joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ed70
Capabilities:
Encrypt data using des

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, pe_nt_image_headers32
sub esp, 0x180
mov dword [esp + 0xc], ecx
mov word [esp + 0xa], dx
xor ecx, ecx
mov edx, 0x38
jmp 0x40eda4
movzx edx, byte [ecx + str.80_]
mov ebx, edx
and ebx, 7
mov ebx, dword [ebx*4 + 0x422120]
shr edx, 3
movzx edx, byte [eax + edx]
and edx, ebx
cmp edx, ebx
sete byte [esp + ecx + 0x10]
add ecx, 1
cmp ecx, 0x38
jne 0x40ed91
mov dword [esp], 0x1e
mov eax, 1
xor ebp, ebp
lea esi, [esi]
cmp word [esp + 0xa], 1
lea ecx, [ebp + ebp]
lea ebx, [esp + 0x48]
cmove ecx, dword [esp]
movzx edi, al
lea edx, [edi + 0x1c]
mov eax, edi
sub ebx, edi
lea esi, [ecx + 1]
mov dword [esp + 4], ecx
mov dword [esp + esi*4 + 0x80], 0
mov dword [esp + ecx*4 + 0x80], 0
jmp 0x40ee1f
movzx ecx, byte [esp + eax + 0x10]
mov byte [ebx + eax], cl
add eax, 1
cmp edx, eax
je 0x40ee33
cmp eax, 0x1b
jbe 0x40ee10
movzx ecx, byte [esp + eax - 0xc]
mov byte [ebx + eax], cl
add eax, 1
cmp edx, eax
jne 0x40ee1f
mov ecx, dword [esp + 4]
lea ebx, [esp + 0x48]
lea edx, [edi + 0x38]
sub ebx, edi
mov edi, ecx
jmp 0x40ee53
movzx ecx, byte [esp + eax + 0x10]
mov byte [ebx + eax], cl
add eax, 1
cmp edx, eax
je 0x40ee67
cmp eax, 0x37
jbe 0x40ee44
movzx ecx, byte [esp + eax - 0xc]
mov byte [ebx + eax], cl
add eax, 1
cmp edx, eax
jne 0x40ee53
mov ecx, edi
mov ebx, 0x28
mov edx, 0xd
xor eax, eax
jmp 0x40ee8e
movzx edx, byte [eax + 0x422040]
movzx ebx, byte [eax + 0x422058]
cmp byte [esp + edx + 0x48], 0
je 0x40eea3
mov edx, dword [eax*4 + 0x4220c0]
or dword [esp + ecx*4 + 0x80], edx
cmp byte [esp + ebx + 0x48], 0
je 0x40eeb8
mov edx, dword [eax*4 + 0x4220c0]
or dword [esp + esi*4 + 0x80], edx
add eax, 1
cmp eax, 0x18
jne 0x40ee80
add ebp, 1
sub dword [esp], 2
cmp ebp, 0x10
je 0x40eed8
movzx eax, byte [ebp + 0x422070]
jmp 0x40edd0
lea esi, [esp + 0x100]
xor ecx, ecx
mov edi, dword [esp + ecx*8 + 0x80]
mov edx, dword [esp + ecx*8 + 0x84]
mov ebx, edi
mov eax, edi
shl ebx, 6
shl eax, 0xa
and eax, 0x3f0000
and ebx, 0x3f000000
or ebx, eax
mov eax, edx
shr eax, 0xa
and eax, 0x3f00
or ebx, eax
mov eax, edx
shr eax, 6
and eax, 0x3f
or ebx, eax
mov eax, edi
shl edi, 0x10
shl eax, 0xc
mov dword [esi + ecx*8], ebx
and edi, 0x3f0000
and eax, 0x3f000000
mov ebx, edx
shr edx, 4
or eax, edi
and ebx, 0x3f
and edx, 0x3f00
or eax, ebx
or eax, edx
mov dword [esi + ecx*8 + 4], eax
add ecx, 1
cmp ecx, 0x10
jne 0x40eee1
mov eax, dword [esi]
mov ecx, dword [esp + 0xc]
mov dword [ecx], eax
mov edi, ecx
mov eax, dword [esi + 0x7c]
add edi, 4
and edi, 0xfffffffc
mov dword [ecx + 0x7c], eax
sub ecx, edi
sub esi, ecx
sub ecx, 0xffffff80
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
add esp, 0x180
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40f860
Capabilities:
Hash data with md5

Disassembly:
push ebx
sub esp, 0x18
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x40f8a3
mov dword [ebx + 8], 0x67452301
mov dword [ebx + 0xc], 0xefcdab89
xor eax, eax
mov dword [ebx + 0x10], 0x98badcfe
mov dword [ebx + 0x14], 0x10325476
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 0x18], 0
add esp, 0x18
pop ebx
ret
mov dword [esp + 8], 0xb0
mov dword [esp + 4], str._home_linux_work_programs_ntpwedit_libntpw_libtomcrypt_src_hashes_md4.c
mov dword [esp], str.md___NULL
call fcn.0040fc70
jmp 0x40f86c

Function at 0x413550
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.004135b0

Function at 0x4135b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x425520]
test esi, esi
jle 0x41369d
mov edi, dword [0x425524]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x4135e4
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x413696
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x4135d0
mov dword [esp], eax
mov esi, eax
call fcn.00413f00
test eax, eax
mov edi, eax
je 0x4136da
mov esi, dword [0x425524]
lea ebx, [ebx + ebx*2]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call fcn.00414010
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x425524]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x4136ba
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x41368f
sub eax, 0x40
and eax, 0xffffffbf
je 0x41368f
mov eax, dword [esp + 0x20]
add ebx, dword [0x425524]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x4136a4
add dword [0x425520], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor ebx, ebx
jmp 0x4135ee
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00413550
mov eax, dword [0x425524]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00413550
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00413550
lea esi, [esi]
Function at 0x413b70
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x425538
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x425530]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x413bc5
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x413bbe
test esi, esi
je 0x413bbe
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x413ba0
mov dword [esp], 0x425538
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4018e0
Capabilities:
Clear file content

Disassembly:
mov eax, 0x2000
call fcn.00407e30
push esi
mov esi, dword [esp + 0x2008]
mov eax, dword [esi + 8]
test eax, eax
je 0x401981
mov al, byte [esi + 4]
test al, al
jne 0x401981
push edi
mov ecx, 0x400
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
mov ecx, 0x400
lea edi, [esp + 0x1008]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x2014]
lea eax, [esp + 0x2018]
push eax
lea edx, [esp + 0xc]
push ecx
push edx
mov byte [esi + 4], 1
call fcn.00407dda
mov eax, dword [esp + 0x201c]
add esp, 0xc
lea ecx, [esp + 8]
lea edx, [esp + 0x1008]
push eax
push ecx
push str.__s__return_Error_Code___d
push edx
call fcn.00407d88
mov eax, dword [esi + 8]
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
lea ecx, [esp + 0x1008]
push ecx
mov ecx, esi
call fcn.00401a10
mov byte [esi + 4], 0
pop edi
pop esi
add esp, 0x2000
ret

Function at 0x401990
Capabilities:
Clear file content

Disassembly:
mov eax, 0x1000
call fcn.00407e30
push esi
mov esi, dword [esp + 0x1008]
mov eax, dword [esi + 8]
test eax, eax
je 0x4019fa
mov al, byte [esi + 4]
test al, al
jne 0x4019fa
push edi
mov ecx, 0x400
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x1010]
lea eax, [esp + 0x1014]
push eax
lea edx, [esp + 0xc]
push ecx
push edx
mov byte [esi + 4], 1
call fcn.00407dda
mov eax, dword [esi + 8]
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.00401a10
mov byte [esi + 4], 0
pop edi
pop esi
add esp, 0x1000
ret
Function at 0x4059c0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4187b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x124
push ebx
push esi
mov esi, ecx
push edi
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x130]
mov dword [ebp - 0x10], esp
rep stosd dword es:[edi], eax
push 0x423f20
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x1c], 0x3f2
mov dword [ebp - 0x20], 0x104
mov bl, 1
mov dword [ebp - 0x18], 0
call fcn.00413688
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 0
push eax
push 0x20019
push 0
push str.Software
push 0x80000002
mov byte [ebp - 4], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405b57
test bl, bl
je 0x405b2a
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x130]
push eax
rep stosd dword es:[edi], eax
push eax
push eax
lea ecx, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x130]
push ecx
mov ecx, dword [ebp - 0x24]
push edx
push eax
push ecx
mov dword [ebp - 0x20], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x405b05
push 0x423f20
lea ecx, [ebp - 0x14]
call fcn.00413757
lea edx, [esi + 0x210a]
lea eax, [ebp - 0x130]
push edx
push eax
lea ecx, [ebp - 0x14]
push str.Software_sINF_Installer_s
push ecx
call fcn.00412be6
mov eax, dword [ebp - 0x14]
add esp, 0x10
lea edx, [ebp - 0x28]
push edx
push 0x20019
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405b22
mov ecx, dword [ebp - 0x14]
mov edx, dword [esi + 0x251c]
push ecx
push str.__s__Key_is_found
push edx
call fcn.00401990
mov eax, dword [ebp - 0x28]
add esp, 0xc
mov dword [ebp - 0x1c], 0
xor bl, bl
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x18]
jmp 0x405a49
push str.RegEnumKeyEx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi + 0x251c]
push eax
push ecx
call fcn.004018e0
add esp, 0xc
xor bl, bl
inc dword [ebp - 0x18]
jmp 0x405a49
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
call fcn.0041361a
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
push str.RegOpenKeyEx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [esi + 0x251c]
push eax
call fcn.004018e0
add esp, 0xc
jmp 0x405b34
Function at 0x410879
Capabilities:
Access peb ldr_data

Disassembly:
in al, dx
add ebp, 0x24
push esp
call fcn.0040e6d8
mov esi, eax
push ss
pop ecx
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
cmp byte [eax + 0x1c], 0x18
je 0x41089c
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.0040e6d8
and byte [edi - 0x1c], bl
cmp cl, byte [ebx + 0x3c478bf8]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.0040e6d8
mov eax, dword [0x49c4d6b7]
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x4108c5
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x4108c5
call fcn.0040e6d8
mov dword [ecx + 0x5a8b723d], eax
and al, 3
fbld tbyte [esi - 0x75]
or al, 0x4b
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
call fcn.0040e6d8
sar dword [ecx + 0x75ff1e84], cl
Function at 0x7d703bc0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x110
lea eax, [ebp - 0x110]
mov dword [ebp - 4], eax
cmp dword [ebp + 0x18], 0xf0
jbe 0x7d703be4
xor eax, eax
jmp 0x7d703c67
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x10]
push edx
call dword [sym.imp.ntext.dll_RtlInitUnicodeString]
lea eax, [ebp + 0x18]
push eax
push 0x100
lea ecx, [ebp - 0x110]
push ecx
push 2
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ntext.dll_NtQueryValueKey]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x7d703c2f
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ntext.dll_RtlNtStatusToDosError]
push eax
call sub.kernel32.dll_SetLastError
xor eax, eax
jmp 0x7d703c67
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
cmp eax, dword [ebp + 0x10]
je 0x7d703c48
push 0x65d
call sub.kernel32.dll_SetLastError
xor eax, eax
jmp 0x7d703c67
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
push edx
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
mov ecx, dword [ebp + 0x14]
push ecx
call sub.ntext.dll_memcpy
add esp, 0xc
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x7d703f10
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x7d75628c]
mov dword [ebp - 4], eax
mov ecx, dword [0x7d75628c]
add ecx, 1
mov dword [0x7d75628c], ecx
cmp dword [ebp - 4], 0
jne 0x7d703f48
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push str.__p___p__stub__n
call sub.ntext.dll_DbgPrint
add esp, 0xc
xor eax, eax
mov esp, ebp
pop ebp
ret 8

Function at 0x7d704360
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
mov dword [ebp - 4], eax
push 0x29
push 4
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ntext.dll_NtSetInformationFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jl 0x7d704397
mov eax, 1
jmp 0x7d7043a0
push 0x78
call sub.kernel32.dll_SetLastError
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x7d7045f0
Capabilities:
Map section object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp + 0x1c]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
cmp dword [ebp + 0xc], 1
jne 0x7d70461f
mov dword [ebp - 4], 8
jmp 0x7d704676
mov ecx, dword [ebp + 0xc]
and ecx, 2
je 0x7d704647
mov edx, dword [ebp + 0xc]
and edx, 0x20
je 0x7d704638
mov dword [ebp - 8], 0x40
jmp 0x7d70463f
mov dword [ebp - 8], 4
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x7d704676
mov ecx, dword [ebp + 0xc]
and ecx, 4
je 0x7d70466f
mov edx, dword [ebp + 0xc]
and edx, 0x20
je 0x7d704660
mov dword [ebp - 0xc], 0x20
jmp 0x7d704667
mov dword [ebp - 0xc], 2
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
jmp 0x7d704676
mov dword [ebp - 4], 1
cmp dword [ebp + 0x20], 0xffffffff
je 0x7d704688
mov ecx, dword [ebp + 0x20]
add ecx, 1
or ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
push edx
push 0
push 1
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x20]
push ecx
push 0
push 0
lea edx, [ebp - 0x14]
push edx
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ntext.dll_NtMapViewOfSection]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jge 0x7d7046c2
mov ecx, dword [ebp - 0x10]
push ecx
call sym.kernelbase.dll_BaseSetLastNTError
xor eax, eax
jmp 0x7d7046c5
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x7d7047f0
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sym.kernelbase.dll_SetFileAttributesA
pop ebp
ret 0xc

Function at 0x7d704810
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sym.kernelbase.dll_SetFileAttributesW
pop ebp
ret 0xc
Function at 0x7d705bb0
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ntext.dll_RtlSetHeapInformation]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jl 0x7d705bde
mov eax, 1
jmp 0x7d705bf6
push str.HeapSetInformation_::_Status_unsuccess__return_FALSE_n
call sub.ntext.dll_DbgPrint
add esp, 4
mov ecx, dword [ebp - 4]
push ecx
call sym.kernelbase.dll_BaseSetLastNTError
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10

Function at 0x7d705c10
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 0x20], 0
je 0x7d705c2b
push str.unexpected_version_parameter_n
call sub.ntext.dll_DbgPrint
add esp, 4
cmp dword [ebp + 0x24], 0
je 0x7d705c3e
push str.unexpected_reserved_value_n
call sub.ntext.dll_DbgPrint
add esp, 4
cmp dword [ebp + 0x28], 0
je 0x7d705c51
push str.unexpected_lParam_n
call sub.ntext.dll_DbgPrint
add esp, 4
cmp dword [ebp + 0x10], 0
je 0x7d705c5d
cmp dword [ebp + 0x18], 0
jne 0x7d705c6b
push 0x57
call sub.kernel32.dll_SetLastError
xor eax, eax
jmp 0x7d705d0d
mov eax, dword [ebp + 0xc]
and eax, 0xaffceff8
je 0x7d705c86
push 0x3ec
call sub.kernel32.dll_SetLastError
xor eax, eax
jmp 0x7d705d0d
mov ecx, dword [ebp + 0xc]
and ecx, 0x10000000
je 0x7d705c9e
push str.Ignoring_unknown_flags_0x10000000_n
call sub.ntext.dll_DbgPrint
add esp, 4
cmp dword [ebp + 0x14], 0
jge 0x7d705cb3
mov edx, dword [ebp + 0x10]
push edx
call sub.ntext.dll_wcslen
add esp, 4
mov dword [ebp + 0x14], eax
cmp dword [ebp + 0x1c], 0
jge 0x7d705cc8
mov eax, dword [ebp + 0x18]
push eax
call sub.ntext.dll_wcslen
add esp, 4
mov dword [ebp + 0x1c], eax
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.7d715ec0
add esp, 0x14
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x7d705d08
cmp dword [ebp - 4], 0
jge 0x7d705cfc
mov dword [ebp - 8], 1
jmp 0x7d705d03
mov dword [ebp - 8], 3
mov eax, dword [ebp - 8]
jmp 0x7d705d0d
mov eax, 2
mov esp, ebp
pop ebp
ret 0x24
Function at 0x7d706700
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24c
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
cmp dword [ebp + 0x14], 0
je 0x7d70672d
push 0x57
call sub.kernel32.dll_SetLastError
xor eax, eax
jmp 0x7d7068c1
lea eax, [ebp - 0x18]
push eax
push 0x20019
push 0
push str.Locale
mov ecx, dword [0x7d7562bc]
push ecx
call sym.kernelbase.dll_RegOpenKeyExW
test eax, eax
je 0x7d706754
xor eax, eax
jmp 0x7d7068c1
lea edx, [ebp - 0x10]
push edx
push 0x20019
push 0
push str.Alternate_Sorts
mov eax, dword [ebp - 0x18]
push eax
call sym.kernelbase.dll_RegOpenKeyExW
test eax, eax
je 0x7d706778
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x34], 0xa
cmp dword [ebp - 4], 0
je 0x7d70678d
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x20], ecx
jmp 0x7d706793
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x38], eax
push 0
push 0
lea ecx, [ebp - 0x30]
push ecx
push 0
lea edx, [ebp - 0x34]
push edx
lea eax, [ebp - 0x4c]
push eax
mov ecx, dword [ebp - 0x38]
push ecx
mov edx, dword [ebp - 0x20]
push edx
call sym.kernelbase.dll_RegEnumValueW
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 0x28], 0
je 0x7d7067ed
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 0x2c], 0
je 0x7d7067e4
jmp 0x7d7068aa
mov dword [ebp - 8], 0
jmp 0x7d706778
cmp dword [ebp - 0x30], 1
je 0x7d7067f5
jmp 0x7d706778
push 0x10
push 0
lea eax, [ebp - 0x4c]
push eax
call sub.ntext.dll_wcstoul
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x7d706813
jmp 0x7d706778
push 0x100
lea ecx, [ebp - 0x24c]
push ecx
push 0x8000005c
mov edx, dword [ebp - 0xc]
push edx
call sym.kernelbase.dll_GetLocaleInfoW
push 2
lea eax, [ebp - 0x1c]
push eax
push 0xa0000071
mov ecx, dword [ebp - 0xc]
push ecx
call sym.kernelbase.dll_GetLocaleInfoW
test eax, eax
jne 0x7d70684c
mov dword [ebp - 0x1c], 0
cmp dword [ebp - 4], 0
je 0x7d70685b
mov dword [ebp - 0x14], 4
jmp 0x7d70687a
cmp dword [ebp - 0x1c], 0
je 0x7d70686a
mov dword [ebp - 0x24], 0x10
jmp 0x7d706871
mov dword [ebp - 0x24], 0x20
mov edx, dword [ebp - 0x24]
or edx, 1
mov dword [ebp - 0x14], edx
cmp dword [ebp + 0xc], 0
je 0x7d70688d
mov eax, dword [ebp - 0x14]
and eax, dword [ebp + 0xc]
jne 0x7d70688d
jmp 0x7d706778
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
lea eax, [ebp - 0x24c]
push eax
call dword [ebp + 8]
test eax, eax
jne 0x7d7068a5
jmp 0x7d7068aa
jmp 0x7d706778
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.7d711170
mov edx, dword [ebp - 0x18]
push edx
call fcn.7d711170
mov eax, 1
mov esp, ebp
pop ebp
ret 0x10
Function at 0x7d707110
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sym.kernelbase.dll_GetUserDefaultLCID
push eax
call sym.kernelbase.dll_LCIDToLocaleName
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push edx
push str.GetUserDefaultLocaleName_::_Default_Locale:__s_n
call sub.ntext.dll_DbgPrint
add esp, 8
mov eax, dword [ebp - 4]
push eax
push str.GetUserDefaultLocaleName_::_Return_value:__d_n
call sub.ntext.dll_DbgPrint
add esp, 8
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x7d707e90
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push str.AllocateUserPhysicalPagesNuma_called_n
call sub.ntext.dll_DbgPrint
add esp, 4
mov dword [ebp - 4], 0
cmp dword [ebp + 0x14], 0xffffffff
je 0x7d707eff
lea eax, [ebp - 0x14]
push eax
movzx ecx, byte [ebp + 0x14]
push ecx
call sym.kernelbase.dll_GetNumaNodeProcessorMask
test eax, eax
jne 0x7d707ed7
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sym.kernelbase.dll_AllocateUserPhysicalPages
jmp 0x7d707f46
mov edx, dword [ebp - 0x14]
mov dword [ebp - 4], edx
call sym.kernelbase.dll_GetCurrentThread
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
push ecx
call sym.kernelbase.dll_SetThreadAffinityMask
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x7d707eff
xor eax, eax
jmp 0x7d707f46
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.ntext.dll_NtAllocateUserPhysicalPages
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
je 0x7d707f2e
call sym.kernelbase.dll_GetCurrentThread
mov dword [ebp - 8], eax
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
call sym.kernelbase.dll_SetThreadAffinityMask
cmp dword [ebp - 0xc], 0
jl 0x7d707f3b
mov eax, 1
jmp 0x7d707f46
mov ecx, dword [ebp - 0xc]
push ecx
call sym.kernelbase.dll_BaseSetLastNTError
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10