joyce8/EMBER2024-capa huggingface dataset:
Function at 0x517980
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x5d1d8b
mov eax, dword fs:[0]
push eax
sub esp, 0x338
mov eax, dword [0x65d4e4]
xor eax, esp
mov dword [esp + 0x334], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x65d4e4]
xor eax, esp
push eax
lea eax, [esp + 0x34c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x35c]
mov eax, dword [esp + 0x360]
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov edi, 0xf
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
cmp eax, ebx
mov dword [esp + 0x354], ebx
mov byte [esp + 0x140], bl
je 0x517b32
lea eax, [esp + 0x140]
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
je 0x517b32
mov cx, word [0x5f5b88]
mov dl, byte [0x5f5b8a]
mov word [esp + 0x14], cx
mov byte [esp + 0x16], dl
xor edi, edi
lea ebp, [esp + 0x140]
jmp 0x517a40
mov al, byte [ebp]
push 0x104
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x1c]
push edx
mov byte [esp + 0x20], al
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
je 0x517af1
lea eax, [esp + 0x3c]
lea edx, [eax + 1]
jmp 0x517a70
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x517a70
sub eax, edx
mov esi, eax
cmp esi, 0x104
jae 0x517aed
mov ecx, dword [esp + 0x18]
push esi
lea eax, [esp + 0x40]
push eax
push ecx
call fcn.005b416d
add esp, 0xc
mov edi, eax
neg edi
sbb edi, edi
inc edi
je 0x517aed
mov edx, dword [esp + 0x18]
add edx, esi
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x24c]
push 0x5f5b80
push ecx
call fcn.005b1b4c
lea eax, [esp + 0x254]
add esp, 0x10
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x517ad0
sub eax, edx
push eax
lea edx, [esp + 0x248]
push edx
lea ecx, [esp + 0x28]
call fcn.00409790
mov esi, dword [esp + 0x1c]
mov al, byte [ebp]
add ebp, 1
test al, al
jne 0x517af1
cmp edi, ebx
jne 0x517b08
cmp byte [ebp], bl
jne 0x517a40
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x28]
push ecx
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
mov ecx, esi
mov byte [esi + 4], bl
call fcn.00407e40
cmp dword [esp + 0x38], 0x10
jb 0x517b5e
mov edx, dword [esp + 0x24]
push edx
jmp 0x517b56
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x28]
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], ebx
push eax
mov ecx, esi
mov byte [esi + 4], bl
call fcn.00407e40
cmp dword [esp + 0x38], 0x10
jb 0x517b5e
mov ecx, dword [esp + 0x24]
push ecx
call fcn.00595eb8
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x34c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x334]
xor ecx, esp
call fcn.005b1988
add esp, 0x344
ret
Function at 0x51aa60
Capabilities:
Terminate process

Disassembly:
push ecx
mov eax, dword [esp + 8]
test eax, eax
push esi
mov esi, ecx
je 0x51ab46
cmp byte [eax], 0
je 0x51ab46
cmp dword [esi + 0xc], 0
jne 0x51aa84
call fcn.0051a3d0
mov eax, dword [esi + 8]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_OpenProcess]
lea ebx, [esi + 4]
push edi
mov edi, dword [eax]
mov dword [esp + 0x10], 1
lea ecx, [ecx]
cmp ebx, ebx
mov esi, dword [ebx + 4]
je 0x51aaac
call fcn.005b1933
cmp edi, esi
je 0x51ab3a
cmp edi, dword [ebx + 4]
jne 0x51aabe
call fcn.005b1933
mov esi, dword [edi + 8]
cmp dword [esi + 0x1c], 0x10
jb 0x51aacc
mov eax, dword [esi + 8]
jmp 0x51aacf
lea eax, [esi + 8]
mov ecx, dword [esp + 0x18]
push ecx
push eax
call fcn.005b24e5
add esp, 8
test eax, eax
je 0x51ab01
cmp dword [esi + 0x38], 0x10
jb 0x51aaec
mov eax, dword [esi + 0x24]
jmp 0x51aaef
lea eax, [esi + 0x24]
mov edx, dword [esp + 0x18]
push edx
push eax
call fcn.005b24e5
add esp, 8
test eax, eax
jne 0x51ab29
mov eax, dword [esi]
push eax
push 0
push 1
call ebp
mov esi, eax
cmp esi, 0xffffffff
je 0x51ab22
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x51ab22
mov dword [esp + 0x10], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, dword [ebx + 4]
jne 0x51ab33
call fcn.005b1933
mov edi, dword [edi]
jmp 0x51aaa0
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
pop ecx
ret 4
xor eax, eax
pop esi
pop ecx
ret 4
Function at 0x51ab50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5d23f6
mov eax, dword fs:[0]
push eax
sub esp, 0xb4
mov eax, dword [0x65d4e4]
xor eax, esp
mov dword [esp + 0xb0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x65d4e4]
xor eax, esp
push eax
lea eax, [esp + 0xc8]
mov dword fs:[0], eax
mov esi, dword [esp + 0xd8]
xor eax, eax
mov dword [esi], eax
lea ecx, [esp + 0x14]
xor ebx, ebx
mov dword [esi + 4], eax
call fcn.00518350
lea ecx, [esp + 0x14]
mov dword [esp + 0xd0], ebx
call fcn.0051a3d0
mov eax, dword [esp + 0x1c]
mov edi, dword [eax]
lea ebp, [ebx + 0xf]
lea ecx, [ecx]
cmp edi, dword [esp + 0x1c]
je 0x51ac90
mov dword [esp + 0x5c], ebp
mov dword [esp + 0x58], ebx
mov byte [esp + 0x48], bl
mov dword [esp + 0x78], ebp
mov dword [esp + 0x74], ebx
mov byte [esp + 0x64], bl
mov dword [esp + 0x94], ebp
mov dword [esp + 0x90], ebx
mov byte [esp + 0x80], bl
mov dword [esp + 0xb0], ebp
mov dword [esp + 0xac], ebx
mov byte [esp + 0x9c], bl
mov dword [esp + 0xb4], ebx
mov dword [esp + 0xb8], ebx
mov dword [esp + 0xbc], ebx
mov dword [esp + 0xc0], ebx
mov edx, dword [edi + 8]
mov eax, dword [edx]
lea ecx, [esp + 0x2c]
push ecx
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0xd8], 1
call fcn.0051a1e0
test eax, eax
je 0x51ac6e
cmp dword [esi + 4], ebx
jne 0x51ac51
cmp dword [esi], ebx
je 0x51ac61
lea eax, [esp + 0x3c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
test eax, eax
jle 0x51ac6e
mov edx, dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
mov dword [esi + 4], edx
mov dword [esi], ecx
lea ecx, [esp + 0x2c]
mov byte [esp + 0xd0], bl
call fcn.00415730
cmp edi, dword [esp + 0x1c]
jne 0x51ac89
call fcn.005b1933
mov edi, dword [edi]
jmp 0x51abc0
cmp dword [esi + 4], ebx
jne 0x51acbb
cmp dword [esi], ebx
jne 0x51acbb
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x18], vtable.BaseLib::TPointerContainer_class_std::list_struct_BaseLib::_tag_process_info___class_std::allocator_struct_BaseLib::_tag_process_info____.0
call fcn.00415960
add esp, 4
lea ecx, [esp + 0x18]
call fcn.004084d0
xor eax, eax
jmp 0x51ad13
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x18], vtable.BaseLib::TPointerContainer_class_std::list_struct_BaseLib::_tag_process_info___class_std::allocator_struct_BaseLib::_tag_process_info____.0
call fcn.00415960
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx]
mov dword [ecx], ecx
mov ecx, dword [esp + 0x20]
mov dword [ecx + 4], ecx
mov ecx, dword [esp + 0x20]
add esp, 4
cmp eax, ecx
mov dword [esp + 0x20], ebx
je 0x51ad05
jmp 0x51acf0
mov esi, dword [eax]
push eax
call fcn.00595eb8
mov ecx, dword [esp + 0x20]
add esp, 4
cmp esi, ecx
mov eax, esi
jne 0x51acf0
push ecx
call fcn.00595eb8
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0xc8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xb0]
xor ecx, esp
call fcn.005b1988
add esp, 0xc0
ret

Function at 0x51ade0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
xor eax, eax
test edx, edx
jle 0x51adfb
mov ecx, dword [esp + 4]
mov edi, edi
xor byte [eax + ecx], 2
add eax, 1
cmp eax, edx
jl 0x51adf0
ret
Function at 0x51ae40
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
push 0x62c570
push eax
call fcn.005b1ae9
mov esi, eax
add esp, 8
test esi, esi
je 0x51ae89
mov edx, dword [esp + 0xc]
mov eax, edx
push edi
lea edi, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x51ae63
push esi
sub eax, edi
push 1
push eax
push edx
call fcn.005b1d61
push esi
call fcn.005b1fa4
add esp, 0x14
pop edi
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x51ae90
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
push 0x5f5ac8
push eax
call fcn.005b1ae9
mov esi, eax
add esp, 8
test esi, esi
je 0x51aecb
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push esi
push 1
push ecx
push edx
call fcn.005b1d61
push esi
call fcn.005b1fa4
add esp, 0x14
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x51aed0
Capabilities:
Write file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov eax, ebx
push edi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x51aee0
sub eax, edx
mov edi, eax
mov eax, dword [esp + 0x10]
push 0x5f5ac8
push eax
call fcn.005b1ae9
mov esi, eax
add esp, 8
test esi, esi
je 0x51af21
push esi
push 1
push edi
push ebx
call fcn.005b1d61
push esi
call fcn.005b1fa4
add esp, 0x14
pop edi
pop esi
mov eax, 1
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret

Function at 0x51af30
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
je 0x51af98
cmp byte [ebx], 0
je 0x51af98
push esi
mov esi, ebx
push edi
lea ecx, [esi + 1]
mov al, byte [esi]
add esi, 1
test al, al
jne 0x51af45
sub esi, ecx
push esi
call fcn.00595ebd
push esi
mov edi, eax
push ebx
push edi
call fcn.005b74f0
add esp, 0x10
xor eax, eax
test esi, esi
jle 0x51af7b
lea esp, [esp]
xor byte [eax + edi], 2
add eax, 1
cmp eax, esi
jl 0x51af70
mov eax, dword [esp + 0x10]
push esi
push edi
push eax
call fcn.0051ae90
push edi
mov esi, eax
call fcn.00595eb8
add esp, 0x10
pop edi
mov eax, esi
pop esi
pop ebx
ret
xor eax, eax
pop ebx
ret
Function at 0x51afa0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5d2486
mov eax, dword fs:[0]
push eax
sub esp, 0xa4
mov eax, dword [0x65d4e4]
xor eax, esp
mov dword [esp + 0xa0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x65d4e4]
xor eax, esp
push eax
lea eax, [esp + 0xb8]
mov dword fs:[0], eax
mov eax, dword [esp + 0xcc]
mov ebx, dword [esp + 0xc8]
xor edi, edi
cmp eax, edi
mov dword [esp + 0x14], edi
je 0x51b0e6
cmp byte [eax], 0
je 0x51b0e6
push 0x62c568
push eax
call fcn.005b1ae9
mov esi, eax
add esp, 8
mov dword [esp + 0x14], esi
cmp esi, edi
mov dword [esp + 0xc0], 2
je 0x51b0c4
push 2
push edi
push esi
call fcn.005b28d8
push esi
call fcn.005b2af5
push edi
push edi
push esi
mov ebp, eax
call fcn.005b28d8
push ebp
call fcn.00595ebd
mov edi, eax
add esp, 0x20
test edi, edi
je 0x51b0c2
push esi
push 1
push ebp
push edi
call fcn.005b2836
add esp, 0x10
mov dword [esp + 0xb0], 0xf
mov dword [esp + 0xac], 0
mov byte [esp + 0x9c], 0
push ebp
push edi
lea ecx, [esp + 0xa0]
mov byte [esp + 0xc8], 3
call fcn.004080f0
push edi
call fcn.00595eb8
add esp, 4
lea eax, [esp + 0x98]
push eax
mov ecx, ebx
call fcn.0040bf50
lea ecx, [esp + 0x98]
call fcn.0040bf30
push esi
call fcn.005b1fa4
add esp, 4
jmp 0x51b1b2
xor edi, edi
push 0x62b600
mov ecx, ebx
call fcn.0040be30
cmp esi, edi
je 0x51b1b2
push esi
call fcn.005b1fa4
add esp, 4
jmp 0x51b1b2
push 1
push 2
lea ecx, [esp + 0x20]
call fcn.0040b040
lea ecx, [esp + 0x18]
push 0x5f4a0c
push ecx
mov dword [esp + 0xc8], edi
call fcn.00409b60
add esp, 8
lea edx, [esp + 0x98]
push edx
lea ecx, [esp + 0x1c]
call fcn.004094f0
mov esi, 0x10
cmp dword [eax + 0x18], esi
mov byte [esp + 0xc0], 1
jb 0x51b134
mov eax, dword [eax + 4]
jmp 0x51b137
add eax, 4
push eax
push str.BaseLib::ReadFileToString
push 0x47
push str..common_stdfile.cpp
push 0xf0000000
call fcn.00409860
mov ecx, eax
call fcn.004fb930
cmp dword [esp + 0xb0], esi
jb 0x51b16e
mov eax, dword [esp + 0x9c]
push eax
call fcn.00595eb8
add esp, 4
lea ecx, [esp + 0x64]
mov dword [esp + 0xc0], 0xffffffff
call fcn.00409e00
lea ecx, [esp + 0x64]
push ecx
mov dword [esp + 0x68], vtable.std::ios_base.0
call fcn.005cdcde
add esp, 4
push edi
mov dword [ebx + 0x18], 0xf
mov dword [ebx + 0x14], edi
push 0x62b600
mov ecx, ebx
mov byte [ebx + 4], 0
call fcn.00409790
mov eax, ebx
mov ecx, dword [esp + 0xb8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xa0]
xor ecx, esp
call fcn.005b1988
add esp, 0xb0
ret
Function at 0x51c7f0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
ret

Function at 0x51c980
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x5d274d
mov eax, dword fs:[0]
push eax
mov eax, 0x2048
call fcn.005b6f10
mov eax, dword [0x65d4e4]
xor eax, esp
mov dword [esp + 0x2044], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x65d4e4]
xor eax, esp
push eax
lea eax, [esp + 0x205c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x206c]
mov esi, dword [esp + 0x2070]
mov ebp, dword [esp + 0x2074]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x2078]
xor ebx, ebx
cmp eax, ebx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], ebx
mov edx, eax
jne 0x51c9f4
mov edx, 0x62b600
mov eax, edx
mov dword [esp + 0x54], 0xf
mov dword [esp + 0x50], ebx
mov byte [esp + 0x40], bl
lea edi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x51ca10
sub eax, edi
push eax
push edx
lea ecx, [esp + 0x44]
call fcn.00409790
cmp esi, ebx
mov dword [esp + 0x2064], ebx
je 0x51caf4
cmp byte [esi], bl
je 0x51caf4
cmp ebp, ebx
je 0x51caf4
cmp byte [ebp], bl
je 0x51caf4
push 0x1fff
lea ecx, [esp + 0x5d]
push ebx
push ecx
mov byte [esp + 0x64], bl
call fcn.005b5540
mov eax, dword [esp + 0x28]
mov ecx, 0x10
add esp, 0xc
cmp dword [eax + 0x18], ecx
jb 0x51ca78
mov eax, dword [eax + 4]
jmp 0x51ca7b
add eax, 4
cmp dword [esp + 0x54], ecx
mov ecx, dword [esp + 0x40]
jae 0x51ca89
lea ecx, [esp + 0x40]
push eax
push 0x1fff
lea edx, [esp + 0x60]
push edx
push ecx
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esp + 0x58], bl
je 0x51cac4
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x24]
call fcn.0040be30
mov ebx, 2
mov byte [esp + 0x2064], 1
mov dword [esp + 0x14], ebx
jmp 0x51cacc
mov ebx, dword [esp + 0x14]
lea eax, [esp + 0x3c]
mov esi, dword [esp + 0x18]
push eax
mov ecx, esi
call fcn.0040bf50
or ebx, 1
test bl, 2
je 0x51cae9
lea ecx, [esp + 0x20]
call fcn.0040bf30
lea ecx, [esp + 0x3c]
call fcn.0040bf30
jmp 0x51cb28
mov esi, dword [esp + 0x18]
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x44]
push ecx
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
mov ecx, esi
mov byte [esi + 4], bl
call fcn.00407e40
cmp dword [esp + 0x54], 0x10
jb 0x51cb28
mov edx, dword [esp + 0x40]
push edx
call fcn.00595eb8
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x205c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2044]
xor ecx, esp
call fcn.005b1988
add esp, 0x2054
ret 0x10
Function at 0x51cd90
Capabilities:
Query or enumerate registry value

Disassembly:
push edi
mov edi, dword [esp + 0x10]
test edi, edi
jne 0x51cda3
push 0x80004005
call fcn.0041c050
mov edx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
push edi
push esi
lea eax, [esp + 0x1c]
push eax
mov eax, dword [ecx]
push 0
push edx
push eax
mov dword [esp + 0x2c], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test esi, esi
je 0x51ce0a
mov ecx, dword [edi]
test ecx, ecx
jbe 0x51ce07
mov edx, dword [esp + 0x14]
test edx, edx
jbe 0x51ce02
cmp edx, 2
jbe 0x51cdfb
cmp edx, 7
jne 0x51ce02
cmp ecx, 1
jb 0x51ce02
cmp byte [ecx + esi - 1], 0
jne 0x51ce02
cmp ecx, 1
jbe 0x51ce0a
cmp byte [ecx + esi - 2], 0
jmp 0x51ce00
cmp byte [ecx + esi - 1], 0
je 0x51ce0a
mov eax, 0xd
mov byte [esi], 0
pop esi
pop edi
ret 0xc

Function at 0x51d140
Capabilities:
Get disk information

Disassembly:
mov eax, 0x1044
call fcn.005b6f10
mov eax, dword [0x65d4e4]
xor eax, esp
mov dword [esp + 0x1040], eax
push edi
push 0xfff
xor edi, edi
lea eax, [esp + 0x49]
push edi
push eax
mov byte [esp + 0x50], 0
call fcn.005b5540
add esp, 0xc
lea ecx, [esp + 0x44]
push ecx
push 0xfff
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
je 0x51d1df
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
push esi
lea esi, [esp + 0x4c]
push esi
call ebx
cmp eax, 3
jne 0x51d1d0
push 0x40
lea edx, [esp + 0x10]
push 0
push edx
call fcn.005b5540
movsx eax, byte [esi]
push eax
lea ecx, [esp + 0x1c]
push 0x5f4218
push ecx
call fcn.005b1b4c
lea edx, [esp + 0x24]
push edx
call fcn.004ffc70
add esp, 0x1c
add edi, eax
jmp 0x51d1d0
mov al, byte [esi]
add esi, 1
test al, al
jne 0x51d1d0
cmp byte [esi], al
jne 0x51d193
pop esi
pop ebx
mov ecx, dword [esp + 0x1044]
mov eax, edi
pop edi
xor ecx, esp
call fcn.005b1988
add esp, 0x1044
ret
Function at 0x51e450
Capabilities:
Get hostname

Disassembly:
sub esp, 0x108
mov eax, dword [0x65d4e4]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
push esi
mov esi, dword [esp + 0x114]
xor ebx, ebx
push 0xff
lea eax, [esp + 0x11]
push ebx
push eax
mov dword [esp + 0x14], ebx
mov byte [esp + 0x18], bl
call fcn.005b5540
add esp, 0xc
push 0x100
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.WS2_32.dll_gethostname]
lea eax, [esp + 0xc]
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
mov byte [esi + 4], bl
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x51e4b0
sub eax, edx
push eax
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.00409790
mov ecx, dword [esp + 0x10c]
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.005b1988
add esp, 0x108
ret 4

Function at 0x51e4f0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x144
mov eax, dword [0x65d4e4]
xor eax, esp
mov dword [esp + 0x140], eax
xor eax, eax
push esi
mov esi, dword [esp + 0x14c]
push 0x9c
push eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x30]
push eax
call fcn.005b5540
add esp, 0xc
push 0
push 0x62b600
mov ecx, esi
call fcn.00409790
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0x2c], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x51e60e
push str.GetNativeSystemInfo
push 0x5f4994
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x51e592
lea edx, [esp + 4]
push edx
call eax
jmp 0x51e59d
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [esp + 0x38], 2
jne 0x51e60e
push 0x7f
lea ecx, [esp + 0xc9]
push 0
push ecx
mov byte [esp + 0xd0], 0
call fcn.005b5540
movzx edx, word [esp + 0xca]
movzx eax, word [esp + 0xc8]
mov ecx, dword [esp + 0x40]
push edx
push eax
push ecx
lea edx, [esp + 0xdc]
push str._lu._lu._lu
push edx
call fcn.0051d220
lea eax, [esp + 0xe4]
add esp, 0x20
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x51e5f3
sub eax, edx
push eax
lea eax, [esp + 0xc8]
push eax
mov ecx, esi
call fcn.00409790
mov ecx, dword [esp + 0x144]
pop esi
xor ecx, esp
call fcn.005b1988
add esp, 0x144
ret 4
Function at 0x51e630
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x114
mov eax, dword [0x65d4e4]
xor eax, esp
mov dword [esp + 0x110], eax
xor eax, eax
push esi
mov esi, dword [esp + 0x11c]
push 0x9c
push eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x30]
push eax
call fcn.005b5540
add esp, 0xc
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0x2c], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x51e73b
push str.GetNativeSystemInfo
push 0x5f4994
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x51e6c4
lea edx, [esp + 4]
push edx
call eax
jmp 0x51e6cf
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0
push 0x62b600
mov ecx, esi
call fcn.00409790
cmp dword [esp + 0x38], 2
jne 0x51e73b
cmp dword [esp + 0x2c], 4
jbe 0x51e73b
movzx ecx, word [esp + 0xbe]
movzx edx, word [esp + 0xbc]
push ecx
push edx
push str._d._d
lea eax, [esp + 0xd0]
push 0x50
push eax
call fcn.0051d320
lea eax, [esp + 0xd8]
add esp, 0x14
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x51e720
sub eax, edx
push eax
lea ecx, [esp + 0xc8]
push ecx
mov ecx, esi
call fcn.00409790
mov ecx, dword [esp + 0x114]
pop esi
xor ecx, esp
call fcn.005b1988
add esp, 0x114
ret 4
Function at 0x51e880
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5d2908
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x65d4e4]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
push esi
mov eax, dword [0x65d4e4]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov esi, dword [esp + 0x60]
xor ebx, ebx
push ebx
push 0x62b600
lea ecx, [esp + 0x38]
mov dword [esp + 0x50], 0xf
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x3c], bl
call fcn.00409790
push ebx
push 0x62b600
lea ecx, [esp + 0x1c]
mov dword [esp + 0x60], ebx
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.00409790
lea ecx, [esp + 0xc]
mov byte [esp + 0x58], 1
call fcn.00593500
lea ecx, [esp + 0xc]
mov byte [esp + 0x58], 2
call fcn.00593b20
lea eax, [esp + 0x30]
push eax
push str.Vendor
push str.Select__from_Win32_ComputerSystemProduct
lea ecx, [esp + 0x18]
call fcn.00593640
lea ecx, [esp + 0x14]
push ecx
push str.Name
push str.Select__from_Win32_ComputerSystemProduct
lea ecx, [esp + 0x18]
call fcn.00593640
cmp dword [esp + 0x44], ebx
je 0x51e967
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x38]
push edx
mov ecx, esi
call fcn.00407e40
push 1
push 0x5f42a4
mov ecx, esi
call fcn.004080f0
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
call fcn.00408200
push 4
push ebx
push str.__t_r_n
mov ecx, esi
call fcn.0049f210
push eax
push ebx
mov ecx, esi
call fcn.00407f00
push 0xffffffffffffffff
push 4
push 0xffffffffffffffff
push str.__t_r_n
mov ecx, esi
call fcn.004ca290
add eax, 1
push eax
mov ecx, esi
call fcn.00407f00
mov eax, dword [esp + 0x10]
cmp eax, ebx
mov byte [esp + 0x58], 1
je 0x51e9c0
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x51e9d0
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov esi, 0x10
cmp dword [esp + 0x2c], esi
jb 0x51e9e8
mov eax, dword [esp + 0x18]
push eax
call fcn.00595eb8
add esp, 4
cmp dword [esp + 0x48], esi
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
jb 0x51ea0b
mov ecx, dword [esp + 0x34]
push ecx
call fcn.00595eb8
add esp, 4
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.005b1988
add esp, 0x50
ret 4