joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10041da1
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c4
push ebx
push esi
push edi
mov esi, 0x11c
push esi
xor edi, edi
lea eax, [ebp - 0x124]
push edi
push eax
call fcn.10055e00
add esp, 0xc
lea eax, [ebp - 0x124]
mov dword [ebp - 0x124], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
mov ebx, eax
cmp ebx, edi
jne 0x10041dfb
lea eax, [ebp - 0x124]
push eax
mov dword [ebp - 0x124], 0x114
call esi
test eax, eax
je 0x10041f6f
mov eax, dword [ebp - 0x114]
xor esi, esi
sub eax, edi
je 0x10041f68
dec eax
je 0x10041f1a
dec eax
jne 0x10041f6d
cmp dword [ebp - 0x120], 4
ja 0x10041e27
mov esi, 0x1388
cmp dword [ebp - 0x120], 5
jne 0x10041e46
mov esi, dword [ebp - 0x11c]
neg esi
sbb esi, esi
and esi, 0x3e8
add esi, 0x1770
cmp ebx, edi
je 0x10041e89
cmp byte [ebp - 0xa], 1
jne 0x10041e58
add esi, 0x64
jmp 0x10041efa
cmp byte [ebp - 0xa], 3
jne 0x10041efa
test byte [ebp - 0xc], 0x80
je 0x10041e73
add esi, 0xc8
jmp 0x10041efa
test byte [ebp - 0xc], 2
je 0x10041e81
add esi, 0x12c
jmp 0x10041efa
add esi, 0x190
jmp 0x10041efa
lea eax, [ebp - 4]
push eax
push 1
push edi
push str.SYSTEMCurrentControlSetControlProductOptions
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1c4]
push eax
push edi
push edi
push str.ProductType
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea eax, [ebp - 0x1c4]
push eax
push str.WINNT
call edi
test eax, eax
jne 0x10041ee2
add esi, 0x1f4
lea eax, [ebp - 0x1c4]
push eax
push str.SERVERNT
call edi
test eax, eax
jne 0x10041efa
add esi, 0x258
mov eax, dword [ebp - 0x120]
cmp eax, 4
ja 0x10041f6d
mov ecx, dword [ebp - 0x11c]
cmp ecx, 0xa
jae 0x10041f6d
lea eax, [eax + eax*4]
lea eax, [ecx + eax*2]
add esi, eax
jmp 0x10041f6d
cmp dword [ebp - 0x120], 4
jne 0x10041f6d
cmp dword [ebp - 0x11c], edi
jne 0x10041f3d
cmp word [ebp - 0x10e], 0x43
mov esi, 0x7d0
jne 0x10041f6d
add esi, 0x64
cmp dword [ebp - 0x11c], 0xa
jne 0x10041f58
cmp word [ebp - 0x10e], 0x41
mov esi, 0xbb8
jne 0x10041f6d
add esi, 0x64
cmp dword [ebp - 0x11c], 0x5a
jne 0x10041f6d
mov esi, 0xfa0
jmp 0x10041f6d
mov esi, 0x3e8
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10041f74
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
cmp dword [ebp - 0x18], 0xa
jae 0x10041f8f
push 0x64
pop eax
leave
ret
push 0
push 0x3200000
push 0
push dword [ebp - 0x18]
call fcn.100568c0
leave
ret

Function at 0x10041fa2
Capabilities:
Persist via run registry key

Disassembly:
push str.GoogleDCClient
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push SysReAllocString
call fcn.100098a7
add esp, 0xc
ret
Function at 0x10042038
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push 0x104
lea eax, [ebp - 0x104]
push eax
call sub.WSOCK32.dll_gethostname
cmp eax, 0xffffffff
jne 0x1004205b
xor al, al
leave
ret
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x104]
push eax
call fcn.1000581d
mov al, 1
leave
ret

Function at 0x10042696
Capabilities:
Resolve dns

Disassembly:
mov eax, 0x1006d829
call fcn.10055640
sub esp, 0x38
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 0x10
jb 0x100426b1
mov eax, dword [eax + 4]
jmp 0x100426b4
add eax, 4
push eax
call sub.WSOCK32.dll_gethostbyname
test eax, eax
jne 0x100426c2
xor al, al
jmp 0x10042736
movsx ecx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
push esi
push ecx
push dword [eax]
lea eax, [ebp + 8]
push eax
call fcn.10055680
add esp, 0xc
push dword [ebp + 8]
call sub.WSOCK32.dll_inet_ntoa
push eax
lea ecx, [ebp - 0x28]
call fcn.10005c35
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.100058c1
pop ecx
pop ecx
mov ecx, dword [ebp + 0xc]
push 0xffffffffffffffff
push 0
push eax
mov byte [ebp - 4], 1
call fcn.10004148
push 1
lea ecx, [ebp - 0x44]
call fcn.1000289a
push 1
lea ecx, [ebp - 0x28]
call fcn.10002e29
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x10042733
push dword [ebp + 8]
call sub.WSOCK32.dll_htonl
mov dword [esi], eax
mov al, 1
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret

Function at 0x10042742
Capabilities:
Initialize winsock library

Disassembly:
mov eax, 0x1006d843
call fcn.10055640
sub esp, 0x254
push ebx
push esi
push edi
lea eax, [ebp - 0x260]
push eax
xor esi, esi
push 0x101
mov dword [ebp - 0x10], esi
call sub.WSOCK32.dll_WSAStartup
cmp eax, esi
jne 0x100427d1
push esi
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x1c], 0xf
call fcn.10002358
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 4], esi
call fcn.10042038
pop ecx
push esi
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x38], 7
call fcn.1000205b
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 1
call fcn.10042696
add esp, 0xc
call sub.WSOCK32.dll_WSACleanup
push 1
lea ecx, [ebp - 0x50]
call fcn.1000289a
or dword [ebp - 4], 0xffffffff
push 1
lea ecx, [ebp - 0x34]
call fcn.10002e29
push esi
call fcn.10056b94
push eax
call fcn.100570fd
pop ecx
pop ecx
call fcn.1005710a
cdq
mov esi, eax
mov edi, edx
call fcn.1005710a
cdq
mov ebx, eax
mov dword [ebp - 0x14], edx
call fcn.1005710a
push dword [ebp - 0x10]
cdq
shld edx, eax, 0xd
xor edx, dword [ebp - 0x14]
shl eax, 0xd
xor eax, ebx
mov ecx, edx
shld ecx, eax, 0x14
shl eax, 0x14
xor eax, dword [ebp - 0x10]
xor edx, edx
xor ecx, edx
xor ecx, edi
xor eax, esi
push ecx
push eax
call fcn.10041f74
push eax
call fcn.10041da1
push eax
lea eax, [ebp - 0xd0]
push str._4d._d__I64u__x
push eax
call fcn.10056928
mov ecx, dword [ebp + 8]
add esp, 0x1c
lea eax, [ebp - 0xd0]
push eax
call fcn.10004249
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov al, 1
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x10042d93
Capabilities:
Persist via run registry key

Disassembly:
mov eax, 0x1006d90f
call fcn.10055640
sub esp, 0x3c
push ebx
push esi
push edi
push 0
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x30], 7
call fcn.1000205b
and dword [ebp - 4], 0
push 0x20019
mov ebx, str.SoftwareMicrosoftWindowsCurrentVersionRun
push ebx
mov edi, SysReAllocString
push edi
lea ecx, [ebp - 0x10]
call fcn.10038798
lea eax, [ebp - 0x48]
push eax
mov esi, str.GoogleDCClient
push esi
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.100388d3
test al, al
jne 0x10042e2b
mov eax, dword [0x1009575c]
add eax, 0x38
push str.__startup
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.1000e4d3
add esp, 0xc
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
mov byte [ebp - 4], 2
jae 0x10042e15
lea eax, [ebp - 0x28]
push eax
push esi
push ebx
push edi
call fcn.1000987e
add esp, 0x10
push 1
lea ecx, [ebp - 0x2c]
call fcn.1000289a
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.100385bd
push 1
lea ecx, [ebp - 0x48]
call fcn.1000289a
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x10042e50
Capabilities:
Get common file path

Disassembly:
mov eax, 0x1006d965
call fcn.10055640
sub esp, 0x234
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
push ebx
mov dword [ebp - 0x18], esi
call fcn.1000289a
lea ecx, [esi + 0x1c]
push ebx
mov dword [ebp - 4], ebx
call fcn.1000289a
lea ecx, [esi + 0x38]
push ebx
call fcn.1000289a
lea edi, [esi + 0x54]
push ebx
mov ecx, edi
call fcn.1000289a
lea ecx, [esi + 0x70]
push ebx
call fcn.1000289a
push str.homedir
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 4
call fcn.10005748
lea eax, [ebp - 0x34]
push esi
push eax
mov byte [ebp - 4], 5
call fcn.1003c43f
test al, al
pop ecx
pop ecx
je 0x10042ed1
mov eax, dword [esi + 0x14]
xor ecx, ecx
cmp ecx, eax
sbb al, al
inc al
mov byte [ebp - 0xd], al
mov byte [ebp - 0xd], bl
je 0x10042ed5
mov byte [ebp - 0xd], 1
push 1
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 4
call fcn.1000289a
cmp byte [ebp - 0xd], bl
je 0x10043043
push str.SHELL32.DLL
call fcn.1000b4e4
cmp eax, ebx
mov dword [ebp - 0x14], eax
je 0x10042f22
push str.SHGetFolderPathW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x10042f22
lea ecx, [ebp - 0x240]
push ecx
push ebx
push ebx
push 0x8026
push ebx
call eax
test eax, eax
je 0x10042f35
lea eax, [ebp - 0x240]
push 0x10074514
push eax
call fcn.100564d6
pop ecx
pop ecx
cmp dword [ebp - 0x14], ebx
je 0x10042f43
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x240]
push eax
call fcn.1005565f
test eax, eax
pop ecx
jbe 0x10042f67
lea eax, [ebp - 0x240]
push eax
mov ecx, esi
call fcn.10004249
jmp 0x10043037
push 0x20019
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x14]
call fcn.10038798
push esi
push str.ProgramFilesDir
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 6
call fcn.100388d3
test al, al
jne 0x1004302b
push 0x104
lea eax, [ebp - 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x240]
push 0x10074d1c
push eax
call fcn.10055f8b
cmp eax, ebx
pop ecx
pop ecx
je 0x10042fc7
mov word [eax + 2], bx
jmp 0x10042fda
lea eax, [ebp - 0x240]
push 0x1007e67c
push eax
call fcn.100564d6
pop ecx
pop ecx
lea eax, [ebp - 0x240]
push str.Program_Files
push eax
call fcn.100564ac
lea eax, [ebp - 0x240]
push eax
call fcn.10041b1f
add esp, 0xc
test al, al
jne 0x1004301d
lea eax, [ebp - 0x240]
push eax
call fcn.10057edf
test eax, eax
pop ecx
je 0x1004301d
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 4
call fcn.100385bd
jmp 0x1004307f
lea eax, [ebp - 0x240]
push eax
mov ecx, esi
call fcn.10004249
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 4
call fcn.100385bd
push str.GoogleDCC
mov ecx, esi
call fcn.1000412b
push str.upgrade
lea eax, [ebp - 0x34]
push esi
push eax
call fcn.1000e4d3
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
mov ecx, edi
mov byte [ebp - 4], 7
call fcn.10004148
push 1
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 4
call fcn.1000289a
push dword [0x10092100]
mov ecx, esi
call fcn.1004219e
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x1004365c
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x10093134]
xor eax, dword [ebp + 0x7c]
push esi
mov dword [ebp + 0x74], eax
mov esi, ecx
call fcn.100435de
and byte [esi + 0xc], 0
mov eax, 0x10000000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
call fcn.10055e00
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x100436c1
cmp dword [ebp - 0x1c], 5
jb 0x100436d9
jmp 0x100436d5
cmp dword [ebp - 0x10], 1
jne 0x100436d9
cmp dword [ebp - 0x1c], 4
ja 0x100436d5
jne 0x100436d9
cmp dword [ebp - 0x18], 0
jbe 0x100436d9
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x700
mov dword [esi + 0x14], 0x1007e9cc
call fcn.10001852
test eax, eax
jge 0x100436fa
mov byte [0x100952ac], 1
mov ecx, dword [ebp + 0x74]
xor ecx, dword [ebp + 0x7c]
mov eax, esi
pop esi
call fcn.1005a011
add ebp, 0x78
leave
ret

Function at 0x10054ab0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
and byte [ebp - 4], 0
push edi
xor eax, eax
lea edi, [ebp - 3]
stosb byte es:[edi], al
push 2
lea eax, [ebp - 4]
push eax
push 0x22
call fcn.1005a235
push dword [eax + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov al, byte [ebp - 4]
cmp al, 0x30
pop edi
jne 0x10054ae2
push 2
pop eax
leave
ret
cmp al, 0x31
jne 0x10054aeb
xor eax, eax
inc eax
leave
ret
sub al, 0x32
neg al
sbb eax, eax
and eax, 0xfffffffd
add eax, 3
leave
ret

Function at 0x100575f8
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push edi
mov edi, dword [esp + 0xc]
xor ebx, ebx
test edi, edi
jne 0x10057614
call fcn.10057e5a
mov dword [eax], 0x16
or eax, 0xffffffff
jmp 0x10057686
push esi
push 0x88
push 1
call fcn.10060c19
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x1005766c
push esi
call fcn.1005d406
mov eax, dword [esp + 0x1c]
pop ecx
push esi
push 4
push esi
push 0x10057558
push dword [esp + 0x24]
mov dword [esi + 0x4c], edi
push 0
mov dword [esi + 0x50], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
mov dword [esi + 4], edi
je 0x10057664
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x10057683
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.10057a3f
test ebx, ebx
pop ecx
je 0x1005767e
push ebx
call fcn.10057e6c
pop ecx
or eax, 0xffffffff
jmp 0x10057685
mov eax, edi
pop esi
pop edi
pop ebx
ret
Function at 0x1005855b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 8
call fcn.1005a380
xor esi, esi
inc esi
cmp dword [0x10095a6c], esi
pop ecx
jne 0x10058583
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [ebp + 0xc], 0
mov al, byte [ebp + 0x10]
mov dword [0x10095a68], esi
mov byte [0x10095a64], al
jne 0x100585e9
mov ecx, dword [0x1009724c]
test ecx, ecx
je 0x100585ca
mov eax, dword [0x10097248]
sub eax, 4
cmp eax, ecx
jmp 0x100585c3
mov eax, dword [eax]
test eax, eax
je 0x100585b5
call eax
mov eax, dword [0x10097248]
sub eax, 4
cmp eax, dword [0x1009724c]
mov dword [0x10097248], eax
jae 0x100585ad
mov eax, 0x10090624
mov esi, 0x1009062c
cmp eax, esi
mov edi, eax
jae 0x100585e9
mov eax, dword [edi]
test eax, eax
je 0x100585e2
call eax
add edi, 4
cmp edi, esi
jb 0x100585da
mov eax, 0x10090630
mov esi, 0x10090638
cmp eax, esi
mov edi, eax
jae 0x10058608
mov eax, dword [edi]
test eax, eax
je 0x10058601
call eax
add edi, 4
cmp edi, esi
jb 0x100585f9
cmp dword [ebp + 0x10], 0
pop edi
pop esi
je 0x10058619
push 8
call fcn.1005a2ec
jmp 0x1005862b
push dword [ebp + 8]
mov dword [0x10095a6c], 1
call fcn.100584b4
pop ecx
pop ebp
ret
Function at 0x10058ee7
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.100570c0
mov eax, dword [0x10093134]
xor eax, dword [ebp + 4]
push ebx
push esi
push 1
xor esi, esi
push esi
push dword [ebp + 8]
mov dword [ebp - 4], eax
call fcn.10061f19
or ebx, 0xffffffff
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x10059011
push 2
push esi
push dword [ebp + 8]
call fcn.10061f19
add esp, 0xc
cmp eax, ebx
je 0x10059011
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
test edi, edi
jle 0x10058fb4
mov ebx, 0x1000
push ebx
lea eax, [ebp - 0x100c]
push esi
push eax
call fcn.10055e00
push 0x8000
push dword [ebp + 8]
call fcn.10063a82
add esp, 0x14
mov dword [ebp - 0xc], eax
cmp edi, ebx
mov eax, ebx
jge 0x10058f6d
mov eax, edi
push eax
lea eax, [ebp - 0x100c]
push eax
push dword [ebp + 8]
call fcn.10060cff
add esp, 0xc
cmp eax, 0xffffffff
je 0x10058f8d
sub edi, eax
test edi, edi
jg 0x10058f65
jmp 0x10058fa5
call fcn.10057e63
cmp dword [eax], 5
jne 0x10058fa2
call fcn.10057e5a
mov dword [eax], 0xd
or esi, 0xffffffff
push dword [ebp - 0xc]
push dword [ebp + 8]
call fcn.10063a82
pop ecx
pop ecx
jmp 0x10058ffc
jge 0x10058ffc
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10061f19
push dword [ebp + 8]
call fcn.1006385f
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
cmp esi, ebx
jne 0x10058ffc
call fcn.10057e5a
mov dword [eax], 0xd
call fcn.10057e63
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
push 0
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.10061f19
add esp, 0xc
mov eax, esi
pop edi
jmp 0x10059013
mov eax, ebx
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop esi
pop ebx
call fcn.1005a011
leave
ret
Function at 0x100590b9
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edx, ebx
je 0x1005927f
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0x1f
sar ecx, 5
lea esi, [eax + eax*8]
lea edi, [ecx*4 + 0x10095ec0]
mov eax, dword [edi]
shl esi, 2
add eax, esi
mov cl, byte [eax + 4]
test cl, 2
jne 0x1005927f
test cl, 0x48
je 0x1005911f
mov al, byte [eax + 5]
cmp al, 0xa
je 0x1005911f
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea edx, [ebx + 1]
mov dword [ebp - 8], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push edx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10059171
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop esi
cmp eax, esi
jne 0x10059159
call fcn.10057e5a
mov dword [eax], 9
call fcn.10057e63
mov dword [eax], esi
jmp 0x10059169
cmp eax, 0x6d
je 0x1005927f
push eax
call fcn.10057e6c
pop ecx
or eax, 0xffffffff
jmp 0x10059281
mov eax, dword [edi]
mov edx, dword [ebp - 0xc]
add dword [ebp - 8], edx
lea ecx, [eax + esi + 4]
mov al, byte [ecx]
test al, al
jns 0x1005927a
test edx, edx
je 0x10059194
cmp byte [ebx], 0xa
jne 0x10059194
or al, 4
jmp 0x10059196
and al, 0xfb
mov byte [ecx], al
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
add ecx, eax
cmp eax, ecx
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], ecx
jae 0x10059274
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0x1a
je 0x10059264
cmp al, 0xd
je 0x100591ca
mov byte [ebx], al
inc ebx
inc dword [ebp + 0x10]
jmp 0x10059256
dec ecx
cmp dword [ebp + 0x10], ecx
jae 0x100591e4
mov eax, dword [ebp + 0x10]
inc eax
cmp byte [eax], 0xa
jne 0x100591df
add dword [ebp + 0x10], 2
jmp 0x10059238
mov dword [ebp + 0x10], eax
jmp 0x10059252
inc dword [ebp + 0x10]
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1005920c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10059252
cmp dword [ebp - 0xc], 0
je 0x10059252
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x1005922d
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x10059238
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x10059255
cmp ebx, dword [ebp + 0xc]
jne 0x1005923d
cmp byte [ebp - 1], 0xa
jne 0x1005923d
mov byte [ebx], 0xa
jmp 0x10059255
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.10061f19
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x10059256
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 8]
cmp dword [ebp + 0x10], ecx
jb 0x100591ae
jmp 0x10059274
mov eax, dword [edi]
lea esi, [eax + esi + 4]
mov al, byte [esi]
test al, 0x40
jne 0x10059274
or al, 2
mov byte [esi], al
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
jmp 0x10059281
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10059d92
Capabilities:
Accept command line arguments
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 1
push esi
jne 0x10059e7f
mov eax, 0x94
call fcn.100570c0
mov esi, esp
push esi
mov dword [esi], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x10059ef4
mov ecx, dword [esi + 0x10]
mov dword [0x10095a2c], ecx
mov eax, dword [esi + 4]
mov dword [0x10095a38], eax
mov edx, dword [esi + 8]
mov dword [0x10095a3c], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
cmp ecx, 2
mov dword [0x10095a30], esi
je 0x10059dfd
or esi, 0x8000
mov dword [0x10095a30], esi
shl eax, 8
add eax, edx
push 1
mov dword [0x10095a34], eax
call fcn.10061069
test eax, eax
pop ecx
je 0x10059ef4
call fcn.1005d5f5
test eax, eax
jne 0x10059e2a
call fcn.100610ba
jmp 0x10059ef4
call fcn.10062f51
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x10096230], eax
call fcn.1006406a
mov dword [0x10095a78], eax
call fcn.10062fd9
test eax, eax
jl 0x10059e78
call fcn.10063fc8
test eax, eax
jl 0x10059e73
call fcn.10063d95
test eax, eax
jl 0x10059e73
call fcn.100584f6
test eax, eax
jne 0x10059e73
inc dword [0x10095a74]
jmp 0x10059f05
call fcn.100631d7
call fcn.1005d3e8
jmp 0x10059e20
test eax, eax
jne 0x10059eaf
cmp dword [0x10095a74], eax
jle 0x10059ef4
dec dword [0x10095a74]
cmp dword [0x10095a68], eax
jne 0x10059e9e
call fcn.10058650
call fcn.100631d7
call fcn.1005d3e8
call fcn.100610ba
jmp 0x10059f05
cmp eax, 2
jne 0x10059ef8
push 0x88
push 1
call fcn.10060c19
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x10059ef4
push esi
push dword [0x1009353c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
push esi
je 0x10059eee
call fcn.1005d406
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
or dword [esi + 4], 0xffffffff
mov dword [esi], eax
jmp 0x10059f05
call fcn.10057a3f
pop ecx
xor eax, eax
jmp 0x10059f08
cmp eax, 3
jne 0x10059f05
push 0
call fcn.1005d48a
pop ecx
xor eax, eax
inc eax
lea esp, [ebp - 4]
pop esi
pop ebp
ret 0xc
Function at 0x1005d814
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
push 4
pop eax
call fcn.100570c0
mov ebx, esp
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1005d8a9
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x44]
lea esi, [eax - 1]
not esi
and esi, ebx
sub esi, eax
mov dword [ebp - 4], eax
mov eax, dword [0x10095a2c]
mov ecx, eax
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0xffff1000
add ecx, 0x11000
add ecx, edi
cmp esi, ecx
jb 0x1005d8a9
cmp eax, 1
je 0x1005d8c1
mov ebx, edi
mov edi, 0x1000
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1005d8a9
add ebx, dword [ebp - 0x18]
test dword [ebp - 0x14], edi
je 0x1005d87e
test byte [ebp - 0xf], 1
mov ebx, dword [ebp - 0x24]
je 0x1005d8a5
xor eax, eax
inc eax
jmp 0x1005d8dd
cmp esi, ebx
jae 0x1005d8ad
xor eax, eax
jmp 0x1005d8dd
push 4
push edi
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x10095a2c]
jmp 0x1005d8c3
mov ebx, esi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 8]
push ecx
inc eax
push eax
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x54]
pop edi
pop esi
pop ebx
leave
ret