joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40dd30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x228
mov eax, dword [0x44a1a0]
xor eax, esp
mov dword [esp + 0x224], eax
test ecx, ecx
je 0x40ddcd
cmp word [ecx], 0
je 0x40ddcd
lea eax, [esp + 0x14]
mov dword [esp], 0
push 0x44cdfc
mov dword [esp + 0x14], eax
xor eax, eax
push ecx
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 2
mov dword [esp + 0x14], pe_nt_image_headers32
mov word [esp + 0x1c], ax
call fcn.0040c8a0
test al, al
je 0x40ddc5
push ebx
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
lea ecx, [esp + 4]
setne bl
call fcn.00408240
mov al, bl
pop ebx
mov ecx, dword [esp + 0x224]
xor ecx, esp
call fcn.0041e8c8
add esp, 0x228
ret
lea ecx, [esp]
call fcn.00408240
mov ecx, dword [esp + 0x224]
xor al, al
xor ecx, esp
call fcn.0041e8c8
add esp, 0x228
ret

Function at 0x40ddf0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x26c
mov eax, dword [0x44a1a0]
xor eax, esp
mov dword [esp + 0x268], eax
push ebx
test ecx, ecx
je 0x40dee5
cmp word [ecx], 0
je 0x40dee5
lea eax, [esp + 0x54]
mov dword [esp + 0x40], 0
push 0x44cdfc
mov dword [esp + 0x54], eax
xor eax, eax
push ecx
lea ecx, [esp + 0x48]
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 2
mov dword [esp + 0x54], pe_nt_image_headers32
mov word [esp + 0x5c], ax
call fcn.0040c8a0
test al, al
je 0x40dedc
push 0x34
lea eax, [esp + 0x10]
mov dword [esp + 0xc], 0
push 0
push eax
call fcn.00422270
add esp, 0xc
push dword [esp + 0x50]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40debc
lea eax, [esp + 8]
push eax
push dword [esp + 0x54]
call fcn.0041fe8c
add esp, 8
test eax, eax
je 0x40debc
lea ecx, [esp + 0x40]
xor bl, bl
call fcn.00408240
mov al, bl
pop ebx
mov ecx, dword [esp + 0x268]
xor ecx, esp
call fcn.0041e8c8
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0x40]
mov bl, 1
call fcn.00408240
mov al, bl
pop ebx
mov ecx, dword [esp + 0x268]
xor ecx, esp
call fcn.0041e8c8
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0x40]
call fcn.00408240
mov ecx, dword [esp + 0x26c]
xor al, al
pop ebx
xor ecx, esp
call fcn.0041e8c8
mov esp, ebp
pop ebp
ret

Function at 0x40df00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x228
mov eax, dword [0x44a1a0]
xor eax, esp
mov dword [esp + 0x224], eax
push ebx
lea eax, [esp + 0x18]
mov dword [esp + 4], 0
push 0x44cdfc
mov dword [esp + 0x18], eax
xor eax, eax
push ecx
lea ecx, [esp + 0xc]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], pe_nt_image_headers32
mov word [esp + 0x20], ax
call fcn.0040c8a0
test al, al
je 0x40df6e
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40df6e
test al, 1
je 0x40df6e
mov bl, 1
jmp 0x40df70
xor bl, bl
lea ecx, [esp + 4]
call fcn.00408240
mov ecx, dword [esp + 0x228]
mov al, bl
pop ebx
xor ecx, esp
call fcn.0041e8c8
add esp, 0x228
ret
Function at 0x40f120
Capabilities:
Set registry value

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x20]
push ebp
push esi
push edi
mov edx, dword [ebx + 0x20]
mov ebp, ecx
cmp edx, 1
je 0x40f249
cmp edx, 2
je 0x40f249
cmp edx, 7
jne 0x40f22d
mov ecx, dword [ebx + 0x28]
xor edi, edi
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], edi
test ecx, ecx
je 0x40f1d5
lea edx, [ecx + 2]
jmp 0x40f180
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40f180
sub ecx, edx
sar ecx, 1
lea esi, [ecx*2 + 2]
test esi, esi
je 0x40f1d7
push 0
push esi
lea ecx, [esp + 0x18]
call fcn.004082a0
mov edi, eax
mov dword [esp + 0x20], edi
test edi, edi
je 0x40f1b6
mov dword [esp + 0x1c], esi
jmp 0x40f1d7
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0
xor bl, bl
call fcn.00408240
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x14
ret 0xc
xor esi, esi
push esi
push dword [ebx + 0x28]
mov dword [esp + 0x1c], esi
push edi
call fcn.00421610
add esp, 0xc
mov eax, edi
cmp word [edi], 0
je 0x40f204
cmp word [eax], 0xa
jne 0x40f1fb
xor ecx, ecx
mov word [eax], cx
add eax, 2
cmp word [eax], 0
jne 0x40f1f0
push ecx
push esi
push edi
push dword [ebx + 0x20]
mov ecx, ebp
push str.SysSafeInstallPath
call fcn.0040f0e0
lea ecx, [esp + 0x10]
mov bl, al
call fcn.00408240
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x14
ret 0xc
push ecx
push dword [ebx + 0x1c]
push dword [ebx + 0x28]
push edx
push str.SysSafeInstallPath
call fcn.0040f0e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0xc
mov esi, dword [ebx + 0x28]
test esi, esi
je 0x40f26d
mov ecx, esi
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40f255
sub ecx, edi
sar ecx, 1
lea ecx, [ecx*2 + 2]
jmp 0x40f26f
xor ecx, ecx
push ecx
push esi
push edx
push 0
push str.SysSafeInstallPath
push dword [ebp]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x40f2a7
push ecx
push str.SysSafeInstallPath
push eax
mov ecx, 0x44cdfc
call fcn.00408c20
test al, al
jne 0x40f2a7
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret 0xc
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x14
ret 0xc

Function at 0x40f440
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x18]
xorps xmm0, xmm0
movdqu xmmword [esp + 4], xmm0
mov dword [esp + 8], eax
mov eax, dword [esp + 0x1c]
push ebx
mov dword [esp + 0x10], eax
mov eax, dword [ecx + 0x28]
mov dword [esp + 0x14], eax
lea eax, [esp + 4]
push eax
push 0
push dword [esp + 0x30]
mov dword [esp + 0x10], 0
push dword [esp + 0x30]
push dword [ecx + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
sete bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
test bl, bl
je 0x40f4a8
cmp eax, 0x3e5
jne 0x40f4d2
push 0xffffffffffffffff
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x40f4ac
test eax, eax
jne 0x40f4d2
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 8]
mov dword [eax], ecx
mov eax, dword [esp + 4]
test eax, eax
je 0x40f4c9
cmp eax, 0x103
je 0x40f4c9
test ecx, ecx
je 0x40f4d2
mov al, 1
pop ebx
add esp, 0x14
ret 0x14
xor al, al
pop ebx
add esp, 0x14
ret 0x14
Function at 0x40f4e0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x18]
xorps xmm0, xmm0
movdqu xmmword [esp + 4], xmm0
mov dword [esp + 8], eax
mov eax, dword [esp + 0x1c]
push ebx
mov dword [esp + 0x10], eax
mov eax, dword [ecx + 0x28]
mov dword [esp + 0x14], eax
lea eax, [esp + 4]
push eax
push 0
push dword [esp + 0x30]
mov dword [esp + 0x10], 0
push dword [esp + 0x30]
push dword [ecx + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
sete bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
test bl, bl
je 0x40f548
cmp eax, 0x3e5
jne 0x40f56a
push 0xffffffffffffffff
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x40f54c
test eax, eax
jne 0x40f56a
cmp dword [esp + 4], 0
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 8]
mov dword [eax], ecx
je 0x40f561
test ecx, ecx
je 0x40f56a
mov al, 1
pop ebx
add esp, 0x14
ret 0x14
xor al, al
pop ebx
add esp, 0x14
ret 0x14

Function at 0x40fc60
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5c
mov eax, dword [0x44a1a0]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [esp + 0x14], ecx
test edi, edi
js 0x40fc8b
or edi, 0x80000000
mov ebx, dword [ebp + 0x18]
or edi, 0x40000000
mov edx, dword [ecx + 8]
mov eax, edi
shr eax, 0x1e
and al, 1
mov byte [ecx + 0x20], al
mov eax, ebx
and eax, 0x7fffeff
add ecx, 8
or eax, 0xe0000000
push eax
push dword [ebp + 0x14]
mov eax, dword [edx + 0x30]
push dword [ebp + 0x10]
push edi
push esi
call eax
mov edi, dword [esp + 0x14]
shr ebx, 0x1c
add edi, 0x18
not bl
mov byte [esp + 0x13], al
and bl, 1
movzx ecx, bl
mov ebx, dword [esp + 0x14]
push ecx
push dword [ebp + 0x1c]
mov ecx, 0x4d23e0
push dword [ebx + 0xc]
push edi
call fcn.0041b4e0
cmp byte [esp + 0x13], 0
je 0x40fd36
push 0x30
lea eax, [esp + 0x30]
mov dword [esp + 0x2c], 0
push 0
push eax
call fcn.00422270
add esp, 0xc
lea eax, [esp + 0x28]
push eax
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x40fd36
mov eax, dword [edi]
push 0
push 0
push dword [esp + 0x50]
add eax, 0x18
push dword [esp + 0x58]
push eax
call fcn.0041a760
add esp, 0x14
lea eax, [esp + 0x5c]
mov ecx, 2
lea edi, [ecx + 1]
test esi, esi
je 0x40fd5f
movzx edx, word [esi]
lea esi, [esi + 2]
dec ecx
test dx, dx
je 0x40fd5f
dec edi
je 0x40fd5f
mov word [eax], dx
add eax, 2
test ecx, ecx
jg 0x40fd46
xor ecx, ecx
mov word [eax], cx
xor eax, eax
mov word [esp + 0x60], ax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x40fd95
mov eax, dword [esp + 0x18]
mov dword [ebx + 0x1c], eax
mov ecx, dword [esp + 0x64]
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041e8c8
mov esp, ebp
pop ebp
ret 0x18
Function at 0x4107b0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x18
mov eax, dword [0x44a1a0]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 0
push 0
mov ebp, dword [esi + 0x28]
push ebp
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [esp + 0x10], eax
lea edi, [eax + eax]
cmp edi, 0x10
jbe 0x410826
push edi
call fcn.0041f629
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x41082c
mov ecx, dword fs:[0x2c]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x41080d
mov ecx, dword [ecx + 0x104]
test ecx, ecx
je 0x41080d
mov eax, dword [ecx]
push edi
call dword [eax + 0x14]
test ebx, ebx
jne 0x41082c
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0041e8c8
add esp, 0x18
ret
lea ebx, [esp + 0x14]
jmp 0x410830
mov eax, dword [esp + 0x10]
push eax
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ecx, dword [esi + 0x28]
lea ebp, [esi + 0x2c]
cmp ecx, ebp
je 0x410858
mov eax, dword [esi + 0x14]
shr eax, 0xa
not al
test al, 1
je 0x410858
push ecx
call fcn.0041f5f1
add esp, 4
mov dword [esi + 0x1c], 0
mov dword [esi + 0x28], ebp
mov dword [ebp], 0
cmp edi, 0x10
jbe 0x410873
mov dword [esi + 0x28], ebx
jmp 0x410882
push edi
lea eax, [esp + 0x18]
push eax
push ebp
call fcn.00421610
add esp, 0xc
mov ecx, dword [esp + 0x24]
mov al, 1
mov dword [esi + 0x1c], edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041e8c8
add esp, 0x18
ret
Function at 0x411380
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov dword [esp + 0xc], 0
push edi
mov dword [esp + 0x14], 0
mov eax, dword [esi + 0xc]
mov edx, dword [esi]
or eax, 0x20019
mov edi, dword [esi + 4]
cmp edx, 0x80000004
je 0x4113e4
cmp edx, 0x80000050
je 0x4113e4
lea ecx, [esp + 0x10]
push ecx
push eax
push 0
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4113de
push ecx
push edi
push eax
mov ecx, 0x44cdfc
call fcn.00408c20
test al, al
jne 0x4113de
xor bl, bl
jmp 0x411428
mov edx, dword [esp + 0x10]
jmp 0x4113e8
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x28]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x28]
lea eax, [esp + 0x2c]
push eax
push 0
push dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x411426
push ecx
push dword [esi + 4]
mov ecx, 0x44cdfc
push eax
call fcn.00408c20
test al, al
jne 0x411426
xor bl, bl
jmp 0x411428
mov bl, 1
mov eax, dword [esp + 0x10]
test eax, eax
je 0x411437
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov al, bl
pop ebx
add esp, 0x10
ret 0x10

Function at 0x411540
Capabilities:
Set registry value

Disassembly:
sub esp, 8
mov edx, dword [ecx + 0xc]
mov eax, dword [ecx]
or edx, 0x20006
mov dword [esp], 0
mov dword [esp + 4], 0
push ebx
push esi
mov esi, dword [ecx + 4]
cmp eax, 0x80000004
je 0x411597
cmp eax, 0x80000050
je 0x411597
lea ecx, [esp + 8]
push ecx
push edx
push 0
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x41159b
push ecx
push esi
push eax
mov ecx, 0x44cdfc
call fcn.00408c20
test al, al
je 0x4115cd
jmp 0x41159b
mov dword [esp + 8], eax
push dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
push dword [esp + 0x1c]
push dword [esp + 0x2c]
push 0
push esi
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x4115d1
push ecx
push esi
push eax
mov ecx, 0x44cdfc
call fcn.00408c20
test al, al
jne 0x4115d1
xor bl, bl
jmp 0x4115d3
mov bl, 1
mov eax, dword [esp + 8]
test eax, eax
je 0x4115e2
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov al, bl
pop ebx
add esp, 8
ret 0x14
Function at 0x4115f0
Capabilities:
Delete registry value

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x1c]
push esi
mov esi, ecx
mov dword [esp + 0xc], 0
push edi
mov dword [esp + 0x14], 0
mov ecx, dword [esi + 0xc]
mov eax, dword [esi]
or ecx, 0xf003f
mov edi, dword [esi + 4]
cmp eax, 0x80000004
je 0x41164c
cmp eax, 0x80000050
je 0x41164c
lea edx, [esp + 0x10]
push edx
push ecx
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x411650
push ecx
push edi
push eax
mov ecx, ebx
call fcn.00408c20
test al, al
je 0x411672
jmp 0x411650
mov dword [esp + 0x10], eax
push dword [esp + 0x20]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x411676
push ecx
push dword [esi + 4]
mov ecx, ebx
push eax
call fcn.00408c20
test al, al
jne 0x411676
xor bl, bl
jmp 0x411678
mov bl, 1
mov eax, dword [esp + 0x10]
test eax, eax
je 0x411687
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov al, bl
pop ebx
add esp, 0x10
ret 8

Function at 0x412300
Capabilities:
Create thread
Resume thread

Disassembly:
push ecx
push ebx
mov ebx, ecx
push esi
push edi
cmp byte [ebx + 0x260], 0
je 0x412341
call fcn.00411fd0
movzx eax, al
mov dword [ebx + 0x128], eax
test eax, eax
jne 0x412330
mov ecx, dword [esp + 0x14]
push dword [ebx + 0xe0]
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebx + 0x128], 0
setne al
pop edi
pop esi
pop ebx
pop ecx
ret 4
mov esi, dword [ebx + 0x1bc]
lea eax, [ebx + 0x25c]
push eax
push 4
push ebx
push 0x4121e0
push dword [ebx + 0x258]
push 0
call fcn.0041f81d
add esp, 0x18
lea ecx, [ebx + 0x1bc]
push eax
call dword [esi + 8]
mov eax, dword [ebx + 0x1bc]
lea ecx, [ebx + 0x1bc]
mov eax, dword [eax + 0x10]
call eax
test al, al
je 0x4123c4
mov eax, dword [ebx + 0x254]
cmp eax, 3
jge 0x4123a3
push dword [eax*4 + 0x4425cc]
push dword [ebx + 0x1c0]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [ebx + 0x14]
shr eax, 0xb
not al
test al, 1
je 0x4123bb
push dword [ebx + 0x1c0]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov al, 1
pop edi
pop esi
pop ebx
pop ecx
ret 4
mov ecx, dword [esp + 0x14]
push str.Cannot_create_thread
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
pop edi
pop esi
pop ebx
pop ecx
ret 4
Function at 0x412710
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x994
mov eax, dword [0x44a1a0]
xor eax, esp
mov dword [esp + 0x990], eax
xor eax, eax
push esi
mov esi, dword [esp + 0x9a0]
mov word [esp + 0x194], ax
lea eax, [esp + 0x9a8]
push eax
push dword [esp + 0x9a8]
lea eax, [esp + 0x19c]
push 0xffffffffffffffff
push 0x400
push eax
call fcn.00420a77
add esp, 0x14
test eax, eax
jns 0x41276a
xor eax, eax
mov word [esp + 0x992], ax
cmp byte [0x44f683], 0
je 0x4127ed
push ebx
push edi
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov edi, eax
test edi, edi
je 0x4127a0
test esi, esi
je 0x41278b
cmp word [esi], 0
jne 0x4127a0
push 0xc8
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea esi, [esp + 0xc]
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [esp + 0x9a4]
mov ebx, eax
or ecx, 0x10000
lea eax, [esp + 0x19c]
push ecx
push esi
push eax
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
mov esi, eax
test ebx, ebx
je 0x4127d3
push ebx
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop ebx
mov eax, esi
pop esi
mov ecx, dword [esp + 0x990]
xor ecx, esp
call fcn.0041e8c8
add esp, 0x994
ret
mov ecx, dword [esp + 0x99c]
and ecx, 0xf
cmp ecx, 4
je 0x412820
cmp ecx, 3
je 0x412820
xor eax, eax
cmp ecx, 5
pop esi
sete al
inc eax
mov ecx, dword [esp + 0x990]
xor ecx, esp
call fcn.0041e8c8
add esp, 0x994
ret
mov ecx, dword [esp + 0x994]
mov eax, 6
pop esi
xor ecx, esp
call fcn.0041e8c8
add esp, 0x994
ret

Function at 0x4136a0
Capabilities:
Print debug messages

Disassembly:
push esi
push edi
mov edi, ecx
push 0
lea esi, [edi + 0x80050]
push esi
call fcn.00403dd0
add esp, 8
test eax, eax
je 0x4136ea
cmp dword [edi + 0x8000c], 0
je 0x4136df
push 0
push esi
call fcn.00403dd0
push eax
push 0x442908
push 0
push 0xffffffffffffffff
push edi
call fcn.00413760
add esp, 0x1c
jmp 0x4136ea
push str.Messages_missed__likely_during_startup._r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [edi + 0x80020]
call fcn.00404e60
lea esi, [edi + 0x80008]
mov ecx, esi
call fcn.004139e0
mov ecx, esi
call fcn.00408240
and dword [esi], 0xfffffffc
mov dword [esi + 4], 0
mov dword [esi + 0xc], 0
mov eax, dword [edi]
test eax, eax
je 0x41373c
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, dword [edi]
test eax, eax
je 0x413736
push eax
call fcn.0041f5f1
add esp, 4
mov dword [edi], 0
mov eax, dword [edi]
test eax, eax
je 0x41374b
push eax
call fcn.0041f5f1
add esp, 4
mov dword [edi], 0
pop edi
pop esi
ret
Function at 0x414850
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [0x4d0b40]
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, ecx
test eax, eax
je 0x414878
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4d0b40]
mov bl, 1
jmp 0x41487a
xor bl, bl
cmp dword [0x4d0b54], 0
jne 0x4148a0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionTime_Zones
call fcn.004140a0
test al, al
jne 0x41489b
push str.SOFTWAREMicrosoftWindowsCurrentVersionTime_Zones
call fcn.004140a0
mov eax, dword [0x4d0b40]
test bl, bl
je 0x4148af
test eax, eax
je 0x4148af
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, dword [edi + 0x14]
mov esi, dword [0x4d0b54]
shr ebx, 9
and ebx, 0xffffff01
mov dword [esp + 0x14], ebx
test esi, esi
je 0x414995
lea ecx, [ecx]
test bl, bl
je 0x4148ed
lea eax, [esi + 0x1c]
push eax
lea ecx, [edi + 0x1c]
call fcn.00414630
test al, al
jne 0x4149a3
jmp 0x41498a
mov eax, dword [edi + 0x70]
cmp word [eax], 0
je 0x41493f
mov ecx, dword [esi + 0x70]
test ecx, ecx
je 0x41498a
test eax, eax
je 0x41498a
push eax
push ecx
call fcn.0041eb22
add esp, 8
test eax, eax
sete al
test al, al
je 0x41498a
lea ebx, [esi + 0x1c]
push ebx
lea ecx, [edi + 0x1c]
call fcn.00414550
test al, al
jne 0x41499f
push ebx
lea ecx, [edi + 0x1c]
call fcn.004145c0
mov ebx, dword [esp + 0x14]
test al, al
jne 0x4149a3
jmp 0x41498a
mov eax, dword [esi + 0x34]
cmp eax, dword [edi + 0x34]
jne 0x41498a
mov eax, dword [esi + 0x38]
cmp eax, dword [edi + 0x38]
jne 0x41498a
mov eax, dword [esi + 0x3c]
cmp eax, dword [edi + 0x3c]
jne 0x41498a
lea edx, [edi + 0x44]
mov ebx, 0xc
lea ecx, [esi + 0x44]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x414986
add ecx, 4
add edx, 4
sub ebx, 4
jae 0x414962
push ecx
lea edx, [edi + 0x54]
lea ecx, [esi + 0x54]
call fcn.004031c0
add esp, 4
test al, al
jne 0x41499f
mov ebx, dword [esp + 0x14]
mov esi, dword [esi + 4]
test esi, esi
jne 0x4148d0
xor al, al
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [esp + 0x14]
mov eax, dword [esi + 0x64]
xor ecx, ecx
mov dword [edi + 0x64], eax
mov eax, dword [esi + 0x68]
mov dword [edi + 0x68], eax
mov eax, dword [esi + 8]
test eax, eax
je 0x4149c8
mov eax, dword [eax + 0xc]
cmp eax, esi
je 0x4149c8
nop
mov eax, dword [eax + 4]
inc ecx
cmp eax, esi
jne 0x4149c0
mov eax, dword [edi]
mov dword [edi + 0x88], ecx
mov ecx, edi
push dword [esi + 0x18]
call dword [eax + 0x10]
push dword [esi + 0x70]
lea ecx, [edi + 0x70]
call fcn.004065a0
cmp dword [edi + 0x7c], 0
je 0x4149f3
mov eax, dword [edi + 0x78]
xor ecx, ecx
mov word [eax], cx
jmp 0x4149fa
mov dword [edi + 0x78], 0x43c8e0
cmp dword [edi + 0x84], 0
je 0x414a10
mov eax, dword [edi + 0x80]
xor ecx, ecx
mov word [eax], cx
jmp 0x414a1a
mov dword [edi + 0x80], 0x43c8e0
test bl, bl
jne 0x414a36
push ecx
lea ecx, [edi + 0x1c]
call fcn.004085d0
mov eax, dword [edi + 0x1c]
lea ecx, [edi + 0x1c]
push 1
add esi, 0x1c
push esi
call dword [eax + 4]
pop edi
mov al, 1
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x417130
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
mov ebx, dword [esi + 0x14]
test ebx, ebx
je 0x4171d0
add ebx, ebx
cmp ebx, dword [esi + 0x38]
jbe 0x41717c
mov eax, dword [esi + 0x2c]
shr eax, 0xa
test al, 1
jne 0x417328
cmp dword [esi + 0x3c], 0
je 0x417163
lea ecx, [esi + 0x2c]
call fcn.00408240
push 0
push ebx
lea ecx, [esi + 0x2c]
call fcn.004082a0
mov dword [esi + 0x3c], eax
test eax, eax
je 0x41728d
mov dword [esi + 0x38], ebx
mov dword [esi + 0x30], 0
cmp dword [esi + 0x4c], 0x8800
jae 0x4171c9
mov eax, dword [esi + 0x40]
shr eax, 0xa
test al, 1
jne 0x417328
cmp dword [esi + 0x50], 0
je 0x4171a8
lea ecx, [esi + 0x40]
call fcn.00408240
push 0
push 0x8800
lea ecx, [esi + 0x40]
call fcn.004082a0
mov dword [esi + 0x50], eax
test eax, eax
je 0x417299
mov dword [esi + 0x4c], 0x8800
mov dword [esi + 0x44], 0x8800
mov ecx, dword [esi + 0x50]
mov eax, dword [esi + 0x14]
add ecx, 0x400
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0x3c]
mov dword [esi + 4], eax
lea eax, [ecx + 0x8000]
mov dword [esi + 0x10], 0
mov dword [esi + 0x74], ecx
mov dword [esi + 0x78], eax
mov dword [esi + 0x20], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0xa8], 0
mov dword [esi + 0x9c], 0
mov dword [esi + 0xa0], 0
mov dword [esi + 0x80], ecx
mov dword [esi + 0x7c], ecx
mov dword [esi + 0xa4], 1
mov dword [esi + 0xc], 1
mov edi, edi
cmp dword [esi + 0x18], 0
je 0x4172b2
mov ecx, esi
call fcn.00416de0
mov edx, dword [esi + 0x14]
mov dword [esi + 0x10], eax
sub edx, dword [esi + 0x1c]
je 0x4172ac
mov ecx, dword [esi + 8]
push 0x44cdfc
push edx
push dword [esi + 0x3c]
mov eax, dword [ecx]
mov eax, dword [eax + 0xa4]
call eax
test al, al
je 0x4172a5
mov eax, dword [esi + 8]
mov eax, dword [eax + 0x14]
shr eax, 0xd
test al, 1
jne 0x4172a5
mov eax, dword [esi + 0x3c]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x14]
mov dword [esi + 0x1c], eax
jmp 0x4172ac
mov dword [esi + 0x38], 0
jmp 0x417328
mov dword [esi + 0x4c], 0
jmp 0x417328
mov dword [esi + 0x10], 0xffffffff
cmp dword [esi + 0x10], 0
je 0x417240
mov ecx, esi
call fcn.00416de0
mov edx, dword [esi + 0x14]
mov dword [esi + 0x10], eax
sub edx, dword [esi + 0x1c]
je 0x417306
mov ecx, dword [esi + 8]
push 0x44cdfc
push edx
push dword [esi + 0x3c]
mov eax, dword [ecx]
mov eax, dword [eax + 0xa4]
call eax
test al, al
je 0x4172ff
mov eax, dword [esi + 8]
mov eax, dword [eax + 0x14]
shr eax, 0xd
test al, 1
jne 0x4172ff
cmp dword [esi + 0x10], 0
mov eax, dword [esi + 0x3c]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x14]
mov dword [esi + 0x1c], eax
je 0x4172b2
jmp 0x417306
mov dword [esi + 0x10], 0xffffffff
mov eax, dword [esi + 0x10]
test eax, eax
je 0x417346
cmp eax, 1
je 0x417346
mov eax, dword [esp + 0x10]
push dword [esp + 0x14]
push 0x443368
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
add esp, 0xc
mov eax, dword [esi + 0xac]
lea ecx, [esi + 0xac]
mov dword [esi + 0x10], 0xfffffffc
call dword [eax + 0xc]
xor al, al
pop edi
pop esi
pop ebx
ret 8
mov eax, dword [esi + 0xac]
lea ecx, [esi + 0xac]
call dword [eax + 0xc]
pop edi
pop esi
mov al, 1
pop ebx
ret 8