joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405090
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x150
mov eax, dword [0x467fd4]
xor eax, esp
mov dword [esp + 0x14c], eax
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov edx, dword [esp]
shl edx, 4
sub edx, dword [esp]
shl edx, 2
mov dword [0x469458], edx
mov dword [0x46945c], edx
cmp eax, 2
jne 0x4050de
mov ecx, dword [esp + 0xa8]
shl ecx, 4
sub ecx, dword [esp + 0xa8]
jmp 0x4050ee
cmp eax, 1
jne 0x4050f6
mov ecx, dword [esp + 0x54]
shl ecx, 4
sub ecx, dword [esp + 0x54]
lea eax, [edx + ecx*4]
mov dword [0x46945c], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push edi
push 6
push 0x466458
push 0xe
push 0x400
call esi
push 6
push 0x466464
push 0xf
push 0x400
call esi
push 0xa0
lea eax, [esp + 0xb8]
push 0
push eax
call fcn.00424960
add esp, 0xc
lea eax, [esp + 0xb4]
push 0x50
push eax
push 0x1f
push 0x400
call esi
movzx eax, word [esp + 0xb4]
push eax
call dword [sym.imp.USER32.dll_CharLowerW]
mov ecx, dword [0x469450]
cmp ax, 0x64
push 0x50
lea eax, [esp + 0xb8]
mov edi, 1
push eax
push 0x1003
cmove ecx, edi
push 0x400
mov dword [0x469450], ecx
call esi
cmp word [esp + 0xb4], 0x48
mov eax, dword [0x469454]
cmove eax, edi
cmp dword [0x469450], 1
pop edi
mov dword [0x469454], eax
pop esi
jne 0x4051ca
push 0x3c
push dword [0x46613c]
push 0x466040
call fcn.0040bc00
mov eax, dword [0x469454]
add esp, 0xc
mov dword [0x466148], 0x445e78
cmp eax, 1
jne 0x4051ee
push 0x3c
push dword [0x466144]
push str.hh:mm:ss_tt
call fcn.0040bc00
mov eax, dword [0x466144]
add esp, 0xc
mov dword [0x469474], eax
mov ecx, dword [esp + 0x14c]
xor ecx, esp
call fcn.00422c85
add esp, 0x150
ret

Function at 0x4058f0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x194
mov eax, dword [0x467fd4]
xor eax, esp
mov dword [esp + 0x190], eax
push ebp
mov ebp, dword [esp + 0x1ac]
push esi
mov esi, dword [esp + 0x1a0]
push edi
mov edi, dword [esp + 0x1b0]
call fcn.0041c790
test al, al
je 0x4059ac
test esi, esi
jne 0x405945
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov esi, eax
test esi, esi
jne 0x405945
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
test esi, esi
je 0x405964
test edi, edi
je 0x40594f
cmp word [edi], 0
jne 0x405964
push 0xc8
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea edi, [esp + 0xc]
push ebx
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [esp + 0x1ac]
mov ebx, eax
or ecx, 0x10000
push ecx
push edi
push ebp
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
mov esi, eax
test ebx, ebx
je 0x405991
push ebx
call dword [sym.imp.USER32.dll_SetFocus]
pop ebx
pop edi
mov eax, esi
pop esi
pop ebp
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.00422c85
add esp, 0x194
ret
mov eax, dword [esp + 0x1ac]
test eax, eax
jne 0x4059ef
mov ecx, dword [esp + 0x1a8]
and ecx, 0xf
cmp ecx, 4
je 0x4059ea
cmp ecx, 3
je 0x4059ea
cmp ecx, 5
pop edi
sete al
pop esi
inc eax
pop ebp
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.00422c85
add esp, 0x194
ret
mov eax, 6
mov ecx, dword [esp + 0x19c]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00422c85
add esp, 0x194
ret
Function at 0x407850
Capabilities:
Compute adler32 checksum

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x407967
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
movzx ecx, di
shr edi, 0x10
test ebp, ebp
je 0x40795c
push ebx
mov edx, 0x15b0
cmp ebp, edx
cmovb edx, ebp
sub ebp, edx
cmp edx, 0x10
jb 0x40791e
mov ebx, edx
shr ebx, 4
movzx eax, byte [esi]
sub edx, 0x10
add ecx, eax
movzx eax, byte [esi + 1]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 2]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 3]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 4]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 5]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 6]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 7]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 8]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 9]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 0xa]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 0xb]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 0xc]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 0xd]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 0xe]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 0xf]
add edi, ecx
add esi, 0x10
add ecx, eax
add edi, ecx
sub ebx, 1
jne 0x407890
test edx, edx
je 0x40792f
movzx eax, byte [esi]
inc esi
add ecx, eax
add edi, ecx
sub edx, 1
jne 0x407922
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
mov eax, 0x80078071
mul edi
shr edx, 0xf
imul edx, edx, 0xffff000f
add edi, edx
test ebp, ebp
jne 0x407876
pop ebx
shl edi, 0x10
or edi, ecx
mov eax, edi
pop edi
pop ebp
pop esi
ret
mov eax, 1
pop esi
ret

Function at 0x408410
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push dword [esi + 0xc]
push dword [esi + 0x10]
call edi
test eax, eax
je 0x408447
cmp eax, dword [esi + 0xc]
jb 0x40844e
push 0
add eax, eax
mov ecx, esi
push eax
call fcn.00403270
test al, al
je 0x408447
push dword [esi + 0xc]
push dword [esi + 0x10]
call edi
test eax, eax
jne 0x408426
pop edi
xor al, al
pop esi
ret 4
mov eax, dword [esp + 0xc]
push ebx
push ebp
test eax, eax
je 0x4084ec
movzx ecx, word [eax]
test cx, cx
je 0x4084ec
cmp ecx, 0x5c
lea edi, [eax + 2]
mov ecx, esi
cmovne edi, eax
call fcn.00407b90
test al, al
je 0x4084f5
push dword [esi + 0x10]
call fcn.0040bde0
add esp, 4
mov ebp, eax
test edi, edi
je 0x40849a
push edi
call fcn.0040bde0
add esp, 4
mov ebx, eax
jmp 0x40849c
xor ebx, ebx
lea eax, [ebp + 1]
mov dword [esi + 4], ebp
add eax, ebx
cmp eax, dword [esi + 0xc]
jbe 0x4084ce
push dword [esi + 0x10]
call fcn.0040bcd0
add esp, 4
mov dword [esi + 4], eax
call fcn.00414220
push eax
lea eax, [ebp + 1]
mov ecx, esi
add eax, ebx
push eax
call fcn.00403530
test al, al
je 0x4084f5
mov eax, dword [esi + 0x10]
lea esi, [eax + ebp*2]
test edi, edi
je 0x4084e6
lea eax, [ebx + ebx]
push eax
push edi
push esi
call fcn.004243e0
add esp, 0xc
xor eax, eax
mov word [esi + ebx*2], ax
pop ebp
pop ebx
pop edi
mov al, 1
pop esi
ret 4
pop ebp
pop ebx
pop edi
xor al, al
pop esi
ret 4
Function at 0x408670
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44251b
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x467fd4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0
push 0x108
push 2
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x234]
call fcn.004031c0
mov eax, dword [ebp - 0x224]
xor ecx, ecx
mov word [eax], cx
push dword [ebp - 0x224]
mov dword [ebp - 4], ecx
push dword [ebp - 0x228]
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x408765
push dword [edi + 0xc]
mov ebx, dword [ebp - 0x224]
push dword [edi + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
jne 0x408743
test ebx, ebx
je 0x408738
push ebx
call fcn.0040bde0
mov esi, eax
add esp, 4
test esi, esi
je 0x408738
push 0
lea ecx, [esi + 1]
push ecx
mov ecx, edi
call fcn.00403270
test al, al
je 0x408743
add esi, esi
push esi
push ebx
push dword [edi + 0x10]
call fcn.004243e0
mov eax, dword [edi + 0x10]
add esp, 0xc
xor ecx, ecx
mov word [esi + eax], cx
jmp 0x408743
mov eax, dword [edi + 0x10]
xor ecx, ecx
mov word [eax], cx
mov dword [edi + 4], ecx
mov esi, dword [edi + 0x10]
push esi
call fcn.0040bde0
add esp, 4
test eax, eax
je 0x408754
dec eax
cmp word [esi + eax*2], 0x5c
jne 0x408761
xor ecx, ecx
mov word [esi + eax*2], cx
mov bl, 1
jmp 0x408767
xor bl, bl
lea ecx, [ebp - 0x234]
mov dword [ebp - 4], 2
call fcn.00403250
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00422c85
mov esp, ebp
pop ebp
ret

Function at 0x4087a0
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
push dword [esi + 0xc]
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x4087be
mov eax, dword [esi + 0x10]
xor ecx, ecx
mov word [eax], cx
mov dword [esi + 4], ecx
mov eax, dword [esp + 8]
test eax, eax
je 0x4087d6
push eax
mov ecx, esi
call fcn.00407ad0
test al, al
jne 0x4087d6
pop esi
ret 4
mov al, 1
pop esi
ret 4
Function at 0x4092f0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x442580
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x467fd4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
push str.ROOTCIMV2
mov dword [ebp - 4], 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x18], esi
test esi, esi
je 0x40944a
mov ecx, dword [ebx + 0xc]
lea edi, [ebx + 0xc]
test ecx, ecx
je 0x40934c
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
push edi
push 0x44748c
push 1
push 0
push 0x45356c
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x10], eax
test eax, eax
jns 0x4093ce
mov dword [ebp - 0x20], 0x44789c
mov dword [ebp - 0x1c], 0
push str.WbemLocator
push str.Failed_to_instantiate_COM_object
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 1
push str._s__Message:___s_
push eax
call fcn.0040d0c0
add esp, 0x10
test al, al
je 0x4093b9
push 0
lea ecx, [ebp - 0x20]
call fcn.0040d1e0
push eax
push dword [ebp - 0x10]
mov ecx, ebx
call fcn.00405aa0
test al, al
je 0x4093b9
mov bl, 1
jmp 0x4093bb
xor bl, bl
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0
call fcn.0040ca60
test bl, bl
je 0x40944a
mov ebx, dword [ebp + 8]
mov edx, dword [edi]
mov edi, dword [ebp - 0x14]
add edi, 0x14
mov dword [ebp + 8], edx
mov ecx, dword [edi]
test ecx, ecx
je 0x4093e8
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov edx, dword [ebp + 8]
push edi
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [edi], 0
mov eax, dword [edx]
push esi
push edx
call dword [eax + 0xc]
test eax, eax
jns 0x409419
push 0
push 0x446f64
push eax
mov ecx, ebx
call fcn.00405aa0
test al, al
je 0x40944a
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [edi]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x409446
push 0
push 0x446f64
push eax
mov ecx, ebx
call fcn.00405aa0
test al, al
je 0x40944a
mov bl, 1
jmp 0x40944c
xor bl, bl
test esi, esi
je 0x409457
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x409fd0
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x467fd4]
xor eax, esp
mov dword [esp + 0x114], eax
push pe_nt_image_headers32
lea eax, [esp + 8]
push 0
push eax
call fcn.00424960
add esp, 0xc
mov dword [esp], 0x114
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 4], 6
jb 0x40a02e
cmp dword [esp + 8], 2
jb 0x40a02e
mov al, 1
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.00422c85
add esp, 0x118
ret
mov ecx, dword [esp + 0x114]
xor al, al
xor ecx, esp
call fcn.00422c85
add esp, 0x118
ret

Function at 0x40a790
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x442738
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
mov eax, dword [0x467fd4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov ebx, dword [esi + 0xc]
lea eax, [esi + 4]
mov ecx, eax
mov dword [ebp - 4], 0
or ebx, 0xf003f
mov dword [ebp - 0x14], eax
call fcn.0040d1e0
mov ecx, dword [ebp - 0x1c]
mov esi, dword [esi]
mov dword [ebp - 0x10], eax
test ecx, ecx
je 0x40a801
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], 0
cmp esi, 0x80000004
je 0x40a838
cmp esi, 0x80000050
je 0x40a838
lea ecx, [ebp - 0x1c]
push ecx
push ebx
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40a83b
mov ecx, dword [ebp + 0xc]
push 0
push dword [ebp - 0x10]
push eax
call fcn.00405aa0
test al, al
je 0x40a865
jmp 0x40a83b
mov dword [ebp - 0x1c], esi
push dword [ebp + 8]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
test esi, esi
je 0x40a869
mov ecx, dword [ebp - 0x14]
push 0
call fcn.0040d1e0
mov ecx, dword [ebp + 0xc]
push eax
push esi
call fcn.00405aa0
test al, al
jne 0x40a869
xor bl, bl
jmp 0x40a86b
mov bl, 1
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40a879
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40aa10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x442738
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
mov eax, dword [0x467fd4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov ebx, dword [esi + 0xc]
lea eax, [esi + 4]
mov ecx, eax
mov dword [ebp - 4], 0
or ebx, 0x20019
mov dword [ebp - 0x14], eax
call fcn.0040d1e0
mov ecx, dword [ebp - 0x1c]
mov esi, dword [esi]
mov dword [ebp - 0x10], eax
test ecx, ecx
je 0x40aa81
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], 0
cmp esi, 0x80000004
je 0x40aabf
cmp esi, 0x80000050
je 0x40aabf
lea ecx, [ebp - 0x1c]
push ecx
push ebx
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40aaba
mov ecx, dword [ebp + 0x14]
push 0
push dword [ebp - 0x10]
push eax
call fcn.00405aa0
test al, al
jne 0x40aaba
xor bl, bl
jmp 0x40ab03
mov esi, dword [ebp - 0x1c]
jmp 0x40aac2
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp + 0x10]
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
je 0x40ab01
mov ecx, dword [ebp - 0x14]
push 0
call fcn.0040d1e0
mov ecx, dword [ebp + 0x14]
push eax
push esi
call fcn.00405aa0
test al, al
jne 0x40ab01
xor bl, bl
jmp 0x40ab03
mov bl, 1
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40ab11
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40b870
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x442868
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
mov eax, dword [0x467fd4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov eax, dword [esi + 0xc]
lea ecx, [esi + 4]
or eax, 0x20006
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], eax
call fcn.0040d1e0
mov esi, dword [esi]
mov ebx, eax
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x40b8da
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x18], 0
cmp esi, 0x80000004
je 0x40b911
cmp esi, 0x80000050
je 0x40b911
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x10]
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40b914
mov ecx, dword [ebp + 0x14]
push 0
push ebx
push eax
call fcn.00405aa0
test al, al
je 0x40b940
jmp 0x40b914
mov dword [ebp - 0x18], esi
push dword [ebp + 0x10]
mov esi, dword [ebp + 8]
push dword [ebp + 0xc]
push dword [ebp + 0x18]
push 0
push esi
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x40b944
mov ecx, dword [ebp + 0x14]
push 0
push esi
push eax
call fcn.00405aa0
test al, al
jne 0x40b944
xor bl, bl
jmp 0x40b946
mov bl, 1
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x40b954
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x40b9c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x442898
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x467fd4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 0x20]
cmp eax, 1
je 0x40baba
cmp eax, 2
je 0x40baba
cmp eax, 7
jne 0x40ba94
push 1
lea ecx, [ebp - 0x20]
call fcn.00403190
push dword [edi + 0x30]
mov dword [ebp - 4], 0
call fcn.0040be10
add esp, 4
mov dword [ebp + 0xc], eax
lea ecx, [ebp - 0x20]
push 0
push eax
call fcn.00403270
test al, al
je 0x40ba6d
push dword [ebp + 0xc]
mov esi, dword [ebp - 0x10]
push dword [edi + 0x30]
push esi
call fcn.004243e0
push 0
push 0xa
push esi
call fcn.0040c980
add esp, 0x18
mov ecx, ebx
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push esi
push dword [edi + 0x20]
push dword [ebp + 8]
call fcn.0040b830
mov bl, al
jmp 0x40ba6f
xor bl, bl
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 2
call fcn.00403250
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push dword [ebp + 0x10]
push dword [edi + 0x1c]
push dword [edi + 0x30]
push eax
push dword [ebp + 8]
call fcn.0040b830
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov esi, dword [edi + 0x30]
push esi
call fcn.0040be10
add esp, 4
push eax
push esi
push dword [edi + 0x20]
mov esi, dword [ebp + 8]
push 0
push esi
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x40bb01
mov ecx, dword [ebp + 0x10]
push 0
push esi
push eax
call fcn.00405aa0
test al, al
jne 0x40bb01
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40eec0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x442d2a
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x467fd4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
push dword [ebp + 8]
call fcn.00407020
mov dword [ebx + 0x18], 0x44789c
mov dword [ebx + 0x1c], 0
push 0
lea ecx, [ebx + 0x20]
mov dword [ebp - 4], 0
mov dword [ebx], vtable.StatusClass.0
call fcn.00403900
lea ecx, [ebx + 0x28]
call fcn.00403930
movsd xmm0, qword [0x445ec8]
lea edi, [ebx + 0x50]
movsd qword [ebx + 0x30], xmm0
xorps xmm0, xmm0
movups xmmword [ebx + 0x38], xmm0
mov dword [ebx + 0x48], 0
mov dword [ebx + 0x4c], 0
mov dword [edi], 0x44789c
mov dword [edi + 4], 0
mov dword [ebx + 0x58], 0
cmp dword [0x469af8], 0
mov byte [ebp - 4], 1
je 0x40ef9e
push 8
call fcn.00422c96
mov esi, eax
add esp, 4
mov dword [ebp + 8], esi
test esi, esi
je 0x40ef97
lea ecx, [esi + 4]
mov byte [ebp - 4], 3
push ecx
mov dword [esi], vtable.RWLockClass::RWLockOSClass.0
call dword [0x469ae4]
mov dword [ebx + 0x58], esi
jmp 0x40f017
xor esi, esi
mov dword [ebx + 0x58], esi
jmp 0x40f017
push 0x18
call fcn.00422c96
mov esi, eax
add esp, 4
mov dword [ebp + 8], esi
test esi, esi
je 0x40f012
push 0xfa0
lea ecx, [esi + 4]
mov byte [ebp - 4], 5
mov dword [esi], vtable.RWLockClass::RWLockCompatClass.0
call fcn.00403600
lea edi, [esi + 0xc]
mov dword [ebp - 0x14], edi
mov dword [edi + 4], 0xffffffff
mov ecx, edi
mov byte [ebp - 4], 7
mov dword [edi], vtable.SemaphoreClass.0
call fcn.00411330
mov esi, dword [edi]
push 0
push 1
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
push eax
mov ecx, edi
call dword [esi + 8]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x10]
mov eax, dword [ebp + 8]
lea edi, [ebx + 0x50]
mov dword [eax + 0x14], 0
jmp 0x40f014
xor eax, eax
mov dword [ebx + 0x58], eax
push 0xfa0
lea ecx, [ebx + 0x5c]
mov byte [ebp - 4], 8
call fcn.00403600
mov esi, dword [ebp + 0xc]
lea eax, [ebx + 0x64]
push esi
mov ecx, ebx
mov byte [ebp - 4], 9
mov dword [eax], 1
mov dword [ebx + 0x68], eax
call fcn.00406fa0
push esi
mov ecx, edi
call fcn.0040cf90
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x411600
Capabilities:
Get file size
Read file on windows

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x294]
cmp eax, 0xffffffff
je 0x41161f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x294], 0xffffffff
mov eax, dword [esi + 0x298]
cmp eax, 0xffffffff
je 0x41163b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x298], 0xffffffff
mov ecx, esi
pop esi
jmp fcn.00416380
Function at 0x411dd0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4430c8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x467fd4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov eax, dword [ebx + 0xe8]
lea ecx, [ebx + 0xe8]
call dword [eax + 0x18]
lea ecx, [ebx + 0x20]
call fcn.00404ee0
cmp byte [ebx + 0x270], 0
je 0x411eb1
mov ecx, dword [0x4ec1a4]
mov eax, dword fs:[0x2c]
mov eax, dword [eax + ecx*4]
lea ecx, [ebp - 0x18]
mov eax, dword [eax + 8]
mov esi, dword [eax + 0x68]
lea eax, [ebx + 0x5c]
push eax
call fcn.004036a0
mov edi, dword [ebx + 0x68]
lea ecx, [ebp - 0x18]
mov dword [ebx + 0x68], esi
call fcn.00403720
mov eax, dword [ebx]
mov ecx, ebx
mov eax, dword [eax + 0x80]
call eax
mov esi, dword [ebp - 0x10]
lea ecx, [ebp - 0x20]
mov bl, al
lea eax, [esi + 0x5c]
push eax
call fcn.004036a0
lea ecx, [ebp - 0x20]
mov dword [esi + 0x68], edi
call fcn.00403720
movzx eax, bl
mov ebx, esi
mov dword [ebx + 0x138], eax
test eax, eax
jne 0x411ea9
mov esi, dword [ebp + 8]
lea ecx, [ebx + 0xf0]
push eax
mov edi, dword [esi]
call fcn.0040d1e0
push eax
mov ecx, esi
call dword [edi + 4]
mov eax, dword [ebx + 0x138]
test eax, eax
setne al
jmp 0x411f3e
mov esi, dword [ebx + 0x1cc]
lea eax, [ebx + 0x26c]
push eax
push 4
push ebx
push 0x417460
push dword [ebx + 0x268]
push 0
call fcn.0043339f
add esp, 0x18
lea ecx, [ebx + 0x1cc]
push eax
call dword [esi + 8]
mov eax, dword [ebx + 0x1cc]
lea ecx, [ebx + 0x1cc]
mov eax, dword [eax + 0x10]
call eax
test al, al
je 0x411f2d
mov eax, dword [ebx + 0x264]
cmp eax, 3
jge 0x411f13
push dword [eax*4 + 0x44c408]
push dword [ebx + 0x1d0]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [ebx + 0x14]
shr eax, 0xb
not al
test al, 1
je 0x411f42
push dword [ebx + 0x1d0]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x411f42
mov ecx, dword [ebp + 8]
push 0
push str.Cannot_create_thread
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
test al, al
je 0x411f97
cmp byte [ebp + 0xc], 0
je 0x411f81
mov al, byte [ebx + 0x16]
not al
test al, 1
je 0x411f81
cmp byte [ebx + 0x270], 0
jne 0x411f81
push 0x46a6b0
lea ecx, [ebp - 0x28]
call fcn.004036a0
push ebx
mov ecx, 0x467178
mov dword [ebp - 4], 0
call fcn.004070d0
lea ecx, [ebp - 0x28]
call fcn.00403720
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8