joyce8/EMBER2024-capa huggingface dataset:
Function at 0x586691
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x58672e
push ebx
push esi
call fcn.0058677f
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00586243
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x5866db
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x58672d
push edi
push eax
call fcn.004f2bc0
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x5866fb
call fcn.00554e50
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x58672c
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00586243
add esp, 0x20
test eax, eax
jne 0x58671a
push edi
call fcn.00554e50
jmp 0x586722
push ebx
call fcn.00554e50
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x586731
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x586742
pop esi
ret
push ebx
push edi
push esi
call fcn.0058677f
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.004f2bc0
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x58676a
push ebx
push esi
push edi
call fcn.005670c0
add esp, 0xc
push 0
call fcn.00554e50
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x5867c1
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00586a2c
Function at 0x5b2eb0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
je 0x5b2ebf
dec eax
mov dword [ecx + 4], eax
pop ebp
jmp fcn.005b2ed0
Function at 0x5b37c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xb0
mov ebx, edx
mov dword [esp + 8], ecx
mov eax, dword [0x644040]
xor eax, ebp
mov dword [esp + 0xa8], eax
mov dword [esp + 0x20], 0xa
mov al, byte [0x649456]
test al, al
jne 0x5b39e9
xor edi, edi
dec edi
mov dword [esp + 0x98], edi
mov dword [esp + 0x9c], edi
mov dword [esp + 0xa0], edi
lea esi, [esp + 0x50]
mov ecx, ebx
push esi
call fcn.0041aec0
cmp byte [esi + 0xb], 0
mov dword [esp + 0xc], ebx
js 0x5b38aa
mov eax, dword [esp + 0x58]
mov dword [esp + 0xa0], eax
movq xmm0, qword [esp + 0x50]
movq qword [esp + 0x98], xmm0
lea ebx, [esp + 0x50]
mov ecx, ebx
call fcn.0055ac70
lea esi, [esp + 0x8c]
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov ecx, dword [esp + 0xc]
push esi
call fcn.005bad40
pxor xmm0, xmm0
movq qword [ebx + 0x34], xmm0
pxor xmm0, xmm0
movdqu xmmword [ebx + 0x24], xmm0
mov dword [ebx], 0x3c
mov dword [ebx + 4], 0x40
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], str.runas
cmp byte [esp + 0xa3], 0
js 0x5b38c0
lea ecx, [esp + 0x98]
jmp 0x5b38c7
lea ecx, [esp + 0x98]
push dword [esp + 0x54]
push dword [esp + 0x54]
call fcn.0050b0a0
jmp 0x5b3844
mov ecx, dword [esp + 0x98]
mov edi, dword [esp + 8]
mov al, byte [ebp + 8]
mov dword [esp + 0x60], ecx
cmp byte [esp + 0x97], 0
jns 0x5b38e3
mov esi, dword [esp + 0x8c]
mov dword [esp + 0x64], esi
xor esi, esi
mov dword [esp + 0x68], esi
xor al, 1
movzx eax, al
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], esi
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x5b3968
cmp byte [ebp + 0xc], 0
je 0x5b3961
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x20]
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea esi, [esp + 0x10]
push 0x9f
push str.launch_win.cc
push str.LaunchElevatedProcess
push esi
call fcn.0050b300
add esp, 0x10
mov ecx, ebx
push 0
push esi
call fcn.005221a0
push 0xffffffffffffffff
push dword [esp + 0x8c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, ebx
lea ebx, [esp + 0x50]
call fcn.00540b60
mov esi, dword [esp + 0x88]
mov ecx, edi
push esi
call fcn.004108c0
cmp byte [esp + 0x97], 0
jns 0x5b3989
push dword [esp + 0x8c]
call fcn.00562bc0
add esp, 4
cmp byte [esp + 0xa3], 0
jns 0x5b39a2
push dword [esp + 0x98]
call fcn.00562bc0
add esp, 4
mov dword [esp + 0x20], 0xa
mov al, byte [0x649456]
test al, al
jne 0x5b39cb
mov ecx, dword [esp + 0xa8]
xor ecx, ebp
call fcn.00565ea5
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
movzx eax, al
mov dword [esp + 0x50], 0
lea ecx, [esp + 0x20]
push 2
push ebx
push ecx
push eax
call fcn.0058fbc0
add esp, 0x10
jmp 0x5b39b3
movzx eax, al
lea ecx, [esp + 0x50]
mov dword [ecx], str.LaunchElevatedProcess
lea edx, [esp + 0x20]
push 1
push ecx
push edx
push eax
call fcn.0058fbc0
add esp, 0x10
jmp 0x5b37f8
Function at 0x5d2560
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov eax, dword [0x644040]
xor eax, ebp
mov dword [esp + 0x78], eax
lea esi, [esp + 0x1c]
mov dword [esi], 0xffffffff
mov edx, esi
call fcn.0044bf00
mov ebx, dword [esi]
mov edi, 3
mov esi, dword [ebp + 8]
test ebx, ebx
jne 0x5d25cd
lea ecx, [esp + 0x1c]
call fcn.0044b6d0
test esi, esi
je 0x5d25b6
mov ecx, esi
call fcn.005e3050
push esi
call fcn.00562bc0
add esp, 4
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.00565ea5
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
lea edi, [ebp + 8]
mov al, byte [esi + 0x1c]
mov byte [esp + 0xc], al
xor eax, eax
push eax
call fcn.00578bab
add esp, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], edx
mov esi, dword [edi]
lea eax, [esi + 0xc]
mov dword [esp + 0x10], eax
lea edi, [esp + 0x20]
mov ecx, edi
call fcn.005e2f60
movups xmm0, xmmword [esi + 0x38]
movaps xmmword [edi], xmm0
lea edi, [esp + 0x30]
mov ecx, edi
push dword [esp + 0x10]
call fcn.00543610
mov eax, dword [esp + 0x14]
mov dword [edi + 0x1c], eax
mov eax, dword [esp + 0x18]
mov dword [edi + 0x18], eax
xor eax, eax
mov dword [edi + 0x40], eax
mov al, byte [esp + 0xc]
mov byte [edi + 0x35], al
lea ecx, [ebx + 0x28]
lea edx, [esp + 0x20]
call fcn.005d3cd0
mov byte [ebx + 0x24], 1
cmp byte [edi + 0x17], 0
jns 0x5d2650
push dword [esp + 0x3c]
call fcn.00562bc0
add esp, 4
cmp byte [esp + 0x3b], 0
jns 0x5d2663
push dword [esp + 0x30]
call fcn.00562bc0
add esp, 4
lea ecx, [esi + 8]
lea eax, [esp + 0x20]
push eax
call fcn.005d2720
cmp byte [esp + 0x2b], 0
jns 0x5d2683
push dword [esp + 0x20]
call fcn.00562bc0
add esp, 4
mov edi, dword [esi + 0x20]
mov ebx, dword [esi + 0x24]
jmp 0x5d2695
mov ecx, dword [edi]
call fcn.005e4510
add edi, 4
cmp edi, ebx
jne 0x5d268b
lea eax, [esi + 0x38]
mov dword [esp + 0xc], eax
mov ebx, dword [esi + 0x2c]
mov edi, dword [esi + 0x30]
jmp 0x5d26ca
mov ecx, ebx
lea eax, [esp + 0x20]
push eax
call fcn.005d2720
cmp byte [esp + 0x2b], 0
jns 0x5d26c7
push dword [esp + 0x20]
call fcn.00562bc0
add esp, 4
add ebx, 0x14
cmp ebx, edi
jne 0x5d26a8
mov eax, dword [esp + 0xc]
movups xmm0, xmmword [eax]
mov eax, dword [ebp + 0xc]
movups xmmword [eax], xmm0
xor edi, edi
push edi
call fcn.005d7d30
add esp, 4
mov eax, dword [esi]
mov ecx, dword [eax + 4]
mov ecx, dword [ecx + 4]
lea ebx, [eax + ecx]
add ebx, 4
mov eax, dword [ebx]
mov ecx, dword [eax]
mov dword [esp + 0xc], ecx
call dword [0x63e1bc]
mov ecx, ebx
push 2
push edi
push edi
call dword [esp + 0x18]
push edx
push eax
call fcn.005d7d90
add esp, 8
jmp 0x5d2599
Function at 0x5d2860
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x644040]
xor eax, ebp
mov dword [ebp - 0x10], eax
movups xmm0, xmmword [edx]
movups xmmword [ebp - 0x20], xmm0
mov esi, dword [ecx + 0x28]
mov ebx, dword [ecx + 0x2c]
cmp esi, ebx
je 0x5d28a3
mov dword [ebp - 0x24], ecx
lea edi, [ebp - 0x20]
mov ecx, esi
push edi
call fcn.005e5260
test al, al
jne 0x5d289d
add esi, 0x58
cmp esi, ebx
jne 0x5d288a
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax + 0x2c]
cmp esi, ebx
je 0x5d28da
cmp byte [esi + 0x1b], 0
js 0x5d28b2
lea eax, [esi + 0x10]
jmp 0x5d28b5
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
xor edi, edi
inc edi
cmp eax, 0xffffffff
cmovne edi, ecx
test edi, edi
jne 0x5d28dd
mov eax, dword [ebp + 8]
mov dword [eax], esi
xor edi, edi
jmp 0x5d28dd
xor edi, edi
inc edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00565ea5
mov eax, edi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x5d2a20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x644040]
xor eax, ebp
mov dword [ebp - 0x10], eax
movups xmm0, xmmword [edx]
movups xmmword [ebp - 0x20], xmm0
mov edi, dword [ecx + 0x28]
mov esi, dword [ecx + 0x2c]
cmp edi, esi
je 0x5d2a63
mov dword [ebp - 0x24], ecx
lea ebx, [ebp - 0x20]
mov ecx, edi
push ebx
call fcn.005e5260
test al, al
jne 0x5d2a5d
add edi, 0x58
cmp edi, esi
jne 0x5d2a4a
mov ecx, dword [ebp - 0x24]
mov esi, dword [ecx + 0x2c]
xor ebx, ebx
inc ebx
cmp edi, esi
je 0x5d2ab3
mov eax, dword [edi + 0x50]
cmp eax, dword [ebp + 8]
jne 0x5d2aa7
cmp byte [edi + 0x1b], 0
js 0x5d2a7f
mov esi, ecx
lea eax, [edi + 0x10]
jmp 0x5d2a84
mov esi, ecx
mov eax, dword [edi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x5d2ab3
shr eax, 3
and eax, 2
mov ebx, eax
jne 0x5d2ab3
mov eax, dword [ebp + 0xc]
mov byte [esi + 0x24], 1
mov dword [eax], edi
xor ebx, ebx
jmp 0x5d2ab3
xor ecx, ecx
cmp eax, 1
sete cl
lea ebx, [ecx + ecx*2]
inc ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00565ea5
mov eax, ebx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5e0d70
Capabilities:
Terminate process

Disassembly:
cmp dword [ecx + 8], 0
mov eax, dword [ecx]
je 0x5e0d86
push ebp
mov ebp, esp
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop ebp
ret
test eax, eax
jne 0x5e0d78
cmp dword [ecx + 0xc], 0
jne 0x5e0d78
cmp dword [ecx + 4], 0
jne 0x5e0d78
jmp 0x5e0d85
Function at 0x5e4ab0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xa4
mov edi, dword [ebp + 8]
mov eax, dword [0x644040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x5e4ad3
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x5e4af7
mov ebx, eax
mov al, byte [ebp + 0xc]
mov ecx, ebx
shr ecx, 0xa
xor al, 1
test cl, al
jne 0x5e4b4b
and ebx, 0x10
shr ebx, 4
jmp 0x5e4b4d
push 2
call fcn.00538880
add esp, 4
test al, al
je 0x5e4b4b
call fcn.004f27f0
lea esi, [ebp - 0xb0]
mov ecx, esi
push eax
push 2
push 0x80
push str.filesystem_win.cc
call fcn.0045af70
lea eax, [ebp - 0xa8]
push 0x12
push str.GetFileAttributes
push eax
call fcn.00538a30
add esp, 0xc
push edi
push eax
call fcn.005baa80
add esp, 8
mov ecx, esi
call fcn.0044fb10
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00565ea5
mov eax, ebx
add esp, 0xa4
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x5e4b70
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xa4
mov edi, dword [ebp + 8]
mov eax, dword [0x644040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x5e4b93
mov eax, dword [edi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
jne 0x5e4c08
cmp byte [ebp + 0x10], 0
je 0x5e4bb5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x5e4c1f
push 2
call fcn.00538880
add esp, 4
test al, al
je 0x5e4c06
call fcn.004f27f0
lea esi, [ebp - 0xb0]
mov ecx, esi
push eax
push 2
push 0x61
push str.filesystem_win.cc
call fcn.0045af70
lea eax, [ebp - 0xa8]
push 0x10
push str.CreateDirectory
push eax
call fcn.00538a30
add esp, 0xc
push edi
push eax
call fcn.005baa80
add esp, 8
mov ecx, esi
call fcn.0044fb10
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00565ea5
mov eax, ebx
add esp, 0xa4
pop esi
pop edi
pop ebx
pop ebp
ret
push 1
push edi
call fcn.005e4ab0
add esp, 8
test al, al
jne 0x5e4c08
push 2
call fcn.00538880
add esp, 4
test al, al
je 0x5e4c06
lea esi, [ebp - 0xb0]
mov ecx, esi
push 2
push 0x5c
push str.filesystem_win.cc
call fcn.0040b630
lea eax, [ebp - 0xa8]
push edi
push eax
call fcn.005baa80
add esp, 8
push 0x10
push str._not_a_directory
push eax
call fcn.00538a30
add esp, 0xc
mov ecx, esi
call fcn.0040ae00
jmp 0x5e4c06
Function at 0x5e4c80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xa4
mov edi, dword [ebp + 8]
mov eax, dword [0x644040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x5e4ca3
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x5e4cce
test eax, 0x410
sete bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00565ea5
mov eax, ebx
add esp, 0xa4
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.00538880
add esp, 4
test al, al
je 0x5e4d1f
call fcn.004f27f0
lea esi, [ebp - 0xb0]
mov ecx, esi
push eax
push 2
push 0x73
push str.filesystem_win.cc
call fcn.0045af70
lea eax, [ebp - 0xa8]
push 0x12
push str.GetFileAttributes
push eax
call fcn.00538a30
add esp, 0xc
push edi
push eax
call fcn.005baa80
add esp, 8
mov ecx, esi
call fcn.0044fb10
xor ebx, ebx
jmp 0x5e4cb7

Function at 0x5e4d30
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xa4
mov esi, dword [ebp + 8]
mov eax, dword [0x644040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x5e4d53
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
sete cl
not eax
test eax, 0x410
setne al
or al, cl
je 0x5e4df6
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x5e4d7c
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov bl, 1
test eax, eax
jne 0x5e4ddf
push 2
call fcn.00538880
add esp, 4
test al, al
je 0x5e4ddd
call fcn.004f27f0
lea edi, [ebp - 0xb0]
mov ecx, edi
push eax
push 2
push 0x93
push str.filesystem_win.cc
call fcn.0045af70
lea eax, [ebp - 0xa8]
push 0xb
push str.DeleteFile
push eax
call fcn.00538a30
add esp, 0xc
push esi
push eax
call fcn.005baa80
add esp, 8
mov ecx, edi
call fcn.0044fb10
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00565ea5
mov eax, ebx
add esp, 0xa4
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00565ea5
mov ecx, esi
add esp, 0xa4
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.005e4e20

Function at 0x5e4e20
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xa4
mov esi, ecx
mov eax, dword [0x644040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x5e4e42
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov edi, eax
test eax, eax
je 0x5e4e6b
test edi, edi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00565ea5
mov eax, ebx
add esp, 0xa4
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.00538880
add esp, 4
test al, al
je 0x5e4e4f
call fcn.004f27f0
lea ebx, [ebp - 0xb0]
mov ecx, ebx
push eax
push 2
push 0x2f
push str.filesystem_win.cc
call fcn.0045af70
lea eax, [ebp - 0xa8]
push 0x10
push str.RemoveDirectory
push eax
call fcn.00538a30
add esp, 0xc
push esi
push eax
call fcn.005baa80
add esp, 8
mov ecx, ebx
call fcn.0044fb10
jmp 0x5e4e4f
Function at 0x5eb7e0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xa8
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [0x644040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ecx + 8], edi
mov eax, dword [0x658734]
mov ecx, dword [0x64784c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x5eba3e
mov ecx, dword [0x658730]
test ecx, ecx
je 0x5eb8f6
lea ebx, [ebp - 0x14]
mov dword [ebx], 0xffffffff
call dword [0x63e1bc]
push ebx
push edi
call ecx
test eax, eax
je 0x5eb8af
cmp dword [ebp - 0x14], 0
setne byte [esi + 0x5d]
je 0x5eb8fa
mov byte [esi + 0x5c], 0
lea eax, [esi + 0x30]
lea ebx, [esi + 0x28]
mov ecx, edi
mov edx, esi
push eax
push ebx
call fcn.005eba90
add esp, 8
test al, al
jne 0x5eb988
push 2
call fcn.00538880
add esp, 4
test al, al
je 0x5eb96d
lea esi, [ebp - 0xb4]
mov ecx, esi
push 2
push 0x244
push str.process_info.cc
call fcn.0040b630
lea eax, [ebp - 0xac]
push 0x21
push str.GetProcessBasicInformation_failed
jmp 0x5eb95d
push 2
call fcn.00538880
add esp, 4
test al, al
je 0x5eb8f6
call fcn.004f27f0
lea ebx, [ebp - 0xb4]
mov ecx, ebx
push eax
push 2
push 0x4e
push str.process_info.cc
call fcn.0045af70
lea eax, [ebp - 0xac]
push 0xe
push 0x633b2c
push eax
call fcn.00538a30
add esp, 0xc
mov ecx, ebx
call fcn.0044fb10
mov byte [esi + 0x5d], 0
pcmpeqd xmm0, xmm0
lea ebx, [ebp - 0xb4]
movdqu xmmword [ebx + 0x10], xmm0
movdqu xmmword [ebx], xmm0
mov dword [ebx + 0x20], 0xffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebx], 9
sete byte [esi + 0x5c]
jne 0x5eb856
push 2
call fcn.00538880
add esp, 4
test al, al
je 0x5eb96d
lea esi, [ebp - 0xb4]
mov ecx, esi
push 2
push 0x236
push str.process_info.cc
call fcn.0040b630
lea eax, [ebp - 0xac]
push 0x32
push str.Reading_x64_process_from_x86_process_not_supported
push eax
call fcn.00538a30
add esp, 0xc
mov ecx, esi
call fcn.0040ae00
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00565ea5
mov eax, ebx
add esp, 0xa8
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov edx, dword [esi + 0x28]
mov eax, dword [esi + 0x2c]
cmp byte [esi + 0x5c], 1
je 0x5eb99f
mov ecx, edi
push esi
push eax
call fcn.005ec1c0
jmp 0x5eb9a8
mov ecx, edi
push esi
push eax
call fcn.005ebbb0
add esp, 8
test al, al
jne 0x5eb9e8
push 2
call fcn.00538880
add esp, 4
test al, al
je 0x5eb96d
lea esi, [ebp - 0xb4]
mov ecx, esi
push 2
push 0x24d
push str.process_info.cc
call fcn.0040b630
lea eax, [ebp - 0xac]
push 0x16
push str.ReadProcessData_failed
jmp 0x5eb95d
movzx edx, byte [esi + 0x5c]
mov ecx, edi
push esi
call fcn.005eae20
add esp, 4
mov bl, 1
test al, al
jne 0x5eb96f
push 2
call fcn.00538880
add esp, 4
test al, al
je 0x5eb96d
lea esi, [ebp - 0xb4]
mov ecx, esi
push 2
push 0x252
push str.process_info.cc
call fcn.0040b630
lea eax, [ebp - 0xac]
push 0x15
push str.ReadMemoryInfo_failed
jmp 0x5eb95d
push 0x658734
call fcn.00562c08
add esp, 4
cmp dword [0x658734], 0xffffffff
jne 0x5eb81f
push 0
push str.::IsWow64Process
push 0x62339e
call fcn.004f4c00
add esp, 0xc
mov dword [0x658730], eax
push 0x658734
call fcn.00562c57
add esp, 4
jmp 0x5eb81f
Function at 0x5f5d80
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.005e4d30
Function at 0x5f8da0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x644040]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
lea esi, [ebp - 0x14]
mov dword [esi], eax
lea edi, [ebp - 0x18]
mov dword [edi], eax
lea eax, [ebp - 0x1c]
mov dword [eax], 4
push eax
push edi
push esi
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esi]
xor ecx, 4
or ecx, eax
sete bl
jne 0x5f8dea
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00565ea5
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x5f8e90
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0xc4
mov eax, dword [0x644040]
xor eax, ebp
mov dword [ebp - 0xc], eax
pcmpeqd xmm0, xmm0
lea esi, [ebp - 0x30]
movdqu xmmword [esi + 0x10], xmm0
movdqu xmmword [esi], xmm0
mov dword [esi + 0x20], 0xffffffff
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [esi + 0x14], 0x100
jb 0x5f8f10
push 1
call fcn.00538880
add esp, 4
test al, al
je 0x5f8f10
lea esi, [ebp - 0xcc]
mov ecx, esi
push 1
push 0x10a
push str.system_snapshot_win.cc
call fcn.0040b630
lea eax, [ebp - 0xc4]
push 0x2c
push str.dwNumberOfProcessors_exceeds_uint8_t_storage
push eax
call fcn.00538a30
add esp, 0xc
mov ecx, esi
call fcn.0040ae00
mov eax, dword [ebp - 0x1c]
cmp eax, 0x100
mov ebx, 0xff
cmovb ebx, eax
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00565ea5
mov eax, ebx
add esp, 0xc4
pop esi
pop ebx
pop ebp
ret
Function at 0x60a6a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xe8
mov dword [ebp - 0xf4], edx
mov esi, ecx
mov eax, dword [0x644040]
xor eax, ebp
mov dword [ebp - 0x10], eax
pcmpeqd xmm0, xmm0
lea ebx, [ebp - 0x50]
movdqu xmmword [ebx + 0x30], xmm0
movdqu xmmword [ebx + 0x20], xmm0
movdqu xmmword [ebx + 0x10], xmm0
movdqu xmmword [ebx], xmm0
lea edi, [ecx + 0x10]
mov ecx, edi
call fcn.005932e0
mov ecx, esi
push ebx
push 0
push 0x40
push edx
push eax
call fcn.006111b0
test al, al
je 0x60a79e
movzx eax, word [ebp - 0x50]
cmp eax, 0x5a4d
jne 0x60a764
mov ecx, edi
call fcn.005932e0
mov ecx, dword [ebp - 0x14]
mov edi, ecx
sar edi, 0x1f
add eax, ecx
adc edi, edx
mov ecx, esi
mov ebx, dword [ebp - 0xf4]
push ebx
push 0
push 0x108
push edi
mov dword [ebp - 0xf0], eax
push eax
call fcn.006111b0
test al, al
je 0x60a813
cmp dword [ebx], 0x4550
jne 0x60a849
mov eax, dword [ebp + 8]
mov bl, 1
test eax, eax
je 0x60a7fc
mov ecx, dword [ebp - 0xf0]
mov dword [eax], ecx
mov dword [eax + 4], edi
jmp 0x60a7fc
push 1
call fcn.00538880
add esp, 4
test al, al
je 0x60a7fa
lea edi, [ebp - 0xec]
mov ecx, edi
push 1
push 0x15a
push str.pe_image_reader.cc
call fcn.0040b630
lea eax, [ebp - 0xe4]
push 0x21
push str.invalid_e_magic_in_dos_header_of
jmp 0x60a7d2
push 1
call fcn.00538880
add esp, 4
test al, al
je 0x60a7fa
lea edi, [ebp - 0xec]
mov ecx, edi
push 1
push 0x154
push str.pe_image_reader.cc
call fcn.0040b630
lea eax, [ebp - 0xe4]
push 0x1f
push str.could_not_read_dos_header_from
push eax
call fcn.00538a30
add esp, 0xc
movsx ecx, byte [esi + 0xb]
test ecx, ecx
jns 0x60a7e8
mov ecx, dword [esi + 4]
mov esi, dword [esi]
push ecx
push esi
push eax
call fcn.00538a30
add esp, 0xc
mov ecx, edi
call fcn.0040ae00
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00565ea5
mov eax, ebx
add esp, 0xe8
pop esi
pop edi
pop ebx
pop ebp
ret
push 1
call fcn.00538880
add esp, 4
test al, al
je 0x60a7fa
lea edi, [ebp - 0xec]
mov ecx, edi
push 1
push 0x162
push str.pe_image_reader.cc
call fcn.0040b630
lea eax, [ebp - 0xe4]
push 0x1f
push str.could_not_read_nt_headers_from
jmp 0x60a7d2
push 1
call fcn.00538880
add esp, 4
test al, al
je 0x60a7fa
lea edi, [ebp - 0xec]
mov ecx, edi
push 1
push 0x168
push str.pe_image_reader.cc
call fcn.0040b630
lea eax, [ebp - 0xe4]
push 0x23
push str.invalid_signature_in_nt_headers_of
jmp 0x60a7d2