joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40db00
Capabilities:
Access peb ldr_data
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4e42b6
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x50f130]
xor eax, esp
mov dword [esp + 0x218], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x50f130]
xor eax, esp
push eax
lea eax, [esp + 0x230]
mov dword fs:[0], eax
xor esi, esi
push 0x206
lea eax, [esp + 0x2a]
push esi
push eax
mov dword [esp + 0x24], esi
mov word [esp + 0x30], si
call fcn.004be320
mov edx, dword [0x5143ac]
mov eax, dword [edx + 0xc]
add esp, 0xc
mov ecx, 0x5143ac
call eax
lea ebp, [eax + 0x10]
mov dword [esp + 0x1c], ebp
lea ecx, [esp + 0x24]
push ecx
push 0x104
mov dword [esp + 0x240], esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, esi
je 0x40dc9b
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [esp + 0x24]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x40dba1
sub eax, edx
sar eax, 1
lea ecx, [esp + 0x24]
mov ebx, eax
push ecx
mov eax, 0x5156fc
call fcn.00401450
push 0x10
push str.TencentQQPCMgr_
push 0x5156fc
call fcn.00405fb0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0x4f0a30
lea edi, [esp + 0x24]
call fcn.00406040
mov ebp, dword [esp + 0x24]
mov eax, dword [ebp - 0xc]
add esp, 8
push eax
push ebp
push 0x5156fc
call fcn.00405fb0
mov edx, dword [0x5156fc]
push edx
call fcn.00421e10
add esp, 4
test eax, eax
jne 0x40dc66
lea ebx, [esp + 0x20]
call fcn.0040d9b0
mov edi, 0x5156fc
mov byte [esp + 0x238], 1
call fcn.004013f0
mov byte [esp + 0x238], 0
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40dc53
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [0x5156fc]
push ecx
call fcn.00421e10
add esp, 4
test eax, eax
je 0x40dc9b
mov edx, dword [0x5156fc]
push edx
push str.temp_:__ws
mov ecx, 0x515890
call fcn.004899e0
add esp, 8
call fcn.00469030
mov edx, dword [0x5156fc]
mov ecx, eax
call fcn.00468c90
mov dword [esp + 0x18], 1
jmp 0x40dca5
mov esi, 0x5156fc
call fcn.004014f0
add ebp, 0xfffffff0
mov dword [esp + 0x238], 0xffffffff
lea eax, [ebp + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40dccd
mov ecx, dword [ebp]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push ebp
call eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x230]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.004b84de
add esp, 0x228
ret
Function at 0x423550
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x21c
mov eax, dword [0x50f130]
xor eax, esp
mov dword [esp + 0x218], eax
push 0x208
lea eax, [esp + 0x12]
push 0
push eax
mov dword [0x515fe4], 0x4f3028
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x208
mov word [esp + 0x18], 0
call fcn.004be320
add esp, 0xc
lea ecx, [esp]
push ecx
push 0x20019
push 0
push str.SOFTWARETencentQQPC2Mgr
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4235fb
lea edx, [esp + 4]
push edx
mov edx, dword [esp + 4]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
push 0
push 0x4f1408
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
neg eax
sbb eax, eax
add eax, 1
mov dword [0x515fe8], eax
mov eax, dword [esp]
test eax, eax
je 0x4235fb
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x218]
xor ecx, esp
mov eax, 0x515fe4
call fcn.004b84de
add esp, 0x21c
ret
Function at 0x43c190
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4dce79
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x50f130]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x50f130]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x50]
xor ebx, ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x1c], ebx
mov eax, dword [0x5143ac]
mov edx, dword [eax + 0xc]
mov edi, ecx
add ebp, 6
mov ecx, 0x5143ac
mov dword [esp + 0x20], edi
mov dword [esp + 0x18], ebp
call edx
add eax, 0x10
mov dword [edi], eax
mov dword [esp + 0x48], ebx
mov eax, dword [0x4f3fc8]
mov ecx, dword [0x4f3fcc]
mov edx, dword [0x4f3fd0]
mov dword [esp + 0x24], eax
mov eax, dword [0x4f3fd4]
mov dword [esp + 0x28], ecx
mov ecx, dword [0x4f3fd8]
mov dword [esp + 0x2c], edx
mov edx, dword [0x4f3fdc]
mov dword [esp + 0x1c], 1
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], edx
mov dword [esp + 0x14], ebx
jmp 0x43c240
movzx esi, word [esp + ebx*2 + 0x24]
push esi
push ebp
call fcn.004b953d
add esp, 8
test eax, eax
je 0x43c2ab
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
je 0x43c262
push 0x20
call fcn.0043d650
mov eax, dword [edi]
mov ebx, dword [eax - 0xc]
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
movzx ebp, si
lea esi, [ebx + 1]
sub eax, esi
or eax, ecx
jge 0x43c287
mov ecx, esi
mov eax, edi
call fcn.00401130
test esi, esi
mov eax, dword [edi]
mov word [eax + ebx*2], bp
jl 0x43c2da
mov eax, dword [edi]
cmp esi, dword [eax - 8]
jg 0x43c2da
mov ebp, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov dword [eax - 0xc], esi
mov ecx, dword [edi]
mov word [ecx + esi*2], 0
add ebx, 1
cmp ebx, 0xb
mov dword [esp + 0x14], ebx
jb 0x43c240
mov eax, edi
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.004b84de
add esp, 0x38
ret 4
push 0x80070057
call fcn.00401340
int3

Function at 0x43c2f0
Capabilities:
Hide graphical window

Disassembly:
push ecx
push esi
mov esi, eax
mov eax, dword [esi + 0x3f4]
test eax, eax
push edi
jne 0x43c319
lea eax, [esi + 0x68]
mov edi, 0xce
call fcn.00428360
test eax, eax
je 0x43c34b
call fcn.0043bba0
pop edi
pop esi
pop ecx
ret
cmp eax, 2
jne 0x43c34b
mov eax, dword [esi + 4]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov eax, 1
push 0
push 0
mov dword [esi + 0x40], eax
mov dword [esi + 0x3dc], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageW]
pop edi
pop esi
pop ecx
ret
Function at 0x47bb80
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4df826
mov eax, dword fs:[0]
push eax
sub esp, 0x248
mov eax, dword [0x50f130]
xor eax, esp
mov dword [esp + 0x244], eax
push ebp
push esi
push edi
mov eax, dword [0x50f130]
xor eax, esp
push eax
lea eax, [esp + 0x258]
mov dword fs:[0], eax
xor edi, edi
push 0x206
lea eax, [esp + 0x52]
push edi
push eax
mov dword [esp + 0x54], edi
mov word [esp + 0x58], di
call fcn.004be320
add esp, 0xc
test byte [0x51616c], 1
lea ebp, [edi + 7]
jne 0x47bc0b
or dword [0x51616c], 1
push 0x4e6d10
mov dword [0x516168], ebp
mov dword [0x516164], edi
mov word [0x516154], di
call fcn.004b9683
add esp, 4
cmp dword [0x516164], edi
jne 0x47bce9
push 0x104
lea ecx, [esp + 0x50]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [esp + 0x4c]
mov dword [esp + 0x44], ebp
mov dword [esp + 0x40], edi
mov word [esp + 0x30], di
lea edx, [eax + 2]
jmp 0x47bc40
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x47bc40
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x50]
push edx
lea esi, [esp + 0x34]
call fcn.004024d0
mov dword [esp + 0x260], edi
push 0xffffffffffffffff
push edi
mov eax, esi
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], ebp
mov dword [esp + 0x2c], edi
mov word [esp + 0x1c], di
call fcn.00402090
push 0xffffffffffffffff
push edi
lea eax, [esp + 0x18]
mov ecx, 0x516150
mov byte [esp + 0x268], 1
call fcn.00402090
mov esi, 8
cmp dword [esp + 0x28], esi
jb 0x47bcb1
mov eax, dword [esp + 0x14]
push eax
call fcn.004b84d9
add esp, 4
mov dword [esp + 0x260], 0xffffffff
cmp dword [esp + 0x44], esi
mov dword [esp + 0x28], ebp
mov dword [esp + 0x24], edi
mov word [esp + 0x14], di
jb 0x47bcdc
mov ecx, dword [esp + 0x30]
push ecx
call fcn.004b84d9
add esp, 4
mov dword [esp + 0x44], ebp
mov dword [esp + 0x40], edi
mov word [esp + 0x30], di
push 0xffffffffffffffff
mov dword [ebx + 0x18], ebp
mov dword [ebx + 0x14], edi
push edi
mov eax, 0x516150
mov ecx, ebx
mov word [ebx + 4], di
call fcn.00402090
mov eax, ebx
mov ecx, dword [esp + 0x258]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x244]
xor ecx, esp
call fcn.004b84de
add esp, 0x254
ret

Function at 0x47cb40
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x50f130]
xor eax, esp
mov dword [esp + 0x20c], eax
cmp dword [0x515c14], 0
jne 0x47cbd3
push esi
push 0x208
lea eax, [esp + 0xa]
push 0
push eax
mov word [esp + 0x10], 0
call fcn.004be320
add esp, 0xc
push 0x104
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0xffffffffffffffff
push 0x4f55f8
lea edx, [esp + 0xc]
push 0x104
push edx
call fcn.004bc834
add esp, 0x10
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x47cbd2
push str.GetLocaleInfoEx
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
neg eax
sbb eax, eax
add eax, 2
push esi
mov dword [0x515c14], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
mov ecx, dword [esp + 0x20c]
xor eax, eax
cmp dword [0x515c14], 1
sete al
xor ecx, esp
call fcn.004b84de
add esp, 0x210
ret
Function at 0x485650
Capabilities:
Get storage device properties

Disassembly:
push 0xffffffffffffffff
push 0x4dd8f2
mov eax, dword fs:[0]
push eax
sub esp, 0x41c
mov eax, dword [0x50f130]
xor eax, esp
mov dword [esp + 0x418], eax
push ebx
push esi
push edi
mov eax, dword [0x50f130]
xor eax, esp
push eax
lea eax, [esp + 0x42c]
mov dword fs:[0], eax
mov ebx, ecx
xor edi, edi
mov dword [esp + 0x434], edi
push ebx
mov ecx, 0x4f5884
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], edi
call fcn.00415120
push edi
push edi
push 3
push edi
push 3
push edi
mov dword [esp + 0x44c], edi
push 0x4f62d8
mov dword [esp + 0x2c], 1
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x48574d
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
push 0x400
mov dword [esp + 0x28], eax
lea eax, [esp + 0x2c]
push edi
push eax
mov dword [esp + 0x20], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
call fcn.004be320
add esp, 0xc
push edi
lea ecx, [esp + 0x18]
push ecx
push 0x400
lea edx, [esp + 0x34]
push edx
push 0xc
lea eax, [esp + 0x30]
push eax
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x485746
mov edi, dword [esp + 0x38]
movsx ecx, byte [esp + edi + 0x28]
lea edi, [esp + edi + 0x28]
push ecx
call fcn.004bcc84
add esp, 4
test eax, eax
je 0x485746
mov edx, edi
call fcn.004152a0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [esp + 0x42c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x418]
xor ecx, esp
call fcn.004b84de
add esp, 0x428
ret
Function at 0x490d84
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x20c
lea ebp, [esp - 4]
mov eax, dword [0x50f130]
xor eax, ebp
mov dword [ebp + 0x20c], eax
push 0x24
mov eax, 0x4df0d7
call fcn.004bea3c
xor edi, edi
push 0x208
lea eax, [ebp + 2]
mov dword [ebp - 0x28], edi
push edi
push eax
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], edi
mov word [ebp], di
call fcn.004be320
add esp, 0xc
lea esi, [ebp - 0x14]
call fcn.00416d00
lea eax, [ebp - 0x18]
push eax
push 0x20019
push edi
push str.SoftwareTencentQQPCMgr
mov dword [ebp - 4], edi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x20], 0x20a
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x490eb8
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 0x30]
push eax
push edi
push 0x4f1408
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x490eaf
lea eax, [ebp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea edx, [ebp]
mov edi, esi
call fcn.004049e0
mov eax, esi
push eax
lea eax, [ebp - 0x24]
push eax
mov ebx, str.QQPCtray.exe
call fcn.00413810
pop ecx
pop ecx
mov byte [ebp - 4], 1
push dword [eax]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor ebx, ebx
inc ebx
mov dword [ebp - 0x28], ebx
call esi
test eax, eax
je 0x490e81
mov eax, edi
push eax
lea eax, [ebp - 0x2c]
push eax
mov ebx, str.QQPCMgr.exe
call fcn.00413810
pop ecx
pop ecx
push 3
pop ebx
push dword [eax]
call esi
test eax, eax
mov byte [ebp - 0xd], 1
jne 0x490e85
mov byte [ebp - 0xd], 0
test bl, 2
je 0x490e95
lea ecx, [ebp - 0x2c]
and ebx, 0xfffffffd
call fcn.00416ce0
test bl, 1
je 0x490ea2
lea ecx, [ebp - 0x24]
call fcn.00416ce0
cmp byte [ebp - 0xd], 0
je 0x490eaf
mov dword [ebp - 0x1c], 1
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x14]
call fcn.00416ce0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x20c]
xor ecx, ebp
call fcn.004b84de
add ebp, 0x210
leave
ret
Function at 0x4c0896
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x50f2e8]
je 0x4c08b1
inc edi
cmp edi, 0x17
jb 0x4c08a2
cmp edi, 0x17
jae 0x4c0a31
push ebp
push 3
call fcn.004cf262
cmp eax, 1
pop ecx
je 0x4c09fd
push 3
call fcn.004cf262
test eax, eax
pop ecx
jne 0x4c08e5
cmp dword [0x50f0b4], 1
je 0x4c09fd
cmp ebx, 0xfc
je 0x4c0a30
push 0x4e8848
mov ebx, 0x314
push ebx
mov ebp, 0x514710
push ebp
call fcn.004bdc24
add esp, 0xc
test eax, eax
je 0x4c091b
push esi
push esi
push esi
push esi
push esi
call fcn.004b9aee
add esp, 0x14
push 0x104
mov esi, 0x514729
push esi
push 0
mov byte [0x51482d], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4c095f
push 0x4e8830
push 0x2fb
push esi
call fcn.004bdc24
add esp, 0xc
test eax, eax
je 0x4c095f
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.004b9aee
add esp, 0x14
push esi
call fcn.004be5a0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x4c09a4
push esi
call fcn.004be5a0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x514a24
push 0x4e882c
sub ecx, eax
push ecx
push eax
call fcn.004bdc89
add esp, 0x14
test eax, eax
je 0x4c09a4
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.004b9aee
add esp, 0x14
jmp 0x4c09a6
xor esi, esi
push 0x4e8828
push ebx
push ebp
call fcn.004ca35b
add esp, 0xc
test eax, eax
je 0x4c09c6
push esi
push esi
push esi
push esi
push esi
call fcn.004b9aee
add esp, 0x14
push dword [edi*8 + 0x50f2ec]
push ebx
push ebp
call fcn.004ca35b
add esp, 0xc
test eax, eax
je 0x4c09e8
push esi
push esi
push esi
push esi
push esi
call fcn.004b9aee
add esp, 0x14
push 0x12010
push 0x4e8800
push ebp
call fcn.004cf0a5
add esp, 0xc
jmp 0x4c0a30
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x4c0a30
cmp ebp, 0xffffffff
je 0x4c0a30
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x50f2ec]
push dword [esi]
call fcn.004be5a0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x4cf0a5
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004c145a
xor ebx, ebx
cmp dword [0x515218], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x4cf17b
push 0x4e9404
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x4cf25b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4e93f8
push edi
call esi
cmp eax, ebx
je 0x4cf25b
push eax
call fcn.004c13ec
mov dword [esp], 0x4e93e8
push edi
mov dword [0x515218], eax
call esi
push eax
call fcn.004c13ec
mov dword [esp], 0x4e93d4
push edi
mov dword [0x51521c], eax
call esi
push eax
call fcn.004c13ec
mov dword [0x515220], eax
lea eax, [ebp - 0xc]
push eax
call fcn.004b9f8e
test eax, eax
pop ecx
pop ecx
je 0x4cf149
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004b9aee
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x4cf17b
push 0x4e93b8
push edi
call esi
push eax
call fcn.004c13ec
cmp eax, ebx
pop ecx
mov dword [0x515228], eax
je 0x4cf17b
push 0x4e93a0
push edi
call esi
push eax
call fcn.004c13ec
pop ecx
mov dword [0x515224], eax
mov eax, dword [0x515224]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x4cf200
cmp dword [0x515228], ecx
je 0x4cf200
push eax
call fcn.004c1463
push dword [0x515228]
mov esi, eax
call fcn.004c1463
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x4cf200
cmp edi, ebx
je 0x4cf200
call esi
cmp eax, ebx
je 0x4cf1cd
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4cf1cd
test byte [ebp - 0x18], 1
jne 0x4cf200
lea eax, [ebp - 0x10]
push eax
call fcn.004b9fc5
test eax, eax
pop ecx
je 0x4cf1e8
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004b9aee
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x4cf1f7
or dword [ebp + 0x10], 0x200000
jmp 0x4cf23b
or dword [ebp + 0x10], 0x40000
jmp 0x4cf23b
mov eax, dword [0x51521c]
cmp eax, dword [ebp - 8]
je 0x4cf23b
push eax
call fcn.004c1463
cmp eax, ebx
pop ecx
je 0x4cf23b
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4cf23b
mov eax, dword [0x515220]
cmp eax, dword [ebp - 8]
je 0x4cf23b
push eax
call fcn.004c1463
cmp eax, ebx
pop ecx
je 0x4cf23b
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x515218]
call fcn.004c1463
cmp eax, ebx
pop ecx
je 0x4cf25b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4cf25d
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x436ebd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add esp, 4
pop eax
push esi
xor esi, 0x1339b
pop esi
mov byte [ebp - 0x878], 0x45
mov byte [ebp - 0x877], 0x78
mov byte [ebp - 0x876], 0x69
mov byte [ebp - 0x875], 0x74
mov byte [ebp - 0x874], 0x50
mov byte [ebp - 0x873], 0x72
mov byte [ebp - 0x872], 0x6f
mov byte [ebp - 0x871], 0x63
mov byte [ebp - 0x870], 0x65
mov byte [ebp - 0x86f], 0x73
mov byte [ebp - 0x86e], 0x73
mov byte [ebp - 0x86d], 0
push edi
push edi
add esp, 4
les eax, [eax + ebp*8]
pop es
add byte [eax], al
add byte [eax], al
inc ebx
dec esi
dec edx
inc ebp
push eax
dec esp
add esp, 4
xor edi, 0x11f6d
call 0x436f45
add byte [eax + 0x41], dl
dec eax
dec edx
inc ebp
dec esi
add esp, 4
sub edi, 0x98dd
pop edi
mov ecx, 0x6b
mov word [ebp - 0x1738], cx
mov edx, 0x65
mov word [ebp - 0x1736], dx
mov eax, 0x72
mov word [ebp - 0x1734], ax
mov ecx, 0x6e
mov word [ebp - 0x1732], cx
mov edx, 0x65
mov word [ebp - 0x1730], dx
mov eax, 0x6c
mov word [ebp - 0x172e], ax
mov ecx, 0x33
mov word [ebp - 0x172c], cx
mov edx, 0x32
mov word [ebp - 0x172a], dx
mov eax, 0x2e
mov word [ebp - 0x1728], ax
mov ecx, 0x64
mov word [ebp - 0x1726], cx
mov edx, 0x6c
mov word [ebp - 0x1724], dx
mov eax, 0x6c
mov word [ebp - 0x1722], ax
xor ecx, ecx
mov word [ebp - 0x1720], cx
push esi
jmp 0x436ff1
pop esi
push edx
push edx
add esp, 4
and edx, 0x110d2
add edx, 0x16b81
pop edx
push eax
sub eax, 0x129cd
add eax, 0x10007
pop eax
push edi
or edi, 0x6e28
pop edi
push ecx
or ecx, 0x16966
add ecx, 0x13fa
pop ecx
push eax
or eax, 0x42e4
add eax, 0x11aeb
add eax, 0x78f0
pop eax
push eax
or eax, 0x428d
pop eax
push ebx
xor ebx, 0x245
pop ebx
mov edx, dword fs:[0x18]
mov dword [ebp - 0x1954], edx
mov eax, dword [ebp - 0x1954]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x1958], ecx
mov edx, dword [ebp - 0x1958]
mov dword [ebp - 0x15d8], edx
push esi
push ebx
add esp, 4
jmp 0x437082
pop esi
push edx
sub edx, 0x9f67
jmp 0x437092
jmp 0x437097
and edx, 0x318
pop edx
push eax
sub eax, 0x36bf
pop eax
cmp dword [ebp - 0x15d8], 0
jne 0x4370be
mov dword [ebp - 0x31c], 0
jmp 0x43737a
mov eax, dword [ebp - 0x15d8]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xc98], edx
push edi
push edi
add esp, 4
or edi, 0x2d50
sub edi, 0x5bc5
and edi, 0x4cab
pop edi
push esi
add esi, 0x85e0
xor esi, 0x17409
pop esi
push edi
push edi
add esp, 4
or edi, 0x13b40
pop edi
cmp dword [ebp - 0xc98], 0
jne 0x43711a
mov dword [ebp - 0x31c], 0
jmp 0x43737a
mov eax, dword [ebp - 0xc98]
mov dword [ebp - 0x504], eax
Function at 0x436f45
Capabilities:
Get number of processors

Disassembly:
add esp, 4
pop eax
push esi
xor esi, 0x1339b
pop esi
mov byte [ebp - 0x878], 0x45
mov byte [ebp - 0x877], 0x78
mov byte [ebp - 0x876], 0x69
mov byte [ebp - 0x875], 0x74
mov byte [ebp - 0x874], 0x50
mov byte [ebp - 0x873], 0x72
mov byte [ebp - 0x872], 0x6f
mov byte [ebp - 0x871], 0x63
mov byte [ebp - 0x870], 0x65
mov byte [ebp - 0x86f], 0x73
mov byte [ebp - 0x86e], 0x73
mov byte [ebp - 0x86d], 0
push edi
push edi
add esp, 4
les eax, [eax + ebp*8]
pop es
add byte [eax], al
add byte [eax], al
inc ebx
dec esi
dec edx
inc ebp
push eax
dec esp
add esp, 4
xor edi, 0x11f6d
call 0x436f45
add byte [eax + 0x41], dl
dec eax
dec edx
inc ebp
dec esi
add esp, 4
sub edi, 0x98dd
pop edi
mov ecx, 0x6b
mov word [ebp - 0x1738], cx
mov edx, 0x65
mov word [ebp - 0x1736], dx
mov eax, 0x72
mov word [ebp - 0x1734], ax
mov ecx, 0x6e
mov word [ebp - 0x1732], cx
mov edx, 0x65
mov word [ebp - 0x1730], dx
mov eax, 0x6c
mov word [ebp - 0x172e], ax
mov ecx, 0x33
mov word [ebp - 0x172c], cx
mov edx, 0x32
mov word [ebp - 0x172a], dx
mov eax, 0x2e
mov word [ebp - 0x1728], ax
mov ecx, 0x64
mov word [ebp - 0x1726], cx
mov edx, 0x6c
mov word [ebp - 0x1724], dx
mov eax, 0x6c
mov word [ebp - 0x1722], ax
xor ecx, ecx
mov word [ebp - 0x1720], cx
push esi
jmp 0x436ff1
pop esi
push edx
push edx
add esp, 4
and edx, 0x110d2
add edx, 0x16b81
pop edx
push eax
sub eax, 0x129cd
add eax, 0x10007
pop eax
push edi
or edi, 0x6e28
pop edi
push ecx
or ecx, 0x16966
add ecx, 0x13fa
pop ecx
push eax
or eax, 0x42e4
add eax, 0x11aeb
add eax, 0x78f0
pop eax
push eax
or eax, 0x428d
pop eax
push ebx
xor ebx, 0x245
pop ebx
mov edx, dword fs:[0x18]
mov dword [ebp - 0x1954], edx
mov eax, dword [ebp - 0x1954]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x1958], ecx
mov edx, dword [ebp - 0x1958]
mov dword [ebp - 0x15d8], edx
push esi
push ebx
add esp, 4
jmp 0x437082
pop esi
push edx
sub edx, 0x9f67
jmp 0x437092
jmp 0x437097
and edx, 0x318
pop edx
push eax
sub eax, 0x36bf
pop eax
cmp dword [ebp - 0x15d8], 0
jne 0x4370be
mov dword [ebp - 0x31c], 0
jmp 0x43737a
mov eax, dword [ebp - 0x15d8]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xc98], edx
push edi
push edi
add esp, 4
or edi, 0x2d50
sub edi, 0x5bc5
and edi, 0x4cab
pop edi
push esi
add esi, 0x85e0
xor esi, 0x17409
pop esi
push edi
push edi
add esp, 4
or edi, 0x13b40
pop edi
cmp dword [ebp - 0xc98], 0
jne 0x43711a
mov dword [ebp - 0x31c], 0
jmp 0x43737a
mov eax, dword [ebp - 0xc98]
mov dword [ebp - 0x504], eax