joyce8/EMBER2024-capa huggingface dataset:
Function at 0x471dd0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
mov dword [esp + 0x10], ecx
xor edi, edi
mov ecx, dword [esp + 0x10]
push ebp
push ebx
mov esi, 1
mov eax, dword [ecx]
call dword [eax + 0x38]
test eax, eax
jle 0x471e13
sub ebp, eax
test ebp, ebp
jle 0x471e61
add ebx, eax
mov eax, dword [esp + 0x20]
xor edi, edi
test eax, eax
jne 0x471de3
mov dword [esp + 0x20], 0x1388
jmp 0x471de3
jne 0x471e1c
xor esi, esi
mov eax, 0xffffffb0
mov ecx, dword [esp + 0x20]
test ecx, ecx
jbe 0x471e70
test eax, eax
je 0x471e2d
cmp eax, 0xffffffb0
jne 0x471e70
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, edi
jb 0x471e3b
test edi, edi
jne 0x471e43
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x20]
sub eax, edi
cmp eax, ecx
ja 0x471e6b
test esi, esi
je 0x471de3
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x471de3
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 0xc
mov eax, 0xffffffb0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc

Function at 0x472000
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5435d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [eax], ebx
mov dword [ebp - 0x10], esp
mov edx, dword [edi]
call dword [edx + 0x3c]
mov esi, eax
test esi, esi
jg 0x47206e
mov eax, dword [ebp + 0x10]
test eax, eax
jbe 0x4720e8
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
cmp eax, ebx
jb 0x47204e
test ebx, ebx
jne 0x472052
call esi
mov ebx, eax
call esi
mov ecx, dword [ebp + 0x10]
sub eax, ebx
cmp eax, ecx
jae 0x4720e8
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x3c]
mov esi, eax
test esi, esi
jle 0x472033
mov ebx, dword [ebp + 8]
cmp esi, dword [ebx + 8]
jle 0x47208e
push 0xffffffffffffffff
push esi
mov ecx, ebx
mov dword [ebp - 4], 0
call fcn.00511241
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebx + 4]
test eax, eax
jne 0x4720bd
mov eax, 0xfffffc22
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp + 0xc]
push esi
push eax
mov dword [ecx], esi
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 0x38]
cmp eax, esi
jne 0x4720e4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
test eax, eax
jl 0x4720ed
mov eax, 0xffffffb0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x472a80
Capabilities:
Set socket configuration

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax]
push eax
call fcn.004f9b83
mov ebx, eax
mov eax, dword [esi - 0x54]
add esp, 4
cmp eax, 0xffffffff
je 0x472ab2
push 0
push str.Socket_Error
push str.RawListen:_why_is_handle_ok_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 2
push 2
call dword [sym.imp.WSOCK32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi - 0x54], eax
jne 0x472ad5
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
pop esi
or eax, 0xffffffff
pop ebx
pop ecx
ret 4
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 1
push ecx
push 0x8004667e
push eax
call dword [sym.imp.WSOCK32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x472af9
mov edx, dword [esi - 0x54]
push edx
jmp 0x472b3e
push edi
lea edi, [esi - 0x4c]
mov ecx, edi
xor eax, eax
push ebx
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov word [edi], 2
call dword [sym.imp.WSOCK32.dll_htons]
push 0
mov word [esi - 0x4a], ax
call dword [sym.imp.WSOCK32.dll_htonl]
mov dword [esi - 0x48], eax
mov edx, dword [esi - 0x54]
push 0x10
push edi
push edx
call dword [sym.imp.WSOCK32.dll_bind]
cmp eax, 0xffffffff
pop edi
jne 0x472b54
mov eax, dword [esi - 0x54]
push eax
call dword [sym.imp.WSOCK32.dll_closesocket]
mov dword [esi - 0x54], 0xffffffff
pop esi
or eax, 0xffffffff
pop ebx
pop ecx
ret 4
mov edx, dword [esi - 0x54]
lea ecx, [esp + 8]
push 4
push ecx
push 0x20
push 0xffff
push edx
mov dword [esp + 0x1c], 1
call dword [sym.imp.WSOCK32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x472b7f
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
lea ecx, [esi - 0x24]
xor eax, eax
xor edx, edx
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
lea eax, [esi - 0x14]
mov dword [esi - 0x14], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
mov dword [esi - 0x50], ebx
mov dword [esi - 0x28], edx
pop esi
xor eax, eax
pop ebx
pop ecx
ret 4
Function at 0x472a86
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax]
push eax
call fcn.004f9b83
mov ebx, eax
mov eax, dword [esi - 0x54]
add esp, 4
cmp eax, 0xffffffff
je 0x472ab2
push 0
push str.Socket_Error
push str.RawListen:_why_is_handle_ok_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 2
push 2
call dword [sym.imp.WSOCK32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi - 0x54], eax
jne 0x472ad5
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
pop esi
or eax, 0xffffffff
pop ebx
pop ecx
ret 4
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 1
push ecx
push 0x8004667e
push eax
call dword [sym.imp.WSOCK32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x472af9
mov edx, dword [esi - 0x54]
push edx
jmp 0x472b3e
push edi
lea edi, [esi - 0x4c]
mov ecx, edi
xor eax, eax
push ebx
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov word [edi], 2
call dword [sym.imp.WSOCK32.dll_htons]
push 0
mov word [esi - 0x4a], ax
call dword [sym.imp.WSOCK32.dll_htonl]
mov dword [esi - 0x48], eax
mov edx, dword [esi - 0x54]
push 0x10
push edi
push edx
call dword [sym.imp.WSOCK32.dll_bind]
cmp eax, 0xffffffff
pop edi
jne 0x472b54
mov eax, dword [esi - 0x54]
push eax
call dword [sym.imp.WSOCK32.dll_closesocket]
mov dword [esi - 0x54], 0xffffffff
pop esi
or eax, 0xffffffff
pop ebx
pop ecx
ret 4
mov edx, dword [esi - 0x54]
lea ecx, [esp + 8]
push 4
push ecx
push 0x20
push 0xffff
push edx
mov dword [esp + 0x1c], 1
call dword [sym.imp.WSOCK32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x472b7f
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
lea ecx, [esi - 0x24]
xor eax, eax
xor edx, edx
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
lea eax, [esi - 0x14]
mov dword [esi - 0x14], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
mov dword [esi - 0x50], ebx
mov dword [esi - 0x28], edx
pop esi
xor eax, eax
pop ebx
pop ecx
ret 4
Function at 0x4731a0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x14
mov edx, dword [esp + 0x1c]
push esi
test edx, edx
mov esi, ecx
mov dword [esp + 4], 0x10
jne 0x4731bf
xor eax, eax
pop esi
add esp, 0x14
ret 8
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jne 0x4731d3
mov eax, 0xfffffc22
pop esi
add esp, 0x14
ret 8
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
jne 0x4731e7
mov eax, 0xfffffffe
pop esi
add esp, 0x14
ret 8
push edi
lea edi, [esp + 8]
push edi
lea edi, [esp + 0x10]
push edi
push 0
push edx
push ecx
push eax
call dword [sym.imp.WSOCK32.dll_recvfrom]
cmp eax, 0xffffffff
pop edi
jne 0x473266
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
add eax, 0xffffd8da
cmp eax, 0x47
ja case.0x47321b.10025
xor ecx, ecx
mov cl, byte [eax + 0x473298]
jmp dword [ecx*4 + 0x473288]
mov eax, 0xffffffb0
pop esi
add esp, 0x14
ret 8
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov dword [eax + esi + 0x24], 0
mov ecx, dword [esi]
mov edx, dword [ecx + 4]
mov eax, dword [edx + esi]
lea ecx, [edx + esi]
call dword [eax + 0x24]
mov dword [esi + 4], 0xffffffff
mov eax, 0xfffffffe
pop esi
add esp, 0x14
ret 8
or eax, 0xffffffff
pop esi
add esp, 0x14
ret 8
mov edx, dword [esp + 8]
xor ecx, ecx
add esi, 0x34
mov dword [esi], edx
mov edx, dword [esp + 0xc]
mov dword [esi + 4], edx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], ecx
pop esi
add esp, 0x14
ret 8
Function at 0x473dc0
Capabilities:
Get hostname
Resolve dns

Disassembly:
push 0xffffffffffffffff
push 0x54385b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x104
mov eax, dword [0x5ab980]
push ebx
push ebp
push edi
xor edi, edi
mov dword [esp + 0xc], eax
mov ebp, dword [esp + 0x120]
mov dword [esp + 0x118], edi
mov ecx, ebp
call fcn.00510e2a
lea ecx, [esp + 0x10]
push 0x100
push ecx
call dword [sym.imp.WSOCK32.dll_gethostname]
or ebx, 0xffffffff
cmp eax, ebx
jne 0x473e29
lea ecx, [esp + 0xc]
mov dword [esp + 0x118], ebx
call fcn.005128e4
mov eax, ebx
jmp 0x473e9b
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.WSOCK32.dll_gethostbyname]
cmp eax, edi
jne 0x473e4f
lea ecx, [esp + 0xc]
mov dword [esp + 0x118], ebx
call fcn.005128e4
mov eax, 0xfffffffe
jmp 0x473e9b
push esi
mov esi, dword [eax + 0xc]
mov eax, dword [esi]
cmp eax, edi
je 0x473e88
mov ebx, dword [sym.imp.WSOCK32.dll_inet_ntoa]
mov eax, dword [eax]
push eax
call ebx
push eax
lea ecx, [esp + 0x14]
call fcn.00512a6d
lea eax, [esp + 0x10]
mov ecx, ebp
push eax
call fcn.00510fd7
mov eax, dword [esi + 4]
add esi, 4
inc edi
test eax, eax
jne 0x473e5f
or ebx, 0xffffffff
lea ecx, [esp + 0x10]
mov dword [esp + 0x11c], ebx
call fcn.005128e4
mov eax, edi
pop esi
mov ecx, dword [esp + 0x110]
pop edi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x110
ret
Function at 0x474990
Capabilities:
Create thread

Disassembly:
push ecx
lea eax, [esp]
push esi
mov esi, ecx
push eax
push 0
push esi
push 0x474670
push 0x1000
push 0
mov dword [esi + 0x108], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x10c], eax
pop esi
neg eax
sbb eax, eax
and eax, 2
dec eax
pop ecx
ret

Function at 0x475310
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x543a1f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [0x5ab980]
push ebx
xor ebx, ebx
push esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 0x24], ebx
mov dword [esp + 8], eax
mov esi, dword [esp + 0x2c]
mov byte [esp + 0x24], 1
mov ecx, esi
call fcn.00510e2a
cmp dword [0x5b0cec], ebx
jne 0x47538a
lea ecx, [esp + 8]
mov byte [esp + 0x24], bl
call fcn.005128e4
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call fcn.005128e4
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
mov eax, dword [0x5b0c60]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], eax
sub esp, 8
fild qword [esp + 0x1c]
lea ecx, [esp + 0x10]
fmul qword [0x55dec0]
fstp qword [esp]
push str._.2f
push ecx
call fcn.0050e6c7
mov eax, dword [0x5b0cec]
add esp, 0x10
cmp eax, ebx
je 0x4753c8
lea eax, [esp + 8]
jmp 0x4753e8
lea edx, [esp + 0x2c]
push 0x4fca
push edx
call fcn.00422640
mov ebx, 1
add esp, 8
mov dword [esp + 0x10], ebx
mov byte [esp + 0x24], 2
push eax
lea ecx, [esp + 0xc]
call fcn.00512a1d
test bl, 1
mov dword [esp + 0x24], 1
je 0x475408
lea ecx, [esp + 0x2c]
call fcn.005128e4
mov eax, dword [esp + 8]
lea ecx, [esp + 0xc]
push eax
push 0x4fc7
push ecx
call fcn.0050e6da
add esp, 0xc
lea edx, [esp + 0xc]
mov ecx, esi
push edx
call fcn.00510fd7
mov eax, dword [0x5b0cf0]
lea ecx, [esp + 0x2c]
neg eax
sbb eax, eax
add eax, 0x4fca
push eax
push ecx
call fcn.00422640
add esp, 8
mov edx, dword [eax]
lea eax, [esp + 0xc]
push edx
push 0x4fc8
push eax
mov byte [esp + 0x30], 3
call fcn.0050e6da
add esp, 0xc
lea ecx, [esp + 0x2c]
mov byte [esp + 0x24], 1
call fcn.005128e4
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.00510fd7
lea ecx, [esp + 8]
mov byte [esp + 0x24], 0
call fcn.005128e4
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call fcn.005128e4
mov ecx, dword [esp + 0x1c]
pop esi
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x4755b0
Capabilities:
Modify service
Stop service

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov ebx, ecx
push 0x43
mov dword [esp + 0x18], 1
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0xf003f
push 0
push 0
mov dword [esp + 0x1c], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
jne 0x4755ec
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 4
lea ebp, [ebx + 0x108]
push 0xf01ff
push ebp
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x475618
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24
ret 4
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x475651
lea eax, [esp + 0x18]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push ebp
push 0
push 0
push 0
push 0
add ebx, 4
push str.Parallel_Arbitrator
push ebx
push 1
push 4
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
mov ebx, eax
jmp 0x475655
mov ebx, dword [esp + 0x14]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x24
ret 4
Function at 0x475890
Capabilities:
Manipulate safe mode programs

Disassembly:
push 1
push str.Driver
push 0
push str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalAloPar.sys
call fcn.0041e450
push 1
push str.Driver
push 0
push str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootNetworkAloPar.sys
call fcn.0041e450
push 1
push str.Driver_Group
push 0
push str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalParallel_Arbitrator
call fcn.0041e450
push 1
push str.Driver_Group
push 0
push str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootNetworkParallel_Arbitrator
call fcn.0041e450
add esp, 0x40
ret

Function at 0x4758e0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x20c
add ecx, 0x108
lea eax, [esp + 0x10c]
push ebx
push edi
push ecx
push str.Software_s
push eax
xor edi, edi
xor ebx, ebx
call fcn.004fa1d7
add esp, 0xc
lea ecx, [esp + 0xc]
lea edx, [esp + 0x114]
push ecx
push 0x20019
push ebx
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x475a4b
lea eax, [esp + 8]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x98]
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
push ecx
push edx
push ebx
push str.AllProcessesIOPM
push eax
mov dword [esp + 0x24], 0x80
call esi
test eax, eax
jne 0x475965
mov edi, 1
lea ecx, [esp + 0xc]
lea edx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push edx
push eax
push 0
push str.ThroughCreateFileIOPM
push ecx
mov dword [esp + 0x24], 0x80
call esi
test eax, eax
pop esi
jne 0x475994
mov ebx, 1
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x475a4b
test ebx, ebx
je 0x475a4b
xor eax, eax
mov ecx, eax
mov edx, 1
and ecx, 7
shl edx, cl
mov ecx, eax
shr ecx, 3
mov cl, byte [esp + ecx + 0x94]
test cl, dl
jne 0x4759f1
inc eax
cmp eax, 0x400
jae 0x4759f1
mov ecx, eax
mov edx, 1
and ecx, 7
shl edx, cl
mov ecx, eax
shr ecx, 3
mov cl, byte [esp + ecx + 0x94]
test cl, dl
je 0x4759cd
inc eax
cmp eax, 0x400
jb 0x4759b1
xor eax, eax
mov ecx, eax
mov edx, 1
and ecx, 7
shl edx, cl
mov ecx, eax
shr ecx, 3
mov cl, byte [esp + ecx + 0x14]
test cl, dl
jne 0x475a35
inc eax
cmp eax, 0x400
jae 0x475a35
mov ecx, eax
mov edx, 1
and ecx, 7
shl edx, cl
mov ecx, eax
shr ecx, 3
mov cl, byte [esp + ecx + 0x14]
test cl, dl
je 0x475a14
inc eax
cmp eax, 0x400
jb 0x4759fb
pop edi
mov eax, 1
pop ebx
add esp, 0x20c
ret
pop edi
xor eax, eax
pop ebx
add esp, 0x20c
ret
Function at 0x476380
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x543acb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3a8
push edi
mov ecx, 0x25
xor eax, eax
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
mov dword [esp + 4], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [0x5b0cf8]
mov dword [0x5b0d04], 0
test eax, eax
je 0x4763e0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x5b0cf8], 0
cmp dword [esp + 0x14], 2
jne 0x4764c0
cmp dword [esp + 8], 4
jae 0x47640b
or eax, 0xffffffff
pop edi
mov ecx, dword [esp + 0x3a8]
mov dword fs:[0], ecx
add esp, 0x3b4
ret
push ebp
push esi
lea ecx, [esp + 0xa0]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, str.DriversAloPar.sys
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xa0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0xa0]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.00475d60
add esp, 4
test eax, eax
pop esi
pop ebp
jle 0x4764c2
lea ecx, [esp + 0x1a0]
call fcn.00475570
push 0
lea ecx, [esp + 0x9c]
push str.AloPar
push ecx
lea ecx, [esp + 0x1ac]
mov dword [esp + 0x3c0], 0
call fcn.00475a60
lea ecx, [esp + 0x1a0]
call fcn.004755a0
mov eax, 1
pop edi
mov ecx, dword [esp + 0x3a8]
mov dword fs:[0], ecx
add esp, 0x3b4
ret
xor eax, eax
mov ecx, dword [esp + 0x3ac]
pop edi
mov dword fs:[0], ecx
add esp, 0x3b4
ret
Function at 0x485520
Capabilities:
Get common file path

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x545d61
push eax
mov dword fs:[0], esp
sub esp, 0x130
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0xc], ebx
je 0x48555a
cmp dword [esp + 0x154], ebx
je 0x485678
call fcn.004856e0
push 0xa
lea ecx, [esp + 0x24]
call fcn.00510deb
mov eax, dword [0x5ab980]
mov dword [esp + 0x148], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov ebp, dword [esp + 0x150]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
push eax
push ecx
push ebp
mov byte [esp + 0x154], 2
call fcn.004222e0
add esp, 0xc
lea edx, [esp + 0x20]
lea eax, [esp + 0x18]
push edx
push eax
push ecx
lea edx, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x28], esp
push edx
call fcn.00512659
call fcn.004201f0
mov eax, dword [esi + 8]
lea edi, [esi + 8]
add esp, 0xc
cmp dword [eax - 8], ebx
jne 0x4855d1
push ebp
mov ecx, edi
call fcn.00512a1d
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x4855e4
cmp eax, ebx
je 0x4855e4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [edi]
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 4], ebx
cmp dword [eax - 8], ebx
je 0x48560a
push ebx
push 0x80
push 2
push ebx
push 1
push 0x40000000
push eax
call ebp
mov dword [esi + 4], eax
cmp dword [esi + 4], 0xffffffff
jne 0x485663
lea ecx, [esp + 0x3c]
push ecx
push 0x102
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
cmp eax, ebx
jbe 0x485663
cmp eax, 0x102
jae 0x485663
lea edx, [esp + 0x3c]
mov ecx, edi
push edx
call fcn.00512a6d
push edi
call fcn.0041f9c0
add esp, 4
mov ecx, edi
push str.aloerr.txt
call fcn.00512cc0
mov edi, dword [edi]
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push edi
call ebp
mov dword [esi + 4], eax
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x48567f
cmp eax, ebx
je 0x48567f
mov dword [esi + 0xc], 1
jmp 0x485685
mov eax, 1
jmp 0x4856bf
mov dword [esi + 4], ebx
mov dword [esi + 0xc], ebx
mov esi, dword [esi + 0xc]
lea ecx, [esp + 0x14]
mov byte [esp + 0x148], 1
call fcn.005128e4
lea ecx, [esp + 0x10]
mov byte [esp + 0x148], bl
call fcn.005128e4
lea ecx, [esp + 0x20]
mov dword [esp + 0x148], 0xffffffff
call fcn.00510e5f
mov eax, esi
mov ecx, dword [esp + 0x140]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x13c
ret 8
Function at 0x485a80
Capabilities:
Get number of processors

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x545e30
push eax
mov dword fs:[0], esp
sub esp, 0x2c
lea eax, [esp + 0x20]
push ebx
push eax
call fcn.0041e240
add esp, 4
test eax, eax
je 0x485c8b
mov eax, dword [0x5ab980]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x38], 0
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 8], eax
mov dword [esp + 4], eax
mov dword [esp + 0xc], eax
mov al, byte [esp + 0x24]
mov bl, 6
test al, al
mov byte [esp + 0x38], bl
jne 0x485c26
mov eax, dword [esp + 0x26]
cmp al, 0x64
ja 0x485b0b
and eax, 0xff
lea ecx, [esp + 4]
push eax
push str._i____left
push ecx
call fcn.0050e6c7
add esp, 0xc
jmp 0x485b39
lea edx, [esp + 0x20]
push 0x4fcb
push edx
call fcn.00422640
add esp, 8
push eax
lea ecx, [esp + 8]
mov byte [esp + 0x3c], 7
call fcn.00512a1d
lea ecx, [esp + 0x20]
mov byte [esp + 0x38], bl
call fcn.005128e4
mov ecx, dword [esp + 0x28]
cmp ecx, 0xffffffff
je 0x485b78
mov eax, 0x88888889
push 0
mul ecx
shr edx, 5
lea eax, [esp + 0x24]
push edx
push eax
call fcn.00423670
add esp, 0xc
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x3c], 8
call fcn.00512a1d
lea ecx, [esp + 0x20]
mov byte [esp + 0x38], bl
call fcn.005128e4
mov ecx, dword [esp + 4]
lea edx, [esp + 8]
push ecx
push str.Battery_Remaining:__s
push edx
call fcn.0050e6c7
mov eax, dword [esp + 0x18]
add esp, 0xc
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x485bbb
push eax
lea eax, [esp + 0x14]
push str.__about__s_minutes_
push eax
call fcn.0050e6c7
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0xc]
call fcn.00512cfc
lea edx, [esp + 8]
push 0x59960c
lea eax, [esp + 0x18]
push edx
push eax
call fcn.00425570
add esp, 0xc
lea ecx, [esp + 0x18]
push str.Please_switch_to_a_power_outlet
call fcn.00512a6d
lea ecx, [esp + 0x14]
push str._n_nThis_PC_is_running_on_batteries.__PC_Relocator_will_try_to_prevent_the_computer_from_shutting_down_during_the_relocation.__However__if_the_power_supply_fails__the_relocation_will_be_interrupted._n_nPlease_switch_to_a_power_outlet._n_nPress_OK_when_you_are_ready_to_continue.
lea edx, [esp + 0x24]
push ecx
push edx
call fcn.00512b79
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x3c], 9
call fcn.00512a1d
lea ecx, [esp + 0x20]
mov byte [esp + 0x38], bl
call fcn.005128e4
push 0
lea eax, [esp + 0x1c]
push 0x30
lea ecx, [esp + 0x24]
push eax
push ecx
call fcn.0042e190
add esp, 0x10
lea ecx, [esp + 0xc]
mov byte [esp + 0x38], 5
call fcn.005128e4
lea ecx, [esp + 4]
mov byte [esp + 0x38], 4
call fcn.005128e4
lea ecx, [esp + 8]
mov byte [esp + 0x38], 3
call fcn.005128e4
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], 2
call fcn.005128e4
lea ecx, [esp + 0x14]
mov byte [esp + 0x38], 1
call fcn.005128e4
lea ecx, [esp + 0x18]
mov byte [esp + 0x38], 0
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.005128e4
mov ecx, dword [esp + 0x30]
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret