joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439f80
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], ecx
mov eax, 4
imul ecx, eax, 0x18db
mov edx, dword [ecx + 0x49c858]
add edx, 1
mov dword [ebp - 8], edx
mov eax, 4
imul ecx, eax, 0x18db
mov edx, dword [ebp - 8]
mov dword [ecx + 0x49c858], edx
imul eax, dword [ebp - 8], 0x50920196
mov ecx, 2
imul edx, ecx, 0x1663
movsx ecx, word [edx + 0x48f8a0]
sub ecx, eax
mov edx, 4
imul eax, edx, 0x4a4f
mov edx, dword [eax + 0x49c858]
and edx, ecx
mov eax, 4
imul ecx, eax, 0x4a4f
mov dword [ecx + 0x49c858], edx
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp - 4]
mov dword [ecx + eax], 0
mov edx, 2
imul eax, edx, 0xd4d
movsx ecx, word [eax + 0x48f8a0]
sub ecx, 0x31181cdc
mov edx, 2
imul eax, edx, 0xd4d
mov word [eax + 0x48f8a0], cx
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx], 0
mov eax, 4
imul ecx, eax, 0x4d5a
mov edx, 4
imul eax, edx, 0x49fb
mov edx, dword [eax + 0x49c858]
xor edx, 0xa00d589e
mov eax, dword [ecx + 0x49c858]
and eax, edx
mov ecx, 4
imul edx, ecx, 0x4d5a
mov dword [edx + 0x49c858], eax
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx + 8], 0x67452301
mov eax, 4
imul ecx, eax, 0x1892
mov edx, dword [ecx + 0x49c858]
sub edx, 1
mov dword [ebp - 0xc], edx
mov eax, 4
imul ecx, eax, 0x1892
mov edx, dword [ebp - 0xc]
mov dword [ecx + 0x49c858], edx
mov eax, 4
imul ecx, eax, 0x56d1
imul edx, dword [ecx + 0x49c858], 0x78d032a9
and edx, dword [ebp - 0xc]
mov eax, 4
imul ecx, eax, 0x900
mov dword [ecx + 0x49c858], edx
mov edx, 4
imul eax, edx, 0x56d1
mov ecx, dword [eax + 0x49c858]
add ecx, 1
mov edx, 4
imul eax, edx, 0x56d1
mov dword [eax + 0x49c858], ecx
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx + 8], 0xefcdab89
mov eax, 4
imul ecx, eax, 0x432
mov edx, dword [ecx + 0x49c858]
xor edx, 0xe15ccec7
mov eax, 4
imul ecx, eax, 0x432
mov dword [ecx + 0x49c858], edx
mov edx, 4
shl edx, 1
mov eax, dword [ebp - 4]
mov dword [eax + edx + 8], 0x98badcfe
mov ecx, 4
imul edx, ecx, 0x573
imul eax, dword [edx + 0x49c858], 0x548c0008
mov ecx, 4
imul edx, ecx, 0x573
mov dword [edx + 0x49c858], eax
mov eax, 4
imul ecx, eax, 3
mov edx, dword [ebp - 4]
mov dword [edx + ecx + 8], 0x10325476
mov eax, 4
imul ecx, eax, 0x500b
mov edx, dword [ecx + 0x49c858]
add edx, 1
mov dword [ebp - 0x10], edx
mov eax, 4
imul ecx, eax, 0x500b
mov edx, dword [ebp - 0x10]
mov dword [ecx + 0x49c858], edx
mov eax, dword [ebp - 0x10]
xor eax, 0xa78b6fb3
mov ecx, 2
imul edx, ecx, 0x275
movsx ecx, word [edx + 0x48f8a0]
or ecx, eax
mov edx, 2
imul eax, edx, 0x275
mov word [eax + 0x48f8a0], cx
mov esp, ebp
pop ebp
ret
Function at 0x44a640
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
imul ecx, eax, 0x283a
mov edx, 4
imul eax, edx, 0x293e
mov edx, dword [eax + 0x49c858]
sar edx, 4
and edx, 0x5211a52f
mov eax, 4
imul eax, eax, 0x1229
xor edx, dword [eax + 0x49c858]
mov ecx, dword [ecx + 0x49c858]
and ecx, edx
mov edx, 4
imul eax, edx, 0x283a
mov dword [eax + 0x49c858], ecx
mov ecx, dword [0x48f008]
push ecx
call fcn.0040fc50
add esp, 4
mov edx, 4
imul eax, edx, 0x43c9
mov ecx, dword [eax + 0x49c858]
sub ecx, 0x467880bb
mov edx, 4
imul eax, edx, 0x43c9
mov dword [eax + 0x49c858], ecx
push 1
call fcn.00465540
mov ecx, 2
imul edx, ecx, 0x6648
mov eax, 4
imul ecx, eax, 0x32c5
mov eax, dword [ecx + 0x49c858]
xor eax, 0x9a2b9c46
movsx ecx, word [edx + 0x48f8a0]
imul ecx, eax
mov edx, 2
imul eax, edx, 0x6648
mov word [eax + 0x48f8a0], cx
pop ebp
ret
Function at 0x46cc05
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x48e5e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00466cdc
mov dword [ebp - 0x14], eax
cmp dword [0x4b7374], esi
jne 0x46ccf8
push 0x800
push esi
push 0x484260
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x46cc85
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x46cdd8
push esi
push esi
push 0x484260
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x46cdd8
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x46cdd8
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4b7374], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4b7378], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4b737c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4b7384], eax
test eax, eax
je 0x46ccf5
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4b7380], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x46cd1d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x46cd10
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x46cd32
push 4
pop eax
jmp 0x46cdda
cmp dword [ebp - 0x14], esi
je 0x46cd32
push dword [0x4b7374]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x46cd17
mov eax, dword [0x4b7380]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x46cd90
cmp dword [0x4b7384], edi
je 0x46cd90
push eax
call ebx
push dword [0x4b7384]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x46cd90
test eax, eax
je 0x46cd90
call ecx
test eax, eax
je 0x46cd85
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x46cd85
test byte [ebp - 8], 1
jne 0x46cd90
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x46cdc0
mov eax, dword [0x4b7378]
cmp eax, edi
je 0x46cdbd
push eax
call ebx
test eax, eax
je 0x46cdbd
call eax
mov esi, eax
test esi, esi
je 0x46cdbd
mov eax, dword [0x4b737c]
cmp eax, edi
je 0x46cdbd
push eax
call ebx
test eax, eax
je 0x46cdbd
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4b7374]
call ebx
test eax, eax
je 0x46cdd8
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x46cdda
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046ca57
mov esp, ebp
pop ebp
ret
Function at 0x401140
Capabilities:
Get geographical location

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
push 0
push 0
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov esi, eax
lea eax, [esi + 1]
push eax
call sub.MFC42.DLL_operatornew
add esp, 4
mov edi, eax
push esi
push edi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov ecx, dword [esp + 0x1c]
mov dword [ecx], edi
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x401860
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x404b50
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
sub esp, 0x14
push ebp
xor ebp, ebp
push esi
push edi
test eax, eax
mov eax, str.PerfStatsStartStat
jne 0x40188f
mov eax, str.PerfStatsStopStat
push eax
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString_1
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x30]
push eax
push 0x20019
push 0
push ecx
push inet_addr
mov dword [esp + 0x3c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401990
mov edx, dword [esp + 0x34]
lea ecx, [esp + 0x18]
push edx
call sub.MFC42.DLL_CString::CString_1
push 0x406044
push eax
lea eax, [esp + 0x1c]
mov byte [esp + 0x30], 1
push eax
call sub.MFC42.DLL_operator
mov ecx, dword [esp + 0x38]
lea edx, [esp + 0x34]
push ecx
push eax
push edx
mov byte [esp + 0x34], 2
call sub.MFC42.DLL_operator
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 5
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], 4
call sub.MFC42.DLL_CString::CString
mov edx, dword [esp + 0x34]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0xc]
lea ecx, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x34]
push 0
push ecx
push 0
push edx
push eax
call esi
test eax, eax
jne 0x401977
mov ecx, dword [esp + 0xc]
push ecx
call sub.MFC42.DLL_operatornew
mov ecx, dword [esp + 0x38]
add esp, 4
lea edx, [esp + 0xc]
mov edi, eax
push edx
mov edx, dword [esp + 0x34]
lea eax, [esp + 0x20]
push edi
push eax
push 0
push ecx
push edx
call esi
test eax, eax
jne 0x40196e
mov ebp, 1
push edi
call sub.MFC42.DLL_operatordelete
add esp, 4
mov eax, dword [esp + 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x34]
mov byte [esp + 0x28], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x20]
pop edi
mov eax, ebp
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0x20
ret 0xc
Function at 0x4019c0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x404b80
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
push str.PerfStatsStatData
lea ecx, [esp + 0xc]
xor esi, esi
call sub.MFC42.DLL_CString::CString_1
mov ecx, dword [esp + 8]
lea eax, [esp + 4]
push eax
push 0x20019
push esi
push ecx
push inet_addr
mov dword [esp + 0x38], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401aae
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 0x10]
push edx
mov dword [esp + 0x18], 4
call sub.MFC42.DLL_CString::CString_1
push 0x406044
push eax
lea eax, [esp + 0x14]
mov byte [esp + 0x2c], 1
push eax
call sub.MFC42.DLL_operator
mov ecx, dword [esp + 0x30]
lea edx, [esp + 0x2c]
push ecx
push eax
push edx
mov byte [esp + 0x30], 2
call sub.MFC42.DLL_operator
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 5
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 4
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x34]
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x30]
lea edx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0xc]
push edx
push esi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401a95
mov esi, 1
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x2c]
mov byte [esp + 0x24], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov dword [esp + 0x24], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x1c]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0x24
ret 0xc

Function at 0x402200
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40221a
test al, 0x10
jne 0x40221a
mov eax, 1
ret
xor eax, eax
ret

Function at 0x402220
Capabilities:
Get disk information

Disassembly:
sub esp, 8
mov eax, dword [0x406240]
mov cl, byte [esp + 0xc]
mov dword [esp], eax
push 0
lea edx, [esp + 0x10]
push 0
lea eax, [esp + 0xc]
push edx
push eax
mov byte [esp + 0x10], cl
push 0
push 0
lea ecx, [esp + 0x18]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
add esp, 8
ret
Function at 0x402540
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push esi
push edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov dword [esp + 8], eax
mov dword [esp + 0x18], 0x44
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x60]
test eax, eax
jne 0x402578
pop edi
pop esi
add esp, 0x54
ret
lea ecx, [esp + 8]
lea edx, [esp + 0x18]
push ecx
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4025a1
pop edi
pop esi
add esp, 0x54
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 8]
push ecx
call esi
pop edi
mov eax, 1
pop esi
add esp, 0x54
ret

Function at 0x4025c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
lea eax, [esp + 0x18]
push edi
mov ebp, 1
push eax
push ebp
push 0
push str.SoftwareEarthLink_NetworkEventMgrConSvr
push closesocket
mov dword [esp + 0x2c], 0x14
mov dword [esp + 0x28], ebp
mov dword [esp + 0x34], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x13]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
push ecx
lea eax, [esp + 0x24]
push edx
push eax
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x24]
push 0
lea edx, [esp + 0x34]
push ecx
push edx
push 0
push eax
mov edi, ebp
call ebx
mov esi, dword [esp + 0x3c]
test eax, eax
jne 0x40266e
mov edx, dword [esi + 8]
lea ecx, [esp + 0x24]
push ecx
push edx
mov ecx, esi
mov dword [esp + 0x20], 0x14
mov dword [esp + 0x1c], ebp
call sub.MFC42.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x14]
lea edx, [esp + 0x13]
push ecx
lea ecx, [esp + 0x24]
push edx
push ecx
lea edx, [esp + 0x24]
push 0
lea ecx, [esp + 0x34]
mov eax, edi
push edx
mov edx, dword [esp + 0x30]
push ecx
push eax
push edx
inc edi
call ebx
test eax, eax
je 0x402628
mov eax, dword [esi + 8]
test eax, eax
jne 0x402693
mov edi, 0x406088
mov eax, dword [edi]
mov ecx, dword [esi + 8]
push eax
push ecx
mov ecx, esi
call sub.MFC42.DLL_CStringArray::SetAtGrow
add edi, 4
cmp edi, str.192.9.48.5
jl 0x40267a
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
Function at 0x402b60
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x404d20
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x18
push ebx
mov ebx, ecx
push esi
xor esi, esi
mov eax, dword [ebx + 0x4c]
push edi
cmp eax, esi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], ebx
jne 0x402bac
mov dword [ebx + 0x10], 0x1e7
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov dword [ebp - 4], esi
call eax
cmp eax, 0xffffffff
mov dword [ebp - 0x14], eax
jne 0x402bc2
mov dword [ebx + 0x10], 6
jmp 0x402b97
xor eax, eax
mov edi, str.123456789
mov dword [ebp - 0x28], eax
or ecx, 0xffffffff
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], esi
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov word [ebp - 0x20], ax
lea edx, [ebp - 0x28]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0x57
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call sub.MFC42.DLL_operatornew
mov esi, eax
add esp, 4
test esi, esi
je 0x402cc8
mov eax, dword [ebp + 8]
mov edx, dword [ebx]
mov ecx, dword [eax]
push ecx
mov ecx, ebx
call dword [edx + 0x94]
mov dl, byte [ebp + 0x10]
mov byte [esi + 0x14], dl
mov eax, dword [ebx + 0x28]
mov dword [esi + 0x10], eax
mov ecx, dword [ebx + 0x28]
mov eax, dword [ecx - 8]
inc eax
mov word [esi + 0xc], ax
mov edx, dword [ebx + 0x24]
push edx
call sub.WSOCK32.dll_inet_addr
mov ecx, dword [ebx + 0x54]
test ecx, ecx
jne 0x402c4b
mov dword [ebx + 0x10], 0x1e7
jmp 0x402b97
push 0x5dc
push 0x57
push esi
push 0
lea edx, [ebp - 0x28]
push 9
push edx
push eax
mov eax, dword [ebp - 0x14]
push eax
call ecx
mov edi, eax
test edi, edi
je 0x402c9a
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x402ca3
mov edx, dword [ecx]
push esi
call dword [edx + 0x14]
push esi
call sub.MFC42.DLL_operatordelete
mov eax, dword [ebp - 0x14]
add esp, 4
push eax
call dword [ebx + 0x50]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + 0x10], eax
push esi
call sub.MFC42.DLL_operatordelete
mov eax, dword [ebp - 0x14]
add esp, 4
push eax
call dword [ebx + 0x50]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x18]
push eax
call dword [ebx + 0x50]
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x403410
Capabilities:
Get disk size

Disassembly:
sub esp, 0x20
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push edi
mov ebx, ecx
call ebp
lea ecx, [esp + 0x14]
lea edx, [esp + 0x10]
push ecx
push edx
lea ecx, [esp + 0x20]
mov esi, eax
lea edx, [esp + 0x24]
xor eax, eax
push ecx
push edx
push eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x40345e
mov edi, dword [esp + 0x10]
call ebp
xor edi, eax
jmp 0x403492
xor eax, eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], eax
push ecx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov ax, word [esp + 0x2e]
mov cl, byte [esp + 0x2c]
xor edx, edx
mov dl, ah
add dl, cl
xor ecx, ecx
mov cl, dl
mov ch, al
mov edi, ecx
and esi, 0xffff
and edi, 0xffff
shl esi, 0x10
or esi, edi
mov ecx, ebx
push esi
call fcn.004035d0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret

Function at 0x404060
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
mov ecx, 0x64
xor eax, eax
push edi
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
je 0x40408c
call sub.MFC42.DLL_AfxAbort
pop edi
add esp, 0x190
ret

Function at 0x404310
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov edx, dword [esp + 0xc]
lea eax, [esp]
push eax
lea eax, [esp + 8]
push edx
mov edx, dword [esp + 0x18]
push eax
mov eax, dword [ecx]
push 0
push edx
push eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
ret 8
Function at 0x4047e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x405688
push 0x4049d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffff98
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push 2
call dword [sym.imp.MSVCRT.dll___set_app_type]
add esp, 4
mov dword [0x4066d4], 0xffffffff
mov dword [0x4066d8], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x4066c8]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov edx, dword [0x4066c4]
mov dword [eax], edx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov ecx, dword [eax]
mov dword [0x4066d0], ecx
call fcn.00403400
mov eax, dword [0x4065d0]
test eax, eax
jne 0x404871
push 0x403320
call dword [sym.imp.MSVCRT.dll___setusermatherr]
add esp, 4
call fcn.004049b0
push 0x40601c
push 0x406018
call sub.MSVCRT.dll__initterm
add esp, 8
mov edx, dword [0x4066c0]
mov dword [ebp - 0x6c], edx
lea eax, [ebp - 0x6c]
push eax
mov ecx, dword [0x4066bc]
push ecx
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x60]
push ecx
call dword [sym.imp.MSVCRT.dll___getmainargs]
add esp, 0x14
push 0x406014
push section..data
call sub.MSVCRT.dll__initterm
add esp, 8
call dword [sym.imp.MSVCRT.dll___p__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x74], esi
cmp byte [esi], 0x22
jne 0x40497f
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x4048e5
cmp al, 0x22
jne 0x4048d7
cmp byte [esi], 0x22
jne 0x4048ee
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x4048fe
cmp al, 0x20
ja 0x4048fe
inc esi
mov dword [ebp - 0x74], esi
jmp 0x4048ee
mov dword [ebp - 0x30], 0
lea edx, [ebp - 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x40491f
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x404924
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x68], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
jmp 0x404964
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x20
jbe 0x4048ee
inc esi
mov dword [ebp - 0x74], esi
jmp 0x40497f
Function at 0x10005200
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push esi
push str.Enter_function
push str.MediaStatusProvider::Start
push str.C:jenkinsJelrond_setuptool_Release_Trainelrond_setuptool_winProjectselrond_setuptool_winMediaStatusProviderMediaStatusProvider.cpp
push 0
push 0x1004113c
call fcn.100012d0
add esp, 0x14
cmp dword [0x10041148], 0
je 0x10005239
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
push ecx
mov byte [0x1004114d], 0
call fcn.100045e0
test eax, eax
jne 0x10005328
mov esi, dword [0x10041150]
cmp esi, dword [0x10041154]
je 0x100052df
cmp dword [esi + 0x14], 0xf
mov eax, esi
jbe 0x1000526a
mov eax, dword [esi]
push dword [esi + 0x18]
push eax
push str.exeName____s___playerType____d_
push str.MediaStatusProvider::ShowPlayersList
push str.C:jenkinsJelrond_setuptool_Release_Trainelrond_setuptool_winProjectselrond_setuptool_winMediaStatusProviderMediaStatusProvider.cpp
push 1
push 0x1004113c
call fcn.100012d0
add esp, 0x1c
mov edx, str.exeName___
mov ecx, 0x10040618
call fcn.100092c0
cmp dword [esi + 0x14], 0xf
mov edx, esi
jbe 0x100052a5
mov edx, dword [esi]
push dword [esi + 0x10]
mov ecx, eax
call fcn.1000b8f0
add esp, 4
mov edx, str.___playerType___
mov ecx, eax
push dword [esi + 0x18]
call fcn.100092c0
mov ecx, eax
call fcn.10006d80
mov edx, 0x10039eb0
mov ecx, eax
call fcn.100092c0
add esi, 0x1c
cmp esi, dword [0x10041154]
jne 0x10005260
push 0x10041144
push 0
push 0x1004113c
push 0x10003470
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x10041148], eax
test eax, eax
jne 0x10005330
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateThread_failed_with_GetLastError___lu
push str.MediaStatusProvider::Start
push str.C:jenkinsJelrond_setuptool_Release_Trainelrond_setuptool_winProjectselrond_setuptool_winMediaStatusProviderMediaStatusProvider.cpp
push 4
push 0x1004113c
call fcn.100012d0
add esp, 0x18
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
push str.Leave_function
push str.MediaStatusProvider::Start
push str.C:jenkinsJelrond_setuptool_Release_Trainelrond_setuptool_winProjectselrond_setuptool_winMediaStatusProviderMediaStatusProvider.cpp
push 0
push 0x1004113c
call fcn.100012d0
add esp, 0x14
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret