joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45f084
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
lea esi, [eax + 2]
mov dword [ebp - 4], eax
sub dword [ebp - 4], esi
lea edi, [ebp + 0xa]
mov ecx, 0xbaadf00d
sub edi, esi
mov dword [ebp - 8], 2
mov eax, dword [ebp - 4]
movzx eax, byte [eax + esi]
movzx ebx, byte [esi]
mov dl, al
xor eax, ecx
xor dl, bl
push 5
push eax
mov byte [edi + esi], dl
call fcn.0087a034
add eax, ebx
pop ecx
inc esi
dec dword [ebp - 8]
pop ecx
mov ecx, eax
jne 0x45f0a9
cmp ecx, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
je 0x45f0ed
push 0x8f9b80
lea eax, [ebp + 8]
push eax
mov dword [ebp + 8], 5
call fcn.00879bd7
mov ax, word [ebp + 0xa]
leave
ret
Function at 0x473bd1
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 0
push dword [ebp + 0xc]
mov esi, ecx
call fcn.00473902
mov edi, dword [ebp + 8]
test edi, edi
je 0x473c12
cmp byte [edi], 0
je 0x473c12
push edi
call dword [sym.imp.ws2_32.dll_inet_addr]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
jne 0x473c12
push edi
call dword [sym.imp.ws2_32.dll_gethostbyname]
test eax, eax
je 0x473c1a
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [esi + 4], eax
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov dword [ebp + 0xc], eax
push 0x8f9b80
lea eax, [ebp + 0xc]
push eax
call fcn.00879bd7
Function at 0x47f584
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x14], 0
mov ecx, dword [ebp + 8]
je 0x47f593
xor dword [ebp + 0x10], ecx
mov eax, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 0xc]
cmp edi, 0x10
jb 0x47f735
mov esi, edi
push ebx
shr esi, 4
movzx ebx, byte [ecx]
mov edx, eax
shr edx, 0x18
xor edx, ebx
mov ebx, eax
mov eax, dword [edx*4 + 0x9647c0]
shl ebx, 8
xor eax, ebx
movzx ebx, byte [ecx + 1]
mov edx, eax
shr edx, 0x18
xor edx, ebx
mov edx, dword [edx*4 + 0x9647c0]
shl eax, 8
xor edx, eax
mov eax, edx
shr eax, 0x18
shl edx, 8
inc ecx
movzx ebx, byte [ecx + 1]
xor eax, ebx
mov eax, dword [eax*4 + 0x9647c0]
xor eax, edx
inc ecx
movzx ebx, byte [ecx + 1]
mov edx, eax
shr edx, 0x18
xor edx, ebx
mov edx, dword [edx*4 + 0x9647c0]
shl eax, 8
xor edx, eax
inc ecx
movzx ebx, byte [ecx + 1]
mov eax, edx
shr eax, 0x18
xor eax, ebx
mov eax, dword [eax*4 + 0x9647c0]
shl edx, 8
xor eax, edx
inc ecx
movzx ebx, byte [ecx + 1]
mov edx, eax
shr edx, 0x18
xor edx, ebx
mov edx, dword [edx*4 + 0x9647c0]
shl eax, 8
xor edx, eax
inc ecx
movzx ebx, byte [ecx + 1]
mov eax, edx
shr eax, 0x18
xor eax, ebx
mov eax, dword [eax*4 + 0x9647c0]
shl edx, 8
xor eax, edx
inc ecx
movzx ebx, byte [ecx + 1]
mov edx, eax
shr edx, 0x18
xor edx, ebx
mov edx, dword [edx*4 + 0x9647c0]
inc ecx
movzx ebx, byte [ecx + 1]
shl eax, 8
xor edx, eax
mov eax, edx
inc ecx
shr eax, 0x18
xor eax, ebx
mov eax, dword [eax*4 + 0x9647c0]
movzx ebx, byte [ecx + 1]
shl edx, 8
xor eax, edx
inc ecx
mov edx, eax
shr edx, 0x18
xor edx, ebx
mov edx, dword [edx*4 + 0x9647c0]
shl eax, 8
xor edx, eax
inc ecx
movzx ebx, byte [ecx]
mov eax, edx
shr eax, 0x18
xor eax, ebx
mov eax, dword [eax*4 + 0x9647c0]
movzx ebx, byte [ecx + 1]
shl edx, 8
xor eax, edx
mov edx, eax
shr edx, 0x18
xor edx, ebx
mov edx, dword [edx*4 + 0x9647c0]
shl eax, 8
xor edx, eax
inc ecx
movzx ebx, byte [ecx + 1]
mov eax, edx
shr eax, 0x18
xor eax, ebx
mov eax, dword [eax*4 + 0x9647c0]
shl edx, 8
xor eax, edx
inc ecx
movzx ebx, byte [ecx + 1]
mov edx, eax
shr edx, 0x18
xor edx, ebx
mov edx, dword [edx*4 + 0x9647c0]
inc ecx
movzx ebx, byte [ecx + 1]
shl eax, 8
xor edx, eax
inc ecx
mov eax, edx
shr eax, 0x18
xor eax, ebx
mov eax, dword [eax*4 + 0x9647c0]
movzx ebx, byte [ecx + 1]
shl edx, 8
xor eax, edx
inc ecx
mov edx, eax
shr edx, 0x18
xor edx, ebx
mov edx, dword [edx*4 + 0x9647c0]
shl eax, 8
xor eax, edx
inc ecx
sub edi, 0x10
dec esi
jne 0x47f5aa
pop ebx
cmp edi, 1
jb 0x47f754
movzx esi, byte [ecx]
mov edx, eax
shr edx, 0x18
xor edx, esi
mov edx, dword [edx*4 + 0x9647c0]
shl eax, 8
xor eax, edx
inc ecx
dec edi
jne 0x47f73a
mov ecx, dword [ebp + 0x18]
test ecx, ecx
pop edi
pop esi
je 0x47f763
mov dword [ecx], 7
pop ebp
ret
Function at 0x4b8c34
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [ebp - 2]
mov edi, edx
sub edi, eax
lea ebx, [edx + 2]
lea eax, [ebp - 2]
xor esi, esi
mov word [ebp - 2], cx
mov dword [ebp - 8], 0xbaadf00d
sub ebx, eax
mov ecx, 0x979568
call fcn.004133f0
mov dl, byte [ebp + esi - 2]
lea ecx, [ebp + esi - 2]
mov byte [edi + ecx], al
movzx eax, al
xor dl, al
xor eax, dword [ebp - 8]
mov byte [ebx + ecx], dl
xor ecx, ecx
mov cl, dl
push 5
push eax
mov dword [ebp - 0xc], ecx
call fcn.0087a034
add eax, dword [ebp - 0xc]
inc esi
cmp esi, 2
pop ecx
pop ecx
mov dword [ebp - 8], eax
jb 0x4b8c59
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4b8d24
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
lea esi, [eax + 2]
mov dword [ebp - 4], eax
sub dword [ebp - 4], esi
lea edi, [ebp + 0xa]
mov ecx, 0xbaadf00d
sub edi, esi
mov dword [ebp - 8], 2
mov eax, dword [ebp - 4]
movzx eax, byte [eax + esi]
movzx ebx, byte [esi]
mov dl, al
xor eax, ecx
xor dl, bl
push 5
push eax
mov byte [edi + esi], dl
call fcn.0087a034
add eax, ebx
pop ecx
inc esi
dec dword [ebp - 8]
pop ecx
mov ecx, eax
jne 0x4b8d49
cmp ecx, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
je 0x4b8d8d
push 0x8f9b80
lea eax, [ebp + 8]
push eax
mov dword [ebp + 8], 5
call fcn.00879bd7
mov ax, word [ebp + 0xa]
leave
ret

Function at 0x4b8d93
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [ebp - 2]
mov edi, edx
sub edi, eax
lea ebx, [edx + 2]
lea eax, [ebp - 2]
xor esi, esi
mov word [ebp - 2], cx
mov dword [ebp - 8], 0xbaadf00d
sub ebx, eax
mov ecx, 0x979568
call fcn.004133f0
mov dl, byte [ebp + esi - 2]
lea ecx, [ebp + esi - 2]
mov byte [edi + ecx], al
movzx eax, al
xor dl, al
xor eax, dword [ebp - 8]
mov byte [ebx + ecx], dl
xor ecx, ecx
mov cl, dl
push 5
push eax
mov dword [ebp - 0xc], ecx
call fcn.0087a034
add eax, dword [ebp - 0xc]
inc esi
cmp esi, 2
pop ecx
pop ecx
mov dword [ebp - 8], eax
jb 0x4b8db8
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4c1115
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 8]
mov esi, ecx
mov ecx, dword [0x978368]
push eax
call fcn.00455c59
mov edi, dword [eax + 4]
xor ebx, ebx
cmp dword [ebp - 4], ebx
je 0x4c1141
push ebx
lea ecx, [ebp - 8]
call fcn.0045e7c2
push dword [esi + 0x14]
lea eax, [ebp - 8]
push dword [esi + 0x10]
mov ecx, edi
push eax
call fcn.00458c4f
cmp dword [ebp - 4], ebx
mov edi, dword [eax + 4]
je 0x4c1163
push ebx
lea ecx, [ebp - 8]
call fcn.00449913
cmp edi, ebx
je 0x4c1215
lea ecx, [edi + 0xc]
call fcn.0045e2eb
mov esi, dword [esi + 0x10]
cmp esi, 2
mov edi, eax
mov dword [ebp - 4], edi
jne 0x4c11e7
cdq
mov ecx, 0x2710
idiv ecx
cmp eax, 0xc8
je 0x4c11e7
cmp eax, 0xc9
je 0x4c11e7
cmp eax, 0xca
je 0x4c11e7
cmp eax, 0xcd
je 0x4c11e7
cmp eax, 0xdd
je 0x4c11e7
cmp eax, 0xec
je 0x4c11e7
cmp eax, 0xee
je 0x4c11e7
cmp eax, 0xd4
je 0x4c11e7
cmp eax, 0xe2
je 0x4c11e7
cmp eax, 0xe3
je 0x4c11e7
mov eax, edi
cdq
mov ecx, 0x3e8
idiv ecx
cmp eax, 0x83d
je 0x4c11e7
cmp edi, 0x200b63
jne 0x4c1215
cmp esi, 5
jne 0x4c121c
push edi
call fcn.0048b8d9
cmp eax, 6
pop ecx
je 0x4c121c
push edi
call fcn.0048b5b3
cmp eax, 8
pop ecx
jl 0x4c120e
cmp eax, 0xb
jle 0x4c1210
cmp eax, 0x25
je 0x4c1210
xor eax, eax
cmp eax, 9
je 0x4c121c
xor eax, eax
jmp 0x4c12a7
mov esi, dword [ebp + 8]
mov edi, dword [0x979110]
neg esi
sbb esi, esi
and esi, 0xffffffaf
add esi, 0x59
test esi, esi
jle 0x4c1277
cmp dword [ebp + 8], 0
je 0x4c1243
push ebx
mov ecx, edi
call fcn.0051c36a
jmp 0x4c1256
cmp ebx, 0x36
jne 0x4c124d
push 0x2a
pop eax
jmp 0x4c124f
mov eax, ebx
lea ecx, [edi + eax*4]
lea eax, [eax + ecx + 4]
mov cl, byte [eax]
cmp cl, 2
je 0x4c1267
cmp cl, 3
je 0x4c1267
cmp cl, 7
jne 0x4c1272
mov ecx, dword [ebp - 4]
cmp dword [eax + 1], ecx
jne 0x4c1272
and byte [eax], 0
inc ebx
cmp ebx, esi
jl 0x4c1233
mov ecx, dword [0x978360]
push 0
call fcn.008161f1
mov ecx, dword [0x9791a0]
test ecx, ecx
je 0x4c1297
push 0
call fcn.008161f1
jmp 0x4c12a4
cmp dword [ebp + 8], 0
je 0x4c12a4
mov ecx, edi
call fcn.0051c175
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4f1993
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
lea edi, [eax + 8]
mov dword [ebp + 8], eax
sub dword [ebp + 8], edi
lea ebx, [ebp - 0x14]
mov dword [ebp - 4], 0xbaadf00d
sub ebx, edi
mov dword [ebp - 8], 2
mov eax, dword [ebp + 8]
mov esi, dword [eax + edi]
mov eax, dword [edi]
push 5
push eax
mov dword [ebp - 0xc], eax
call fcn.0087a36a
xor eax, esi
xor esi, dword [ebp - 4]
push 5
push esi
mov dword [ebx + edi], eax
call fcn.0087a034
add eax, dword [ebp - 0xc]
add esp, 0x10
add edi, 4
dec dword [ebp - 8]
mov dword [ebp - 4], eax
jne 0x4f19bb
cmp eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
je 0x4f1a0c
push 0x8f9b80
lea eax, [ebp + 8]
push eax
mov dword [ebp + 8], 5
call fcn.00879bd7
fld qword [ebp - 0x14]
leave
ret
Function at 0x4f1a11
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ecx + 8]
push ebx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
push esi
lea ecx, [ebp + 8]
sub dword [ebp - 4], ecx
lea eax, [ebp + 8]
sub dword [ebp - 8], eax
push edi
mov dword [ebp - 0xc], 0xbaadf00d
lea esi, [ebp + 8]
mov dword [ebp - 0x10], 2
mov ecx, 0x979568
call fcn.004133f0
mov edi, eax
mov eax, dword [ebp - 4]
mov dword [eax + esi], edi
mov eax, edi
xor eax, dword [esi]
push 5
push eax
call fcn.0087a034
xor edi, dword [ebp - 0xc]
mov ebx, eax
mov eax, dword [ebp - 8]
push 5
push edi
mov dword [eax + esi], ebx
call fcn.0087a034
add eax, ebx
add esp, 0x10
add esi, 4
dec dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
jne 0x4f1a40
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x51c0f2
Capabilities:
Log keystrokes

Disassembly:
push ebx
mov ebx, dword [0x978360]
test ebx, ebx
je 0x51c173
push ebp
push esi
mov esi, dword [sym.imp.user32.dll_MapVirtualKeyA]
push edi
xor edi, edi
lea ebp, [ecx + 5]
jmp 0x51c113
mov ebx, dword [0x978360]
movzx eax, byte [ebp - 1]
test eax, eax
jl 0x51c167
cmp eax, 8
jg 0x51c167
cmp eax, 4
jne 0x51c167
test ebx, ebx
je 0x51c167
mov eax, dword [ebp]
sub eax, 0
je 0x51c158
dec eax
je 0x51c14e
dec eax
je 0x51c144
dec eax
jne 0x51c167
push 1
push edi
call esi
push eax
push 3
jmp 0x51c160
push 1
push edi
call esi
push eax
push 2
jmp 0x51c160
push 1
push edi
call esi
push eax
push 1
jmp 0x51c160
push 1
push edi
call esi
push eax
push 0
mov ecx, ebx
call fcn.00748165
inc edi
add ebp, 5
cmp edi, 0x59
jl 0x51c10d
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x520b36
Capabilities:
Get number of processors

Disassembly:
mov eax, 0x8a1463
call fcn.00879bb8
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.004bc4fa
xor ebx, ebx
mov dword [esp + 0x1c], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x80], ebx
mov ebp, 0x45037d
push ebp
mov edi, 0x45e147
push edi
push 2
push 8
lea eax, [esi + 0x84]
push eax
mov byte [esp + 0x30], 2
call fcn.0087b2f0
push ebp
push edi
push 2
push 8
lea eax, [esi + 0x94]
push eax
mov byte [esp + 0x30], 3
call fcn.0087b2f0
push ebp
push edi
push 2
push 8
lea eax, [esi + 0xa4]
push eax
mov byte [esp + 0x30], 4
call fcn.0087b2f0
push ebp
push edi
push 2
push 8
lea eax, [esi + 0xb4]
push eax
mov byte [esp + 0x30], 5
call fcn.0087b2f0
mov dword [esi + 0xc8], ebx
mov dword [esi + 0xcc], ebx
mov dword [esi + 0xd0], ebx
push ebx
push 1
push 0xa
push 0x157
push 0xfa
push 0x64
push 0x113
mov ecx, esi
mov byte [esp + 0x38], 9
mov dword [esi], 0x8eb068
mov dword [esi + 4], 0x8eb01c
mov dword [esi + 8], 0x8eb018
call fcn.004bc595
mov ecx, dword [esp + 0x14]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x55bc76
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x8a5fef
call fcn.00879bb8
push ecx
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
and dword [ebp - 4], 0
lea edi, [esi + 0x10]
mov dword [ebp - 0x14], edi
lea ecx, [edi + 0x34]
mov byte [ebp - 4], 2
call fcn.00414ebb
lea ecx, [edi + 0x30]
mov byte [ebp - 4], 1
call fcn.00414ebb
mov eax, esi
neg eax
lea ecx, [esi + 0xc]
sbb eax, eax
and eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword [eax], 0x8ebab8
mov dword [esi], 0x8e84a0
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x56a485
Capabilities:
Get common file path
Get disk information
Get mac address on windows

Disassembly:
mov eax, 0x8a76f4
call fcn.00879bb8
mov eax, 0x2e28
call fcn.0087a1b0
and byte [ebp - 0x24], 0
and dword [ebp - 0x14], 0
push ebx
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x23]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x28], 0x2800
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2e34]
push eax
call sub.iphlpapi.dll_GetAdaptersInfo
lea eax, [ebp - 0x2e34]
cmp dword [eax + 0x1a0], 6
jne 0x56a55e
cmp byte [eax + 0x194], 0x44
lea edi, [eax + 0x194]
mov dword [ebp - 0x10], 1
jne 0x56a524
cmp byte [eax + 0x195], 0x45
jne 0x56a524
cmp byte [eax + 0x196], 0x53
jne 0x56a524
cmp byte [eax + 0x197], 0x54
jne 0x56a524
cmp byte [eax + 0x198], 0
jne 0x56a524
cmp byte [eax + 0x199], 0
jne 0x56a524
and dword [ebp - 0x10], 0
mov ebx, 0xfffffe6c
lea esi, [ebp - 0x24]
sub ebx, eax
cmp dword [ebp - 0x10], 0
je 0x56a55e
mov cl, byte [edi]
mov dl, byte [esi]
cmp cl, dl
ja 0x56a54c
jae 0x56a542
and dword [ebp - 0x10], 0
inc edi
lea ecx, [ebx + edi]
inc esi
cmp ecx, 6
jl 0x56a52e
cmp dword [ebp - 0x10], 0
je 0x56a55e
lea esi, [eax + 0x194]
lea edi, [ebp - 0x24]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, dword [eax]
test eax, eax
jne 0x56a4d0
mov esi, 0x200
push esi
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryA]
and byte [ebp - 0x231], 0
push esi
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
push esi
lea eax, [ebp - 0x634]
push eax
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.kernel32.dll_GetVolumeInformationA]
cmp eax, 1
pop edi
pop esi
pop ebx
jne 0x56a5b9
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1e], eax
movzx eax, byte [ebp - 0x1b]
push eax
movzx eax, byte [ebp - 0x1c]
push eax
movzx eax, byte [ebp - 0x1d]
push eax
movzx eax, byte [ebp - 0x1e]
push eax
movzx eax, byte [ebp - 0x1f]
push eax
movzx eax, byte [ebp - 0x20]
push eax
movzx eax, byte [ebp - 0x21]
push eax
movzx eax, byte [ebp - 0x22]
push eax
movzx eax, byte [ebp - 0x23]
push eax
movzx eax, byte [ebp - 0x24]
push eax
lea eax, [ebp - 0x14]
push 0x965760
push eax
call fcn.00434e21
mov ecx, dword [ebp + 8]
add esp, 0x30
lea eax, [ebp - 0x14]
push eax
call fcn.00414f8b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00414ebb
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret 4
Function at 0x59b7d1
Capabilities:
Access peb ldr_data
Get common file path

Disassembly:
mov eax, 0x8abf88
call fcn.00879bb8
sub esp, 0x20c
push ebx
push esi
mov esi, ecx
lea eax, [esi + 0xc]
mov ecx, eax
neg ecx
lea edx, [eax - 0xc]
sbb ecx, ecx
and ecx, edx
push edi
mov dword [ebp - 0x10], esi
mov dword [0x979448], ecx
xor edi, edi
mov dword [ebp - 4], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
lea ecx, [esi + 0x14]
mov dword [eax], edi
mov dword [esi + 0x10], edi
mov dword [ecx], edi
mov dword [esi + 0x18], edi
push 1
pop ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
push 0xffffffffffffffff
push 0x978474
mov byte [ebp - 4], 4
mov dword [esi], 0x8ec6bc
call fcn.00414edd
push 0x104
lea eax, [ebp - 0x114]
push edi
push eax
call fcn.0087a060
add esp, 0xc
push ebx
push 0x1a
lea eax, [ebp - 0x114]
push eax
push edi
call dword [sym.imp.shell32.dll_SHGetSpecialFolderPathA]
push 0x965990
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x218]
push 0x965988
push eax
call fcn.00879f55
add esp, 0x10
lea eax, [ebp - 0x218]
push eax
lea eax, [esi + 0x14]
push 0x964da0
push eax
call fcn.00434e21
mov ecx, dword [ebp - 0xc]
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x5c55cd
Capabilities:
Check os version

Disassembly:
mov eax, 0x8b033e
call fcn.00879bb8
push ecx
push ebx
push esi
push edi
mov esi, ecx
push 0x90
mov ecx, 0x97bac0
call fcn.004029b9
mov ecx, eax
mov dword [ebp - 0x10], ecx
xor ebx, ebx
cmp ecx, ebx
mov dword [ebp - 4], ebx
je 0x5c5601
call fcn.005c5810
jmp 0x5c5603
xor eax, eax
or dword [ebp - 4], 0xffffffff
push eax
lea ecx, [esi + 0x478]
call fcn.005d0c41
mov eax, dword [esi + 0xf0]
mov edi, dword [esi + 0x1f4]
lea ecx, [eax - 0xc]
neg eax
sbb eax, eax
and eax, ecx
cmp dword [esi + 0x274], ebx
je 0x5c563a
mov ecx, dword [esi + 0x160]
cmp ecx, ebx
jne 0x5c5640
mov ecx, dword [esi + 0x15c]
cmp eax, ebx
je 0x5c566a
cmp dword [eax + 0x240], ebx
je 0x5c566a
cmp dword [ecx + 0x1d4], ebx
je 0x5c566a
push dword [ecx + 0xb4]
add ecx, 0xac
push ecx
call fcn.00413367
pop ecx
pop ecx
mov edi, eax
cmp dword [esi + 0x274], ebx
je 0x5c567c
mov eax, dword [esi + 0x160]
cmp eax, ebx
jne 0x5c5682
mov eax, dword [esi + 0x15c]
push dword [eax + 0x48]
add eax, 0x40
push eax
call fcn.00413367
test eax, eax
pop ecx
pop ecx
mov ebx, 0x8c
jne 0x5c569d
fldz
jmp 0x5c56c0
mov eax, dword [esi + 0x1f8]
add eax, edi
cmp eax, 0xa
jg 0x5c56ad
push 0xa
pop eax
cmp eax, ebx
mov dword [ebp - 0x10], eax
jl 0x5c56b7
mov dword [ebp - 0x10], ebx
fild dword [ebp - 0x10]
fmul qword [0x8e8cd0]
push ecx
push ecx
mov ecx, dword [esi + 0x47c]
fstp qword [esp]
add ecx, 0x24
call fcn.005d0f1a
cmp dword [esi + 0x274], 0
je 0x5c56e6
mov eax, dword [esi + 0x160]
test eax, eax
jne 0x5c56ec
mov eax, dword [esi + 0x15c]
push dword [eax + 0x48]
add eax, 0x40
push eax
call fcn.00413367
cmp eax, 3
pop ecx
pop ecx
jne 0x5c57c1
push ecx
fld1
push ecx
fstp qword [esp]
mov ecx, dword [esi + 0x47c]
add ecx, 0x78
call fcn.005d0f1a
mov eax, dword [esi + 0x1f8]
add eax, dword [esi + 0x1f4]
push 0xa
pop edi
cmp eax, edi
jg 0x5c572d
mov eax, edi
cmp eax, ebx
mov dword [ebp - 0x10], eax
jl 0x5c5737
mov dword [ebp - 0x10], ebx
fild dword [ebp - 0x10]
push ecx
push ecx
mov ecx, dword [esi + 0x47c]
fmul qword [0x8e8cd0]
add ecx, 0x84
fstp qword [esp]
call fcn.005d0f1a
push ecx
fld1
push ecx
fstp qword [esp]
mov ecx, dword [esi + 0x47c]
add ecx, 0x54
call fcn.005d0f1a
mov eax, dword [esi + 0x1f8]
add eax, dword [esi + 0x1f4]
cmp eax, edi
jg 0x5c577d
mov eax, edi
cmp eax, ebx
mov dword [ebp - 0x10], eax
jl 0x5c5787
mov dword [ebp - 0x10], ebx
fild dword [ebp - 0x10]
mov edi, dword [esi + 0x47c]
push ecx
push ecx
fmul qword [0x8e8cd0]
add edi, 0x6c
mov ecx, edi
fstp qword [esp]
call fcn.005d0f1a
mov ebx, dword [esi + 0x47c]
mov ecx, edi
add ebx, 0x60
call fcn.005d0e60
push ecx
push ecx
mov ecx, ebx
fstp qword [esp]
call fcn.005d0f1a
mov eax, dword [esi + 0x15c]
fld qword [eax + 0x150]
push ecx
lea edi, [esi + 0x15c]
push ecx
mov ecx, dword [esi + 0x47c]
fstp qword [esp]
add ecx, 0x18
call fcn.005d0f1a
mov eax, dword [edi]
fld qword [eax + 0x150]
push ecx
push ecx
mov ecx, dword [esi + 0x47c]
fstp qword [esp]
add ecx, 0x30
call fcn.005d0f1a
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x5c5810
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x8b03cc
call fcn.00879bb8
push ecx
push ebx
push esi
push edi
mov esi, ecx
push 0xc
push 0
push esi
mov dword [ebp - 0x10], esi
mov dword [esi], 0x8e84a0
call fcn.0087a060
add esp, 0xc
and dword [ebp - 4], 0
lea edi, [esi + 0xc]
mov ecx, edi
call fcn.005d0bc9
lea ebx, [esi + 0x18]
mov ecx, ebx
mov byte [ebp - 4], 1
call fcn.005d0bc9
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call fcn.005d0bc9
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 3
call fcn.005d0bc9
lea ecx, [esi + 0x3c]
mov byte [ebp - 4], 4
call fcn.005d0bc9
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 5
call fcn.005d0bc9
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 6
call fcn.005d0bc9
lea ecx, [esi + 0x60]
mov byte [ebp - 4], 7
call fcn.005d0bc9
lea ecx, [esi + 0x6c]
mov byte [ebp - 4], 8
call fcn.005d0bc9
lea ecx, [esi + 0x78]
mov byte [ebp - 4], 9
call fcn.005d0bc9
lea ecx, [esi + 0x84]
mov byte [ebp - 4], 0xa
call fcn.005d0bc9
fld qword [0x8e9978]
push ecx
push ecx
mov ecx, edi
fstp qword [esp]
mov byte [ebp - 4], 0xb
mov dword [esi], 0x8ecb48
call fcn.005d0f1a
fld1
push ecx
push ecx
mov ecx, ebx
fstp qword [esp]
call fcn.005d0f1a
fld1
push ecx
push ecx
lea ecx, [esi + 0x24]
fstp qword [esp]
call fcn.005d0f1a
fld1
push ecx
push ecx
lea ecx, [esi + 0x30]
fstp qword [esp]
call fcn.005d0f1a
fld qword [0x8ecb40]
push ecx
push ecx
lea ecx, [esi + 0x3c]
fstp qword [esp]
call fcn.005d0f1a
fld1
push ecx
push ecx
lea ecx, [esi + 0x48]
fstp qword [esp]
call fcn.005d0f1a
fld1
push ecx
push ecx
lea ecx, [esi + 0x54]
fstp qword [esp]
call fcn.005d0f1a
fld1
push ecx
push ecx
lea ecx, [esi + 0x60]
fstp qword [esp]
call fcn.005d0f1a
fld1
push ecx
push ecx
lea ecx, [esi + 0x6c]
fstp qword [esp]
call fcn.005d0f1a
fldz
push ecx
push ecx
lea ecx, [esi + 0x78]
fstp qword [esp]
call fcn.005d0f1a
fldz
push ecx
push ecx
lea ecx, [esi + 0x84]
fstp qword [esp]
call fcn.005d0f1a
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x5d5088
Capabilities:
Get number of processors

Disassembly:
mov eax, 0x8b0fa6
call fcn.00879bb8
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], 0x8ecbc8
lea ecx, [esi + 0x70]
mov dword [ebp - 4], 6
call fcn.00434d5d
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 5
call fcn.00434d5d
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 4
call fcn.00434d5d
lea ecx, [esi + 0x44]
mov edi, 0x8ecbcc
mov byte [ebp - 4], 3
mov dword [ecx], edi
call fcn.005d680a
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
mov dword [ecx], edi
call fcn.005d680a
lea ecx, [esi + 0x1c]
mov byte [ebp - 4], 1
mov dword [ecx], edi
call fcn.005d680a
and byte [ebp - 4], 0
lea ecx, [esi + 4]
mov dword [ecx], 0x8ea3e8
call fcn.004d4c05
mov ecx, dword [ebp - 0xc]
and dword [0x97813c], 0
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x5e7035
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x8b2204
call fcn.00879bb8
push ecx
push ebx
push esi
mov esi, ecx
lea ecx, [esi + 4]
mov eax, ecx
neg eax
lea edx, [ecx - 4]
sbb eax, eax
and eax, edx
push edi
mov dword [ebp - 0x10], esi
mov dword [0x9794b8], eax
push 0xffffffffffffffff
xor ebx, ebx
mov edi, 0x978474
push edi
mov dword [ebp - 4], ebx
mov dword [ecx], ebx
call fcn.00414edd
push 0xffffffffffffffff
lea ecx, [esi + 8]
push edi
mov byte [ebp - 4], 1
mov dword [ecx], ebx
call fcn.00414edd
mov dword [esi + 0xc], ebx
push 0x7f89
push ebx
mov byte [ebp - 4], 3
mov dword [esi + 0x30], ebx
mov dword [esi], 0x8ecc7c
call dword [fcn.0097b558]
push 0x7f00
push ebx
mov dword [esi + 0x34], eax
call dword [fcn.0097b558]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x38], eax
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret