joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4678e0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4f3741
mov eax, dword fs:[0]
push eax
sub esp, 0x384
mov eax, dword [0x545628]
xor eax, esp
mov dword [esp + 0x380], eax
push esi
push edi
mov eax, dword [0x545628]
xor eax, esp
push eax
lea eax, [esp + 0x390]
mov dword fs:[0], eax
mov ecx, 0x105
mov esi, 0x552680
mov dword [0x552798], ecx
call fcn.00411b60
cmp byte [0x552794], 0
mov eax, 0x552684
jne 0x467941
mov eax, dword [0x552680]
push 0
push 0x1a
add eax, 4
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov ecx, 0x552678
cmp eax, 1
je 0x467967
call fcn.00410db0
xor al, al
jmp 0x467b39
call fcn.00416230
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x467b37
push str.GetLocaleInfoEx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x467b37
lea ecx, [esp + 0x264]
call fcn.00415be0
lea eax, [esp + 0x264]
push eax
mov ecx, 0x552678
mov dword [esp + 0x39c], 0
call fcn.00417ac0
test al, al
jne 0x4679f6
mov dword [esp + method.t_str.virtual_0], vtable.t_str.0
cmp byte [esp + 0x380], al
jne 0x4679ef
mov eax, dword [esp + 0x26c]
lea ecx, [esp + 0x270]
cmp eax, ecx
je 0x4679ef
push eax
call fcn.004d1d15
add esp, 4
xor al, al
jmp 0x467b39
mov dword [esp + 0x10], str.LocalLow
mov dword [esp + 0x14], str.Roaming
mov dword [esp + 0x18], str.Local
xor edi, edi
cmp byte [esp + 0x380], 0
lea eax, [esp + 0x270]
jne 0x467a28
mov eax, dword [esp + 0x26c]
mov esi, dword [esp + edi*4 + 0x10]
lea ecx, [eax + 4]
call fcn.004677a0
test al, al
jne 0x467a4e
inc edi
cmp edi, 3
jb 0x467a10
mov dword [esp + method.t_str.virtual_0], vtable.t_str.0
jmp 0x467b12
mov edi, esi
test edi, edi
jne 0x467a64
mov dword [esp + method.t_str.virtual_0], vtable.t_str.0
jmp 0x467b12
lea ecx, [esp + 0x1c]
call fcn.00410c10
mov eax, edi
lea edx, [esp + 0x1c]
call fcn.00410e40
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x144]
push ecx
lea ecx, [esp + 0x26c]
mov byte [esp + 0x3a0], 2
call fcn.004163e0
cmp byte [eax + 0x11c], 0
je 0x467aa7
add eax, 0xc
jmp 0x467aaa
mov eax, dword [eax + 8]
add eax, 4
mov edx, 0x552678
call fcn.00410e40
cmp byte [esp + 0x25c], 0
mov esi, vtable.t_str.0
mov dword [esp + 0x140], esi
jne 0x467ae8
mov eax, dword [esp + 0x148]
lea edx, [esp + 0x14c]
cmp eax, edx
je 0x467ae8
push eax
call fcn.004d1d15
add esp, 4
cmp byte [esp + 0x138], 0
mov dword [esp + 0x1c], esi
jne 0x467b0b
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x28]
cmp eax, ecx
je 0x467b0b
push eax
call fcn.004d1d15
add esp, 4
mov dword [esp + 0x264], esi
cmp byte [esp + 0x380], 0
jne 0x467b37
mov eax, dword [esp + 0x26c]
lea edx, [esp + 0x270]
cmp eax, edx
je 0x467b37
push eax
call fcn.004d1d15
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x390]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x380]
xor ecx, esp
call fcn.004d158d
add esp, 0x390
ret
Function at 0x46cae0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4f36bb
mov eax, dword fs:[0]
push eax
sub esp, 0x370
mov eax, dword [0x545628]
xor eax, esp
mov dword [esp + 0x368], eax
push ebx
push esi
push edi
mov eax, dword [0x545628]
xor eax, esp
push eax
lea eax, [esp + 0x380]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
lea esi, [esp + 0x1c]
mov ebx, ecx
mov dword [esp + 0x14], eax
call fcn.0041c530
xor esi, esi
mov dword [esp + 0x1c], vtable.t_fileRead.0
mov dword [esp + method.t_fileRead.1.virtual_0], vtable.t_fileRead.1.0
mov dword [esp + 0x36c], esi
mov dword [esp + 0x370], esi
mov dword [esp + 0x388], esi
mov ecx, dword [esp + 0x14]
push ecx
push edi
lea ecx, [esp + 0x24]
call fcn.0041f530
test al, al
jne 0x46cbbb
mov ecx, edi
call fcn.0040fa50
push 0x52b5a0
push 0x52a3bc
mov edx, eax
call fcn.004114a0
mov dword [esp + 0x390], 0xffffffff
add esp, 8
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], vtable.t_fileRead.0
mov dword [esp + method.t_byteStreamRead.virtual_0], vtable.t_byteStreamRead.0
call fcn.0041c5a0
xor al, al
jmp 0x46cc3c
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x14]
push edx
push eax
mov dword [esp + 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp + 0x18], eax
cmp eax, 0xffffffff
jne 0x46cbea
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
je 0x46cbe6
xor eax, eax
jmp 0x46cbea
mov eax, dword [esp + 0x18]
push eax
mov dword [ebx + 8], eax
call fcn.004d1df2
mov ecx, dword [ebx + 8]
add esp, 4
push ecx
push eax
push edi
lea ecx, [esp + 0x374]
mov dword [ebx + 4], eax
call fcn.0041f590
test al, al
je 0x46cb72
mov dword [esp + 0x388], 0xffffffff
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], vtable.t_fileRead.0
mov dword [esp + method.t_byteStreamRead.virtual_0], vtable.t_byteStreamRead.0
call fcn.0041c5a0
mov al, 1
mov ecx, dword [esp + 0x380]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x368]
xor ecx, esp
call fcn.004d158d
mov esp, ebp
pop ebp
ret 8
Function at 0x46e620
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x46e635
mov esi, dword [eax]
test esi, esi
jne 0x46e635
xor eax, eax
pop esi
ret 8
push edi
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x46e651
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x46e658
pop edi
xor eax, eax
pop esi
ret 8
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
mov eax, ebx
pop ebx
pop edi
pop esi
ret 8
Function at 0x482290
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x14
mov eax, dword [0x545628]
xor eax, esp
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x1c]
movzx ecx, byte [esi + 0x10]
mov dl, byte [esi + 0x11]
mov dword [esp], eax
mov al, byte [esi + 0x12]
mov byte [esp + 4], cl
movzx ecx, byte [esi + 0x13]
push ebx
mov byte [esp + 0xa], al
mov eax, dword [esi + 4]
push ebp
mov ebp, dword [esp + 0x20]
mov byte [esp + 0xd], dl
mov byte [esp + 0xf], cl
mov dword [esp + 0x10], edi
lea ebx, [edi + 8]
test eax, eax
je 0x4822e8
push eax
call fcn.004d195d
add esp, 4
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
push ebx
call fcn.004d2d51
push 8
lea edx, [esp + 0x14]
push edx
push 8
push eax
mov dword [esi + 4], eax
mov dword [esi + 8], ebx
call fcn.004d6eed
mov eax, dword [esi + 4]
push edi
push ebp
add eax, 8
push edi
push eax
call fcn.004d6eed
mov ecx, dword [esp + 0x2c]
mov edx, dword [esi + 8]
mov eax, dword [esi + 4]
add esp, 0x24
push 0
push ecx
mov ecx, dword [esi]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x14]
neg eax
sbb eax, eax
pop ebp
neg eax
pop ebx
xor ecx, esp
dec eax
call fcn.004d158d
add esp, 0x14
ret 8

Function at 0x482350
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
mov eax, dword [0x545628]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea eax, [esp + 0x14]
push eax
mov esi, ecx
mov edx, dword [esi]
push 8
lea ecx, [esp + 0x20]
push ecx
push edx
mov dword [esp + 0x24], 0
call edi
test eax, eax
je 0x4823e2
mov al, byte [esp + 0x14]
cmp al, byte [esi + 0x10]
jne 0x4823e2
mov cl, byte [esp + 0x15]
cmp cl, byte [esi + 0x11]
jne 0x4823e2
mov dl, byte [esp + 0x16]
cmp dl, byte [esi + 0x12]
jne 0x4823e2
mov al, byte [esp + 0x17]
cmp al, byte [esi + 0x13]
jne 0x4823e2
mov ebx, dword [esp + 0x18]
call fcn.004824a0
mov edx, dword [esi + 8]
mov eax, dword [esi + 4]
push 0
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esi]
push edx
push eax
push ecx
call edi
neg eax
sbb eax, eax
neg eax
dec eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.004d158d
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
xor ecx, esp
or eax, 0xffffffff
call fcn.004d158d
add esp, 0x18
ret
Function at 0x482a60
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4f6998
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x545628]
xor eax, esp
mov dword [esp + 0x14], eax
push ebp
push esi
push edi
mov eax, dword [0x545628]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [str.SGPO]
mov esi, ecx
mov edi, edx
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], str..pipe_sgppPopup2
mov dword [esp + 0x20], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x30], 0
call fcn.004829d0
cmp eax, 0xffffffff
jne 0x482af5
mov eax, dword [esp + 0x14]
test eax, eax
je 0x482ae5
push eax
call fcn.004d195d
add esp, 4
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
jmp 0x482b65
push edi
mov eax, esi
lea ecx, [esp + 0x14]
call fcn.00482400
mov ebp, eax
cmp ebp, 1
jne 0x482b47
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
call fcn.004829d0
cmp eax, 0xffffffff
jne 0x482b2c
lea esi, [esp + 0x10]
call fcn.00482a30
or eax, 0xffffffff
jmp 0x482b65
push edi
mov eax, esi
lea ecx, [esp + 0x14]
call fcn.00482400
lea esi, [esp + 0x10]
mov edi, eax
call fcn.00482a30
mov eax, edi
jmp 0x482b65
mov eax, dword [esp + 0x14]
test eax, eax
je 0x482b58
push eax
call fcn.004d195d
add esp, 4
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebp
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.004d158d
add esp, 0x24
ret

Function at 0x484130
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov esi, eax
push 0x2c
mov byte [esi], 1
call fcn.004d2d51
push eax
mov dword [eax], esi
lea edi, [eax + 4]
push 0
add esi, 0x80c
mov ecx, 0xa
push 0x484340
rep movsd dword es:[edi], dword [esi]
call fcn.004d5224
add esp, 0x10
pop edi
pop esi
ret

Function at 0x484a80
Capabilities:
Enumerate process modules

Disassembly:
sub esp, 0x438
mov eax, dword [0x545628]
xor eax, esp
mov dword [esp + 0x430], eax
push ebx
lea eax, [esp + 8]
push eax
push esi
xor bl, bl
mov dword [esp + 0x10], 0x428
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
jne 0x484ac4
pop ebx
mov ecx, dword [esp + 0x430]
xor ecx, esp
call fcn.004d158d
add esp, 0x438
ret
lea ecx, [esp + 0x28]
push str.SogouPY.ime
push ecx
call fcn.004d1734
add esp, 8
test eax, eax
je 0x484aeb
lea edx, [esp + 8]
push edx
push esi
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x484ac4
jmp 0x484aed
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x434]
xor eax, eax
test bl, bl
setne al
pop ebx
xor ecx, esp
call fcn.004d158d
add esp, 0x438
ret
Function at 0x484b20
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x238
mov eax, dword [0x545628]
xor eax, esp
mov dword [esp + 0x234], eax
push ebx
push ebp
mov ebp, dword [esp + 0x244]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0
push 2
mov ebx, eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x484b75
lea eax, [esp + 0x10]
push eax
push edi
mov dword [esp + 0x18], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x484b7c
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x484c06
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x484beb
push eax
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp eax, 0xffffffff
je 0x484beb
mov esi, eax
call fcn.00484a80
test eax, eax
je 0x484beb
lea ecx, [esp + 0x34]
test ecx, ecx
je 0x484beb
mov ecx, str._System_Process_
lea eax, [esp + 0x34]
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x484bd6
test dx, dx
je 0x484bd2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x484bd6
add eax, 4
add ecx, 4
test dx, dx
jne 0x484bb0
xor eax, eax
jmp 0x484bdb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x484beb
lea edx, [esp + 0x34]
push edx
mov esi, ebp
call fcn.00484c30
lea eax, [esp + 0x10]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x484b7c
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [esp + 0x244]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004d158d
add esp, 0x238
ret 4

Function at 0x486810
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4ef648
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x545628]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
push 0x64
push 0
lea ecx, [esp + 0x20]
call fcn.0041c0d0
mov dword [esp + 0x18], vtable.UserEnv::t_locker.0
mov edi, dword [esp + 0x30]
push 0x54c020
push edi
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], 0
call fcn.0041c110
mov ebx, dword [esp + 0x34]
test al, al
je 0x4868bd
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x3c]
push eax
mov ecx, esi
mov dword [esp + 0x40], ebx
call fcn.00485eb0
test eax, eax
je 0x48689a
mov eax, dword [eax + 4]
test eax, eax
jne 0x4868a7
push ebx
push edi
mov ecx, esi
call fcn.00486500
test eax, eax
je 0x4868bd
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
push ecx
push edx
push edi
mov ecx, eax
call fcn.00485810
test al, al
jne 0x4868fe
push ebx
push str.UserEnv::MergeFrom
push edi
call fcn.0040fb00
add esp, 0xc
lea ecx, [esp + 0x18]
mov bl, al
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x18], vtable.UserEnv::t_locker.0
call fcn.0041c0f0
mov al, bl
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 0x10
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x18], vtable.UserEnv::t_locker.0
call fcn.0041c0f0
mov al, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 0x10
Function at 0x486930
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4ef648
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x545628]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
push 0x64
push 0
lea ecx, [esp + 0x20]
call fcn.0041c0d0
mov dword [esp + 0x18], vtable.UserEnv::t_locker.0
mov edi, dword [esp + 0x30]
push 0x54c020
push edi
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], 0
call fcn.0041c110
mov ebx, dword [esp + 0x34]
test al, al
je 0x4869dd
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x3c]
push eax
mov ecx, esi
mov dword [esp + 0x40], ebx
call fcn.00485eb0
test eax, eax
je 0x4869ba
mov eax, dword [eax + 4]
test eax, eax
jne 0x4869c7
push ebx
push edi
mov ecx, esi
call fcn.00486500
test eax, eax
je 0x4869dd
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
push ecx
push edx
push edi
mov ecx, eax
call fcn.00485ae0
test al, al
jne 0x486a1e
push ebx
push str.UserEnv::MergeGet
push edi
call fcn.0040fb00
add esp, 0xc
lea ecx, [esp + 0x18]
mov bl, al
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x18], vtable.UserEnv::t_locker.0
call fcn.0041c0f0
mov al, bl
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 0x10
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x18], vtable.UserEnv::t_locker.0
call fcn.0041c0f0
mov al, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 0x10
Function at 0x48b220
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4f00e0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x545628]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
push 0x64
push 0
lea ecx, [esp + 0x20]
call fcn.0041c0d0
mov dword [esp + 0x18], vtable.UserManager::t_lockerProc.0
mov esi, dword [esp + 0x30]
push 0x54c258
push esi
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], 0
call fcn.0041c110
test al, al
je 0x48b2b7
push 0x64
push 0
lea ecx, [esp + 0x18]
call fcn.0041c0d0
mov dword [esp + 0x10], vtable.UserManager::t_locker.0
push 0x54c488
push esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 1
call fcn.0041c110
test al, al
jne 0x48b2df
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 0
call fcn.0041c0f0
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], 0xffffffff
call fcn.0041c0f0
xor al, al
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 0xc
push 0
push esi
lea ecx, [edi + 0x144]
call fcn.00415950
test al, al
je 0x48b2a9
push 0
push esi
lea ecx, [edi + 0x3fc]
call fcn.00415950
lea ecx, [esp + 0x10]
test al, al
je 0x48b2ad
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
push eax
push ecx
push edx
push esi
mov ecx, edi
call fcn.0048a770
lea ecx, [esp + 0x10]
mov bl, al
mov byte [esp + 0x28], 0
call fcn.0041c0f0
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], 0xffffffff
call fcn.0041c0f0
mov al, bl
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 0xc
Function at 0x48bca0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4f00e0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x545628]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
push 0x64
push 0
lea ecx, [esp + 0x20]
call fcn.0041c0d0
mov dword [esp + 0x18], vtable.UserManager::t_lockerProc.0
mov esi, dword [esp + 0x30]
push 0x54c258
push esi
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], 0
call fcn.0041c110
test al, al
je 0x48bd37
push 0x64
push 0
lea ecx, [esp + 0x18]
call fcn.0041c0d0
mov dword [esp + 0x10], vtable.UserManager::t_locker.0
push 0x54c488
push esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 1
call fcn.0041c110
test al, al
jne 0x48bd5f
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 0
call fcn.0041c0f0
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], 0xffffffff
call fcn.0041c0f0
xor al, al
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 0x10
push 0
push esi
lea ecx, [edi + 0x144]
call fcn.00415950
test al, al
je 0x48bd29
push 0
push esi
lea ecx, [edi + 0x3fc]
call fcn.00415950
test al, al
je 0x48bd29
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
push eax
push ecx
push edx
lea eax, [esp + 0x1c]
push eax
push esi
mov ecx, edi
call fcn.0048b6c0
lea ecx, [esp + 0x10]
mov bl, al
mov byte [esp + 0x28], 0
call fcn.0041c0f0
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], 0xffffffff
call fcn.0041c0f0
mov al, bl
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 0x10
Function at 0x48bde0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4f00e0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x545628]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
push 0x64
push 0
lea ecx, [esp + 0x20]
call fcn.0041c0d0
mov dword [esp + 0x18], vtable.UserManager::t_lockerProc.0
mov esi, dword [esp + 0x30]
push 0x54c258
push esi
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], 0
call fcn.0041c110
test al, al
je 0x48be77
push 0x64
push 0
lea ecx, [esp + 0x18]
call fcn.0041c0d0
mov dword [esp + 0x10], vtable.UserManager::t_locker.0
push 0x54c488
push esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 1
call fcn.0041c110
test al, al
jne 0x48be9f
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 0
call fcn.0041c0f0
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], 0xffffffff
call fcn.0041c0f0
xor al, al
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 0x10
push 0
push esi
lea ecx, [edi + 0x144]
call fcn.00415950
test al, al
je 0x48be69
push 0
push esi
lea ecx, [edi + 0x3fc]
call fcn.00415950
test al, al
je 0x48be69
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
push eax
push ecx
push edx
lea eax, [esp + 0x1c]
push eax
push esi
mov ecx, edi
call fcn.0048b970
lea ecx, [esp + 0x10]
mov bl, al
mov byte [esp + 0x28], 0
call fcn.0041c0f0
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], 0xffffffff
call fcn.0041c0f0
mov al, bl
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 0x10
Function at 0x4d0607
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x24
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov eax, dword [edx + 0x78]
mov ebx, dword [edx + 0x8c]
cmp eax, ebx
mov eax, dword [edx + 0x34]
mov ebx, dword [edx + 0x7c]
jl 0x4d062c
shr ebx, 2
dec ebx
shl ebx, 0x10
or ebx, eax
mov dword [esp], ebx
mov eax, dword [edx + 0x90]
mov ebx, dword [edx + 0x74]
cmp ebx, eax
jl 0x4d0644
mov ebx, eax
mov dword [esp + 0x18], ebx
mov esi, dword [edx + 0x38]
mov dword [esp + 4], esi
mov ebp, dword [edx + 0x6c]
lea edi, [ebp + esi]
mov dword [esp + 0x20], edi
mov eax, edi
neg eax
and eax, 3
mov dword [esp + 0x14], eax
mov eax, dword [edx + 0x2c]
sub eax, 0x106
sub ebp, eax
jg 0x4d0673
xor ebp, ebp
mov eax, dword [edx + 0x78]
mov dword [esp + 0x1c], eax
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [edi]
mov dword [esp + 0x10], ebx
movzx ebx, word [eax + edi - 1]
mov dword [esp + 0xc], ebx
mov edi, dword [edx + 0x40]
mov edx, dword [esp]
jmp 0x4d06b2
and ecx, edx
movzx ecx, word [edi + ecx*2]
cmp ecx, ebp
jbe 0x4d0786
sub edx, 0x10000
js 0x4d0786
movzx eax, word [ecx + esi - 1]
cmp eax, ebx
jne 0x4d0698
mov eax, dword [esp + 4]
movzx eax, word [ecx + eax]
cmp eax, dword [esp + 0x10]
jne 0x4d0698
mov dword [esp], edx
mov esi, dword [esp + 4]
mov edi, dword [esp + 0x20]
add esi, ecx
mov eax, dword [esp + 0x14]
mov edx, 0xfffffef8
lea edi, [eax + edi + 0x108]
lea esi, [eax + esi + 0x108]
mov eax, dword [edx + esi]
xor eax, dword [edx + edi]
jne 0x4d0709
mov eax, dword [edx + esi + 4]
xor eax, dword [edx + edi + 4]
jne 0x4d0706
add edx, 8
jne 0x4d06ed
jmp 0x4d0777
add edx, 4
test eax, 0xffff
jne 0x4d0716
add edx, 2
shr eax, 0x10
sub al, 1
adc edx, 0
lea eax, [edx + edi]
mov edi, dword [esp + 0x20]
sub eax, edi
cmp eax, 0x102
jge 0x4d0777
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
cmp eax, ebx
jg 0x4d074a
mov esi, dword [esp + 8]
mov edi, dword [edx + 0x40]
mov ebx, dword [esp + 0xc]
mov edx, dword [esp]
jmp 0x4d0698
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov dword [edx + 0x70], ecx
cmp eax, ebx
jge 0x4d0786
mov esi, dword [esp + 4]
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [eax + edi - 1]
mov edi, dword [edx + 0x40]
mov dword [esp + 0xc], ebx
mov edx, dword [esp]
jmp 0x4d0698
mov edx, dword [esp + 0x38]
mov dword [esp + 0x1c], 0x102
mov dword [edx + 0x70], ecx
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
mov eax, dword [edx + 0x74]
cmp ebx, eax
jg 0x4d0797
mov eax, ebx
add esp, 0x24
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4d158d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x545628]
jne 0x4d1597
repz ret
jmp fcn.004da814