joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405330
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [0x5010bc]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
movzx eax, byte [eax]
cmp al, 1
jne 0x405358
call fcn.00405540
jmp 0x40552f
mov eax, dword [edx + 8]
movdqu xmm0, xmmword [ecx + 0x30]
test eax, eax
je 0x40552a
movdqu xmm7, xmmword [ecx]
mov esi, dword [edx]
movdqu xmm5, xmmword [ecx + 0x10]
movdqu xmm3, xmmword [ecx + 0x20]
mov edx, dword [edx + 4]
xor edi, edi
movdqa xmmword [esp], xmm7
nop word cs:[eax + eax]
nop dword [eax]
mov ebx, 0xa
movdqa xmm4, xmm5
movdqa xmm6, xmm0
movdqa xmm2, xmm3
nop word cs:[eax + eax]
nop dword [eax + eax]
paddd xmm7, xmm5
dec ebx
pxor xmm6, xmm7
movdqa xmm1, xmm6
pslld xmm6, 0x10
psrld xmm1, 0x10
por xmm6, xmm1
paddd xmm3, xmm6
pxor xmm5, xmm3
movdqa xmm1, xmm5
pslld xmm5, 0xc
psrld xmm1, 0x14
por xmm5, xmm1
paddd xmm7, xmm5
pxor xmm6, xmm7
pshufd xmm7, xmm7, 0x93
movdqa xmm1, xmm6
pslld xmm6, 8
psrld xmm1, 0x18
por xmm6, xmm1
paddd xmm3, xmm6
pshufd xmm6, xmm6, 0x4e
pxor xmm5, xmm3
pshufd xmm3, xmm3, 0x39
movdqa xmm1, xmm5
pslld xmm5, 7
psrld xmm1, 0x19
por xmm5, xmm1
paddd xmm7, xmm5
pxor xmm6, xmm7
movdqa xmm1, xmm6
pslld xmm6, 0x10
psrld xmm1, 0x10
por xmm6, xmm1
paddd xmm3, xmm6
pxor xmm5, xmm3
movdqa xmm1, xmm5
pslld xmm5, 0xc
psrld xmm1, 0x14
por xmm5, xmm1
paddd xmm7, xmm5
pxor xmm6, xmm7
pshufd xmm7, xmm7, 0x39
movdqa xmm1, xmm6
pslld xmm6, 8
psrld xmm1, 0x18
por xmm6, xmm1
paddd xmm3, xmm6
pshufd xmm6, xmm6, 0x4e
pxor xmm5, xmm3
pshufd xmm3, xmm3, 0x93
movdqa xmm1, xmm5
pslld xmm5, 7
psrld xmm1, 0x19
por xmm5, xmm1
jne 0x4053b0
mov ebx, edi
paddd xmm6, xmm0
paddd xmm3, xmm2
movdqa xmmword [esp + 0x10], xmm0
movdqa xmm0, xmm2
movdqa xmm2, xmmword [esp]
paddd xmm5, xmm4
inc edi
shl ebx, 6
cmp eax, edi
movdqu xmm1, xmmword [esi + ebx + 0x30]
paddd xmm7, xmm2
pxor xmm6, xmm1
movdqu xmm1, xmmword [esi + ebx + 0x20]
pxor xmm3, xmm1
movdqu xmm1, xmmword [esi + ebx + 0x10]
pxor xmm5, xmm1
movdqu xmm1, xmmword [esi + ebx]
pxor xmm7, xmm1
movdqu xmmword [edx + ebx], xmm7
movdqu xmmword [edx + ebx + 0x10], xmm5
movdqu xmmword [edx + ebx + 0x20], xmm3
movdqa xmm3, xmm0
movdqa xmm0, xmmword [esp + 0x10]
movdqa xmm7, xmm2
movdqa xmm5, xmm4
movdqu xmmword [edx + ebx + 0x30], xmm6
paddd xmm0, xmmword [0x535ca0]
jne 0x405390
movd dword [ecx + 0x30], xmm0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x412e00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [ebp + 8]
mov esi, dword [eax]
test esi, esi
je 0x412ec2
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x412eba
je 0x412eb8
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x412e4e
mov ecx, dword [eax]
movups xmm0, xmmword [eax + 8]
mov dword [eax], 0
or ecx, dword [eax + 4]
mov dword [eax + 4], 0
jne 0x412e68
xorps xmm0, xmm0
lea eax, [esp + 0x10]
movaps xmmword [esp + 0x10], xmm0
push 0x10
push eax
call dword [sym.imp.bcryptprimitives.dll_ProcessPrng]
movaps xmm0, xmmword [esp + 0x10]
mov eax, dword [0x55bd94]
movaps xmmword [esp], xmm0
movzx eax, byte [eax]
push 8
push 0x18
call fcn.0040d1d0
add esp, 8
test eax, eax
je 0x412ede
movaps xmm0, xmmword [esp]
movups xmmword [eax], xmm0
mov dword [eax + 0x10], esi
push esi
mov ebx, eax
call sub.kernel32.dll_TlsGetValue
mov edi, eax
mov dword [esp], ebx
push ebx
push esi
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x412eb3
push 8
push 0x18
push edi
call fcn.0040d1e0
add esp, 0xc
mov eax, dword [esp]
jmp 0x412eba
xor eax, eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call fcn.004addb0
add esp, 4
mov esi, eax
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x412e29
jmp 0x412eba
push 0x18
push 8
call fcn.004d0a10
nop word [eax + eax]

Function at 0x412ef0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov eax, dword [ebp + 8]
mov esi, dword [eax]
test esi, esi
je 0x412f79
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x412f71
je 0x412f26
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x412f2a
mov edi, dword [eax]
mov dword [eax], 0
test edi, edi
je 0x412f2c
mov edi, dword [eax + 4]
jmp 0x412f2c
xor eax, eax
jmp 0x412f71
xor edi, edi
mov eax, dword [0x55bd94]
movzx eax, byte [eax]
push 4
push 8
call fcn.0040d1d0
add esp, 8
test eax, eax
je 0x412f95
mov dword [eax], edi
mov dword [eax + 4], esi
push esi
mov ebx, eax
call sub.kernel32.dll_TlsGetValue
mov edi, eax
mov dword [ebp - 0x10], ebx
push ebx
push esi
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x412f6e
push 4
push 8
push edi
call fcn.0040d1e0
add esp, 0xc
mov eax, dword [ebp - 0x10]
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call fcn.004addb0
add esp, 4
mov esi, eax
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x412f0c
jmp 0x412f71
push 8
push 4
call fcn.004d0a10
nop
Function at 0x412fa0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov eax, dword [ebp + 8]
mov esi, dword [eax]
test esi, esi
je 0x41305f
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x413057
je 0x413055
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x412fdf
mov edi, dword [eax + 4]
cmp dword [eax], 0
mov dword [eax], 0
jne 0x412fef
call fcn.00452cc0
push eax
call fcn.00450e40
add esp, 4
mov edi, eax
mov eax, dword [0x55bd94]
movzx eax, byte [eax]
push 4
push 8
call fcn.0040d1d0
add esp, 8
test eax, eax
je 0x413086
mov dword [eax], edi
mov dword [eax + 4], esi
push esi
mov ebx, eax
call sub.kernel32.dll_TlsGetValue
mov edi, eax
mov dword [ebp - 0x10], ebx
push ebx
push esi
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x413050
mov eax, dword [edi]
mov ecx, dword [eax + 0x410]
lea edx, [ecx - 1]
mov dword [eax + 0x410], edx
cmp dword [eax + 0x40c], 0
jne 0x413043
cmp ecx, 1
je 0x41307b
push 4
push 8
push edi
call fcn.0040d1e0
add esp, 0xc
mov eax, dword [ebp - 0x10]
jmp 0x413057
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call fcn.004addb0
add esp, 4
mov esi, eax
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x412fc4
jmp 0x413057
push eax
call fcn.00451960
add esp, 4
jmp 0x413043
push 8
push 4
call fcn.004d0a10
nop

Function at 0x413090
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [ebp + 8]
mov esi, dword [eax]
test esi, esi
je 0x413161
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x413159
je 0x413157
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4130e6
mov ecx, dword [eax + 4]
mov edi, dword [eax + 8]
cmp dword [eax], 0
mov dword [eax], 0
je 0x4130e6
mov eax, edi
mov ebx, edi
mov dword [ebp - 0x10], ecx
shr eax, 0x10
shr ebx, 0x18
mov dword [ebp - 0x14], eax
jmp 0x4130f6
mov dword [ebp - 0x14], 0
xor edi, edi
mov dword [ebp - 0x10], 0
mov eax, dword [0x55bd94]
movzx eax, byte [eax]
push 4
push 0xc
call fcn.0040d1d0
add esp, 8
test eax, eax
je 0x41317d
movzx edx, byte [ebp - 0x14]
movzx ecx, bl
shl ecx, 0x18
shl edx, 0x10
or edx, ecx
movzx ecx, di
or ecx, edx
mov edx, dword [ebp - 0x10]
mov dword [eax + 4], ecx
mov dword [eax], edx
mov dword [eax + 8], esi
push esi
mov ebx, eax
call sub.kernel32.dll_TlsGetValue
mov edi, eax
mov dword [ebp - 0x10], ebx
push ebx
push esi
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x413152
push 4
push 0xc
push edi
call fcn.0040d1e0
add esp, 0xc
mov eax, dword [ebp - 0x10]
jmp 0x413159
xor eax, eax
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call fcn.004addb0
add esp, 4
mov esi, eax
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x4130b6
jmp 0x413159
push 0xc
push 4
call fcn.004d0a10
nop word cs:[eax + eax]
Function at 0x413e50
Capabilities:
List groups for user account

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp byte [eax + 0x28], 0
je 0x413ec1
cmp dword [eax + 0x18], 0x80000000
je 0x413ec1
mov eax, dword [eax + 0x1c]
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x30], 0
lea edx, [ebp - 0x20]
lea esi, [ebp - 0x1c]
push ecx
push edx
push 0xffffffffffffffff
push esi
push 1
push 0
push eax
push 0x53785c
call sub.netapi32.dll_NetUserGetLocalGroups
test eax, eax
je 0x413eda
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x10], 0
jmp 0x413fda
mov dword [ebx], 0
mov dword [ebx + 4], 4
mov dword [ebx + 8], 0
jmp 0x414007
mov esi, dword [ebp - 0x20]
test esi, esi
je 0x413f15
mov edi, esi
shl edi, 4
cmp esi, 0x7ffffff
ja 0x41402b
mov eax, dword [0x55bd94]
movzx eax, byte [eax]
push 4
push edi
call fcn.0040d1d0
add esp, 8
test eax, eax
jne 0x413f1a
mov eax, 4
push edi
push eax
call fcn.004d09f0
mov eax, 4
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
test ecx, ecx
mov dword [ebp - 0x2c], ecx
je 0x413ff8
mov ebx, dword [ebp - 0x20]
cmp ebx, esi
ja 0x414011
xor edx, edx
test ebx, ebx
je 0x413fd4
mov ecx, edx
add edx, ebx
xor edi, edi
shl ecx, 4
mov dword [ebp - 0x24], edx
lea eax, [ecx + eax + 0xc]
mov dword [ebp - 0x28], eax
jmp 0x413f7c
mov esi, dword [ebp - 0x28]
mov dword [esi + edi*4 - 0xc], ecx
mov dword [esi + edi*4 - 8], edx
mov dword [esi + edi*4 - 4], eax
mov dword [esi + edi*4], 0
add edi, 4
dec ebx
je 0x413fd1
mov eax, dword [ebp - 0x2c]
mov edx, 1
mov ecx, 0
mov eax, dword [eax + edi]
mov dword [ebp - 0x34], eax
test eax, eax
mov eax, 0
je 0x413f60
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.004416f0
add esp, 8
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x38]
mov edx, 0
mov esi, 1
cmp ecx, 0x80000000
cmove eax, edx
mov edx, dword [ebp - 0x3c]
cmove edx, esi
mov esi, 0
cmove ecx, esi
jmp 0x413f60
mov edx, dword [ebp - 0x24]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
movsd xmm0, qword [ebp - 0x18]
test eax, eax
mov dword [ebx + 8], ecx
movsd qword [ebx], xmm0
je 0x414007
push eax
call sub.netapi32.dll_NetApiBufferFree
jmp 0x414007
mov eax, dword [ebp - 0x10]
movsd xmm0, qword [ebp - 0x18]
mov dword [ebx + 8], eax
movsd qword [ebx], xmm0
mov eax, ebx
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [ebp - 0x18]
push ebx
push 0
push eax
call fcn.00423cb0
add esp, 0xc
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
jmp 0x413f4a
xor eax, eax
push edi
push eax
call fcn.004d09f0
nop word cs:[eax + eax]
nop
Function at 0x416370
Capabilities:
Get local ipv4 addresses

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
xor esi, esi
xor ebx, ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0x3c00
nop word [eax + eax]
push dword [ebp - 0x14]
push esi
call sub.msvcrt.dll_realloc
add esp, 8
test eax, eax
je 0x416413
mov edi, eax
lea eax, [ebp - 0x14]
push eax
push edi
push 0
push 0xe
push 0
call sub.iphlpapi.dll_GetAdaptersAddresses
test eax, eax
mov dword [ebp - 0x18], eax
je 0x41645b
cmp ebx, 1
ja 0x4163ca
inc ebx
cmp eax, 0x6f
mov esi, edi
je 0x416390
lea eax, [ebp - 0x18]
mov dword [ebp - 0x38], 0x537a94
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1c], fcn.004ec920
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0x2c], 1
push eax
push dword [ebp - 0x10]
call fcn.004d1b40
add esp, 8
push edi
call sub.msvcrt.dll_free
add esp, 4
jmp 0x41646a
mov eax, dword [0x55bd94]
movzx eax, byte [eax]
push 1
push 0x32
call fcn.0040d1d0
add esp, 8
test eax, eax
je 0x416472
mov edi, eax
push 0x32
push 0x537a38
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
push esi
call sub.msvcrt.dll_free
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x32
mov dword [eax + 4], edi
mov dword [eax + 8], 0x32
jmp 0x41646a
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov dword [eax], 0x80000000
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x32
push 1
call fcn.004d09f0
nop
nop
nop
push ebp
mov ebp, esp
push esi
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [edx + 4]
cmp eax, ecx
je 0x41649a
lea esi, [eax + 1]
mov dword [edx], esi
movzx edx, byte [eax]
jmp 0x41649a
cmp eax, ecx
setne al
pop esi
pop ebp
ret
Function at 0x41b080
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, edx
mov edi, ecx
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
push eax
push 0x537f5c
push 1
push 0
push 0x537fec
call sub.ole32.dll_CoCreateInstance
test eax, eax
js 0x41b0e1
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x41b17b
cmp dword [esi], 0
je 0x41b0c8
push esi
call fcn.00447760
add esp, 4
mov dword [esi], ebx
movsd xmm0, qword [esi + 8]
movsd xmm1, qword [esi]
movsd qword [edi + 8], xmm0
movsd qword [edi], xmm1
jmp 0x41b173
push eax
call fcn.004480f0
add esp, 4
mov dword [ebp - 0x14], eax
mov eax, 8
mov dword [ebp + eax - 0x18], edx
mov dword [ebp - 0x18], 1
cmp dword [ebp - 0x10], 0
je 0x41b10f
lea eax, [ebp - 0x10]
push eax
call fcn.00447ed0
add esp, 4
mov eax, dword [esi + 8]
mov byte [edi + 0xc], 2
mov dword [esi + 8], 0
test eax, eax
mov dword [ebp - 0x18], eax
je 0x41b130
lea eax, [ebp - 0x18]
push eax
call fcn.00447760
add esp, 4
mov eax, dword [esi + 4]
mov dword [esi + 4], 0
test eax, eax
mov dword [ebp - 0x18], eax
je 0x41b14d
lea eax, [ebp - 0x18]
push eax
call fcn.00447760
add esp, 4
mov eax, dword [esi]
mov dword [esi], 0
test eax, eax
mov dword [ebp - 0x18], eax
je 0x41b168
lea eax, [ebp - 0x18]
push eax
call fcn.00447760
add esp, 4
cmp byte [esi + 0xc], 0
je 0x41b173
call sub.ole32.dll_CoUninitialize
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
xor edx, edx
mov eax, 4
mov dword [ebp + eax - 0x18], edx
mov dword [ebp - 0x18], 1
cmp dword [ebp - 0x10], 0
jne 0x41b103
jmp 0x41b10f
Function at 0x41b440
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov ebx, dword [edx + 4]
mov esi, edx
test ebx, ebx
je 0x41b524
mov dword [ebp - 0x1c], ecx
push 0x53800e
call sub.oleaut32.dll_SysAllocString
mov edi, eax
mov dword [ebp - 0x38], eax
push str.SELECT__FROM_MSAcpi_ThermalZoneTemperature
call sub.oleaut32.dll_SysAllocString
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 0x20]
mov edx, dword [ebx]
push ecx
push 0
push 0x30
mov dword [ebp - 0x24], eax
push eax
mov dword [ebp - 0x28], edi
push edi
push ebx
call dword [edx + 0x50]
test eax, eax
js 0x41b4b4
mov edx, dword [ebp - 0x20]
xor eax, eax
mov ecx, 4
test edx, edx
jne 0x41b4ca
mov eax, 1
xor edx, edx
mov dword [ebp - 0x10], 0
jmp 0x41b4ca
push eax
call fcn.004480f0
add esp, 4
mov dword [ebp - 0x14], eax
mov eax, 1
mov ecx, 8
mov dword [ebp + ecx - 0x18], edx
mov dword [ebp - 0x18], eax
push dword [ebp - 0x28]
call sub.oleaut32.dll_SysFreeString
push dword [ebp - 0x24]
call sub.oleaut32.dll_SysFreeString
mov eax, dword [ebp - 0x10]
movsd xmm0, qword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x3c]
movsd qword [ebp - 0x34], xmm0
push eax
call fcn.00440370
add esp, 4
lea eax, [ebp - 0x38]
push eax
call fcn.00440370
add esp, 4
cmp dword [ebp - 0x34], 0
je 0x41b587
cmp dword [ebp - 0x2c], 0
je 0x41b521
lea eax, [ebp - 0x2c]
push eax
call fcn.00447ed0
add esp, 4
mov ecx, dword [ebp - 0x1c]
mov eax, dword [esi + 8]
mov byte [ecx + 0xc], 2
mov dword [esi + 8], 0
test eax, eax
mov dword [ebp - 0x18], eax
je 0x41b545
lea eax, [ebp - 0x18]
push eax
call fcn.00447760
add esp, 4
test ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [esi + 4], 0
je 0x41b55f
lea eax, [ebp - 0x18]
push eax
call fcn.00447760
add esp, 4
mov eax, dword [esi]
mov dword [esi], 0
test eax, eax
mov dword [ebp - 0x18], eax
je 0x41b57a
lea eax, [ebp - 0x18]
push eax
call fcn.00447760
add esp, 4
cmp byte [esi + 0xc], 0
je 0x41b5b4
call sub.ole32.dll_CoUninitialize
jmp 0x41b5b4
mov edi, dword [ebp - 0x30]
cmp dword [esi + 8], 0
je 0x41b59c
lea eax, [esi + 8]
push eax
call fcn.00447760
add esp, 4
mov dword [esi + 8], edi
mov eax, dword [ebp - 0x1c]
movsd xmm0, qword [esi]
movsd xmm1, qword [esi + 8]
movsd qword [eax], xmm0
movsd qword [eax + 8], xmm1
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x420700
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov esi, ecx
lea eax, [ebp - 0x24]
push eax
push edx
call sub.shell32.dll_CommandLineToArgvW
test eax, eax
mov dword [ebp - 0x1c], eax
je 0x4207c2
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x10], 0
test ebx, ebx
je 0x4207a6
mov edi, dword [ebp - 0x1c]
shl ebx, 2
jmp 0x420779
mov eax, dword [ebp - 0x14]
movsd xmm0, qword [ebp - 0x34]
movsd xmm1, qword [ebp - 0x2c]
mov ecx, esi
add edi, 4
inc esi
shl ecx, 4
add ebx, 0xfffffffc
movsd qword [eax + ecx + 8], xmm1
movsd qword [eax + ecx], xmm0
mov dword [ebp - 0x10], esi
je 0x4207a6
push edi
call fcn.004416d0
add esp, 4
push edx
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.00491170
add esp, 0xc
mov esi, dword [ebp - 0x10]
cmp esi, dword [ebp - 0x18]
jne 0x420750
lea eax, [ebp - 0x18]
push eax
call fcn.00424230
add esp, 4
jmp 0x420750
push dword [ebp - 0x1c]
call sub.kernel32.dll_LocalFree
movsd xmm0, qword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
movsd qword [ecx], xmm0
mov dword [ecx + 8], eax
jmp 0x4207d6
mov dword [esi], 0
mov dword [esi + 4], 4
mov dword [esi + 8], 0
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x421750
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
movzx ebx, byte [ebp + 0x10]
mov esi, dword [ebp + 8]
cmp byte [ebp + 0xc], 0
je 0x4217d0
xorps xmm0, xmm0
lea eax, [esp + 0x10]
movaps xmmword [esp + 0x10], xmm0
movaps xmmword [esp + 0x40], xmm0
movaps xmmword [esp + 0x30], xmm0
movaps xmmword [esp + 0x20], xmm0
mov dword [esp + 0x10], 0x40
push eax
call sub.kernel32.dll_GlobalMemoryStatusEx
test eax, eax
je 0x4217a1
movups xmm0, xmmword [esp + 0x18]
movups xmmword [esi + 0x40], xmm0
jmp 0x4217d0
call fcn.00447f20
movups xmm0, xmmword [esp + 0x18]
test edx, edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 4], 1
movups xmmword [esi + 0x40], xmm0
je 0x4217d0
lea eax, [esp + 0xc]
push eax
call fcn.00447ed0
add esp, 4
test bl, bl
je 0x421839
xorps xmm0, xmm0
lea eax, [esp + 0x10]
movsd qword [esp + 0x40], xmm0
xorps xmm0, xmm0
movaps xmmword [esp + 0x30], xmm0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
push 0x38
push eax
call sub.kernel32.dll_K32GetPerformanceInfo
test eax, eax
je 0x421839
mov edi, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x38]
xor ecx, ecx
mov edx, 0
sub eax, edi
sbb edx, edx
cmovb eax, ecx
mul ebx
mov dword [esi + 0x50], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 0x54], edx
mov edx, 0
sub eax, edi
sbb edx, edx
cmovb eax, ecx
mul ebx
mov dword [esi + 0x5c], edx
mov dword [esi + 0x58], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x422820
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
lea edi, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push edi
push 0
push 5
call sub.kernel32.dll_GetComputerNameExW
xor ecx, ecx
test eax, eax
jne 0x422853
call fcn.00447f20
mov ecx, 1
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1c], ecx
test ebx, ebx
je 0x4228b4
lea esi, [ebx + ebx]
cmp ebx, 0x3fffffff
ja 0x422992
push 2
push esi
call fcn.0040d220
add esp, 8
test eax, eax
je 0x42299b
mov edi, eax
lea eax, [ebp - 0x10]
push eax
push edi
push 5
call sub.kernel32.dll_GetComputerNameExW
test eax, eax
je 0x4228cb
xor eax, eax
nop word cs:[eax + eax]
cmp word [edi + eax*2], 0
je 0x4228d0
inc eax
add esi, 0xfffffffe
jne 0x4228a0
mov esi, dword [ebp + 8]
mov eax, ebx
jmp 0x4228d3
push edi
push 2
push 5
call sub.kernel32.dll_GetComputerNameExW
test eax, eax
je 0x422931
xor eax, eax
mov edi, 2
jmp 0x4228d3
mov esi, dword [ebp + 8]
jmp 0x422936
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x28]
push eax
push edi
push ecx
call fcn.004d27f0
add esp, 0xc
cmp dword [ebp - 0x28], 0x80000000
jne 0x4228f6
mov dword [esi], 0x80000000
test ebx, ebx
jne 0x422909
jmp 0x422917
mov eax, dword [ebp - 0x20]
movsd xmm0, qword [ebp - 0x28]
mov dword [esi + 8], eax
movsd qword [esi], xmm0
test ebx, ebx
je 0x422917
add ebx, ebx
push 2
push ebx
push edi
call fcn.0040d1e0
add esp, 0xc
cmp dword [ebp - 0x1c], 0
je 0x422988
cmp dword [ebp - 0x14], 0
je 0x422988
lea eax, [ebp - 0x14]
push eax
call fcn.00447ed0
add esp, 4
jmp 0x422988
mov edi, 2
call fcn.00447f20
test edx, edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x28], 1
je 0x422958
lea eax, [ebp - 0x20]
push eax
call fcn.00447ed0
add esp, 4
test ebx, ebx
je 0x42296a
add ebx, ebx
push 2
push ebx
push edi
call fcn.0040d1e0
add esp, 0xc
cmp dword [ebp - 0x1c], 0
je 0x422982
cmp dword [ebp - 0x14], 0
je 0x422982
lea eax, [ebp - 0x14]
push eax
call fcn.00447ed0
add esp, 4
mov dword [esi], 0x80000000
mov eax, esi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
push esi
push eax
call fcn.004d09f0
mov eax, 2
push esi
push eax
call fcn.004d09f0
nop word [eax + eax]
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov edx, 0x538610
mov ecx, esi
push 0x12
call fcn.004231c0
add esp, 4
mov eax, esi
pop esi
pop ebp
ret
Function at 0x422cb0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, dword [ebp + 8]
call 0x422cc1
pop edi
lea ebx, [ebp - 0x30]
push ebx
call fcn.0043b1a0
add esp, 4
push ebx
call sub.kernel32.dll_GetSystemInfo
movzx eax, word [ebp - 0x30]
cmp eax, 0xe
ja 0x422ecf
add edi, dword [eax*4 + 0x422f0c]
jmp edi
mov dword [esi], 0x80000000
mov eax, esi
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret