joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413ba8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x6d25dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x6e8528]
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x413bdb
mov ecx, dword [0x6e8524]
cmp ecx, dword [0x6e9884]
je 0x413cf8
call fcn.00413b65
mov eax, dword [0x6e9884]
push esi
push edi
push 0x50
mov dword [0x6e8524], eax
call fcn.00413d11
push 0x51
mov dword [0x6e84f8], eax
call fcn.00413d11
push 0xf
mov dword [0x6e84fc], eax
call fcn.00413d11
push 0xe
mov dword [0x6e8504], eax
call fcn.00413d11
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
add esp, 0x10
push 0x20
mov dword [0x6e8508], eax
lea eax, [ebp - 0x24]
push eax
push 0x1010
mov edi, 0x400
push edi
mov dword [0x6e8500], ebx
mov dword [0x6e850c], ebx
mov dword [0x6e8510], 0x657c70
call esi
test eax, eax
jne 0x413c7d
mov eax, dword [eax*4 + 0x6d6150]
mov dword [0x6e8514], eax
call fcn.00413dc6
push 0x10
mov word [0x6e8518], ax
call fcn.00413d11
cmp eax, ebx
pop ecx
je 0x413c96
mov cl, byte [eax]
sub cl, 0x30
mov byte [0x6e851c], cl
jmp 0x413c9c
lea eax, [ebp - 0x24]
call fcn.00414093
cmp eax, 5
jb 0x413c4d
mov dword [0x6e8514], 0x657c5c
jmp 0x413c59
mov byte [0x6e851c], bl
push eax
call fcn.00401c01
pop ecx
push 0x20
lea eax, [ebp - 0x24]
push eax
push 0x11
push edi
call esi
test eax, eax
je 0x413cba
lea eax, [ebp - 0x24]
call fcn.00414093
movzx ax, al
push 0x20
mov word [0x6e851a], ax
lea eax, [ebp - 0x24]
push eax
push 0x12
push edi
call esi
test eax, eax
pop edi
pop esi
je 0x413cdd
lea eax, [ebp - 0x24]
call fcn.00414093
mov byte [0x6e851d], al
mov eax, 0x6e84f4
mov byte [0x6e851e], bl
mov byte [0x6e8520], bl
mov dword [0x6e8528], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00579aab
leave
ret

Function at 0x413d11
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6d25dc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
push dword [ebp + 8]
mov esi, 0x400
push esi
mov dword [ebp - 0x28], ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov edi, eax
cmp edi, ebx
jne 0x413d78
push ebx
push ebx
push dword [ebp + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push esi
call ebx
mov edi, eax
test edi, edi
je 0x413da8
inc edi
cmp edi, 0x20
jbe 0x413d66
mov eax, edi
call fcn.00580200
mov dword [ebp - 0x28], esp
jmp 0x413d6c
lea eax, [ebp - 0x24]
mov dword [ebp - 0x28], eax
push edi
push dword [ebp - 0x28]
push dword [ebp + 8]
push esi
call ebx
jmp 0x413d79
inc edi
lea eax, [edi + edi]
push eax
call fcn.00401bd8
cmp dword [ebp - 0x28], 0
pop ecx
mov ebx, eax
push edi
jne 0x413d99
push ebx
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x413da6
push dword [ebp - 0x28]
push edi
push ebx
call fcn.00412ac8
add esp, 0x10
mov eax, ebx
lea esp, [ebp - 0x34]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00579aab
leave
ret
Function at 0x42651e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x426533
mov al, 1
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x426548
cmp eax, 3
je 0x426548
xor eax, eax
inc eax
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x42a86d
Capabilities:
Check if file exists
Get file attributes
Manipulate boot configuration
Set file attributes

Disassembly:
cmp dword [esi + 0x18], 0x10
push edi
lea edi, [esi + 4]
jb 0x42a87b
mov eax, dword [edi]
jmp 0x42a87d
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
mov ecx, dword [esp + 8]
mov dword [ecx], eax
jne 0x42a8ac
cmp dword [esi + 0x18], 0x10
jb 0x42a897
mov edi, dword [edi]
push edi
push str.Cannot_locate__s____use__INIFILE:__path_boot.ini__
push 0
call fcn.0048212f
add esp, 0xc
xor eax, eax
inc eax
pop edi
ret
test al, 1
je 0x42a8db
and eax, 0xfffffffe
cmp dword [esi + 0x18], 0x10
jb 0x42a8bd
mov ecx, dword [edi]
jmp 0x42a8bf
mov ecx, edi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x42a8db
cmp dword [esi + 0x18], 0x10
jb 0x42a8d3
mov edi, dword [edi]
push edi
push str.Cannot_make__s_writable._Please_remove_READ_ONLY_attributes
jmp 0x42a89d
xor eax, eax
pop edi
ret
Function at 0x440050
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5f7d78
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x6d25dc]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, dword [esp + 0x2c]
test edi, edi
jne 0x440092
lea eax, [edi + 1]
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret
lea ecx, [esp + 0x2c]
call fcn.00459d00
push 1
mov ecx, edi
mov esi, eax
call fcn.004443b0
imul eax, esi
push eax
lea ecx, [esp + 0x14]
call fcn.00459bd0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
push eax
push esi
push ecx
push edx
mov ecx, edi
mov dword [esp + 0x34], 0
call fcn.00444590
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0xc]
push eax
push ecx
lea ecx, [esp + 0x34]
call fcn.00459d10
lea ecx, [esp + 0xc]
mov esi, eax
mov dword [esp + 0x24], 0xffffffff
call fcn.00459ce0
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret

Function at 0x443e80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5f8068
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x6d25dc]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov ecx, dword [ecx + 8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
lea edx, [esp + 8]
push edx
call eax
mov ecx, dword [eax]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
mov dword [esp + 0x18], 0
call eax
mov esi, eax
mov eax, dword [esp + 0xc]
test eax, eax
mov dword [esp + 0x18], 0xffffffff
je 0x443f06
add dword [eax], 0xffffffff
mov eax, dword [esp + 0xc]
cmp dword [eax], 0
jne 0x443f06
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x443ef6
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 4]
add ecx, dword [eax]
jne 0x443f06
push eax
call fcn.00401000
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret

Function at 0x4443b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5f8188
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x6d25dc]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov ecx, dword [ecx + 8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
lea edx, [esp + 8]
push edx
call eax
mov ecx, dword [eax]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
mov dword [esp + 0x18], 0
call eax
mov esi, eax
mov eax, dword [esp + 0xc]
test eax, eax
mov dword [esp + 0x18], 0xffffffff
je 0x444436
add dword [eax], 0xffffffff
mov eax, dword [esp + 0xc]
cmp dword [eax], 0
jne 0x444436
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x444426
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 4]
add ecx, dword [eax]
jne 0x444436
push eax
call fcn.00401000
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret
Function at 0x444590
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5f81e8
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x6d25dc]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov ecx, dword [ecx + 8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
lea edx, [esp + 4]
push edx
call eax
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
mov eax, dword [eax]
push 0
push ecx
mov ecx, dword [esp + 0x28]
push 0
push edx
mov edx, dword [esp + 0x2c]
push ecx
push edx
mov ecx, eax
mov dword [esp + 0x2c], 0
call fcn.0051ff6e
mov eax, dword [esp + 8]
test eax, eax
mov dword [esp + 0x14], 0xffffffff
je 0x44462b
add dword [eax], 0xffffffff
mov eax, dword [esp + 8]
cmp dword [eax], 0
jne 0x44462b
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x44461b
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
add ecx, dword [eax]
jne 0x44462b
push eax
call fcn.00401000
add esp, 4
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
add esp, 0x14
ret 0x10

Function at 0x444640
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5f8218
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x6d25dc]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov ecx, dword [ecx + 8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
lea edx, [esp + 4]
push edx
call eax
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
mov eax, dword [eax]
push 0
push 0
push 0
push ecx
mov ecx, dword [esp + 0x30]
push 0
push edx
mov edx, dword [esp + 0x34]
push ecx
push edx
mov ecx, eax
mov dword [esp + 0x34], 0
call fcn.0051f464
mov eax, dword [esp + 8]
test eax, eax
mov dword [esp + 0x14], 0xffffffff
je 0x4446df
add dword [eax], 0xffffffff
mov eax, dword [esp + 8]
cmp dword [eax], 0
jne 0x4446df
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x4446cf
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
add ecx, dword [eax]
jne 0x4446df
push eax
call fcn.00401000
add esp, 4
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
add esp, 0x14
ret 0x10
Function at 0x4468f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5f86e9
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x6d25dc]
xor eax, esp
mov dword [esp + 0x50], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6d25dc]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov esi, dword [esp + 0x78]
mov eax, dword [esp + 0x80]
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov ebp, dword [0x6dab44]
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
mov dword [esp + 0x18], esi
mov byte [esi + 4], bl
mov edi, dword [esp + 0x7c]
cmp edi, ebp
mov dword [esp + 0x70], ebx
mov dword [esp + 0x14], 1
jae 0x4469a2
mov edi, edi
cmp edi, eax
jne 0x44699b
mov eax, dword [eax + 4]
push eax
lea ecx, [esp + 0x58]
push str._x
push ecx
call fcn.0057ea98
lea eax, [esp + 0x60]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x446981
sub eax, edx
push eax
lea edx, [esp + 0x58]
push edx
mov ecx, esi
call fcn.0042c8bf
mov eax, dword [edi]
add edi, 4
cmp edi, ebp
jb 0x446960
push 0x4466e0
lea eax, [esp + 0x58]
push 0x63286c
push eax
call fcn.0057ea98
add esp, 0xc
push 7
mov ebp, 0xf
push str.Known
lea ecx, [esp + 0x24]
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
call fcn.00415d79
lea ecx, [esp + 0x54]
push ecx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x40]
push eax
mov dword [esp + 0x7c], 1
call fcn.0042ecd5
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
mov byte [esp + 0x7c], 2
call fcn.0042c818
mov edi, 0x10
cmp dword [esp + 0x50], edi
jb 0x446a21
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.00401000
add esp, 4
cmp dword [esp + 0x34], edi
mov dword [esp + 0x50], ebp
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x3c], bl
jb 0x446a40
mov edx, dword [esp + 0x20]
push edx
call fcn.00401000
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.00579aab
add esp, 0x60
ret

Function at 0x449810
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x20
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
lea eax, [esp]
push eax
mov dword [esp + 4], 0x20
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [esp + 8]
xor ecx, ecx
cmp eax, 0xffffffff
jne 0x449856
mov eax, SysReAllocString
mov edx, dword [esp + 0x24]
mov dword [edx], eax
mov eax, dword [esp + 0xc]
mov dword [edx + 4], ecx
xor ecx, ecx
cmp eax, 0xffffffff
jne 0x44986f
mov eax, SysReAllocString
mov edx, dword [esp + 0x28]
mov dword [edx], eax
mov dword [edx + 4], ecx
add esp, 0x20
ret
Function at 0x44a9d0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x5f8c88
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x6d25dc]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
push edi
mov eax, dword [0x6d25dc]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x4c]
push 0x400
xor edi, edi
push edi
push eax
call fcn.0057d9b0
push edi
call fcn.005795ca
mov ecx, dword [esi + 0x4c]
mov dword [ecx], 0x1f700
mov dword [esp + 0x24], edx
mov edx, dword [esi + 0x4c]
mov dword [edx + 4], 0x3ec08
mov ebx, eax
mov eax, dword [esi + 0x4c]
mov dword [eax + 8], 0x3233
mov ecx, dword [esi + 0x4c]
mov dword [ecx + 0xc], 0x3dc31
mov edx, dword [esi + 0x4c]
mov dword [edx + 0x10], 0x1f6f5
mov eax, dword [esi + 0x4c]
mov dword [eax + 0x14], edi
mov edx, dword [esi + 0x4c]
mov ecx, 2
mov dword [edx + 0x18], ecx
mov eax, dword [esi + 0x4c]
mov dword [eax + 0x1c], ecx
mov edx, dword [esi + 0x4c]
mov eax, 0x8000
mov dword [edx + 0x20], eax
mov edx, dword [esi + 0x4c]
mov dword [edx + 0x24], eax
mov eax, dword [esi + 0x4c]
mov dword [eax + 0x28], 0x3ee0
mov edx, dword [esi + 0x4c]
mov dword [edx + 0x2c], edi
mov eax, dword [esi + 0x4c]
mov dword [eax + 0x30], ebx
mov edx, dword [esi + 0x4c]
mov word [edx + 0x34], di
mov eax, dword [esi + 0x4c]
mov word [eax + 0x36], 0x19
mov edx, dword [esi + 0x4c]
mov word [edx + 0x38], 0xef53
mov edx, dword [esi + 0x4c]
mov eax, 1
mov word [edx + 0x3a], ax
mov edx, dword [esi + 0x4c]
mov word [edx + 0x3c], ax
mov edx, dword [esi + 0x4c]
mov word [edx + 0x3e], di
mov edx, dword [esi + 0x4c]
mov dword [edx + 0x40], ebx
mov edx, dword [esi + 0x4c]
mov dword [edx + 0x44], 0xed4e00
mov edx, dword [esi + 0x4c]
mov dword [edx + 0x48], edi
mov edx, dword [esi + 0x4c]
mov dword [edx + 0x4c], eax
mov edx, dword [esi + 0x4c]
mov word [edx + 0x50], di
mov edx, dword [esi + 0x4c]
mov word [edx + 0x52], di
mov edx, dword [esi + 0x4c]
mov dword [edx + 0x54], 0xb
mov edx, dword [esi + 0x4c]
mov word [edx + 0x58], 0x80
mov edx, dword [esi + 0x4c]
mov word [edx + 0x5a], di
mov edx, dword [esi + 0x4c]
mov dword [edx + 0x5c], edi
mov edx, dword [esi + 0x4c]
mov dword [edx + 0x60], ecx
mov ecx, dword [esi + 0x4c]
lea edx, [esp + 0x28]
push edx
mov dword [ecx + 0x64], eax
call fcn.0045d260
add esp, 0x14
lea ecx, [esp + 0x18]
mov dword [esp + 0x34], edi
call fcn.0045d0a0
mov ecx, dword [esi + 0x4c]
mov edx, dword [eax]
mov dword [ecx + 0x68], edx
mov edx, dword [eax + 4]
add ecx, 0x68
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
mov ecx, dword [esi + 0x4c]
mov dword [ecx + 0x108], ebx
lea ecx, [esp + 0x18]
mov dword [esp + 0x34], 0xffffffff
call fcn.0045ce60
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00579aab
add esp, 0x28
ret 4
Function at 0x45ccc0
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [eax]
mov ecx, dword [eax + 4]
push ebx
push esi
push edi
xor eax, eax
mov esi, 0x20
mov edi, ecx
shl edi, 4
sub edi, 0xc38e911
mov ebx, ecx
shr ebx, 5
add ebx, 0x7d4b450c
xor edi, ebx
sub eax, 0x61c88647
lea ebx, [eax + ecx]
xor edi, ebx
add edx, edi
mov edi, edx
shl edi, 4
mov ebx, edx
shr ebx, 5
sub edi, 0x4d140630
add ebx, 0x73db6268
xor edi, ebx
lea ebx, [eax + edx]
xor edi, ebx
sub esi, 1
add ecx, edi
test esi, esi
ja 0x45ccd3
xor esi, esi
pop edi
or edx, esi
xor eax, eax
pop esi
or eax, ecx
pop ebx
ret
Function at 0x470260
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x5fad1b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6d25dc]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
mov ebp, dword [esp + 0x28]
mov dword [esi], ebp
mov eax, dword [ebp + 0x5c]
push 1
push eax
lea ecx, [esi + 4]
call fcn.00459bd0
lea edi, [esi + 0x14]
xor ebx, ebx
mov ecx, edi
mov dword [esp + 0x20], ebx
call fcn.0046c500
mov dword [edi + 4], eax
mov byte [eax + 0x25], 1
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov dword [edi + 8], ebx
mov dword [esi + 0x20], ebp
mov ebp, dword [ebp + 0x5c]
mov dword [esi + 0x24], ebp
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov byte [esi + 0x38], bl
mov dword [esi + 0x3c], ebx
mov byte [esi + 0xc0], bl
mov dword [esi + 0xc8], ebx
mov dword [esi + 0xcc], ebx
mov dword [esi + 0xd0], ebx
lea edi, [esi + 0xd8]
mov byte [esi + 0xd4], 1
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [esi + 0xe8], ebx
mov dword [esi + 0xec], ebx
mov dword [esi + 0xf0], ebx
mov dword [esi + 0xf4], ebx
mov byte [esi + 0xf8], bl
mov dword [esi + 0x100], ebx
mov dword [esi + 0x104], ebx
lea ebp, [esi + 0x108]
mov dword [ebp], ebx
mov dword [ebp + 4], ebx
mov dword [esi + 0x128], 0xf
mov dword [esi + 0x124], ebx
mov byte [esi + 0x114], bl
push 0x80
lea eax, [esi + 0x40]
push ebx
push eax
mov byte [esp + 0x2c], 5
call fcn.0057d9b0
mov eax, dword [esp + 0x38]
add esp, 0xc
cmp eax, ebx
je 0x470383
push eax
mov ecx, edi
call fcn.00443160
mov eax, dword [esp + 0x30]
cmp eax, ebx
jne 0x470393
mov byte [esi + 0xd4], bl
jmp 0x4703d2
test byte [eax + 0x18], 0x80
jne 0x47039f
mov byte [esi + 0xd4], bl
test word [eax + 0x1c], 0x4000
je 0x4703d2
mov byte [esi + 0xf8], 1
mov ecx, dword [eax + 8]
mov dword [esi + 0x100], ecx
mov edx, dword [eax + 0xc]
add eax, 0x10
cmp eax, ebp
mov dword [esi + 0x104], edx
je 0x4703d2
mov ecx, dword [eax]
mov dword [ebp], ecx
mov edx, dword [eax + 4]
mov dword [ebp + 4], edx
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
Function at 0x475340
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5fb186
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x6d25dc]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
xor eax, eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x30], 0xf
mov dword [esi + 0x2c], eax
mov dword [esp + 0x14], eax
mov byte [esi + 0x1c], al
mov eax, dword [esp + 0x1c]
push eax
mov byte [esp + 0x18], 1
call fcn.00474e40
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4

Function at 0x4757d0
Capabilities:
Execute anti-debugging instructions
Get cpu information
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x5fb1f8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x6d25dc]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
lea ecx, [esp + 0x24]
call fcn.00475d30
xor esi, esi
lea ecx, [esp + 0x24]
mov dword [esp + 0x38], esi
call fcn.00475bd0
test eax, eax
jne 0x475875
lea eax, [esp + 0x18]
push eax
push 0x20019
push esi
push str.HardwareDescriptionSystemCentralProcessor0
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x475864
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x20]
push edx
push esi
push esi
push str.Mhz
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x1c]
mov edx, 0xf4240
mul edx
mov esi, eax
mov edi, edx
jmp 0x4758b6
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 1
call esi
cpuid
rdtsc
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edx
push 0x3e8
call esi
cpuid
rdtsc
sub eax, dword [esp + 0x14]
sbb edx, dword [esp + 0x10]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
xor esi, esi
xor ecx, ecx
or esi, eax
or edi, ecx
lea ecx, [esp + 0x24]
mov dword [esp + 0x38], 0xffffffff
call fcn.00475bc0
mov edx, edi
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x2c
ret
Function at 0x47b5a4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0x12c
mov eax, 0x5fbc6f
call fcn.00579b23
mov esi, dword [ebp + 8]
push esi
mov edi, ecx
call fcn.0047b24e
test al, al
jne 0x47b7a7
push esi
lea ecx, [edi + 0x78]
call fcn.004363af
cmp dword [esi + 0x18], 0x10
jb 0x47b5da
mov eax, dword [esi + 4]
jmp 0x47b5dd
lea eax, [esi + 4]
push eax
lea ecx, [ebp - 0x138]
call fcn.00414b61
push 1
push 1
lea eax, [ebp - 0x138]
xor ebx, ebx
push eax
lea ecx, [ebp - 0x118]
mov dword [ebp - 4], ebx
call fcn.0047b4f0
push ebx
push 1
lea ecx, [ebp - 0x138]
mov byte [ebp - 4], 2
call fcn.00415386
mov eax, dword [ebp - 0x118]
mov eax, dword [eax + 4]
mov eax, dword [ebp + eax - 0x110]
test al, 6
je 0x47b63f
push 0xffffffffffffffff
push ebx
push esi
lea ecx, [edi + 0x3c]
call fcn.00415271
mov byte [edi + 0x1c], 1
jmp 0x47b798
cmp eax, ebx
jne 0x47b78d
push 0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], 0xf
call fcn.00415e5a
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x118]
push eax
mov byte [ebp - 4], 3
call fcn.0047b581
and dword [ebp - 0x11c], 0
or esi, 0xffffffff
cmp dword [ebp - 0x18], 0
pop ecx
pop ecx
mov ebx, esi
jbe 0x47b766
push dword [ebp - 0x11c]
lea ecx, [ebp - 0x2c]
call fcn.00429b4c
movzx eax, byte [eax]
push eax
call fcn.00580eef
test eax, eax
pop ecx
jne 0x47b6b1
cmp ebx, 0xffffffff
jne 0x47b6ab
mov ebx, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x11c]
inc dword [ebp - 0x11c]
mov eax, dword [ebp - 0x11c]
cmp eax, dword [ebp - 0x18]
jb 0x47b684
cmp ebx, 0xffffffff
je 0x47b766
cmp esi, ebx
jb 0x47b766
je 0x47b6e4
push esi
lea ecx, [ebp - 0x2c]
call fcn.00429b4c
cmp byte [eax], 0x22
jne 0x47b6e4
dec esi
push ebx
lea ecx, [ebp - 0x2c]
call fcn.00429b4c
cmp byte [eax], 0x22
jne 0x47b6f3
inc ebx
sub esi, ebx
inc esi
push esi
push ebx
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0042cea2
lea eax, [ebp - 0x48]
push eax
mov ecx, edi
mov byte [ebp - 4], 4
call fcn.0047ad6f
test al, al
je 0x47b74e
cmp dword [ebp - 0x30], 0x10
mov ecx, dword [ebp - 0x44]
jae 0x47b723
lea ecx, [ebp - 0x44]
mov eax, dword [edi + 0x14]
add ecx, eax
push ecx
lea ecx, [ebp - 0x64]
call fcn.00414b61
lea eax, [ebp - 0x64]
push eax
mov ecx, edi
mov byte [ebp - 4], 5
call fcn.0047b5a4
push 0
push 1
lea ecx, [ebp - 0x64]
call fcn.00415386
jmp 0x47b75a
lea eax, [ebp - 0x48]
push eax
lea ecx, [edi + 0x58]
call fcn.004363af
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.00415386
push 0
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.00415386
mov eax, dword [ebp - 0x118]
mov eax, dword [eax + 4]
cmp dword [ebp + eax - 0x110], 0
je 0x47b647
lea ecx, [ebp - 0x110]
call fcn.0047b2e5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x118]
call fcn.0047b231
call fcn.00579ba6
ret 4