edi, eax
inc edi
jmp 0x4fd8e5
lea edx, [ebp - 0x48]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x90]
lea eax, [ebp - 0x48]
call fcn.00417f08
test al, al
je 0x4fd8e5
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x90]
lea eax, [ebp - 0x5c]
lea edx, [ebp - 0x4c]
call fcn.00417f44
mov eax, dword [ebp - 0x4c]
call fcn.004046ac
mov edi, eax
test edi, edi
jne 0x4fd8e5
mov edi, 1
test edi, edi
jne 0x4fd917
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x40]
mov eax, dword [eax + 0xc0]
push eax
lea eax, [ebp - 0x18]
call fcn.004115a8
mov ecx, eax
mov edx, 0x28
pop eax
mov ebx, dword [eax]
call dword [ebx + 0x70]
lea eax, [ebp - 0x18]
call fcn.004121c4
mov edi, eax
mov edx, edi
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x18]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fd958
lea eax, [ebp - 0x5c]
call fcn.004115a8
lea eax, [ebp - 0x4c]
call fcn.004043dc
lea eax, [ebp - 0x48]
mov edx, dword [0x40111c]
mov ecx, 4
call fcn.00405078
ret
Function at 0x4ff4c0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x4ff4c8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4ff6be
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x24]
mov dl, byte [0x59ba44]
call fcn.004045c4
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call fcn.004049f0
test eax, eax
je 0x4ff6a3
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov dl, 1
call dword [eax + 0x28]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x1c]
mov dl, byte [0x59ba44]
call fcn.004045c4
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x18], 0
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x1b], 0
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x40], 1
xor eax, eax
push ebp
push 0x4ff691
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x20]
call fcn.004043dc
lea eax, [ebp - 0x14]
call fcn.004043dc
mov bl, 1
xor esi, esi
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x30]
test bl, bl
je 0x4ff581
lea eax, [ebp - 0x14]
call fcn.004043dc
mov edx, eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov esi, eax
test esi, esi
je 0x4ff67b
mov bl, 1
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x1c]
call fcn.004047f8
jne 0x4ff66b
mov edx, esi
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x38]
test al, al
je 0x4ff66b
lea eax, [ebp - 0x14]
call fcn.004043dc
mov edx, eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov esi, eax
cmp esi, 0xffffff99
je 0x4ff5dd
cmp esi, 0xffffff97
jne 0x4ff5d8
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call dword [eax + 0x3c]
test al, al
jne 0x4ff5dd
cmp esi, 0x64
jl 0x4ff650
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x14]
call fcn.00404474
cmp esi, 0xffffff97
jne 0x4ff61a
lea eax, [ebp - 0x14]
call fcn.004043dc
mov edx, eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov esi, eax
cmp esi, 0xffffff99
je 0x4ff60b
cmp esi, 0x64
jl 0x4ff618
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x14]
call fcn.004046b4
jmp 0x4ff61a
xor ebx, ebx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.004ffa78
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4ff569
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0x28]
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x20]
call fcn.004046b4
jmp 0x4ff569
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push dword [ebp - 0x14]
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.0040476c
jmp 0x4ff569
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x14]
call fcn.004046b4
jmp 0x4ff569
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ff698
mov eax, dword [ebp - 0xc]
call fcn.004035c0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ff6c5
lea eax, [ebp - 0x28]
mov edx, 6
call fcn.00404400
ret
Function at 0x50e7d8
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x14], 0x67452301
mov dword [eax + 0x18], 0xefcdab89
mov dword [eax + 0x1c], 0x98badcfe
mov dword [eax + 0x20], 0x10325476
call fcn.0050de14
pop ebp
ret
Function at 0x50fb9c
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x14], 0x67452301
mov dword [eax + 0x18], 0xefcdab89
mov dword [eax + 0x1c], 0x98badcfe
mov dword [eax + 0x20], 0x10325476
mov dword [eax + 0x24], 0xc3d2e1f0
call fcn.0050e970
pop ebp
ret

Function at 0x50fde8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00405cd8
mov eax, dword [ebp - 8]
call fcn.00405cd8
xor eax, eax
push ebp
push 0x50fe9f
push dword fs:[eax]
mov dword fs:[eax], esp
push 8
mov eax, ebx
mov ecx, 1
mov edx, dword [0x47e9c0]
call fcn.00405b54
add esp, 4
mov eax, dword [ebp - 8]
call fcn.00405998
mov edx, eax
dec edx
test edx, edx
jl 0x50fe55
inc edx
xor eax, eax
mov ecx, dword [ebp - 4]
mov cl, byte [ecx + eax]
mov esi, dword [ebp - 8]
xor cl, byte [esi + eax]
mov esi, dword [ebx]
mov byte [esi + eax], cl
inc eax
dec edx
jne 0x50fe40
mov eax, dword [ebp - 8]
call fcn.00405998
push eax
mov eax, dword [ebp - 4]
call fcn.00405998
mov edx, eax
dec edx
pop eax
sub edx, eax
jl 0x50fe7e
inc edx
mov ecx, dword [ebp - 4]
mov cl, byte [ecx + eax]
mov esi, dword [ebx]
mov byte [esi + eax], cl
inc eax
dec edx
jne 0x50fe6f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50fea6
lea eax, [ebp - 8]
mov edx, dword [0x47e9c0]
mov ecx, 2
call fcn.00405078
ret
Function at 0x514170
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, dword [ebp + 0xc]
mov eax, edi
call fcn.0051ad0c
mov ecx, eax
mov dl, 1
mov eax, dword [0x50cd68]
call fcn.0051cc08
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x5142d8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x18], edi
mov eax, dword [ebp - 0xc]
add eax, 0x30
mov edx, 0x5142f4
call fcn.00404430
mov eax, dword [ebp - 0xc]
mov word [eax + 0x38], 9
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x50c97c]
call fcn.00518d84
mov ebx, eax
lea eax, [ebx + 0x14]
mov edx, 0x51433c
call fcn.00404430
mov word [ebx + 0x18], 0x6c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
mov dword [ebx + 0x64], eax
mov eax, dword [ebp - 4]
call fcn.00518e00
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
mov eax, dword [ebp - 4]
call fcn.005250a8
mov dword [ebx + 0x30], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x28]
mov edx, ebx
call fcn.0041e7a0
mov word [ebp - 0x12], 0xffff
push 0x70
push 0
mov eax, edi
call fcn.0051ad0c
mov ecx, eax
mov dl, 1
mov eax, dword [0x50d1bc]
call fcn.005222b0
mov dword [esi], eax
mov eax, dword [esi]
call fcn.00518e00
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x50c97c]
call fcn.00518d84
mov ebx, eax
lea eax, [ebx + 0x14]
mov edx, 0x514348
call fcn.00404430
mov word [ebx + 0x18], 0x70
lea eax, [ebp - 0x10]
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
lea eax, [ebp - 0x12]
mov dword [ebx + 0x30], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x28]
mov edx, ebx
call fcn.0041e7a0
push 0
mov ecx, 1
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
call fcn.00520f60
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5142b1
cmp word [ebp - 0x12], 0xffff
jne 0x5142b1
mov dword [ebp - 8], 0x64
cmp dword [ebp - 8], 0
je 0x5142c2
mov eax, dword [esi]
call fcn.00518f5c
xor eax, eax
mov dword [esi], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5142df
mov eax, dword [ebp - 0xc]
call fcn.004035c0
ret
Function at 0x5156b4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebp - 4]
call fcn.00405cd8
mov eax, dword [ebp + 0x10]
call fcn.00405cd8
xor eax, eax
push ebp
push 0x5158d2
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x50dabc]
call fcn.0050ddd4
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x51588e
push dword fs:[edx]
mov dword fs:[edx], esp
cmp edi, 0x939
jne 0x515767
push 0x10
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, dword [0x47e9c0]
call fcn.00405b54
add esp, 4
xor eax, eax
lea edx, [ebx + eax]
mov ecx, dword [ebp - 4]
mov dl, byte [ecx + edx]
lea ecx, [esi + eax]
mov edi, dword [ebp + 0x10]
xor dl, byte [edi + ecx]
mov ecx, dword [ebp - 0xc]
mov byte [ecx + eax], dl
inc eax
cmp eax, 0x10
jne 0x51572e
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.0050e80c
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
call fcn.0050e8a0
jmp 0x515878
cmp edi, 0x1b25
jne 0x51586a
push 0x18
mov eax, dword [ebp + 8]
mov ecx, 1
mov edx, dword [0x47e9c0]
call fcn.00405b54
add esp, 4
push 0x18
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, dword [0x47e9c0]
call fcn.00405b54
add esp, 4
push 0
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, dword [0x47e9c0]
call fcn.00405b54
add esp, 4
xor eax, eax
lea edx, [ebx + eax]
mov ecx, dword [ebp - 4]
mov dl, byte [ecx + edx]
lea ecx, [esi + eax]
mov edi, dword [ebp + 0x10]
xor dl, byte [edi + ecx]
mov ecx, dword [ebp - 0xc]
mov byte [ecx + eax], dl
inc eax
cmp eax, 0x18
jne 0x5157bd
push 0x10
lea eax, [ebp - 0x14]
push eax
xor ecx, ecx
mov edx, dword [0x47e9c0]
mov eax, dword [ebp - 0xc]
call fcn.00405b80
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.0050e80c
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.0050e8a0
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
push 0
push 0x10
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [0x480168]
call fcn.00481b90
push 8
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x10
mov edx, dword [0x47e9c0]
mov eax, dword [ebp - 0xc]
call fcn.00405b80
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
call fcn.0050e80c
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.0050e8a0
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
push 0x10
push 8
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [0x480168]
call fcn.00481b90
jmp 0x515878
mov eax, dword [ebp + 8]
mov edx, dword [0x47e9c0]
call fcn.00405c74
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x515895
mov eax, dword [ebp - 8]
call fcn.004035c0
ret
Function at 0x515db8
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x118], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x110], ecx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x10c], ecx
mov dword [ebp - 0x108], ecx
test dl, dl
je 0x515e01
add esp, 0xfffffff0
call fcn.0040390c
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x515f82
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, esi
call fcn.00403590
lea edx, [ebp - 0x108]
mov eax, esi
call fcn.00515fdc
mov edx, dword [ebp - 0x108]
lea eax, [esi + 4]
call fcn.00404430
lea edx, [ebp - 0x10c]
mov eax, esi
call fcn.00516024
mov edx, dword [ebp - 0x10c]
lea eax, [esi + 8]
call fcn.00404430
mov dword [ebp - 4], pe_nt_image_headers32
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x104]
push eax
call sub.advapi32.dll_GetUserNameA
lea eax, [esi + 0xc]
lea edx, [ebp - 0x104]
mov ecx, pe_nt_image_headers32
call fcn.0040465c
call sub.kernel32.dll_GetCurrentProcessId
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x110]
call fcn.004093d8
push dword [ebp - 0x110]
push 0x515fb0
call sub.kernel32.dll_GetCurrentThreadId_1
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x114]
call fcn.004093d8
push dword [ebp - 0x114]
lea eax, [esi + 0x10]
mov edx, 3
call fcn.0040476c
push pe_nt_image_headers32
lea eax, [ebp - 0x104]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x11c]
lea edx, [ebp - 0x104]
mov ecx, pe_nt_image_headers32
call fcn.0040465c
mov eax, dword [ebp - 0x11c]
lea edx, [ebp - 0x118]
call fcn.00409c18
mov edx, dword [ebp - 0x118]
lea eax, [esi + 0x14]
call fcn.00404430
mov al, byte [0x515fb4]
push eax
lea eax, [ebp - 0x120]
push eax
mov eax, dword [esi + 0x14]
mov ecx, 0x515fc0
mov edx, 0x515fcc
call fcn.0040ef30
mov edx, dword [ebp - 0x120]
lea eax, [esi + 0x14]
call fcn.00404430
mov al, byte [0x515fb4]
push eax
lea eax, [ebp - 0x124]
push eax
mov eax, dword [esi + 0x14]
mov ecx, 0x515fc0
mov edx, 0x515fd8
call fcn.0040ef30
mov edx, dword [ebp - 0x124]
lea eax, [esi + 0x14]
call fcn.00404430
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x515f89
lea eax, [ebp - 0x124]
mov edx, 8
call fcn.00404400
ret

Function at 0x515fdc
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov eax, ebx
call fcn.004043dc
mov dword [ebp - 4], pe_nt_image_headers32
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x51601c
mov eax, ebx
lea edx, [ebp - 0x104]
mov ecx, pe_nt_image_headers32
call fcn.0040465c
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x524714
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
test dl, dl
je 0x524726
add esp, 0xfffffff0
call fcn.0040390c
mov esi, ecx
mov ebx, edx
mov edi, eax
mov eax, dword [ebp + 0x10]
call fcn.00405cd8
xor eax, eax
push ebp
push 0x5247c9
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, edi
call fcn.00403590
mov dword [edi + 4], esi
mov eax, dword [ebp + 0x18]
mov dword [edi + 8], eax
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x24], eax
lea eax, [edi + 0x28]
mov edx, dword [ebp + 0x10]
mov ecx, dword [0x47e9c0]
call fcn.00405cb0
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x30], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x14]
mov edx, dword [0x47e9c0]
call fcn.00405c74
xor eax, eax
mov dword [edi + 0x10], eax
xor eax, eax
mov dword [edi + 0x34], eax
xor eax, eax
mov dword [edi + 0x18], eax
mov byte [edi + 0xd], 0
mov byte [edi + 0xc], 0
mov word [edi + 0xe], 0
xor eax, eax
mov dword [edi + 0x20], eax
mov word [edi + 0x1c], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5247d0
lea eax, [ebp + 0x10]
mov edx, dword [0x47e9c0]
call fcn.00405c74
ret
Function at 0x52f8c8
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004043dc
push 0
push 0
push 0x52f91c
call sub.kernel32.dll_GetEnvironmentVariableA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x52f915
mov edx, dword [ebp - 8]
dec edx
mov eax, dword [ebp - 4]
call fcn.00404a38
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004048ac
push eax
push 0x52f91c
call sub.kernel32.dll_GetEnvironmentVariableA
pop ecx
pop ecx
pop ebp
ret

Function at 0x5346d4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
xor ebx, ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.0040489c
xor eax, eax
push ebp
push 0x534881
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.004043dc
mov eax, dword [ebp - 4]
mov word [eax + 0x38], 0
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 8]
call fcn.004048ac
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, dword [0x47e9c0]
call fcn.00405b54
add esp, 4
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 8]
call fcn.004048ac
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x534850
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x534890
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x5347ec
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov ecx, 4
call fcn.00402ac4
mov eax, dword [ebp - 0x20]
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x24]
mov eax, 8
call fcn.00409428
lea eax, [ebp - 0x28]
push eax
mov ecx, 4
mov edx, 1
mov eax, dword [ebp - 0x24]
call fcn.0040490c
mov eax, dword [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, 4
mov edx, 5
mov eax, dword [ebp - 0x24]
call fcn.0040490c
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
pop ecx
call fcn.004046f8
jmp 0x5347f9
lea eax, [ebp - 0x24]
mov edx, 0x5348b4
call fcn.00404474
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x5348c8
push dword [ebp - 0x24]
push 0x5348e4
lea eax, [ebp - 0x30]
mov edx, 3
call fcn.0040476c
mov eax, dword [ebp - 0x30]
call fcn.004048ac
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x534850
lea eax, [ebp - 0x34]
push eax
or ecx, 0xffffffff
mov edx, dword [ebp - 0x14]
mov eax, dword [0x47fd0c]
call fcn.004804b4
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0xc]
call fcn.00404430
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x534888
lea eax, [ebp - 0x34]
mov edx, 5
call fcn.00404400
lea eax, [ebp - 0x10]
mov edx, dword [0x47e9c0]
call fcn.00405c74
lea eax, [ebp - 8]
call fcn.004043dc
ret