joyce8/EMBER2024-capa huggingface dataset:
Function at 0x664e0c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x665066
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
mov edx, 0x24
call fcn.00667820
lea eax, [ebp - 0x28]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov eax, dword [ebp - 0x14]
mov dword [0x6d2524], eax
mov eax, dword [ebp - 0xc]
mov dword [0x6d2528], eax
mov eax, dword [ebp - 0x24]
mov dword [0x6d252c], eax
call fcn.0042e378
cmp eax, 2
sete byte [0x6d1d01]
push 0x665074
call sub.KERNEL32.DLL_GetModuleHandleW
lea edx, [ebp - 4]
call fcn.00667b10
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp byte [0x6d1d01], 0
jne 0x664e9b
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.00667b40
test al, al
je 0x664e9b
mov eax, dword [ebp - 0x4c]
mov dword [0x6da9c0], eax
jmp 0x664ea2
xor eax, eax
mov dword [0x6da9c0], eax
call fcn.00664400
and eax, 0x7f
cmp eax, 0x1a
ja case.0x664eb3.0
jmp dword [eax*4 + 0x664eba]
mov byte [0x6d1cfc], 1
jmp case.0x664eb3.0
mov byte [0x6d1cfd], 1
jmp case.0x664eb3.0
mov byte [0x6d1cfe], 1
jmp case.0x664eb3.0
mov byte [0x6d1cff], 1
jmp case.0x664eb3.0
mov byte [0x6d1d00], 1
jmp case.0x664eb3.0
mov byte [0x6d1d02], 1
mov byte [0x6d1d03], 1
jmp case.0x664eb3.0
mov byte [0x6d1d02], 1
mov byte [0x6d1d04], 1
jmp case.0x664eb3.0
mov byte [0x6d1d02], 1
mov byte [0x6d1d04], 1
mov byte [0x6d1d05], 1
jmp case.0x664eb3.0
mov byte [0x6d1d06], 1
jmp case.0x664eb3.0
mov byte [0x6d1d07], 1
jmp case.0x664eb3.0
mov byte [0x6d1d08], 1
jmp case.0x664eb3.0
mov byte [0x6d1d09], 1
jmp case.0x664eb3.0
mov byte [0x6d1d0a], 1
jmp case.0x664eb3.0
mov byte [0x6d1d0b], 1
jmp case.0x664eb3.0
mov byte [0x6d1d0c], 1
jmp case.0x664eb3.0
mov byte [0x6d1d0d], 1
jmp case.0x664eb3.0
mov byte [0x6d1d0e], 1
jmp case.0x664eb3.0
mov byte [0x6d1d0f], 1
jmp case.0x664eb3.0
mov byte [0x6d1d10], 1
jmp case.0x664eb3.0
mov byte [0x6d1d11], 1
jmp case.0x664eb3.0
mov byte [0x6d1d12], 1
jmp case.0x664eb3.0
mov byte [0x6d1d13], 1
jmp case.0x664eb3.0
mov byte [0x6d1d14], 1
jmp case.0x664eb3.0
mov byte [0x6d1d15], 1
jmp case.0x664eb3.0
mov byte [0x6d1d16], 1
jmp case.0x664eb3.0
mov byte [0x6d1d17], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x66506d
lea eax, [ebp - 4]
call fcn.0040a7d0
ret

Function at 0x666050
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor edx, edx
mov dword [ebp - 0x14], edx
xor edx, edx
push ebp
push 0x6660b4
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 0xe]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoW
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xe]
mov ecx, 7
call fcn.0040b3a8
mov eax, dword [ebp - 0x14]
push eax
call sub.KERNEL32.DLL_GetACP
mov edx, eax
pop eax
call fcn.00426b08
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6660bb
lea eax, [ebp - 0x14]
call fcn.0040a7d0
ret
Function at 0x666e30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x666ec6
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0042e378
cmp eax, 2
jne 0x666e70
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push edi
push esi
push ebx
call sub.advapi32.dll_RegQueryValueExW
mov ebx, eax
jmp 0x666ea8
lea eax, [ebp - 8]
mov edx, esi
call fcn.0040b100
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, 0
call fcn.0040af7c
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push edi
mov eax, dword [ebp - 4]
call fcn.0040aff0
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x666ecd
lea eax, [ebp - 8]
call fcn.0040a818
lea eax, [ebp - 4]
call fcn.0040a7f4
ret

Function at 0x667264
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esi], eax
xor eax, eax
mov dword [ebp - 8], eax
push 0x20019
lea eax, [ebp - 8]
push eax
mov eax, edi
call fcn.0040b2ec
mov edx, eax
mov eax, ebx
call fcn.00666c9c
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.00666d78
test eax, eax
sete al
mov ebx, eax
test bl, bl
je 0x6672d6
push 0
push 0
push esi
push 0
mov eax, dword [ebp - 4]
call fcn.0040b2ec
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
sete bl
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x66797c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0040b2ec
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x667995
test al, 0x10
jne 0x667999
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x6679a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
test ebx, ebx
je 0x6679be
push ebx
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x6679b6
test al, 0x10
je 0x6679ba
xor eax, eax
jmp 0x6679c0
mov al, 1
pop ebx
ret
xor eax, eax
pop ebx
ret
Function at 0x667b40
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x667bf2
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
mov eax, esi
call fcn.0040b2ec
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
jbe 0x667bdc
lea eax, [ebp - 4]
mov edx, edi
call fcn.0040b480
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
push eax
push edi
mov eax, dword [ebp - 0x10]
push eax
mov eax, esi
call fcn.0040b2ec
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x667bdc
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x667c04
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x667bdc
cmp dword [ebp - 0xc], 0x34
jne 0x667bdc
mov bl, 1
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 8]
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x667bf9
lea eax, [ebp - 4]
call fcn.0040a7d0
ret
Function at 0x6695cc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
xor edx, edx
mov dword [ebp - 0x6c], edx
mov dword [ebp - 0x5c], edx
mov dword [ebp - 0x68], edx
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x54], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x669818
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
xor edx, edx
mov eax, 0x669834
call fcn.006683b8
lea edx, [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.006693e8
lea eax, [ebp - 0x54]
mov ecx, dword [ebp - 4]
mov edx, 0x66985c
call fcn.0040b558
mov eax, dword [ebp - 0x54]
xor edx, edx
call fcn.006683b8
cmp dword [ebp - 4], 0
je 0x669644
mov eax, dword [ebp - 4]
call fcn.006679a0
test al, al
jne 0x669655
xor edx, edx
mov eax, 0x669880
call fcn.006683b8
jmp 0x6697e3
cmp byte [ebx + 0x3c], 0
je 0x669665
lea eax, [ebp - 8]
call fcn.0040a7d0
jmp 0x669672
lea eax, [ebp - 8]
mov edx, 0x6698b4
call fcn.0040abf8
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x3c
call fcn.00407e54
mov dword [ebp - 0x50], 0x3c
mov dword [ebp - 0x4c], 0x40
mov eax, 0x6698c0
mov dword [ebp - 0x44], eax
mov eax, 0x6698cc
mov dword [ebp - 0x40], eax
push 0x6698e8
push dword [ebp - 4]
push 0x669900
push dword [ebp - 8]
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.0040b5e0
mov eax, dword [ebp - 0x58]
call fcn.0040b2ec
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x34], 5
lea eax, [ebp - 0x50]
push eax
call sub.shell32.dll_ShellExecuteExW
test eax, eax
je 0x6697e3
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x6697e3
xor edx, edx
push ebp
push 0x6697dc
push dword fs:[edx]
mov dword fs:[edx], esp
push 0xffffffffffffffff
push eax
call sub.KERNEL32.DLL_WaitForSingleObject
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.KERNEL32.DLL_GetExitCodeProcess
test eax, eax
jne 0x669753
lea eax, [ebp - 0x5c]
push eax
call sub.KERNEL32.DLL_GetLastError
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x68]
call fcn.0042675c
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0x11
lea edx, [ebp - 0x64]
xor ecx, ecx
mov eax, 0x669910
call fcn.004283f8
mov eax, dword [ebp - 0x5c]
xor edx, edx
call fcn.006683b8
call fcn.00409fc0
jmp 0x6697e3
xor eax, eax
push ebp
push 0x6697a8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.0040a7d0
mov eax, dword [ebp - 0x14]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xc]
call fcn.0042675c
lea eax, [ebp - 0x6c]
mov ecx, dword [ebp - 0xc]
mov edx, 0x669988
call fcn.0040b558
mov eax, dword [ebp - 0x6c]
xor edx, edx
call fcn.006683b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6697af
lea eax, [ebp - 0xc]
call fcn.0040a7d0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x66981f
lea eax, [ebp - 0x6c]
mov edx, 2
call fcn.0040a830
lea eax, [ebp - 0x5c]
mov edx, 3
call fcn.0040a830
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040a830
ret
Function at 0x66a048
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
xor edx, edx
mov dword [ebp - 0x64], edx
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x60], edx
mov dword [ebp - 0x50], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x66a256
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
lea ecx, [ebp - 4]
mov eax, dword [ebx]
xor edx, edx
call fcn.00669018
cmp dword [ebp - 4], 0
jne 0x66a09e
xor edx, edx
mov eax, 0x66a274
call fcn.006683b8
mov byte [ebp - 9], 1
jmp 0x66a221
xor edx, edx
mov eax, 0x66a2ac
call fcn.006683b8
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x3c
call fcn.00407e54
mov dword [ebp - 0x4c], 0x3c
mov dword [ebp - 0x48], 0x40
mov eax, 0x66a2e4
mov dword [ebp - 0x40], eax
mov eax, 0x66a2f0
mov dword [ebp - 0x3c], eax
push 0x66a30c
push dword [ebp - 4]
push 0x66a320
lea eax, [ebp - 0x50]
mov edx, 3
call fcn.0040b5e0
mov eax, dword [ebp - 0x50]
call fcn.0040b2ec
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x30], 1
lea eax, [ebp - 0x4c]
push eax
call sub.shell32.dll_ShellExecuteExW
test eax, eax
je 0x66a221
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x66a221
xor edx, edx
push ebp
push 0x66a21a
push dword fs:[edx]
mov dword fs:[edx], esp
push 0xffffffffffffffff
push eax
call sub.KERNEL32.DLL_WaitForSingleObject
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.KERNEL32.DLL_GetExitCodeProcess
test eax, eax
jne 0x66a188
lea eax, [ebp - 0x54]
push eax
call sub.KERNEL32.DLL_GetLastError
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x60]
call fcn.0042675c
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0x11
lea edx, [ebp - 0x5c]
xor ecx, ecx
mov eax, 0x66a338
call fcn.004283f8
mov eax, dword [ebp - 0x54]
xor edx, edx
call fcn.006683b8
call fcn.00409fc0
jmp 0x66a221
xor eax, eax
push ebp
push 0x66a1dd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.0040a7d0
mov eax, dword [ebp - 0x10]
xor edx, edx
push edx
push eax
lea eax, [ebp - 8]
call fcn.0042675c
lea eax, [ebp - 0x64]
mov ecx, dword [ebp - 8]
mov edx, 0x66a3b4
call fcn.0040b558
mov eax, dword [ebp - 0x64]
xor edx, edx
call fcn.006683b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x66a1e4
lea eax, [ebp - 8]
call fcn.0040a7d0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x66a25d
lea eax, [ebp - 0x64]
mov edx, 2
call fcn.0040a830
lea eax, [ebp - 0x54]
mov edx, 2
call fcn.0040a830
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040a830
ret

Function at 0x672bb0
Capabilities:
Hash data using djb2

Disassembly:
push ebx
push esi
push edi
mov edi, eax
mov ebx, 0x1505
mov esi, ebx
mov eax, edi
call fcn.0040b2ec
mov edx, eax
jmp 0x672beb
movzx eax, cx
mov ecx, ebx
shl ecx, 5
add ebx, ecx
xor eax, ebx
mov ebx, eax
movzx eax, word [edx + 2]
test eax, eax
je 0x672bf3
mov ecx, esi
shl ecx, 5
add esi, ecx
xor eax, esi
mov esi, eax
add edx, 4
movzx ecx, word [edx]
test cx, cx
jne 0x672bc7
imul eax, esi, 0x5d588b65
add eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x680294
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
dec edx
test edx, edx
jl 0x6802b4
inc edx
mov ebx, ecx
xor bl, byte [eax]
movzx ebx, bl
mov ebx, dword [ebx*4 + 0x6d274c]
shr ecx, 8
xor ebx, ecx
mov ecx, ebx
inc eax
dec edx
jne 0x68029b
mov eax, ecx
pop ebx
ret

Function at 0x6a89b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x75ca18], 0
jne 0x6a89c7
call fcn.006a896c
mov eax, edi
dec eax
test eax, eax
jl 0x6a89ef
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x75c618]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x6a89d1
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x6aba14
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x6aba45
dec al
je 0x6aba80
dec al
je 0x6abac4
dec al
je 0x6abb36
jmp 0x6abbd1
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x6abbd1
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x6aba55
jmp 0x6abbd1
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x6abbd1
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
movzx ecx, al
mov ecx, dword [ebx + ecx*4 + 0x40]
add dl, byte [ecx + esi]
and dl, 0xff
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x6aba90
jmp 0x6abbd1
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x6abbd1
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
jbe 0x6abaf7
xor edx, edx
mov dword [esp + 4], edx
jmp 0x6abb0c
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov ebp, dword [ebx + edx*4 + 0x40]
movzx edx, byte [ebp + esi]
add eax, dword [esp + 4]
sar eax, 1
jns 0x6abb24
adc eax, 0
add dl, al
and dl, 0xff
mov byte [ebp + esi], dl
inc esi
dec edi
jne 0x6abad4
jmp 0x6abbd1
xor eax, eax
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x6abbd1
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
ja 0x6abb9d
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 8], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 8]
push eax
movzx eax, byte [esp + 8]
pop edx
call fcn.006a89f8
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [esp]
and al, 0xff
mov byte [edx + esi], al
inc esi
dec edi
jne 0x6abb52
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4014d0
Capabilities:
Create directory
Write file on windows

Disassembly:
sub esp, 0x48
mov eax, dword [0x70a108]
xor eax, esp
mov dword [esp + 0x44], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push edi
push 0
push str.data
mov edi, ecx
call esi
push 0
push str.data_aiconfig
call esi
mov eax, dword [0x71a264]
movzx ecx, word [eax + 0x129]
push ecx
lea edx, [esp + 0x10]
push str.._data_aiconfig__d.dat
push edx
call fcn.00586b40
push 0x5cf650
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.00586aa0
mov eax, dword [esp + 0x20]
add esp, 0x18
test eax, eax
je 0x401556
push eax
push 1
push 0x1c64
add edi, 0xec
push edi
call fcn.00586390
mov edx, dword [esp + 0x18]
push edx
call fcn.00586180
add esp, 0x14
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
xor ecx, esp
call fcn.00586d40
add esp, 0x48
ret

Function at 0x4041d0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x5bc09c
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x70a108]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
xor edi, edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esp + 0x20], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
mov dword [esi + 0x78], edi
lea ecx, [esi + 0xec]
mov byte [esp + 0x20], 2
call fcn.00401000
push 0x64
lea ecx, [esi + 0x1c]
mov dword [esi + 0x1d7c], edi
mov dword [esi], edi
mov dword [esi + 8], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x94], edi
mov dword [esi + 0x98], edi
call fcn.0053d2d0
push 0xc8
lea ecx, [esi + 0x40]
call fcn.0053d2d0
push 0x1f4
lea ecx, [esi + 0x64]
call fcn.0053d2d0
mov ecx, esi
call fcn.00403d30
mov ecx, esi
call fcn.00403eb0
mov ecx, esi
call fcn.00404040
mov ecx, esi
call fcn.004015b0
mov eax, dword [0x71b194]
push edi
mov dword [esi + 0x1d50], eax
mov dword [esi + 4], edi
mov dword [esi + 0x9c], 0xffffffff
mov dword [esi + 0x8c], edi
mov dword [esi + 0x90], edi
mov dword [esi + 0xdc], edi
mov dword [esi + 0x1d80], edi
mov dword [esi + 0x1d84], edi
mov dword [esi + 0xc8], edi
mov dword [esi + 0xcc], edi
mov dword [esi + 0xd4], edi
call fcn.00586070
mov dword [esi + 0xd8], eax
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x404770
Capabilities:
Create directory
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
xor edi, edi
mov dword [esp + 0x10], ecx
xor ebp, ebp
mov esi, 0x1d4
lea ebx, [edi + 1]
call fcn.00404310
mov dword [eax + esi + 0xbc], ebx
call fcn.00404310
mov dword [eax + esi], edi
cmp ebp, 5
jge 0x4047bf
call fcn.00404310
mov dword [eax + esi - 0x88], edi
call fcn.00404310
mov dword [eax + esi - 0x34], edi
call fcn.00404310
mov dword [eax + esi + 0x88], ebx
cmp ebp, 4
jge 0x4047e6
call fcn.00404310
mov dword [eax + esi - 0x74], edi
call fcn.00404310
mov dword [eax + esi - 0x20], edi
call fcn.00404310
mov dword [eax + esi + 0x9c], 5
cmp ebp, 2
jge 0x40482f
call fcn.00404310
mov dword [eax + esi - 0x64], edi
call fcn.00404310
mov dword [eax + esi - 0x5c], edi
call fcn.00404310
mov dword [eax + esi - 0x10], edi
call fcn.00404310
mov dword [eax + esi + 0xac], 5
call fcn.00404310
mov dword [eax + esi - 8], edi
call fcn.00404310
mov dword [eax + esi + 0xb4], 5
add esi, 4
add ebp, ebx
cmp esi, 0x1ec
jl 0x404785
call fcn.00404310
mov dword [eax + 0x240], 0x1e
call fcn.00404310
mov dword [eax + 0x180], ebx
call fcn.00404310
mov dword [eax + 0x184], ebx
call fcn.00404310
mov esi, 0xfa
mov dword [eax + 0x228], esi
call fcn.00404310
mov dword [eax + 0x22c], esi
call fcn.00404310
mov dword [eax + 0x188], ebx
call fcn.00404310
mov dword [eax + 0x18c], ebx
call fcn.00404310
mov dword [eax + 0x250], ebx
call fcn.00404310
mov ebp, 3
mov dword [eax + 0x254], ebp
call fcn.00404310
mov dword [eax + 0x190], ebx
call fcn.00404310
mov dword [eax + 0x12c], ebx
call fcn.00404310
mov dword [eax + 0xf0], edi
call fcn.00404310
mov dword [eax + 0xf4], edi
call fcn.00404310
mov dword [eax + 0xf8], edi
call fcn.00404310
mov dword [eax + 0x194], edi
call fcn.00404310
mov dword [eax + 0x198], edi
call fcn.00404310
mov esi, 5
mov dword [eax + 0x218], esi
call fcn.00404310
mov dword [eax + 0x220], esi
call fcn.00404310
mov dword [eax + 0x21c], esi
call fcn.00404310
mov dword [eax + 0x258], ebp
call fcn.00404310
mov dword [eax + 0x204], esi
call fcn.00404310
mov dword [eax + 0x19c], edi
call fcn.00404310
mov dword [eax + 0xfc], edi
call fcn.00404310
mov dword [eax + 0x10c], ebx
call fcn.00404310
mov dword [eax + 0x110], ebx
call fcn.00404310
mov dword [eax + 0x118], ebx
call fcn.00404310
mov dword [eax + 0x120], ebx
call fcn.00404310
mov ecx, dword [esp + 0x10]
mov dword [eax + 0x2a8], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 4
jmp fcn.004014d0
Function at 0x404f50
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x4c
mov eax, dword [0x70a108]
xor eax, esp
mov dword [esp + 0x48], eax
mov eax, dword [0x71a264]
push esi
mov esi, ecx
movzx ecx, word [eax + 0x129]
push edi
push ecx
lea edx, [esp + 0x14]
push str.._data_aiconfig__d.dat
push edx
call fcn.00586b40
push 0x1c64
lea edi, [esi + 0xec]
push 0
push edi
call fcn.00585ff0
push 0x5cf710
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x28]
push ecx
call fcn.00586aa0
mov eax, dword [esp + 0x2c]
add esp, 0x24
test eax, eax
je 0x405028
push eax
push 1
push 0x1c64
push edi
call fcn.00587d80
mov edx, dword [esp + 0x18]
push edx
call fcn.00586180
add esp, 0x14
call fcn.00404310
mov eax, dword [eax + 0x228]
imul eax, eax, 0x64
mov dword [esp + 0xc], eax
fild dword [esp + 0xc]
test eax, eax
jns 0x404feb
fadd dword [0x5cf690]
fstp dword [esi + 0xe0]
call fcn.00404310
mov ecx, dword [eax + 0x22c]
imul ecx, ecx, 0x64
mov dword [esp + 0xc], ecx
fild dword [esp + 0xc]
test ecx, ecx
jns 0x405011
fadd dword [0x5cf690]
pop edi
fstp dword [esi + 0xe8]
pop esi
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.00586d40
add esp, 0x4c
ret
mov ecx, esi
call fcn.00404770
mov ecx, dword [esp + 0x50]
pop edi
pop esi
xor ecx, esp
call fcn.00586d40
add esp, 0x4c
ret

Function at 0x404f63
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x4c
mov eax, dword [0x70a108]
xor eax, esp
mov dword [esp + 0x48], eax
mov eax, dword [0x71a264]
push esi
mov esi, ecx
movzx ecx, word [eax + 0x129]
push edi
push ecx
lea edx, [esp + 0x14]
push str.._data_aiconfig__d.dat
push edx
call fcn.00586b40
push 0x1c64
lea edi, [esi + 0xec]
push 0
push edi
call fcn.00585ff0
push 0x5cf710
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x28]
push ecx
call fcn.00586aa0
mov eax, dword [esp + 0x2c]
add esp, 0x24
test eax, eax
je 0x405028
push eax
push 1
push 0x1c64
push edi
call fcn.00587d80
mov edx, dword [esp + 0x18]
push edx
call fcn.00586180
add esp, 0x14
call fcn.00404310
mov eax, dword [eax + 0x228]
imul eax, eax, 0x64
mov dword [esp + 0xc], eax
fild dword [esp + 0xc]
test eax, eax
jns 0x404feb
fadd dword [0x5cf690]
fstp dword [esi + 0xe0]
call fcn.00404310
mov ecx, dword [eax + 0x22c]
imul ecx, ecx, 0x64
mov dword [esp + 0xc], ecx
fild dword [esp + 0xc]
test ecx, ecx
jns 0x405011
fadd dword [0x5cf690]
pop edi
fstp dword [esi + 0xe8]
pop esi
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.00586d40
add esp, 0x4c
ret
mov ecx, esi
call fcn.00404770
mov ecx, dword [esp + 0x50]
pop edi
pop esi
xor ecx, esp
call fcn.00586d40
add esp, 0x4c
ret