joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47fb90
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e96cb
mov eax, dword fs:[0]
push eax
sub esp, 0x144
mov eax, dword [0x522008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi], 0
je 0x47fbc9
call fcn.0047fd30
cmp byte [0x5247f8], 0
jne 0x47fbdc
mov eax, 0x80000001
jmp 0x47fd0c
mov eax, dword [esi]
test eax, eax
jne 0x47fc5c
push 8
call fcn.004b5975
mov edi, eax
add esp, 4
mov dword [ebp - 0x138], edi
mov dword [ebp - 4], 0
push 1
call fcn.004b5975
add esp, 4
mov dword [edi + 4], eax
mov byte [eax], 0
lea eax, [ebp - 0x130]
push 0x118
push 0
push eax
call fcn.004b7720
add esp, 0xc
mov dword [ebp - 0x134], 0x11c
lea eax, [ebp - 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x47fc4b
cmp dword [ebp - 0x130], 6
mov eax, dword [edi + 4]
setae cl
mov byte [eax], cl
mov dword [ebp - 4], 0xffffffff
mov dword [esi], edi
mov dword [edi], 0
mov eax, dword [esi]
cmp dword [eax], 0
jne 0x47fcfb
call fcn.004130e0
test al, al
jne 0x47fc96
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [esi]
push eax
add ecx, 4
call fcn.00413640
test al, al
je 0x47fcfb
mov ecx, dword [esi]
add ecx, 4
call fcn.00412bf0
call fcn.004130e0
test al, al
je 0x47fcfb
push str.Advapi32.dll
lea ecx, [ebp - 0x150]
call fcn.004021e0
mov dword [ebp - 4], 2
lea eax, [ebp - 0x150]
push eax
call fcn.0040fa50
mov ecx, eax
call fcn.0040fb10
mov edi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x150]
call fcn.00401f40
test edi, edi
je 0x47fcfb
push str.RegOpenCurrentUser
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x47fcfb
push dword [esi]
push dword [ebp + 8]
call eax
test eax, eax
je 0x47fcfb
mov eax, dword [esi]
mov dword [eax], 0
mov eax, dword [esi]
cmp dword [eax], 0
jne 0x47fd0a
mov dword [eax], 0x80000001
mov eax, dword [esi]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004b5964
mov esp, ebp
pop ebp
ret 4
Function at 0x47fef0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e9786
mov eax, dword fs:[0]
push eax
sub esp, 0x64c
mov eax, dword [0x522008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x654]
mov ebx, dword [ebp + 0xc]
call fcn.00402230
mov dword [ebp - 4], 0
mov eax, dword [0x524800]
mov dword [ebp - 0x63c], 0
mov dword [ebp - 0x63c], 0x524800
test eax, eax
je 0x47ff5c
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 1
mov ecx, 0x524804
call fcn.00402120
test al, al
jne 0x47ffa3
mov ecx, 0x524804
call fcn.00402330
lea ecx, [ebp - 0x654]
cmp ecx, eax
je 0x480067
mov ecx, 0x524804
call fcn.00402330
mov ecx, eax
cmp dword [eax + 0x14], 8
jb 0x47ff9a
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
jmp 0x48005c
push 0x20c
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.004b7720
add esp, 0xc
lea eax, [ebp - 0x220]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x103
ja 0x48010c
xor eax, eax
push 0x412
push eax
mov word [ebp - 0x16], ax
lea eax, [ebp - 0x638]
push eax
call fcn.004b7720
add esp, 0xc
lea eax, [ebp - 0x638]
push 0x208
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, 0x208
ja 0x480045
test eax, eax
je 0x480045
add eax, eax
cmp eax, 0x412
jae 0x48015e
xor ecx, ecx
mov word [ebp + eax - 0x638], cx
lea eax, [ebp - 0x638]
push eax
call fcn.004025c0
add esp, 4
push eax
lea eax, [ebp - 0x638]
jmp 0x48005b
lea eax, [ebp - 0x220]
push eax
call fcn.004025c0
add esp, 4
push eax
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x654]
call fcn.004023b0
mov byte [ebp - 4], 0
mov eax, dword [0x524800]
test eax, eax
je 0x48007b
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push ebx
push edi
lea eax, [ebp - 0x654]
mov dword [ebp - 0x63c], 0
push eax
mov ecx, esi
call fcn.0047fe80
test al, al
je 0x4800a0
mov bl, 1
jmp 0x48012c
push 0x20c
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.004b7720
add esp, 0xc
lea eax, [ebp - 0x220]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec eax
cmp eax, 0x103
ja 0x48012a
xor eax, eax
mov word [ebp - 0x16], ax
lea eax, [ebp - 0x220]
push eax
call fcn.004025c0
add esp, 4
lea ecx, [ebp - 0x654]
push eax
lea eax, [ebp - 0x220]
push eax
call fcn.004023b0
push ebx
push edi
lea eax, [ebp - 0x654]
mov ecx, esi
push eax
call fcn.0047fe80
mov bl, al
jmp 0x48012c
mov byte [ebp - 4], 0
mov eax, dword [0x524800]
test eax, eax
je 0x480120
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 0x63c], 0
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x654]
call fcn.00401f40
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b5964
mov esp, ebp
pop ebp
ret 8
call fcn.004b5fbe
int3
Function at 0x481da0
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e9c54
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x522008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.00402230
mov dword [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.00402230
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.00402230
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.00402230
mov byte [ebp - 4], 3
lea ecx, [esi + 0x70]
mov word [esi + 0x60], 0x101
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
call fcn.00402230
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x487f30
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ea8ff
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x522008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 0xc]
mov edx, dword [edi + 4]
push eax
lea ecx, [eax + 0x94]
call fcn.00488660
mov esi, dword [edi + 4]
add esp, 4
sub esi, 0x94
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 4
lea ecx, [esi + 0x7c]
call fcn.00401f40
mov byte [ebp - 4], 3
lea ecx, [esi + 0x64]
call fcn.00401f40
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.00401f40
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.00401f40
mov byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.00401f40
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00401f40
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
add dword [edi + 4], 0xffffff6c
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x488c70
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4eaaef
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x522008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 4
lea ecx, [esi + 0x7c]
call fcn.00401f40
mov byte [ebp - 4], 3
lea ecx, [esi + 0x64]
call fcn.00401f40
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.00401f40
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.00401f40
mov byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.00401f40
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00401f40
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x489f50
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4eac8f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x522008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push esi
call fcn.00404490
mov dword [ebp - 4], 0
lea eax, [esi + 0x18]
push eax
lea ecx, [edi + 0x18]
call fcn.00404490
mov byte [ebp - 4], 1
lea eax, [esi + 0x30]
push eax
lea ecx, [edi + 0x30]
call fcn.00404490
mov byte [ebp - 4], 2
lea eax, [esi + 0x48]
push eax
lea ecx, [edi + 0x48]
call fcn.00404490
mov byte [ebp - 4], 3
lea ecx, [edi + 0x64]
mov al, byte [esi + 0x60]
mov byte [edi + 0x60], al
lea eax, [esi + 0x64]
push eax
call fcn.00404490
mov byte [ebp - 4], 4
lea eax, [esi + 0x7c]
push eax
lea ecx, [edi + 0x7c]
call fcn.00404490
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x48c3d0
Capabilities:
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x414]
sub esp, 0x414
push 0xfffffffffffffffe
push 0x51be58
push 0x4b7010
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x522008]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x410], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.00402330
mov dword [ebp - 0x24], 0
mov dword [eax + 0x10], 0
cmp dword [eax + 0x14], 8
jb 0x48c442
mov eax, dword [eax]
lea ecx, [ebp - 0x24]
push ecx
push eax
call fcn.00402560
add esp, 8
mov edx, esi
mov ecx, edi
call fcn.0048c530
mov bl, al
mov byte [ebp - 0x19], bl
mov dword [ebp - 4], 0xfffffffe
jmp 0x48c481
test bl, bl
jne 0x48c504
cmp edi, 0x1a
jne 0x48c504
mov ecx, esi
call fcn.00402330
mov dword [ebp - 0x20], 0
mov dword [eax + 0x10], 0
cmp dword [eax + 0x14], 8
jb 0x48c4a7
mov eax, dword [eax]
lea ecx, [ebp - 0x20]
push ecx
push eax
call fcn.00402560
push 0x410
push 0
lea eax, [ebp]
push eax
call fcn.004b7720
add esp, 0x14
push 0x207
lea eax, [ebp]
push eax
push str.APPDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [ebp]
push eax
call fcn.004025c0
add esp, 4
push eax
lea eax, [ebp]
push eax
mov ecx, esi
call fcn.004023b0
mov ecx, esi
call fcn.00402120
movzx ebx, bl
mov ecx, 1
test al, al
cmove ebx, ecx
mov al, bl
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x410]
xor ecx, ebp
call fcn.004b5964
lea esp, [ebp + 0x414]
pop ebp
ret

Function at 0x48d4b0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x522008]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
push ebx
push ebp
mov ebp, ecx
mov dword [esp + 8], eax
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
push edi
cmp dword [ebp + 0x10], 0xffffffff
mov edi, dword [esp + 0x20]
je 0x48d532
mov ecx, 0x100000
nop dword [eax]
nop word [eax + eax]
cmp esi, 0x100000
mov dword [esp + 0x14], 0
push 0
mov eax, esi
cmova eax, ecx
lea ecx, [esp + 0x18]
push ecx
push eax
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x14]
add ebx, ecx
test eax, eax
je 0x48d532
test ecx, ecx
je 0x48d52e
add edi, ecx
sub esi, ecx
mov ecx, 0x100000
jne 0x48d4f0
xor eax, eax
jmp 0x48d537
mov eax, 1
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x48d541
mov dword [ecx], ebx
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004b5964
add esp, 0xc
ret 0xc
Function at 0x490a90
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ebda1
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x522008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.DL::RCSimpleDownloadHandler.0
mov dword [edi + 4], vtable.DL::RCSimpleDownloadHandler.1.0
mov dword [ebp - 4], 7
mov dword [edi + 0x98], 0
mov byte [ebp - 4], 6
or ebx, 0xffffffff
mov esi, dword [edi + 0xf8]
test esi, esi
je 0x490b0b
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x490b0b
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov eax, ebx
lock xadd dword [esi + 8], eax
jne 0x490b0b
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov byte [ebp - 4], 5
mov ecx, dword [edi + 0xec]
test ecx, ecx
je 0x490b26
lock xadd dword [ecx + 8], ebx
dec ebx
jne 0x490b26
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 4
mov eax, dword [edi + 0xe4]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
test eax, eax
je 0x490b57
push eax
call ebx
push 0x18
push dword [edi + 0xe4]
call fcn.004b5c3f
add esp, 8
mov dword [edi + 0xe4], 0
mov byte [ebp - 4], 3
lea esi, [edi + 0xc0]
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 8
mov eax, dword [esi]
test eax, eax
je 0x490b7b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
mov byte [ebp - 4], 3
lea ecx, [esi + 8]
call fcn.00401f40
mov byte [ebp - 4], 2
mov eax, dword [edi + 0xac]
test eax, eax
je 0x490bb2
push eax
call ebx
push 0x18
push dword [edi + 0xac]
call fcn.004b5c3f
add esp, 8
mov dword [edi + 0xac], 0
mov byte [ebp - 4], 1
mov ecx, dword [edi + 0xa0]
test ecx, ecx
je 0x490c2d
mov edx, dword [edi + 0xa4]
push ecx
call fcn.0040ed50
mov eax, dword [edi + 0xa8]
add esp, 4
mov ecx, dword [edi + 0xa0]
sub eax, ecx
sar eax, 3
lea edx, [eax*8]
cmp edx, 0x1000
jb 0x490c05
mov esi, dword [ecx - 4]
add edx, 0x23
sub ecx, esi
lea eax, [ecx - 4]
cmp eax, 0x1f
ja 0x490cac
mov ecx, esi
push edx
push ecx
call fcn.004b5c3f
add esp, 8
mov dword [edi + 0xa0], 0
mov dword [edi + 0xa4], 0
mov dword [edi + 0xa8], 0
mov byte [ebp - 4], 0
lea esi, [edi + 0x10]
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 0xc
lea ecx, [esi + 0x70]
call fcn.00401f40
mov byte [ebp - 4], 0xb
lea ecx, [esi + 0x48]
call fcn.00401f40
mov byte [ebp - 4], 0xa
lea ecx, [esi + 0x30]
call fcn.00401f40
mov byte [ebp - 4], 9
lea ecx, [esi + 0x18]
call fcn.00401f40
mov byte [ebp - 4], 0
mov ecx, esi
call fcn.00401f40
mov dword [ebp - 4], 0xe
mov dword [edi + 4], vtable.RC::RCRefCounted.0
mov dword [ebp - 4], 0xffffffff
mov dword [edi], vtable.DL::ISimpleDownloadHandler.0
mov dword [ebp - 4], 0xffffffff
mov dword [edi], vtable.RC::IRefCount.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004b9689
int3
Function at 0x4931e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ec348
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x522008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
mov esi, dword [ebp + 8]
mov ecx, esi
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x3c]
push eax
push 2
push 0xffffffffffffffff
push 0xffff8000
movlpd qword [ebp - 0x3c], xmm0
call fcn.00411b00
test al, al
jne 0x493240
mov eax, 1
jmp 0x4933bd
push 0x10000
call fcn.004b6098
mov ebx, eax
mov dword [ebp - 0x18], 0
add esp, 4
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], 0
push 0x10000
push 0
push ebx
call fcn.004b7720
mov eax, dword [esi]
add esp, 0xc
mov dword [ebp - 0x1c], 0
test eax, eax
je 0x493396
test ebx, ebx
je 0x493396
cmp dword [eax], 0xffffffff
je 0x493396
push 0
lea ecx, [ebp - 0x1c]
push ecx
push 0x8000
push ebx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x493396
mov esi, dword [ebp - 0x20]
mov ecx, 0x8000
xor ebx, ebx
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], ecx
add esi, ecx
nop word [eax + eax]
cmp byte [edi + 0x9c], 0
jne 0x49338c
lea edx, [ebp - 0x30]
mov dword [ebp - 0x30], 0
push edx
lea edx, [ebp - 0x24]
mov dword [ebp - 0x24], 0
push edx
push ecx
mov ecx, dword [ebp - 0x34]
lea eax, [esi + ebx]
push eax
call fcn.004af960
test al, al
je 0x49337f
mov eax, dword [ebp - 0x24]
test eax, eax
jne 0x493332
mov eax, dword [edi + 0xc0]
test eax, eax
je 0x493321
push 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [edi + 0x9c], 0
jne 0x49338c
inc dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
jmp 0x49333c
add ebx, eax
cmp ebx, 0x8000
je 0x49334c
cmp dword [ebp - 0x28], 0xf
ja 0x493375
mov ecx, dword [ebp - 0x2c]
sub ecx, eax
mov dword [ebp - 0x2c], ecx
jne 0x4932d0
mov ebx, dword [ebp - 0x20]
mov edx, 0x7ffc
mov ecx, ebx
mov eax, dword [ecx]
cmp eax, dword [esi]
jne 0x49336e
add ecx, 4
add esi, 4
sub edx, 4
jae 0x493356
mov esi, 4
jmp 0x4933a7
mov esi, 5
jmp 0x4933a7
mov ebx, dword [ebp - 0x20]
mov esi, 3
jmp 0x4933a7
mov eax, dword [ebp - 0x30]
mov esi, 3
mov ebx, dword [ebp - 0x20]
jmp 0x4933a1
mov ebx, dword [ebp - 0x20]
mov esi, 2
jmp 0x4933a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 1
mov dword [edi + 0xb0], eax
mov dword [ebp - 4], 0xffffffff
test ebx, ebx
je 0x4933bb
push ebx
call fcn.004b5e98
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004b5964
mov esp, ebp
pop ebp
ret 0xc
Function at 0x496c50
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ea8ff
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x522008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push edx
push 0x94
call fcn.00401890
mov esi, dword [ebp + 8]
add esp, 8
mov edi, eax
mov ecx, eax
mov dword [ebp - 0x10], edi
push esi
call fcn.00402250
mov dword [ebp - 4], 0
lea ecx, [esi + 0x18]
push ecx
lea ecx, [edi + 0x18]
call fcn.00402250
mov byte [ebp - 4], 1
lea eax, [esi + 0x30]
push eax
lea ecx, [edi + 0x30]
call fcn.00402250
mov byte [ebp - 4], 2
lea eax, [esi + 0x48]
push eax
lea ecx, [edi + 0x48]
call fcn.00402250
mov byte [ebp - 4], 3
lea ecx, [edi + 0x64]
mov al, byte [esi + 0x60]
mov byte [edi + 0x60], al
lea eax, [esi + 0x64]
push eax
call fcn.00402250
mov byte [ebp - 4], 4
lea eax, [esi + 0x7c]
push eax
lea ecx, [edi + 0x7c]
call fcn.00402250
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x499860
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x522008]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [ecx]
push esi
push edi
mov edi, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x4998c5
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4998a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4998c5
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, esi
mov dword [edi], ecx
adc eax, 0
mov dword [edi + 4], eax
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.004b5964
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.004b5964
add esp, 8
ret 4
Function at 0x499a40
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ed318
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x522008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
test ecx, ecx
je 0x499a89
mov dword [ecx], 0
mov dword [eax], 0
cmp dword [edi], 0xffffffff
je 0x499bdb
mov eax, dword [ebp + 0xc]
mov ecx, 0x100000
push 0
mov ebx, eax
mov dword [ebp - 0x1c], 0
cmp eax, 0x100000
lea eax, [ebp - 0x1c]
push eax
cmova ebx, ecx
push ebx
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
cmp dword [edi + 0x1c], 0
je 0x499ba6
test eax, eax
je 0x499ba6
mov edx, dword [ebp - 0x1c]
cmp edx, ebx
jae 0x499ba9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [edi]
mov dword [ebp - 0x24], eax
cmp ecx, 0xffffffff
je 0x499b2b
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x499b1f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x499b2b
mov eax, dword [ebp - 0x14]
xor ecx, ecx
add ecx, esi
adc eax, 0
jmp 0x499b39
xorps xmm0, xmm0
movlpd qword [ebp - 0x38], xmm0
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
push 0
push dword [ebp - 0x24]
push eax
push ecx
sub esp, 0x18
lea eax, [edi + 4]
mov ecx, esp
mov dword [ebp - 0x24], esp
push eax
call fcn.00402250
mov dword [ebp - 4], 0
mov ecx, dword [edi + 0x1c]
mov eax, dword [ecx]
mov dword [ebp - 4], 0xffffffff
call dword [eax + 0x18]
mov esi, dword [ebp - 0x20]
test eax, eax
jne 0x499ba6
push eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x1c]
push ebx
add eax, esi
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, eax
xor edx, edx
test ecx, ecx
mov eax, 0x80004005
cmovne eax, edx
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
test ecx, ecx
je 0x499ae4
jmp 0x499ba9
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x28]
add dword [ecx], edx
test eax, eax
jne 0x499bd2
test edx, edx
je 0x499bce
mov eax, dword [ebp + 0xc]
add esi, edx
sub eax, edx
mov dword [ebp - 0x20], esi
mov dword [ebp + 0xc], eax
mov ecx, 0x100000
jne 0x499aa0
mov al, 1
jmp 0x499bdd
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x499bdb
mov dword [ecx], eax
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b5964
mov esp, ebp
pop ebp
ret 0x10