joyce8/EMBER2024-capa huggingface dataset:
Function at 0x509be0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 0xc]
mov ecx, 0x9e3779b9
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, edx
push edi
xor edi, edi
mov dword [ebp - 8], eax
mov ebx, ecx
cmp edx, 0xc
jb 0x509cfc
mov eax, 0xaaaaaaab
mov dword [ebp - 4], esi
mul edx
shr edx, 3
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 4]
movsx esi, byte [esi + 7]
shl esi, 8
movsx eax, byte [edx + 6]
add esi, eax
movsx eax, byte [edx + 5]
shl esi, 8
add esi, eax
movsx eax, byte [edx + 4]
add ecx, eax
shl esi, 8
add ecx, esi
mov esi, edx
movsx edx, byte [esi + 0xb]
movsx eax, byte [esi + 0xa]
shl edx, 8
add edx, eax
movsx eax, byte [esi + 9]
shl edx, 8
add edx, eax
movsx eax, byte [esi + 8]
add edi, eax
shl edx, 8
movsx eax, byte [esi + 2]
add edi, edx
movsx edx, byte [esi + 3]
shl edx, 8
add edx, eax
movsx eax, byte [esi + 1]
shl edx, 8
add edx, eax
movsx eax, byte [esi]
shl edx, 8
add edx, eax
mov eax, edi
shr eax, 0xd
sub edx, edi
sub edx, ecx
sub ecx, edi
add ebx, edx
xor ebx, eax
sub ecx, ebx
mov eax, ebx
shl eax, 8
xor ecx, eax
sub edi, ecx
mov eax, ecx
sub edi, ebx
shr eax, 0xd
xor edi, eax
sub ebx, edi
mov eax, edi
shr eax, 0xc
sub ebx, ecx
xor ebx, eax
sub ecx, edi
sub ecx, ebx
mov eax, ebx
shl eax, 0x10
xor ecx, eax
sub edi, ecx
mov eax, ecx
sub edi, ebx
shr eax, 5
xor edi, eax
sub ebx, edi
mov eax, edi
shr eax, 3
sub ebx, ecx
xor ebx, eax
sub ecx, edi
mov eax, ebx
sub ecx, ebx
shl eax, 0xa
xor ecx, eax
sub edi, ecx
mov eax, ecx
sub edi, ebx
shr eax, 0xf
xor edi, eax
add esi, 0xc
mov eax, dword [ebp - 8]
sub eax, 0xc
mov dword [ebp - 4], esi
sub dword [ebp - 0xc], 1
mov dword [ebp - 8], eax
jne 0x509c16
mov edx, dword [ebp + 0xc]
dec eax
add edi, edx
cmp eax, 0xa
ja case.default.0x509d04
jmp dword [eax*4 + 0x509dd4]
movsx eax, byte [esi + 0xa]
shl eax, 0x18
add edi, eax
movsx eax, byte [esi + 9]
shl eax, 0x10
add edi, eax
movsx eax, byte [esi + 8]
shl eax, 8
add edi, eax
movsx eax, byte [esi + 7]
shl eax, 0x18
add ecx, eax
movsx eax, byte [esi + 6]
shl eax, 0x10
add ecx, eax
movsx eax, byte [esi + 5]
shl eax, 8
add ecx, eax
movsx eax, byte [esi + 4]
add ecx, eax
movsx eax, byte [esi + 3]
shl eax, 0x18
add ebx, eax
movsx eax, byte [esi + 2]
shl eax, 0x10
add ebx, eax
movsx eax, byte [esi + 1]
shl eax, 8
add ebx, eax
movsx eax, byte [esi]
add ebx, eax
sub ebx, edi
mov eax, edi
sub ebx, ecx
shr eax, 0xd
xor ebx, eax
sub ecx, edi
sub ecx, ebx
mov eax, ebx
shl eax, 8
xor ecx, eax
sub edi, ecx
mov eax, ecx
sub edi, ebx
shr eax, 0xd
xor edi, eax
sub ebx, edi
mov eax, edi
sub ebx, ecx
shr eax, 0xc
xor ebx, eax
sub ecx, edi
sub ecx, ebx
mov eax, ebx
shl eax, 0x10
xor ecx, eax
sub edi, ecx
mov eax, ecx
sub edi, ebx
shr eax, 5
xor edi, eax
sub ebx, edi
mov eax, edi
sub ebx, ecx
shr eax, 3
xor ebx, eax
sub ecx, edi
sub ecx, ebx
mov edx, ebx
shl edx, 0xa
xor ecx, edx
sub edi, ecx
shr ecx, 0xf
sub edi, ebx
xor edi, ecx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x50d100
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x824], 0
je 0x50d144
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x50d144
mov eax, dword [esi + 0x824]
mov ecx, dword [esi + eax*8 + 4]
cmp ecx, 0xffffffff
je 0x50d138
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esi + 0x824]
dec eax
mov dword [esi + 0x824], eax
xor eax, eax
pop esi
pop ebp
ret
or eax, 0xffffffff
pop esi
pop ebp
ret
Function at 0x51bcb0
Capabilities:
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc10
mov eax, dword [0x906648]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push 0x400
mov dword [ebp - 0xc10], eax
lea eax, [ebp - 0x404]
push 0
push eax
mov dword [ebp - 0xc08], 0
mov dword [ebp - 0xc0c], 0
call sub.VCRUNTIME140.dll_memset
lea eax, [ebp - 0xc04]
push 0x800
push eax
call fcn.004f3630
mov ebx, dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
lea eax, [ebp - 0xc0c]
add esp, 0x14
push 0
push eax
lea eax, [ebp - 0xc08]
push eax
push 0x3ff
lea eax, [ebp - 0x404]
push eax
push esi
call ebx
cmp dword [ebp - 0xc08], 0
je 0x51be1a
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
nop word [eax + eax]
push 0x400
lea eax, [ebp - 0x404]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0xc08]
push 0
push eax
push 0x3ff
lea eax, [ebp - 0x404]
push eax
push esi
call edi
test eax, eax
je 0x51be19
cmp dword [ebp - 0xc08], 0
je 0x51be19
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0xc04]
push 0x800
push eax
call fcn.004f3eb0
lea eax, [ebp - 0xc04]
push eax
push 0x6d1abc
push 1
push 0
push dword [ebp - 0xc10]
call fcn.00538a70
push 0x400
lea eax, [ebp - 0x404]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
lea eax, [ebp - 0xc04]
push 0x800
push eax
call fcn.004f3630
add esp, 0x34
lea eax, [ebp - 0xc0c]
push 0
push eax
lea eax, [ebp - 0xc08]
push eax
push 0x3ff
lea eax, [ebp - 0x404]
push eax
push esi
call ebx
cmp dword [ebp - 0xc08], 0
jne 0x51bd50
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0063c972
mov esp, ebp
pop ebp
ret
Function at 0x550b20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x910f80]
push esi
mov esi, dword [ebp + 8]
mov dword [esi], eax
test eax, eax
jne 0x550b78
push 0x59545551
push 0x208
call fcn.004f3590
add esp, 8
mov dword [0x910f80], eax
test eax, eax
jne 0x550b55
mov eax, 0xc
pop esi
pop ebp
ret
push 0x104
push eax
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x550b6d
or eax, 0xffffffff
pop esi
pop ebp
ret
mov eax, dword [0x910f80]
xor ecx, ecx
mov word [eax + 6], cx
xor eax, eax
pop esi
pop ebp
ret

Function at 0x550d60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x10
push esi
mov esi, dword [0x910f80]
mov dword [eax], 0
test esi, esi
jne 0x550dc3
push 0x59545551
push 0x208
call fcn.004f3590
mov esi, eax
add esp, 8
mov dword [0x910f80], esi
test esi, esi
jne 0x550da0
lea eax, [esi + 0xc]
pop esi
mov esp, ebp
pop ebp
ret
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x550db8
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [0x910f80]
xor ecx, ecx
mov word [eax + 6], cx
push ebx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0
test edi, edi
jne 0x550de1
mov ebx, 0x3ea
pop edi
mov eax, ebx
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
push 0x50545551
lea eax, [ebp - 4]
mov dword [ebp - 0x10], 0
push eax
push edi
call fcn.00550770
mov ebx, eax
add esp, 0xc
mov eax, dword [ebp - 4]
test ebx, ebx
jne 0x550e62
push edi
call fcn.004f36b0
add esp, 4
mov dword [ebp - 8], eax
cmp word [edi + eax*2 - 2], 0x5c
push dword [ebp - 4]
je 0x550e33
inc eax
mov dword [ebp - 8], eax
call fcn.004f36b0
dec eax
push eax
push dword [ebp - 4]
push edi
call fcn.004f3820
add esp, 0x10
jmp 0x550e3c
push edi
call fcn.004f3800
add esp, 8
push dword [ebp - 4]
mov dword [ebp - 0xc], eax
call fcn.004f36b0
add esp, 4
cmp dword [ebp - 8], eax
jne 0x550e5f
xor eax, eax
mov ecx, 1
cmp dword [ebp - 0xc], eax
cmove eax, ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x550e6f
push eax
call fcn.004f3570
add esp, 4
test ebx, ebx
je 0x550e7c
pop edi
mov eax, ebx
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x550e9d
cmp dword [ebp - 0x10], 0
je 0x550e9d
push esi
push edi
call fcn.004f3800
add esp, 8
test eax, eax
jne 0x550e9d
mov eax, dword [ebp + 0xc]
mov dword [eax], 1
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x557100
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push dword [ebp + 8]
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x557123
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
test al, 0x10
jne 0x55712d
mov dword [esi], 1
xor eax, eax
pop esi
pop ebp
ret

Function at 0x557140
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push dword [ebp + 8]
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x557163
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
test al, 0x10
je 0x55716d
mov dword [esi], 1
xor eax, eax
pop esi
pop ebp
ret

Function at 0x557180
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push dword [ebp + 8]
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x5571a3
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
and eax, 0x410
cmp eax, 0x10
jne 0x5571b3
mov dword [esi], 1
xor eax, eax
pop esi
pop ebp
ret

Function at 0x5571c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
push dword [ebp + 8]
mov dword [edi], esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x5571ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
call fcn.004f1a60
add esp, 4
pop edi
pop esi
pop ebp
ret
test eax, 0x4000
je 0x5571fc
mov dword [edi], 1
push esi
call fcn.004f1a60
add esp, 4
pop edi
pop esi
pop ebp
ret

Function at 0x557210
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push dword [ebp + 8]
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x557236
mov dword [esi], 1
xor eax, eax
pop esi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x557246
cmp eax, 3
jne 0x557248
xor eax, eax
pop esi
pop ebp
ret
Function at 0x5579d0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
push 0x61747551
push 0x64
mov dword [ebp - 4], esi
mov dword [edi], esi
call fcn.004f3590
add esp, 8
mov dword [edi], eax
test eax, eax
jne 0x5579fe
lea esi, [eax + 0xc]
jmp 0x557ade
lea eax, [ebp - 4]
push eax
call fcn.00550b20
add esp, 4
push 0x32
push dword [edi]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
jne 0x557a2e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004f1a60
mov esi, eax
jmp 0x557ad7
mov ecx, dword [ebp + 8]
push 0x62747551
push ecx
call fcn.004f36e0
add esp, 4
add eax, 4
push eax
call fcn.004f3590
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x557a59
lea esi, [eax + 0xc]
jmp 0x557ade
mov eax, dword [ebp + 8]
push eax
push eax
call fcn.004f36e0
add esp, 4
add eax, 4
push eax
push ebx
call fcn.004f3880
push dword [ebp + 8]
call fcn.004f36b0
mov ecx, dword [ebp + 8]
add esp, 0x10
cmp word [ecx + eax*2 - 2], 0x5c
je 0x557ab1
push 0x6ce50c
call fcn.004f36b0
add esp, 4
push eax
push 0x6ce50c
push dword [ebp + 8]
call fcn.004f36e0
add esp, 4
add eax, 4
push eax
push ebx
call fcn.004f3920
add esp, 0x10
push 0x32
push dword [edi]
push ebx
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
jne 0x557ad1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004f1a60
add esp, 4
mov esi, eax
push ebx
call fcn.004f3570
add esp, 4
test esi, esi
je 0x557af3
mov eax, dword [edi]
test eax, eax
je 0x557aed
push eax
call fcn.004f3570
add esp, 4
mov dword [edi], 0
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x557b00
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x906648]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x214]
push esi
push edi
mov edi, dword [ebp + 0xc]
push eax
push ebx
mov dword [ebp - 0x220], edi
call fcn.005c85b0
mov esi, eax
add esp, 8
test esi, esi
jne 0x557d2e
test byte [ebp - 0xc], 0x10
je 0x557b5f
push edi
push ebx
call fcn.00557d50
add esp, 8
mov esi, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0063c972
mov esp, ebp
pop ebp
ret
test ebx, ebx
jne 0x557b79
pop edi
pop esi
mov eax, 0x3ea
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0063c972
mov esp, ebp
pop ebp
ret
push 0x61747551
xor esi, esi
push 0x64
mov dword [ebp - 0x21c], esi
call fcn.004f3590
mov edi, eax
add esp, 8
test edi, edi
jne 0x557bae
mov esi, 0xc
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0063c972
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x21c]
push eax
call fcn.00550b20
add esp, 4
push 0x32
push edi
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
jne 0x557be3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004f1a60
mov esi, eax
jmp 0x557c91
push 0x62747551
push ebx
call fcn.004f36e0
add esp, 4
add eax, 4
push eax
call fcn.004f3590
add esp, 8
mov dword [ebp - 0x218], eax
test eax, eax
je 0x557cec
push ebx
push ebx
call fcn.004f36e0
add esp, 4
add eax, 4
push eax
push dword [ebp - 0x218]
call fcn.004f3880
push ebx
call fcn.004f36b0
add esp, 0x10
cmp word [ebx + eax*2 - 2], 0x5c
je 0x557c66
push 0x6ce50c
call fcn.004f36b0
add esp, 4
push eax
push 0x6ce50c
push ebx
call fcn.004f36e0
mov ebx, dword [ebp - 0x218]
add esp, 4
add eax, 4
push eax
push ebx
call fcn.004f3920
add esp, 0x10
jmp 0x557c6c
mov ebx, dword [ebp - 0x218]
push 0x32
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
jne 0x557c8b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004f1a60
add esp, 4
mov esi, eax
push ebx
call fcn.004f3570
add esp, 4
test esi, esi
jne 0x557d25
push edi
call fcn.004f36b0
mov ebx, eax
add esp, 4
cmp word [edi + ebx*2 - 2], 0x5c
jne 0x557cb7
xor eax, eax
mov word [edi + ebx*2 - 2], ax
dec ebx
cmp ebx, 4
jb 0x557cd3
mov edx, 4
mov ecx, edi
mov ax, word [ecx + 8]
lea ecx, [ecx + 2]
inc edx
mov word [ecx - 2], ax
cmp edx, ebx
jbe 0x557cc3
push 0x208
call fcn.004f3510
mov ebx, dword [ebp - 0x220]
add esp, 4
mov dword [ebx], eax
test eax, eax
jne 0x557cf3
mov esi, 0xc
jmp 0x557d25
push 0x104
push eax
push edi
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jne 0x557d25
push dword [ebx]
call fcn.004f3570
add esp, 4
mov dword [ebx], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004f1a60
add esp, 4
mov esi, eax
push edi
call fcn.004f3570
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0063c972
mov esp, ebp
pop ebp
ret
Function at 0x5583a0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x906648]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x28]
push eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
jne 0x5583f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004f1a60
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0063c972
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
xor eax, eax
or eax, dword [ebp - 8]
mov dword [esi], eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x24]
mov dword [esi + 4], ecx
mov esi, dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
push eax
call esi
test eax, eax
je 0x5583d9
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push ebx
call fcn.00558310
add esp, 0xc
test eax, eax
jne 0x5584fa
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x14]
push eax
call esi
test eax, eax
je 0x5583d9
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push dword [ebp - 0x38]
call fcn.00558310
add esp, 0xc
test eax, eax
jne 0x5584fa
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x1c]
push eax
call esi
test eax, eax
je 0x5583d9
push 0x66747551
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push edi
call fcn.00550770
add esp, 0xc
test eax, eax
jne 0x5584fa
push 0x104
push eax
lea eax, [ebp - 0x3c]
push eax
push 0
push 0
push 0x104
push 0
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test dword [ebp - 0x3c], 0x80000
jne 0x5584e8
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push dword [ebp - 0x40]
call fcn.00558310
mov esi, eax
add esp, 0xc
test esi, esi
je 0x5584e8
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x5584d5
push ecx
call fcn.004f3570
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0063c972
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x5584f8
push eax
call fcn.004f3570
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0063c972
mov esp, ebp
pop ebp
ret
Function at 0x559840
Capabilities:
Get common file path

Disassembly:
push edi
push 0x208
call fcn.004f3510
mov edi, eax
add esp, 4
test edi, edi
jne 0x559859
lea eax, [edi + 0xc]
pop edi
ret
push 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x55987b
push edi
call fcn.004f3570
push 0
call fcn.004f1a60
add esp, 8
pop edi
ret
push ebx
push esi
push edi
call fcn.004f36e0
push str.Prefetch
mov esi, eax
call fcn.004f36e0
lea ebx, [eax + 4]
add ebx, esi
push ebx
call fcn.004f3510
add esp, 0xc
mov esi, eax
push edi
test esi, esi
jne 0x5598b3
call fcn.004f3570
add esp, 4
lea eax, [esi + 0xc]
pop esi
pop ebx
pop edi
ret
call fcn.004f36b0
add esp, 4
cmp word [edi + eax*2 - 2], 0x5c
jne 0x5598ca
xor ecx, ecx
mov word [edi + eax*2 - 2], cx
push edi
push str._sPrefetch
push ebx
push esi
call fcn.004f3b60
push edi
call fcn.004f3570
push esi
call fcn.005069c0
push esi
call fcn.004f3570
add esp, 0x1c
xor eax, eax
pop esi
pop ebx
pop edi
ret

Function at 0x559900
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push dword [ebp + 8]
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x559923
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, 0x400
je 0x559930
mov dword [esi], 1
xor eax, eax
pop esi
pop ebp
ret
Function at 0x55bd10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x55bde9
push ebx
push edi
push dword [esi + 0x210]
call fcn.0055bd10
mov ebx, dword [esi + 0x208]
add esp, 4
push ebx
push 1
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x55bd85
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
call fcn.004f1a60
add esp, 4
test byte [0x9538a8], 1
je 0x55bdd9
push edi
push ebx
push str.Failed_to_open_handle_of_process_id__d.__err___d._n
push 0x57
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_solidifier_utl_utl_proc.c
push str._utl_kill_process
push dword [0x7d0f40]
push 1
call fcn.004f21c0
add esp, 0x20
jmp 0x55bdd9
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x55bdd2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov dword [ebp + 8], eax
call fcn.004f1a60
add esp, 4
test byte [0x9538a8], 1
je 0x55bdd2
push dword [ebp + 8]
push ebx
push str.Failed_to_terminate_process_id__d._err___d._n
push 0x60
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_solidifier_utl_utl_proc.c
push str._utl_kill_process
push dword [0x7d0f40]
push 1
call fcn.004f21c0
add esp, 0x20
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esi + 0x214]
test esi, esi
jne 0x55bd21
pop edi
pop ebx
pop esi
pop ebp
ret
Function at 0x56a710
Capabilities:
Initialize winhttp library

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
push 0
push 0
push 0
push str.Solidcore_Service
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov dword [0x9111c4], eax
test eax, eax
jne 0x56a775
call dword [sym.imp.KERNEL32.dll_GetLastError]
test byte [0x9538a8], 1
mov esi, eax
je 0x56a767
push esi
push str.WinHttpOpen_failed__Err:__d
push 0x335
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_solidifier_gti_gti_http.c
push str.gti_winhttp_open
push dword [0x7d18d4]
push 1
call fcn.004f21c0
add esp, 0x1c
push esi
call fcn.004f1a60
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret
push 4
lea ecx, [ebp - 4]
mov dword [ebp - 4], 0xaa0
push ecx
push 0x54
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
test eax, eax
jne 0x56a7ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
test byte [0x9538a8], 1
mov esi, eax
je 0x56a767
push esi
push str.Unable_to_set_TLS1.2_protocol__Err:__d
push 0x345
jmp 0x56a74d
push 0
push 0
push 0
push 0
push dword [0x9111c4]
call dword [sym.imp.WINHTTP.dll_WinHttpSetTimeouts]
test eax, eax
jne 0x56a7e6
call dword [sym.imp.KERNEL32.dll_GetLastError]
test byte [0x9538a8], 1
mov esi, eax
je 0x56a767
push esi
push str.WinHttpSetTimeouts_failed__err:__d
push 0x354
jmp 0x56a74d
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x56a9a0
Capabilities:
Prepare http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x9111c4]
push esi
xor esi, esi
mov dword [ebp - 4], esi
test eax, eax
jne 0x56a9ca
test byte [0x9538a8], 1
je 0x56a9fe
push str.GTI:_Winhttp_session_not_connected__couldnt_resolve_gti_server_name
push 0x2e9
jmp 0x56a9e4
mov ecx, dword [ebp + 8]
test ecx, ecx
jne 0x56aa06
test byte [0x9538a8], 1
je 0x56a9fe
push str.GTI:_invalid_gti_host_name__couldnt_resolve_gti_server_name
push 0x2ef
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_solidifier_gti_gti_http.c
push str.gti_resolve_server_name
push dword [0x7d18d4]
push 1
call fcn.004f21c0
add esp, 0x18
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0x1bb
push ecx
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov dword [ebp - 8], eax
test eax, eax
jne 0x56aa41
call dword [sym.imp.KERNEL32.dll_GetLastError]
test byte [0x9538a8], 1
mov esi, eax
je 0x56ab0d
push esi
push str.GTI:_WinHttpConnect_failed__err:__d
push 0x2fa
jmp 0x56aaf3
push 0x800000
push 0
push 0
push 0
push 0x700e20
push 0x700e28
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov dword [ebp - 4], eax
test eax, eax
jne 0x56aa86
call dword [sym.imp.KERNEL32.dll_GetLastError]
test byte [0x9538a8], 1
mov esi, eax
je 0x56ab0d
push esi
push str.GTI:_WinHttpOpenRequest_failed__err:__d
push 0x306
jmp 0x56aaf3
push 0
push 0
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
jne 0x56ab18
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x2ee2
jne 0x56aadf
test byte [0x9538a8], 1
je 0x56ab0d
push eax
push 2
push str.GTI:_Request_to_get_reputation_from_GTI_timed_out__response_not_received_in__d_sec__err:__d
push 0x314
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_solidifier_gti_gti_http.c
push str.gti_resolve_server_name
push dword [0x7d18d4]
push 1
call fcn.004f21c0
add esp, 0x20
jmp 0x56ab0d
test byte [0x9538a8], 1
je 0x56ab0d
push esi
push str.GTI:_WinHttpSendRequest_failed__err:__d
push 0x317
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_solidifier_gti_gti_http.c
push str.gti_resolve_server_name
push dword [0x7d18d4]
push 1
call fcn.004f21c0
add esp, 0x1c
push esi
call fcn.004f1a60
add esp, 4
mov esi, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
call fcn.0056b400
add esp, 8
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret