joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49b160
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebx
xor ebx, ebx
push ebp
push edi
cmp dword [esi + 0x34], ebx
ja 0x49b174
cmp dword [esi + 0x30], 0x40
jbe 0x49b278
mov edi, dword [esi + 0x28]
mov ebp, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 0x40
push edi
call ebp
test eax, eax
jne 0x49b27d
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x49b27d
mov byte [esi + 0x38], 1
mov eax, dword [edi + 0x3c]
mov edi, dword [esi + 0x34]
xor ecx, ecx
lea edx, [eax + 0xf8]
cmp edi, ecx
jb 0x49b278
ja 0x49b1bf
mov ecx, dword [esi + 0x30]
cmp ecx, edx
jbe 0x49b278
mov edx, dword [esi + 0x28]
add eax, edx
push 0xf8
push eax
mov dword [esi + 0x24], eax
call ebp
test eax, eax
jne 0x49b27d
mov eax, dword [esi + 0x24]
cmp dword [eax], 0x4550
jne 0x49b27d
mov ecx, 0x2000
test word [eax + 0x16], cx
jne 0x49b1f5
mov byte [esi + 0x44], 1
mov edx, eax
movzx eax, word [edx + 0x18]
mov ecx, 0x10b
cmp ax, cx
jne 0x49b211
mov dword [esi + 0x40], 1
add edx, 0x78
jmp 0x49b228
mov ecx, 0x20b
cmp ax, cx
jne 0x49b22b
mov dword [esi + 0x40], 2
add edx, 0x88
mov dword [esi + 0x20], edx
cmp dword [esi + 0x20], ebx
je 0x49b27d
mov eax, dword [esi + 0x24]
movzx ecx, word [eax + 6]
mov dword [esi + 0x3c], ecx
test ecx, ecx
je 0x49b27d
movzx edx, word [eax + 0x14]
mov ebx, dword [esi + 0x34]
lea ecx, [ecx + ecx*4]
add ecx, ecx
add ecx, ecx
add ecx, ecx
sub ecx, dword [esi + 0x28]
add ecx, edx
lea edi, [ecx + eax + 0x18]
xor ecx, ecx
cmp ebx, ecx
jb 0x49b278
ja 0x49b266
mov ecx, dword [esi + 0x30]
cmp ecx, edi
jbe 0x49b278
pop edi
mov ebx, 1
lea edx, [edx + eax + 0x18]
pop ebp
mov eax, ebx
mov dword [esi + 0x1c], edx
pop ebx
ret
mov ebx, 2
pop edi
pop ebp
mov eax, ebx
pop ebx
ret

Function at 0x49b450
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [ecx + 0x24]
push ebx
mov ebx, dword [eax + 0x28]
mov ecx, eax
movzx eax, word [eax + 0x14]
push esi
lea esi, [eax + ecx + 0x18]
movzx ecx, word [ecx + 6]
xor eax, eax
push edi
test ecx, ecx
jbe 0x49b488
lea ecx, [ecx]
mov edx, dword [esi + 0xc]
cmp ebx, edx
jb 0x49b480
mov edi, dword [esi + 8]
add edi, edx
cmp ebx, edi
jb 0x49b490
inc eax
add esi, 0x28
cmp eax, ecx
jb 0x49b470
pop edi
pop esi
xor eax, eax
pop ebx
ret 0x10
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
mov eax, esi
lea edx, [eax + 1]
jmp 0x49b4a0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x49b4a0
sub eax, edx
mov edi, eax
mov eax, dword [esp + 0x14]
push esi
call fcn.0040f500
mov eax, dword [esp + 0x18]
mov edx, ebx
sub edx, dword [esi + 0xc]
pop edi
mov dword [eax], edx
mov ecx, dword [esi + 8]
mov edx, dword [esp + 0x18]
sub ecx, ebx
add ecx, dword [esi + 0xc]
mov dword [edx], ecx
mov eax, dword [esi + 0x14]
sub eax, dword [esi + 0xc]
pop esi
add eax, ebx
pop ebx
ret 0x10
Function at 0x49b4e0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [eax + 0x24]
movzx edx, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
lea eax, [edx + ecx + 0x18]
xor edx, edx
test esi, esi
jbe 0x49b50f
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x49b507
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x49b511
inc edx
add eax, 0x28
cmp edx, esi
jb 0x49b4f7
xor eax, eax
pop esi
pop ebx
ret

Function at 0x49b520
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [eax + 0x24]
movzx ecx, word [eax + 0x14]
push ebx
push esi
movzx esi, word [eax + 6]
xor edx, edx
lea ecx, [ecx + eax + 0x18]
test esi, esi
jbe 0x49b54f
mov eax, dword [ecx + 0xc]
cmp edi, eax
jb 0x49b547
mov ebx, dword [ecx + 8]
add ebx, eax
cmp edi, ebx
jb 0x49b554
inc edx
add ecx, 0x28
cmp edx, esi
jb 0x49b537
pop esi
xor eax, eax
pop ebx
ret
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
pop esi
add eax, edi
pop ebx
ret

Function at 0x49b560
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [ebx + 0x24]
movzx ecx, word [eax + 0x14]
push ebp
push esi
movzx esi, word [eax + 6]
xor edx, edx
lea ecx, [ecx + eax + 0x18]
test esi, esi
jbe 0x49b58f
mov eax, dword [ecx + 0xc]
cmp edi, eax
jb 0x49b587
mov ebp, dword [ecx + 8]
add ebp, eax
cmp edi, ebp
jb 0x49b594
inc edx
add ecx, 0x28
cmp edx, esi
jb 0x49b577
pop esi
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
pop esi
add eax, dword [ebx + 0x28]
pop ebp
add eax, edi
ret
Function at 0x49b950
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x5d8268
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6d26f8]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x3c]
mov edi, dword [esp + 0x30]
mov ebx, dword [esp + 0x2c]
mov dword [esp + 0x14], 0
cmp ecx, 0x64
ja 0x49ba7c
mov eax, dword [edx]
cmp eax, 0x4e20
jg 0x49ba7c
inc eax
mov dword [edx], eax
mov eax, dword [ebx + 4]
test eax, eax
jns 0x49b9d0
push edx
mov edx, dword [esp + 0x3c]
push ebp
push edx
mov edx, dword [esp + 0x40]
push edx
mov edx, dword [ebx]
push edx
push ecx
mov ecx, dword [esp + 0x40]
and eax, 0x7fffffff
push edi
add eax, edi
push eax
call fcn.0049baa0
jmp 0x49ba7e
mov esi, dword [ebx]
push ecx
lea eax, [esp + 0x40]
push eax
call fcn.0049b880
add esp, 8
mov dword [esp + 0x20], 0
mov esi, dword [ebx + 4]
add esi, edi
je 0x49ba6b
mov edi, dword [esi]
mov ebx, dword [esp + 0x28]
call fcn.0049b560
lea ecx, [esp + 0x34]
push 0x69bbc8
push ecx
mov ecx, dword [esp + 0x3c]
mov edi, eax
call fcn.0041c860
mov byte [esp + 0x28], 1
lea edx, [esp + 0x44]
push edx
lea ecx, [esp + 0x34]
push ecx
mov ecx, eax
call fcn.0041c7b0
add esp, 0x10
mov byte [esp + 0x20], 2
mov edx, dword [esi + 4]
push ebp
push edx
push edi
push eax
call dword [esp + 0x48]
mov bl, al
mov byte [esp + 0x20], 1
lea ecx, [esp + 0x28]
call fcn.0040b720
mov byte [esp + 0x20], 0
lea ecx, [esp + 0x34]
call fcn.0040b720
mov dword [esp + 0x20], 0xffffffff
lea ecx, [esp + 0x3c]
call fcn.0040b720
mov al, bl
jmp 0x49ba7e
mov dword [esp + 0x20], 0xffffffff
lea ecx, [esp + 0x3c]
call fcn.0040b720
mov al, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x18
Function at 0x49d300
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x5c6489
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6d26f8]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, dword [esp + 0x30]
xor ebx, ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x14], ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esp + 0x28], ebx
movzx eax, word [esp + 0x34]
push 0x69a914
push eax
push ebx
mov dword [esp + 0x20], 1
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, ebx
je 0x49d3bd
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
cmp ebp, ebx
je 0x49d3bd
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
mov dword [esp + 0x34], edi
mov dword [esp + 0x28], 1
cmp edi, ebx
je 0x49d3ae
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, ebp
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
mov byte [esp + 0x28], 2
mov dword [esi], eax
mov dword [esi + 4], ecx
mov byte [esp + 0x28], 1
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x28], bl
cmp edi, ebx
je 0x49d3bd
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret

Function at 0x49d3e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x5c7bd9
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6d26f8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x14], ebp
call fcn.004383a0
mov dword [esp + 0x24], ebp
movzx eax, word [esp + 0x30]
push 0x69a914
push eax
mov ebx, 1
push ebp
mov dword [esp + 0x20], ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, ebp
je 0x49d4aa
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebp, eax
mov dword [esp + 0x18], ebp
mov dword [esp + 0x24], ebx
test ebp, ebp
je 0x49d49a
push ebp
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x49d49a
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x49d49a
lea ecx, [esp + 0x30]
push ebx
push ecx
mov edi, eax
call fcn.0049d4d0
add esp, 8
mov byte [esp + 0x24], 2
push eax
mov ebx, esi
call fcn.00442660
mov byte [esp + 0x24], 1
lea ebx, [esp + 0x30]
call fcn.004b7990
mov byte [esp + 0x24], 0
test ebp, ebp
je 0x49d4aa
push ebp
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x4a1040
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Get ntdll base address
Get number of processors
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x5c9a57
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x6d26f8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.IMdbScanner.0
mov dword [esp + 0x14], 0x20
lea eax, [esi + 0xc4]
push eax
call fcn.0041cd80
mov byte [esp + 0x14], 0x1f
lea ecx, [esi + 0xac]
push ecx
call fcn.0041cd80
mov byte [esp + 0x14], 0x1e
lea ecx, [esi + 0xa8]
call fcn.0040b950
mov byte [esp + 0x14], 0x1d
lea edx, [esi + 0x90]
push edx
call fcn.0041cd80
mov byte [esp + 0x14], 0x1c
lea eax, [esi + 0x78]
push eax
call fcn.0041cd80
mov byte [esp + 0x14], 0x1b
lea ecx, [esi + 0x74]
call fcn.0040b950
mov byte [esp + 0x14], 0x1a
lea ecx, [esi + 0x70]
call fcn.0040b950
mov byte [esp + 0x14], 0x19
lea ecx, [esi + 0x6c]
call fcn.0040b950
mov byte [esp + 0x14], 0x18
lea ecx, [esi + 0x68]
call fcn.0040b950
mov byte [esp + 0x14], 0x17
lea ecx, [esi + 0x64]
call fcn.0040b950
mov byte [esp + 0x14], 0x16
lea ecx, [esi + 0x60]
call fcn.0040b950
mov byte [esp + 0x14], 0x15
lea ecx, [esi + 0x5c]
call fcn.0040b950
mov byte [esp + 0x14], 0x14
lea ecx, [esi + 0x58]
call fcn.0040b950
mov byte [esp + 0x14], 0x13
lea ecx, [esi + 0x54]
call fcn.0040b950
mov byte [esp + 0x14], 0x12
lea ecx, [esi + 0x50]
call fcn.0040b950
mov byte [esp + 0x14], 0x11
lea ecx, [esi + 0x4c]
call fcn.0040b950
mov byte [esp + 0x14], 0x10
lea ecx, [esi + 0x48]
call fcn.0040b950
mov byte [esp + 0x14], 0xf
lea ecx, [esi + 0x44]
call fcn.0040b950
mov byte [esp + 0x14], 0xe
lea ecx, [esi + 0x40]
call fcn.0040b950
mov byte [esp + 0x14], 0xd
lea ecx, [esi + 0x3c]
call fcn.0040b950
mov byte [esp + 0x14], 0xc
lea ecx, [esi + 0x38]
call fcn.0040b950
mov byte [esp + 0x14], 0xb
lea ecx, [esi + 0x34]
call fcn.0040b950
mov byte [esp + 0x14], 0xa
lea ecx, [esi + 0x30]
call fcn.0040b950
mov byte [esp + 0x14], 9
lea ecx, [esi + 0x2c]
call fcn.0040b950
mov byte [esp + 0x14], 8
lea ecx, [esi + 0x28]
call fcn.0040b950
mov byte [esp + 0x14], 7
lea ecx, [esi + 0x24]
call fcn.0040b950
mov byte [esp + 0x14], 6
lea ecx, [esi + 0x20]
call fcn.0040b950
mov byte [esp + 0x14], 5
lea ecx, [esi + 0x1c]
call fcn.0040b950
mov byte [esp + 0x14], 4
lea ecx, [esi + 0x18]
call fcn.0040b950
mov byte [esp + 0x14], 3
lea ecx, [esi + 0x14]
call fcn.0040b950
mov byte [esp + 0x14], 2
lea ecx, [esi + 0x10]
call fcn.0040b950
mov byte [esp + 0x14], 1
lea ecx, [esi + 0xc]
call fcn.0040b950
mov byte [esp + 0x14], 0
lea ecx, [esi + 8]
call fcn.0040b950
mov dword [esp + 0x14], 0xffffffff
lea ecx, [esi + 4]
call fcn.0040b950
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x4a1250
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x5ce22d
mov eax, dword fs:[0]
push eax
sub esp, 0x814
mov eax, dword [0x6d26f8]
xor eax, esp
mov dword [esp + 0x810], eax
push ebx
push esi
push edi
mov eax, dword [0x6d26f8]
xor eax, esp
push eax
lea eax, [esp + 0x824]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x82c], ebx
mov edi, ecx
push edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], ebx
call fcn.0040b7e0
mov dword [esp + 0x82c], ebx
mov eax, 1
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0x82c], eax
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
je 0x4a12d3
push eax
call esi
mov dword [esp + 0x10], ebx
lea eax, [esp + 0x10]
push eax
push 0x20119
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a1334
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x24]
push edx
push ebx
push ebx
push str.ProgramFilesDir
push eax
mov dword [esp + 0x2c], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4a1334
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x4a1334
shr eax, 1
xor ecx, ecx
lea edx, [esp + 0x20]
mov word [esp + eax*2 + 0x20], cx
call fcn.0040b9c0
mov byte [esp + 0x82c], bl
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x4a1346
push eax
call esi
mov eax, edi
mov ecx, dword [esp + 0x824]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x810]
xor ecx, esp
call fcn.0059393a
add esp, 0x820
ret
Function at 0x4a2890
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x5ce1d1
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x6d26f8]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6d26f8]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
xor eax, eax
mov dword [esp + 0x50], eax
mov ebp, dword [esp + 0x58]
mov dword [esp + 0x20], eax
mov edi, ecx
xor ecx, ecx
push eax
lea ebx, [eax + 3]
lea esi, [esp + 0x2c]
mov dword [esp + 0x28], ebp
mov dword [esp + 0x18], 2
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], eax
mov word [esp + 0x30], cx
call fcn.00439bb0
mov esi, 1
mov dword [esp + 0x50], esi
xor ebx, ebx
push ebp
mov dword [esp + 0x20], ebx
call fcn.0040b7e0
mov dword [esp + 0x20], esi
mov dword [esp + 0x18], ebx
cmp byte [0x6eaed0], bl
je 0x4a292e
mov eax, 0x101
cmp byte [esp + 0x5c], bl
jne 0x4a2930
mov eax, esi
lea edx, [esp + 0x18]
push edx
push eax
push ebx
push edi
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x4a2a37
cmp dword [esp + 0x40], 8
mov eax, dword [esp + 0x2c]
jae 0x4a295a
lea eax, [esp + 0x2c]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x14]
push ecx
push eax
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x24]
push edx
push ebx
push ebx
push eax
call edi
cmp eax, 0xea
jne 0x4a29cd
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x3c]
inc ecx
cmp ecx, edx
ja 0x4a2998
or eax, 0xffffffff
mov ebx, ecx
lea esi, [esp + 0x28]
call fcn.0040b3a0
jmp 0x4a29a6
mov eax, ecx
push ebx
sub eax, edx
lea ebx, [esp + 0x2c]
call fcn.00439b50
cmp dword [esp + 0x40], 8
mov eax, dword [esp + 0x2c]
jae 0x4a29b5
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x14]
push ecx
push eax
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x24]
push edx
push 0
push 0
push eax
call edi
xor ebx, ebx
cmp eax, ebx
jne 0x4a2a2c
mov eax, dword [esp + 0x1c]
cmp eax, 1
je 0x4a29e4
cmp eax, 2
je 0x4a29e4
cmp eax, 7
jne 0x4a2a2c
mov ecx, dword [esp + 0x14]
cmp ecx, ebx
jbe 0x4a2a2c
mov edx, dword [esp + 0x3c]
shr ecx, 1
cmp ecx, edx
ja 0x4a2a06
or eax, 0xffffffff
mov ebx, ecx
lea esi, [esp + 0x28]
call fcn.0040b3a0
jmp 0x4a2a14
mov eax, ecx
push ebx
sub eax, edx
lea ebx, [esp + 0x2c]
call fcn.00439b50
cmp dword [esp + 0x40], 8
mov edx, dword [esp + 0x2c]
jae 0x4a2a23
lea edx, [esp + 0x2c]
mov edi, ebp
call fcn.0040b9c0
xor ebx, ebx
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [esp + 0x50], bl
cmp dword [esp + 0x40], 8
jb 0x4a2a4f
mov edx, dword [esp + 0x2c]
push edx
call fcn.0059392f
add esp, 4
xor eax, eax
mov dword [esp + 0x40], 7
mov dword [esp + 0x3c], ebx
mov word [esp + 0x2c], ax
mov eax, ebp
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.0059393a
add esp, 0x40
ret
Function at 0x4a8370
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x5ce064
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6d26f8]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x34]
mov ebp, dword [esp + 0x30]
xor esi, esi
mov dword [esp + 0x18], esi
cmp dword [ebp], esi
jne 0x4a83af
call fcn.004a7c20
mov eax, dword [ebp + 4]
cmp eax, esi
jne 0x4a83bb
call fcn.004a7c20
push eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x34], esi
call fcn.00583f10
add esp, 4
cmp eax, 6
jne 0x4a84a8
jmp 0x4a83e0
cmp dword [esp + 0x14], 0x3e8
jg 0x4a84a8
cmp dword [esp + 0x30], 3
jg 0x4a84a8
push esi
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 8
mov edi, eax
call fcn.005939b5
mov esi, eax
add esp, 4
mov dword [esp + 0x1c], esi
mov dword [esp + 0x28], 1
test esi, esi
je 0x4a8436
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [esi], edi
mov dword [esi + 4], eax
jmp 0x4a8438
xor esi, esi
mov byte [esp + 0x28], 0
mov eax, dword [ebp]
push esi
push 0x4a7a60
push eax
call fcn.0056dd26
add esp, 0xc
nop
push 1
push 0x1388
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
cmp eax, 0xc0
je 0x4a8450
test eax, eax
je 0x4a846d
inc dword [esp + 0x30]
mov ecx, dword [ebp]
push 0
push 0
push ecx
call fcn.0056dd26
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp + 4]
inc dword [esp + 0x14]
push edx
call fcn.0057d862
mov eax, dword [ebp + 4]
push eax
call fcn.00583f10
add esp, 8
xor esi, esi
cmp eax, 6
je 0x4a83e0
cmp eax, 0x65
jne 0x4a84f0
mov eax, dword [ebp + 4]
mov ecx, dword [ebp]
push eax
mov dword [ebx], ecx
mov dword [ebx + 4], eax
mov byte [ebx + 8], 1
call fcn.005581b2
add esp, 4
mov dword [ebx + 0xc], eax
mov byte [ebx + 0x10], 0
mov dword [esp + 0x28], esi
mov dword [esp + 0x18], 1
mov eax, ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 8
cmp eax, 0x64
mov eax, dword [ebp + 4]
push eax
jne 0x4a8516
mov edx, dword [ebp]
mov dword [ebx], edx
mov dword [ebx + 4], eax
mov byte [ebx + 8], 0
call fcn.005581b2
add esp, 4
mov dword [ebx + 0xc], eax
mov byte [ebx + 0x10], 0
jmp 0x4a84cc
call fcn.0057d862
mov ecx, dword [ebp]
push ecx
mov esi, eax
call fcn.005664c6
add esp, 8
push 0x6a9ba4
lea edx, [esp + 0x34]
push edx
mov dword [esp + 0x38], esi
call fcn.00598385
int3
Function at 0x4a8900
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x5ce064
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6d26f8]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
xor eax, eax
mov dword [esp + 0x18], eax
cmp dword [ebp], eax
jne 0x4a893b
call fcn.004a7c20
mov dword [esp + 0x14], eax
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x38]
push eax
mov ebx, ebp
call fcn.004a8c60
mov ebx, eax
push ebx
call fcn.00583f10
add esp, 4
cmp eax, 6
jne 0x4a8a36
cmp dword [esp + 0x14], 0x3e8
jg 0x4a8a36
cmp dword [esp + 0x30], 3
jg 0x4a8a36
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 8
mov edi, eax
call fcn.005939b5
mov esi, eax
add esp, 4
mov dword [esp + 0x1c], esi
mov dword [esp + 0x28], 1
test esi, esi
je 0x4a89bc
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [esi], edi
mov dword [esi + 4], eax
jmp 0x4a89be
xor esi, esi
mov byte [esp + 0x28], 0
mov ecx, dword [ebp]
push esi
push 0x4a7a60
push ecx
call fcn.0056dd26
add esp, 0xc
push 1
push 0x1388
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
cmp eax, 0xc0
je 0x4a89d5
test eax, eax
je 0x4a89f2
inc dword [esp + 0x30]
mov edx, dword [ebp]
push 0
push 0
push edx
call fcn.0056dd26
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [esp + 0x14]
push ebx
call fcn.0057d80b
mov eax, dword [esp + 0x3c]
add esp, 4
push eax
mov ebx, ebp
call fcn.004a8c60
mov ebx, eax
push ebx
call fcn.00583f10
add esp, 4
cmp eax, 6
je 0x4a8963
push ebx
cmp eax, 0x65
jne 0x4a8a83
mov ecx, dword [ebp]
mov esi, dword [esp + 0x38]
mov dword [esi], ecx
mov dword [esi + 4], ebx
mov byte [esi + 8], 1
call fcn.005581b2
add esp, 4
mov dword [esi + 0xc], eax
mov byte [esi + 0x10], 1
mov dword [esp + 0x28], 0
mov dword [esp + 0x18], 1
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0xc
cmp eax, 0x64
jne 0x4a8ab9
mov edx, dword [ebp]
mov esi, dword [esp + 0x38]
mov dword [esi], edx
mov dword [esi + 4], ebx
mov byte [esi + 8], 0
call fcn.005581b2
mov dword [esi + 0xc], eax
mov eax, 1
add esp, 4
mov byte [esi + 0x10], al
mov dword [esp + 0x28], 0
mov dword [esp + 0x18], eax
jmp 0x4a8a6b
call fcn.0057d80b
mov esi, eax
mov eax, dword [ebp]
push eax
call fcn.005664c6
add esp, 8
push 0x6a9ba4
lea ecx, [esp + 0x3c]
push ecx
mov dword [esp + 0x40], esi
call fcn.00598385
int3