joyce8/EMBER2024-capa huggingface dataset:
Function at 0x506510
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x567a20
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x5d21e8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x18], ebx
push 0
mov dword [ebp - 0x14], 0
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QObject::constructor_class_QObject__]
mov dword [ebx], vtable.Morpho::Logging.0
mov dword [ebx + 8], 2
mov dword [ebp - 4], 0
mov dword [ebx + 0xc], 0
lea esi, [ebx + 0x10]
mov dword [esi], 0x56f360
mov dword [ebp - 0x1c], esi
mov dword [esi + 0x10], 0x56f368
mov dword [esi + 0x70], 0
mov dword [esi + 0x90], 0
mov dword [esi + 0x94], 0
mov dword [esi + 0x98], 0
mov dword [esi + 0x68], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
lea ebx, [esi + 0x18]
mov byte [ebp - 4], 2
push 0
push ebx
mov ecx, esi
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x10], ebx
call fcn.00436000
mov eax, dword [esi]
push 8
mov dword [ebp - 4], 3
mov eax, dword [eax + 4]
mov dword [esi + eax], vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ecx + esi - 4], eax
mov dword [ebx], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0053274c
mov edi, eax
add esp, 4
test edi, edi
je 0x506609
push 1
mov byte [ebp - 4], 4
call fcn.00519161
add esp, 4
mov dword [edi + 4], eax
jmp 0x50660b
xor edi, edi
lea eax, [esi + 0x18]
mov dword [eax + 0x34], edi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
lea edi, [eax + 0x14]
mov dword [eax + 0x1c], edi
lea ecx, [eax + 0x18]
mov dword [eax + 0x20], ecx
lea edx, [eax + 0x24]
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov dword [eax], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov dword [eax + 0x38], 0
mov dword [eax + 0x3c], 0
mov eax, dword [ebp - 0x18]
mov dword [eax + 0xc0], 0
mov dword [eax + 0xc4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x50b2e0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56850e
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x5d21e8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], 0
mov esi, dword [ebp + 8]
mov ecx, esi
push 0x5d1f98
mov dword [ebp - 4], 0
call fcn.00422890
lea eax, [ebp - 0x34]
mov dword [ebp - 4], 0
push eax
mov dword [ebp - 0x10], 1
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [ebp - 0x34]
cmp eax, 9
jne 0x50b34d
push 3
push 0x5a0318
jmp 0x50b366
cmp eax, 6
jne 0x50b35b
push 0xd
push str.Intel_Itanium
jmp 0x50b366
test eax, eax
jne 0x50b36d
push 3
push 0x5a032c
mov ecx, esi
call fcn.00423620
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x50b7b0
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5685f0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c0
mov eax, dword [0x5d21e8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x50], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x50b804
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x44]
shrd ecx, eax, 0x14
mov eax, ecx
jmp 0x50b960
push 0
lea ecx, [ebp - 0xb8]
call fcn.00502d30
mov edi, eax
mov ebx, dword [sym.imp.QtCore4.dll_private:_static_struct_QString::Data____cdecl_QString::fromAscii_helper_char_const___int_]
push ecx
mov esi, esp
mov dword [ebp - 4], 2
push 0xffffffffffffffff
push str.getRamSizeFailed
call ebx
add esp, 8
mov dword [esi], eax
mov ecx, edi
call fcn.00505810
sub esp, 0x10
mov edi, eax
mov esi, esp
mov dword [ebp - 0x1c8], esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QVariant::constructor_unsigned_int_]
push ecx
mov esi, esp
mov byte [ebp - 4], 3
push 0xffffffffffffffff
push str.errorCode
call ebx
add esp, 8
mov dword [esi], eax
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.00504e80
mov edi, eax
lea eax, [ebp - 0x1cc]
push eax
call fcn.0050b770
sub esp, 0xc
mov byte [ebp - 4], 4
mov ecx, esp
mov dword [ebp - 0x1c4], esp
push eax
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QVariant::constructor_class_QString_const__]
push ecx
mov esi, esp
mov byte [ebp - 4], 5
push 0xffffffffffffffff
push str.error
call ebx
add esp, 8
mov dword [esi], eax
mov ecx, edi
mov byte [ebp - 4], 4
call fcn.00504e80
push 4
mov ecx, eax
call fcn.00504e60
push ecx
mov esi, esp
mov edi, eax
push 0xffffffffffffffff
push str.SystemInfoWin
call ebx
add esp, 8
mov dword [esi], eax
mov ecx, edi
call fcn.00505760
push 0x357
mov ecx, eax
call fcn.00504e70
sub esp, 0x68
mov edi, eax
mov ebx, esp
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x1c4], esp
push str.Amazon::SystemInfo::getMBytesRAM
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QVariant::constructor_char_const__]
push ecx
mov esi, esp
mov byte [ebp - 4], 6
push 0xffffffffffffffff
push 0x56e5f8
call dword [sym.imp.QtCore4.dll_private:_static_struct_QString::Data____cdecl_QString::fromAscii_helper_char_const___int_]
add esp, 8
mov dword [esi], eax
mov ecx, edi
mov byte [ebp - 4], 4
call fcn.00504e80
push eax
mov ecx, ebx
call fcn.00425d30
lea ecx, [ebp - 0x1c0]
call fcn.00425bf0
lea ecx, [ebp - 0x1c0]
call fcn.005066c0
lea ecx, [ebp - 0x1cc]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
lea ecx, [ebp - 0xb8]
call fcn.00502f90
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005329db
mov esp, ebp
pop ebp
ret
Function at 0x50d010
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5d21e8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x208]
mov dword [ebp - 0x20c], esi
push eax
mov dword [ebp - 0x20c], 0x101
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push 0xffffffffffffffff
lea eax, [ebp - 0x208]
push eax
push esi
call dword [sym.imp.QtCore4.dll_public:_static_class_QString___cdecl_QString::fromWCharArray_wchar_t_const___int_]
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, esi
xor ecx, ebp
pop esi
call fcn.005329db
mov esp, ebp
pop ebp
ret
Function at 0x50d070
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5689a0
mov eax, dword fs:[0]
push eax
sub esp, 0x59c
mov eax, dword [0x5d21e8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x105
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x5a4], 0xd3fcab12
push eax
push 0
push 0
lea eax, [ebp - 0x5a4]
push eax
push 0x105
lea eax, [ebp - 0x428]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
jne 0x50d23a
push eax
lea ecx, [ebp - 0x490]
call fcn.00502d30
mov edi, eax
mov ebx, dword [sym.imp.QtCore4.dll_private:_static_struct_QString::Data____cdecl_QString::fromAscii_helper_char_const___int_]
push ecx
mov esi, esp
mov dword [ebp - 4], 0
push 0xffffffffffffffff
push str.getVolumeInformationFailed
call ebx
add esp, 8
mov dword [esi], eax
mov ecx, edi
call fcn.00505810
sub esp, 0x10
mov edi, eax
mov esi, esp
mov dword [ebp - 0x5a0], esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QVariant::constructor_unsigned_int_]
push ecx
mov esi, esp
mov byte [ebp - 4], 1
push 0xffffffffffffffff
push str.errorCode
call ebx
add esp, 8
mov dword [esi], eax
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.00504e80
mov edi, eax
lea eax, [ebp - 0x5a8]
push eax
call fcn.0050b770
sub esp, 0xc
mov byte [ebp - 4], 2
mov ecx, esp
mov dword [ebp - 0x59c], esp
push eax
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QVariant::constructor_class_QString_const__]
push ecx
mov esi, esp
mov byte [ebp - 4], 3
push 0xffffffffffffffff
push str.error
call ebx
add esp, 8
mov dword [esi], eax
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.00504e80
push 4
mov ecx, eax
call fcn.00504e60
push ecx
mov esi, esp
mov edi, eax
push 0xffffffffffffffff
push str.SystemInfoWin
call ebx
add esp, 8
mov dword [esi], eax
mov ecx, edi
call fcn.00505760
push 0x36b
mov ecx, eax
call fcn.00504e70
sub esp, 0x68
mov edi, eax
mov ebx, esp
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x59c], esp
push str.Amazon::SystemInfo::getVolumeId
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QVariant::constructor_char_const__]
push ecx
mov esi, esp
mov byte [ebp - 4], 4
push 0xffffffffffffffff
push 0x56e5f8
call dword [sym.imp.QtCore4.dll_private:_static_struct_QString::Data____cdecl_QString::fromAscii_helper_char_const___int_]
add esp, 8
mov dword [esi], eax
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.00504e80
push eax
mov ecx, ebx
call fcn.00425d30
lea ecx, [ebp - 0x598]
call fcn.00425bf0
lea ecx, [ebp - 0x598]
call fcn.005066c0
lea ecx, [ebp - 0x5a8]
call dword [sym.imp.QtCore4.dll_public:_void___thiscall_QString::destructor_void_]
lea ecx, [ebp - 0x490]
call fcn.00502f90
mov eax, 0xd3fcab12
jmp 0x50d240
mov eax, dword [ebp - 0x5a4]
xor edx, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005329db
mov esp, ebp
pop ebp
ret
Function at 0x52fa70
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56b300
mov eax, dword fs:[0]
push eax
sub esp, 0x290
mov eax, dword [0x5d21e8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x18]
mov ebx, dword [ebp + 0x1c]
mov dword [ebp - 0x298], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x29c], ecx
lea ecx, [ebp - 0x28]
push eax
call fcn.004259d0
cmp dword [ebp - 0x18], 0
mov dword [ebp - 4], 0
je 0x52fb1f
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x18]
cmovae eax, edx
cmp word [eax + ecx*2 - 2], 0x5c
mov ecx, dword [ebp - 0x14]
je 0x52fb18
cmp ecx, 8
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 0x18]
cmovae eax, edx
cmp word [eax + ecx*2 - 2], 0x2f
mov ecx, dword [ebp - 0x14]
je 0x52fb18
cmp ecx, 8
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 0x18]
cmovae eax, edx
cmp word [eax + ecx*2 - 2], 0x3a
jne 0x52fb1f
mov edx, 0x5a273c
jmp 0x52fb24
mov edx, 0x5a2734
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x294], eax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x52fb30
sub ecx, dword [ebp - 0x294]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.00503cd0
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x290]
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, dword [ebp - 0x298]
mov dword [ecx], eax
cmp eax, 0xffffffff
jne 0x52fbab
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ecx], 0
call edi
cmp eax, 2
je 0x52fb9d
call edi
cmp eax, 0x12
je 0x52fb9d
call edi
mov edi, eax
call fcn.0052c940
mov dword [esi], edi
jmp 0x52fc81
xor edi, edi
call fcn.0052c940
mov dword [esi], edi
jmp 0x52fc81
lea edx, [ebp - 0x264]
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x52fbb4
sub edx, ecx
lea eax, [ebp - 0x264]
mov ecx, dword [ebp - 0x29c]
sar edx, 1
push edx
push eax
call fcn.00503d40
mov eax, dword [ebp - 0x290]
test eax, 0x400
je 0x52fbf4
mov dword [edi], 0
mov dword [ebx], 0
jmp 0x52fc76
test al, 0x10
je 0x52fc06
mov dword [edi], 3
mov dword [ebx], 3
jmp 0x52fc12
mov dword [edi], 2
mov dword [ebx], 2
xor eax, eax
mov dword [ebp - 0x30], 0
lea ecx, [ebp - 0x264]
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x52fc30
sub ecx, edx
lea eax, [ebp - 0x264]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x40]
call fcn.00503d40
push dword [ebp - 0x290]
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
call fcn.00530840
add esp, 8
mov dword [edi + 4], eax
lea ecx, [ebp - 0x40]
call fcn.00422db0
mov eax, dword [edi + 4]
mov dword [ebx + 4], eax
mov dword [esi], 0
call fcn.0052c940
lea ecx, [ebp - 0x28]
mov dword [esi + 4], eax
call fcn.00422db0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005329db
mov esp, ebp
pop ebp
ret
Function at 0x530a40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [esp + 0x14]
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x530a53
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x530a7b
push dword [esp + 0x18]
lea eax, [esp + 0xc]
push esi
push eax
call fcn.00530930
add esp, 0xc
mov eax, dword [eax]
pop esi
pop ebx
add esp, 8
ret
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x530a92
mov dword [edi], 0
call fcn.0052c940
mov dword [edi + 4], eax
pop edi
test ebx, 0x400
je 0x530ac9
push esi
call fcn.005305e0
add esp, 4
test al, al
je 0x530abe
test bl, 0x10
mov eax, 4
mov ecx, 0xb
pop esi
cmovne eax, ecx
pop ebx
add esp, 8
ret
pop esi
mov eax, 9
pop ebx
add esp, 8
ret
and ebx, 0x10
or ebx, 0x20
shr ebx, 4
pop esi
mov eax, ebx
pop ebx
add esp, 8
ret

Function at 0x530b50
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
mov eax, dword [esp + 8]
push esi
push edi
cmp eax, 1
jne 0x530b7a
mov esi, dword [esp + 0x14]
test esi, esi
je 0x530c03
mov dword [esi], 0
call fcn.0052c940
mov dword [esi + 4], eax
xor al, al
pop edi
pop esi
ret
cmp eax, 3
je 0x530b9b
cmp eax, 0xb
je 0x530b9b
mov esi, dword [esp + 0xc]
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x530b92
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x530bb0
mov esi, dword [esp + 0xc]
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x530ba9
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x530bea
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 2
je 0x530bea
cmp eax, 3
je 0x530bea
cmp eax, 0x7b
je 0x530bea
cmp eax, 0xf
je 0x530bea
cmp eax, 0x15
je 0x530bea
cmp eax, 0x57
je 0x530bea
cmp eax, 0xa1
je 0x530bea
cmp eax, 0x35
je 0x530bea
call edi
jmp 0x530bec
xor eax, eax
push str.boost::filesystem::remove
push dword [esp + 0x18]
push esi
push eax
call fcn.00530470
add esp, 0x10
test al, al
je 0x530c08
pop edi
xor al, al
pop esi
ret
pop edi
mov al, 1
pop esi
ret

Function at 0x530c10
Capabilities:
Move file

Disassembly:
push esi
mov esi, dword [esp + 0xc]
mov eax, esi
push edi
cmp dword [esi + 0x14], 8
jb 0x530c20
mov eax, dword [esi]
mov edi, dword [esp + 0xc]
mov ecx, edi
cmp dword [edi + 0x14], 8
jb 0x530c2e
mov ecx, dword [edi]
push 3
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x530c44
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x530c46
xor eax, eax
push str.boost::filesystem::rename
push dword [esp + 0x18]
push esi
push edi
push eax
call fcn.005303b0
add esp, 0x14
pop edi
pop esi
ret
Function at 0x530ce0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56b470
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x5d21e8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov eax, edi
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x2c], esi
cmp dword [edi + 0x14], 8
jb 0x530d21
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x30], eax
cmp eax, 0xffffffff
jne 0x530d40
push esi
push edi
push ebx
call fcn.00530930
add esp, 0xc
jmp 0x530e5d
test eax, 0x400
je 0x530e24
cmp dword [edi + 0x14], 8
mov edx, edi
jb 0x530d55
mov edx, dword [edi]
mov ecx, edx
mov dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x530d70
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.00503d40
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push 0x2000000
push 3
push 0
push 7
push 0
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x34], esi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.00422db0
cmp esi, 0xffffffff
jne 0x530dd9
push dword [ebp - 0x2c]
push edi
push ebx
call fcn.00530930
add esp, 0xc
jmp 0x530e5d
push edi
call fcn.005305e0
add esp, 4
test al, al
jne 0x530e0c
mov eax, dword [ebp - 0x30]
push eax
push edi
call fcn.00530840
add esp, 8
mov dword [ebx], 9
mov dword [ebx + 4], eax
push esi
mov dword [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x530e5d
push esi
mov dword [ebp - 4], 5
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x530e36
mov dword [esi], 0
call fcn.0052c940
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x30]
push eax
push edi
test al, 0x10
je 0x530e4b
call fcn.00530840
mov ecx, 3
jmp 0x530e55
call fcn.00530840
mov ecx, 2
add esp, 8
mov dword [ebx], ecx
mov dword [ebx + 4], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005329db
mov esp, ebp
pop ebp
ret
Function at 0x532120
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56b6c8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5d21e8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x5d21d8]
cmp eax, 0xffffffff
jne 0x532156
xor ebx, ebx
jmp 0x53215f
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x532247
mov ecx, dword [ebx + 0x18]
mov eax, dword [ebx + 0xc]
mov esi, eax
nop dword [eax]
mov edx, ecx
mov edi, esi
test edx, edx
jne 0x532190
test eax, eax
je 0x532222
test edx, edx
mov esi, eax
cmovne esi, edi
test esi, esi
je 0x5321e7
nop dword [eax + eax]
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x5321cb
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esi]
mov ecx, edi
push 0
mov eax, dword [edi]
call dword [eax]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebx + 0xc]
mov esi, eax
test eax, eax
jne 0x5321a0
mov ecx, dword [ebx + 0x18]
test ecx, ecx
je 0x532180
nop dword [eax + eax]
mov esi, dword [ebx + 0x14]
mov esi, dword [esi]
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x532209
mov edx, dword [esi + 0x1c]
test edx, edx
je 0x532209
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebx + 0x14]
call fcn.00531b50
mov ecx, dword [ebx + 0x18]
test ecx, ecx
jne 0x5321f0
jmp 0x532174
push 0x5319b0
push 0x5de760
call fcn.00461e20
mov eax, dword [0x5d21d8]
add esp, 8
cmp eax, 0xffffffff
je 0x532247
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [ebp - 4], 1
test ebx, ebx
je 0x532274
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x532274
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax]
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x532290
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push esi
mov esi, ecx
mov edx, dword [esi]
lea eax, [edx + 0x10]
push eax
push 4
push edx
push 0x5322f0
push 0
push 0
call fcn.0053ba3e
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x5322b9
pop esi
xor al, al
pop ebx
ret
mov eax, dword [esi]
push edi
add eax, 4
lock inc dword [eax]
mov edi, dword [esi]
mov eax, dword [edi + 8]
test eax, eax
je 0x5322d7
cmp eax, 0xffffffff
je 0x5322d7
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 8], ebx
mov eax, dword [esi]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
mov al, 1
pop ebx
ret

Function at 0x54fbab
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0054fa21
Function at 0x555a60
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005555b3
Function at 0x4467a2
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4467d0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4467ee
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0044670c
jmp 0x4467ee
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4467ee
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.0044670c
test edi, edi
mov eax, edi
jne 0x4467d8
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x4714cc]
test ecx, ecx
je 0x4468a1
jmp 0x4467a1
ret 8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x100071c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
lea edi, [ebp - 0x40]
mov ecx, 0x10
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov esi, esp
push str.VirtualAlloc
mov edi, esp
push str.KERNEL32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp edi, esp
call fcn.10024be0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp esi, esp
call fcn.10024be0
mov dword [0x101f58f0], eax
pop edi
pop esi
pop ebx
add esp, 0x40
cmp ebp, esp
call fcn.10024be0
mov esp, ebp
pop ebp
ret

Function at 0x10007320
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
lea edi, [ebp - 0x40]
mov ecx, 0x10
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov esi, esp
push str.VirtualProtect
mov edi, esp
push str.KERNEL32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp edi, esp
call fcn.10024be0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp esi, esp
call fcn.10024be0
mov dword [0x101f58e8], eax
pop edi
pop esi
pop ebx
add esp, 0x40
cmp ebp, esp
call fcn.10024be0
mov esp, ebp
pop ebp
ret