joyce8/EMBER2024-capa huggingface dataset:
Function at 0x56ec70
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov eax, esi
mov edx, dword [0x55f280]
call fcn.00403d00
test al, al
je 0x56ed94
mov dl, byte [ebx + 4]
mov edi, esi
mov eax, edi
call fcn.0056eda4
mov dl, byte [ebx + 5]
mov eax, edi
call fcn.0056ee8c
mov al, byte [ebx + 6]
mov byte [edi + 6], al
mov dl, byte [ebx + 7]
mov eax, edi
call fcn.0056eec4
mov al, byte [ebx + 8]
mov byte [edi + 8], al
mov dl, byte [ebx + 9]
mov eax, edi
call fcn.0056efa8
mov al, byte [ebx + 0xa]
mov byte [edi + 0xa], al
mov dl, byte [ebx + 0xb]
mov eax, edi
call fcn.0056eed4
mov dl, byte [ebx + 0xe]
mov eax, edi
call fcn.0056ef20
mov dl, byte [ebx + 0x10]
mov eax, edi
call fcn.0056efc4
mov al, byte [ebx + 0xf]
mov byte [edi + 0xf], al
mov dl, byte [ebx + 0x11]
mov eax, edi
call fcn.0056f0bc
mov eax, ebx
call fcn.0056f040
mov edx, eax
mov eax, edi
call fcn.0056f04c
mov dl, byte [ebx + 0x12]
mov eax, edi
call fcn.0056f138
mov dl, byte [ebx + 0x14]
mov eax, edi
call fcn.0056f058
mov eax, ebx
call fcn.0056f088
mov edx, eax
mov eax, edi
call fcn.0056f094
mov dl, byte [ebx + 0x15]
mov eax, edi
call fcn.0056f1c4
mov dl, byte [ebx + 0x16]
mov eax, edi
call fcn.0056f244
mov eax, dword [ebx + 0x18]
mov dword [edi + 0x18], eax
mov al, byte [ebx + 0x1c]
mov byte [edi + 0x1c], al
mov dl, byte [ebx + 0x13]
mov eax, edi
call fcn.0056ee18
mov dl, byte [ebx + 0xc]
mov eax, edi
call fcn.0056eeec
mov dl, byte [ebx + 0xd]
mov eax, edi
call fcn.0056ef04
mov al, byte [ebx + 0x1d]
mov byte [edi + 0x1d], al
mov dl, byte [ebx + 0x17]
mov eax, edi
call fcn.0056f2c4
mov dl, byte [ebx + 0x1e]
mov eax, edi
call fcn.0056f344
mov dl, byte [ebx + 0x1f]
mov eax, edi
call fcn.0056f3c0
mov al, byte [ebx + 0x20]
mov byte [edi + 0x20], al
jmp 0x56ed9d
mov edx, esi
mov eax, ebx
call fcn.0042010c
pop edi
pop esi
pop ebx
ret
Function at 0x576820
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0xb
push 0
push 0
dec ecx
jne 0x576829
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x576a09
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebx + 0x34]
mov eax, esi
call fcn.0055a984
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x30]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x3c]
pop edx
call dword [eax + 4]
mov edx, eax
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 8]
mov dx, word [ebx + 0x44]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov eax, ebx
call fcn.005671b4
mov edx, eax
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push dword [ebx + 0x54]
push dword [ebx + 0x50]
mov eax, esi
call fcn.0055ac14
mov eax, ebx
call fcn.004f2e60
mov edx, eax
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x10]
mov dl, byte [ebx + 0x39]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x38]
mov edi, eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x30]
sub al, 1
je 0x5768e7
add al, 0xf5
sub al, 2
jb 0x5768e7
add al, 0xf7
sub al, 2
jb 0x5768e7
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x30]
and eax, 0x7f
cmp eax, 0x34
jne 0x5769cf
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x38]
test eax, eax
jne 0x5769cf
mov eax, ebx
call fcn.004f2e60
cmp al, 1
je 0x57691f
mov eax, ebx
call fcn.004f2e60
test al, al
jne 0x57699d
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x90]
test al, al
jne 0x57699d
lea edx, [ebp - 0x28]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x90]
lea eax, [ebp - 0x28]
call fcn.00418274
sub ax, 0x2011
jne 0x576959
lea edx, [ebp - 0x38]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x90]
lea eax, [ebp - 0x38]
mov edx, 1
call fcn.00418778
mov edi, eax
inc edi
jmp 0x57699d
lea edx, [ebp - 0x48]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x90]
lea eax, [ebp - 0x48]
call fcn.00418394
test al, al
je 0x57699d
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x90]
lea eax, [ebp - 0x5c]
lea edx, [ebp - 0x4c]
call fcn.004183d0
mov eax, dword [ebp - 0x4c]
call fcn.00404d58
mov edi, eax
test edi, edi
jne 0x57699d
mov edi, 1
test edi, edi
jne 0x5769cf
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x40]
mov eax, dword [eax + 0xc4]
push eax
lea eax, [ebp - 0x18]
call fcn.00411e40
mov ecx, eax
mov edx, 0x28
pop eax
mov ebx, dword [eax]
call dword [ebx + 0x5c]
lea eax, [ebp - 0x18]
call fcn.00412a5c
mov edi, eax
mov edx, edi
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x14]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x576a10
lea eax, [ebp - 0x5c]
call fcn.00411e40
lea eax, [ebp - 0x4c]
call fcn.00404a88
lea eax, [ebp - 0x48]
mov edx, dword [0x401144]
mov ecx, 4
call fcn.00405840
ret
Function at 0x5785e0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x5785e8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5787de
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x24]
mov dl, byte [0x647dd4]
call fcn.00404c70
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call fcn.0040509c
test eax, eax
je 0x5787c3
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov dl, 1
call dword [eax + 0x28]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x1c]
mov dl, byte [0x647dd4]
call fcn.00404c70
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x18], 0
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x1b], 0
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x40], 1
xor eax, eax
push ebp
push 0x5787b1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x20]
call fcn.00404a88
lea eax, [ebp - 0x14]
call fcn.00404a88
mov bl, 1
xor esi, esi
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x30]
test bl, bl
je 0x5786a1
lea eax, [ebp - 0x14]
call fcn.00404a88
mov edx, eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov esi, eax
test esi, esi
je 0x57879b
mov bl, 1
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x1c]
call fcn.00404ea4
jne 0x57878b
mov edx, esi
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x38]
test al, al
je 0x57878b
lea eax, [ebp - 0x14]
call fcn.00404a88
mov edx, eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov esi, eax
cmp esi, 0xffffff99
je 0x5786fd
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call dword [eax + 0x3c]
test al, al
je 0x5786f8
cmp esi, 0xffffff97
je 0x5786fd
cmp esi, 0x64
jl 0x578770
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x14]
call fcn.00404b20
cmp esi, 0xffffff97
jne 0x57873a
lea eax, [ebp - 0x14]
call fcn.00404a88
mov edx, eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov esi, eax
cmp esi, 0xffffff99
je 0x57872b
cmp esi, 0x64
jl 0x578738
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x14]
call fcn.00404d60
jmp 0x57873a
xor ebx, ebx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00578b98
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x578689
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0x28]
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x20]
call fcn.00404d60
jmp 0x578689
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push dword [ebp - 0x14]
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00404e18
jmp 0x578689
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x14]
call fcn.00404d60
jmp 0x578689
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5787b8
mov eax, dword [ebp - 0xc]
call fcn.00403b74
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5787e5
lea eax, [ebp - 0x28]
mov edx, 6
call fcn.00404aac
ret
Function at 0x5866a0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x14], 0x67452301
mov dword [eax + 0x18], 0xefcdab89
mov dword [eax + 0x1c], 0x98badcfe
mov dword [eax + 0x20], 0x10325476
call fcn.00585cdc
pop ebp
ret
Function at 0x587a64
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x14], 0x67452301
mov dword [eax + 0x18], 0xefcdab89
mov dword [eax + 0x1c], 0x98badcfe
mov dword [eax + 0x20], 0x10325476
mov dword [eax + 0x24], 0xc3d2e1f0
call fcn.00586838
pop ebp
ret

Function at 0x587cb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.004064a0
mov eax, dword [ebp - 8]
call fcn.004064a0
xor eax, eax
push ebp
push 0x587d67
push dword fs:[eax]
mov dword fs:[eax], esp
push 8
mov eax, ebx
mov ecx, 1
mov edx, dword [0x4fc9c8]
call fcn.0040631c
add esp, 4
mov eax, dword [ebp - 8]
call fcn.00406160
mov edx, eax
dec edx
test edx, edx
jl 0x587d1d
inc edx
xor eax, eax
mov ecx, dword [ebp - 4]
mov cl, byte [ecx + eax]
mov esi, dword [ebp - 8]
xor cl, byte [esi + eax]
mov esi, dword [ebx]
mov byte [esi + eax], cl
inc eax
dec edx
jne 0x587d08
mov eax, dword [ebp - 8]
call fcn.00406160
push eax
mov eax, dword [ebp - 4]
call fcn.00406160
mov edx, eax
dec edx
pop eax
sub edx, eax
jl 0x587d46
inc edx
mov ecx, dword [ebp - 4]
mov cl, byte [ecx + eax]
mov esi, dword [ebx]
mov byte [esi + eax], cl
inc eax
dec edx
jne 0x587d37
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x587d6e
lea eax, [ebp - 8]
mov edx, dword [0x4fc9c8]
mov ecx, 2
call fcn.00405840
ret
Function at 0x58cd10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebp - 4]
call fcn.004064a0
mov eax, dword [ebp + 0x10]
call fcn.004064a0
xor eax, eax
push ebp
push 0x58cf2e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x585998]
call fcn.00585c9c
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x58ceea
push dword fs:[edx]
mov dword fs:[edx], esp
cmp edi, 0x939
jne 0x58cdc3
push 0x10
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, dword [0x4fc9c8]
call fcn.0040631c
add esp, 4
xor eax, eax
lea edx, [ebx + eax]
mov ecx, dword [ebp - 4]
mov dl, byte [ecx + edx]
lea ecx, [esi + eax]
mov edi, dword [ebp + 0x10]
xor dl, byte [edi + ecx]
mov ecx, dword [ebp - 0xc]
mov byte [ecx + eax], dl
inc eax
cmp eax, 0x10
jne 0x58cd8a
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.005866d4
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
call fcn.00586768
jmp 0x58ced4
cmp edi, 0x1b25
jne 0x58cec6
push 0x18
mov eax, dword [ebp + 8]
mov ecx, 1
mov edx, dword [0x4fc9c8]
call fcn.0040631c
add esp, 4
push 0x18
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, dword [0x4fc9c8]
call fcn.0040631c
add esp, 4
push 0
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, dword [0x4fc9c8]
call fcn.0040631c
add esp, 4
xor eax, eax
lea edx, [ebx + eax]
mov ecx, dword [ebp - 4]
mov dl, byte [ecx + edx]
lea ecx, [esi + eax]
mov edi, dword [ebp + 0x10]
xor dl, byte [edi + ecx]
mov ecx, dword [ebp - 0xc]
mov byte [ecx + eax], dl
inc eax
cmp eax, 0x18
jne 0x58ce19
push 0x10
lea eax, [ebp - 0x14]
push eax
xor ecx, ecx
mov edx, dword [0x4fc9c8]
mov eax, dword [ebp - 0xc]
call fcn.00406348
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.005866d4
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00586768
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
push 0
push 0x10
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [0x4fdb68]
call fcn.004ff5c0
push 8
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x10
mov edx, dword [0x4fc9c8]
mov eax, dword [ebp - 0xc]
call fcn.00406348
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
call fcn.005866d4
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00586768
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
push 0x10
push 8
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [0x4fdb68]
call fcn.004ff5c0
jmp 0x58ced4
mov eax, dword [ebp + 8]
mov edx, dword [0x4fc9c8]
call fcn.0040643c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58cef1
mov eax, dword [ebp - 8]
call fcn.00403b74
ret
Function at 0x58d414
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x118], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x110], ecx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x10c], ecx
mov dword [ebp - 0x108], ecx
test dl, dl
je 0x58d45d
add esp, 0xfffffff0
call fcn.00403ed8
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x58d5de
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, esi
call fcn.00403b44
lea edx, [ebp - 0x108]
mov eax, esi
call fcn.0058d638
mov edx, dword [ebp - 0x108]
lea eax, [esi + 4]
call fcn.00404adc
lea edx, [ebp - 0x10c]
mov eax, esi
call fcn.0058d680
mov edx, dword [ebp - 0x10c]
lea eax, [esi + 8]
call fcn.00404adc
mov dword [ebp - 4], pe_nt_image_headers32
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x104]
push eax
call sub.advapi32.dll_GetUserNameA
lea eax, [esi + 0xc]
lea edx, [ebp - 0x104]
mov ecx, pe_nt_image_headers32
call fcn.00404d08
call sub.kernel32.dll_GetCurrentProcessId
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x110]
call fcn.00409ec4
push dword [ebp - 0x110]
push 0x58d60c
call sub.kernel32.dll_GetCurrentThreadId_1
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x114]
call fcn.00409ec4
push dword [ebp - 0x114]
lea eax, [esi + 0x10]
mov edx, 3
call fcn.00404e18
push pe_nt_image_headers32
lea eax, [ebp - 0x104]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x11c]
lea edx, [ebp - 0x104]
mov ecx, pe_nt_image_headers32
call fcn.00404d08
mov eax, dword [ebp - 0x11c]
lea edx, [ebp - 0x118]
call fcn.0040a7e0
mov edx, dword [ebp - 0x118]
lea eax, [esi + 0x14]
call fcn.00404adc
mov al, byte [0x58d610]
push eax
lea eax, [ebp - 0x120]
push eax
mov eax, dword [esi + 0x14]
mov ecx, 0x58d61c
mov edx, 0x58d628
call fcn.0040f7c8
mov edx, dword [ebp - 0x120]
lea eax, [esi + 0x14]
call fcn.00404adc
mov al, byte [0x58d610]
push eax
lea eax, [ebp - 0x124]
push eax
mov eax, dword [esi + 0x14]
mov ecx, 0x58d61c
mov edx, 0x58d634
call fcn.0040f7c8
mov edx, dword [ebp - 0x124]
lea eax, [esi + 0x14]
call fcn.00404adc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58d5e5
lea eax, [ebp - 0x124]
mov edx, 8
call fcn.00404aac
ret

Function at 0x58d638
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov eax, ebx
call fcn.00404a88
mov dword [ebp - 4], pe_nt_image_headers32
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x58d678
mov eax, ebx
lea edx, [ebp - 0x104]
mov ecx, pe_nt_image_headers32
call fcn.00404d08
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5923bc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
add ebx, 0xfffffffc
mov eax, dword [ebx]
mov eax, dword [eax + 0x10]
cmp dword [eax + 0x14], 0
je 0x59248b
mov eax, dword [ebx]
cmp dword [eax + 0x3c], 0x2328
jl 0x59248b
mov eax, dword [ebx]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax + 0x10]
mov dl, 1
mov eax, dword [0x585460]
call fcn.00593070
mov dword [ebp - 4], eax
push 0x592498
mov eax, dword [ebx]
mov eax, dword [eax + 0x10]
push dword [eax + 0x14]
push 0x5924c8
push 0x5924d8
mov eax, dword [ebp - 4]
add eax, 0x28
mov edx, 4
call fcn.00404e18
mov eax, dword [ebp - 4]
mov word [eax + 0x30], 8
xor eax, eax
push ebp
push 0x592484
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx]
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], eax
push 0
mov ecx, 1
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00596bf4
push eax
mov eax, dword [ebx]
call fcn.00591930
call fcn.0058bb80
mov edx, eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 8]
pop eax
call fcn.0058b43c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59248b
mov eax, dword [ebp - 4]
call fcn.00403b74
ret
pop ebx
pop ecx
pop ebp
ret
Function at 0x5924e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff48
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5926de
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
cmp dword [eax + 0x3c], 0x1fa4
jl 0x5926bd
lea eax, [ebp - 4]
mov edx, 0x5926f4
call fcn.00404b20
xor eax, eax
push ebp
push 0x5925fe
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xb4]
push eax
call sub.kernel32.dll_GetTimeZoneInformation
sub eax, 1
jb 0x59254b
je 0x592553
dec eax
je 0x59255e
jmp 0x592569
mov ebx, dword [ebp - 0xb4]
jmp 0x59257f
mov ebx, dword [ebp - 0xb4]
add ebx, dword [ebp - 0x60]
jmp 0x59257f
mov ebx, dword [ebp - 0xb4]
add ebx, dword [ebp - 0xc]
jmp 0x59257f
mov ecx, 0x592704
mov dl, 1
mov eax, dword [0x40880c]
call fcn.0040e18c
call fcn.00404404
neg ebx
mov eax, ebx
mov ecx, 0x3c
cdq
idiv ecx
mov eax, edx
lea edx, [ebp - 4]
call fcn.00409dd8
mov eax, dword [ebp - 4]
call fcn.00404d58
dec eax
jne 0x5925b0
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, 0x59272c
call fcn.00404da4
mov eax, ebx
mov ecx, 0x3c
cdq
idiv ecx
lea edx, [ebp - 0xb8]
call fcn.00409dd8
push dword [ebp - 0xb8]
push 0x592738
push dword [ebp - 4]
lea eax, [ebp - 4]
mov edx, 3
call fcn.00404e18
test ebx, ebx
jl 0x5925f4
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, 0x592744
call fcn.00404da4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x592615
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax + 0x10]
mov dl, 1
mov eax, dword [0x585460]
call fcn.00593070
mov dword [ebp - 8], eax
push 0x592750
push dword [ebp - 4]
push 0x592778
mov eax, dword [ebp - 8]
add eax, 0x28
mov edx, 3
call fcn.00404e18
mov eax, dword [ebp - 8]
mov word [eax + 0x30], 7
xor eax, eax
push ebp
push 0x5926b6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 8]
mov dword [edx + 0x10], eax
push 0
mov ecx, 1
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.00596bf4
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00591930
call fcn.0058bb80
mov edx, eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 8]
pop eax
call fcn.0058b43c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5926bd
mov eax, dword [ebp - 8]
call fcn.00403b74
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5926e5
lea eax, [ebp - 0xb8]
call fcn.00404a88
lea eax, [ebp - 4]
call fcn.00404a88
ret
Function at 0x599b18
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x599d52
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0050c794
mov esi, dword [eax + 4]
cmp byte [0x647e28], 0
je 0x599bf1
mov eax, dword [ebp - 8]
call fcn.0050c794
mov esi, eax
push esi
push 0x111
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00406160
push eax
mov ecx, dword [esi + 0x14]
mov dl, 1
mov eax, dword [0x58587c]
call fcn.00599f44
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x599bc8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x24]
call fcn.0059a058
mov edx, ebx
mov eax, dword [ebp - 0x24]
call fcn.0059a210
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x599bcf
mov eax, dword [ebp - 4]
mov byte [eax + 0x1c], 0
mov eax, dword [ebp - 0x24]
call fcn.00403b74
ret
mov ecx, esi
mov dl, 1
mov eax, dword [0x585460]
call fcn.00593070
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
mov edx, 0x599d6c
call fcn.00404b20
mov eax, dword [ebp - 0x10]
add eax, 0x28
mov edx, dword [ebp - 0xc]
call fcn.00404adc
mov eax, dword [ebp - 0x10]
mov word [eax + 0x30], 8
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x5850f4]
call fcn.0058faa8
mov edi, eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x20]
mov edx, edi
call fcn.0041f1cc
lea eax, [edi + 0xc]
mov edx, 0x599d9c
call fcn.00404adc
mov eax, dword [ebp - 4]
call fcn.0058fb18
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
call fcn.0050c7ec
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x599d33
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 0x18]
push eax
push 4
mov eax, dword [ebp - 4]
mov ax, word [eax + 0x10]
push eax
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x1c]
mov ecx, ebx
mov eax, dword [ebp - 0x10]
call fcn.00596b70
push eax
mov eax, esi
call fcn.0058bb80
mov edx, eax
mov ecx, ebx
pop eax
call fcn.0058b43c
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x1d]
mov dword [ebp - 0x20], eax
mov eax, esi
call fcn.0058bb80
push eax
push ebx
push 0x20
push 0
lea eax, [ebp - 0x20]
push eax
push 5
mov eax, dword [ebp - 0x1c]
push eax
call fcn.0059accc
add esp, 0x18
mov ecx, ebx
pop edx
call fcn.0058b43c
mov eax, dword [ebp - 8]
call fcn.0050c794
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x10], eax
push 0
mov ecx, 1
mov edx, ebx
mov eax, dword [ebp - 0x10]
call fcn.00596bf4
push eax
mov eax, esi
call fcn.0058bb80
mov edx, eax
mov ecx, ebx
pop eax
call fcn.0058b43c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x599d3a
mov eax, dword [ebp - 4]
mov byte [eax + 0x1c], 0
mov eax, dword [ebp - 0x10]
call fcn.00403b74
out 0xff, al
Function at 0x599f44
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
test dl, dl
je 0x599f56
add esp, 0xfffffff0
call fcn.00403ed8
mov esi, ecx
mov ebx, edx
mov edi, eax
mov eax, dword [ebp + 0x10]
call fcn.004064a0
xor eax, eax
push ebp
push 0x599ff9
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, edi
call fcn.00403b44
mov dword [edi + 4], esi
mov eax, dword [ebp + 0x18]
mov dword [edi + 8], eax
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x24], eax
lea eax, [edi + 0x28]
mov edx, dword [ebp + 0x10]
mov ecx, dword [0x4fc9c8]
call fcn.00406478
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x30], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x14]
mov edx, dword [0x4fc9c8]
call fcn.0040643c
xor eax, eax
mov dword [edi + 0x10], eax
xor eax, eax
mov dword [edi + 0x34], eax
xor eax, eax
mov dword [edi + 0x18], eax
mov byte [edi + 0xd], 0
mov byte [edi + 0xc], 0
mov word [edi + 0xe], 0
xor eax, eax
mov dword [edi + 0x20], eax
mov word [edi + 0x1c], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59a000
lea eax, [ebp + 0x10]
mov edx, dword [0x4fc9c8]
call fcn.0040643c
ret

Function at 0x59fddc
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a88
push 0
push 0
push 0x59fe30
call sub.kernel32.dll_GetEnvironmentVariableA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x59fe29
mov edx, dword [ebp - 8]
dec edx
mov eax, dword [ebp - 4]
call fcn.004050e4
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00404f58
push eax
push 0x59fe30
call sub.kernel32.dll_GetEnvironmentVariableA
pop ecx
pop ecx
pop ebp
ret