joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50ba90
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x60e7a0
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x6e377c]
xor eax, esp
mov dword [esp + 0x4c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6e377c]
xor eax, esp
push eax
lea eax, [esp + 0x64]
mov dword fs:[0], eax
mov eax, dword [esp + 0x74]
mov edi, dword [esp + 0x7c]
mov ebp, dword [esp + 0x80]
mov esi, ecx
mov ecx, dword [esp + 0x78]
xor ebx, ebx
push 0xffffffffffffffff
push ebx
mov dword [esp + 0x1c], ecx
push eax
lea ecx, [esp + 0x50]
mov dword [esp + 0x68], 0xf
mov dword [esp + 0x64], ebx
mov byte [esp + 0x54], bl
call fcn.00403843
lea edx, [esp + 0x44]
push edx
mov dword [esp + 0x70], ebx
call fcn.0050e9d0
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x30]
push ecx
call fcn.0050ba60
add esp, 0xc
cmp dword [esp + 0x40], 0x10
mov eax, dword [esp + 0x2c]
mov byte [esp + 0x6c], 1
jae 0x50bb2e
lea eax, [esp + 0x2c]
mov edx, dword [esp + 0x3c]
add edx, eax
xor ecx, ecx
cmp eax, edx
jae 0x50bb52
lea ebx, [ebx]
movzx ebx, byte [eax]
imul ecx, ecx, 0x1000193
inc eax
xor ecx, ebx
cmp eax, edx
jb 0x50bb40
xor ebx, ebx
mov dword [esp + 0x18], ecx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x24]
push ecx
mov ecx, esi
call fcn.0050b9f0
mov esi, dword [eax + 4]
mov edx, dword [eax]
mov dword [esp + 0x18], edx
cmp esi, ebx
jne 0x50bbb6
mov esi, 0x10
cmp dword [esp + 0x40], esi
jb 0x50bb8c
mov eax, dword [esp + 0x2c]
push eax
call fcn.005b4dd1
add esp, 4
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
cmp dword [esp + 0x5c], esi
jb 0x50bbaf
mov ecx, dword [esp + 0x48]
push ecx
call fcn.005b4dd1
add esp, 4
xor al, al
jmp 0x50bc77
cmp dword [esp + 0x5c], 0x10
mov eax, dword [esp + 0x48]
jae 0x50bbc5
lea eax, [esp + 0x48]
mov edx, dword [esp + 0x58]
push edx
push eax
call fcn.0050e800
mov ecx, eax
mov eax, 0xaaaaaaab
mul ecx
shr edx, 1
lea eax, [edx + edx*2]
mov edx, ecx
sub edx, eax
mov eax, dword [esp + 0x1c]
mov dword [eax], edx
mov edx, dword [esi + 8]
mov dword [edi], edx
mov eax, dword [esi + 0xc]
mov dword [edi + 4], eax
mov edx, dword [esi + 0x10]
mov dword [edi + 8], edx
mov eax, dword [esi + 0x14]
mov dword [edi + 0xc], eax
mov edx, dword [esi + 0x18]
mov dword [ebp], edx
mov eax, dword [esi + 0x1c]
mov dword [ebp + 4], eax
mov edx, dword [esi + 0x20]
mov dword [ebp + 8], edx
mov eax, dword [esi + 0x24]
add esp, 8
mov dword [ebp + 0xc], eax
xor eax, eax
lea esp, [esp]
xor dword [edi + eax*4], ecx
inc eax
cmp eax, 4
jb 0x50bc20
xor eax, eax
jmp 0x50bc30
xor dword [ebp + eax*4], ecx
inc eax
cmp eax, 4
jb 0x50bc30
mov esi, 0x10
cmp dword [esp + 0x40], esi
jb 0x50bc52
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.005b4dd1
add esp, 4
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
cmp dword [esp + 0x5c], esi
jb 0x50bc75
mov edx, dword [esp + 0x48]
push edx
call fcn.005b4dd1
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.005bae23
add esp, 0x5c
ret 0x10
Function at 0x50bca0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push 0xffffffffffffffff
push 0x60e7d8
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x6e377c]
xor eax, esp
mov dword [esp + 0x30], eax
push ebp
push esi
push edi
mov eax, dword [0x6e377c]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
mov eax, dword [esp + 0x54]
mov ebp, dword [esp + 0x58]
mov esi, ecx
mov ecx, dword [esp + 0x5c]
push 0xffffffffffffffff
push 0
mov dword [esp + 0x20], ecx
push eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x48], 0xf
mov dword [esp + 0x44], 0
mov byte [esp + 0x34], 0
call fcn.00403843
lea edx, [esp + 0x24]
push edx
mov dword [esp + 0x50], 0
call fcn.0050e9d0
mov edi, dword [esp + 0x40]
mov eax, dword [esp + 0x2c]
add esp, 4
cmp edi, 0x10
jae 0x50bd30
lea eax, [esp + 0x28]
mov ecx, dword [esp + 0x38]
lea edx, [ecx + eax]
xor ecx, ecx
cmp eax, edx
jae 0x50bd54
lea ecx, [ecx]
movzx ebp, byte [eax]
imul ecx, ecx, 0x1000193
inc eax
xor ecx, ebp
cmp eax, edx
jb 0x50bd40
mov ebp, dword [esp + 0x10]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x20]
mov dword [esp + 0x14], ecx
push eax
lea ecx, [esi + 0x20]
call fcn.0050b9f0
mov esi, dword [eax + 4]
mov ecx, dword [eax]
mov dword [esp + 0x10], ecx
test esi, esi
je 0x50bd8e
mov eax, dword [esi + 0x34]
sub eax, dword [esi + 0x30]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
test eax, eax
jg 0x50bda4
mov dword [ebp], 0
cmp edi, 0x10
jb 0x50bda0
mov edx, dword [esp + 0x28]
push edx
call fcn.005b4dd1
add esp, 4
xor al, al
jmp 0x50bdcf
mov eax, dword [esi + 0x34]
sub eax, dword [esi + 0x30]
jne 0x50bdb5
call fcn.005b544b
mov edi, dword [esp + 0x3c]
mov ecx, dword [esi + 0x30]
mov dword [ebp], ecx
cmp edi, 0x10
jb 0x50bdcd
mov edx, dword [esp + 0x28]
push edx
call fcn.005b4dd1
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.005bae23
add esp, 0x40
ret 0xc
Function at 0x50d170
Capabilities:
Get system information on windows
Print debug messages
Read file via mapping

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x24
push esi
mov esi, ecx
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x130], ecx
test eax, eax
jne 0x50d18e
mov eax, dword [esi + 0x114]
mov edx, eax
add edx, ecx
mov dword [esi + 0x134], eax
cmp edx, dword [esi + 0x114]
jbe 0x50d1a9
xor eax, eax
pop esi
add esp, 0x24
ret 0xc
push ebx
push ebp
push edi
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esi + 0x130]
mov edi, dword [esp + 0x2c]
mov eax, ecx
xor edx, edx
div edi
push 0
imul eax, edi
mov ebx, eax
mov eax, dword [esi + 0x134]
mov edi, ecx
add ecx, eax
push ecx
mov ecx, dword [esi + 0x110]
push 0
push 2
push 0
push ecx
lea ebp, [eax + edx]
sub edi, ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [esi + 0x12c], eax
test eax, eax
jne 0x50d212
push str.CMappedFile::Map__m_hFM_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
add esp, 0x24
ret 0xc
push ebp
push ebx
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0x138], eax
test eax, eax
jne 0x50d249
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CMappedFile::Map__m_lpMapData__lu
call fcn.0050e6f0
add esp, 8
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
add esp, 0x24
ret 0xc
mov edx, dword [esp + 0x38]
add eax, edi
mov dword [esi + 0x13c], eax
mov dword [edx], eax
mov eax, dword [esi + 0x13c]
mov ecx, dword [esi + 0x134]
push eax
push ecx
mov ecx, esi
mov dword [esi + 0x128], 0
call fcn.0050d070
mov eax, dword [esi + 0x134]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x24
ret 0xc

Function at 0x50e4f0
Capabilities:
Get file size

Disassembly:
push ebp
push esi
push edi
mov esi, ecx
call fcn.0050e4d0
mov ebp, dword [esp + 0x10]
push 0x104
lea eax, [esi + 8]
push ebp
push eax
call fcn.005b7a60
mov edi, dword [esp + 0x20]
add esp, 0xc
mov eax, 1
cmp edi, 2
jne 0x50e528
mov ecx, 0xc0000000
lea eax, [edi + 1]
jmp 0x50e52d
mov ecx, SysReAllocString
xor edx, edx
cmp edi, 1
setne dl
push 0
push 0x80
add edx, 3
push edx
push 0
push eax
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0x110], eax
cmp eax, 0xffffffff
je 0x50e573
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 4], edi
pop edi
mov dword [esi + 0x114], eax
pop esi
mov eax, 1
pop ebp
ret 8
pop edi
mov dword [esi + 0x110], 0
pop esi
xor eax, eax
pop ebp
ret 8
Function at 0x50e800
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
or eax, 0xffffffff
push esi
cmp edx, 0x10
jb 0x50e983
movsx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6db528]
movsx esi, byte [ecx + 1]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6db528]
movsx esi, byte [ecx + 2]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6db528]
movsx esi, byte [ecx + 3]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6db528]
movsx esi, byte [ecx + 4]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6db528]
movsx esi, byte [ecx + 5]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6db528]
movsx esi, byte [ecx + 6]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6db528]
movsx esi, byte [ecx + 7]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6db528]
movsx esi, byte [ecx + 8]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6db528]
movsx esi, byte [ecx + 9]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6db528]
movsx esi, byte [ecx + 0xa]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6db528]
movsx esi, byte [ecx + 0xb]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6db528]
movsx esi, byte [ecx + 0xc]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6db528]
movsx esi, byte [ecx + 0xd]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6db528]
movsx esi, byte [ecx + 0xe]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6db528]
movsx esi, byte [ecx + 0xf]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6db528]
add ecx, 0x10
sub edx, 0x10
cmp edx, 0x10
jae 0x50e815
test edx, edx
je 0x50e9ab
jmp 0x50e990
movsx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6db528]
inc ecx
sub edx, 1
jne 0x50e990
not eax
pop esi
ret

Function at 0x50ea30
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
xor eax, eax
mov esi, 0x20
mov ebx, edx
shr ebx, 5
mov ebp, edx
shl ebp, 4
xor ebx, ebp
add ebx, edx
mov ebp, eax
and ebp, 3
mov ebp, dword [edi + ebp*4]
add ebp, eax
xor ebx, ebp
add ecx, ebx
mov ebx, ecx
shr ebx, 5
mov ebp, ecx
shl ebp, 4
xor ebx, ebp
sub eax, 0x61c88647
mov ebp, eax
shr ebp, 0xb
and ebp, 3
mov ebp, dword [edi + ebp*4]
add ebx, ecx
add ebp, eax
xor ebx, ebp
dec esi
add edx, ebx
test esi, esi
ja 0x50ea47
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [eax], ecx
mov dword [eax + 4], edx
pop ebx
ret
Function at 0x50eaa0
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov eax, 0xc6ef3720
mov esi, 0x20
lea ebx, [ebx]
mov ebx, edx
shr ebx, 5
mov ebp, edx
shl ebp, 4
xor ebx, ebp
mov ebp, eax
shr ebp, 0xb
and ebp, 3
mov ebp, dword [edi + ebp*4]
add ebp, eax
add ebx, edx
xor ebx, ebp
sub ecx, ebx
mov ebx, ecx
shr ebx, 5
mov ebp, ecx
shl ebp, 4
xor ebx, ebp
add eax, 0x61c88647
mov ebp, eax
and ebp, 3
mov ebp, dword [edi + ebp*4]
add ebx, ecx
add ebp, eax
xor ebx, ebp
dec esi
sub edx, ebx
test esi, esi
ja 0x50eac0
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [eax], edx
mov dword [eax + 4], ecx
pop ebx
ret

Function at 0x511d10
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x60ecec
mov eax, dword fs:[0]
push eax
push ecx
push ebp
push esi
push edi
mov eax, dword [0x6e377c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov eax, dword [0x6db93c]
lea ecx, [esi + 4]
mov dword [ecx], eax
mov edx, dword [0x6db93c]
lea edi, [esi + 8]
mov dword [esp + 0x1c], 0
mov dword [edi], edx
mov eax, dword [0x6db93c]
lea ebp, [esi + 0xc]
mov dword [ebp], eax
mov edx, dword [0x6db93c]
mov dword [esi + 0x20], edx
mov edx, dword [esp + 0x28]
or eax, 0xffffffff
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov eax, dword [esp + 0x24]
push edx
mov byte [esp + 0x20], 3
mov dword [esi], eax
call fcn.0050f610
mov eax, dword [esp + 0x2c]
push eax
mov ecx, edi
call fcn.0050f610
mov ecx, dword [esp + 0x30]
push ecx
mov ecx, ebp
call fcn.0050f610
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], edx
mov byte [esi + 0x18], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x10
ret 0x18
Function at 0x514c00
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 4]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
jne 0x514c51
call fcn.00519760
test eax, eax
je 0x514c3c
mov edx, dword [eax]
push 0
mov ecx, eax
mov eax, dword [edx + 8]
push str.Couldnt_terminate_thread
call eax
push eax
call fcn.00527960
add esp, 4
mov eax, 5
pop esi
ret
mov eax, str.Couldnt_terminate_thread
push eax
call fcn.00527960
add esp, 4
mov eax, 5
pop esi
ret
mov eax, dword [esi + 4]
test eax, eax
je 0x514c66
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0
xor eax, eax
pop esi
ret

Function at 0x514c70
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x514cc2
call fcn.00519760
test eax, eax
je 0x514cac
mov edx, dword [eax]
push 0
mov ecx, eax
mov eax, dword [edx + 8]
push str.Can_not_resume_thread__x
call eax
mov ecx, dword [esi + 4]
push ecx
push eax
call fcn.00527960
add esp, 8
xor al, al
pop esi
ret
mov ecx, dword [esi + 4]
mov eax, str.Can_not_resume_thread__x
push ecx
push eax
call fcn.00527960
add esp, 8
xor al, al
pop esi
ret
cmp dword [esi + 8], 4
mov eax, 1
je 0x514cd0
mov dword [esi + 8], eax
pop esi
ret

Function at 0x514df0
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x6dba94], eax
cmp eax, 0xffffffff
jne 0x514e36
call fcn.00519760
test eax, eax
je 0x514e25
mov edx, dword [eax]
push 0
mov ecx, eax
mov eax, dword [edx + 8]
push str.Thread_module_initialization_failed:_impossible_to_allocate_index_in_thread_local_storage
call eax
push eax
call fcn.00527960
add esp, 4
xor al, al
ret
mov eax, str.Thread_module_initialization_failed:_impossible_to_allocate_index_in_thread_local_storage
push eax
call fcn.00527960
add esp, 4
xor al, al
ret
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x514e90
mov ecx, dword [0x6dba94]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsFree]
mov dword [0x6dba94], 0xffffffff
call fcn.00519760
test eax, eax
je 0x514e7f
mov edx, dword [eax]
push 0
mov ecx, eax
mov eax, dword [edx + 8]
push 0x63e4a0
call eax
push eax
call fcn.00527960
add esp, 4
xor al, al
ret
mov eax, 0x63e4a0
push eax
call fcn.00527960
add esp, 4
xor al, al
ret
push 0x18
call fcn.005b4e59
add esp, 4
test eax, eax
je 0x514ea7
mov ecx, eax
call fcn.00514860
jmp 0x514ea9
xor eax, eax
push 0x18
mov dword [0x6f2e68], eax
call fcn.005b4e59
add esp, 4
test eax, eax
je 0x514ec5
mov ecx, eax
call fcn.00514860
jmp 0x514ec7
xor eax, eax
mov ecx, eax
mov dword [0x6f2e64], eax
call fcn.00514880
push 0x18
call fcn.005b4e59
add esp, 4
test eax, eax
je 0x514efb
mov ecx, eax
call fcn.00514860
mov dword [0x6f2e6c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x6f2e60], eax
mov al, 1
ret
xor eax, eax
mov dword [0x6f2e6c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x6f2e60], eax
mov al, 1
ret
Function at 0x515380
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60f1d8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x6e377c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
push esi
lea eax, [ebp - 0x20]
push fcn.00514b10
push eax
call fcn.00515350
add esp, 0xc
mov ecx, dword [0x6dba94]
push esi
or edi, 0xffffffff
mov dword [ebp - 4], 0
push ecx
mov dword [ebp - 0x14], edi
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x51541c
call fcn.00519760
test eax, eax
je 0x5153fe
mov edx, dword [eax]
push 0
mov ecx, eax
mov eax, dword [edx + 8]
push str.Can_not_start_thread:_error_writing_TLS.
call eax
jmp 0x515403
mov eax, str.Can_not_start_thread:_error_writing_TLS.
push eax
call fcn.00527960
add esp, 4
lea ecx, [ebp - 0x20]
push ecx
mov dword [ebp - 4], edi
call fcn.00515020
mov eax, edi
jmp 0x515450
mov edx, dword [esi]
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
mov esi, eax
jmp 0x515442
lea ecx, [ebp - 0x20]
push ecx
mov dword [ebp - 4], edi
call fcn.00515020
mov eax, esi
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x515570
Capabilities:
Create thread

Disassembly:
mov edx, dword [esp + 8]
push esi
mov esi, ecx
mov ecx, dword [esp + 8]
lea eax, [esi + 0x10]
push eax
push 4
push ecx
push 0x515470
push edx
push 0
call fcn.005bddf5
add esp, 0x18
mov dword [esi + 4], eax
test eax, eax
jne 0x5155d5
call fcn.00519760
test eax, eax
je 0x5155c1
mov edx, dword [eax]
push 0
mov ecx, eax
mov eax, dword [edx + 8]
push str.Cant_create_thread
call eax
push eax
call fcn.00527960
add esp, 4
xor al, al
pop esi
ret 8
mov eax, str.Cant_create_thread
push eax
call fcn.00527960
add esp, 4
xor al, al
pop esi
ret 8
mov eax, dword [esi + 0xc]
cmp eax, 0x32
je 0x5155e5
push eax
mov ecx, esi
call fcn.00514b70
mov al, 1
pop esi
ret 8

Function at 0x518210
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x6e377c]
xor eax, esp
mov dword [esp + 0x11c], eax
mov eax, dword [0x6dbe18]
cmp eax, 0xffffffff
jne 0x518282
push 0x11c
lea eax, [esp + 4]
push 0
push eax
call fcn.005b79e0
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [esp + 4]
cmp eax, 5
ja 0x518278
jne 0x518274
mov eax, dword [esp + 8]
test eax, eax
ja 0x518278
jne 0x518274
cmp word [esp + 0x114], 4
jae 0x518278
xor eax, eax
jmp 0x51827d
mov eax, 1
mov dword [0x6dbe18], eax
mov ecx, dword [esp + 0x11c]
xor edx, edx
cmp eax, 1
sete dl
xor ecx, esp
mov al, dl
call fcn.005bae23
add esp, 0x120
ret
Function at 0x51dd10
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x60fcf9
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x6e377c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov dword [esp + 8], 0
mov esi, dword [esp + 0x1c]
mov eax, dword [0x6db93c]
mov dword [esi], eax
push str.TMPDIR
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], 1
call fcn.005bef4d
add esp, 4
push eax
mov ecx, esi
call fcn.0050fe00
mov ecx, dword [esi]
cmp dword [ecx - 8], 0
jne 0x51dda4
push 0x640bcc
call fcn.005bef4d
add esp, 4
push eax
mov ecx, esi
call fcn.0050fe00
mov edx, dword [esi]
cmp dword [edx - 8], 0
jne 0x51dda4
push str.TEMP
call fcn.005bef4d
add esp, 4
push eax
mov ecx, esi
call fcn.0050fe00
mov eax, dword [esi]
cmp dword [eax - 8], 0
jne 0x51dddc
push 0x105
mov ecx, esi
call fcn.0050f7e0
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ecx, esi
call fcn.0050fe50
mov ecx, dword [esi]
cmp dword [ecx - 8], 0
jne 0x51dddc
push 0x2e
mov ecx, esi
call fcn.0050fde0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x51f730
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x60fa30
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x6e377c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov eax, dword [0x6db93c]
mov dword [esp + 0xc], eax
mov edi, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
push edi
push 0
push ecx
mov ecx, dword [esp + 0x2c]
push edx
push esi
lea eax, [esp + 0x20]
push eax
push ecx
mov dword [esp + 0x34], 0
call fcn.0051e2f0
add esp, 0x1c
test esi, esi
je 0x51f7d1
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x28]
push eax
mov edx, edi
call fcn.0051e630
add esp, 8
push eax
mov ecx, esi
mov byte [esp + 0x1c], 1
call fcn.00512350
mov ecx, dword [esp + 0x24]
mov eax, dword [ecx - 0xc]
add ecx, 0xfffffff4
mov byte [esp + 0x18], 0
cmp eax, 0xffffffff
je 0x51f7d1
add eax, 0xffffffff
mov dword [ecx], eax
jne 0x51f7d1
call fcn.0050ec00
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx - 0xc]
add ecx, 0xfffffff4
mov dword [esp + 0x18], 0xffffffff
cmp eax, 0xffffffff
je 0x51f7f4
add eax, 0xffffffff
mov dword [ecx], eax
jne 0x51f7f4
call fcn.0050ec00
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x51f810
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x60fa58
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x6e377c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esp + 0x30]
mov edx, dword [esp + 0x20]
push edi
mov eax, edx
call fcn.0051d690
add esp, 4
test al, al
je 0x51f8ad
mov eax, dword [0x6db93c]
mov ecx, dword [0x63dcd0]
mov dword [esp + 0x30], eax
mov eax, dword [edx]
mov edx, dword [eax - 8]
dec edx
cmp edx, ecx
jae 0x51f866
mov ecx, edx
push ecx
push 1
push eax
lea ecx, [esp + 0x3c]
call fcn.0050fcd0
push edi
lea ecx, [esp + 0x34]
push ecx
mov ecx, esi
mov dword [esp + 0x1c], 0
call fcn.0051e750
mov ecx, dword [esp + 0x30]
mov eax, dword [ecx - 0xc]
add ecx, 0xfffffff4
mov dword [esp + 0x14], 0xffffffff
cmp eax, 0xffffffff
je 0x51f8b6
add eax, 0xffffffff
mov dword [ecx], eax
jne 0x51f8b6
call fcn.0050ec00
jmp 0x51f8b6
push edi
push edx
mov ecx, esi
call fcn.0051e750
mov edx, dword [esp + 0x1c]
push edx
mov ecx, esi
call fcn.0050f610
mov eax, dword [esp + 0x28]
push eax
lea ecx, [esi + 0x18]
call fcn.0050f610
mov ecx, dword [esp + 0x24]
push ecx
lea ecx, [esi + 0x14]
call fcn.0050f610
mov dl, byte [esp + 0x2c]
mov byte [esi + 0x1d], dl
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 0x18
Function at 0x51f900
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x60faa0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x6e377c]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x6db93c]
mov dword [esp + 0x18], eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
mov edi, dword [esp + 0x30]
push edi
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x3c]
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x2c]
push ecx
push edx
mov byte [esp + 0x40], 3
call fcn.0051e2f0
mov eax, dword [esp + 0x4c]
add esp, 0x1c
push edi
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x2c]
push ecx
mov ecx, esi
call fcn.0051f810
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx - 0xc]
add ecx, 0xfffffff4
mov byte [esp + 0x24], 2
cmp eax, 0xffffffff
je 0x51f9b5
add eax, 0xffffffff
mov dword [ecx], eax
jne 0x51f9b5
call fcn.0050ec00
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx - 0xc]
add ecx, 0xfffffff4
mov byte [esp + 0x24], 1
cmp eax, 0xffffffff
je 0x51f9d5
add eax, 0xffffffff
mov dword [ecx], eax
jne 0x51f9d5
call fcn.0050ec00
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx - 0xc]
add ecx, 0xfffffff4
mov byte [esp + 0x24], 0
cmp eax, 0xffffffff
je 0x51f9f5
add eax, 0xffffffff
mov dword [ecx], eax
jne 0x51f9f5
call fcn.0050ec00
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx - 0xc]
add ecx, 0xfffffff4
mov dword [esp + 0x24], 0xffffffff
cmp eax, 0xffffffff
je 0x51fa18
add eax, 0xffffffff
mov dword [ecx], eax
jne 0x51fa18
call fcn.0050ec00
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret 8