joyce8/EMBER2024-capa huggingface dataset:
Function at 0x592188
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe6c
push ebx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x194]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
xor ecx, ecx
push ebp
push 0x5921f2
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov eax, ebx
call fcn.0040579c
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x5921df
mov edx, dword [eax + 0xc]
test edx, edx
je 0x5921df
mov eax, dword [edx]
lea edx, [ebp - 4]
mov ecx, 4
call fcn.004031c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5921f9
call sub.wsock32.dll_WSACleanup
ret

Function at 0x59262c
Capabilities:
Create process on windows

Disassembly:
push ebx
push 1
push 0
push 0
push eax
push 0x592644
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, ebx
pop ebx
ret

Function at 0x592758
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x59288b
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
lea eax, [ebp - 4]
call fcn.0040530c
lea eax, [ebp - 8]
push eax
push 0
call sub.iphlpapi.dll_GetAdaptersInfo
cmp dword [ebp - 8], 0
jbe 0x59279b
mov eax, dword [ebp - 8]
call fcn.00402fd8
mov esi, eax
lea eax, [ebp - 8]
push eax
mov ebx, esi
push ebx
call sub.iphlpapi.dll_GetAdaptersInfo
test eax, eax
jne 0x592864
test ebx, ebx
je 0x592864
lea eax, [ebp - 4]
push eax
movzx eax, byte [ebx + 0x194]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0
movzx eax, byte [ebx + 0x195]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0
movzx eax, byte [ebx + 0x196]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0
movzx eax, byte [ebx + 0x197]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
movzx eax, byte [ebx + 0x198]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0
movzx eax, byte [ebx + 0x199]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x38]
mov ecx, 5
mov eax, 0x5928a4
call fcn.0040b68c
mov edx, dword [ebp - 4]
mov eax, dword [0x624a74]
call fcn.004058e8
test al, al
jne 0x592852
mov edx, dword [ebp - 4]
mov eax, dword [0x624a78]
call fcn.004058e8
test al, al
jne 0x592852
mov eax, dword [ebp - 4]
mov edx, 0x5928cc
call fcn.00405734
jne 0x592864
lea eax, [ebp - 4]
call fcn.0040530c
mov ebx, dword [ebx]
test ebx, ebx
jne 0x5927b7
mov eax, esi
call fcn.00402ff4
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00405360
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x592892
lea eax, [ebp - 4]
call fcn.0040530c
ret
Function at 0x594c78
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x594cdc
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.0040557c
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GetACP_1
mov edx, eax
pop eax
call fcn.0040a6cc
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x594ce3
lea eax, [ebp - 0xc]
call fcn.0040530c
ret

Function at 0x59a194
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x59a204
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x104
call fcn.00405a2c
mov eax, dword [ebx]
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
test esi, esi
je 0x59a1ce
sub esi, 4
mov esi, dword [esi]
mov eax, dword [ebx]
call fcn.0040579c
push eax
push esi
call sub.KERNEL32.DLL_GetTempPathA
mov edx, ebx
xchg edx, eax
call fcn.00405a2c
lea edx, [ebp - 8]
mov eax, dword [ebx]
call fcn.00599dbc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59a20b
lea eax, [ebp - 8]
call fcn.0040530c
ret

Function at 0x59c2e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
push ebp
add esp, 0xffffffbc
mov esi, edx
lea edi, [esp + 1]
push ecx
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop ecx
mov edi, ecx
add eax, 2
mov dword [edi], eax
push edi
lea esi, [esp + 5]
lea edi, [esp + 0x28]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop edi
lea eax, [esp + 0x24]
mov edx, 0x59c37c
mov cl, 0x20
call fcn.00403d74
push edi
lea esi, [esp + 0x28]
lea edi, [esp + 5]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop edi
mov al, 1
jmp 0x59c36e
mov edx, dword [edi]
movzx ebp, word [edx]
movzx esi, bp
mov edx, esi
shr dx, 8
mov ecx, esi
and ecx, 0xff
mov byte [esp], cl
test dl, dl
jne 0x59c360
movzx eax, byte [esp]
movzx eax, al
bt dword [esp + 1], eax
setb al
xor al, 1
test bp, bp
jne 0x59c367
xor eax, eax
test al, al
je 0x59c36e
add dword [edi], 2
test al, al
jne 0x59c332
sub dword [edi], 2
add esp, 0x44
pop ebp
pop edi
pop esi
ret
Function at 0x5afc4c
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040578c
mov eax, dword [ebp - 8]
call fcn.0040578c
xor eax, eax
push ebp
push 0x5afd17
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 0x14
mov dword [ebp - 0x1c], 0x14
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 3
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x3c], 3
mov dword [ebp - 0x34], 2
mov eax, dword [ebp - 8]
call fcn.0040579c
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 3
mov eax, 0x5afd24
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
call fcn.0040579c
push eax
call sub.wininet.dll_InternetOpenA
mov ebx, eax
push esi
lea eax, [ebp - 0x1c]
push eax
push 0x4b
push ebx
call sub.wininet.dll_InternetSetOptionA
push 0
push 0
push 0x25
push ebx
call sub.wininet.dll_InternetSetOptionA
push ebx
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5afd1e
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405330
ret

Function at 0x5afd2c
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040578c
mov eax, dword [ebp - 8]
call fcn.0040578c
mov eax, dword [ebp - 0xc]
call fcn.0040578c
mov eax, dword [ebp + 0xc]
call fcn.0040578c
xor eax, eax
push ebp
push 0x5afe39
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 0x14
mov dword [ebp - 0x20], 0x14
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 3
mov dword [ebp - 0x44], 1
mov dword [ebp - 0x40], 3
mov dword [ebp - 0x38], 2
mov eax, dword [ebp - 8]
call fcn.0040579c
mov edi, eax
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x2c], 3
mov eax, 0x5afe4c
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
call fcn.0040579c
push eax
call sub.wininet.dll_InternetOpenA
mov ebx, eax
push 0
push 0
push 3
mov eax, dword [ebp + 0xc]
call fcn.0040579c
push eax
mov eax, dword [ebp - 0xc]
call fcn.0040579c
push eax
movzx eax, word [ebp + 8]
push eax
push edi
push ebx
call sub.wininet.dll_InternetConnectA
push esi
lea eax, [ebp - 0x20]
push eax
push 0x4b
push ebx
call sub.wininet.dll_InternetSetOptionA
push 0
push 0
push 0x25
push ebx
call sub.wininet.dll_InternetSetOptionA
push ebx
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5afe40
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405330
lea eax, [ebp + 0xc]
call fcn.0040530c
ret
Function at 0x5b14c8
Capabilities:
Create http request

Disassembly:
push ebx
push esi
add esp, 0xffffffc8
mov esi, 0x14
mov dword [esp], 0x14
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], 3
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], 3
mov dword [esp + 0x20], 2
mov eax, 0x5b155c
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], 3
mov eax, 0x5b1560
mov dword [esp + 0x30], eax
lea eax, [esp + 0x14]
mov dword [esp + 0x10], eax
push 0
push 0
push 0
push 1
push 0x5b155c
call sub.wininet.dll_InternetOpenA
mov ebx, eax
push esi
lea eax, [esp + 4]
push eax
push 0x4b
push ebx
call sub.wininet.dll_InternetSetOptionA
push 0
push 0
push 0x25
push ebx
call sub.wininet.dll_InternetSetOptionA
push ebx
call sub.wininet.dll_InternetCloseHandle
add esp, 0x38
pop esi
pop ebx
ret

Function at 0x5b1527
Capabilities:
Create http request

Disassembly:
push ebx
push esi
add esp, 0xffffffc8
mov esi, 0x14
mov dword [esp], 0x14
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], 3
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], 3
mov dword [esp + 0x20], 2
mov eax, 0x5b155c
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], 3
mov eax, 0x5b1560
mov dword [esp + 0x30], eax
lea eax, [esp + 0x14]
mov dword [esp + 0x10], eax
push 0
push 0
push 0
push 1
push 0x5b155c
call sub.wininet.dll_InternetOpenA
mov ebx, eax
push esi
lea eax, [esp + 4]
push eax
push 0x4b
push ebx
call sub.wininet.dll_InternetSetOptionA
push 0
push 0
push 0x25
push ebx
call sub.wininet.dll_InternetSetOptionA
push ebx
call sub.wininet.dll_InternetCloseHandle
add esp, 0x38
pop esi
pop ebx
ret

Function at 0x5b16b0
Capabilities:
Get geographical location

Disassembly:
add esp, 0xfffffff4
mov eax, esp
xor ecx, ecx
mov edx, 0xa
call fcn.00403a40
push 0xa
lea eax, [esp + 4]
push eax
push 0xd
push 0x400
call sub.KERNEL32.DLL_GetLocaleInfoA_1
cmp byte [esp], 0x31
jne 0x5b16de
mov al, 1
jmp 0x5b16e0
xor eax, eax
add esp, 0xc
ret

Function at 0x5b16c8
Capabilities:
Get geographical location

Disassembly:
add esp, 0xfffffff4
mov eax, esp
xor ecx, ecx
mov edx, 0xa
call fcn.00403a40
push 0xa
lea eax, [esp + 4]
push eax
push 0xd
push 0x400
call sub.KERNEL32.DLL_GetLocaleInfoA_1
cmp byte [esp], 0x31
jne 0x5b16de
mov al, 1
jmp 0x5b16e0
xor eax, eax
add esp, 0xc
ret

Function at 0x5b4494
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
xor ecx, ecx
mov edx, 0x40
call fcn.00403a40
ret
Function at 0x5bb650
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe4
mov esi, edx
lea edi, [esp]
push ecx
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
pop ecx
mov esi, ecx
mov ebx, eax
mov eax, dword [esp + 4]
cmp eax, 0x206
jne 0x5bb678
mov byte [esi], 1
jmp 0x5bb6f0
cmp eax, 0x204
jne 0x5bb68d
mov edx, esp
mov eax, ebx
call fcn.005bb6f8
mov byte [esi], 1
jmp 0x5bb6f0
cmp eax, 0x100
jne 0x5bb6f0
cmp dword [esp + 8], 0x74
jne 0x5bb69e
mov byte [esi], 1
cmp dword [esp + 8], 0x41
jne 0x5bb6bb
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5bb6bb
mov eax, ebx
call fcn.005bc064
mov byte [esi], 1
cmp dword [esp + 8], 0x43
jne 0x5bb6da
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5bb6da
mov eax, ebx
call fcn.005bc0dc
mov byte [esi], 1
jmp 0x5bb6f0
cmp dword [esp + 8], 0x46
jne 0x5bb6f0
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5bb6f0
mov byte [esi], 1
add esp, 0x1c
pop edi
pop esi
pop ebx
ret
Function at 0x5c1cb4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff44
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x24]
mov ebx, dword [ebp + 0x28]
mov eax, dword [ebp - 4]
call fcn.0040578c
mov eax, dword [ebp - 8]
call fcn.0040578c
mov eax, dword [ebp - 0xc]
call fcn.0040578c
xor eax, eax
push ebp
push 0x5c1e97
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.00592554
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 4]
call fcn.004053a4
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 8]
call fcn.00592554
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 8]
call fcn.004053a4
lea ecx, [ebp - 0x18]
movzx edx, word [ebp + 0x1c]
movzx eax, word [ebp + 0x20]
call fcn.005c15b8
lea ecx, [ebp - 0x1c]
movzx edx, word [ebp + 0x14]
movzx eax, word [ebp + 0x18]
call fcn.005c15b8
lea edx, [ebp - 0x10]
mov eax, dword [ebp + 0x10]
call fcn.005c14f4
lea edx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
call fcn.005c14f4
test esi, esi
jne 0x5c1dca
push edi
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
mov dword [ebp - 0x4c], ebx
mov byte [ebp - 0x48], 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov dword [ebp - 0x34], ebx
mov byte [ebp - 0x30], 0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
lea edx, [ebp - 0x5c]
mov ecx, 6
mov eax, 0x5c1eb0
call fcn.0040b68c
jmp 0x5c1e7c
push edi
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0xb
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xb4], eax
mov byte [ebp - 0xb0], 0xb
mov dword [ebp - 0xac], ebx
mov byte [ebp - 0xa8], 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0xa4], eax
mov byte [ebp - 0xa0], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x9c], eax
mov byte [ebp - 0x98], 0xb
mov dword [ebp - 0x94], ebx
mov byte [ebp - 0x90], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x8c], eax
mov byte [ebp - 0x88], 0xb
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x84], eax
mov byte [ebp - 0x80], 0xb
mov dword [ebp - 0x7c], esi
mov byte [ebp - 0x78], 0
mov eax, dword [ebp - 8]
mov dword [ebp - 0x74], eax
mov byte [ebp - 0x70], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
lea edx, [ebp - 0xbc]
mov ecx, 0xb
mov eax, 0x5c1f34
call fcn.0040b68c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c1e9e
lea eax, [ebp - 0x24]
mov edx, 9
call fcn.00405330
ret
Function at 0x5d6640
Capabilities:
Capture microphone audio

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x5d670d
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x20
mov eax, ebx
call fcn.005d5cf8
mov esi, eax
mov edi, esi
mov eax, edi
xor ecx, ecx
mov edx, 0x20
call fcn.00403a40
mov edx, esi
mov eax, dword [ebx + 0x68]
call fcn.0041cfc4
mov edx, dword [ebx + 0x90]
mov eax, ebx
call fcn.005d5cf8
mov dword [edi], eax
mov eax, dword [ebx + 0x90]
mov dword [edi + 4], eax
lea edx, [ebp - 4]
mov eax, dword [0x6333f8]
call fcn.004079f4
mov eax, dword [ebp - 4]
push eax
push 0x20
push esi
mov eax, dword [ebx + 0xa0]
push eax
call sub.winmm.dll_waveInPrepareHeader
mov ecx, dword [0x5d5120]
pop edx
call fcn.005d40a0
lea edx, [ebp - 8]
mov eax, dword [0x6332a0]
call fcn.004079f4
mov eax, dword [ebp - 8]
push eax
push 0x20
push esi
mov eax, dword [ebx + 0xa0]
push eax
call sub.winmm.dll_waveInAddBuffer
mov ecx, dword [0x5d5120]
pop edx
call fcn.005d40a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d6714
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405330
ret

Function at 0x5ddaf0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x5ddb59
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [0x6320f8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
cmp dword [ebp - 4], 0
je 0x5ddb43
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.005ddae0
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x5dd8dc]
call fcn.005ddb80
mov dword [0x63215c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ddb60
lea eax, [ebp - 8]
call fcn.004074f8
ret
Function at 0x5ef7f4
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x5ef7fc
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x5ef9ee
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x5efa04
mov eax, esi
call fcn.005ed660
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.00405360
lea ecx, [ebp - 0x10]
mov edx, 0x5efa18
mov eax, esi
call fcn.005ed660
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.00405360
lea ecx, [ebp - 0x14]
mov edx, 0x5efa30
mov eax, esi
call fcn.005ed660
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.00405360
lea ecx, [ebp - 0x18]
mov edx, 0x5efa4c
mov eax, esi
call fcn.005ed660
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.00405360
lea ecx, [ebp - 0x1c]
mov edx, 0x5efa68
mov eax, esi
call fcn.005ed660
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.00405360
lea ecx, [ebp - 0x24]
mov edx, 0x5efa80
mov eax, esi
call fcn.005ed660
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.0040a0a8
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.0040a6cc
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x5efa98
mov eax, esi
call fcn.005ed660
mov eax, dword [ebp - 0x28]
call fcn.0059aa94
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x5efaa8
mov eax, esi
call fcn.005ed660
mov eax, dword [ebp - 0x2c]
call fcn.0059aa94
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x5efac0
mov eax, esi
call fcn.005ed660
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.0040a6cc
inc eax
je 0x5ef991
lea ecx, [ebp - 0x34]
mov edx, 0x5efac0
mov eax, esi
call fcn.005ed660
mov eax, dword [ebp - 0x34]
call fcn.0040a690
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
movzx edx, word [ebp - 4]
movzx eax, word [ebp - 8]
call fcn.0040bfb4
fstp qword [ebp - 0x3c]
wait
call fcn.0040c31c
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x5ef9ac
lea ecx, [ebp - 0x40]
mov edx, 0x5efac0
mov eax, esi
call fcn.005ed660
mov eax, dword [ebp - 0x40]
call fcn.0059aa94
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x5efad0
mov eax, esi
call fcn.005ed660
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.00405360
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ef9f5
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00405330
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.00405330
ret
Function at 0x5ffab8
Capabilities:
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb0
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [esp + 4]
xor edx, edx
mov dword [eax], edx
lea eax, [esp + 0x10]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov ebp, dword [esp + 0x14]
call sub.KERNEL32.DLL_GetCurrentProcessId
mov dword [esp + 8], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0xc], eax
xor edi, edi
mov ebx, dword [esp + 0xc]
and ebx, 0xffff0000
mov eax, edi
shl eax, 0x10
sub ebx, eax
mov eax, ebp
not eax
inc eax
and eax, ebx
mov ebx, eax
push 4
push 0x3000
push ebp
push ebx
call sub.KERNEL32.DLL_VirtualAlloc_1
mov esi, eax
test esi, esi
je 0x5ffb31
cmp esi, ebx
je 0x5ffb31
push 0x8000
push 0
push esi
call sub.KERNEL32.DLL_VirtualFree_1
inc edi
jmp 0x5ffba9
test esi, esi
jne 0x5ffbb2
push 0x1c
lea eax, [esp + 0x38]
push eax
push ebx
call sub.KERNEL32.DLL_VirtualQuery_1
cmp dword [esp + 0x40], 0x118
jb 0x5ffba6
mov eax, dword [esp + 0x48]
and eax, 4
cmp eax, 4
jne 0x5ffba6
mov eax, dword [esp + 8]
xor edx, edx
xor eax, 0x23456789
xor edx, 0xabcdef01
cmp edx, dword [ebx + 4]
jne 0x5ffba6
cmp eax, dword [ebx]
jne 0x5ffba6
mov eax, dword [esp + 8]
xor edx, edx
xor eax, 0x10fedcba
xor edx, 0x98765432
cmp edx, dword [ebx + 0x114]
jne 0x5ffba6
cmp eax, dword [ebx + 0x110]
jne 0x5ffba6
lea eax, [ebx + 8]
mov edx, dword [esp]
movzx ecx, byte [eax]
inc ecx
call fcn.004039d0
je 0x5ffbb2
inc edi
xor ebx, ebx
cmp edi, 0x14
jle 0x5ffaef
xor eax, eax
test esi, esi
je 0x5ffc18
cmp esi, ebx
jne 0x5ffc34
mov eax, dword [esp + 8]
xor edx, edx
xor eax, 0x23456789
xor edx, 0xabcdef01
mov dword [ebx], eax
mov dword [ebx + 4], edx
lea eax, [ebx + 8]
mov edx, dword [esp]
call fcn.00403924
mov eax, dword [esp + 8]
xor edx, edx
xor eax, 0x10fedcba
xor edx, 0x98765432
mov dword [ebx + 0x110], eax
mov dword [ebx + 0x114], edx
mov dword [ebx + 0x108], 1
lea eax, [ebx + 0x118]
mov edx, dword [esp + 4]
mov dword [edx], 1
jmp 0x5ffc34
test ebx, ebx
je 0x5ffc34
inc dword [ebx + 0x108]
lea eax, [ebx + 0x118]
mov edx, dword [esp + 4]
mov ecx, dword [ebx + 0x108]
mov dword [edx], ecx
add esp, 0x50
pop ebp
pop edi
pop esi
pop ebx
ret