joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4706b0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52680e
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x569638]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, esi
call fcn.00466d30
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
xor edi, edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], eax
mov dword [ebp - 4], edi
mov dword [esi + 0x50], vtable.CTransparentWnd_class_CFloatButton_.0
mov dword [esi + 0x54], edi
mov byte [esi + 0x5c], 0xff
mov dword [esi + 0x60], edi
mov dword [esi + 0x58], edi
lea ebx, [esi + 0x64]
push ebx
mov byte [ebp - 4], 1
call fcn.00481170
mov dword [esi + method.IFontIconCBImpl_class_CFloatButton_.virtual_0], vtable.IFontIconCBImpl_class_CFloatButton_.0
mov dword [esi], vtable.CFloatButton.0
mov dword [esi + 0x2c], vtable.CFloatButton.1.0
mov dword [esi + 0x50], vtable.CFloatButton.2.0
mov dword [ebx], vtable.CFloatButton.3.0
mov dword [esi + method.IFontIconCBImpl_class_CFloatButton_.virtual_0], vtable.CFloatButton.4.0
mov dword [esi + 0x1b8], edi
lea ecx, [esi + 0x1bc]
push ecx
mov ecx, str.360InternationSafe_floatbutton.xml
mov byte [ebp - 4], 3
call fcn.00428460
mov dword [esi + 0x1c0], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x470860
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52c4b8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
mov eax, dword [0x569638]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [edi + 0x30]
mov ecx, dword [edi + 0x1bc]
push 0
push 0
push 0
push eax
lea ebx, [edi + 0x64]
push ebx
call fcn.00481400
test al, al
jne 0x4708b8
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x6c]
test eax, eax
jne 0x4708c9
push 0x80004003
call fcn.004f3830
lea esi, [ebp - 0x14]
call fcn.00466c30
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4709cf
push 0
push 0x2710
lea esi, [ebp - 0x10]
call fcn.00466c00
lea esi, [edi + 0x1b8]
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.00465ed0
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x470916
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
cmp dword [esi], 0
je 0x4709cf
mov eax, dword [esi]
test eax, eax
jne 0x47092f
push 0x80004003
call fcn.004f3830
push 1
push 0x3e9
lea esi, [ebp - 0x18]
call fcn.00466c00
mov byte [ebp - 4], 2
mov esi, dword [ebp - 0x18]
test esi, esi
je 0x4709bf
mov eax, esi
call fcn.00466b70
push 0
cmp eax, 2
jne 0x470971
push ecx
mov eax, esp
mov dword [eax], esi
mov eax, dword [esi]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x10], esp
push esi
call ecx
push ebx
mov edx, edi
call fcn.004821b0
jmp 0x4709bf
push 0
push 0
push 1
push edi
lea eax, [edi + 0x1ac]
push eax
push ecx
mov eax, esp
mov dword [ebp - 0x10], esp
mov dword [eax], esi
mov edx, dword [esi]
mov eax, dword [edx + 4]
push esi
call eax
lea ecx, [ebp - 0x10]
push ecx
push ebx
call fcn.00482e40
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4709bf
mov byte [eax + 0x3c], 1
mov byte [eax + 0x3d], 0x14
mov byte [eax + 0x3e], 0x28
mov byte [eax + 0x3f], 0xff
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4709bf
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov byte [ebp - 4], 0
test esi, esi
je 0x4709cf
mov ecx, dword [esi]
mov edx, dword [ecx + 8]
push esi
call edx
mov eax, dword [edi + 0x30]
lea esi, [edi + 0x50]
call fcn.004ac060
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4709f0
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x474320
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51caf0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x569638]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [ebp - 4], ebx
mov dword [esi], vtable.CFontIcon.0
mov byte [esi + 0x44], 0xff
mov eax, dword [0x570fac]
mov edx, dword [eax + 0xc]
mov ecx, 0x570fac
call edx
add eax, 0x10
mov dword [esi + 0x4c], eax
mov byte [ebp - 4], 1
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov eax, dword [0x570fac]
mov edx, dword [eax + 0xc]
mov ecx, 0x570fac
call edx
add eax, 0x10
mov dword [esi + 0x68], eax
mov byte [ebp - 4], 2
mov eax, dword [0x570fac]
mov edx, dword [eax + 0xc]
mov ecx, 0x570fac
call edx
add eax, 0x10
mov dword [esi + 0x6c], eax
mov byte [ebp - 4], 3
mov eax, dword [0x570fac]
mov edx, dword [eax + 0xc]
mov ecx, 0x570fac
call edx
add eax, 0x10
mov dword [esi + 0x70], eax
mov byte [ebp - 4], 4
xor eax, eax
mov word [esi + 0xa4], ax
mov dword [esi + 0xa8], ebx
mov dword [esi + 0xc4], ebx
mov dword [esi + 0xc8], ebx
mov dword [esi + 0xcc], 3
mov dword [esi + 0xd0], ebx
mov dword [esi + 0xd4], ebx
mov edx, dword [0x570fac]
mov eax, dword [edx + 0xc]
mov ecx, 0x570fac
call eax
add eax, 0x10
mov dword [esi + 0xd8], eax
mov byte [ebp - 4], 5
mov edx, dword [0x570fac]
mov eax, dword [edx + 0xc]
mov ecx, 0x570fac
call eax
add eax, 0x10
mov dword [esi + 0xdc], eax
mov byte [ebp - 4], 6
mov eax, 1
lea ecx, [esi + 0xec]
mov dword [esi + 0xe0], eax
mov byte [esi + 0xe4], bl
mov byte [esi + 0xe5], bl
mov dword [esi + 0xe8], eax
call fcn.004782e0
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x90], ebx
mov dword [esi + 0x94], ebx
mov dword [esi + 0x98], ebx
mov dword [esi + 0x9c], ebx
mov dword [esi + 0xa0], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0xb4], ebx
mov dword [esi + 0xb8], ebx
mov dword [esi + 0xbc], ebx
mov dword [esi + 0xc0], ebx
or eax, 0xffffffff
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x45], ebx
mov dword [esi + 0xac], 9
mov dword [esi + 0xb0], 0x190
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4779c0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x4779d3
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
push esi
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x477a51
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test esi, esi
je 0x477a43
mov eax, dword [ebp + 0x10]
push 0x57109e
push esi
mov dword [eax], esi
call fcn.004f4b86
mov ecx, dword [ebp + 0xc]
add esp, 8
mov dword [ecx], eax
test eax, eax
je 0x477a43
push 0
lea edx, [ebp - 4]
push edx
push esi
push eax
push edi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x477a43
cmp dword [ebp - 4], esi
jne 0x477a43
mov bl, 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x477a64
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
push esi
call fcn.00477930
add esp, 0xc
mov bl, al
pop edi
mov al, bl
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x47bc00
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5294e0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x569638]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [esp + 0x20]
push eax
push ecx
push edx
mov dword [esp + 0x2c], 0x60
call fcn.0047b820
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x47bc5f
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push ebx
call fcn.0047b9e0
mov ecx, dword [ebx + 4]
mov edi, eax
add esp, 8
lea eax, [esp + 0x14]
push eax
push ecx
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], 0
call sub.gdiplus.dll_GdipGetImageWidth
test eax, eax
je 0x47bc8c
mov dword [ebx + 8], eax
mov eax, dword [ebx + 4]
lea edx, [esp + 0x1c]
push edx
push eax
mov dword [esp + 0x24], 0
call sub.gdiplus.dll_GdipGetImageHeight
test eax, eax
je 0x47bca9
mov dword [ebx + 8], eax
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
imul ecx, esi
mov edx, dword [esp + 0x1c]
push esi
push eax
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], edx
call fcn.00453260
lea esi, [esp + 0x2c]
call fcn.0047b5f0
test al, al
je 0x47bd01
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push ecx
push edx
push edi
call fcn.004894b0
mov esi, eax
add esp, 0xc
test esi, esi
je 0x47bd01
test edi, edi
je 0x47bcfb
mov eax, dword [edi]
mov edx, dword [eax]
push 1
mov ecx, edi
call edx
mov dword [esp + 0x18], esi
mov edi, esi
lea eax, [esp + 0x14]
push eax
mov ecx, edi
mov dword [esp + 0x24], 0
call fcn.00489970
add esp, 4
mov dword [esp + 0x38], 0
mov ecx, dword [esp + 0x14]
cmp dword [ecx - 0xc], 0
je 0x47bd9d
lea esi, [esp + 0x1c]
call fcn.00456340
mov byte [esp + 0x38], 1
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x47bd81
push ecx
mov edx, esp
mov dword [esp + 0x24], esp
push edx
mov edi, str.disable_resize
call fcn.00428100
push ecx
mov byte [esp + 0x40], 2
mov edi, dword [esp + 0x1c]
mov eax, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.00428100
mov byte [esp + 0x40], 3
mov ecx, esi
mov byte [esp + 0x40], 1
call fcn.00456160
mov edi, dword [esp + 0x18]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [esp + 0x38], 0
test esi, esi
je 0x47bd9d
mov edx, dword [esi]
mov eax, dword [edx + 8]
push esi
call eax
mov edx, dword [ebx]
mov eax, dword [edx]
push 1
mov ecx, ebx
call eax
test edi, edi
je 0x47bdb5
mov edx, dword [edi]
mov eax, dword [edx]
push 1
mov ecx, edi
call eax
mov dword [esp + 0x38], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47bddd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x489690
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51e82d
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x569638]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 0x224], ebx
mov eax, dword [0x570fac]
mov edx, dword [eax + 0xc]
mov ecx, 0x570fac
call edx
add eax, 0x10
mov dword [ebp - 0x21c], eax
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x216]
mov dword [ebp - 4], ebx
push ecx
mov word [ebp - 0x218], ax
call fcn.004fb000
add esp, 0xc
lea edx, [ebp - 0x218]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x4897ac
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x489720
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
push ecx
call fcn.0042be60
push 0x208
lea edx, [ebp - 0x218]
push 0
push edx
call fcn.004fb000
mov ecx, dword [ebp - 0x21c]
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0
push 0x542fa8
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x4897ac
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x489781
sub eax, edx
sar eax, 1
push eax
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x21c]
push eax
call fcn.0042be60
lea eax, [ebp - 0x21c]
jmp 0x4897da
mov edx, dword [0x570fac]
mov eax, dword [edx + 0xc]
mov ecx, 0x570fac
call eax
add eax, 0x10
mov dword [ebp - 0x220], eax
mov ebx, 1
mov byte [ebp - 4], 1
lea eax, [ebp - 0x220]
mov dword [ebp - 0x224], ebx
mov eax, dword [eax]
sub eax, 0x10
call fcn.0042b8e0
add eax, 0x10
or ebx, 2
mov dword [edi], eax
mov dword [ebp - 4], 0
test bl, 1
je 0x48981a
mov eax, dword [ebp - 0x220]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48981a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x21c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x489843
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f398f
mov esp, ebp
pop ebp
ret
Function at 0x48ab90
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x569638]
xor eax, ebp
mov dword [ebp - 4], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x114]
push 0
push eax
call fcn.004fb000
add esp, 0xc
lea ecx, [ebp - 0x118]
push ecx
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 6
mov ecx, dword [ebp - 4]
sbb eax, eax
xor ecx, ebp
inc eax
call fcn.004f398f
mov esp, ebp
pop ebp
ret

Function at 0x48b2b0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51e7d8
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x569638]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x4c], ebx
cmp eax, ebx
jne 0x48b2f8
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
mov byte [esi + 4], bl
jmp 0x48b41f
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocStringLen
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x50], edi
cmp edi, 0xffffffff
je 0x48b3f2
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x4c], eax
cmp eax, 1
jbe 0x48b3eb
push 0x57109e
push eax
call fcn.004f4b86
mov edi, eax
add esp, 8
cmp edi, ebx
je 0x48b3e8
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x50]
push ebx
lea eax, [ebp - 0x54]
push eax
push ecx
push edi
push edx
mov dword [ebp - 0x54], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x48b3df
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x4c], eax
jne 0x48b3df
push eax
push edi
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x30], 0xf
mov dword [ebp - 0x34], ebx
mov byte [ebp - 0x44], bl
call fcn.0042a0d0
lea eax, [ebp - 0x70]
push eax
xor ecx, ecx
lea edx, [ebp - 0x48]
mov byte [ebp - 4], 1
call fcn.00442ec0
add esp, 4
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.0042a570
cmp dword [ebp - 0x58], 0x10
jb 0x48b3ca
mov ecx, dword [ebp - 0x6c]
push ecx
call fcn.004f3984
add esp, 4
mov byte [ebp - 4], bl
cmp dword [ebp - 0x30], 0x10
jb 0x48b3df
mov edx, dword [ebp - 0x44]
push edx
call fcn.004f3984
add esp, 4
push edi
call fcn.004f4972
add esp, 4
mov edi, dword [ebp - 0x50]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x2c]
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
push eax
mov ecx, esi
mov byte [esi + 4], bl
call fcn.0042a570
cmp dword [ebp - 0x14], 0x10
jb 0x48b41f
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.004f3984
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f398f
mov esp, ebp
pop ebp
ret
Function at 0x49f690
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x51a658
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x569638]
xor eax, esp
mov dword [esp + 0x34], eax
mov eax, dword [0x569638]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov eax, dword [esi + 0x30]
push 0x64
push eax
mov byte [esi + 0x1c4], 1
call dword [sym.imp.USER32.dll_KillTimer]
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], eax
mov byte [esp + 0x18], al
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
xor ecx, ecx
cmp dword [ebp + 8], eax
mov dword [esp + 0x48], eax
mov edx, dword [esi + 0x198]
mov edx, dword [edx + 4]
setne cl
lea eax, [esp + 8]
push eax
lea ecx, [ecx + ecx + 2]
mov dword [esp + 0x14], ecx
lea ecx, [esi + 0x198]
call edx
cmp dword [esp + 0x2c], 0x10
jb 0x49f737
mov eax, dword [esp + 0x18]
push eax
call fcn.004f3984
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.004f398f
mov esp, ebp
pop ebp
ret 4
Function at 0x4a45e0
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov esi, eax
push 0
lea eax, [esp + 0x14]
push eax
mov edi, ecx
mov dword [esp + 0x18], 0
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
jne 0x4a462a
mov edx, dword [edi]
mov eax, dword [edx + 0x28]
push 6
push esi
mov ecx, edi
call eax
mov eax, dword [ebp + 8]
mov dword [eax], 0xc0000018
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebx + 0x3c]
lea edx, [esp + 0x10]
lea eax, [edi + 0x40]
push edx
push eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], eax
call fcn.004a5b40
mov dword [eax], esi
push ebx
lea esi, [edi + 0x9c]
call fcn.0042fbc0
push edi
mov ecx, ebx
mov esi, 1
call fcn.00435db0
test al, al
jne 0x4a4693
mov eax, dword [ebx + 0x3c]
mov edi, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x18], eax
call fcn.00430fc0
mov ecx, dword [eax + 4]
mov edx, dword [eax]
push ecx
push edx
lea eax, [esp + 0x18]
push eax
push edi
call fcn.00430ce0
mov esi, 0xc0000001
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4ab3d0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5275e6
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x569638]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, esi
call fcn.00466d30
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
xor edi, edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], eax
mov dword [ebp - 4], edi
mov dword [esi + 0x50], vtable.CTransparentWnd_class_CBadgeWnd_.0
mov dword [esi + 0x54], edi
mov byte [esi + 0x5c], 0xff
mov dword [esi + 0x60], edi
mov dword [esi + 0x58], edi
lea ebx, [esi + 0x64]
push ebx
mov byte [ebp - 4], 1
call fcn.00481170
mov dword [esi], vtable.CBadgeWnd.0
mov dword [esi + 0x2c], vtable.CBadgeWnd.1.0
mov dword [esi + 0x50], vtable.CBadgeWnd.2.0
mov dword [ebx], vtable.CBadgeWnd.3.0
mov dword [esi + 0x1b4], edi
mov dword [esi + 0x1b8], edi
mov dword [esi + 0x1bc], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4ae200
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52756c
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x569638]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov eax, edi
call fcn.00466d30
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
xor ebx, ebx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x40], ebx
mov dword [edi + 0x44], ebx
mov dword [edi + 0x48], ebx
mov dword [edi + 0x4c], eax
lea eax, [edi + 0x50]
push eax
mov dword [ebp - 4], ebx
call fcn.00481170
mov dword [edi + method.CefWebViewHost.virtual_0], vtable.CefWebViewHost.0
mov dword [edi + 0x19c], 4
lea esi, [edi + 0x1a0]
mov byte [ebp - 4], 2
call fcn.004a6eb0
mov dword [edi], vtable.CCommPromoPopup.0
mov dword [edi + 0x2c], vtable.CCommPromoPopup.1.0
mov dword [edi + 0x50], vtable.CCommPromoPopup.2.0
mov dword [edi + method.CCommPromoPopup.3.virtual_0], vtable.CCommPromoPopup.3.0
mov dword [esi], vtable.CCommPromoPopup.4.0
mov dword [edi + 0x260], ebx
mov dword [edi + 0x264], ebx
mov eax, 7
xor ecx, ecx
mov dword [edi + 0x298], eax
mov dword [edi + 0x294], ebx
mov word [edi + 0x284], cx
xor edx, edx
mov dword [edi + 0x2b4], eax
mov dword [edi + 0x2b0], ebx
mov word [edi + 0x2a0], dx
mov dword [edi + 0x2d0], eax
xor eax, eax
mov dword [edi + 0x2cc], ebx
mov word [edi + 0x2bc], ax
lea ecx, [edi + 0x2dc]
mov byte [ebp - 4], 6
push ecx
mov byte [edi + 0x2d4], bl
mov dword [edi + 0x2d8], ebx
call fcn.004706b0
lea edx, [edi + 0x268]
push edx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, 1
test byte [0x5758b4], al
jne 0x4ae351
or dword [0x5758b4], eax
mov eax, 0x60
mov dword [0x5758b8], 0x64
mov dword [0x5758bc], eax
mov dword [0x5758c0], eax
mov byte [0x5758c4], bl
call fcn.00405f90
test al, al
jne 0x4ae351
call fcn.00453200
cmp byte [0x5758c4], bl
je 0x4ae373
mov eax, dword [0x5758b8]
cmp eax, 0x64
je 0x4ae373
push 0x64
push eax
push 0x29a
call dword [sym.imp.KERNEL32.dll_MulDiv]
jmp 0x4ae378
mov eax, 0x29a
mov dword [edi + 0x4a0], eax
mov dword [edi + 0x4a4], ebx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4