joyce8/EMBER2024-capa huggingface dataset:
Function at 0x495b54
Capabilities:
Check os version

Disassembly:
push ebx
add esp, 0xffffff6c
xor ebx, ebx
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x495b98
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x10]
dec ecx
je 0x495b96
dec ecx
jne 0x495b98
cmp eax, 5
jne 0x495b8d
test edx, edx
jne 0x495b8d
xor ebx, ebx
jmp 0x495b98
cmp eax, 5
jl 0x495b98
mov bl, 1
jmp 0x495b98
xor ebx, ebx
mov eax, ebx
add esp, 0x94
pop ebx
ret

Function at 0x75bd44
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x75bd44
lcall 0x5de5, 0x8b10c483
jmp loc.0199730c