joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409c20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dc2fb
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x51ec70]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x234], esi
cmp edi, 0x23
je 0x409c88
cmp edi, 0x1a
je 0x409c88
xor eax, eax
mov dword [esi + 0x10], 0
push eax
mov dword [esi + 0x14], 7
mov ecx, esi
push 0x4f1708
mov word [esi], ax
call fcn.004197d0
jmp 0x409d62
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push edi
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x409c63
xor eax, eax
mov dword [ebp - 0x220], 0
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409ce0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x230]
call fcn.004197d0
push 0x11
push 0x4f24b8
lea ecx, [ebp - 0x230]
mov dword [ebp - 4], 0
call fcn.00419500
cmp byte [ebp + 0x10], 0
lea eax, [ebp - 0x230]
push eax
jne 0x409d31
mov ecx, esi
call fcn.00406620
jmp 0x409d57
call fcn.00421dd0
add esp, 4
mov ecx, esi
test al, al
je 0x409d4d
lea eax, [ebp - 0x230]
push eax
call fcn.00406620
jmp 0x409d57
push 0x4f1708
call fcn.00406860
lea ecx, [ebp - 0x230]
call fcn.00407580
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d761c
mov esp, ebp
pop ebp
ret
Function at 0x40a250
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 8
push ebx
push edi
test ecx, ecx
je 0x40a3da
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x40a3da
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x40a3da
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x40a3da
push esi
xor esi, esi
cmp edi, 2
jbe 0x40a32a
mov dword [ebp - 8], 4
mov dh, byte [ecx]
sub edi, 3
mov dl, byte [ecx + 1]
mov bl, dh
mov ah, byte [ecx + 2]
mov al, dl
and bl, 3
shr al, 4
shl bl, 4
and dl, 0xf
add bl, al
shl dl, 2
mov al, ah
mov byte [ebp - 1], ah
shr al, 6
add ecx, 3
add dl, al
mov dword [ebp + 8], ecx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x14]
ja 0x40a3c1
mov ecx, dword [ebp + 0x10]
movzx eax, dh
shr eax, 2
mov al, byte [eax + 0x4f2090]
mov byte [esi + ecx], al
movzx eax, bl
mov ebx, ecx
mov ecx, dword [ebp + 8]
mov al, byte [eax + 0x4f2090]
mov byte [esi + ebx + 1], al
movzx eax, dl
mov al, byte [eax + 0x4f2090]
mov byte [esi + ebx + 2], al
movzx eax, byte [ebp - 1]
and eax, 0x3f
mov al, byte [eax + 0x4f2090]
mov byte [esi + ebx + 3], al
add esi, 4
mov eax, dword [ebp - 8]
add eax, 4
mov dword [ebp - 8], eax
cmp edi, 2
ja 0x40a297
test edi, edi
je 0x40a3bc
xor dh, dh
mov word [ebp + 9], 0
xor ah, ah
mov byte [ebp + 8], dh
xor dl, dl
test edi, edi
je 0x40a35c
push edi
push ecx
lea eax, [ebp + 8]
push eax
call sub.msvcrt.dll_memcpy
mov ah, byte [ebp + 0xa]
add esp, 0xc
mov dl, byte [ebp + 9]
mov dh, byte [ebp + 8]
mov al, dl
shr ah, 6
mov cl, dh
shr al, 4
and dh, 3
shr cl, 2
and dl, 0xf
shl dh, 4
shl dl, 2
add dh, al
add dl, ah
lea eax, [esi + 4]
cmp eax, dword [ebp + 0x14]
ja 0x40a3c1
movzx eax, cl
mov al, byte [eax + 0x4f2090]
mov byte [esi + ebx], al
movzx eax, dh
mov al, byte [eax + 0x4f2090]
mov byte [esi + ebx + 1], al
add esi, 2
lea ecx, [esi + ebx]
cmp edi, 1
jne 0x40a3a9
mov al, 0x3d
jmp 0x40a3b2
movzx eax, dl
mov al, byte [eax + 0x4f2090]
mov byte [ecx], al
mov byte [esi + ebx + 1], 0x3d
add esi, 2
cmp esi, dword [ebp + 0x14]
jb 0x40a3cd
pop esi
pop edi
mov eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [esi + ebx], 0
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40ac40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dc41c
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x51ec70]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x22c], eax
test edi, edi
je 0x40ae9a
test esi, esi
je 0x40ae9a
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x228], 1
lea eax, [ebp - 0x21c]
mov ebx, 0x104
mov dword [ebp - 0x21c], ebx
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x228]
push eax
push esi
push edi
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x40ad3b
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x40ad3b
mov ebx, eax
lea ecx, [ebp - 0x220]
lea eax, [ebp - 0x218]
push eax
call fcn.00406060
push 0
push 0x4f2080
lea ecx, [ebp - 0x220]
mov dword [ebp - 4], 0
call fcn.00413580
push dword [ebp - 0x220]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x220]
test eax, eax
jne 0x40adbf
call fcn.00407190
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x21c], ebx
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x228]
push eax
push esi
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x40ae9a
test ebx, ebx
je 0x40ae9a
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x224]
call fcn.00406060
push 0
push 0x4f2080
lea ecx, [ebp - 0x224]
mov dword [ebp - 4], 1
call fcn.00413580
push dword [ebp - 0x224]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea ecx, [ebp - 0x224]
test eax, eax
je 0x40ae95
mov dword [ebp - 4], 0xffffffff
call fcn.00407190
call fcn.0040bd80
mov ecx, eax
test ecx, ecx
je 0x40aeb8
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 2
test eax, 0xffff0000
jne 0x40ae06
movzx eax, ax
lea ecx, [ebp - 0x21c]
push eax
call fcn.00412970
jmp 0x40ae32
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40ae10
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x21c]
call fcn.00413d30
push 0
push 0x4f2080
lea ecx, [ebp - 0x21c]
mov dword [ebp - 4], 3
call fcn.00413580
mov esi, dword [ebp - 0x21c]
mov edx, esi
lea edi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x40ae56
mov ecx, dword [ebp - 0x22c]
sub edx, edi
sar edx, 1
push edx
push esi
call fcn.004197d0
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40ae91
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov al, 1
jmp 0x40ae9c
call fcn.00407190
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d761c
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004098f0
int3
Function at 0x40afe0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dc48b
mov eax, dword fs:[0]
push eax
sub esp, 0x144
mov eax, dword [0x51ec70]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [esi + 4], 0
mov edi, dword [ebp + 0xc]
je 0x40b12e
cmp dword [ebp + 8], 0
je 0x40b12e
test edi, edi
je 0x40b12e
push 0x118
lea eax, [ebp - 0x128]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x12c], 0x11c
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40b0c3
cmp dword [ebp - 0x128], 6
ja 0x40b0c3
jne 0x40b073
cmp dword [ebp - 0x124], 1
jae 0x40b0c3
mov eax, 0x17
mov dword [ebp - 0x138], 0xb
mov word [ebp - 0x140], ax
lea edx, [ebp - 0x140]
mov eax, dword [esi + 8]
push edx
push 3
push eax
mov ecx, dword [eax]
call dword [ecx + 0x60]
mov eax, 0xb
lea edx, [ebp - 0x150]
mov word [ebp - 0x150], ax
or eax, 0xffffffff
mov word [ebp - 0x148], ax
mov eax, dword [esi + 8]
push edx
push 2
push eax
mov ecx, dword [eax]
call dword [ecx + 0x60]
mov dword [ebp - 0x130], 0
mov eax, dword [esi + 8]
lea edx, [ebp - 0x130]
push 0
push edx
push eax
mov ecx, dword [eax]
mov dword [ebp - 4], 0
call dword [ecx + 0x58]
test eax, eax
js 0x40b111
mov eax, dword [ebp - 0x130]
test eax, eax
je 0x40b117
push dword [ebp + 0x10]
mov ecx, dword [eax]
push edi
push 3
push eax
call dword [ecx + 0x18]
test eax, eax
je 0x40b111
mov eax, dword [ebp - 0x130]
mov esi, 1
jmp 0x40b119
mov eax, dword [ebp - 0x130]
xor esi, esi
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x40b12a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
jmp 0x40b130
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d761c
mov esp, ebp
pop ebp
ret 0xc

Function at 0x40bca0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x51ec70]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push 0x208
mov dword [ebp - 0x214], esi
push 0
push eax
mov dword [ebp - 0x210], 1
mov dword [ebp - 0x214], 0x104
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x210]
push eax
push str.Path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsQHSafeMain.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
test eax, eax
je 0x40bd31
xor eax, eax
mov word [esi], ax
push 0
push 0x4f1708
jmp 0x40bd67
xor eax, eax
cmp dword [ebp - 0x210], 1
mov word [esi], ax
jne 0x40bd28
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
jmp 0x40bd50
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40bd50
sub ecx, edx
lea eax, [ebp - 0x20c]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.004197d0
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004d761c
mov esp, ebp
pop ebp
ret
Function at 0x40c910
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x51ec70]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push 0x208
push 0
push eax
mov dword [ebp - 0x214], esi
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x210], 0x208
lea eax, [ebp - 0x210]
mov dword [ebp - 0x214], 1
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push str.Path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsQHSafeMain.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x40c9d4
mov eax, dword [ebp - 0x210]
shr eax, 1
dec eax
cmp eax, 0x104
jae 0x40c9d4
cmp word [ebp + eax*2 - 0x20c], 0x5c
je 0x40c9cc
cmp eax, 0x103
jae 0x40c9d4
mov ecx, 0x5c
mov word [ebp + eax*2 - 0x20c], cx
lea eax, [eax*2 + 2]
cmp eax, 0x208
jae 0x40c9f2
xor ecx, ecx
mov word [ebp + eax - 0x20c], cx
lea eax, [ebp - 0x20c]
jmp 0x40c9d9
mov eax, 0x4f1708
push eax
mov ecx, esi
call fcn.00406060
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004d761c
mov esp, ebp
pop ebp
ret
call fcn.004ab010
int3
Function at 0x40e260
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dca18
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x51ec70]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp byte [ebx + 0x418], 0
jne 0x40e403
lea esi, [ebx + 0x41c]
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [ebx + 0x418], 0
mov dword [ebp - 4], 0
jne 0x40e3fc
xor eax, eax
mov dword [ebx + 0x208], 0
push eax
push 0x28
push ebx
mov dword [ebx + 0x414], 0
lea edi, [ebx + 0x20c]
push eax
mov word [ebx], ax
mov word [edi], ax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40e300
push str.:windows_
push ebx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x40e38b
mov dword [ebp - 0x10], 0
call fcn.00412630
test al, al
jne 0x40e3fc
mov eax, dword [ebp + 8]
test eax, eax
je 0x40e3fc
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x18], eax
cmp dword [0x51c5b8], eax
je 0x40e37d
test eax, eax
je 0x40e37d
lea ecx, [ebp + 8]
mov dword [ebp + 8], 0
push ecx
push 8
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40e37d
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x104
push eax
push ebx
push dword [ebp + 8]
call dword [sym.imp.USERENV.dll_GetUserProfileDirectoryW]
test eax, eax
je 0x40e374
mov dword [ebp - 0x10], 1
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x18]
call fcn.00407e70
cmp dword [ebp - 0x10], 0
je 0x40e3fc
push ebx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40e397
push 0x104
sub ecx, edx
push edi
sar ecx, 1
push ebx
mov dword [ebx + 0x208], ecx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
je 0x40e3c4
cmp eax, 0x104
jb 0x40e3c9
xor eax, eax
mov word [edi], ax
push edi
push ebx
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x40e3d8
mov word [edi], ax
lea ecx, [edi + 2]
jmp 0x40e3e0
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x40e3e0
sub edi, ecx
mov byte [ebx + 0x418], 1
sar edi, 1
mov dword [ebx + 0x414], edi
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x411070
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dcf86
mov eax, dword fs:[0]
push eax
sub esp, 0x458
mov eax, dword [0x51ec70]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
test esi, esi
jne 0x4110ac
xor al, al
jmp 0x41129a
xor bl, bl
mov dword [ebp - method.CommonLib::CFileVersion.virtual_0], vtable.CommonLib::CFileVersion.0
mov dword [ebp - 0x24c], 0
lea eax, [ebp - 0x464]
mov dword [ebp - 4], 0
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
je 0x41127b
mov eax, dword [ebp - 0x24c]
test eax, eax
je 0x4110f3
push eax
call sub.msvcrt.dll_free
add esp, 4
push edi
call sub.msvcrt.dll_malloc
add esp, 4
mov dword [ebp - 0x24c], eax
test eax, eax
je 0x411298
push eax
push edi
push 0
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x41127b
lea eax, [ebp - 0x460]
mov dword [ebp - 0x460], 0
push eax
lea eax, [ebp - 0x45c]
push eax
push str.VarFileInfoTranslation
push dword [ebp - 0x24c]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x41127b
mov ecx, dword [ebp - 0x45c]
mov esi, dword [sym.imp.SHLWAPI.dll_wnsprintfW]
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
push 0x4f2404
lea eax, [ebp - 0x454]
push 0x208
push eax
call esi
add esp, 0x14
mov dword [ebp - 0x460], 0
cmp dword [ebp - 0x24c], 0
mov dword [ebp - 0x45c], 0
je 0x411298
lea eax, [ebp - 0x454]
push eax
push str._sProductName
lea eax, [ebp - 0x218]
push 0x208
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x24c]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x41127b
cmp dword [ebp - 0x45c], 0
je 0x41127b
mov eax, dword [ebp - 0x460]
test eax, eax
je 0x41127b
push eax
lea ecx, [ebp - 0x230]
call fcn.00406860
push 0
push 0x28
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 1
call fcn.0041bb60
push 0
push 0x29
lea ecx, [ebp - 0x230]
mov esi, eax
call fcn.0041bb60
cmp esi, 0xffffffff
je 0x411270
cmp eax, 0xffffffff
je 0x411270
cmp eax, esi
jbe 0x411270
sub eax, esi
lea ecx, [ebp - 0x230]
dec eax
push eax
lea eax, [esi + 1]
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.0041dc80
push str.Professional
lea ecx, [ebp - 0x248]
call fcn.00414e80
mov bl, al
lea ecx, [ebp - 0x248]
xor bl, 1
call fcn.00407580
lea ecx, [ebp - 0x230]
call fcn.00407580
mov ecx, dword [ebp - 0x24c]
mov dword [ebp - method.CommonLib::CFileVersion.virtual_0], vtable.CommonLib::CFileVersion.0
test ecx, ecx
je 0x411298
push ecx
call sub.msvcrt.dll_free
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d761c
mov esp, ebp
pop ebp
ret

Function at 0x4112c0
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
setne al
mov esp, ebp
pop ebp
ret
Function at 0x411c55
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1fbc
push ebx
push esi
push edi
push ecx
and ecx, 0x16536
pop ecx
push ecx
push ecx
add esp, 4
call 0x4119f9
add byte [eax + 0x39], al
dec esi
cmp dh, byte [0x4a373b3b]
add esp, 4
xor ecx, 0x12cee
add ecx, 0x11254
xor ecx, 0x1560b
pop ecx
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
mov word [ebp - 0x1ee4], dx
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push ecx
push esi
add esp, 4
xor ecx, 0xb843
xor ecx, 0xd66
or ecx, 0x15969
pop ecx
push ecx
push eax
add esp, 4
add ecx, 0x14d99
jmp 0x411ae9
and ecx, 0x3ae0
pop ecx
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push ebx
push ecx
add esp, 4
sub ebx, 0xe06c
sub ebx, 0x306
pop ebx
push esi
push edx
add esp, 4
call 0x411b51
add byte [eax + eax*2 + 0x34], al
cmp ecx, dword [edi + edi + 0x4d]
cmp al, 0x3c
add esp, 4
pop esi
push edx
xor edx, 0xa6aa
pop edx
mov dword [ebp - 0x10], 1
push edx
push ebx
add esp, 4
xor edx, 0xb2fd
and edx, 0x7bec
or edx, 0x5bc
sub edx, 0xae7d
pop edx
push edx
push edi
add esp, 4
sub edx, 0x16597
pop edx
push esi
or esi, 0xf410
pop esi
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push esi
push eax
add esp, 4
sub esi, 0x113c2
and esi, 0x92b1
and esi, 0x2158
pop esi
push edi
and edi, 0x3b72
sub edi, 0xbd96
pop edi
push edx
push edx
add esp, 4
sub edx, 0xd9a6
pop edx
push edx
xor edx, 0xb0
pop edx
push ebx
push ebx
add esp, 4
or ebx, 0xbd33
sub ebx, 0x4179
add ebx, 0xae8a
call 0x411c22
add byte [edi], dh
dec edx
inc edi
inc edx
inc edx
dec eax
cmp eax, 0x4c48334
pop ebx
mov dword [ebp - 0x2c], 1
push esi
sub esi, 0xb650
and esi, 0x114c5
pop esi
push eax
sub eax, 0xb8f8
or eax, 0x17d7d
call 0x411c55
add byte [edx], dh
dec esp
dec eax
dec ebx
inc ebp
cmp byte [0x8104c483], bh
enter 0xffffffffffffba87, 0
add byte [eax + 0x69], bl
push ebp
aam 0x38
add dword [eax], eax
add byte [ecx - 0xc9bb43e], al
inc esp
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x138
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x411e40
Function at 0x41664e
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x6f4]
add edx, 1
mov dword [ebp - 0x6f4], edx
mov eax, dword [ebp - 0x6f0]
mov ecx, dword [ebp - 0x6f4]
cmp ecx, dword [eax + 0x18]
jae 0x4166ab
mov edx, dword [ebp - 0x6f4]
mov eax, dword [ebp - 0x18a0]
mov ecx, dword [ebp - 0x2f8]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x6f8], ecx
mov edx, dword [ebp - 0x6f4]
mov eax, dword [ebp - 0x18a4]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x18a8]
mov eax, dword [ebp - 0x2f8]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x18ac], eax
mov dword [ebp - 0x180], 0
jmp 0x41650f
mov ecx, dword [ebp - 0x180]
add ecx, 1
mov dword [ebp - 0x180], ecx
mov edx, dword [ebp - 0x6f8]
add edx, dword [ebp - 0x180]
movsx eax, byte [edx]
test eax, eax
je 0x4165c1
mov ecx, dword [ebp - 0x180]
movsx edx, byte [ebp + ecx - 0x820]
test edx, edx
je 0x4165c1
push esi
and esi, 0x143cb
sub esi, 0x544f
sub esi, 0x1169b
pop esi
push edx
push eax
add esp, 4
xor edx, 0x6737
and edx, 0x14e01
sub edx, 0x117be
sub edx, 0x128c9
pop edx
mov eax, dword [ebp - 0x6f8]
add eax, dword [ebp - 0x180]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x180]
movsx eax, byte [ebp + edx - 0x820]
cmp ecx, eax
je 0x4165b3
mov ecx, dword [ebp - 0x6f8]
add ecx, dword [ebp - 0x180]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x180]
movsx ecx, byte [ebp + eax - 0x820]
cmp edx, ecx
jne 0x4165ba
jmp 0x416500
jmp 0x4165c1
push edi
jmp 0x4165c8
or edi, 0x455d
pop edi
push eax
jmp 0x4165d8
pop eax
push eax
and eax, 0x17028
and eax, 0x46b1
pop eax
push eax
push esi
add esp, 4
add eax, 0x2f1d
pop eax
mov edx, dword [ebp - 0x6f8]
add edx, dword [ebp - 0x180]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x180]
movsx edx, byte [ebp + ecx - 0x820]
cmp eax, edx
jne 0x416620
mov dword [ebp - 0xc30], 0
jmp 0x41668f
push edx
or edx, 0xc642
pop edx
push esi
add esi, 0x16ea1
pop esi
push edx
jmp 0x416639
pop edx
push ebx
or ebx, 0xc41b
call fcn.0041664e
add byte [edi], bh
dec ebp
inc ebx
aas
dec edx
inc ebp
add esp, 4
add esp, 4
add esp, 4
pop ebx
mov eax, dword [ebp - 0x6f8]
add eax, dword [ebp - 0x180]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x180]
movsx eax, byte [ebp + edx - 0x820]
or eax, 0x20
cmp ecx, eax
jge 0x416685
mov dword [ebp - 0xc30], 0xffffffff
jmp 0x41668f
mov dword [ebp - 0xc30], 1
cmp dword [ebp - 0xc30], 0
jne 0x4166a6
mov ecx, dword [ebp - 0x18ac]
mov dword [ebp - 0x3c4], ecx
jmp 0x4166b7
jmp 0x416490
mov edx, dword [ebp - 0x6fc]
mov dword [ebp - 0x3c4], edx
cmp dword [ebp - 0x3c4], 0
je 0x416792
push edx
push esi
add esp, 4
add edx, 0x1768b
xor edx, 0x3562
or edx, 0x125ba
jmp 0x4166e3
pop edx
push eax
push edx
add esp, 4
add eax, 0x28af
add eax, 0x542e
pop eax
mov eax, dword [ebp - 0x3c4]
mov dword [ebp - 0x18b0], eax
push ebx
sub ebx, 0x12f69
pop ebx
push edi
push edi
add esp, 4
call 0x41671e
add byte [ebx + 0x48], al
xor esi, dword [edi]
cmp al, 0x3e
dec eax
aaa
inc edx
add esp, 4
call 0x416730
add byte [edx + eax*2 + 0x32], al
cmp al, 0x50
xor al, 0x49
dec ecx
cmp dword [ebx - 0x74a0fb3c], eax
lea edx, [eax - 0x19]
invalid