joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100753a5
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1007e330]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.100660d2
mov dword [ebp - 0x14], eax
cmp dword [0x1066ac14], esi
jne 0x10075498
push 0x800
push esi
push 0x100077ac
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10075425
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10075578
push esi
push esi
push 0x100077ac
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10075578
push 0x100077c4
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10075578
push eax
call ebx
push 0x100077d0
push edi
mov dword [0x1066ac14], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x100077e0
push edi
mov dword [0x1066ac18], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x100077f4
push edi
mov dword [0x1066ac1c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1066ac24], eax
test eax, eax
je 0x10075495
push 0x10007810
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1066ac20], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x100754bd
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x100754b0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x100754d2
push 4
pop eax
jmp 0x1007557a
cmp dword [ebp - 0x14], esi
je 0x100754d2
push dword [0x1066ac14]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x100754b7
mov eax, dword [0x1066ac20]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10075530
cmp dword [0x1066ac24], edi
je 0x10075530
push eax
call ebx
push dword [0x1066ac24]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10075530
test eax, eax
je 0x10075530
call ecx
test eax, eax
je 0x10075525
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10075525
test byte [ebp - 8], 1
jne 0x10075530
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10075560
mov eax, dword [0x1066ac18]
cmp eax, edi
je 0x1007555d
push eax
call ebx
test eax, eax
je 0x1007555d
call eax
mov esi, eax
test esi, esi
je 0x1007555d
mov eax, dword [0x1066ac1c]
cmp eax, edi
je 0x1007555d
push eax
call ebx
test eax, eax
je 0x1007555d
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x1066ac14]
call ebx
test eax, eax
je 0x10075578
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1007557a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call main
mov esp, ebp
pop ebp
ret
Function at 0x433000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x170732e3
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x7ab058e1
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x403d50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x50]
mov ebp, dword [esp + 0x44]
mov edi, dword [esp + 0x54]
mov ebx, dword [esp + 0x48]
mov esi, esp
mov dword [esp], 1
add ecx, eax
mov dword [esp + 4], eax
lea eax, [esp + 0x24]
mov dword [esp + 8], ecx
mov word [esp + 0xc], 0
push esi
push eax
call fcn.00406a70
add esp, 8
mov eax, dword [esp + 0x58]
mov dword [esp], 1
mov dword [esp + 4], edi
add eax, edi
mov dword [esp + 8], eax
mov word [esp + 0xc], 0
lea eax, [esp + 0x18]
push esi
push eax
call fcn.00406a70
add esp, 8
mov edi, dword [esp + 0x24]
mov ecx, ebx
mov edx, edi
call fcn.00403930
test eax, eax
je 0x403e54
mov ebp, dword [esp + 0x18]
mov ebx, edx
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], 0
mov dword [esp], 0
push ebp
call fcn.00403fc0
add esp, 4
lea ecx, [esp + 0x14]
lea edx, [esp + 0x10]
push ecx
push edx
push esi
push 0
push eax
push ebx
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
je 0x403e6d
push eax
call fcn.0040d250
add esp, 4
push eax
call fcn.0040cfd0
add esp, 4
mov esi, dword [esp + 0x44]
test edx, edx
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov byte [esp], 1
mov byte [esi], 0
je 0x403e47
lea eax, [esp + 8]
push eax
call fcn.0040ce40
add esp, 4
push ebx
call dword [sym.imp.advapi32.dll_RegCloseKey]
test eax, eax
jne 0x403e86
jmp 0x403eb8
mov eax, dword [esp + 0x1c]
mov esi, ebp
mov byte [ebp], 0
test eax, eax
je 0x403ece
add eax, eax
push 2
push eax
push dword [esp + 0x20]
jmp 0x403ec6
mov esi, dword [esp + 0x44]
mov eax, dword [esp + 0x10]
mov dword [esi + 1], eax
mov byte [esi], 1
push ebx
call dword [sym.imp.advapi32.dll_RegCloseKey]
test eax, eax
je 0x403eb8
push eax
call fcn.0040d250
add esp, 4
push eax
call fcn.0040cfd0
add esp, 4
test edx, edx
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov dword [esp], 1
je 0x403eb8
lea eax, [esp + 8]
push eax
call fcn.0040ce40
add esp, 4
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x403ece
add eax, eax
push 2
push eax
push ebp
call fcn.00402ca0
add esp, 0xc
mov eax, dword [esp + 0x28]
test eax, eax
je 0x403ee4
add eax, eax
push 2
push eax
push edi
call fcn.00402ca0
add esp, 0xc
mov eax, esi
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4056f0
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
movzx ebx, byte [ebp + 0x10]
mov esi, dword [ebp + 8]
cmp byte [ebp + 0xc], 0
je 0x405771
xorps xmm0, xmm0
lea eax, [esp + 0x10]
movaps xmmword [esp + 0x10], xmm0
movaps xmmword [esp + 0x40], xmm0
movaps xmmword [esp + 0x30], xmm0
movaps xmmword [esp + 0x20], xmm0
mov dword [esp + 0x10], 0x40
push eax
call dword [sym.imp.kernel32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x405742
movups xmm0, xmmword [esp + 0x18]
movups xmmword [esi + 0x20], xmm0
jmp 0x405771
call fcn.0040cfb0
movups xmm0, xmmword [esp + 0x18]
test edx, edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 4], 1
movups xmmword [esi + 0x20], xmm0
je 0x405771
lea eax, [esp + 0xc]
push eax
call fcn.0040ce40
add esp, 4
test bl, bl
je 0x4057e2
xorps xmm0, xmm0
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
lea eax, [esp + 0x10]
movaps xmmword [esp + 0x30], xmm0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
push 0x38
push eax
call dword [sym.imp.kernel32.dll_K32GetPerformanceInfo]
test eax, eax
je 0x4057e2
mov edi, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x38]
xor ecx, ecx
mov edx, 0
sub eax, edi
sbb edx, edx
cmovb eax, ecx
mul ebx
mov dword [esi + 0x30], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 0x34], edx
mov edx, 0
sub eax, edi
sbb edx, edx
cmovb eax, ecx
mul ebx
mov dword [esi + 0x3c], edx
mov dword [esi + 0x38], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x405c70
Capabilities:
Get hostname

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov dword [esp + 8], 0
call fcn.0040cd60
lea ebx, [esp + 8]
push ebx
push eax
push 5
call dword [sym.imp.kernel32.dll_GetComputerNameExW]
test eax, eax
mov dword [esp + 4], eax
je 0x405c9e
xor eax, eax
jmp 0x405cb3
call fcn.0040cfb0
mov dword [esp + 0x1c], eax
mov eax, 1
mov dword [esp], edx
mov dword [esp + 0x20], edx
mov edi, dword [esp + 8]
mov ebp, 2
mov dword [esp + 0x18], eax
test edi, edi
je 0x405cf2
cmp edi, 0x3fffffff
ja 0x405df7
lea esi, [edi + edi]
test esi, esi
js 0x405df7
je 0x405cf2
push 2
push esi
call fcn.00402ce0
add esp, 8
mov ebp, eax
test eax, eax
je 0x405dfe
mov esi, dword [esp + 0x38]
push ebp
call fcn.00403fc0
add esp, 4
push ebx
push eax
push 5
call dword [sym.imp.kernel32.dll_GetComputerNameExW]
test eax, eax
je 0x405d32
test edi, edi
je 0x405d8c
lea ecx, [edi + edi]
xor eax, eax
nop word cs:[eax + eax]
cmp word [ebp + eax*2], 0
je 0x405d8e
inc eax
add ecx, 0xfffffffe
jne 0x405d20
mov eax, edi
jmp 0x405d8e
call fcn.0040cfb0
test edx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], 1
je 0x405d58
lea eax, [esp + 0x14]
push eax
call fcn.0040ce40
add esp, 4
test edi, edi
je 0x405d6a
add edi, edi
push 2
push edi
push ebp
call fcn.00402ca0
add esp, 0xc
cmp dword [esp + 4], 0
jne 0x405d84
cmp dword [esp], 0
je 0x405d84
lea eax, [esp + 0x20]
push eax
call fcn.0040ce40
add esp, 4
mov dword [esi], 0
jmp 0x405de1
xor eax, eax
lea ecx, [esp + 0xc]
push eax
push ebp
push ecx
call fcn.00435d60
add esp, 0xc
cmp dword [esp + 0xc], 0
je 0x405deb
mov eax, dword [esp + 0x14]
movsd xmm0, qword [esp + 0xc]
mov dword [esi + 8], eax
movsd qword [esi], xmm0
test edi, edi
je 0x405dc7
add edi, edi
push 2
push edi
push ebp
call fcn.00402ca0
add esp, 0xc
cmp dword [esp + 4], 0
jne 0x405de1
cmp dword [esp], 0
je 0x405de1
lea eax, [esp + 0x20]
push eax
call fcn.0040ce40
add esp, 4
mov eax, esi
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esi], 0
test edi, edi
jne 0x405db9
jmp 0x405dc7
call fcn.00434ef0
ud2
push esi
push 2
call fcn.00442780
add esp, 8
ud2
Function at 0x40b7f0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov esi, ecx
lea eax, [esp + 0x20]
push eax
push edx
call dword [sym.imp.shell32.dll_CommandLineToArgvW]
test eax, eax
mov dword [esp + 0x10], eax
je 0x40b913
mov ebx, dword [esp + 0x20]
mov dword [esp], 4
mov dword [esp + 4], 0
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0
test ebx, ebx
je 0x40b8b8
mov edi, dword [esp + 0x10]
shl ebx, 2
lea ebp, [esp + 0x14]
lea esi, [esp + 0x24]
jmp 0x40b875
mov ecx, dword [esp]
mov edx, dword [esp + 0x2c]
lea eax, [eax + eax*2]
add edi, 4
mov dword [ecx + eax*4 + 8], edx
movsd xmm0, qword [esp + 0x24]
movsd qword [ecx + eax*4], xmm0
inc dword [esp + 8]
add ebx, 0xfffffffc
je 0x40b8b8
push edi
call fcn.0040ce10
add esp, 4
lea ecx, [eax + edx*2]
mov word [esp + 0x14], 0
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
push ebp
push esi
call fcn.00403630
add esp, 8
mov eax, dword [esp + 8]
cmp eax, dword [esp + 4]
jne 0x40b850
push eax
lea eax, [esp + 4]
push eax
call fcn.004063f0
add esp, 8
mov eax, dword [esp + 8]
jmp 0x40b850
push dword [esp + 0x10]
call dword [sym.imp.kernel32.dll_LocalFree]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x24]
push eax
call fcn.0040cd80
add esp, 4
test al, al
je 0x40b929
call fcn.0040cfb0
mov dword [esp + 0x18], eax
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
movsd xmm0, qword [esp]
test edx, edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], 1
mov dword [ecx + 8], eax
movsd qword [ecx], xmm0
je 0x40b93d
lea eax, [esp + 0x1c]
push eax
call fcn.0040ce40
add esp, 4
jmp 0x40b93d
mov dword [esi], 4
mov dword [esi + 4], 0
mov dword [esi + 8], 0
jmp 0x40b93d
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
movsd xmm0, qword [esp]
mov dword [ecx + 8], eax
movsd qword [ecx], xmm0
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40bd50
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x40bd75
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x40bd8a
cmp dword [eax + 4], 0
je 0x40bd8a
add eax, 8
pop esi
pop edi
ret
push edi
call fcn.00442130
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jae 0x40bd69
mov eax, dword [edi]
test eax, eax
je 0x40bdff
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x40be14
mov esi, eax
test eax, eax
jne 0x40bdd4
movzx eax, byte [0x529189]
push 4
push 0xc
call fcn.00402c90
add esp, 8
test eax, eax
je 0x40be24
mov dword [eax], edi
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [edi]
test eax, eax
je 0x40be19
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40bded
mov ecx, dword [eax]
mov dword [eax], 0
test ecx, ecx
je 0x40bdef
mov ecx, dword [eax + 4]
jmp 0x40bdef
xor ecx, ecx
lea eax, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], ecx
pop esi
pop edi
ret
push edi
call fcn.00442130
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x40bd9d
xor eax, eax
pop esi
pop edi
ret
push edi
call fcn.00442130
add esp, 4
jmp 0x40bdcc
push 0xc
push 4
call fcn.00442780
add esp, 8
ud2

Function at 0x40f020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push edi
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi]
mov edi, dword [esi + 0x40]
xor edi, eax
push dword [esp + 0x14]
push dword [esp + 0x14]
push esi
call fcn.004100e0
add esp, 0xc
mfence
nop word cs:[eax + eax]
nop dword [eax + eax]
mov eax, dword [esi + 0xbc]
test eax, 0x10000
jne 0x40f079
lea ecx, [eax + 0x10000]
lock cmpxchg dword [esi + 0xbc], ecx
jne 0x40f050
mov eax, ecx
and eax, 0xff
jne 0x40f084
pop esi
pop edi
ret
mov ecx, eax
mov eax, ecx
and eax, 0xff
je 0x40f076
cmp edi, 1
ja 0x40f090
movzx ecx, ch
cmp ecx, eax
jne 0x40f076
add esi, 0xb0
push 1
push esi
call fcn.004408d0
add esp, 8
pop esi
pop edi
ret
Function at 0x40fb20
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push ebx
push edi
push esi
mov edi, dword [esp + 0x14]
mov eax, dword [edi]
test eax, eax
je 0x40fb49
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x40fb5e
cmp dword [eax + 4], 0
je 0x40fb5e
add eax, 8
jmp 0x40fc1c
push edi
call fcn.00442130
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jae 0x40fb3b
mov eax, dword [edi]
test eax, eax
je 0x40fc01
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x40fc1a
mov esi, eax
test eax, eax
jne 0x40fbb4
movzx eax, byte [0x529189]
push 4
push 0x14
call fcn.00402c90
add esp, 8
test eax, eax
je 0x40fc2c
mov dword [eax], edi
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [edi]
test eax, eax
je 0x40fc21
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x40fbdd
mov ecx, dword [eax]
mov dword [eax], 0
cmp ecx, 1
jne 0x40fbdd
mov ebp, dword [eax + 4]
movzx edx, byte [eax + 8]
movzx ebx, byte [eax + 9]
movzx edi, word [eax + 0xa]
mov ecx, dword [eax + 0xc]
jmp 0x40fbe5
xor ecx, ecx
xor ebx, ebx
xor edx, edx
xor ebp, ebp
lea eax, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], ebp
mov byte [esi + 0xc], dl
mov byte [esi + 0xd], bl
mov word [esi + 0xe], di
mov dword [esi + 0x10], ecx
jmp 0x40fc1c
push edi
call fcn.00442130
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x40fb79
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
push edi
call fcn.00442130
add esp, 4
jmp 0x40fbac
push 0x14
push 4
call fcn.00442780
add esp, 8
ud2

Function at 0x410e60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x410e85
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x410e9a
cmp dword [eax + 4], 0
je 0x410e9a
add eax, 8
pop esi
pop edi
ret
push edi
call fcn.00442130
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jae 0x410e79
mov eax, dword [edi]
test eax, eax
je 0x410ef7
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x410f0c
mov esi, eax
test eax, eax
jne 0x410ee4
movzx eax, byte [0x529189]
push 4
push 0xc
call fcn.00402c90
add esp, 8
test eax, eax
je 0x410f1c
mov dword [eax], edi
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [edi]
test eax, eax
je 0x410f11
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
add esi, 4
push dword [esp + 0x10]
push esi
call fcn.004114a0
add esp, 8
pop esi
pop edi
ret
push edi
call fcn.00442130
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x410ead
xor eax, eax
pop esi
pop edi
ret
push edi
call fcn.00442130
add esp, 4
jmp 0x410edc
push 0xc
push 4
call fcn.00442780
add esp, 8
ud2
Function at 0x419370
Capabilities:
Get system information on windows

Disassembly:
push esi
sub esp, 0x24
mov esi, dword [esp + 0x2c]
xorps xmm0, xmm0
mov eax, esp
mov dword [esp + 0x20], 0
movups xmmword [esp + 0x10], xmm0
movups xmmword [esp], xmm0
push eax
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4193aa
mov dword [esi + 4], eax
mov byte [esi], 4
mov eax, esi
add esp, 0x24
pop esi
ret
mov byte [esi], 2
mov dword [esi + 4], 0x51e1ac
mov eax, esi
add esp, 0x24
pop esi
ret

Function at 0x4193c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x43c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x42de10
mov esi, 0x200
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x2c], 0
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov dword [ebp - 0x38], 2
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
cmp esi, 0x201
jae 0x419450
jmp 0x41943e
jbe 0x4194e4
cmp esi, 0x201
jae 0x419450
mov dword [ebp - 0x28], 0x200
lea ebx, [ebp - 0x448]
mov edi, esi
jmp 0x41948b
mov edi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
sub esi, edi
sub eax, edi
cmp eax, esi
jae 0x41947c
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x38]
mov edx, edi
push esi
call fcn.00441c90
add esp, 4
mov eax, dword [ebp - 0x38]
mov edi, dword [ebp - 0x34]
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], edi
push 0
call dword [sym.imp.kernel32.dll_SetLastError]
push ebx
push edi
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov esi, eax
test eax, eax
jne 0x4194af
call dword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x419547
cmp esi, edi
jne 0x419430
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x419563
lea esi, [edi + edi]
test edi, edi
mov eax, 0xffffffff
cmovs esi, eax
cmp esi, 0x201
jb 0x41943e
jmp 0x419450
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], 0
cmp esi, eax
ja 0x419580
lea eax, [ebp - 0x48]
push esi
push ebx
push eax
call fcn.0041b8f0
add esp, 0xc
movsd xmm0, qword [ebp - 0x48]
mov esi, dword [ebp + 8]
movsd xmm1, qword [ebp - 0x40]
movsd qword [esi + 8], xmm1
movsd qword [esi], xmm0
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x419531
add eax, eax
push 2
push eax
push dword [ebp - 0x24]
call fcn.00402ca0
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x43c
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, dword [ebp + 8]
mov byte [esi], 0
mov dword [esi + 4], eax
mov byte [esi + 0xc], 2
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x419521
jmp 0x419531
mov dword [ebp - 0x10], 0
push 0x51e2f8
push 0x28
push 0x51c258
call fcn.00442910
add esp, 0xc
jmp 0x41958f
push 0x51e2e8
push eax
push esi
call fcn.00442ca0
add esp, 0xc
ud2
Function at 0x41f0b0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x103c
call fcn.0043afb0
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x42df90
mov edi, ecx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x28], edx
lea esi, [ebp - 0x1048]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
push 0x1000
push 0
push esi
call fcn.0043d590
add esp, 0xc
xorps xmm0, xmm0
lea ebx, [ebp - 0x48]
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0
movups xmmword [ebp - 0x48], xmm0
mov dword [ebp - 0x38], eax
push 0x425990
push ebx
push 0x1000
push esi
push edi
call dword [sym.imp.kernel32.dll_ReadFileEx]
test eax, eax
je 0x41f204
mov esi, dword [sym.imp.kernel32.dll_SleepEx]
mov dword [ebp - 0x20], edi
push 1
push 0xffffffffffffffff
call esi
cmp dword [ebp - 0x34], 0
je 0x41f13a
cmp dword [ebp - 0x30], 0
jne 0x41f215
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x41f215
cmp eax, 0x1000
mov dword [ebp - 0x24], eax
ja 0x41f251
xor edi, edi
nop dword [eax + eax]
sub eax, edi
jb 0x41f237
xorps xmm0, xmm0
lea edx, [ebp - 0x34]
lea ecx, [ebp + edi - 0x1048]
mov dword [ebp - 0x34], 0
movups xmmword [ebp - 0x48], xmm0
mov dword [ebp - 0x38], edx
push 0x425990
push ebx
push eax
push ecx
push dword [ebp - 0x28]
call dword [sym.imp.kernel32.dll_WriteFileEx]
test eax, eax
je 0x41f20c
nop dword [eax + eax]
push 1
push 0xffffffffffffffff
call esi
cmp dword [ebp - 0x34], 0
je 0x41f1b0
cmp dword [ebp - 0x30], 0
jne 0x41f212
add edi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
cmp edi, eax
jne 0x41f170
xorps xmm0, xmm0
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0
movups xmmword [ebp - 0x48], xmm0
mov dword [ebp - 0x38], eax
push 0x425990
push ebx
push 0x1000
lea eax, [ebp - 0x1048]
push eax
mov edi, dword [ebp - 0x20]
push edi
call dword [sym.imp.kernel32.dll_ReadFileEx]
test eax, eax
jne 0x41f13a
call dword [sym.imp.kernel32.dll_GetLastError]
jmp 0x41f215
call dword [sym.imp.kernel32.dll_GetLastError]
mov edi, dword [ebp - 0x20]
mov esi, dword [sym.imp.kernel32.dll_CloseHandle]
push edi
call esi
push dword [ebp - 0x28]
call esi
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x103c
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
push 0x51dd84
push dword [ebp - 0x24]
push edi
call fcn.00442d10
add esp, 0xc
jmp 0x41f26b
mov dword [ebp - 0x10], 0
push 0x51dd84
push 0x1000
push eax
call fcn.00442ca0
add esp, 0xc
ud2