joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417976
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
xor eax, eax
mov dword [ebp - 0x10], ecx
push ebx
push esi
mov ebx, edx
mov dword [ebp - 0x18], eax
mov esi, eax
mov dword [ebp - 0x14], eax
push edi
lea edx, [ebp - 8]
mov dword [ebp - 4], esi
mov ecx, ebx
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
call fcn.004175b3
mov edi, eax
test edi, edi
jns 0x417a1a
lea edx, [ebp - 0xc]
mov ecx, ebx
call fcn.004177e7
mov edi, eax
test edi, edi
js 0x417a05
mov esi, dword [ebp - 0xc]
test esi, esi
je 0x417a05
push esi
push ebx
push 0x4082c8
push 2
call fcn.0041944e
add esp, 0x10
lea edx, [ebp - 4]
mov ecx, esi
call fcn.0041769d
mov edi, eax
test edi, edi
jns 0x4179f9
push ebx
push 0x408330
push 4
call fcn.0041944e
mov esi, dword [ebp - 4]
add esp, 0xc
jmp 0x417af8
mov esi, dword [ebp - 4]
mov dword [ebp - 0x14], 1
jmp 0x417a26
push ebx
push 0x408270
push 4
call fcn.0041944e
add esp, 0xc
jmp 0x417b0d
cmp dword [ebp - 8], esi
je 0x417ae6
mov esi, dword [ebp - 8]
test esi, esi
je 0x417ae6
mov ecx, dword [ebp - 0x10]
xor ebx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x417a36
sub ecx, edx
mov edx, esi
sar ecx, 1
lea ebx, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, word [ebp - 0x18]
jne 0x417a4a
sub edx, ebx
lea eax, [ecx + 1]
sar edx, 1
add eax, edx
mov dword [ebp - 0x18], eax
add eax, eax
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
jne 0x417a8f
push 0x408368
push 4
call fcn.0041944e
pop ecx
pop ecx
mov edi, 0xc0000017
jmp 0x417aeb
push dword [ebp - 0x10]
push esi
push 0x4083b8
push dword [ebp - 0x18]
push ebx
call dword [sym.imp.msvcrt.dll_swprintf_s]
add esp, 0x14
cmp eax, 0xffffffff
jne 0x417abf
push 0x4083c8
push 4
call fcn.0041944e
pop ecx
pop ecx
mov edi, 0xc0000001
jmp 0x417ad3
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
mov eax, dword [ebp + 8]
setne cl
mov dword [eax], ecx
push ebx
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x417aeb
mov edi, 0xc000000e
cmp dword [ebp - 0x14], 0
je 0x417af8
push esi
call dword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointW]
test esi, esi
je 0x417b0d
push esi
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x417b16
Capabilities:
Enumerate disk volumes
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x42c044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x418], ecx
push 0x208
push eax
lea eax, [ebp - 0x20c]
mov ebx, edx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov edi, eax
test edi, edi
jne 0x417b6f
mov esi, 0xc0000001
jmp 0x417bf2
lea esi, [ebp - 0x20c]
xor edx, edx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, dx
jne 0x417b7a
sub esi, ecx
xor eax, eax
sar esi, 1
push 0x104
mov word [ebp + esi*2 - 0x20e], ax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov ecx, dword [ebp - 0x418]
lea edx, [ebp - 0x414]
push 0x5c
pop eax
push ebx
mov word [ebp + esi*2 - 0x20e], ax
call fcn.00417976
mov esi, eax
test esi, esi
js 0x417beb
cmp dword [ebx], 1
je 0x417beb
push 0x104
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
test eax, eax
jne 0x417b6f
push edi
call dword [sym.imp.KERNEL32.dll_FindVolumeClose]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042a860
leave
ret
Function at 0x418491
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
xor esi, esi
and dword [ebp - 4], esi
push edi
xor edi, edi
mov dword [ebp - 8], esi
test ecx, ecx
jne 0x4184cc
lea ecx, [ebp - 8]
call fcn.004206a4
mov esi, dword [ebp - 8]
mov ebx, eax
test ebx, ebx
js 0x418586
push esi
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
jmp 0x4184d7
mov eax, dword [ecx]
mov dword [ebp - 0x10], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0xc], eax
and dword [ebp - 0x2c], edi
lea eax, [ebp - 0x10]
and dword [ebp - 0x20], edi
and dword [ebp - 0x1c], edi
push 0x4020
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x18]
push 7
push eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0x18
push eax
push 0x110080
lea eax, [ebp - 4]
mov dword [ebp - 0x24], 0x40
push eax
call dword [sym.imp.ntdll.dll_NtOpenFile]
mov ebx, eax
test ebx, ebx
js 0x418586
movzx ebx, word [ebp - 0x10]
lea eax, [ebx + 0x1e]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x41853c
mov ebx, 0xc0000017
jmp 0x418586
and dword [edi + 4], 0
lea eax, [ebx + 0x10]
lea edx, [ebx + 0x12]
mov dword [edi + 8], eax
shr edx, 1
lea eax, [edi + 0xc]
mov dword [edi], 1
je 0x418565
push ecx
push dword [ebp - 0xc]
push ecx
mov ecx, eax
call fcn.00411632
lea eax, [edi + 0xc]
push ecx
lea edx, [ebx + 0x12]
mov ecx, eax
call fcn.00414713
push 0xa
lea eax, [ebx + 0x1e]
push eax
push edi
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x418595
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
je 0x4185ab
mov eax, dword fs:[0x30]
push esi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
test edi, edi
je 0x4185bf
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x419334
Capabilities:
Create directory

Disassembly:
cmp dword [0x42c49c], 0
push edi
mov edi, ecx
jne 0x4193aa
push esi
mov esi, edi
xor edx, edx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, dx
jne 0x419348
sub esi, ecx
sar esi, 1
sub esi, 1
je 0x4193a9
push ebx
push 0x5c
pop ebx
cmp word [edi + esi*2], bx
je 0x41936b
sub esi, 1
jne 0x419360
test esi, esi
je 0x4193a8
push edx
xor eax, eax
push edi
mov word [edi + esi*2], ax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x409b6c
push edi
push 0x42c4a8
mov word [edi + esi*2], bx
call dword [sym.imp.msvcrt.dll__wfopen_s]
add esp, 0xc
cmp dword [0x42c4a8], 0
je 0x4193a8
mov dword [0x42c49c], 1
pop ebx
pop esi
pop edi
ret
Function at 0x419e25
Capabilities:
Inspect section memory permissions

Disassembly:
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
add dword [ebp + 0x10], 4
jmp 0x419deb

Function at 0x41a459
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x509], 0x4f
mov byte [ebp - 0x508], 0x75
mov byte [ebp - 0x507], 0x66
mov byte [ebp - 0x506], 0x79
mov byte [ebp - 0x505], 0x1c
lea eax, [ebp - 0x514]
push eax
call fcn.00419805
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004197ba
add esp, 0xc
mov dword [ebp - 0x33c], eax
call fcn.004197f5
jb 0x41a488
idiv byte [edx + 0x10468]
add byte [ebp - 0x3337b], cl
call dword [eax - 1]
jne 0x41a4be
call dword [ebp - 0x538]
mov dword [ebp - 0x398], eax
mov byte [ebp - 0x544], 1
cmp dword [ebp - 0x398], 0
je 0x41a4e9
push 0xc6fffffc
test dword [edx + edi*8 - 0x7cfe0001], edi
mov ebp, 0xfffffc68
add byte [edi + edx - 0x7d], dh
mov ebp, 0xfffffc68
add byte [edi], cl
test ah, dl
add dword [eax], eax
add byte [ebx + 0xf010c7d], al
test dl, cl
add dword [eax], eax
add byte [ebx + 0xf080c7d], al
test dword [eax - 0x7fffffff], ecx
movsd dword es:[edi], dword [esi]
dec eax
stc
invalid
cmp dword [ebp - 0x398], 0
je 0x41a6b3
cmp dword [ebp + 0xc], 1
je 0x41a6b3
cmp dword [ebp + 0xc], 8
jne 0x41a67b
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
mov byte [ebp - 0x6a6], 9
mov byte [ebp - 0x6a5], 0xb
mov byte [ebp - 0x6a4], 0x16
mov byte [ebp - 0x6a3], 0x1d
mov byte [ebp - 0x6a2], 0x64
lea eax, [ebp - 0x6b8]
push eax
call fcn.00419805
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004197ba
add esp, 0xc
mov dword [ebp - 0x690], eax
mov byte [ebp - 0x6a0], 0x8b
or byte [ebp - 0x69f], 0xff
mov byte [ebp - 0x69e], 0x55
mov byte [ebp - 0x69d], 0x8b
mov byte [ebp - 0x69c], 0xec
lea eax, [ebp - 0x694]
push eax
push 5
lea eax, [ebp - 0x6a0]
push eax
push dword [ebp - 0x33c]
push 0xffffffffffffffff
call dword [ebp - 0x690]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x6c0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x6bc], eax
push 0x1000
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 0x698], eax
call fcn.004197f5
mov dword [0xff7d3e0f], eax
mov ch, 0x68
stc
invalid
call fcn.004197f5
push esp
dec edx
fld qword [edx - 0x5435a80]
invalid
Function at 0x41a694
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
or byte [eax + 4], ch
add dword [eax], eax
add byte [ebp - 0x3337b], cl
call dword [eax + 0x6a]
add bh, bh
xchg ebp, eax
enter 0xfffffffffffffffa, 0xffffffffffffffff
call fcn.004197f5
push 0xffffffffffffff95
xchg al, bl
and byte [ebp - 0x230], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.004197d3
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.00419805
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004197ba
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.004197f5
mov ecx, 0x68273384
add al, 1
add byte [eax], al
lea eax, [ebp - 0x12c]
push eax
call dword [ebp - 0x3d4]
mov dword [ebp - 0x28], eax
call fcn.004197f5
invalid
Function at 0x41b9b6
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
add dl, byte [esi + 0x8408bad]
push eax
call fcn.004197f5
xchg edx, eax
invalid

Function at 0x41bd34
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov esi, ecx
xor eax, eax
push edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
cmp ax, word [esi]
jne 0x41bd62
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x41beb9
push ebx
lea edx, [ebp - 4]
call fcn.0041bb15
mov ebx, eax
test ebx, ebx
je 0x41bea6
xor eax, eax
lea edx, [ebp - 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push ecx
push eax
mov ecx, ebx
call fcn.0041bf7d
test eax, eax
js 0x41be68
cmp dword [ebp - 8], 1
push 0x5c
pop ecx
jne 0x41be08
mov edx, dword [ebp - 0xc]
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x14]
jne 0x41bda5
mov eax, dword [ebp - 4]
sub ecx, esi
sar ecx, 1
lea esi, [eax + ecx*2]
test edx, edx
je 0x41bdd0
push edx
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0x5c
pop ecx
xor edi, edi
push ecx
push esi
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
mov esi, eax
pop ecx
mov ecx, ebx
test esi, esi
je 0x41be36
xor eax, eax
mov word [esi], ax
call fcn.0041b9b6
test eax, eax
jne 0x41bdfd
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x5c
pop ecx
mov word [esi], cx
add esi, 2
jmp 0x41bdd5
mov esi, dword [ebp - 4]
movzx eax, word [esi]
cmp eax, 0x61
jb 0x41be18
cmp eax, 0x7a
jbe 0x41be22
cmp eax, 0x41
jb 0x41bdd3
cmp eax, 0x5a
ja 0x41bdd3
push 0x3a
pop eax
cmp ax, word [esi + 2]
jne 0x41bdd3
cmp cx, word [esi + 4]
jne 0x41bdd3
add esi, 8
jmp 0x41bdd3
call fcn.0041b9b6
xor esi, esi
inc esi
cmp eax, esi
je 0x41be63
xor eax, eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, esi
je 0x41be63
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
push dword [ebp - 0x1c]
push 0x40a950
jmp 0x41be81
mov dword [ebp - 0x10], esi
jmp 0x41be93
movzx eax, ax
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
push esi
push 0x40a9b0
push 0x3000000
push 0x42c454
call fcn.0041aebe
add esp, 0x14
push ebx
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x41beae
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x10]
pop ebx
pop edi
pop esi
leave
ret
Function at 0x41c62b
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 4]
mov dword [ebp - 8], edx
push eax
xor edi, edi
mov ebx, ecx
push edi
push edi
push ebx
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, eax
cmp esi, 0xc0000023
je 0x41c65e
test esi, esi
js 0x41c6cb
mov esi, 0xc0000001
jmp 0x41c6cb
push dword [ebp - 4]
mov eax, dword fs:[0x30]
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
test edi, edi
jne 0x41c67e
mov esi, 0xc000009a
jmp 0x41c6cb
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push edi
push ebx
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, eax
test esi, esi
js 0x41c6b9
movzx ecx, word [edi]
mov eax, dword [ebp + 0xc]
add ecx, 2
mov dword [eax], ecx
cmp ecx, dword [ebp + 8]
jbe 0x41c6aa
mov esi, 0xc0000023
jmp 0x41c6b9
push ecx
push dword [edi + 4]
push dword [ebp - 8]
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, dword fs:[0x30]
push edi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x41c9a2
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x54
mov eax, dword [0x42c044]
xor eax, esp
mov dword [esp + 0x50], eax
push ebx
mov ebx, dword [ebp + 8]
mov eax, ecx
push esi
mov dword [esp + 0x1c], eax
and al, 1
push edi
mov edi, edx
mov dword [esp + 0x24], ebx
mov byte [esp + 0x13], al
jne 0x41c9df
call fcn.0041f643
test eax, eax
js 0x41cb5c
xor eax, eax
mov dword [ebx], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.ntdll.dll_RtlStringFromGUID]
mov ebx, eax
test ebx, ebx
jns 0x41ca0a
push ebx
push 0x40aaa8
push 4
jmp 0x41cb27
push dword [esp + 0x18]
push 0x40ab00
push 2
call fcn.0041c24c
mov esi, dword [esp + 0x2c]
lea eax, [esp + 0x28]
add esp, 0xc
mov edx, 0x40aa98
mov ecx, esi
push eax
push 0x20019
call fcn.00422661
mov ebx, eax
test ebx, ebx
jns 0x41ca45
push ebx
push 0x40ab28
jmp 0x41ca03
lea edx, [esp + 0x20]
mov ecx, edi
call fcn.0041ce42
test al, al
je 0x41caf2
mov eax, dword [esp + 0x20]
sub eax, 1
je 0x41ca7c
sub eax, 1
je 0x41ca6d
mov ebx, 0xc000000d
jmp 0x41ca9f
lea edx, [esp + 0x28]
mov ecx, esi
call fcn.0041ce8e
mov ebx, eax
jmp 0x41ca9f
push 0
push 0x20
lea eax, [esp + 0x40]
push eax
push 0x5a
call dword [sym.imp.ntdll.dll_ZwQuerySystemInformation]
mov ebx, eax
test ebx, ebx
js 0x41caa3
lea esi, [esp + 0x38]
lea edi, [esp + 0x28]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
test ebx, ebx
jns 0x41caae
push ebx
push 0x40ab88
jmp 0x41ca03
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
and dword [esp + 0x18], 0
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.ntdll.dll_RtlStringFromGUID]
mov ebx, eax
test ebx, ebx
jns 0x41cadf
push ebx
push 0x40abe8
jmp 0x41ca03
push dword [esp + 0x18]
push 0x40ac48
push 2
call fcn.0041c24c
add esp, 0xc
push dword [esp + 0x24]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
push 0xf003f
call fcn.00422661
mov ebx, eax
test ebx, ebx
jns 0x41cb2f
xor eax, eax
cmp ebx, 0xc0000034
push ebx
setne al
push 0x40ac80
lea eax, [eax*2 + 2]
push eax
call fcn.0041c24c
add esp, 0xc
cmp dword [esp + 0x18], 0
je 0x41cb41
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x41cb4e
call fcn.004223fa
cmp byte [esp + 0x13], 0
jne 0x41cb5a
call fcn.0041f68c
mov eax, ebx
mov ecx, dword [esp + 0x5c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0042a860
mov esp, ebp
pop ebp
ret 4
Function at 0x41e877
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
mov dword [esp + 0x10], edx
mov dword [eax], edi
mov esi, edi
lea eax, [esp + 0xc]
mov dword [esp + 0x14], ecx
push eax
push edi
push ecx
mov dword [ebx], edi
mov dword [esp + 0x18], edi
call fcn.0041d0ec
mov edi, eax
cmp edi, 0xc0000023
jne 0x41e8f9
push dword [esp + 0xc]
mov eax, dword fs:[0x30]
push esi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
test esi, esi
jne 0x41e8d4
add edi, 0x77
jmp 0x41e913
mov edx, dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push esi
push ecx
mov ecx, dword [esp + 0x20]
call fcn.0041d0ec
mov edi, eax
test edi, edi
js 0x41e8fd
mov ecx, dword [ebp + 0xc]
mov eax, dword [esp + 0xc]
mov dword [ebx], esi
mov dword [ecx], eax
test edi, edi
jns 0x41e913
test esi, esi
je 0x41e913
mov eax, dword fs:[0x30]
push esi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x41e91e
Capabilities:
Get number of processors

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x64
mov eax, dword [0x42c044]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
push esi
push edi
mov edi, edx
mov dword [esp + 0x24], ecx
xor esi, esi
mov dword [esp + 0x10], esi
mov ebx, esi
mov dword [esp + 0x14], esi
mov eax, dword [edi + 0x18]
add eax, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], eax
cmp dword [eax], 2
je 0x41e965
mov esi, 0xc00000bb
jmp 0x41eadb
cmp dword [edi + 0x14], ebx
jne 0x41e9da
mov edx, dword [edi + 0x1c]
mov eax, edx
and eax, 0xf000000
cmp eax, 0x2000000
jne 0x41e95b
lea eax, [esp + 0x18]
mov dword [esp + 0x18], esi
push eax
push esi
push esi
call fcn.0041d0ec
mov esi, eax
cmp esi, 0xc0000023
jne 0x41eaa7
push dword [esp + 0x18]
mov eax, dword fs:[0x30]
xor esi, esi
push esi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ebx, eax
test ebx, ebx
jne 0x41e9bf
mov esi, 0xc000009a
jmp 0x41eaa7
mov edx, dword [edi + 0x1c]
lea eax, [esp + 0x18]
mov ecx, dword [esp + 0x24]
push eax
push ebx
push esi
call fcn.0041d0ec
mov eax, dword [esp + 0x1c]
mov edi, ebx
jmp 0x41e9e7
cmp dword [edi + 0x14], 1
jne 0x41eaa2
add edi, 0x20
lea esi, [eax + 0x14]
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [esp + 0x20]
jne 0x41e9ef
sub ecx, edx
mov edx, edi
sar ecx, 1
lea eax, [edx + 2]
mov dword [esp + 0x1c], eax
mov ax, word [edx]
add edx, 2
cmp ax, word [esp + 0x20]
jne 0x41ea09
sub edx, dword [esp + 0x1c]
sar edx, 1
lea eax, [ecx + edx]
lea eax, [eax*2 + 2]
mov word [esp + 0x12], ax
movzx eax, ax
push eax
xor eax, eax
push eax
mov eax, dword fs:[0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [esp + 0x14], eax
test eax, eax
jne 0x41ea50
mov esi, 0xc000009a
jmp 0x41eac4
push esi
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.ntdll.dll_RtlAppendUnicodeToString]
push edi
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.ntdll.dll_RtlAppendUnicodeToString]
lea eax, [esp + 0x10]
mov dword [esp + 0x28], 0x18
mov dword [esp + 0x30], eax
xor edi, edi
lea eax, [esp + 0x40]
mov dword [esp + 0x2c], edi
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x38], 0x40
push eax
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], edi
call dword [sym.imp.ntdll.dll_ZwQueryAttributesFile]
mov esi, eax
jmp 0x41eaa9
mov esi, 0xc00000bb
xor edi, edi
cmp dword [esp + 0x14], 0
je 0x41eac4
push dword [esp + 0x14]
mov eax, dword fs:[0x30]
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
test ebx, ebx
je 0x41eadb
push ebx
xor eax, eax
push eax
mov eax, dword fs:[0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov ecx, dword [esp + 0x6c]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0042a860
mov esp, ebp
pop ebp
ret
Function at 0x420535
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
lea eax, [esp + 0xc]
xor esi, esi
and dword [esp + 0xc], esi
mov edx, 0x47000006
push eax
push esi
push ecx
mov ebx, ecx
call fcn.0041d0ec
mov edi, eax
cmp edi, 0xc0000023
jne 0x420598
push dword [esp + 0xc]
mov eax, dword fs:[0x30]
push esi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
test esi, esi
jne 0x420583
add edi, 0xfffffff4
jmp 0x4205c2
lea eax, [esp + 0xc]
mov edx, 0x47000006
push eax
push esi
push ecx
mov ecx, ebx
call fcn.0041d0ec
mov edi, eax
test edi, edi
jns 0x4205b4
test esi, esi
je 0x4205c2
mov eax, dword fs:[0x30]
push esi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x4205c2
mov ecx, dword [ebp + 0xc]
mov eax, dword [esp + 0xc]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8