joyce8/EMBER2024-capa huggingface dataset:
Function at 0x460340
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x460357
add esp, 0xfffffff0
call fcn.00403c88
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004252e4
mov eax, dword [0x488c60]
cmp word [eax + 2], 0
jne 0x46037f
mov eax, dword [0x488c60]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00461a1c
mov eax, dword [0x488dc0]
cmp word [eax + 2], 0
jne 0x460399
mov eax, dword [0x488dc0]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00461c14
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x41a7bc]
call fcn.004038f4
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x41a7bc]
call fcn.004038f4
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0x80000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x427794]
call fcn.0042eb50
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x460520
mov eax, dword [0x488a9c]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042ef20
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x462184
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x488a9c]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040d948
test eax, eax
je 0x46048e
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.0040942c
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040d970
test eax, eax
je 0x4604a2
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.0040497c
mov eax, dword [0x488844]
cmp byte [eax], 0
jne 0x4604d6
mov eax, ebx
call fcn.00460648
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.00462360
mov eax, ebx
call fcn.00462d10
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x460516
call fcn.00403ce0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4608bc
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x48ac38]
cmp dword [eax + 0x30], 0
je 0x460966
cmp dword [ebx + 0x94], 0
jne 0x460960
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x46084c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x460960
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x460926
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x460960
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041d02c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x460935
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x461444
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x461479
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404804
jmp 0x461486
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404768
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x46253c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x46257d
mov eax, esi
call fcn.004488e4
test al, al
je 0x46257d
mov eax, dword [ebx + 0x84]
call fcn.004485e0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x46257d
push 0
mov eax, dword [ebx + 0x84]
call fcn.004485e0
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x4851b4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404bb4
mov eax, dword [ebp - 8]
call fcn.00404bb4
xor eax, eax
push ebp
push 0x485291
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004092c8
mov dword [ebp - 0x48], 0x3c
xor eax, eax
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x40], eax
mov eax, 0x4852a4
mov dword [ebp - 0x3c], eax
test bl, bl
je 0x485216
mov eax, 0x4852ac
mov dword [ebp - 0x3c], eax
mov eax, 0x4852b4
mov dword [ebp - 0x38], eax
cmp dword [ebp - 4], 0
je 0x48522f
lea eax, [ebp - 4]
call fcn.00404c1c
mov dword [ebp - 0x38], eax
mov eax, 0x4852b4
mov dword [ebp - 0x34], eax
cmp dword [ebp - 8], 0
je 0x485248
lea eax, [ebp - 8]
call fcn.00404c1c
mov dword [ebp - 0x34], eax
mov eax, 0x4852b4
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0xc], 0
je 0x485261
lea eax, [ebp - 0xc]
call fcn.00404c1c
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x48]
push eax
call sub.shell32.dll_ShellExecuteExA
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x485298
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404738
ret
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43300c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d

Function at 0x40974c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x40975b
pop dword [ebp - 0x1c]
mov eax, 0xc1dfd589
add eax, 0x3e60c1d2
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xe7d0f030
add dword [ebp - 0x2c], 0x6681551b
mov dword [ebp - 0x28], 0x36a8b80
sub dword [ebp - 0x28], 0xd1373f3b
mov dword [ebp - 0x24], 0x53ebd4c
sub dword [ebp - 0x24], 0xb8f2791e
mov dword [ebp - 0x20], 0x1f170faa
sub dword [ebp - 0x20], 0x1f170faa
lea eax, [ebp - 0x2c]
push eax
mov eax, 0xed09c218
add eax, 0x13370e34
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x6109104c
sub dword [ebp - 0x2c], 0xec96a6f6
mov dword [ebp - 0x28], 0x61984b8f
sub dword [ebp - 0x28], 0x202bea1a
mov dword [ebp - 0x24], 0x672a58c2
add dword [ebp - 0x24], 0xfc4513aa
mov dword [ebp - 0x20], 0x88c46505
sub dword [ebp - 0x20], 0x88c46505
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0xfda03849
sub eax, 0xfd5f6801
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x3b0e6
push 0
call eax
mov ecx, 0x84724e8f
sub ecx, 0x8472009b
mov ebx, eax
mov esi, 0x9f5069fa
add esi, 0x60f14606
add esi, dword [ebp - 0x1c]
mov edx, 0xaceb0ac5
sub edx, 0x5ed288b2
sub dword [ebp - 0xc], 0x418dee9a
mov edi, dword [esi]
sub dword [ebp - 8], edx
xor edi, edx
add dword [ebp - 0x14], 0xea3a1d04
mov dword [ebx], edi
sub dword [ebp - 0xc], edx
add ebx, 4
add esi, 4
loop 0x40987d
add eax, 0xba12ce41
sub eax, 0xba11a39e
xor ebx, ebx
add ebx, eax
add eax, 0x448e9986
sub eax, 0x448e9981
mov ecx, 0x400000
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x409e46
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x409e55
pop dword [ebp - 0x2c]
mov eax, 0xb00d854e
add eax, 0x50331907
sub dword [ebp - 0x2c], eax
push 0x40
push 0x1000
push 0x363ec
push 0
mov eax, 0x4c67f3d8
sub eax, 0x4c24aeac
add eax, dword [ebp - 0x2c]
call dword [eax]
mov ecx, 0x29efb1b5
sub ecx, 0x29ef6c84
xor edi, edi
add edi, eax
mov ebx, 0x43e000
add ebx, dword [ebp - 0x2c]
mov edx, 0x2735699d
sub edx, 0xc69a1bd1
mov dword [ebp - 0x24], 0x107020ea
mov esi, dword [ebx]
mov dword [ebp - 0xc], 0xf644c537
xor esi, edx
add dword [ebp - 8], ebx
mov dword [edi], esi
add edi, 0xa3dd3e0b
add edi, 0x5c22c1f9
add ebx, 0xc532d192
add ebx, 0x3acd2e72
loop 0x409eb0
add eax, 0x10797
mov ebx, eax
add eax, 5
mov ecx, 0xaed2c632
sub ecx, 0xae92c632
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x40c900
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x24
mov eax, dword [0x43700c]
xor eax, ebp
mov dword [ebp - 0xc], eax
push str.MOZ_ENABLE_HANDLE_VERIFIER
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
add esp, 4
test eax, eax
jne 0x40c93a
call fcn.0040ca10
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0040a740
add esp, 0x24
pop esi
pop edi
pop ebp
ret
movaps xmm0, xmmword [str.kernel32]
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0x64002e
mov dword [ebp - 0x14], 0x6c006c
mov word [ebp - 0x10], 0
cmp dword [0x4383a0], 0
jne 0x40c971
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryW]
mov dword [0x4383a0], eax
lea esi, [ebp - 0x2c]
mov dword [esi], 0
lea edi, [ebp - 0x28]
mov dword [edi], 0x4383ec
mov dword [edi + 4], 0x43836c
mov dword [edi + 8], 0x4318ad
mov dword [edi + 0xc], 0x42dda0
mov byte [edi + 0x10], 0
push esi
push edi
push 0x42de00
push 0x4383f0
call dword [sym.imp.kernel32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x40c924
cmp dword [ebp - 0x2c], 0
je 0x40c924
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0x4383f4
mov dword [ebp - 0x24], 0x43836c
mov dword [ebp - 0x20], 0x43189d
mov dword [ebp - 0x1c], 0x42ddc0
mov byte [ebp - 0x18], 0
push esi
push edi
push 0x42de00
push 0x4383f8
call dword [sym.imp.kernel32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x40c924
cmp dword [ebp - 0x2c], 0
jne 0x40c929
jmp 0x40c924
Function at 0x412848
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x412857
pop dword [ebp - 8]
mov eax, 0x412857
sub dword [ebp - 8], eax
push 0x40
push 0x1000
push 0x4cbbf
push 0
mov eax, 0xe28862fe
add eax, 0x1dbc4fbe
add eax, dword [ebp - 8]
call dword [eax]
mov ecx, 0x54d56b10
add ecx, 0xab2acfd7
xor ebx, ebx
add ebx, eax
mov esi, 0x7d1b75a0
sub esi, 0x7cd2f7a0
add esi, dword [ebp - 8]
mov edi, 0xcd7ddbdd
sub edi, 0x69b2ac93
sub dword [ebp - 4], 0x14cba326
mov edx, dword [esi]
add dword [ebp - 4], edx
xor edx, edi
mov dword [ebx], edx
xor dword [ebp - 4], 0xf84ecc8c
add ebx, 0xcdbe5f29
add ebx, 0x3241a0db
add esi, 4
loop 0x4128b3
add eax, 0xa78f582e
add eax, 0x58718641
mov ebx, eax
add eax, 5
mov ecx, 0xdf374683
add ecx, 0x2108b97d
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x43fcae
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46b5d8
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x43fcf1
push str.SystemFunction040
push dword [0x46b5d8]
call edi
push str.SystemFunction041
push dword [0x46b5d8]
mov dword [0x46b5e0], eax
call edi
mov dword [0x46b5e4], eax
jmp 0x43fcf6
mov eax, dword [0x46b5e4]
cmp dword [0x46b5e0], 0
je 0x43fd07
test eax, eax
jne 0x43fdae
push 0x46b5dc
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x43fdb8
push str.CryptProtectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e0], 0
mov dword [0x46b5e8], eax
jne 0x43fd6c
test eax, eax
jne 0x43fd6c
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fd56
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fd5d
mov esi, 0x80004005
push esi
push 0x28
push str.cryputil.cpp
call fcn.00403821
jmp 0x43fdb8
push str.CryptUnprotectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e4], 0
mov dword [0x46b5ec], eax
jne 0x43fdae
test eax, eax
jne 0x43fdae
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fda2
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fda9
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x43fd60
mov dword [0x46b5f0], 1
pop edi
mov eax, esi
pop esi
ret
Function at 0x4069f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x10]
mov cl, byte [eax + 0x100]
mov byte [ebp - 2], cl
mov edx, dword [ebp + 0x10]
mov al, byte [edx + 0x101]
mov byte [ebp - 1], al
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], 0
jmp 0x406a26
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
jge 0x406ad6
movzx ecx, byte [ebp - 2]
add ecx, 1
and ecx, 0x800000ff
jns 0x406a49
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [ebp - 2], cl
movzx edx, byte [ebp - 2]
mov eax, dword [ebp - 0x10]
movzx ecx, byte [eax + edx]
movzx edx, byte [ebp - 1]
add ecx, edx
and ecx, 0x800000ff
jns 0x406a6d
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [ebp - 1], cl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0x10]
push eax
movzx ecx, byte [ebp - 2]
add ecx, dword [ebp - 0x10]
push ecx
call fcn.00406b00
add esp, 8
movzx edx, byte [ebp - 2]
mov eax, dword [ebp - 0x10]
movzx ecx, byte [eax + edx]
movzx edx, byte [ebp - 1]
mov eax, dword [ebp - 0x10]
movzx edx, byte [eax + edx]
add ecx, edx
and ecx, 0x800000ff
jns 0x406ab0
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [ebp - 9], cl
movzx eax, byte [ebp - 9]
mov ecx, dword [ebp - 0x10]
movzx edx, byte [ecx + eax]
mov eax, dword [ebp + 8]
add eax, dword [ebp - 8]
movzx ecx, byte [eax]
xor ecx, edx
mov edx, dword [ebp + 8]
add edx, dword [ebp - 8]
mov byte [edx], cl
jmp 0x406a1d
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 2]
mov byte [eax + 0x100], cl
mov edx, dword [ebp + 0x10]
mov al, byte [ebp - 1]
mov byte [edx + 0x101], al
mov esp, ebp
pop ebp
ret
Function at 0x408240
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x511a38
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x56f8f4]
xor eax, ebp
mov dword [ebp - 0x18], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x68], ecx
mov eax, dword [ebp - 0x68]
cmp dword [eax + 0x3c], 0
je 0x408280
mov ecx, dword [ebp - 0x68]
movzx edx, byte [ecx + 0x41]
test edx, edx
jne 0x40828c
mov al, 1
jmp 0x40842f
mov dword [ebp - 0x10], 8
call fcn.0040a060
push eax
mov eax, dword [ebp - 0x68]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x68]
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 0x3c], eax
call fcn.0040a060
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.0040a010
add esp, 8
movzx eax, al
test eax, eax
je 0x4082cf
xor al, al
jmp 0x40842f
push 0
push 8
lea ecx, [ebp - 0x34]
call fcn.00407bb0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x48]
push edx
lea ecx, [ebp - 0x34]
call fcn.004014f0
mov ecx, eax
call fcn.004085b0
mov esi, eax
lea ecx, [ebp - 0x34]
call fcn.004017b0
add esi, eax
push esi
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x34]
call fcn.004014f0
mov ecx, eax
call fcn.004085b0
push eax
mov ecx, dword [ebp - 0x68]
add ecx, 0x44
push ecx
mov edx, dword [ebp - 0x68]
mov ecx, dword [edx + 0x3c]
call fcn.00408880
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
je 0x40834a
cmp dword [ebp - 0x6c], 1
je 0x408351
cmp dword [ebp - 0x6c], 3
je 0x4083eb
jmp 0x408403
mov eax, dword [ebp - 0x68]
mov byte [eax + 0x41], 0
lea ecx, [ebp - 0x58]
push ecx
lea ecx, [ebp - 0x34]
call fcn.004014f0
mov ecx, eax
call fcn.004085b0
mov edx, dword [ebp - 0x14]
sub edx, eax
mov dword [ebp - 0x38], edx
je 0x4083b4
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 1
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x34]
call fcn.004014f0
mov ecx, eax
call fcn.004085b0
push eax
call fcn.004c6f97
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x4083b4
mov byte [ebp - 0x61], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00403d70
mov al, byte [ebp - 0x61]
jmp 0x40842f
mov ecx, dword [ebp - 0x68]
movzx edx, byte [ecx + 0x41]
test edx, edx
jne 0x4083d7
mov byte [ebp - 0x62], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00403d70
mov al, byte [ebp - 0x62]
jmp 0x40842f
cmp dword [ebp - 0x38], 0
jne 0x4083e9
push 0
push 8
lea ecx, [ebp - 0x34]
call fcn.00402390
jmp 0x40841b
mov byte [ebp - 0x63], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00403d70
mov al, byte [ebp - 0x63]
jmp 0x40842f
mov byte [ebp - 0x64], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00403d70
mov al, byte [ebp - 0x64]
jmp 0x40842f
jmp 0x4082e2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.004c3202
mov esp, ebp
pop ebp
ret
Function at 0x419330
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x512bfb
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x56f8f4]
xor eax, esp
mov dword [esp + 0x88], eax
push ebx
push ebp
mov eax, dword [0x56f8f4]
xor eax, esp
push eax
lea eax, [esp + 0x98]
mov dword fs:[0], eax
mov ebp, dword [esp + 0xa8]
push 0x63
lea eax, [esp + 0x35]
push 0
mov dword [esp + 0x18], 0
push eax
mov byte [esp + 0x3c], 0
call fcn.004c3b30
lea ecx, [esp + 0x20]
push esi
push ecx
mov dword [esp + 0x24], 0x64
call fcn.00419650
add esp, 0x14
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x34]
push ecx
push edi
mov ecx, eax
call fcn.00403cc0
mov ecx, eax
call fcn.00421030
add esp, 0xc
lea ecx, [esp + 0x14]
mov bl, al
call fcn.00403d70
test bl, bl
je 0x419407
lea ecx, [esp + 0xf]
call fcn.005053d0
mov dword [esp + 0xa0], 0
mov edx, dword [esp + 0x10]
push edx
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x17]
call fcn.00505450
lea ecx, [esp + 0xf]
mov dword [esp + 0xa0], 0xffffffff
call fcn.005053c0
lea ecx, [esp + 0x30]
push ecx
mov ecx, ebp
call fcn.004045c0
mov eax, ebp
mov ecx, dword [esp + 0x98]
mov dword fs:[0], ecx
pop ecx
pop ebp
pop ebx
mov ecx, dword [esp + 0x88]
xor ecx, esp
call fcn.004c3202
add esp, 0x98
ret
Function at 0x419900
Capabilities:
Get geographical location

Disassembly:
push 0xffffffffffffffff
push 0x512828
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
push esi
mov eax, dword [0x56f8f4]
xor eax, esp
push eax
lea eax, [esp + 0x84]
mov dword fs:[0], eax
mov esi, ecx
call fcn.00505640
test al, al
je 0x4199f2
push str.city
lea ecx, [esp + 0x4c]
call fcn.004045c0
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x68]
push ecx
mov ecx, esi
mov dword [esp + 0x94], 0
call fcn.00505aa0
push eax
mov ecx, edi
mov byte [esp + 0x90], 1
call fcn.004013d0
lea ecx, [esp + 0x64]
call fcn.00403d70
lea ecx, [esp + 0x48]
mov dword [esp + 0x8c], 0xffffffff
call fcn.00403d70
mov ecx, edi
call fcn.00404650
test al, al
jne 0x4199f2
push str.time
lea ecx, [esp + 0x4c]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call fcn.004045c0
lea edx, [esp + 0x48]
push edx
lea eax, [esp + 0x34]
push eax
mov ecx, esi
mov dword [esp + 0x94], 2
call fcn.00505970
lea ecx, [esp + 0x48]
call fcn.00403d70
lea ecx, [esp + 0x30]
call fcn.004048f0
cmp eax, 8
je 0x4199f9
lea ecx, [esp + 0x30]
call fcn.004048b0
xor al, al
jmp 0x419aae
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x34]
lea esi, [esp + 0x10]
call fcn.004049d0
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x34]
call fcn.00404fc0
push eax
lea ecx, [esp + 0x1c]
call fcn.0040b340
test al, al
je 0x419a61
lea ecx, [esp + 0x18]
call fcn.00412a50
mov al, byte [eax]
push 0
lea ecx, [esp + 0x2c]
push ecx
mov byte [esi], al
lea ecx, [esp + 0x20]
inc esi
call fcn.00412a70
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x34]
call fcn.00404fc0
push eax
lea ecx, [esp + 0x1c]
call fcn.0040b340
test al, al
jne 0x419a27
push 0
call fcn.004c3de4
xor ecx, ecx
add esp, 4
sub eax, dword [esp + 0xc]
sbb ecx, dword [esp + 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
fild qword [esp + 0xc]
lea ecx, [esp + 0x30]
fdiv qword [0x539088]
fstp dword [esp + 0xc]
fld dword [esp + 0xc]
fild dword [esp + 0x94]
fcompp
fnstsw ax
test ah, 5
jnp 0x4199ed
call fcn.004048b0
mov al, 1
mov ecx, dword [esp + 0x84]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x88
ret 4
Function at 0x41a090
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x512fd8
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x56f8f4]
xor eax, esp
mov dword [esp + 0x5c], eax
push ebp
push esi
push edi
mov eax, dword [0x56f8f4]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x80]
mov esi, ecx
xor edi, edi
lea ecx, [esp + 0x50]
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
call fcn.00403ce0
cmp byte [esp + 0x84], 0
mov dword [esp + 0x78], edi
je 0x41a164
push str..MD5
lea eax, [esp + 0x1c]
push esi
push eax
call fcn.004031b0
add esp, 0xc
mov edi, eax
lea esi, [esp + 0x34]
mov byte [esp + 0x78], 1
call fcn.0041a010
push eax
lea ecx, [esp + 0x54]
mov byte [esp + 0x7c], 2
call fcn.004013d0
mov ecx, esi
call fcn.00403d70
lea ecx, [esp + 0x18]
mov byte [esp + 0x78], 0
call fcn.00403d70
mov ecx, ebp
call fcn.00403cc0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x41a160
lea ecx, [esp + 0x50]
push ecx
push ebp
call fcn.0050a790
add esp, 8
test al, al
je 0x41a160
push ebp
mov ecx, ebx
call fcn.00403d30
jmp 0x41a196
mov esi, dword [esp + 0x10]
push esi
mov eax, ebp
call fcn.00424b50
add esp, 4
test al, al
je 0x41a18f
cmp byte [esp + 0x84], 0
je 0x41a156
lea edx, [esp + 0x50]
push edx
push ebp
call fcn.0050a790
add esp, 8
test al, al
jne 0x41a156
mov ecx, ebx
call fcn.00403ce0
lea ecx, [esp + 0x50]
call fcn.00403d70
mov eax, ebx
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.004c3202
add esp, 0x6c
ret