joyce8/EMBER2024-capa huggingface dataset:
Function at 0x519bc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5d13d6
mov eax, dword fs:[0]
push eax
sub esp, 0xb4
mov eax, dword [0x65b4e4]
xor eax, esp
mov dword [esp + 0xb0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x65b4e4]
xor eax, esp
push eax
lea eax, [esp + 0xc8]
mov dword fs:[0], eax
mov esi, dword [esp + 0xd8]
xor eax, eax
mov dword [esi], eax
lea ecx, [esp + 0x14]
xor ebx, ebx
mov dword [esi + 4], eax
call fcn.005173c0
lea ecx, [esp + 0x14]
mov dword [esp + 0xd0], ebx
call fcn.00519440
mov eax, dword [esp + 0x1c]
mov edi, dword [eax]
lea ebp, [ebx + 0xf]
lea ecx, [ecx]
cmp edi, dword [esp + 0x1c]
je 0x519d00
mov dword [esp + 0x5c], ebp
mov dword [esp + 0x58], ebx
mov byte [esp + 0x48], bl
mov dword [esp + 0x78], ebp
mov dword [esp + 0x74], ebx
mov byte [esp + 0x64], bl
mov dword [esp + 0x94], ebp
mov dword [esp + 0x90], ebx
mov byte [esp + 0x80], bl
mov dword [esp + 0xb0], ebp
mov dword [esp + 0xac], ebx
mov byte [esp + 0x9c], bl
mov dword [esp + 0xb4], ebx
mov dword [esp + 0xb8], ebx
mov dword [esp + 0xbc], ebx
mov dword [esp + 0xc0], ebx
mov edx, dword [edi + 8]
mov eax, dword [edx]
lea ecx, [esp + 0x2c]
push ecx
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0xd8], 1
call fcn.00519250
test eax, eax
je 0x519cde
cmp dword [esi + 4], ebx
jne 0x519cc1
cmp dword [esi], ebx
je 0x519cd1
lea eax, [esp + 0x3c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
test eax, eax
jle 0x519cde
mov edx, dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
mov dword [esi + 4], edx
mov dword [esi], ecx
lea ecx, [esp + 0x2c]
mov byte [esp + 0xd0], bl
call fcn.00414d70
cmp edi, dword [esp + 0x1c]
jne 0x519cf9
call fcn.005b0913
mov edi, dword [edi]
jmp 0x519c30
cmp dword [esi + 4], ebx
jne 0x519d2b
cmp dword [esi], ebx
jne 0x519d2b
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x18], vtable.BaseLib::TPointerContainer_class_std::list_struct_BaseLib::_tag_process_info___class_std::allocator_struct_BaseLib::_tag_process_info____.0
call fcn.00414fa0
add esp, 4
lea ecx, [esp + 0x18]
call fcn.00480a90
xor eax, eax
jmp 0x519d83
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x18], vtable.BaseLib::TPointerContainer_class_std::list_struct_BaseLib::_tag_process_info___class_std::allocator_struct_BaseLib::_tag_process_info____.0
call fcn.00414fa0
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx]
mov dword [ecx], ecx
mov ecx, dword [esp + 0x20]
mov dword [ecx + 4], ecx
mov ecx, dword [esp + 0x20]
add esp, 4
cmp eax, ecx
mov dword [esp + 0x20], ebx
je 0x519d75
jmp 0x519d60
mov esi, dword [eax]
push eax
call fcn.00594e98
mov ecx, dword [esp + 0x20]
add esp, 4
cmp esi, ecx
mov eax, esi
jne 0x519d60
push ecx
call fcn.00594e98
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0xc8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xb0]
xor ecx, esp
call fcn.005b0968
add esp, 0xc0
ret

Function at 0x519e50
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
xor eax, eax
test edx, edx
jle 0x519e6b
mov ecx, dword [esp + 4]
mov edi, edi
xor byte [eax + ecx], 2
add eax, 1
cmp eax, edx
jl 0x519e60
ret
Function at 0x519eb0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
push 0x62b410
push eax
call fcn.005b0ac9
mov esi, eax
add esp, 8
test esi, esi
je 0x519ef9
mov edx, dword [esp + 0xc]
mov eax, edx
push edi
lea edi, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x519ed3
push esi
sub eax, edi
push 1
push eax
push edx
call fcn.005b0d41
push esi
call fcn.005b0f84
add esp, 0x14
pop edi
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x519f00
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
push 0x5f4ac8
push eax
call fcn.005b0ac9
mov esi, eax
add esp, 8
test esi, esi
je 0x519f3b
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push esi
push 1
push ecx
push edx
call fcn.005b0d41
push esi
call fcn.005b0f84
add esp, 0x14
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x519f40
Capabilities:
Write file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov eax, ebx
push edi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x519f50
sub eax, edx
mov edi, eax
mov eax, dword [esp + 0x10]
push 0x5f4ac8
push eax
call fcn.005b0ac9
mov esi, eax
add esp, 8
test esi, esi
je 0x519f91
push esi
push 1
push edi
push ebx
call fcn.005b0d41
push esi
call fcn.005b0f84
add esp, 0x14
pop edi
pop esi
mov eax, 1
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret

Function at 0x519fa0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
je 0x51a008
cmp byte [ebx], 0
je 0x51a008
push esi
mov esi, ebx
push edi
lea ecx, [esi + 1]
mov al, byte [esi]
add esi, 1
test al, al
jne 0x519fb5
sub esi, ecx
push esi
call fcn.00594e9d
push esi
mov edi, eax
push ebx
push edi
call fcn.005b64d0
add esp, 0x10
xor eax, eax
test esi, esi
jle 0x519feb
lea esp, [esp]
xor byte [eax + edi], 2
add eax, 1
cmp eax, esi
jl 0x519fe0
mov eax, dword [esp + 0x10]
push esi
push edi
push eax
call fcn.00519f00
push edi
mov esi, eax
call fcn.00594e98
add esp, 0x10
pop edi
mov eax, esi
pop esi
pop ebx
ret
xor eax, eax
pop ebx
ret
Function at 0x51a010
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5d1466
mov eax, dword fs:[0]
push eax
sub esp, 0xa4
mov eax, dword [0x65b4e4]
xor eax, esp
mov dword [esp + 0xa0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x65b4e4]
xor eax, esp
push eax
lea eax, [esp + 0xb8]
mov dword fs:[0], eax
mov eax, dword [esp + 0xcc]
mov ebx, dword [esp + 0xc8]
xor edi, edi
cmp eax, edi
mov dword [esp + 0x14], edi
je 0x51a156
cmp byte [eax], 0
je 0x51a156
push 0x62b408
push eax
call fcn.005b0ac9
mov esi, eax
add esp, 8
mov dword [esp + 0x14], esi
cmp esi, edi
mov dword [esp + 0xc0], 2
je 0x51a134
push 2
push edi
push esi
call fcn.005b18b8
push esi
call fcn.005b1ad5
push edi
push edi
push esi
mov ebp, eax
call fcn.005b18b8
push ebp
call fcn.00594e9d
mov edi, eax
add esp, 0x20
test edi, edi
je 0x51a132
push esi
push 1
push ebp
push edi
call fcn.005b1816
add esp, 0x10
mov dword [esp + 0xb0], 0xf
mov dword [esp + 0xac], 0
mov byte [esp + 0x9c], 0
push ebp
push edi
lea ecx, [esp + 0xa0]
mov byte [esp + 0xc8], 3
call fcn.00408360
push edi
call fcn.00594e98
add esp, 4
lea eax, [esp + 0x98]
push eax
mov ecx, ebx
call fcn.0040c070
lea ecx, [esp + 0x98]
call fcn.0040c050
push esi
call fcn.005b0f84
add esp, 4
jmp 0x51a222
xor edi, edi
push 0x62a4a0
mov ecx, ebx
call fcn.0040bf50
cmp esi, edi
je 0x51a222
push esi
call fcn.005b0f84
add esp, 4
jmp 0x51a222
push 1
push 2
lea ecx, [esp + 0x20]
call fcn.0040b160
lea ecx, [esp + 0x18]
push 0x5f3a0c
push ecx
mov dword [esp + 0xc8], edi
call fcn.00409c80
add esp, 8
lea edx, [esp + 0x98]
push edx
lea ecx, [esp + 0x1c]
call fcn.00409610
mov esi, 0x10
cmp dword [eax + 0x18], esi
mov byte [esp + 0xc0], 1
jb 0x51a1a4
mov eax, dword [eax + 4]
jmp 0x51a1a7
add eax, 4
push eax
push str.BaseLib::ReadFileToString
push 0x47
push str..common_stdfile.cpp
push 0xf0000000
call fcn.00409980
mov ecx, eax
call fcn.004fa910
cmp dword [esp + 0xb0], esi
jb 0x51a1de
mov eax, dword [esp + 0x9c]
push eax
call fcn.00594e98
add esp, 4
lea ecx, [esp + 0x64]
mov dword [esp + 0xc0], 0xffffffff
call fcn.00409f20
lea ecx, [esp + 0x64]
push ecx
mov dword [esp + 0x68], vtable.std::ios_base.0
call fcn.005cccbe
add esp, 4
push edi
mov dword [ebx + 0x18], 0xf
mov dword [ebx + 0x14], edi
push 0x62a4a0
mov ecx, ebx
mov byte [ebx + 4], 0
call fcn.004098b0
mov eax, ebx
mov ecx, dword [esp + 0xb8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xa0]
xor ecx, esp
call fcn.005b0968
add esp, 0xb0
ret
Function at 0x51b860
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
ret

Function at 0x51b9f0
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x5d172d
mov eax, dword fs:[0]
push eax
mov eax, 0x2048
call fcn.005b5ef0
mov eax, dword [0x65b4e4]
xor eax, esp
mov dword [esp + 0x2044], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x65b4e4]
xor eax, esp
push eax
lea eax, [esp + 0x205c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x206c]
mov esi, dword [esp + 0x2070]
mov ebp, dword [esp + 0x2074]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x2078]
xor ebx, ebx
cmp eax, ebx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], ebx
mov edx, eax
jne 0x51ba64
mov edx, 0x62a4a0
mov eax, edx
mov dword [esp + 0x54], 0xf
mov dword [esp + 0x50], ebx
mov byte [esp + 0x40], bl
lea edi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x51ba80
sub eax, edi
push eax
push edx
lea ecx, [esp + 0x44]
call fcn.004098b0
cmp esi, ebx
mov dword [esp + 0x2064], ebx
je 0x51bb64
cmp byte [esi], bl
je 0x51bb64
cmp ebp, ebx
je 0x51bb64
cmp byte [ebp], bl
je 0x51bb64
push 0x1fff
lea ecx, [esp + 0x5d]
push ebx
push ecx
mov byte [esp + 0x64], bl
call fcn.005b4520
mov eax, dword [esp + 0x28]
mov ecx, 0x10
add esp, 0xc
cmp dword [eax + 0x18], ecx
jb 0x51bae8
mov eax, dword [eax + 4]
jmp 0x51baeb
add eax, 4
cmp dword [esp + 0x54], ecx
mov ecx, dword [esp + 0x40]
jae 0x51baf9
lea ecx, [esp + 0x40]
push eax
push 0x1fff
lea edx, [esp + 0x60]
push edx
push ecx
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esp + 0x58], bl
je 0x51bb34
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x24]
call fcn.0040bf50
mov ebx, 2
mov byte [esp + 0x2064], 1
mov dword [esp + 0x14], ebx
jmp 0x51bb3c
mov ebx, dword [esp + 0x14]
lea eax, [esp + 0x3c]
mov esi, dword [esp + 0x18]
push eax
mov ecx, esi
call fcn.0040c070
or ebx, 1
test bl, 2
je 0x51bb59
lea ecx, [esp + 0x20]
call fcn.0040c050
lea ecx, [esp + 0x3c]
call fcn.0040c050
jmp 0x51bb98
mov esi, dword [esp + 0x18]
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x44]
push ecx
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
mov ecx, esi
mov byte [esi + 4], bl
call fcn.004080b0
cmp dword [esp + 0x54], 0x10
jb 0x51bb98
mov edx, dword [esp + 0x40]
push edx
call fcn.00594e98
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x205c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2044]
xor ecx, esp
call fcn.005b0968
add esp, 0x2054
ret 0x10
Function at 0x51be00
Capabilities:
Query or enumerate registry value

Disassembly:
push edi
mov edi, dword [esp + 0x10]
test edi, edi
jne 0x51be13
push 0x80004005
call fcn.0041b660
mov edx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
push edi
push esi
lea eax, [esp + 0x1c]
push eax
mov eax, dword [ecx]
push 0
push edx
push eax
mov dword [esp + 0x2c], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test esi, esi
je 0x51be7a
mov ecx, dword [edi]
test ecx, ecx
jbe 0x51be77
mov edx, dword [esp + 0x14]
test edx, edx
jbe 0x51be72
cmp edx, 2
jbe 0x51be6b
cmp edx, 7
jne 0x51be72
cmp ecx, 1
jb 0x51be72
cmp byte [ecx + esi - 1], 0
jne 0x51be72
cmp ecx, 1
jbe 0x51be7a
cmp byte [ecx + esi - 2], 0
jmp 0x51be70
cmp byte [ecx + esi - 1], 0
je 0x51be7a
mov eax, 0xd
mov byte [esi], 0
pop esi
pop edi
ret 0xc

Function at 0x51c1a0
Capabilities:
Get disk information

Disassembly:
mov eax, 0x1044
call fcn.005b5ef0
mov eax, dword [0x65b4e4]
xor eax, esp
mov dword [esp + 0x1040], eax
push edi
push 0xfff
xor edi, edi
lea eax, [esp + 0x49]
push edi
push eax
mov byte [esp + 0x50], 0
call fcn.005b4520
add esp, 0xc
lea ecx, [esp + 0x44]
push ecx
push 0xfff
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
je 0x51c23f
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
push esi
lea esi, [esp + 0x4c]
push esi
call ebx
cmp eax, 3
jne 0x51c230
push 0x40
lea edx, [esp + 0x10]
push 0
push edx
call fcn.005b4520
movsx eax, byte [esi]
push eax
lea ecx, [esp + 0x1c]
push 0x5f3218
push ecx
call fcn.005b0b2c
lea edx, [esp + 0x24]
push edx
call fcn.004fec50
add esp, 0x1c
add edi, eax
jmp 0x51c230
mov al, byte [esi]
add esi, 1
test al, al
jne 0x51c230
cmp byte [esi], al
jne 0x51c1f3
pop esi
pop ebx
mov ecx, dword [esp + 0x1044]
mov eax, edi
pop edi
xor ecx, esp
call fcn.005b0968
add esp, 0x1044
ret
Function at 0x51d4b0
Capabilities:
Get hostname

Disassembly:
sub esp, 0x108
mov eax, dword [0x65b4e4]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
push esi
mov esi, dword [esp + 0x114]
xor ebx, ebx
push 0xff
lea eax, [esp + 0x11]
push ebx
push eax
mov dword [esp + 0x14], ebx
mov byte [esp + 0x18], bl
call fcn.005b4520
add esp, 0xc
push 0x100
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.WS2_32.dll_gethostname]
lea eax, [esp + 0xc]
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
mov byte [esi + 4], bl
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x51d510
sub eax, edx
push eax
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.004098b0
mov ecx, dword [esp + 0x10c]
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.005b0968
add esp, 0x108
ret 4

Function at 0x51d550
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x144
mov eax, dword [0x65b4e4]
xor eax, esp
mov dword [esp + 0x140], eax
xor eax, eax
push esi
mov esi, dword [esp + 0x14c]
push 0x9c
push eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x30]
push eax
call fcn.005b4520
add esp, 0xc
push 0
push 0x62a4a0
mov ecx, esi
call fcn.004098b0
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0x2c], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x51d66e
push str.GetNativeSystemInfo
push 0x5f3994
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x51d5f2
lea edx, [esp + 4]
push edx
call eax
jmp 0x51d5fd
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [esp + 0x38], 2
jne 0x51d66e
push 0x7f
lea ecx, [esp + 0xc9]
push 0
push ecx
mov byte [esp + 0xd0], 0
call fcn.005b4520
movzx edx, word [esp + 0xca]
movzx eax, word [esp + 0xc8]
mov ecx, dword [esp + 0x40]
push edx
push eax
push ecx
lea edx, [esp + 0xdc]
push str._lu._lu._lu
push edx
call fcn.0051c280
lea eax, [esp + 0xe4]
add esp, 0x20
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x51d653
sub eax, edx
push eax
lea eax, [esp + 0xc8]
push eax
mov ecx, esi
call fcn.004098b0
mov ecx, dword [esp + 0x144]
pop esi
xor ecx, esp
call fcn.005b0968
add esp, 0x144
ret 4
Function at 0x51d690
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x114
mov eax, dword [0x65b4e4]
xor eax, esp
mov dword [esp + 0x110], eax
xor eax, eax
push esi
mov esi, dword [esp + 0x11c]
push 0x9c
push eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x30]
push eax
call fcn.005b4520
add esp, 0xc
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0x2c], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x51d79b
push str.GetNativeSystemInfo
push 0x5f3994
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x51d724
lea edx, [esp + 4]
push edx
call eax
jmp 0x51d72f
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0
push 0x62a4a0
mov ecx, esi
call fcn.004098b0
cmp dword [esp + 0x38], 2
jne 0x51d79b
cmp dword [esp + 0x2c], 4
jbe 0x51d79b
movzx ecx, word [esp + 0xbe]
movzx edx, word [esp + 0xbc]
push ecx
push edx
push str._d._d
lea eax, [esp + 0xd0]
push 0x50
push eax
call fcn.0051c380
lea eax, [esp + 0xd8]
add esp, 0x14
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x51d780
sub eax, edx
push eax
lea ecx, [esp + 0xc8]
push ecx
mov ecx, esi
call fcn.004098b0
mov ecx, dword [esp + 0x114]
pop esi
xor ecx, esp
call fcn.005b0968
add esp, 0x114
ret 4
Function at 0x51d8e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5d18e8
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x65b4e4]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
push esi
mov eax, dword [0x65b4e4]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov esi, dword [esp + 0x60]
xor ebx, ebx
push ebx
push 0x62a4a0
lea ecx, [esp + 0x38]
mov dword [esp + 0x50], 0xf
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x3c], bl
call fcn.004098b0
push ebx
push 0x62a4a0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x60], ebx
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.004098b0
lea ecx, [esp + 0xc]
mov byte [esp + 0x58], 1
call fcn.005924e0
lea ecx, [esp + 0xc]
mov byte [esp + 0x58], 2
call fcn.00592b00
lea eax, [esp + 0x30]
push eax
push str.Vendor
push str.Select__from_Win32_ComputerSystemProduct
lea ecx, [esp + 0x18]
call fcn.00592620
lea ecx, [esp + 0x14]
push ecx
push str.Name
push str.Select__from_Win32_ComputerSystemProduct
lea ecx, [esp + 0x18]
call fcn.00592620
cmp dword [esp + 0x44], ebx
je 0x51d9c7
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x38]
push edx
mov ecx, esi
call fcn.004080b0
push 1
push 0x5f32a4
mov ecx, esi
call fcn.00408360
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
call fcn.00408470
push 4
push ebx
push str.__t_r_n
mov ecx, esi
call fcn.0049f800
push eax
push ebx
mov ecx, esi
call fcn.00408170
push 0xffffffffffffffff
push 4
push 0xffffffffffffffff
push str.__t_r_n
mov ecx, esi
call fcn.004ca3c0
add eax, 1
push eax
mov ecx, esi
call fcn.00408170
mov eax, dword [esp + 0x10]
cmp eax, ebx
mov byte [esp + 0x58], 1
je 0x51da20
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x51da30
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov esi, 0x10
cmp dword [esp + 0x2c], esi
jb 0x51da48
mov eax, dword [esp + 0x18]
push eax
call fcn.00594e98
add esp, 4
cmp dword [esp + 0x48], esi
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
jb 0x51da6b
mov ecx, dword [esp + 0x34]
push ecx
call fcn.00594e98
add esp, 4
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.005b0968
add esp, 0x50
ret 4
Function at 0x51da90
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x5d191b
mov eax, dword fs:[0]
push eax
sub esp, 0x414
mov eax, dword [0x65b4e4]
xor eax, esp
mov dword [esp + 0x410], eax
push ebx
push ebp
push esi
mov eax, dword [0x65b4e4]
xor eax, esp
push eax
lea eax, [esp + 0x424]
mov dword fs:[0], eax
mov esi, dword [esp + 0x434]
xor ebx, ebx
mov dword [esp + 0x1c], ebx
lea eax, [esp + 0x10]
push eax
push 0x2001f
push ebx
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push reloc.WS2_32.dll_bind
mov dword [esp + 0x440], ebx
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x51dbb4
mov ebp, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x18]
push eax
push ebx
push str.MHz
push ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [esp + 0x10], 4
jne 0x51dbac
cmp eax, ebx
jne 0x51dbac
mov ecx, dword [esp + 0x18]
push ecx
lea edx, [esp + 0x24]
push 0x5f2f68
push edx
call fcn.004c7750
lea eax, [esp + 0x2c]
add esp, 0xc
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x51db60
sub eax, edx
push eax
lea eax, [esp + 0x24]
push eax
mov ecx, esi
call fcn.004098b0
cmp ebp, ebx
je 0x51db83
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x424]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.005b0968
add esp, 0x420
ret 4
push ebx
push 0x62a4a0
jmp 0x51db71
push ebx
push 0x62a4a0
mov ecx, esi
call fcn.004098b0
jmp 0x51db83

Function at 0x51dbd0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x204
mov eax, dword [0x65b4e4]
xor eax, esp
mov dword [esp + 0x200], eax
push esi
mov esi, dword [esp + 0x20c]
mov dword [esp + 8], 0x1f4
mov dword [esp + 0xc], 1
call fcn.004fe580
neg eax
sbb eax, eax
and eax, 0xd0126
lea ecx, [esp + 4]
push ecx
add eax, 0x20019
push eax
push 0
push str.SoftwareMicrosoftInternet_Explorer
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x51dc6f
lea edx, [esp + 8]
push edx
mov edx, dword [esp + 8]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0
push str.Version
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x51dc6f
lea eax, [esp + 0x10]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x51dc57
sub eax, edx
push eax
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call fcn.004098b0
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x204]
pop esi
xor ecx, esp
call fcn.005b0968
add esp, 0x204
ret 4
Function at 0x51e600
Capabilities:
Get system information on windows

Disassembly:
push 0xffffffffffffffff
push 0x5d19db
mov eax, dword fs:[0]
push eax
sub esp, 0x138
mov eax, dword [0x65b4e4]
xor eax, esp
mov dword [esp + 0x134], eax
push ebx
push esi
push edi
mov eax, dword [0x65b4e4]
xor eax, esp
push eax
lea eax, [esp + 0x148]
mov dword fs:[0], eax
mov edi, dword [esp + 0x158]
xor eax, eax
push 0x9c
xor ebx, ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
lea eax, [esp + 0x5c]
push ebx
push eax
call fcn.005b4520
add esp, 0xc
lea ecx, [esp + 0x58]
push ecx
mov dword [esp + 0x5c], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp eax, ebx
je 0x51e7eb
push str.GetNativeSystemInfo
push 0x5f3994
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x51e6bb
lea edx, [esp + 0x14]
push edx
call eax
jmp 0x51e6c6
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [esp + 0x68], 2
jne 0x51e7f2
cmp dword [esp + 0x5c], 4
jbe 0x51e7f2
mov dword [esp + 0x54], 0xf
mov dword [esp + 0x50], ebx
mov byte [esp + 0x40], bl
lea ecx, [esp + 0x3c]
push ecx
mov dword [esp + 0x154], ebx
call fcn.0051dda0
mov edx, dword [esp + 0x44]
add esp, 4
cmp dword [esp + 0x54], 0x10
jae 0x51e70f
lea edx, [esp + 0x40]
mov esi, 0x100
mov eax, edi
sub edx, edi
jmp 0x51e720
lea ecx, [esi + 0x7ffffefe]
test ecx, ecx
je 0x51e73d
mov cl, byte [edx + eax]
cmp cl, bl
je 0x51e73d
mov byte [eax], cl
add eax, 1
sub esi, 1
jne 0x51e720
jmp 0x51e741
cmp esi, ebx
jne 0x51e744
sub eax, 1
mov byte [eax], bl
lea eax, [esp + 0x6c]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x51e750
sub eax, edx
je 0x51e77d
push 0x5f32a4
push 0x100
push edi
call fcn.0051c2e0
lea edx, [esp + 0x6c]
push edx
push 0x100
push edi
call fcn.0051c2e0
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], ebx
call fcn.004fe390
mov eax, dword [esp + 0x14]
add esp, 4
cmp eax, ebx
jbe 0x51e7a8
push eax
push str.__build__d_
push 0x50
lea ecx, [esp + 0x100]
push ecx
jmp 0x51e7bc
mov edx, dword [esp + 0x64]
push edx
push str.__build__d_
push 0x50
lea eax, [esp + 0x100]
push eax
call fcn.0051c380
add esp, 0x10
lea ecx, [esp + 0xf4]
push ecx
push 0x100
push edi
call fcn.0051c2e0
cmp dword [esp + 0x54], 0x10
jb 0x51e7eb
mov edx, dword [esp + 0x40]
push edx
call fcn.00594e98
add esp, 4
mov eax, 1
jmp 0x51e7f4
xor eax, eax
mov ecx, dword [esp + 0x148]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x134]
xor ecx, esp
call fcn.005b0968
add esp, 0x144
ret