joyce8/EMBER2024-capa huggingface dataset:
Function at 0x530840
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x3ec
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x3e8], eax
push esi
push edi
push 0x3e7
lea eax, [esp + 0xd]
push 0
push eax
mov edi, 1
mov byte [esp + 0x14], 0
call fcn.005dfd60
push str.IPCSRVR_STARTED
call fcn.004eae00
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x5308d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x5308b7
lea ecx, [esp + 8]
push 0x3e7
push ecx
call fcn.004d8c20
lea edx, [esp + 0x10]
push esi
push edx
call fcn.00530580
push esi
push str.ERROR____Unable_to_Open_Event__IPCSRVR_STARTED_._Reason_above
call fcn.00530580
add esp, 0x18
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x3e8]
xor ecx, esp
call fcn.005dfbbe
add esp, 0x3ec
ret
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x530907
lea eax, [esp + 8]
push 0x3e7
push eax
call fcn.004d8c20
lea ecx, [esp + 0x10]
push 0
push ecx
call fcn.00530580
push 0
push str.ERROR____Unable_to_Set_Event__IPCSRVR_STARTED_._Reason_above
call fcn.00530580
add esp, 0x18
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x3f0]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.005dfbbe
add esp, 0x3ec
ret
Function at 0x530ba0
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x4f0
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x4ec], eax
push edi
push 0x104
lea eax, [esp + 8]
push 0x7535e0
push eax
call fcn.004d90f0
lea ecx, [esp + 0x10]
push ecx
call fcn.004e24e0
push 0x104
lea edx, [esp + 0x18]
push str.ipcsrvr.dll
push edx
call fcn.004d9130
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 0x1c
lea eax, [esp + 4]
push eax
call edi
mov dword [0x753b54], eax
test eax, eax
jne 0x530c62
lea ecx, [esp + 0x108]
push 0x3e7
push ecx
call fcn.004d8c20
lea edx, [esp + 0x110]
push 0
push edx
call fcn.00530580
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x11c]
push str.ERROR____Unable_to_Load_Library__s._Reason_above
push ecx
call fcn.005dfb23
lea edx, [esp + 0x124]
push 0
push edx
call fcn.00530580
add esp, 0x24
xor eax, eax
pop edi
mov ecx, dword [esp + 0x4ec]
xor ecx, esp
call fcn.005dfbbe
add esp, 0x4f0
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MS_InitializeIPCLayerEx
push eax
call esi
mov dword [0x753b74], eax
mov eax, dword [0x753b54]
push str.MS_WaitOnClientRequestEx
push eax
call esi
push 0x104
lea ecx, [esp + 0xc]
push 0x7535e0
push ecx
mov dword [0x753b78], eax
call fcn.004d90f0
lea edx, [esp + 0x14]
push edx
call fcn.004e24e0
push 0x104
lea eax, [esp + 0x1c]
push str.msvint.dll
push eax
call fcn.004d9130
add esp, 0x1c
lea ecx, [esp + 8]
push ecx
call edi
mov dword [0x753b58], eax
test eax, eax
jne 0x530d35
call fcn.005307f0
lea edx, [esp + 0x10c]
push 0x3e7
push edx
call fcn.004d8c20
lea eax, [esp + 0x114]
push 0
push eax
call fcn.00530580
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x120]
push str.ERROR____Unable_to_Load_Library__s._Reason_above
push edx
call fcn.005dfb23
lea eax, [esp + 0x128]
push 0
push eax
call fcn.00530580
add esp, 0x24
pop esi
xor eax, eax
pop edi
mov ecx, dword [esp + 0x4ec]
xor ecx, esp
call fcn.005dfbbe
add esp, 0x4f0
ret
push str.ServerDispatchFunction
push eax
call esi
mov ecx, dword [0x753b58]
push str.MSV_Uninitialize
push ecx
mov dword [0x753b64], eax
call esi
mov edx, dword [0x753b58]
push str.MSV_Initialize
push edx
mov dword [0x753b6c], eax
call esi
mov ecx, dword [esp + 0x4f4]
pop esi
pop edi
mov dword [0x753b68], eax
xor ecx, esp
mov eax, 1
call fcn.005dfbbe
add esp, 0x4f0
ret
Function at 0x531750
Capabilities:
Get disk information

Disassembly:
push ebp
lea ebp, [esp - 0x404]
sub esp, 0x404
push 0xfffffffffffffffe
push 0x673d88
push 0x5dfbd0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x6aae14]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x400], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 0x40c]
mov edi, dword [ebp + 0x410]
mov ax, word [0x651ed8]
mov word [ebp - 0x1c], ax
mov cl, byte [0x651eda]
mov byte [ebp - 0x1a], cl
xor ebx, ebx
mov byte [ebp], bl
push 0x3ff
push ebx
lea edx, [ebp + 1]
push edx
call fcn.005dfd60
add esp, 0xc
mov dword [ebp - 4], ebx
mov al, byte [esi]
cmp al, 0x21
jne 0x5317d6
mov al, byte [esi + 1]
mov byte [ebp - 0x1c], al
push 0x400
lea ecx, [ebp]
push ecx
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
je 0x531831
cmp byte [esi], 0x21
jne 0x531804
add esi, 3
push esi
lea eax, [ebp]
push eax
push str.__s_s
jmp 0x531811
add esi, 2
push esi
lea ecx, [ebp]
push ecx
push 0x626500
push edi
call fcn.005dfb23
add esp, 0x10
mov dword [ebp - 4], 0xfffffffe
mov eax, 1
jmp 0x53183a
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x400]
xor ecx, ebp
call fcn.005dfbbe
add ebp, 0x404
mov esp, ebp
pop ebp
ret
Function at 0x531c50
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0xc04]
sub esp, 0xc04
push 0xfffffffffffffffe
push 0x673de8
push 0x5dfbd0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x6aae14]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0xc00], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 0xc0c]
mov edi, dword [ebp + 0xc10]
xor ebx, ebx
mov byte [ebp + 0x800], bl
push 0x3ff
push ebx
lea eax, [ebp + 0x801]
push eax
call fcn.005dfd60
add esp, 0xc
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
call fcn.004d9710
mov dword [ebp - 0x24], eax
cmp eax, ebx
je 0x531d2d
push 0x400
lea ecx, [ebp + 0x800]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [ebp + 0x800]
push edx
call fcn.004e24e0
add esp, 4
lea eax, [ebp + 0x800]
dec eax
lea ebx, [ebx]
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x531d00
mov ecx, dword [str.rundll32.exe]
mov dword [eax], ecx
mov edx, dword [0x62ea04]
mov dword [eax + 4], edx
mov ecx, dword [0x62ea08]
mov dword [eax + 8], ecx
mov dl, byte [0x62ea0c]
mov byte [eax + 0xc], dl
jmp 0x531d5b
mov eax, dword [str.rundll32.exe]
mov dword [ebp + 0x800], eax
mov ecx, dword [0x62ea04]
mov dword [ebp + 0x804], ecx
mov edx, dword [0x62ea08]
mov dword [ebp + 0x808], edx
mov al, byte [0x62ea0c]
mov byte [ebp + 0x80c], al
cmp esi, ebx
je 0x531e19
cmp byte [esi], bl
je 0x531e19
push esi
call fcn.004ec4c0
add esp, 4
test eax, eax
jne 0x531d94
cmp edi, ebx
je 0x531e36
push esi
push str._s_file_not_present
push edi
call fcn.005dfb23
add esp, 0xc
jmp 0x531e36
push esi
lea ecx, [ebp + 0x800]
push ecx
push str._s_setupapi.dll_InstallHinfSection_DefaultUninstall_128__s
lea edx, [ebp]
push edx
call fcn.005dfb23
add esp, 0x10
cmp dword [ebp - 0x24], ebx
je 0x531dc2
lea eax, [ebp - 0x1c]
push eax
call fcn.004f77e0
add esp, 4
mov esi, eax
jmp 0x531dc5
mov esi, dword [ebp - 0x20]
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push ebx
push 1
lea ecx, [ebp]
push ecx
call fcn.00506de0
add esp, 0x1c
cmp esi, ebx
je 0x531de9
mov edx, dword [ebp - 0x1c]
push edx
call fcn.004f7860
add esp, 4
push str.mwfsmfltr
call fcn.005110b0
test eax, eax
je 0x531e0b
cmp edi, ebx
je 0x531e36
push str.Failed_to_uninstall_mwfsmfltr
push edi
call fcn.005dfb23
add esp, 8
jmp 0x531e36
mov dword [ebp - 4], 0xfffffffe
mov eax, 1
jmp 0x531e3f
cmp edi, ebx
je 0x531e36
push str.Invalid_parameter
push edi
call fcn.005dfb23
add esp, 8
jmp 0x531e36
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xc00]
xor ecx, ebp
call fcn.005dfbbe
add ebp, 0xc04
mov esp, ebp
pop ebp
ret 8
Function at 0x534010
Capabilities:
Check os version
Get common file path

Disassembly:
sub esp, 0x98
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x94], eax
push esi
mov esi, dword [esp + 0xa0]
test esi, esi
je 0x534033
mov byte [esi], 0
push 0x94
lea eax, [esp + 8]
push 0
push eax
call fcn.005dfd60
add esp, 0xc
lea ecx, [esp + 4]
push ecx
mov dword [esp + 8], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x5340a1
mov dword [esp + 8], 4
mov eax, dword [esp + 0xa4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test esi, esi
je 0x53408b
push 0x5c
push esi
call fcn.005e0940
add esp, 8
test eax, eax
je 0x53408b
mov byte [eax], 0
pop esi
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.005dfbbe
add esp, 0x98
ret
cmp dword [esp + 8], 5
jb 0x534066
push 0x648984
push 0x61bed4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x534066
mov edx, dword [esp + 0xa4]
push edx
push esi
call eax
mov ecx, dword [esp + 0x98]
pop esi
xor ecx, esp
call fcn.005dfbbe
add esp, 0x98
ret
Function at 0x53a9a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x674468
push 0x5dfbd0
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x6aae14]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov byte [ebp - 0x224], bl
push 0x103
push ebx
lea eax, [ebp - 0x223]
push eax
call fcn.005dfd60
mov byte [ebp - 0x120], bl
push 0x103
push ebx
lea ecx, [ebp - 0x11f]
push ecx
call fcn.005dfd60
add esp, 0x18
cmp esi, ebx
je 0x53aad7
cmp byte [esi], bl
je 0x53aad7
push 0x5c
push esi
call fcn.005e0940
add esp, 8
test eax, eax
jne 0x53aabe
push 0x104
lea edx, [ebp - 0x224]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp byte [ebp - 0x224], bl
je 0x53aabe
lea ecx, [ebp - 0x224]
lea edx, [ebp - 0x120]
lea ecx, [ecx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x53aa60
lea eax, [ebp - 0x120]
push eax
call fcn.0053a960
add esp, 4
mov eax, esi
mov edx, esi
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x53aa80
sub eax, edx
lea edi, [ebp - 0x120]
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x53aa90
mov ecx, eax
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 4], 0xfffffffe
jmp 0x53aae0
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 4], 0xfffffffe
jmp 0x53aae0
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret
Function at 0x53abc0
Capabilities:
Delete registry key
Set registry value

Disassembly:
sub esp, 0x114
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x110], eax
push ebx
mov ebx, dword [esp + 0x120]
push ebp
mov ebp, dword [esp + 0x120]
push 0x104
lea eax, [esp + 0x15]
push 0
push eax
mov byte [esp + 0x1c], 0
call fcn.005dfd60
add esp, 0xc
test ebp, ebp
je 0x53ad95
test ebx, ebx
je 0x53ad95
push esi
push edi
mov ecx, 0xe
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionNetworkLanMan_
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, ebp
movsb byte es:[edi], byte [esi]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x53ac26
lea edi, [esp + 0x18]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x53ac34
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x53accb
mov ecx, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea eax, [esp + 0x18]
push eax
push 4
push 0
push str.Flags
push ecx
mov dword [esp + 0x2c], 0x191
call esi
mov edx, dword [esp + 0x10]
test eax, eax
jne 0x53ad72
push 4
lea ecx, [esp + 0x18]
push ecx
push 4
push eax
push str.Type
push edx
mov dword [esp + 0x2c], eax
call esi
test eax, eax
je 0x53ace6
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x18]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
xor al, al
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.005dfbbe
add esp, 0x114
ret
mov eax, ebx
lea edx, [eax + 1]
jmp 0x53acf0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x53acf0
sub eax, edx
mov edx, dword [esp + 0x10]
inc eax
push eax
push ebx
push 1
push 0
push 0x6486bc
push edx
call esi
test eax, eax
mov eax, dword [esp + 0x10]
jne 0x53acb4
push 0
lea edx, [esp + 0x18]
push edx
push 3
push 0
push str.Parm2enc
push eax
call esi
mov ecx, dword [esp + 0x10]
test eax, eax
je 0x53ad3d
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x18]
push edx
jmp 0x53acc0
push 0
lea eax, [esp + 0x18]
push eax
push 3
push 0
push str.Parm1enc
push ecx
call esi
test eax, eax
jne 0x53ad6e
mov ecx, dword [esp + 0x10]
push 1
push 0x60c81c
push 1
push eax
push str.Remark
push ecx
call esi
test eax, eax
je 0x53ad83
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x18]
push eax
jmp 0x53acc0
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x53accd
mov ecx, dword [esp + 0x118]
pop ebp
pop ebx
xor ecx, esp
xor al, al
call fcn.005dfbbe
add esp, 0x114
ret
Function at 0x53b030
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0xc
push ebx
push esi
lea eax, [esp + 8]
push eax
xor ebx, ebx
push 0xf003f
push ebx
push str.SYSTEMCurrentControlSetServicesLanmanServerParameters
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x1c], ebx
xor esi, esi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x53b160
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edi
cmp esi, ebx
je 0x53b084
push esi
call fcn.005e600f
add esp, 4
add eax, 0x400
jmp 0x53b089
mov eax, 0x400
push eax
push esi
call fcn.005e25a6
mov esi, eax
push esi
call fcn.005e600f
push eax
push ebx
push esi
call fcn.005dfd60
push esi
call fcn.005e600f
mov edx, dword [esp + 0x2c]
add esp, 0x1c
lea ecx, [esp + 0x14]
push ecx
push esi
push ebx
push ebx
push str.NullSessionShares
sub eax, 3
push edx
mov dword [esp + 0x2c], eax
call ebp
mov edi, eax
cmp edi, ebx
je 0x53b0d2
cmp edi, 0xea
je 0x53b070
mov eax, dword [esp + 0x14]
mov byte [eax + esi], bl
mov ecx, dword [esp + 0x14]
mov byte [ecx + esi + 1], bl
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
push ecx
push esi
mov byte [edx + esi + 2], bl
call fcn.0053aeb0
add esp, 0xc
cmp eax, 1
jne 0x53b11a
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
push edx
push esi
push 7
push ebx
push str.NullSessionShares
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x10]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
je 0x53b131
push eax
call ebp
xor eax, eax
mov dword [esp + 0x10], eax
cmp esi, ebx
je 0x53b144
push esi
call fcn.005e0865
mov eax, dword [esp + 0x14]
add esp, 4
xor esi, esi
cmp eax, ebx
je 0x53b14f
push eax
call ebp
mov dword [esp + 0x10], ebx
cmp esi, ebx
je 0x53b15c
push esi
call fcn.005e0865
add esp, 4
mov eax, edi
pop edi
pop ebp
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x53b170
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0xc
push ebx
push esi
lea eax, [esp + 8]
push eax
xor ebx, ebx
push 0xf003f
push ebx
push str.SYSTEMCurrentControlSetServicesLanmanServerParameters
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x1c], ebx
xor esi, esi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x53b2a0
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edi
cmp esi, ebx
je 0x53b1c4
push esi
call fcn.005e600f
add esp, 4
add eax, 0x400
jmp 0x53b1c9
mov eax, 0x400
push eax
push esi
call fcn.005e25a6
mov esi, eax
push esi
call fcn.005e600f
push eax
push ebx
push esi
call fcn.005dfd60
push esi
call fcn.005e600f
mov edx, dword [esp + 0x2c]
add esp, 0x1c
lea ecx, [esp + 0x14]
push ecx
push esi
push ebx
push ebx
push str.NullSessionShares
sub eax, 3
push edx
mov dword [esp + 0x2c], eax
call ebp
mov edi, eax
cmp edi, ebx
je 0x53b212
cmp edi, 0xea
je 0x53b1b0
mov eax, dword [esp + 0x14]
mov byte [eax + esi], bl
mov ecx, dword [esp + 0x14]
mov byte [ecx + esi + 1], bl
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
push ecx
push esi
mov byte [edx + esi + 2], bl
call fcn.0053adb0
add esp, 0xc
cmp eax, 1
jne 0x53b25a
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
push edx
push esi
push 7
push ebx
push str.NullSessionShares
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x10]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
je 0x53b271
push eax
call ebp
xor eax, eax
mov dword [esp + 0x10], eax
cmp esi, ebx
je 0x53b284
push esi
call fcn.005e0865
mov eax, dword [esp + 0x14]
add esp, 4
xor esi, esi
cmp eax, ebx
je 0x53b28f
push eax
call ebp
mov dword [esp + 0x10], ebx
cmp esi, ebx
je 0x53b29c
push esi
call fcn.005e0865
add esp, 4
mov eax, edi
pop edi
pop ebp
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x53b6b0
Capabilities:
Get memory capacity

Disassembly:
push ebp
lea ebp, [esp - 0x118]
sub esp, 0x118
push 0xfffffffffffffffe
push 0x6744e0
push 0x5dfbd0
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x6aae14]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x114], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 0x24], ebx
wait
mov dword [ebp - 4], ebx
mov dword [ebp - 0x84], ebx
push 0x3c
push ebx
lea eax, [ebp - 0x80]
push eax
call fcn.005dfd60
mov byte [ebp], bl
push 0x103
push ebx
lea ecx, [ebp + 1]
push ecx
call fcn.005dfd60
add esp, 0x18
mov dword [ebp - 0x84], 0x40
lea edx, [ebp - 0x84]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
jne 0x53b7a0
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov ecx, dword [ebp - 0x3c]
fild dword [ebp - 0x3c]
test ecx, ecx
jge 0x53b771
fadd qword [0x60ecc0]
fmul qword [0x612ca8]
sub esp, 8
fstp qword [esp]
push str._.0f
lea edx, [ebp + 0x104]
push edx
call fcn.005dfb23
lea eax, [ebp + 0x104]
push eax
push str._s_MB
lea ecx, [ebp]
push ecx
jmp 0x53b7f6
mov edx, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x20], edx
mov ecx, eax
and eax, 0x7fffffff
mov dword [ebp - 0x1c], eax
fild qword [ebp - 0x20]
and ecx, 0x80000000
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ebx
fild qword [ebp - 0x20]
fchs
faddp st(1)
fmul qword [0x612ca8]
sub esp, 8
fstp qword [esp]
push str._.0f
lea eax, [ebp + 0x104]
push eax
call fcn.005dfb23
lea ecx, [ebp + 0x104]
push ecx
push str._s_MB
lea edx, [ebp]
push edx
call fcn.005dfb23
add esp, 0x1c
lea eax, [ebp]
push eax
call fcn.004e1290
lea ecx, [ebp]
push ecx
call fcn.004dd6c0
inc eax
push eax
call fcn.005e20e4
add esp, 0xc
mov dword [ebp - 0x24], eax
cmp eax, ebx
je 0x53b830
lea edx, [ebp]
mov esi, eax
mov cl, byte [edx]
mov byte [esi], cl
inc edx
inc esi
cmp cl, bl
jne 0x53b826
wait
mov dword [ebp - 4], 0xfffffffe
jmp 0x53b85c
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x114]
xor ecx, ebp
call fcn.005dfbbe
add ebp, 0x118
mov esp, ebp
pop ebp
ret
Function at 0x53b890
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x108]
sub esp, 0x108
push 0xfffffffffffffffe
push 0x674500
push 0x5dfbd0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x6aae14]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x104], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], ebx
mov byte [ebp], bl
push 0x103
push ebx
lea eax, [ebp + 1]
push eax
call fcn.005dfd60
add esp, 0xc
mov dword [ebp - 0x24], 0x104
lea ecx, [ebp - 0x1c]
push ecx
push 1
push ebx
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x53b926
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
jmp 0x53b9b1
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp]
push eax
push ebx
push ebx
push str.ProcessorNameString
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x53b97a
lea edx, [ebp]
push edx
call fcn.004e1290
lea eax, [ebp]
push eax
call fcn.004dd6c0
inc eax
push eax
call fcn.005e20e4
add esp, 0xc
mov esi, eax
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x53b97a
lea ecx, [ebp]
mov edx, esi
lea ecx, [ecx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x53b970
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xfffffffe
jmp 0x53b9af
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x104]
xor ecx, ebp
call fcn.005dfbbe
add ebp, 0x108
mov esp, ebp
pop ebp
ret
Function at 0x53b9e0
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x108]
sub esp, 0x108
push 0xfffffffffffffffe
push 0x674520
push 0x5dfbd0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x6aae14]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x104], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], ebx
mov byte [ebp], bl
push 0x103
push ebx
lea eax, [ebp + 1]
push eax
call fcn.005dfd60
add esp, 0xc
mov dword [ebp - 0x24], 0x104
lea ecx, [ebp - 0x1c]
push ecx
push 1
push ebx
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x53ba76
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
jmp 0x53bb01
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp]
push eax
push ebx
push ebx
push str.VendorIdentifier
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x53baca
lea edx, [ebp]
push edx
call fcn.004e1290
lea eax, [ebp]
push eax
call fcn.004dd6c0
inc eax
push eax
call fcn.005e20e4
add esp, 0xc
mov esi, eax
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x53baca
lea ecx, [ebp]
mov edx, esi
lea ecx, [ecx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x53bac0
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xfffffffe
jmp 0x53baff
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x104]
xor ecx, ebp
call fcn.005dfbbe
add ebp, 0x108
mov esp, ebp
pop ebp
ret