joyce8/EMBER2024-capa huggingface dataset:
Function at 0x529bd0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + 0x28]
push edi
mov edi, ecx
lea ebx, [edi + 0x94]
mov dword [ebp + 0xc], eax
test ebx, ebx
je 0x529bf5
mov ecx, ebx
call fcn.004f0b18
lea ecx, [ebp + 0xc]
push ecx
lea edx, [ebp - 4]
push edx
lea ecx, [edi + 0x84]
call fcn.005290a0
mov eax, dword [ebp - 4]
cmp eax, dword [edi + 0x88]
je 0x529c1b
mov eax, dword [eax + 0x10]
mov dword [ebp + 0xc], eax
jmp 0x529c22
mov dword [ebp + 0xc], 0
test ebx, ebx
je 0x529c2d
mov ecx, ebx
call fcn.004f0b20
cmp dword [ebp + 0xc], 0
je 0x529ce2
mov ecx, dword [ebp + 0x10]
add dword [esi + 0x20], ecx
mov eax, dword [esi + 0x20]
mov dword [ebp - 8], 0
cmp eax, dword [esi + 0x1c]
jge 0x529cd7
push 0
call fcn.005377d5
mov ebx, dword [ebp + 8]
add esp, 4
mov dword [ebx + 4], eax
mov eax, dword [esi + 0x20]
mov edx, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
push 0
push esi
add edx, eax
push 0
mov dword [ebp - 0xc], edx
lea edx, [ebp - 8]
push edx
sub ecx, eax
push 1
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ecx
mov ecx, dword [esi + 0x28]
push eax
push ecx
mov dword [esi + 0x24], 0xa
call dword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0xffffffff
jne 0x529cea
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x529cea
lea ecx, [ebx + 0x2c]
call fcn.004f161d
mov edx, dword [esi + 0x30]
push edx
push ebx
mov ecx, edi
call fcn.00527ba0
push esi
mov ecx, edi
call fcn.00527bf0
push esi
mov ecx, edi
call fcn.00527f70
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp + 8]
add ecx, 0x2c
call fcn.004f161d
push esi
mov ecx, edi
call fcn.00527f70
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x529f10
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x676300]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, ecx
cmp dword [edi + 0x80], 0
mov dword [ebp - 0x24], ebx
je 0x529f4a
pop edi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00534bba
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x28]
cmp eax, 0xffffffff
je 0x529f56
test eax, eax
jne 0x529f67
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [edi + 0x28], eax
mov eax, dword [edi + 0x28]
cmp eax, 0xffffffff
je 0x52a103
test eax, eax
je 0x52a103
mov eax, dword [ebp + 0x10]
mov edx, dword [edi]
mov dword [edi + 0x2c], eax
mov eax, dword [edx + 0x18]
mov ecx, edi
call eax
mov dword [edi + 4], eax
cmp eax, 0xffffffff
jne 0x529fc3
call fcn.00568c15
push eax
push str.BaseListenOn:_Create_socket_failed:__s
push str.NetworkServer
push 0x67fa0c
call fcn.004ebec7
add esp, 0x10
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00534bba
mov esp, ebp
pop ebp
ret 0xc
push esi
push 4
lea ecx, [ebp - 0x20]
push ecx
push 4
push 0xffff
push eax
mov dword [ebp - 0x20], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
mov esi, dword [ebp + 0xc]
push esi
call dword [sym.imp.WS2_32.dll_htons]
mov edx, 2
mov word [ebp - 0x12], ax
mov word [ebp - 0x14], dx
test ebx, ebx
je 0x52a00b
cmp byte [ebx], 0x2a
je 0x52a00b
push ebx
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x10], eax
jmp 0x52a012
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x1c], 0
test si, si
jne 0x52a02d
call fcn.00568bda
movzx esi, ax
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x18], 0x64
push esi
mov word [edi + 8], si
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [edi + 4]
mov word [ebp - 0x12], ax
push 0x10
lea eax, [ebp - 0x14]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_bind]
mov ebx, eax
call fcn.00568bda
dec dword [ebp - 0x18]
cmp dword [ebp - 0x1c], 0
movzx esi, ax
je 0x52a073
cmp ebx, 0xffffffff
jne 0x52a0aa
cmp dword [ebp - 0x18], 0
jg 0x52a034
jmp 0x52a078
cmp ebx, 0xffffffff
jne 0x52a0aa
call fcn.00568c15
push eax
push str.Server_Socket_Bind_Failed:__s
push str.NetworkServer
push 0x67fa0c
call fcn.004ebec7
add esp, 0x10
pop esi
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00534bba
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x52a0b6
cmp byte [eax], 0x2a
jne 0x52a0bb
mov eax, str.0.0.0.0
lea esi, [edi + 0xc]
push eax
mov ecx, esi
call fcn.00408930
cmp dword [esi + 0x14], 0x10
jb 0x52a0ce
mov esi, dword [esi]
movzx edx, word [edi + 8]
push edx
push esi
push str.Address__s:_d_is_binded_successfully
push str.NetworkServer
push 0x67fa0c
call fcn.004ebdf1
add esp, 0x14
pop esi
pop edi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00534bba
mov esp, ebp
pop ebp
ret 0xc
push str.BaseListenOn:_create_wait_event_failed
push str.NetworkServer
push 0x67fa0c
call fcn.004ebec7
mov ecx, dword [ebp - 4]
add esp, 0xc
pop edi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00534bba
mov esp, ebp
pop ebp
ret 0xc
Function at 0x52a260
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
push esi
mov esi, ecx
mov ecx, dword [ebp + 0xc]
push eax
push ecx
push edx
mov ecx, esi
call fcn.00529f10
test eax, eax
je 0x52a2b1
mov eax, dword [esi + 0x64]
mov ecx, dword [esi + 0x78]
mov edx, dword [esi + 4]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
test eax, eax
jne 0x52a2b8
call fcn.00568c15
push eax
push str.Binding_Server_Socket_to_IO_Completion_Port_Failed:__s
push str.NetworkServer
push 0x67fa0c
call fcn.004ebec7
add esp, 0x10
xor eax, eax
pop esi
pop ebp
ret 0xc
lea eax, [ebp + 0x10]
push eax
push 0
push esi
push 0x527b80
push 0
push 0
mov dword [ebp + 0x10], 0xffffffff
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x74], eax
mov eax, 1
mov dword [esi + 0x80], eax
pop esi
pop ebp
ret 0xc
Function at 0x52a730
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 4
lea eax, [ebp - 4]
push eax
push 4
mov edi, ecx
mov ecx, dword [esi + 0x28]
push 0xffff
push ecx
mov dword [ebp - 4], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
mov edx, dword [esi + 0x28]
push edx
mov ecx, edi
call fcn.0052a490
mov ebx, eax
test ebx, ebx
jne 0x52a7b2
mov ebx, dword [esi + 0x28]
mov dword [esi + 0x28], 0xffffffff
cmp ebx, 0xffffffff
je 0x52a7a1
mov eax, dword [esi + 0x24]
cmp eax, 8
je 0x52a7a1
cmp eax, 9
je 0x52a7a1
cmp eax, 0xa
je 0x52a7a1
cmp eax, 0xb
je 0x52a7a1
push 1
push ebx
call dword [sym.imp.WS2_32.dll_shutdown]
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
push esi
mov ecx, edi
call fcn.00527f70
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebx + 0x30], eax
mov dword [ebp + 8], 0x10
mov eax, dword [ebx + 0x28]
lea ecx, [ebp + 8]
push ecx
lea edx, [ebx + 0x14]
mov dword [esi + 0x34], eax
mov eax, dword [esi + 0x28]
push edx
push eax
call dword [sym.imp.WS2_32.dll_getpeername]
mov eax, dword [ebp + 0xc]
mov ecx, dword [edi + 0x2c]
mov edx, dword [ecx]
mov edx, dword [edx + 8]
push 0
push 0
push eax
mov eax, dword [esi + 0x18]
push eax
push ebx
call edx
cmp eax, 1
jne 0x52a806
mov eax, dword [esi + 0x28]
push eax
mov ecx, edi
call fcn.005292d0
jmp 0x52a76b
mov ecx, dword [edi + 0x78]
mov edx, dword [esi + 0x28]
push 0
push edi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov ecx, edi
test eax, eax
jne 0x52a848
push eax
push ebx
call fcn.00527ba0
mov eax, dword [esi + 0x28]
push eax
mov ecx, edi
call fcn.005292d0
push esi
mov ecx, edi
call fcn.00527bf0
push esi
mov ecx, edi
call fcn.00527f70
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push esi
call fcn.00529770
mov ecx, edi
test eax, eax
jne 0x52a86f
push eax
push ebx
call fcn.00527ba0
mov ecx, dword [esi + 0x28]
push ecx
mov ecx, edi
call fcn.005292d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [esi + 0x28]
push edx
push esi
call fcn.00529970
test eax, eax
jne 0x52a891
push eax
push ebx
mov ecx, edi
call fcn.00527ba0
mov eax, dword [esi + 0x28]
push eax
mov ecx, edi
call fcn.005292d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x534bba
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x676300]
jne 0x534bc4
repz ret
jmp fcn.005417cb

Function at 0x53859e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x5385c5
call fcn.0053b8ca
mov dword [eax], esi
call fcn.0053b8b7
push 0x16
pop esi
mov dword [eax], esi
call fcn.005424b9
mov eax, esi
jmp 0x53861a
test dword [ebp + 0xc], 0xfffffff9
jne 0x5385ab
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x5385f2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0053b8dd
pop ecx
call fcn.0053b8b7
mov eax, dword [eax]
jmp 0x53861a
test al, 0x10
jne 0x538618
test al, 1
je 0x538618
test byte [ebp + 0xc], 2
je 0x538618
call fcn.0053b8ca
mov dword [eax], 5
call fcn.0053b8b7
mov dword [eax], 0xd
jmp 0x5385e9
xor eax, eax
pop esi
pop ebp
ret

Function at 0x53aef2
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x53af19
call fcn.0053b8ca
mov dword [eax], esi
call fcn.0053b8b7
push 0x16
pop esi
mov dword [eax], esi
call fcn.005424b9
mov eax, esi
jmp 0x53af6e
test dword [ebp + 0xc], 0xfffffff9
jne 0x53aeff
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x53af46
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0053b8dd
pop ecx
call fcn.0053b8b7
mov eax, dword [eax]
jmp 0x53af6e
test al, 0x10
jne 0x53af6c
test al, 1
je 0x53af6c
test byte [ebp + 0xc], 2
je 0x53af6c
call fcn.0053b8ca
mov dword [eax], 5
call fcn.0053b8b7
mov dword [eax], 0xd
jmp 0x53af3d
xor eax, eax
pop esi
pop ebp
ret
Function at 0x54fbe4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x676300]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.005431b4
and dword [ebp - 0x14], 0
cmp dword [0x680d2c], 0
mov dword [ebp - 0x18], eax
jne 0x54fc97
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x54fd3f
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x54fd3f
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x680d2c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x680d30], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x680d34], eax
call edi
push eax
call esi
mov dword [0x680d3c], eax
test eax, eax
je 0x54fc97
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x680d38], eax
mov eax, dword [0x680d38]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x54fcf0
cmp dword [0x680d3c], ecx
je 0x54fcf0
push eax
call esi
push dword [0x680d3c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x54fcf0
test ebx, ebx
je 0x54fcf0
call edi
test eax, eax
je 0x54fce7
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x54fce7
test byte [ebp - 8], 1
jne 0x54fcf0
or dword [ebp + 0x10], 0x200000
jmp 0x54fd23
mov eax, dword [0x680d30]
cmp eax, dword [ebp - 0x18]
je 0x54fd23
push eax
call esi
test eax, eax
je 0x54fd23
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x54fd23
mov eax, dword [0x680d34]
cmp eax, dword [ebp - 0x18]
je 0x54fd23
push eax
call esi
test eax, eax
je 0x54fd23
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x680d2c]
call esi
test eax, eax
je 0x54fd3f
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x54fd41
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00534bba
leave
ret

Function at 0x568b79
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x676300]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x190
lea eax, [ebp - 0x194]
push 0
push eax
call fcn.00534b40
add esp, 0xc
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x568bbc
xor eax, eax
jmp 0x568bce
push 0
call fcn.005377d5
push eax
call fcn.005397ef
pop ecx
xor eax, eax
pop ecx
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00534bba
leave
ret
Function at 0x42e740
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
push ebx
test eax, eax
je 0x42ec60
test edx, edx
je 0x42ec60
call fcn.0042e757
mov eax, 0xffffffff
pop ebx
pop ebp
ret

Function at 0x432440
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
call fcn.00432449

Function at 0x43626a
Capabilities:
Encode data using xor

Disassembly:
jmp 0x43626d
dec edx
test dl, 3
jne 0x43626c
xor eax, eax
test edx, edx
je 0x436288
push esi
mov esi, dword [esp + 8]
xor dword [eax + ecx], esi
add eax, 4
cmp eax, edx
jb 0x43627d
pop esi
ret 8

Function at 0x436dd6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
mov eax, ecx
mov byte [ebp + 0xb], cl
shr eax, 0x18
mov byte [ebp + 8], al
mov eax, ecx
shr eax, 0x10
mov byte [ebp + 9], al
mov eax, ecx
push edi
mov edi, edx
shr eax, 8
xor ecx, ecx
mov byte [ebp + 0xa], al
mov edx, ecx
test edi, edi
je 0x436e1c
mov al, byte [ebp + ecx + 8]
xor byte [edx + esi], al
lea eax, [ecx + 1]
xor ecx, ecx
inc edx
cmp eax, 4
cmovne ecx, eax
cmp edx, edi
jb 0x436e05
pop edi
pop esi
pop ebp
ret 4
Function at 0x5279d0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov dword [ecx], 0x7038ac
add ecx, 4
call fcn.00634040
lea ecx, [esi + 8]
call fcn.00634040
xor ebx, ebx
mov byte [esi + 0xc], bl
lea ecx, [esi + 0x24]
xorps xmm0, xmm0
movups xmmword [esi + 0x10], xmm0
mov dword [esi + 0x20], ebx
call fcn.00634040
mov byte [esi + 0x28], bl
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
lea eax, [esi + 0x3c]
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x38], eax
xorps xmm0, xmm0
movups xmmword [esi + 0x44], xmm0
movups xmmword [esi + 0x54], xmm0
mov dword [esi + 0x68], ebx
mov dword [esi + 0x64], ebx
mov edi, 0x3f800000
mov dword [esi + 0x6c], edi
movups xmmword [esi + 0x70], xmm0
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], edi
movups xmmword [esi + 0x88], xmm0
mov dword [esi + 0x98], edi
movups xmmword [esi + 0x9c], xmm0
mov dword [esi + 0xac], edi
movups xmmword [esi + 0xb0], xmm0
mov dword [esi + 0xc0], edi
mov dword [esi + 0xe4], ebx
mov dword [esi + 0xe0], ebx
mov dword [esi + 0xd8], ebx
movups xmmword [esi + 0xc8], xmm0
mov eax, dword [0x70fcb8]
mov dword [esi + 0xe8], eax
lea ecx, [esi + 0xec]
call fcn.00556ea0
xorps xmm0, xmm0
movups xmmword [esi + 0x188], xmm0
mov dword [esi + 0x198], edi
movups xmmword [esi + 0x19c], xmm0
movups xmmword [esi + 0x1a5], xmm0
mov eax, dword [ebp + 8]
mov dword [esi + 0x1b8], eax
mov byte [esi + 0x1bc], bl
mov dword [esi + 0x1c0], ebx
mov dword [esi + 0x1c4], ebx
mov dword [esi + 0x1c8], ebx
call fcn.00514420
call fcn.0052bdf0
mov ecx, eax
mov dword [esi + 0xd8], eax
xor ecx, 0x84222325
mov edx, 0x1b3
mov eax, ecx
mul edx
shl ecx, 8
add ecx, edx
add ecx, 0x8d40976c
mov dword [esi + 0xd0], eax
mov dword [esi + 0xd4], ecx
mov edx, dword [esi + 0xe8]
mov ecx, dword [esi + 0xf0]
mov eax, ecx
shr eax, 6
test dword [0x70fcbc], edx
je 0x527b6d
cmp ecx, 0x40
mov ecx, 0x3e8
cmovb eax, ecx
push eax
call fcn.00658db0
add esp, 4
mov edi, dword [esi + 0x14]
mov dword [esi + 0x14], eax
test edi, edi
jne 0x527b90
call fcn.00529a60
mov ecx, eax
push 0
push str.TraceLog
push esi
call fcn.00529af0
mov dword [0x72fe9c], esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 4
test dword [0x70fcc0], edx
jne 0x527ba4
test dword [0x70fcc4], edx
jne 0x527bae
cmp ecx, 0x40
mov ecx, 0xfa0
cmovb eax, ecx
push eax
call fcn.00556200
jmp 0x527b3d
mov eax, dword [edi]
mov ebx, dword [eax]
mov ecx, ebx
call dword [section..00cfg]
mov ecx, edi
push 1
call ebx
jmp 0x527b4a
cmp ecx, 0x40
mov ecx, 0x100
jmp 0x527b34
cmp ecx, 0x40
mov ecx, 0x7a1200
jmp 0x527b85
Function at 0x52a180
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x124
mov eax, dword [0x72a00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x72feac]
mov ecx, dword [0x72dff4]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x52a1cd
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0066e1f1
mov eax, 0x72fea8
add esp, 0x124
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x72feac
call fcn.0066d917
add esp, 4
cmp dword [0x72feac], 0xffffffff
jne 0x52a1b3
lea edi, [ebp - 0x128]
xor esi, esi
push 0x118
push esi
push edi
call fcn.006719e0
add esp, 0xc
mov dword [edi - 4], 0x11c
lea edi, [ebp - 0x12c]
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea ebx, [ebp - 0x130]
mov dword [ebx], esi
push ebx
push esi
push esi
push dword [edi + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push 0x54
call fcn.0066d870
add esp, 4
mov esi, eax
mov ebx, dword [ebx]
mov eax, dword [0x72fedc]
mov ecx, dword [0x72dff4]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x52a276
mov ecx, esi
push ebx
push 0x72feb8
push edi
call fcn.0052a370
mov dword [0x72fea8], esi
push 0x72feac
call fcn.0066d98d
add esp, 4
jmp 0x52a1b3
push 0x72fedc
call fcn.0066d917
add esp, 4
cmp dword [0x72fedc], 0xffffffff
jne 0x52a250
xorps xmm0, xmm0
movups xmmword [0x72fec8], xmm0
movups xmmword [0x72feb8], xmm0
mov dword [0x72fed8], 0
push 0x72feb8
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x72fedc
call fcn.0066d98d
add esp, 4
jmp 0x52a250

Function at 0x52a2d0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x72fedc]
mov ecx, dword [0x72dff4]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x52a301
movzx eax, word [0x72feb8]
cmp eax, 9
jne 0x52a34c
xor eax, eax
inc eax
pop ebp
ret
push 0x72fedc
call fcn.0066d917
add esp, 4
cmp dword [0x72fedc], 0xffffffff
jne 0x52a2f0
xorps xmm0, xmm0
movups xmmword [0x72fec8], xmm0
movups xmmword [0x72feb8], xmm0
mov dword [0x72fed8], 0
push 0x72feb8
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x72fedc
call fcn.0066d98d
add esp, 4
jmp 0x52a2f0
test eax, eax
je 0x52a2ff
cmp eax, 6
jne 0x52a35c
mov eax, 2
jmp 0x52a2ff
cmp eax, 0xc
jne 0x52a368
mov eax, 3
jmp 0x52a2ff
mov eax, 4
jmp 0x52a2ff
Function at 0x52ac50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x72a00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, 4
lea edx, [ebp - 0x14]
mov dword [edx], eax
lea esi, [ebp - 0x18]
mov dword [esi], eax
xor eax, eax
lea edi, [ebp - 0x1c]
mov dword [edi], eax
mov ebx, dword [ebp + 8]
push esi
push edi
push edx
push eax
push ebx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x52acc3
mov eax, dword [ebp - 0x14]
add eax, 0xfffffffd
mov esi, 0x3f4
cmp eax, 1
ja 0x52acad
cmp dword [ebp - 0x18], 4
jne 0x52acad
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0066e1f1
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov esi, eax
jmp 0x52acad

Function at 0x52acd0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x100c
call fcn.0066f040
mov esi, ecx
mov eax, dword [0x72a00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ebx, 0x800
lea edi, [ebp - 0x810]
push ebx
push 0xff
push edi
call fcn.006719e0
add esp, 0xc
lea eax, [ebp - 0x1014]
mov dword [eax], 1
lea ecx, [ebp - 0x1018]
mov dword [ecx], ebx
push ecx
push edi
push eax
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x52ad69
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x1014]
cmp eax, 1
jne 0x52ad6d
push edi
call fcn.00687336
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.005267b0
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0066e1f1
mov eax, esi
add esp, 0x100c
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov esi, eax
jmp 0x52ad50
cmp eax, 2
jne 0x52adc0
lea ebx, [ebp - 0x1010]
push 0x800
push 0xff
push ebx
call fcn.006719e0
add esp, 0xc
push 0x400
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x1018], eax
add eax, 0xfffffbff
cmp eax, 0xfffffc00
jb 0x52adb9
push ebx
call fcn.00687336
add esp, 4
mov ecx, esi
push eax
push ebx
jmp 0x52ad49
mov esi, 0xea
jmp 0x52ad50
mov esi, 0x3f4
jmp 0x52ad50
Function at 0x52b530
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, edx
mov ebx, ecx
mov eax, dword [0x72a00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
test ecx, ecx
jne 0x52b58a
mov eax, dword [0x72cb14]
cmp eax, 0xffffffff
jne 0x52b570
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x72cb14
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x52b57b
mov eax, dword [0x72cb14]
mov ebx, 0x100000
test eax, eax
jne 0x52b58a
jmp 0x52b585
mov dword [0x72cb14], 0
mov ebx, 0x80000
push 0x10
call fcn.0066d870
add esp, 4
mov esi, eax
mov eax, edi
shr eax, 0xe
mov ecx, edi
shr ecx, 0x13
mov ecx, dword [ecx*4 + 0x7322f8]
bt ecx, eax
jae 0x52b5b7
push edi
call fcn.00628c40
add esp, 4
jmp 0x52b5c3
mov eax, edi
shr eax, 0x15
mov byte [eax + 0x73a2f8], 1
mov dword [esi], edi
mov edi, dword [ebp + 8]
test edi, edi
setne byte [esi + 4]
mov eax, dword [ebp + 0xc]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0xc], eax
xor eax, eax
push eax
push 0x10000
push esi
push 0x52b9d0
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x52b5fc
test edi, edi
je 0x52b652
mov dword [edi], eax
jmp 0x52b65d
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
je 0x52b615
cmp eax, 0x5af
je 0x52b615
cmp eax, 0xe
jne 0x52b676
push ebx
call fcn.006c8b90
add esp, 4
test esi, esi
mov eax, edi
je 0x52b65d
mov eax, dword [esi]
mov ecx, eax
shr ecx, 0xe
mov edx, eax
shr edx, 0x13
mov edx, dword [edx*4 + 0x7322f8]
bt edx, ecx
jae 0x52b645
push eax
call fcn.00628d60
add esp, 4
push esi
call fcn.0066d8a0
add esp, 4
mov eax, edi
jmp 0x52b65d
push eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
test eax, eax
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0066e1f1
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x20], eax
mov eax, dword [0x72ff3c]
mov ecx, dword [0x72dff4]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x52b6da
lea ebx, [ebp - 0x1c]
push dword [ebp - 0x20]
push ebx
call fcn.00531a00
add esp, 8
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x52b6b3
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
push eax
push ebx
push dword [0x72ff38]
call fcn.006599b0
add esp, 0xc
cmp byte [ebp - 0x11], 0
jns 0x52b61e
push dword [ebp - 0x1c]
call fcn.0066d8a0
jmp 0x52b61b
push 0x72ff3c
call fcn.0066d917
add esp, 4
cmp dword [0x72ff3c], 0xffffffff
jne 0x52b696
push 0x20
push str.create_thread_last_error
call fcn.00558630
add esp, 8
mov dword [0x72ff38], eax
push 0x72ff3c
call fcn.0066d98d
add esp, 4
jmp 0x52b696