joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x40288e
pop dword [ebp - 0x34]
mov eax, 0x34adea75
sub eax, 0x346dc1e7
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x354c75ff
add dword [ebp - 0x44], 0x1905cf4c
mov dword [ebp - 0x40], 0x508a58c1
sub dword [ebp - 0x40], 0x1e570c7c
mov dword [ebp - 0x3c], 0x20587bbb
sub dword [ebp - 0x3c], 0xd40c378d
mov dword [ebp - 0x38], 0xbcbb232f
add dword [ebp - 0x38], 0x4344dcd1
lea eax, [ebp - 0x44]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x64d8c116
add dword [ebp - 0x44], 0xf99a840
mov dword [ebp - 0x40], 0xe21e09e
sub dword [ebp - 0x40], 0xccb57f29
mov dword [ebp - 0x3c], 0xb342d955
add dword [ebp - 0x3c], 0xb02c9317
mov dword [ebp - 0x38], 0x61bdc65d
add dword [ebp - 0x38], 0x9e4239a3
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0xd02a577a
add eax, 0x3016295a
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x39c56
push 0
call eax
mov ecx, 0x218f5e2b
sub ecx, 0x218f0978
xor edx, edx
add edx, eax
mov ebx, 0x411000
add ebx, dword [ebp - 0x34]
mov esi, 0x7f86c5e2
add dword [ebp - 8], 0x4ae5da25
mov edi, dword [ebx]
xor dword [ebp - 0x10], 0x842de5f2
sub edi, esi
mov dword [ebp - 0x1c], 0xbfec21fd
mov dword [edx], edi
xor dword [ebp - 0x14], edx
add edx, 0xbd0230ec
sub edx, 0xbd0230e8
add ebx, 0x11558d34
sub ebx, 0x11558d30
loop 0x4029a1
add eax, 0xeb128b21
sub eax, 0xeb114582
xor ebx, ebx
add ebx, eax
add eax, 0x599302d3
sub eax, 0x599302ce
mov ecx, 0x400000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
je 0x42e072
nop
nop
nop
nop
mov ebx, 0x407ef8
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0xc236fa1
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x42e060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x42e0d2
mov ebx, 0x42cd70
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x22711b5a
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x401150
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x4011ab
cmp byte [esi + ebx - 1], 0xa
je 0x40117f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x405084], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x4016f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0xf0
mov edi, dword [0x405094]
mov esi, dword [ebp + 8]
test edi, edi
je 0x4018b0
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [0x405094]
movzx eax, al
bt eax, esi
jae 0x401910
mov ecx, dword [0x405084]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], ecx
je 0x4017b6
test byte [0x402018], 8
jne 0x401850
lea ebx, [esp + 0x28]
mov edi, ebx
test byte [0x402028], 8
jne 0x401800
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call dbg.sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x401785
cmp esi, 3
jbe 0x4017c0
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
mov dword [esp + 8], str._s:_s:_s
lea edx, [edi + 1]
mov dword [esp], eax
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x4030c0]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x401785
mov ecx, dword [0x405094]
test ecx, ecx
je 0x4018f0
mov dword [esp], 0x402028
call dword [0x405094]
test al, 8
je 0x40175c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call dbg.sprintf
add edi, eax
jmp 0x40175c
mov ebx, dword [0x405094]
test ebx, ebx
je 0x4018d0
mov dword [esp], 0x402018
call dword [0x405094]
test al, 8
je 0x401749
call dword [sym.imp.kernel32.dll_GetTickCount]
lea ebx, [esp + 0x28]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mov eax, 0x10624dd3
mov dword [esp], ebx
mul ecx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call dbg.sprintf
lea edi, [ebx + eax]
jmp 0x40174f
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x405094
call sym._load_func.part.0
jmp 0x401710
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x405094
call sym._load_func.part.0
jmp 0x40185a
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x405094
call sym._load_func.part.0
jmp 0x40180e
mov eax, 0xffffffff
jmp 0x4017b6
Function at 0x401a70
Capabilities:
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call dbg.wmain
mov dword [esp], eax
call sym._exit
Function at 0x528890
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xbf000]
push edi
jmp 0x5288aa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5288b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5288a0
mov eax, 1
add ebx, ebx
jne 0x5288c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5288d4
jne 0x5288f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5288f3
dec eax
add ebx, ebx
jne 0x5288e0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5288b8
add ebx, ebx
jne 0x5288ef
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x528945
xor ecx, ecx
sub eax, 3
jb 0x52890b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x52897a
sar eax, 1
mov ebp, eax
jmp 0x528916
add ebx, ebx
jne 0x528916
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5288e4
inc ecx
add ebx, ebx
jne 0x528924
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5288e4
add ebx, ebx
jne 0x528931
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x528926
jne 0x528942
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x528926
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x528964
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x528956
jmp 0x5288a6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x528964
add edi, ecx
jmp 0x5288a6
pop esi
mov edi, esi
mov ecx, 0x9335
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x528982
cmp byte [edi], 0x2a
jne 0x528982
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x528987
lea edi, [esi + 0x124000]
mov eax, dword [edi]
or eax, eax
je 0x5289ff
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x12f2ec]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x12f454]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5289b4
mov ecx, edi
jns 0x5289e3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x12f458]
or eax, eax
je 0x5289f9
mov dword [ebx], eax
add ebx, 4
jmp 0x5289d1
call dword [esi + 0x12f468]
mov ebp, dword [esi + 0x12f45c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x237]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x528a33
sub esp, 0xffffff80
jmp 0x4a8396
Function at 0x51431c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5ba480]
jne 0x514326
repz ret
jmp fcn.005145cd

Function at 0x514ef8
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x5ba464], 0
mov byte [0x5ba468], 0
mov dword [0x5ba458], 0x19f5
mov dword [0x5ba460], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x5ba458]
add eax, 0x1e60
mov dword [0x5ba45c], eax
mov esi, dword [0x5ba460]
add esi, 1
mov dword [0x5ba460], esi
cmp esi, 0x100
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], esi
jl 0x514f3d
xor eax, eax
mov ecx, 0x1a82
mov dword [0x5ba458], 0x1a82
mov dword [0x5ba460], 0
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
add eax, 0xffffe1b1
mov dword [0x5ba46c], 0
add ecx, 0xffffe791
mov dword [ebp - 0x30], eax
mov eax, edx
xor edi, edi
mov dword [ebp - 0x34], edx
mov edx, edi
mov edi, dword [ebp - 0x10]
div edi
mov ebx, dword [ebp - 0x30]
mov dword [0x5ba45c], ebx
mov ebx, dword [0x5ba464]
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp - 0x34]
movzx ecx, byte [edi + ecx]
add ecx, ebx
mov ebx, dword [ebp - 0x14]
movzx edx, byte [ebx + edx]
add ecx, edx
mov dword [0x5ba46c], ecx
mov eax, ecx
cdq
idiv esi
mov dword [0x5ba464], edx
mov ecx, dword [ebp - 0x34]
mov cl, byte [edi + ecx]
mov byte [0x5ba468], cl
mov esi, dword [ebp - 0x38]
mov dword [0x5ba45c], esi
mov cl, byte [edi + edx]
mov edx, dword [ebp - 0x34]
mov byte [edi + edx], cl
mov cl, byte [0x5ba468]
mov esi, dword [0x5ba464]
mov byte [edi + esi], cl
mov esi, dword [0x5ba460]
add esi, 1
mov dword [0x5ba460], esi
cmp esi, 0x100
mov dword [ebp - 0x3c], esi
jge 0x515072
mov eax, dword [0x5ba45c]
mov ecx, dword [0x5ba458]
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x2c], eax
jmp 0x514fa0
mov dword [0x5ba45c], 0x2635
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x51537e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x48
mov eax, dword [ebp + 8]
mov dword [0x5ba458], 0x15d2
mov dword [0x5ba45c], 0x1167
mov dword [ebp - 0x10], eax
call fcn.00514a6d
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov edi, edx
add edi, esi
mov esi, dword [eax + esi]
cmp esi, 0x4550
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edi
je 0x5153ce
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [0x5ba45c], 0xfffffc1e
mov eax, dword [eax + 0x78]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add ecx, dword [edx + eax + 0x20]
mov esi, dword [edx + eax + 0x24]
mov dword [0x5ba458], 0x901
mov edi, dword [edx + eax + 0x18]
cmp edi, 0
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], ebx
je 0x5154fe
jmp 0x5154a1
mov eax, dword [ebp - 0x38]
add eax, 1
mov cl, byte [ebp - 0x39]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x3a]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x40], eax
jne 0x515447
jmp 0x515498
mov eax, dword [ebp - 0x40]
mov ecx, eax
mov edx, dword [ebp - 0x44]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x39], bh
mov byte [ebp - 0x3a], cl
je 0x515498
jmp 0x51541d
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x4c]
xor edx, edx
mov esi, dword [ebp - 0x28]
mov edi, dword [esi + eax*4]
mov dword [0x5ba45c], 0x1167
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], edx
jmp 0x515447
mov al, byte [ebp - 0x3a]
test al, 1
jne 0x5154d9
jmp 0x5154b3
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x2c]
add ecx, edx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], eax
jmp 0x515472
xor eax, eax
mov ecx, dword [ebp - 0x54]
add ecx, 2
mov edx, dword [ebp - 0x50]
add edx, 1
mov esi, dword [ebp - 0x30]
cmp edx, esi
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x34], eax
jb 0x515472
jmp 0x5154fe
mov eax, dword [ebp - 0x54]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x24]
add edx, dword [edx + esi + 0x1c]
mov ecx, dword [edx + ecx*4]
mov dword [0x5ba45c], 0x1d20
mov edx, dword [ebp - 0x1c]
add edx, ecx
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x34]
add esp, 0x48
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5155d1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [0x5ba460], 0
mov dword [0x5ba464], 0
mov dword [0x5ba470], 0
mov dword [0x5ba458], 0x2448
cmp eax, 0
sete bl
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov byte [ebp - 0x1d], bl
xor eax, eax
mov ecx, 0x2448
mov dl, byte [ebp - 0x1d]
test dl, 1
mov esi, eax
mov edi, eax
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], eax
jne 0x515779
jmp 0x51566f
mov eax, dword [0x5ba460]
mov dword [ebp - 0x34], eax
mov eax, dword [0x5ba458]
mov ecx, dword [0x5ba464]
mov edx, dword [ebp - 0x34]
mov esi, dword [ebp - 0x38]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x30], esi
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x28]
mov edi, 0x100
mov dword [0x5ba45c], 0x264a
add ecx, 1
mov dword [ebp - 0x3c], eax
mov eax, ecx
mov dword [ebp - 0x40], edx
cdq
idiv edi
mov dword [0x5ba460], edx
mov ecx, dword [ebp - 0x40]
add ecx, 0xffffffa9
mov dword [0x5ba458], ecx
mov ecx, dword [ebp - 0x1c]
movzx ebx, byte [ecx + edx]
add ebx, esi
mov eax, ebx
mov dword [ebp - 0x44], edx
cdq
idiv edi
mov dword [0x5ba464], edx
mov esi, dword [ebp - 0x44]
mov cl, byte [ecx + esi]
mov byte [0x5ba468], cl
mov dword [0x5ba45c], 0x20ef
mov edi, dword [ebp - 0x1c]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov cl, byte [0x5ba468]
mov edx, dword [0x5ba464]
mov byte [edi + edx], cl
mov edx, dword [0x5ba458]
mov ebx, edx
add ebx, 0xffffe99b
mov dword [0x5ba45c], ebx
mov ebx, dword [0x5ba460]
movzx ebx, byte [edi + ebx]
mov ecx, dword [0x5ba464]
movzx ecx, byte [edi + ecx]
add ecx, ebx
and ecx, 0xff
mov dword [0x5ba470], ecx
mov dword [0x5ba45c], 0x1562
mov cl, byte [edi + ecx]
mov ebx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x3c]
mov ch, byte [ebx + esi]
add edx, 0x5a6
mov dword [0x5ba45c], edx
xor ch, cl
mov byte [0x5ba474], ch
mov dword [0x5ba458], 0x6a8
mov edx, dword [ebp - 0x18]
mov byte [edx + esi], ch
add esi, 1
mov edx, dword [ebp - 0x10]
cmp esi, edx
mov dword [ebp - 0x38], esi
jne 0x51564a
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x515824
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x90
lea eax, [esp + 0x28]
lea ecx, [esp + 0x38]
mov edx, dword [0x5ba458]
add edx, 0xffffef19
mov dword [0x5ba45c], edx
mov dword [esp], eax
mov dword [esp + 0x24], ecx
call fcn.0051508f
lea ecx, [esp + 0x38]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x5c], edx
mov dword [esp + 0x8c], 0x13c200
mov edx, dword [0x5ba444]
mov dword [esp + 0x80], edx
mov edx, dword [0x5ba448]
mov dword [esp + 0x84], edx
mov edx, dword [0x5ba44c]
mov dword [esp + 0x60], edx
mov edx, dword [0x5ba450]
mov dword [esp + 0x44], edx
mov edx, dword [0x5ba454]
add ecx, 0x50
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], ecx
lea eax, [0x515efe]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [ecx], edx
mov dword [0x5ba45c], 0x717
mov dword [0x5ba458], 0x127a
mov dword [esp + 0x14], eax
jmp 0x515917
mov eax, dword [esp + 0x10]
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0xc]
mov dword [esp + 0x3c], eax
mov dword [0x5ba458], 0x25db
mov ecx, dword [esp + 8]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0x40], edx
call fcn.00515987
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x10], ecx
je 0x51594e
jmp 0x5158dd
mov eax, dword [esp + 0x14]
cmp word [eax], 0x5a4d
mov dword [esp + 0xc], eax
jne 0x51593a
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 8], ecx
je 0x5158e5
mov eax, dword [esp + 0xc]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x14], eax
jmp 0x515917
lea eax, [esp + 0x38]
mov dword [0x5ba458], 0xf39
mov ecx, dword [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00515d92
mov ecx, esp
lea edx, [esp + 0x38]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov dword [esp + 0x10], eax
jmp 0x5158dd
Function at 0x515987
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x28
mov dword [ebp - 8], 0
mov dword [0x5ba458], 0xea1
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
xor ecx, ecx
mov dword [0x5ba458], 0x12cc
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], ecx
jmp 0x515a29
xor eax, eax
mov dword [0x5ba458], 0xffffe770
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
cmp word [ecx + edx*2 - 0x10], 0x6c
mov dword [ebp - 0x1c], eax
je 0x515ac4
jmp 0x515af4
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
cmp word [ecx + edx*2 - 0x18], 0x6f
mov dword [ebp - 0x1c], eax
je 0x515a76
jmp 0x515af4
mov eax, 0x19cd
mov ecx, dword [ebp - 0x20]
add ecx, 1
cmp ecx, 0x104
mov edx, ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x28], eax
jge 0x515a47
mov eax, dword [ebp - 0x14]
mov ecx, 0x1bd2
mov edx, dword [ebp - 0x10]
cmp word [edx + eax*2], 0
mov esi, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], ecx
jne 0x515a08
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
xor edx, edx
mov dword [0x5ba45c], eax
mov dword [0x5ba458], 0x6b6
mov eax, dword [ebp - 0x10]
cmp word [eax + ecx*2 - 0x1a], 0x6c
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
je 0x5159ef
jmp 0x515af4
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
cmp word [ecx + edx*2 - 0x16], 0x61
mov dword [ebp - 0x1c], eax
jne 0x515af4
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
cmp word [ecx + edx*2 - 0x14], 0x64
mov dword [ebp - 0x1c], eax
jne 0x515af4
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x12], 0x64
sete dl
mov byte [ebp - 0x29], dl
xor eax, eax
mov cl, byte [ebp - 0x29]
test cl, 1
mov dword [ebp - 0x1c], eax
jne 0x5159c8
jmp 0x515af4
xor eax, eax
mov dword [0x5ba458], 0x251c
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x1c], eax
jne 0x515af4
mov eax, 1
mov dword [0x5ba45c], 0x369d
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
add esp, 0x28
pop esi
pop ebp
ret
Function at 0x515d92
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x54
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [0x5ba458]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
xor eax, eax
mov ecx, dword [ebp - 0x30]
add ecx, 0xffffe61c
mov dword [0x5ba45c], ecx
mov dword [0x5ba458], 0x1cc
mov dword [ebp - 0x34], eax
jmp 0x515e06
xor eax, eax
add esp, 0x54
pop esi
pop ebp
ret
lea eax, [ebp - 0x24]
mov dword [0x5ba458], 0x179a
mov dword [ebp - 0x38], eax
call fcn.0051605a
mov dword [esp], eax
mov eax, dword [ebp - 0x38]
mov dword [esp + 4], eax
call fcn.00514bd8
cmp eax, 0
mov dword [ebp - 0x3c], eax
je 0x515dce
jmp 0x515e32
mov eax, dword [ebp - 0x34]
mov ecx, eax
add ecx, 1
mov dl, byte [eax + 0x573dda]
mov dh, byte [eax + 0x573dab]
sub dh, dl
mov byte [ebp + eax - 0x24], dh
cmp ecx, 0xe
mov dword [ebp - 0x34], ecx
je 0x515dd6
jmp 0x515e06
mov eax, dword [ebp - 0x3c]
mov dword [0x5ba45c], 0x12d8
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov ecx, dword [0x5ba45c]
add ecx, 0x206f
mov dword [0x5ba458], ecx
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x40], eax
call fcn.00514d9c
xor eax, eax
mov ecx, dword [ebp - 0x40]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [0x5ba458], 0x22f9
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov dword [0x5ba45c], 0x2203
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x44], ecx
mov ecx, dword [ebp - 0x40]
mov dword [edx + 0x40], ecx
mov esi, dword [0x5ba458]
add esi, 0xffffe791
mov dword [0x5ba458], esi
add ecx, 0x166c
mov esi, dword [ebp - 0x40]
cmp esi, 0
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x48], eax
je 0x515ef5
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
add esp, 0x54
pop esi
pop ebp
ret