joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418100
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x4c1b48]
xor edx, edx
cmp eax, edx
jne 0x418126
xor eax, eax
mov byte [eax + 0x4c1a48], al
inc eax
cmp eax, 0x100
jl 0x41810e
mov dword [0x4c1b48], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x4c1a48
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x4181b7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x41818a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x418158
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x418230
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x418283
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x41826a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4369f0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x466aa3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0045a4c9
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], 0x49b740
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], 0x49a7b0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [0x46809c]
push eax
mov ecx, edi
call fcn.0045fb67
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.00461083
test eax, eax
je 0x436b0c
mov ecx, dword [esp + 0x3c]
call fcn.0045fb94
mov ecx, dword [esi + 0x1c]
mov ebp, dword [0x4683b8]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x436ad0
push edi
mov ecx, esi
call fcn.0045d1fb
mov ecx, esi
call fcn.00436c70
cmp dword [esp + 0x38], 1
jne 0x436b05
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.0045d336
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28

Function at 0x439530
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x439563
push esi
call fcn.0043c640
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x43955c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x4395e9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x4395d2
mov eax, dword [esi + 8]
test eax, eax
je 0x439587
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x4395ce
cmp eax, 2
je 0x4395d2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x43957a
cmp eax, 3
je 0x4395ad
cmp eax, 1
jne 0x43957a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x43957a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x43957a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00439610
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x4395f8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00439610
add esp, 4
pop esi
ret
Function at 0x40533c
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x228]
sub esp, 0x2a8
mov eax, dword [0x56bbe0]
xor eax, ebp
mov dword [ebp + 0x224], eax
and dword [ebp - 0x7c], 0
push ebx
mov ebx, dword [ebp + 0x238]
push esi
mov esi, 0x9c
push esi
lea eax, [ebp - 0x78]
push 0
push eax
mov dword [ebp - 0x80], ecx
call fcn.004aa1b0
add esp, 0xc
lea eax, [ebp - 0x78]
mov dword [ebp - 0x78], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push eax
call esi
test eax, eax
jne 0x4053ac
push 0x94
push eax
lea eax, [ebp - 0x78]
push eax
call fcn.004aa1b0
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
mov dword [ebp - 0x78], 0x94
call esi
push ebx
mov esi, 0x200
lea eax, [ebp + 0x24]
push esi
push eax
call fcn.00404c23
mov eax, dword [ebp - 0x68]
add esp, 0xc
dec eax
je 0x405410
dec eax
jne 0x405425
cmp dword [ebp - 0x74], 4
jbe 0x4053ee
cmp dword [ebp - 0x74], 5
jne 0x4053d9
cmp dword [ebp - 0x70], eax
je 0x4053ee
push ebx
push str.Global_s
lea eax, [ebp + 0x24]
push esi
push eax
call fcn.00404c23
add esp, 0x10
jmp 0x4053fc
push ebx
lea eax, [ebp + 0x24]
push esi
push eax
call fcn.00404c23
add esp, 0xc
mov ecx, dword [ebp - 0x80]
lea eax, [ebp + 0x24]
push eax
push dword [ebp + 0x234]
call fcn.00404752
jmp 0x405422
lea eax, [ebp + 0x24]
push eax
push dword [ebp + 0x234]
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x7c], eax
mov ecx, dword [ebp + 0x224]
mov eax, dword [ebp - 0x7c]
pop esi
xor ecx, ebp
pop ebx
call fcn.004a9399
add ebp, 0x228
leave
ret 0xc
Function at 0x405853
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x56bbe0]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x54], 0
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x58]
push eax
push edi
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x48], eax
test eax, eax
je 0x40598f
push ebx
push eax
call fcn.00498aad
pop ecx
mov ebx, eax
push ebx
push dword [ebp - 0x48]
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x405987
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x54]
push eax
push 0x519990
push ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x405987
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x50]
push eax
push str.VarFileInfoTranslation
push ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x405969
mov eax, dword [ebp - 0x50]
movzx ecx, word [eax + 2]
movzx eax, word [eax]
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push ecx
push eax
lea eax, [ebp - 0x44]
push 0x51994c
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x44]
push eax
push ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x405922
push dword [ebp - 0x48]
lea eax, [esi + 0x10]
push 0x100
push eax
call fcn.00404c23
add esp, 0xc
mov eax, dword [ebp - 0x50]
movzx ecx, word [eax + 2]
movzx eax, word [eax]
push ecx
push eax
lea eax, [ebp - 0x44]
push 0x519924
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x44]
push eax
push ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x405969
push dword [ebp - 0x48]
lea eax, [esi + 0x110]
push 0x100
push eax
call fcn.00404c23
add esp, 0xc
mov eax, dword [ebp - 0x54]
movzx ecx, word [eax + 0xa]
mov dword [esi], ecx
movzx ecx, word [eax + 8]
mov dword [esi + 4], ecx
movzx ecx, word [eax + 0xe]
mov dword [esi + 8], ecx
movzx eax, word [eax + 0xc]
mov dword [esi + 0xc], eax
push ebx
call fcn.00498aa2
pop ecx
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004a9399
leave
ret 8
Function at 0x4069e6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
xor ebx, ebx
or eax, 0xffffffff
mov dword [ebp - 4], ebx
cmp dword [esi + 0x10], eax
je 0x406a93
push edi
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x14], ebx
push dword [ebp + 8]
mov dword [ebp - 0x10], ebx
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
push dword [ebp + 0x10]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x406a4f
mov dword [ebp - 4], ebx
jmp 0x406a6b
push ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x406a6b
call edi
or dword [ebp - 4], 0xffffffff
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], ebx
je 0x406a7b
push dword [ebp - 8]
call edi
cmp dword [ebp - 4], ebx
ja 0x406a8f
mov eax, dword [esi + 0x10]
cmp eax, 0xffffffff
je 0x406a8f
push eax
call edi
or dword [esi + 0x10], 0xffffffff
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x406a99
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
xor ebx, ebx
or eax, 0xffffffff
mov dword [ebp - 4], ebx
cmp dword [esi + 0x10], eax
je 0x406b56
push edi
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x14], ebx
push dword [ebp + 8]
mov dword [ebp - 0x10], ebx
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0xc], eax
call edi
cmp dword [ebp + 0xc], ebx
jne 0x406af9
cmp eax, 0x3e5
jne 0x406b2a
push dword [ebp + 0x10]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x406b11
mov dword [ebp - 4], ebx
jmp 0x406b2e
push 1
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x406b2e
call edi
or dword [ebp - 4], 0xffffffff
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], ebx
je 0x406b3e
push dword [ebp - 8]
call edi
cmp dword [ebp - 4], ebx
ja 0x406b52
mov eax, dword [esi + 0x10]
cmp eax, 0xffffffff
je 0x406b52
push eax
call edi
or dword [esi + 0x10], 0xffffffff
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x480935
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 4
mov eax, 0x51313a
call fcn.004ab43d
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push 0x48
mov ecx, edi
mov dword [esi + 4], 9
call fcn.00487dc0
mov dword [ebp + 0xc], eax
and eax, 0xffffc000
push 0x2000000
push eax
xor ebx, ebx
push ebx
mov dword [ebp + 8], eax
call fcn.00405b41
mov ecx, eax
call fcn.0040513c
mov dword [edi + 0x98], eax
cmp eax, ebx
jne 0x4809c1
push 0x14
call fcn.00498a73
pop ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
cmp eax, ebx
je 0x4809a5
push 0x4c00
push dword [ebp + 8]
mov ecx, eax
push ebx
call fcn.00411cf7
mov ebx, eax
or dword [ebp - 4], 0xffffffff
mov dword [edi + 0x98], ebx
call fcn.00405b41
mov ecx, dword [eax + 0x1c]
push ebx
call fcn.00406e0f
xor ebx, ebx
jmp 0x4809c8
mov dword [eax + 0x10], 0x4c00
mov ecx, dword [edi + 0x98]
mov eax, dword [ecx]
lea edx, [ebp + 0xc]
push edx
push 0x5004
mov dword [ebp - 0x10], ebx
mov dword [ebp + 8], ebx
call dword [eax + 0x18]
movzx eax, word [ebp + 0xc]
xor ebx, ebx
inc ebx
test eax, eax
je 0x4809f0
mov dword [ebp + 8], ebx
mov ecx, dword [edi + 0x98]
mov eax, dword [ecx]
lea edx, [ebp + 0xc]
push edx
push 0x5008
call dword [eax + 0x18]
movzx eax, word [ebp + 0xc]
test eax, eax
je 0x480a0f
mov dword [ebp - 0x10], ebx
cmp dword [ebp + 8], ebx
jne 0x480a22
cmp dword [ebp - 0x10], ebx
jne 0x480a22
mov dword [esi + 0x50], 2
jmp 0x480a2a
mov dword [esi + 0x50], ebx
cmp dword [ebp + 8], ebx
jne 0x480a2c
xor ebx, ebx
mov ecx, dword [edi + 0x98]
mov eax, dword [ecx]
lea edx, [ebp + 0xc]
push edx
lea edx, [ebx + 0x10]
shl edx, 0xa
push edx
call dword [eax + 0x18]
test eax, eax
je 0x480a82
mov eax, dword [ebp + 0xc]
mov ecx, eax
shr ecx, 8
and ecx, 0xf
mov dword [ebp + 8], ecx
fild dword [ebp + 8]
test ecx, ecx
jge 0x480a61
fadd dword [0x51d860]
mov ecx, eax
fstp dword [esi + 0x18]
and ecx, 0xf
mov dword [esi + 0x1c], ecx
mov ecx, eax
shr ecx, 4
and ecx, 0xf
shr eax, 0x10
and eax, 0xff
mov dword [esi + 0x20], ecx
mov dword [esi + 0x24], eax
mov ecx, dword [edi + 0x98]
mov eax, dword [ecx]
lea edx, [ebp + 0xc]
shl ebx, 0xa
push edx
add ebx, 0x4004
push ebx
call dword [eax + 0x18]
test eax, eax
je 0x480ab3
mov eax, dword [ebp + 0xc]
shr eax, 0x1e
mov dword [esi + 0x3c], eax
test eax, eax
jne 0x480ab3
mov dword [esi + 0x3c], 1
mov ecx, dword [edi + 0x98]
mov eax, dword [ecx]
lea edx, [ebp + 0xc]
push edx
push 0x5e04
call dword [eax + 0x18]
test eax, eax
je 0x480b00
mov eax, dword [ebp + 0xc]
and eax, 0x1f
mov ecx, eax
mov dword [ebp + 8], ecx
fild dword [ebp + 8]
test ecx, ecx
jge 0x480ae3
fadd dword [0x51d860]
fmul qword [0x528e48]
push eax
push str.1:_d
push 0x20
fstp dword [esi + 0xc]
add esi, 0x78
push esi
call fcn.00404c23
add esp, 0x10
call fcn.004ab515
ret
Function at 0x480b06
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 4
mov eax, 0x51313a
call fcn.004ab43d
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push 0x48
mov ecx, edi
mov dword [esi + 4], 9
call fcn.00487dc0
mov dword [ebp + 0xc], eax
and eax, 0xffffc000
push 0x2000000
push eax
xor ebx, ebx
push ebx
mov dword [ebp + 8], eax
call fcn.00405b41
mov ecx, eax
call fcn.0040513c
mov dword [edi + 0x98], eax
cmp eax, ebx
jne 0x480b92
push 0x14
call fcn.00498a73
pop ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
cmp eax, ebx
je 0x480b76
push 0x4c00
push dword [ebp + 8]
mov ecx, eax
push ebx
call fcn.00411cf7
mov ebx, eax
or dword [ebp - 4], 0xffffffff
mov dword [edi + 0x98], ebx
call fcn.00405b41
mov ecx, dword [eax + 0x1c]
push ebx
call fcn.00406e0f
xor ebx, ebx
jmp 0x480b99
mov dword [eax + 0x10], 0x4c00
mov ecx, dword [edi + 0x98]
mov eax, dword [ecx]
lea edx, [ebp + 0xc]
push edx
push 0x5004
mov dword [ebp - 0x10], ebx
mov dword [ebp + 8], ebx
call dword [eax + 0x18]
movzx eax, word [ebp + 0xc]
xor ebx, ebx
inc ebx
test eax, eax
je 0x480bc1
mov dword [ebp + 8], ebx
mov ecx, dword [edi + 0x98]
mov eax, dword [ecx]
lea edx, [ebp + 0xc]
push edx
push 0x5008
call dword [eax + 0x18]
movzx eax, word [ebp + 0xc]
test eax, eax
je 0x480be0
mov dword [ebp - 0x10], ebx
cmp dword [ebp + 8], ebx
jne 0x480bf3
cmp dword [ebp - 0x10], ebx
jne 0x480bf3
mov dword [esi + 0x50], 2
jmp 0x480bfb
mov dword [esi + 0x50], ebx
cmp dword [ebp + 8], ebx
jne 0x480bfd
xor ebx, ebx
mov ecx, dword [edi + 0x98]
mov eax, dword [ecx]
lea edx, [ebp + 0xc]
push edx
lea edx, [ebx + 0x10]
shl edx, 0xa
push edx
call dword [eax + 0x18]
test eax, eax
je 0x480c53
mov eax, dword [ebp + 0xc]
mov ecx, eax
shr ecx, 8
and ecx, 0xf
mov dword [ebp + 8], ecx
fild dword [ebp + 8]
test ecx, ecx
jge 0x480c32
fadd dword [0x51d860]
mov ecx, eax
fstp dword [esi + 0x18]
and ecx, 0xf
mov dword [esi + 0x1c], ecx
mov ecx, eax
shr ecx, 4
and ecx, 0xf
shr eax, 0x10
and eax, 0xff
mov dword [esi + 0x20], ecx
mov dword [esi + 0x24], eax
mov ecx, dword [edi + 0x98]
mov eax, dword [ecx]
lea edx, [ebp + 0xc]
shl ebx, 0xa
push edx
add ebx, 0x4004
push ebx
call dword [eax + 0x18]
test eax, eax
je 0x480c84
mov eax, dword [ebp + 0xc]
shr eax, 0x1e
mov dword [esi + 0x3c], eax
test eax, eax
jne 0x480c84
mov dword [esi + 0x3c], 1
mov edi, dword [edi + 0x98]
mov eax, dword [edi]
lea ecx, [ebp + 0xc]
push ecx
push 0x5e04
mov ecx, edi
call dword [eax + 0x18]
test eax, eax
je 0x480cfd
mov ecx, dword [ebp + 0xc]
mov eax, ecx
shr eax, 8
and eax, 1
sub eax, 0
je 0x480cc8
dec eax
jne 0x480ce6
mov eax, ecx
and eax, 0x1f
mov dword [ebp + 8], eax
fild dword [ebp + 8]
test eax, eax
jge 0x480ce3
fadd dword [0x51d860]
jmp 0x480ce3
mov eax, ecx
and eax, 0x1f
mov dword [ebp + 8], eax
fild dword [ebp + 8]
test eax, eax
jge 0x480cdd
fadd dword [0x51d860]
fmul qword [0x528e48]
fstp dword [esi + 0xc]
and ecx, 0x1f
push ecx
push str.1:_d
push 0x20
add esi, 0x78
push esi
call fcn.00404c23
add esp, 0x10
call fcn.004ab515
ret
Function at 0x487ed7
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x56bbe0]
xor eax, ebp
mov dword [ebp - 4], eax
or eax, 0xffffffff
push ebx
xor ebx, ebx
push esi
mov esi, ecx
push edi
mov dword [esi + 0x204], eax
mov dword [esi + 0xb50], eax
mov dword [esi + 0xb54], eax
mov dword [esi + 0xb58], eax
mov dword [esi + 0xb64], eax
mov dword [esi + 0xd74], eax
mov dword [esi + 0xd7c], eax
mov dword [esi + 0xd80], eax
mov dword [esi + 0xd84], eax
mov dword [esi + 0xd88], eax
lea eax, [ebp - 0x204]
push eax
lea edi, [esi + 0xb6c]
push 0x200
mov dword [esi], 0x529ec4
mov byte [esi + 0x410], bl
mov byte [esi + 0x610], bl
mov byte [esi + 0x210], bl
mov byte [esi + 0xa10], bl
mov byte [esi + 0xb10], bl
mov byte [esi + 0x810], bl
mov byte [esi + 4], bl
mov byte [esi + 0xb74], bl
mov dword [esi + 0xb68], ebx
mov dword [esi + 0x208], ebx
mov dword [esi + 0x20c], ebx
mov dword [esi + 0xb5c], ebx
mov dword [esi + 0xb60], ebx
mov dword [esi + 0xd78], ebx
mov dword [edi], ebx
mov dword [esi + 0xb70], ebx
mov byte [ebp - 0x204], bl
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jbe 0x487ff7
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x204]
push eax
push str._scpuz_driver__d.log
lea eax, [esi + 0xb74]
push 0x200
push eax
call fcn.00404c23
push 0x529ea4
lea eax, [esi + 0xb74]
push eax
push edi
call fcn.004aa777
mov edi, dword [edi]
add esp, 0x20
cmp edi, ebx
je 0x487ff7
push edi
call fcn.004a9a19
pop ecx
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a9399
leave
ret

Function at 0x48800f
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x56bbe0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [edi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea esi, [edi + 0xb6c]
push 0x529ec8
add edi, 0xb74
push edi
push esi
call fcn.004aa777
add esp, 0xc
cmp dword [esi], 0
je 0x488084
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x104]
push 0x100
push eax
call fcn.004aa18f
lea eax, [ebp - 0x104]
push eax
push dword [esi]
call fcn.004ab547
push dword [esi]
call fcn.004a9a19
add esp, 0x1c
and dword [esi], 0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004a9399
leave
ret
Function at 0x488092
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xcc
mov eax, dword [0x56bbe0]
xor eax, ebp
mov dword [ebp + 0x74], eax
push ebx
push esi
push edi
mov edi, 0x9c
push edi
lea eax, [ebp - 0x28]
push 0
push eax
mov esi, ecx
call fcn.004aa1b0
add esp, 0xc
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], edi
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push eax
call edi
test eax, eax
jne 0x488105
mov ebx, 0x94
push ebx
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.004aa1b0
add esp, 0xc
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x28], ebx
call edi
test eax, eax
jne 0x488105
push str._vGetOSVersion__GetVersionEx_returned_NULL_n
push esi
call fcn.0048800f
pop ecx
pop ecx
jmp 0x4881c0
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
push edx
push ecx
push eax
push str._vGetOSVersion__m_iOSVersion___d___d._d__n
push esi
mov dword [esi + 0xb50], eax
mov dword [esi + 0xb54], ecx
mov dword [esi + 0xb58], edx
call fcn.0048800f
add esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x51a1b4
mov dword [ebp - 0x30], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
je 0x4881ac
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetNativeSystemInfo
push ebx
call edi
test eax, eax
je 0x4881a5
lea ecx, [ebp - 0x54]
push ecx
call eax
movzx eax, word [ebp - 0x54]
mov dword [esi + 0xb64], eax
cmp eax, 9
jne 0x488196
push str.IsWow64Process
push ebx
call edi
test eax, eax
je 0x4881a5
lea ecx, [ebp - 0x2c]
push ecx
push dword [ebp - 0x30]
call eax
test eax, eax
je 0x4881a5
mov eax, dword [ebp - 0x2c]
mov dword [esi + 0xb5c], eax
jmp 0x4881a5
cmp eax, 6
jne 0x4881a5
mov dword [esi + 0xb60], 1
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push dword [esi + 0xb5c]
push str._vGetOSVersion__m_bIsAMD64___d_n
push esi
call fcn.0048800f
add esp, 0xc
mov ecx, dword [ebp + 0x74]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a9399
add ebp, 0x78
leave
ret
Function at 0x4881d2
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
lea eax, [ebp - 0x10]
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0x2710
push dword [esi + 0xb68]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
movzx eax, word [ebp - 4]
push edi
push eax
movzx eax, word [ebp - 6]
push eax
movzx eax, word [ebp - 8]
push eax
push str._vCloseDriver__02d:_02d:_02d__WaitForSingleObject_error___d_n
push esi
call fcn.0048800f
add esp, 0x18
test edi, edi
jne 0x488249
mov eax, dword [esi + 0xb50]
dec eax
je 0x488236
dec eax
jne 0x48823d
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call fcn.0048a3ce
jmp 0x48823d
mov ecx, esi
call fcn.00489dfa
push dword [esi + 0xb68]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [esi + 0xb68]
test eax, eax
je 0x488270
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
push str._vCloseDriver__CloseHandle_mutex____d_n
push esi
call fcn.0048800f
add esp, 0xc
and dword [esi + 0xb68], 0
cmp dword [ebp + 0x10], 0
je 0x488288
lea eax, [esi + 0xb74]
cmp byte [eax], 0
je 0x488288
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
leave
ret 0xc