joyce8/EMBER2024-capa huggingface dataset:
Function at 0x65a120
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x691c39
mov eax, dword fs:[0]
push eax
sub esp, 0x508
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x514]
mov ecx, 0x142
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x6aac14]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
call fcn.0060f380
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x18]
mov dword [eax], vtable.CFsWrite.0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 4
call fcn.00603810
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x18]
add ecx, 0x20
call fcn.00603500
mov byte [ebp - 4], 2
mov esi, esp
lea eax, [ebp - 0x228]
push eax
push 0x104
push 0xb
call fcn.0066fb20
add esp, 4
call eax
cmp esi, esp
call fcn.00673bc2
mov esi, esp
lea eax, [ebp - 0x438]
push eax
push 0
push 0x699884
lea ecx, [ebp - 0x228]
push ecx
push 0xb
call fcn.0066fb20
add esp, 4
call eax
cmp esi, esp
call fcn.00673bc2
mov esi, esp
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x438]
push eax
push 0x21
call fcn.0066fb20
add esp, 4
call eax
cmp esi, esp
call fcn.00673bc2
push eax
lea ecx, [ebp - 0x444]
call fcn.006302d0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x444]
call fcn.00644080
movzx eax, al
test eax, eax
jne 0x65a278
mov esi, esp
push 0
lea eax, [ebp - 0x450]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea ecx, [ebp - 0x444]
call fcn.00643500
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp esi, esp
call fcn.00673bc2
lea eax, [ebp - 0x438]
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 0x20
call fcn.006035a0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x444]
call fcn.00605f60
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
push edx
mov ecx, ebp
push eax
lea edx, [0x65a2d0]
call fcn.00673be5
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00673bb3
add esp, 0x514
cmp ebp, esp
call fcn.00673bc2
mov esp, ebp
pop ebp
ret 0xc
Function at 0x65a430
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xd8]
mov ecx, 0x36
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
add ecx, 0x20
call fcn.0065b790
movzx eax, al
test eax, eax
jne 0x65a505
mov ecx, dword [ebp - 8]
add ecx, 4
call fcn.0065b790
movzx eax, al
test eax, eax
jne 0x65a505
mov ecx, dword [ebp - 8]
add ecx, 4
call fcn.00603950
mov esi, esp
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp esi, esp
call fcn.00673bc2
mov ecx, dword [ebp - 8]
add ecx, 4
call fcn.00603950
mov esi, esp
push eax
mov ecx, dword [ebp - 8]
add ecx, 0x20
call fcn.00603950
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
cmp esi, esp
call fcn.00673bc2
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
add ecx, 4
call fcn.00603950
push eax
mov ecx, dword [ebp - 8]
add ecx, 0x20
call fcn.00603950
push eax
push 0x7c8e
push 0x5a1d
push str.rahe_6zkKFWr6qG2aBceqx2blcr6qG1e1Auy2nL5Ar6qx8w
push 0x18a1
call fcn.00655b80
add esp, 0x10
push eax
call fcn.00654400
add esp, 0x10
pop edi
pop esi
pop ebx
add esp, 0xd8
cmp ebp, esp
call fcn.00673bc2
mov esp, ebp
pop ebp
ret

Function at 0x65bf00
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xcc]
mov ecx, 0x33
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov dword [eax], 0x67452301
mov eax, dword [ebp - 8]
mov dword [eax + 4], 0xefcdab89
mov eax, dword [ebp - 8]
mov dword [eax + 8], 0x98badcfe
mov eax, dword [ebp - 8]
mov dword [eax + 0xc], 0x10325476
mov eax, dword [ebp - 8]
mov dword [eax + 0x10], 0xc3d2e1f0
mov eax, dword [ebp - 8]
mov dword [eax + 0x30], 0
mov dword [eax + 0x34], 0
push 0x695e25
mov ecx, dword [ebp - 8]
add ecx, 0x14
call fcn.006034b0
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.00673bc2
mov esp, ebp
pop ebp
ret
Function at 0x667700
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x692528
mov eax, dword fs:[0]
push eax
sub esp, 0x224
push ebx
push esi
push edi
lea edi, [ebp - 0x230]
mov ecx, 0x89
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x6aac14]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x30]
call fcn.00603500
mov dword [ebp - 4], 0
push 0x11c
push 0
lea eax, [ebp - 0x154]
push eax
call fcn.00673dc0
add esp, 0xc
mov dword [ebp - 0x154], 0x11c
mov esi, esp
lea eax, [ebp - 0x154]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp esi, esp
call fcn.00673bc2
cmp dword [ebp - 0x150], 6
jb 0x6677bd
cmp dword [ebp - 0x14c], 1
jb 0x6677bd
mov dword [ebp - 0x160], str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
lea eax, [ebp - 0x30]
push eax
push str.Progid
mov ecx, dword [ebp - 0x160]
push ecx
push 1
call fcn.00669bc0
add esp, 0x10
jmp 0x66781d
push 0x4f04
push 0x5cc1
push str.qoJ129iUq4hvzOO8nKNH_NOGjaxB8Kwl7h64fuwi6NWw
push 0x5824
call fcn.00655c40
add esp, 0x10
mov dword [ebp - 0x16c], eax
lea eax, [ebp - 0x30]
push eax
push 0x694bc4
mov ecx, dword [ebp - 0x16c]
push ecx
push 1
call fcn.00669bc0
add esp, 0x10
movzx edx, al
test edx, edx
jne 0x66781d
lea eax, [ebp - 0x30]
push eax
push 0x694bc4
mov ecx, dword [ebp - 0x16c]
push ecx
push 0x102
call fcn.00669bc0
add esp, 0x10
lea eax, [ebp - 0x30]
push eax
push str.browser
call fcn.00668410
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.006038c0
push edx
mov ecx, ebp
push eax
lea edx, [0x667878]
call fcn.00673be5
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00673bb3
add esp, 0x230
cmp ebp, esp
call fcn.00673bc2
mov esp, ebp
pop ebp
ret

Function at 0x6694f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf0
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xf0]
mov ecx, 0x3c
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
xor eax, eax
jne 0x669513
xor eax, eax
jne 0x669513
mov dword [ebp - 0x20], 4
mov esi, esp
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x2c]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp esi, esp
call fcn.00673bc2
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x669557
mov eax, dword [ebp - 0x14]
jmp 0x669566
cmp dword [ebp - 0x2c], 4
je 0x669564
mov eax, 0xd
jmp 0x669566
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x669590]
call fcn.00673be5
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0xf0
cmp ebp, esp
call fcn.00673bc2
mov esp, ebp
pop ebp
ret 8
Function at 0x6695c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf0
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xf0]
mov ecx, 0x3c
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
xor eax, eax
jne 0x6695e3
xor eax, eax
jne 0x6695e3
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
shl ecx, 1
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov esi, esp
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x20]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp esi, esp
call fcn.00673bc2
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x669633
mov eax, dword [ebp - 0x14]
jmp 0x669690
cmp dword [ebp - 0x20], 1
je 0x669646
cmp dword [ebp - 0x20], 2
je 0x669646
mov eax, 0xd
jmp 0x669690
cmp dword [ebp + 0xc], 0
je 0x669684
cmp dword [ebp - 0x2c], 0
je 0x66967c
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov ecx, 2
div ecx
test edx, edx
jne 0x669673
mov eax, dword [ebp - 0x2c]
shr eax, 1
mov ecx, dword [ebp + 0xc]
movzx edx, word [ecx + eax*2 - 2]
test edx, edx
je 0x66967a
mov eax, 0xd
jmp 0x669690
jmp 0x669684
xor eax, eax
mov ecx, dword [ebp + 0xc]
mov word [ecx], ax
mov eax, dword [ebp - 0x2c]
shr eax, 1
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x6696b8]
call fcn.00673be5
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0xf0
cmp ebp, esp
call fcn.00673bc2
mov esp, ebp
pop ebp
ret 0xc
Function at 0x66a370
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6928c8
mov eax, dword fs:[0]
push eax
sub esp, 0x368
push ebx
push esi
push edi
lea edi, [ebp - 0x374]
mov ecx, 0xda
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x6aac14]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov byte [ebp - 0x15], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x3c]
call fcn.00603810
mov dword [ebp - 4], 0
lea eax, [ebp - 0x3c]
push eax
call fcn.00669960
add esp, 4
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x3c]
call fcn.00603950
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
jne 0x66a40f
mov byte [ebp - 0x36d], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.006038c0
mov al, byte [ebp - 0x36d]
jmp 0x66a520
mov eax, dword [ebp - 0x54]
push eax
call fcn.006729de
add esp, 4
mov dword [ebp - 0x364], eax
mov ecx, dword [ebp - 0x364]
mov dword [ebp - 0x60], ecx
mov eax, dword [ebp - 0x60]
push eax
mov ecx, dword [ebp - 0x54]
push ecx
mov edx, dword [ebp - 0x48]
push edx
lea ecx, [ebp - 0x3c]
call fcn.00603950
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x66a4ea
lea eax, [ebp - 0x78]
push eax
lea ecx, [ebp - 0x6c]
push ecx
push 0x69884c
mov edx, dword [ebp - 0x60]
push edx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x66a4ea
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax + 0xc]
and ecx, 0xffff
movzx edx, cx
push edx
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax + 0xc]
shr ecx, 0x10
and ecx, 0xffff
movzx edx, cx
push edx
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax + 8]
and ecx, 0xffff
movzx edx, cx
push edx
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax + 8]
shr ecx, 0x10
and ecx, 0xffff
movzx edx, cx
push edx
push 0x2f44
push str.3Kkdquv73Kkdqus
push 0x48e
call fcn.00655c40
add esp, 0xc
push eax
lea eax, [ebp - 0x280]
push eax
call fcn.0061e220
add esp, 0x18
lea eax, [ebp - 0x280]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.006035a0
mov byte [ebp - 0x15], 1
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x358], eax
mov ecx, dword [ebp - 0x358]
push ecx
call fcn.006737c4
add esp, 4
mov al, byte [ebp - 0x15]
mov byte [ebp - 0x349], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.006038c0
mov al, byte [ebp - 0x349]
push edx
mov ecx, ebp
push eax
lea edx, [0x66a55c]
call fcn.00673be5
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00673bb3
add esp, 0x374
cmp ebp, esp
call fcn.00673bc2
mov esp, ebp
pop ebp
ret
Function at 0x66a710
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d4
push ebx
push esi
push edi
lea edi, [ebp - 0x2d4]
mov ecx, 0xb5
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x6aac14]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0x18]
call fcn.006035a0
mov eax, dword [ebp + 0x18]
push eax
call fcn.00669960
add esp, 4
mov ecx, dword [ebp + 0x18]
call fcn.00603950
mov esi, esp
push eax
push 0x104
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp esi, esp
call fcn.00673bc2
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp + 0x18]
call fcn.006035a0
push edx
mov ecx, ebp
push eax
lea edx, [0x66a7c0]
call fcn.00673be5
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00673bb3
add esp, 0x2d4
cmp ebp, esp
call fcn.00673bc2
mov esp, ebp
pop ebp
ret
Function at 0x66e260
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x692c8a
mov eax, dword fs:[0]
push eax
sub esp, 0x304
push ebx
push esi
push edi
lea edi, [ebp - 0x310]
mov ecx, 0xc1
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x6aac14]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30c], 0
mov esi, esp
lea eax, [ebp - 0x21c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp esi, esp
call fcn.00673bc2
push 0x69b6fc
lea ecx, [ebp - 0x240]
call fcn.00603810
mov dword [ebp - 4], 1
push 0x69b6f4
lea ecx, [ebp - 0x240]
call fcn.00611c10
push 0x69b6ec
lea ecx, [ebp - 0x240]
call fcn.00611c10
lea ecx, [ebp - 0x240]
call fcn.00603950
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.00676968
add esp, 8
lea eax, [ebp - 0x21c]
push eax
mov ecx, dword [ebp + 8]
call fcn.00603810
mov ecx, dword [ebp - 0x30c]
or ecx, 1
mov dword [ebp - 0x30c], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x240]
call fcn.006038c0
mov eax, dword [ebp + 8]
push edx
mov ecx, ebp
push eax
lea edx, [0x66e384]
call fcn.00673be5
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00673bb3
add esp, 0x310
cmp ebp, esp
call fcn.00673bc2
mov esp, ebp
pop ebp
ret

Function at 0x67278c
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x6ac760], 0
push esi
push edi
jne 0x672702
call fcn.0067266e
test eax, eax
je 0x672747
mov eax, dword [0x6ac760]
cmp eax, 1
jne 0x672723
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x672747
jmp 0x672789
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x672789
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x67274b
xor eax, eax
jmp 0x672789
mov eax, dword [esi]
push dword [0x6ac760]
call edi
mov edi, eax
test edi, edi
je 0x67276d
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x672789
lea edi, [esi + 0xff0]
push esi
push dword [0x6ac760]
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x672773
mov eax, esi
pop edi
pop esi
ret
jmp 0x6726ee

Function at 0x673bb3
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6aac14]
jne 0x673bbd
repz ret
jmp fcn.0067c22c
Function at 0x688357
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x6aac14]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0067bcca
and dword [ebp - 0x14], 0
cmp dword [0x6ad830], 0
mov dword [ebp - 0x18], eax
jne 0x68840a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x6884b2
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x69f674
push ebx
call edi
test eax, eax
je 0x6884b2
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x6ad830], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x6ad834], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x6ad838], eax
call edi
push eax
call esi
mov dword [0x6ad840], eax
test eax, eax
je 0x68840a
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x6ad83c], eax
mov eax, dword [0x6ad83c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x688463
cmp dword [0x6ad840], ecx
je 0x688463
push eax
call esi
push dword [0x6ad840]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x688463
test ebx, ebx
je 0x688463
call edi
test eax, eax
je 0x68845a
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x68845a
test byte [ebp - 8], 1
jne 0x688463
or dword [ebp + 0x10], 0x200000
jmp 0x688496
mov eax, dword [0x6ad834]
cmp eax, dword [ebp - 0x18]
je 0x688496
push eax
call esi
test eax, eax
je 0x688496
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x688496
mov eax, dword [0x6ad838]
cmp eax, dword [ebp - 0x18]
je 0x688496
push eax
call esi
test eax, eax
je 0x688496
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x6ad830]
call esi
test eax, eax
je 0x6884b2
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x6884b4
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00673bb3
leave
ret
Function at 0x4013cf
Capabilities:
Get number of processors

Disassembly:
mov ecx, 0x508330
jmp 0x4013c3
mov eax, 0x4c79c4
call fcn.00496f6c
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.004014f4
mov eax, dword [0x503d10]
lea ecx, [esi + 0xac]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ecx], eax
mov eax, dword [0x503d10]
mov dword [esi + 0xb4], eax
push 1
mov dword [esi], 0x4ce7cc
pop eax
mov ebx, 0x50832c
push 0xa
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 7
or dword [esi + 0x28], 0xffffffff
or dword [esi + 0x24], 0xffffffff
pop edx
push 0x64
mov dword [esi + 0x30], edi
mov dword [esi + 0x64], edx
mov dword [esi + 0x6c], edx
mov dword [esi + 0x2c], edi
pop edx
mov dword [esi + 0x34], 2
mov dword [esi + 0x38], eax
push ebx
mov byte [ebp - 4], 2
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], 5
mov dword [esi + 0x60], eax
mov dword [esi + 0x68], eax
mov dword [esi + 0x9c], edx
mov dword [esi + 0xa0], edx
mov dword [esi + 0xa4], edi
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], eax
mov dword [esi + 0x78], 0x3e8
mov dword [esi + 0x7c], eax
mov dword [esi + 0x80], eax
mov dword [esi + 0x84], eax
mov dword [esi + 0x88], eax
mov dword [esi + 0x8c], 0xc0
mov dword [esi + 0x90], 0x6c
mov dword [esi + 0x94], eax
mov dword [esi + 0x98], edi
mov dword [esi + 0xa8], edi
call fcn.004b226d
push ebx
lea ecx, [esi + 0xb4]
mov dword [esi + 0xb0], edi
call fcn.004b226d
or dword [esi + 0xc0], 0xffffffff
or dword [esi + 0xbc], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0xb8], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40d369
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x4c8968
call fcn.00496f6c
sub esp, 0x22c
push ebx
push esi
mov dword [ebp - 0x2c], ecx
mov esi, 0x5083f8
push str.DataFile_Types
mov ecx, esi
call fcn.004c4ed1
xor ebx, ebx
mov dword [ebp - 0x18], eax
cmp eax, ebx
jne 0x40d39f
xor eax, eax
jmp 0x40d4e7
mov eax, dword [0x503d10]
push edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x38]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push eax
push ebx
push ebx
lea eax, [ebp - 0x24]
push ebx
push eax
lea eax, [ebp - 0x238]
mov byte [ebp - 4], 2
push eax
push ebx
push dword [ebp - 0x18]
mov dword [ebp - 0x24], 0x100
mov dword [ebp - 0x20], ebx
call edi
cmp eax, 0x103
je 0x40d4b7
lea eax, [ebp - 0x238]
push eax
push str.DataFile_Types
lea eax, [ebp - 0x10]
push 0x4ef100
push eax
call fcn.004afa07
add esp, 0x10
lea eax, [ebp - 0x28]
mov ecx, esi
push ebx
push str.Name
push dword [ebp - 0x10]
push eax
call fcn.004c4f83
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.004b221d
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.004b20d6
push ebx
push str.Extension
push dword [ebp - 0x10]
lea eax, [ebp - 0x30]
mov ecx, esi
push eax
call fcn.004c4f83
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 4
call fcn.004b221d
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 2
call fcn.004b20d6
push 0xffffffffffffffff
push str.Icon
push dword [ebp - 0x10]
mov ecx, esi
call fcn.004c4f17
mov ecx, dword [ebp - 0x14]
cmp dword [ecx - 8], ebx
je 0x40d490
mov edx, dword [ebp - 0x1c]
cmp dword [edx - 8], ebx
je 0x40d490
cmp eax, 0xffffffff
je 0x40d490
push eax
push edx
push ecx
mov ecx, dword [ebp - 0x2c]
call fcn.0040d5d4
lea eax, [ebp - 0x38]
inc dword [ebp - 0x20]
push eax
push ebx
push ebx
lea eax, [ebp - 0x24]
push ebx
push eax
lea eax, [ebp - 0x238]
mov dword [ebp - 0x24], 0x100
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x18]
jmp 0x40d3db
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.004b20d6
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], bl
call fcn.004b20d6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004b20d6
push 1
pop eax
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret