joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ec390
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ec493
mov dword [ecx], 0x553d28
push eax
mov dword fs:[0], esp
sub esp, 4
mov dword [ebp - 4], 0
push ebx
mov dword [ebp - 0x10], ecx
mov ecx, dword [ecx + 0xf4]
test ecx, ecx
je 0x4ec3e9
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 0x104]
test edx, edx
jne 0x4ec3e9
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x104], 1
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xfc]
test eax, eax
je 0x4ec40c
push eax
call fcn.0052f860
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0xfc], 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0xf4]
test ecx, ecx
je 0x4ec479
mov eax, dword [eax + 0x160]
test eax, eax
je 0x4ec45c
push 0
push 4
push 0x15
push eax
call sub.IMM32.dll_ImmNotifyIME
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x164]
test ecx, ecx
je 0x4ec44f
mov ecx, dword [eax + 0x160]
mov edx, dword [eax + 0xf4]
push ecx
push edx
call sub.IMM32.dll_ImmReleaseContext
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x160], 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0xf4]
push ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0xf4], 0
mov dword [ebp - 4], 0xffffffff
call fcn.004ec49d
mov eax, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], eax
mov esp, ebp
pop ebp
ret

Function at 0x4ec770
Capabilities:
Get graphical window text

Disassembly:
sub esp, 8
push ebx
push esi
push edi
mov esi, ecx
push ebp
mov ecx, dword [esi + 0xf4]
test ecx, ecx
je 0x4ec82e
movsx eax, word [esi + 0xf8]
inc eax
mov edx, dword [esi + 0xfc]
push eax
push edx
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov edi, dword [esi + 0xfc]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov eax, dword [esi + 0xfc]
movsx edx, word [esi + 0xf8]
mov dword [esi + 0x100], ecx
mov byte [edx + eax - 1], 0
movsx eax, word [esi + 0xf8]
dec eax
mov ecx, dword [esi + 0x100]
cmp eax, ecx
jge 0x4ec7f8
mov eax, dword [esi + 0xfc]
mov ecx, dword [esi + 0xf4]
push eax
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 0xffffffffffffffff
mov ebp, dword [sym.imp.USER32.dll_MessageBeep]
call ebp
xor eax, eax
lea ecx, [esp + 0x14]
mov edx, dword [esi + 0xf4]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push ecx
push 0xb0
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
sub eax, ecx
mov dword [esi + 0x14c], eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x4fc9e0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x16c
push ebx
push esi
push edi
mov ebx, ecx
lea eax, [esp + 0x40]
push ebp
mov ebp, 0xffffffff
push 0x32
push eax
mov ecx, dword [0x5681d8]
push 0x277b
mov esi, dword [ecx]
call dword [esi + 0x20]
lea ecx, [esp + 0x10]
push 0x32
push ecx
mov eax, dword [0x5681d8]
mov esi, dword [eax]
push 0x2775
mov ecx, eax
call dword [esi + 0x20]
lea ecx, [esp + 0x78]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x4fca57
mov edi, 0x562818
mov ecx, ebp
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edi, [esp + 0x78]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x184]
mov esi, dword [esp + 0x180]
cmp edi, 1
jne 0x4fcaaf
mov eax, dword [ebx + esi*4 + 0x1448]
test eax, eax
jle 0x4fcaaf
mov eax, dword [ebx + esi*4 + 0x1388]
test eax, eax
je 0x4fcaaf
lea ebp, [ebx + 0x1028]
push esi
lea eax, [esp + 0x7c]
push eax
push str._stemp_buildlist_d.tmp
push ebp
call fcn.00535470
add esp, 0x10
push 0x180
push 0x8301
push ebp
call fcn.00535c20
add esp, 0xc
mov ebp, eax
cmp ebp, 0xffffffff
je 0x4fcadb
mov eax, dword [ebx + esi*4 + 0x1448]
mov ecx, dword [ebx + esi*4 + 0x1388]
push eax
push ecx
push ebp
call fcn.00536060
add esp, 0xc
push ebp
call fcn.005358e0
add esp, 4
jmp 0x4fcb96
cmp edi, 1
jne 0x4fcb7a
mov eax, dword [ebx + esi*4 + 0x12c8]
lea edx, [esp + 0x10]
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x4fcb0f
or cl, cl
je 0x4fcb0b
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x4fcb0f
add eax, 2
add edx, 2
or cl, cl
jne 0x4fcaef
xor eax, eax
jmp 0x4fcb14
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4fcb7a
mov eax, dword [ebx + esi*4 + 0x12c8]
lea edx, [esp + 0x44]
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x4fcb43
or cl, cl
je 0x4fcb3f
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x4fcb43
add eax, 2
add edx, 2
or cl, cl
jne 0x4fcb23
xor eax, eax
jmp 0x4fcb48
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4fcb7a
mov eax, dword [ebx + esi*4 + 0x12c8]
mov ecx, dword [0x5681d8]
push eax
nop
mov eax, dword [ecx + 0xc]
lea ecx, [ebx + 0x1028]
add eax, 0x102b
push eax
push str._s_s.ai
push ecx
call fcn.00535470
add esp, 0x10
jmp 0x4fcb96
mov eax, dword [ebx + esi*4 + 0x12c8]
lea ecx, [ebx + 0x1028]
push eax
push 0x55f1e8
push ecx
call fcn.00535470
add esp, 0xc
lea eax, [ebx + 0x1028]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x16c
ret 8
Function at 0x4fcbb0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x16c
push ebx
push esi
push edi
mov ebx, ecx
lea eax, [esp + 0x40]
push ebp
mov ebp, 0xffffffff
push 0x32
push eax
mov ecx, dword [0x5681d8]
push 0x277b
mov esi, dword [ecx]
call dword [esi + 0x20]
lea ecx, [esp + 0x10]
push 0x32
push ecx
mov eax, dword [0x5681d8]
mov esi, dword [eax]
push 0x2775
mov ecx, eax
call dword [esi + 0x20]
lea ecx, [esp + 0x78]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x4fcc27
mov edi, 0x562818
mov ecx, ebp
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edi, [esp + 0x78]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x184]
mov esi, dword [esp + 0x180]
cmp edi, 1
jne 0x4fcc7f
mov eax, dword [ebx + esi*4 + 0x1488]
test eax, eax
jle 0x4fcc7f
mov eax, dword [ebx + esi*4 + 0x13c8]
test eax, eax
je 0x4fcc7f
lea ebp, [ebx + 0x1108]
push esi
lea eax, [esp + 0x7c]
push eax
push str._stemp_CityPlan_d.tmp
push ebp
call fcn.00535470
add esp, 0x10
push 0x180
push 0x8301
push ebp
call fcn.00535c20
add esp, 0xc
mov ebp, eax
cmp ebp, 0xffffffff
je 0x4fccab
mov eax, dword [ebx + esi*4 + 0x1488]
mov ecx, dword [ebx + esi*4 + 0x13c8]
push eax
push ecx
push ebp
call fcn.00536060
add esp, 0xc
push ebp
call fcn.005358e0
add esp, 4
jmp 0x4fcd66
cmp edi, 1
jne 0x4fcd4a
mov eax, dword [ebx + esi*4 + 0x12c8]
lea edx, [esp + 0x10]
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x4fccdf
or cl, cl
je 0x4fccdb
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x4fccdf
add eax, 2
add edx, 2
or cl, cl
jne 0x4fccbf
xor eax, eax
jmp 0x4fcce4
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4fcd4a
mov eax, dword [ebx + esi*4 + 0x12c8]
lea edx, [esp + 0x44]
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x4fcd13
or cl, cl
je 0x4fcd0f
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x4fcd13
add eax, 2
add edx, 2
or cl, cl
jne 0x4fccf3
xor eax, eax
jmp 0x4fcd18
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4fcd4a
mov eax, dword [ebx + esi*4 + 0x1308]
mov ecx, dword [0x5681d8]
push eax
nop
mov eax, dword [ecx + 0xc]
lea ecx, [ebx + 0x1108]
add eax, 0x102b
push eax
push str._s_s.cty
push ecx
call fcn.00535470
add esp, 0x10
jmp 0x4fcd66
mov eax, dword [ebx + esi*4 + 0x1308]
lea ecx, [ebx + 0x1108]
push eax
push 0x55f1e8
push ecx
call fcn.00535470
add esp, 0xc
lea eax, [ebx + 0x1108]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x16c
ret 8
Function at 0x4fcd90
Capabilities:
Get common file path

Disassembly:
sub esp, 0x16c
push ebx
push esi
push edi
mov ebx, ecx
lea eax, [esp + 0x40]
push ebp
mov ebp, 0xffffffff
push 0x32
push eax
mov ecx, dword [0x5681d8]
push 0x277b
mov esi, dword [ecx]
call dword [esi + 0x20]
lea ecx, [esp + 0x10]
push 0x32
push ecx
mov eax, dword [0x5681d8]
mov esi, dword [eax]
push 0x2775
mov ecx, eax
call dword [esi + 0x20]
lea ecx, [esp + 0x78]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x4fce07
mov edi, 0x562818
mov ecx, ebp
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edi, [esp + 0x78]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x184]
mov esi, dword [esp + 0x180]
cmp edi, 1
jne 0x4fce5f
mov eax, dword [ebx + esi*4 + 0x14c8]
test eax, eax
jle 0x4fce5f
mov eax, dword [ebx + esi*4 + 0x1408]
test eax, eax
je 0x4fce5f
lea ebp, [ebx + 0x11e8]
push esi
lea eax, [esp + 0x7c]
push eax
push str._stemp_AiRules_d.tmp
push ebp
call fcn.00535470
add esp, 0x10
push 0x180
push 0x8301
push ebp
call fcn.00535c20
add esp, 0xc
mov ebp, eax
cmp ebp, 0xffffffff
je 0x4fce8b
mov eax, dword [ebx + esi*4 + 0x14c8]
mov ecx, dword [ebx + esi*4 + 0x1408]
push eax
push ecx
push ebp
call fcn.00536060
add esp, 0xc
push ebp
call fcn.005358e0
add esp, 4
jmp 0x4fcf46
cmp edi, 1
jne 0x4fcf2a
mov eax, dword [ebx + esi*4 + 0x12c8]
lea edx, [esp + 0x10]
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x4fcebf
or cl, cl
je 0x4fcebb
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x4fcebf
add eax, 2
add edx, 2
or cl, cl
jne 0x4fce9f
xor eax, eax
jmp 0x4fcec4
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4fcf2a
mov eax, dword [ebx + esi*4 + 0x12c8]
lea edx, [esp + 0x44]
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x4fcef3
or cl, cl
je 0x4fceef
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x4fcef3
add eax, 2
add edx, 2
or cl, cl
jne 0x4fced3
xor eax, eax
jmp 0x4fcef8
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4fcf2a
mov eax, dword [ebx + esi*4 + 0x1348]
mov ecx, dword [0x5681d8]
push eax
nop
mov eax, dword [ecx + 0xc]
lea ecx, [ebx + 0x11e8]
add eax, 0x102b
push eax
push str._s_s.per
push ecx
call fcn.00535470
add esp, 0x10
jmp 0x4fcf46
mov eax, dword [ebx + esi*4 + 0x1348]
lea ecx, [ebx + 0x11e8]
push eax
push 0x55f1e8
push ecx
call fcn.00535470
add esp, 0xc
lea eax, [ebx + 0x11e8]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x16c
ret 8
Function at 0x51a920
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov eax, 0x1004
call fcn.00536770
push ebx
push esi
push edi
mov esi, ecx
push ebp
xor ebx, ebx
mov byte [esp + 0x14], bl
push 1
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x51a94f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1004
ret
mov eax, dword [esi + 0x20]
mov ebp, dword [sym.imp.USER32.dll_OpenClipboard]
mov ecx, dword [eax + 4]
push ecx
call ebp
test eax, eax
jne 0x51a96f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1004
ret
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [esp + 0x10], eax
test eax, eax
je 0x51a9d0
push eax
mov ebp, dword [sym.imp.KERNEL32.dll_GlobalLock]
call ebp
mov ebp, eax
test ebp, ebp
je 0x51a9d0
push ebp
call fcn.00538720
add esp, 4
mov ebx, eax
cmp ebx, 0xfff
jle 0x51a9a6
mov ebx, 0xfff
lea edi, [esp + 0x14]
xor eax, eax
mov ecx, 0x400
push ebx
rep stosd dword es:[edi], eax
lea eax, [esp + 0x18]
push ebp
push eax
call fcn.005382f0
mov eax, dword [esp + 0x1c]
add esp, 0xc
mov ebp, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
nop
push eax
call ebp
call dword [sym.imp.USER32.dll_CloseClipboard]
movsx eax, word [esi + 0x1ac]
movsx ecx, word [esi + 0x1ae]
add eax, ebx
cmp eax, ecx
jl 0x51aa1b
mov ecx, dword [esi + 0x198]
test ecx, ecx
je 0x51aa06
call fcn.004d6f40
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1004
ret
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBeep]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1004
ret
mov edi, dword [esi + 0x1a4]
mov eax, dword [esi + 0x1a0]
cmp eax, edi
jne 0x51aa35
mov ebp, edi
mov edi, dword [esi + 0x1a8]
jmp 0x51aa3b
mov ebp, dword [esi + 0x1a8]
mov dword [esi + 0x1a0], edi
mov byte [edi], 0
movsx eax, word [esi + 0x1b4]
push eax
push ebp
push edi
call fcn.005382f0
add esp, 0xc
movsx eax, word [esi + 0x1b4]
push eax
push ebp
call fcn.00537dd0
add esp, 8
mov ebp, eax
movsx eax, word [esi + 0x1b4]
push eax
push edi
call fcn.00537dd0
add esp, 8
mov edi, eax
lea eax, [esp + 0x14]
push ebx
push eax
push edi
call fcn.005382f0
add esp, 0xc
push ebx
push edi
call fcn.00537dd0
movsx ecx, word [esi + 0x1ac]
movsx edx, word [esi + 0x1b4]
add esp, 8
sub ecx, edx
inc ecx
push ecx
push ebp
push eax
call fcn.005382f0
add word [esi + 0x1ac], bx
add esp, 0xc
add word [esi + 0x1b4], bx
mov ecx, esi
call fcn.0051ab00
mov ecx, esi
call fcn.0051ac80
mov dword [esi + 0x194], 1
mov ebp, dword [sym.imp.WINMM.dll_timeGetTime]
call ebp
pop ebp
mov dword [esi + 0x190], eax
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x1004
ret
Function at 0x5308f0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x10
push ebx
push esi
mov si, dx
push edi
xor ax, ax
mov edx, dword [ecx + 0x10]
push ebp
mov ebx, ecx
mov edi, edx
mov ebp, dword [esp + 0x24]
mov cx, word [edx]
cmp cx, si
jae 0x530966
cmp ax, cx
jae 0x530918
mov ax, cx
mov edx, dword [edx + 2]
cmp edi, edx
jne 0x530908
test ebp, 2
je 0x530950
test ebp, 0x40
jne 0x530950
cmp dword [0x56b400], 0
je 0x530950
push 0
mov edx, esi
mov ecx, ebx
call dword [0x56b400]
cmp ax, si
jb 0x530950
mov edx, dword [ebx + 0x10]
test edx, edx
jne 0x530908
and ax, 0xfffc
mov ecx, dword [ebx + 4]
mov word [ecx], ax
pop ebp
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
and cx, 0xfffc
mov eax, 0x10
sub cx, si
test ebp, 0x4000
jne 0x530981
xor eax, eax
mov ax, word [ebx + 0x18]
movzx edi, cx
mov dword [esp + 0x14], edi
cmp edi, eax
jge 0x5309c2
lea ecx, [edx + 2]
mov dword [esp + 0x10], edx
mov edi, dword [esp + 0x10]
mov edx, dword [ecx]
mov eax, dword [edi + 6]
mov dword [eax + 2], edx
mov eax, dword [edi + 6]
mov ecx, dword [ecx]
mov dword [ecx + 6], eax
mov si, word [edi]
or si, 1
mov word [edi], si
and si, 0xfffc
movzx eax, si
or byte [eax + edi], 2
jmp 0x530a50
test ebp, 6
je 0x530a2a
mov ax, word [edx]
mov dword [esp + 0x10], edx
and ax, 2
or ax, si
or al, 1
mov word [edx], ax
mov edi, dword [edx + 2]
mov dword [esp + 0x18], edi
mov edi, dword [edx + 6]
mov eax, dword [esp + 0x18]
mov dword [edi + 2], eax
mov edi, dword [edx + 6]
mov dword [esp + 0x18], edi
mov edi, dword [edx + 2]
mov eax, dword [esp + 0x18]
mov dword [edi + 6], eax
mov eax, dword [esp + 0x14]
movzx edi, si
add edx, edi
mov word [eax + edx - 2], cx
or cl, 2
mov word [edx], cx
mov ecx, dword [ebx + 0x14]
mov dword [edx + 6], ecx
mov eax, dword [ecx + 2]
mov dword [edx + 2], eax
mov eax, dword [ecx + 2]
mov dword [eax + 6], edx
mov dword [ecx + 2], edx
jmp 0x530a50
mov edi, dword [esp + 0x14]
add edi, edx
movzx eax, si
mov word [edi - 2], cx
mov dword [esp + 0x10], edi
or cl, 2
mov word [edx], cx
mov edx, dword [edx + 2]
or byte [eax + edi], 2
mov ax, si
or al, 1
mov word [edi], ax
test ebp, 1
mov dword [ebx + 0x10], edx
je 0x530a78
mov edi, dword [esp + 0x10]
xor eax, eax
movzx esi, si
sub esi, 2
add edi, 2
mov ecx, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, esi
and ecx, 3
rep stosb byte es:[edi], al
test ebp, 2
je 0x530aa2
mov eax, dword [edx + 6]
cmp dword [edx + 2], eax
jne 0x530aa2
mov eax, dword [ebx + 0x14]
mov ecx, dword [eax + 2]
mov ax, word [ecx]
mov ecx, dword [ebx + 4]
and ax, 0xfffc
mov word [ecx], ax
mov ecx, dword [ebx + 4]
or byte [ecx + 3], 0x80
inc word [ebx + 0xc]
mov eax, dword [esp + 0x10]
add eax, 2
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x531050
Capabilities:
Enumerate pe sections

Disassembly:
mov ax, word [ecx]
sub esp, 0x10
add dx, 9
push ebx
and dx, 0xfff8
push esi
push edi
push ebp
mov di, ax
and di, 0x7ffc
cmp dx, 0x10
ja 0x531075
mov dx, 0x10
cmp di, dx
jb 0x5310f6
mov si, di
mov ebx, 0x10
sub si, dx
test ah, 0x80
jne 0x531097
mov eax, ecx
xor ebx, ebx
and eax, 0xffff0000
mov bx, word [eax + 0x18]
movzx eax, si
cmp eax, ebx
jl 0x5311dc
movzx eax, di
lea edi, [eax + ecx]
mov ax, word [edi]
test al, 1
jne 0x5310da
and ax, 0xfffc
add si, ax
mov eax, ecx
and eax, 0xffff0000
cmp dword [eax + 0x10], edi
jne 0x5310c8
mov ebx, dword [edi + 2]
mov dword [eax + 0x10], ebx
mov eax, dword [edi + 2]
mov ebx, dword [edi + 6]
mov dword [ebx + 2], eax
mov ebx, dword [edi + 6]
mov eax, dword [edi + 2]
mov dword [eax + 6], ebx
mov ebx, ecx
and ebx, 0xffff0000
mov eax, dword [ebx + 4]
cmp word [eax], si
jae 0x53119f
mov word [eax], si
jmp 0x53119f
movzx esi, di
lea ebp, [esi + ecx]
mov ax, word [ebp]
test al, 1
jne 0x53120b
xor ebx, ebx
mov bx, ax
and ebx, 0xfffc
add ebx, esi
movzx esi, dx
cmp ebx, esi
jl 0x53120b
mov ebx, ecx
and ebx, 0xffff0000
cmp dword [ebx + 0x10], ebp
jne 0x531133
mov eax, dword [ebp + 2]
mov dword [ebx + 0x10], eax
lea eax, [ebp + 6]
lea esi, [ebp + 2]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], esi
mov eax, dword [esi]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x14]
mov esi, dword [eax]
mov eax, dword [esp + 0x18]
mov dword [esi + 2], eax
mov eax, dword [esp + 0x14]
mov esi, dword [eax]
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
mov dword [eax + 6], esi
mov ax, word [ebp]
and ax, 0xfffc
mov si, di
sub si, dx
add si, ax
test byte [ecx + 1], 0x80
je 0x531184
mov dword [esp + 0x18], 0x10
jmp 0x53118e
xor edi, edi
mov di, word [ebx + 0x18]
mov dword [esp + 0x18], edi
movzx edi, si
mov dword [esp + 0x1c], edi
mov edi, dword [esp + 0x18]
cmp dword [esp + 0x1c], edi
jl 0x5311e9
mov ax, word [ecx]
and ax, 0x8003
or ax, dx
movzx edx, dx
mov word [ecx], ax
add ecx, edx
mov ax, si
or al, 2
mov word [ecx], ax
mov edx, dword [ebx + 0x14]
mov dword [ecx + 6], edx
mov ebx, dword [edx + 2]
mov dword [ecx + 2], ebx
mov ebx, dword [edx + 2]
movzx eax, si
mov dword [ebx + 6], ecx
mov dword [edx + 2], ecx
add ecx, eax
mov word [ecx - 2], si
and word [ecx], 0xfffd
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x10
ret
add ax, word [ecx]
mov word [ecx], ax
xor eax, eax
mov ax, word [ebp]
and eax, 0xfffc
or byte [eax + ebp], 2
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x10
ret
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x5324e0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x3c
mov dword [esp + 0x14], ecx
push ebx
push esi
push edi
push ebp
mov esi, edx
xor edi, edi
mov dword [esp + 0x1c], edi
call fcn.005334e0
test eax, eax
jne 0x532500
mov dword [esp + 0x50], edi
inc dword [esp + 0x50]
mov ebx, dword [esp + 0x50]
shl ebx, 2
mov ecx, ebx
call fcn.00532150
mov dword [esp + 0x20], eax
test eax, eax
jne 0x532526
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x3c
ret 8
mov edi, dword [esp + 0x50]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, dword [esp + 0x20]
mov dword [ecx], eax
mov eax, dword [esp + 0x54]
lea ebp, [eax + ebx - 4]
add ebx, ecx
sub ebp, 4
sub ebx, 4
dec edi
je 0x532565
mov eax, dword [ebp]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebx], eax
test eax, eax
jne 0x532540
jmp 0x53266b
call fcn.005334e0
test eax, eax
je 0x532587
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 0x30]
mov edi, dword [esp + 0x34]
mov dword [esp + 0x18], ecx
jmp 0x532594
mov dword [esp + 0x18], Ordinal_1
mov edi, 0xbfffffff
cmp dword [esp + 0x24], 0
jne 0x5325ca
mov eax, edi
sub eax, dword [esp + 0x18]
cdq
sub eax, edx
sar eax, 1
mov ebx, eax
call fcn.00535190
mov ebp, eax
call fcn.00535190
imul ebp, eax
mov eax, ebp
sub edx, edx
div ebx
mov eax, dword [esp + 0x18]
add eax, edx
add eax, ebx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
and eax, 0xffff0000
mov dword [esp + 0x28], eax
mov dword [esp + 0x10], eax
mov ebp, edi
mov ebx, dword [esp + 0x20]
sub ebp, dword [esp + 0x10]
mov eax, dword [esp + 0x50]
mov dword [esp + 0x24], eax
mov ecx, ebx
lea eax, [esp + 0x14]
add ebx, 4
push eax
mov edx, dword [esp + 0x14]
push edi
push esi
mov ecx, dword [ecx]
call fcn.005326c0
test eax, eax
je 0x53262c
mov ecx, dword [esp + 0x10]
sub ebp, eax
add ebp, ecx
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x14]
cmp ebp, ecx
jl 0x53261e
mov ebp, ecx
test eax, eax
je 0x532638
cmp ebp, esi
jl 0x53262c
dec dword [esp + 0x24]
jne 0x5325ed
test eax, eax
je 0x532638
cmp ebp, esi
jl 0x532638
mov dword [esp + 0x1c], eax
add dword [esp + 0x10], ebp
cmp dword [esp + 0x10], edi
jb 0x53265a
mov eax, dword [esp + 0x28]
cmp eax, dword [esp + 0x18]
je 0x53265a
mov edi, eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x28], eax
mov dword [esp + 0x10], eax
cmp dword [esp + 0x1c], 0
jne 0x53266b
cmp dword [esp + 0x10], edi
jb 0x5325db
cmp dword [esp + 0x20], 0
je 0x5326a4
dec dword [esp + 0x50]
je 0x53269b
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x50]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edi, [ecx + eax*4]
mov eax, dword [edi]
test eax, eax
je 0x53269b
push eax
sub edi, 4
call esi
dec dword [esp + 0x50]
jne 0x532689
mov ecx, dword [esp + 0x20]
call fcn.00532170
mov eax, dword [esp + 0x1c]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x3c
ret 8
Function at 0x5330a0
Capabilities:
Check mutex on windows

Disassembly:
push esi
push edi
mov esi, ecx
mov edi, dword [esp + 0xc]
cmp dword [edi], 0
jne 0x5330c0
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esi], eax
mov dword [edi], 1
push 0xffffffffffffffff
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, 1
pop edi
pop esi
ret 4

Function at 0x5330e0
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
push ebp
call fcn.00533080
mov edi, eax
test edi, edi
je 0x533142
cmp dword [edi + 0xc], 0
jne 0x533124
lea ebp, [esi + 0x4c]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, ebp
mov ecx, esi
call fcn.00533150
push ebp
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [edi + 0xc], eax
test eax, eax
jne 0x533138
call ebx
cmp eax, 0xb7
je 0x533100
test edi, edi
je 0x533142
cmp dword [edi + 0xc], 0
je 0x533142
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
ret
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
ret
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x535640
Capabilities:
Delete file

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
mov eax, 0
jne 0x53565a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x53566d
push eax
call fcn.0053c220
add esp, 4
mov eax, 0xffffffff
ret
xor eax, eax
ret