joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5567ac
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x150], ecx
mov dword [ebp - 0x154], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00405ec4
xor eax, eax
push ebp
push 0x5568ca
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x55689d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
or eax, 1
push eax
call sub.kernel32.dll_SetErrorMode
lea eax, [ebp - 0x14c]
push eax
mov eax, dword [ebp - 4]
call fcn.00405ed4
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x55687a
test byte [ebp - 0x14c], 0x10
jne 0x55685d
lea eax, [ebp - 0x154]
lea edx, [ebp - 0x120]
mov ecx, 0x104
call fcn.00405cb4
mov eax, dword [ebp - 0x154]
lea edx, [ebp - 0x150]
call fcn.0040ab58
mov edx, dword [ebp - 0x150]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x14c]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x556820
push ebx
call sub.kernel32.dll_FindClose_1
mov byte [ebp - 5], 1
jmp 0x556886
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
sete byte [ebp - 5]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5568a4
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x55c85c
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, eax
movzx eax, byte [ebx + 4]
sub al, 1
jb 0x55c86b
je 0x55c870
jmp 0x55c894
mov eax, dword [ebx + 8]
pop ebx
ret
cmp dword [ebx + 8], 0
jne 0x55c88f
lea eax, [ebx + 8]
push eax
movzx eax, byte [ebx + 0xc]
push eax
mov eax, dword [0x5d4d74]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
mov eax, dword [ebx + 8]
pop ebx
ret
xor eax, eax
pop ebx
ret

Function at 0x56d804
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.00434530
cmp ebx, dword [ebp - 8]
jge 0x56d867
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.004349b8
mov edi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.004349b8
xor edi, eax
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.004349e4
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x56d82d
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x56d870
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.00434530
cmp ebx, dword [ebp - 8]
jge 0x56d8d3
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.004349b8
mov edi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.004349b8
xor edi, eax
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.004349e4
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x56d899
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x57e0c8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405ec4
xor eax, eax
push ebp
push 0x57e136
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00405a98
mov eax, ebx
call fcn.00405f2c
mov eax, dword [ebx]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x57e10c
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x57e120
mov edx, 1
mov ecx, dword [ebx]
xor byte [ecx + edx - 1], 0x55
inc edx
dec eax
jne 0x57e115
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57e13d
lea eax, [ebp - 4]
call fcn.00405a44
ret

Function at 0x581c88
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405ec4
xor eax, eax
push ebp
push 0x581dbc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00407c68
cmp dword [0x5dbbe4], 0
je 0x581d9e
mov eax, dword [0x5dbbe4]
mov edx, dword [eax]
call dword [edx + 0x70]
xor eax, eax
push ebp
push 0x581d97
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x581d32
mov eax, dword [0x5dbbe0]
call fcn.0040727c
mov esi, eax
test esi, esi
jl 0x581d7f
inc esi
xor ebx, ebx
mov eax, dword [0x5dbbe0]
mov eax, dword [eax + ebx*4]
lea edx, [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x74]
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00405e6c
jne 0x581d2c
mov eax, edi
mov edx, dword [0x5dbbe0]
mov edx, dword [edx + ebx*4]
call fcn.00407c80
jmp 0x581d7f
inc ebx
dec esi
jne 0x581cfd
jmp 0x581d7f
cmp dword [ebp - 8], 0
je 0x581d7f
mov eax, dword [0x5dbbe0]
call fcn.0040727c
mov esi, eax
test esi, esi
jl 0x581d7f
inc esi
xor ebx, ebx
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x5dbbe0]
mov eax, dword [eax + ebx*4]
mov edx, dword [eax]
call dword [edx + 0x80]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x581d7b
mov eax, edi
mov edx, dword [0x5dbbe0]
mov edx, dword [edx + ebx*4]
call fcn.00407c80
jmp 0x581d7f
inc ebx
dec esi
jne 0x581d4b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x581d9e
mov eax, dword [0x5dbbe4]
mov edx, dword [eax]
call dword [edx + 0x78]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x581dc3
lea eax, [ebp - 0xc]
call fcn.00405a44
lea eax, [ebp - 4]
call fcn.00405a44
ret
Function at 0x582258
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x582260
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x582398
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [esi + 0x38], 0
jne 0x582379
mov eax, esi
call fcn.0057f600
test al, al
je 0x582379
lea eax, [ebp - 0x2c]
call fcn.00580f54
cmp byte [ebp - 0x1a], 0
je 0x58236b
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 4]
push eax
push 0
mov eax, dword [esi + 0x30]
call fcn.00405ed4
push eax
push 0
call sub.advapi32.dll_LookupAccountNameA
mov eax, dword [ebp - 4]
call fcn.00402f98
mov dword [esi + 0x38], eax
lea eax, [esi + 0x34]
mov edx, dword [ebp - 8]
call fcn.00406164
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [esi + 0x34]
call fcn.00405ed4
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [esi + 0x38]
push eax
mov eax, dword [esi + 0x30]
call fcn.00405ed4
push eax
push 0
call sub.advapi32.dll_LookupAccountNameA
cmp eax, 1
sbb ebx, ebx
inc ebx
mov byte [esi + 8], bl
test bl, bl
je 0x582344
movzx eax, byte [ebp - 0xc]
mov byte [esi + 0x3c], al
mov eax, dword [esi + 0x34]
call fcn.00405ed4
mov edx, eax
lea eax, [esi + 0x34]
call fcn.00405c3c
mov eax, esi
test eax, eax
je 0x58233d
sub eax, 0xffffffc0
call fcn.00581bc0
jmp 0x582379
lea eax, [esi + 0x34]
call fcn.00405a44
mov eax, dword [esi + 0x38]
call fcn.00402fcc
xor eax, eax
mov dword [esi + 0x38], eax
call sub.kernel32.dll_GetLastError_1
mov edx, eax
xor ecx, ecx
mov eax, esi
call fcn.0057efb0
jmp 0x582379
xor ecx, ecx
mov edx, 0x78
mov eax, esi
call fcn.0057efb0
mov ebx, dword [esi + 0x38]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58239f
lea eax, [ebp - 0x2c]
mov edx, dword [0x580e64]
call fcn.00406810
ret
Function at 0x582808
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffecc
push ebx
xor edx, edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x12c], edx
mov dword [ebp - 0x128], edx
mov dword [ebp - 0x124], edx
mov dword [ebp - 0x120], edx
mov dword [ebp - 0x11c], edx
mov dword [ebp - 0x118], edx
mov dword [ebp - 0x114], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x58295e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x130]
call fcn.00580f54
cmp byte [ebp - 0x11e], 0
je 0x5828c6
call sub.kernel32.dll_GetCurrentProcess
lea edx, [ebp - 8]
call fcn.00582790
test al, al
je 0x582898
mov edx, ebx
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00582d04
mov eax, dword [ebp - 8]
call fcn.00402fcc
jmp 0x582934
call sub.kernel32.dll_GetLastError_1
push eax
push 0
push 0
push 0
push 2
xor ecx, ecx
mov dl, 1
mov eax, dword [0x581b20]
call fcn.00581e24
mov edx, eax
test edx, edx
je 0x5828bd
sub edx, 0xffffffc0
mov eax, ebx
call fcn.00407c80
jmp 0x582934
mov dword [ebp - 4], 0x104
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10d]
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x582908
lea eax, [ebp - 0x134]
lea edx, [ebp - 0x10d]
mov ecx, 0x105
call fcn.00405cb4
mov eax, dword [ebp - 0x134]
mov ecx, ebx
mov dl, 2
call fcn.00582c4c
jmp 0x582934
call sub.kernel32.dll_GetLastError_1
push eax
push 0
push 0
push 0
push 2
xor ecx, ecx
mov dl, 1
mov eax, dword [0x581b20]
call fcn.00581e24
mov edx, eax
test edx, edx
je 0x58292d
sub edx, 0xffffffc0
mov eax, ebx
call fcn.00407c80
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x582965
lea eax, [ebp - 0x134]
call fcn.00405a44
lea eax, [ebp - 0x130]
mov edx, dword [0x580e64]
call fcn.00406810
ret
Function at 0x5854a0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x10
push 0
push 0
dec ecx
jne 0x5854a9
xchg dword [ebp - 4], ecx
push ebx
push esi
test dl, dl
je 0x5854c1
add esp, 0xfffffff0
call fcn.00404e48
mov ebx, ecx
mov byte [ebp - 1], dl
mov esi, eax
mov eax, dword [ebp + 0x14]
call fcn.00405ec4
lea eax, [ebp + 0xc]
call fcn.00406720
xor eax, eax
push ebp
push 0x5856d6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov ecx, ebx
xor edx, edx
mov eax, esi
call fcn.0057ec88
cmp byte [esi + 8], 0
je 0x5856a2
cmp dword [ebp + 0x10], 0
setne al
mov byte [esi + 8], al
test al, al
je 0x585694
mov eax, dword [ebp + 0x10]
sub eax, 1
je 0x585534
sub eax, 2
je 0x585534
lea eax, [ebp - 0x24]
call fcn.00580f54
cmp byte [ebp - 0x12], 0
jne 0x585534
xor ebx, ebx
jmp 0x585536
mov bl, 1
mov byte [esi + 8], bl
test bl, bl
je 0x585684
cmp dword [ebp + 8], 0xffffffff
je 0x585567
mov eax, dword [ebp + 0xc]
xor edx, edx
call fcn.004064e0
jne 0x58556b
cmp dword [ebp + 8], 0
je 0x585567
lea eax, [ebp - 0x44]
call fcn.00580f54
cmp byte [ebp - 0x32], 0
jne 0x58556b
xor ebx, ebx
jmp 0x58556d
mov bl, 1
mov byte [esi + 8], bl
test bl, bl
je 0x585674
cmp byte [0x5d45f8], 0
jne 0x585634
mov byte [0x5d45f8], 1
lea eax, [ebp - 0x64]
call fcn.00580f54
cmp byte [ebp - 0x52], 0
je 0x5855e8
push 0x585700
call sub.kernel32.dll_LoadLibraryA
mov ebx, eax
push 0x585710
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5d45d8], eax
push 0x585728
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5d45dc], eax
push 0x585740
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5d45e0], eax
push 0x585750
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5d45e4], eax
jmp 0x585634
push 0x585760
call sub.kernel32.dll_LoadLibraryA
mov ebx, eax
push 0x58576c
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5d45e8], eax
push 0x585780
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5d45ec], eax
push 0x585794
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5d45f0], eax
push 0x5857a4
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5d45f4], eax
lea eax, [ebp - 0x84]
call fcn.00580f54
cmp byte [ebp - 0x74], 0
je 0x58565b
cmp dword [ebp + 0x10], 3
jne 0x58565b
lea eax, [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
mov edx, 0x5857b8
call fcn.00406470
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x30], eax
lea eax, [esi + 0x34]
mov edx, dword [ebp + 0xc]
call fcn.00406288
mov eax, dword [ebp + 8]
mov dword [esi + 0x38], eax
jmp 0x5856a2
xor ecx, ecx
mov edx, 0x57
mov eax, esi
call fcn.0057efb0
jmp 0x5856a2
xor ecx, ecx
mov edx, 0x78
mov eax, esi
call fcn.0057efb0
jmp 0x5856a2
xor ecx, ecx
mov edx, 0x57
mov eax, esi
call fcn.0057efb0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5856dd
lea eax, [ebp - 0x84]
mov edx, dword [0x580e64]
mov ecx, 4
call fcn.0040685c
lea eax, [ebp + 0xc]
call fcn.0040624c
lea eax, [ebp + 0x14]
call fcn.00405a44
ret
Function at 0x589b80
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405ec4
mov eax, dword [ebp - 8]
call fcn.00405ec4
mov eax, dword [ebp - 0xc]
call fcn.00405ec4
lea ebx, [ebp - 0x4c]
xor eax, eax
push ebp
push 0x589c92
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
xor ecx, ecx
mov edx, 0x3c
call fcn.00403d20
mov dword [ebx], 0x3c
mov dword [ebx + 4], 0x440
xor eax, eax
mov dword [ebx + 8], eax
mov eax, 0x589ca4
mov dword [ebx + 0xc], eax
mov eax, dword [ebp - 8]
call fcn.00405ed4
mov dword [ebx + 0x14], eax
mov eax, dword [ebp - 4]
call fcn.00405ed4
mov dword [ebx + 0x10], eax
mov eax, dword [ebp - 0xc]
call fcn.00405ed4
mov dword [ebx + 0x18], eax
cmp byte [ebp + 0xc], 0
je 0x589c11
mov dword [ebx + 0x1c], 5
jmp 0x589c16
xor eax, eax
mov dword [ebx + 0x1c], eax
push ebx
call sub.shell32.dll_ShellExecuteExA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x589c40
xor eax, eax
mov dword [ebx + 0xc], eax
push ebx
call sub.shell32.dll_ShellExecuteExA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x589c40
or ebx, 0xffffffff
jmp 0x589c77
cmp byte [ebp + 8], 0
je 0x589c67
mov eax, dword [0x5d4d74]
mov eax, dword [eax]
call fcn.00485f0c
push 0x3e8
mov eax, dword [ebx + 0x38]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x589c46
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebx + 0x38]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov ebx, dword [ebp - 0x10]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x589c99
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405a68
ret
Function at 0x58a2c8
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
mov eax, dword [ebp - 8]
call fcn.00405a44
xor edx, edx
push ebp
push 0x58a417
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [0x5d510c]
cmp dword [eax], 2
jne 0x58a3cf
lea eax, [ebp - 0x10]
push eax
push 0x20008
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 1
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
mov eax, dword [ebp - 0x14]
inc eax
call fcn.00402fb0
mov ebx, eax
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x14]
push edx
push eax
push ebx
push 1
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebx]
push eax
push 0
call sub.advapi32.dll_LookupAccountSidA
mov eax, dword [ebp - 0x18]
inc eax
call fcn.00402fb0
mov esi, eax
mov eax, dword [ebp - 0x1c]
inc eax
call fcn.00402fb0
mov edi, eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
push edi
lea eax, [ebp - 0x18]
push eax
push esi
mov eax, dword [ebx]
push eax
push 0
call sub.advapi32.dll_LookupAccountSidA
cmp byte [ebp - 1], 0
je 0x58a3a5
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.00405c3c
jmp 0x58a3af
mov eax, dword [ebp - 8]
mov edx, edi
call fcn.00405c3c
mov eax, edi
call fcn.00402fcc
mov eax, esi
call fcn.00402fcc
mov eax, ebx
call fcn.00402fcc
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x58a40d
mov dword [ebp - 0xc], 0x105
mov eax, 0x105
call fcn.00402fb0
mov ebx, eax
lea eax, [ebp - 0xc]
push eax
push ebx
call sub.advapi32.dll_GetUserNameA
cmp byte [ebp - 1], 0
je 0x58a3fe
mov eax, dword [ebp - 8]
mov edx, ebx
call fcn.00405c3c
jmp 0x58a406
mov eax, dword [ebp - 8]
call fcn.00405a44
mov eax, ebx
call fcn.00402fcc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x58a429
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x58a814
Capabilities:
Check os version

Disassembly:
push ebx
add esp, 0xffffff6c
mov eax, dword [0x5d510c]
cmp dword [eax], 2
jne 0x58a833
mov eax, dword [0x5d4648]
call fcn.0058a8c0
mov ebx, eax
jmp 0x58a835
mov bl, 1
test bl, bl
je 0x58a854
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 4], 6
jb 0x58a854
call fcn.0058a798
mov ebx, eax
mov eax, ebx
add esp, 0x94
pop ebx
ret
Function at 0x58a96c
Capabilities:
Compare security identifiers

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov edi, eax
mov eax, dword [0x5d510c]
cmp dword [eax], 1
jne 0x58a8db
mov byte [esp], 1
jmp 0x58a9b0
mov byte [esp], 0
lea eax, [esp + 4]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
mov ebx, eax
test ebx, ebx
jne 0x58a919
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x3f0
jne 0x58a919
lea eax, [esp + 4]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
mov ebx, eax
test ebx, ebx
je 0x58a9b0
mov eax, 0x19000
call fcn.00402fb0
mov esi, eax
lea eax, [esp + 8]
push eax
push 0x19000
push esi
push 2
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_GetTokenInformation
mov ebx, eax
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_CloseHandle_1
test ebx, ebx
je 0x58a9a9
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push edi
mov eax, dword [0x5d4644]
push eax
push 2
push 0x5d463c
call sub.advapi32.dll_AllocateAndInitializeSid
mov ebx, dword [esi]
dec ebx
test ebx, ebx
jl 0x58a99f
inc ebx
xor edi, edi
mov eax, dword [esi + edi*8 + 4]
push eax
mov eax, dword [esp + 0x10]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x58a99b
mov byte [esp], 1
jmp 0x58a99f
inc edi
dec ebx
jne 0x58a982
mov eax, dword [esp + 0xc]
push eax
call sub.advapi32.dll_FreeSid
mov eax, esi
call fcn.00402fcc
movzx eax, byte [esp]
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x58a9bc
Capabilities:
Get common file path
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], ecx
mov edi, edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x58aae0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x104
call fcn.00402fb0
mov ebx, eax
push 0x104
push ebx
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x1c]
mov edx, ebx
call fcn.00405c3c
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.00589d4c
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 4]
mov ecx, 0x58aaf8
call fcn.00405d5c
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.00405ed4
push eax
call sub.version.dll_GetFileVersionInfoSizeA
test eax, eax
jns 0x58aa3a
call fcn.004049ac
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call fcn.00402fb0
mov esi, eax
push esi
mov eax, dword [ebp - 0xc]
test eax, eax
jns 0x58aa54
call fcn.004049ac
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00405ed4
push eax
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x58ab04
push esi
call sub.version.dll_VerQueryValueA
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
test eax, eax
jns 0x58aa86
call fcn.004049ac
mov dword [edi], eax
push 0x104
push ebx
mov eax, dword [edi]
test eax, eax
jns 0x58aa99
call fcn.004049ac
push eax
call sub.kernel32.dll_VerLanguageNameA
mov eax, dword [ebp - 8]
mov edx, ebx
call fcn.00405c3c
and dword [edi], 0xffff
mov eax, ebx
call fcn.00402fcc
mov eax, esi
call fcn.00402fcc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58aae7
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00405a68
lea eax, [ebp - 4]
call fcn.00405a44
ret

Function at 0x58ab80
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x58ac2b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00405a44
mov bl, 0x41
lea eax, [ebp - 8]
mov edx, ebx
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 8]
lea eax, [ebp - 0xc]
call fcn.00403b80
mov edx, 0x58ac38
lea eax, [ebp - 0xc]
mov cl, 2
call fcn.00403b50
lea edx, [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.00405ca8
mov eax, dword [ebp - 4]
call fcn.00405ed4
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 5
jne 0x58ac07
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00405c2c
mov edx, dword [ebp - 0x10]
mov eax, esi
mov ecx, 0x58ac44
call fcn.00405d5c
jmp 0x58ac0d
inc ebx
cmp bl, 0x5b
jne 0x58aba9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58ac32
lea eax, [ebp - 0x10]
call fcn.00405a44
lea eax, [ebp - 4]
call fcn.00405a44
ret
Function at 0x58ad34
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov byte [ebp - 1], al
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
cmp byte [ebp - 1], 0
jne 0x58ad76
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [ebx], eax
mov dword [ebx + 4], edx
mov eax, dword [ebp - 0x10]
xor edx, edx
mov dword [esi], eax
mov dword [esi + 4], edx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [edi], eax
mov dword [edi + 4], edx
jmp 0x58ad94
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov dword [ebx], eax
mov dword [ebx + 4], edx
mov eax, dword [ebp - 0x14]
xor edx, edx
mov dword [esi], eax
mov dword [esi + 4], edx
mov eax, dword [ebp - 0xc]
xor edx, edx
mov dword [edi], eax
mov dword [edi + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x58afe8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405ec4
xor eax, eax
push ebp
push 0x58b0d4
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp - 0xc]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp + 0x14]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp + 0x10]
xor edx, edx
mov dword [eax], edx
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
call fcn.00405ed4
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x58b0be
mov byte [ebp - 0xd], 1
mov eax, ebx
call fcn.00402fb0
mov esi, eax
push esi
push ebx
push 0
push edi
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x58b0e8
push esi
call sub.version.dll_VerQueryValueA
mov eax, dword [ebp - 0x18]
mov edx, dword [eax + 8]
mov ecx, edx
shr ecx, 0x10
mov edi, dword [ebp - 8]
mov dword [edi], ecx
mov ecx, edx
and ecx, 0xffff
mov edi, dword [ebp - 0xc]
mov dword [edi], ecx
mov ecx, dword [ebp + 0xc]
mov dword [ecx], edx
mov edx, dword [eax + 0xc]
mov ecx, edx
shr ecx, 0x10
mov edi, dword [ebp + 0x14]
mov dword [edi], ecx
mov ecx, edx
and ecx, 0xffff
mov edi, dword [ebp + 0x10]
mov dword [edi], ecx
mov ecx, dword [ebp + 8]
mov dword [ecx], edx
mov edx, ebx
mov eax, esi
call fcn.00402fcc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58b0db
lea eax, [ebp - 4]
call fcn.00405a44
ret