joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4010e4
Capabilities:
Get common file path

Disassembly:
push edi
cmp dword [ebp + 8], ebx
je 0x401177
add byte [eax], al
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push ebx
push ebx
call esi
mov edi, eax
mov eax, dword [ebp + 8]
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x401100
sub eax, ecx
sar eax, 1
add eax, edi
lea eax, [eax + eax + 2]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
test ebx, ebx
je 0x401179
push edi
push ebx
call esi
cmp word [ebx + eax*2], 0x5c
je 0x401137
push 0x5c
pop ecx
mov word [ebx + eax*2], cx
inc eax
mov ecx, dword [ebp + 8]
xor edx, edx
lea edi, [ecx + 2]
mov si, word [ecx]
add ecx, 2
test si, si
jne 0x40113f
sub ecx, edi
sar ecx, 1
je 0x401177
lea ecx, [ebx + eax*2]
mov eax, dword [ebp + 8]
mov si, word [eax + edx*2]
mov word [ecx], si
inc edx
add ecx, 2
lea esi, [eax + 2]
mov di, word [eax]
add eax, 2
test di, di
jne 0x401164
sub eax, esi
sar eax, 1
cmp edx, eax
jb 0x401153
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4010ec
Capabilities:
Get common file path

Disassembly:
push edi
cmp dword [ebp + 8], ebx
je 0x401177
add byte [eax], al
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push ebx
push ebx
call esi
mov edi, eax
mov eax, dword [ebp + 8]
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x401100
sub eax, ecx
sar eax, 1
add eax, edi
lea eax, [eax + eax + 2]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
test ebx, ebx
je 0x401179
push edi
push ebx
call esi
cmp word [ebx + eax*2], 0x5c
je 0x401137
push 0x5c
pop ecx
mov word [ebx + eax*2], cx
inc eax
mov ecx, dword [ebp + 8]
xor edx, edx
lea edi, [ecx + 2]
mov si, word [ecx]
add ecx, 2
test si, si
jne 0x40113f
sub ecx, edi
sar ecx, 1
je 0x401177
lea ecx, [ebx + eax*2]
mov eax, dword [ebp + 8]
mov si, word [eax + edx*2]
mov word [ecx], si
inc edx
add ecx, 2
lea esi, [eax + 2]
mov di, word [eax]
add eax, 2
test di, di
jne 0x401164
sub eax, esi
sar eax, 1
cmp edx, eax
jb 0x401153
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40117e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5fe480]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
Function at 0x40119c
Capabilities:
Get common file path
Get program files directory

Disassembly:
push 0x26
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x4011ae
xor eax, eax
jmp 0x401227
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4011b7
sub eax, edx
sar eax, 1
push esi
lea eax, [eax + eax + 4]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x401226
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4011e3
sub eax, edx
sar eax, 1
add eax, eax
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.00543bc0
lea eax, [ebp - 0x20c]
add esp, 0xc
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x40120e
sub eax, ecx
push 0x5c
sar eax, 1
pop ecx
mov word [esi + eax*2], cx
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005413de
leave
ret

Function at 0x407080
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, dword [0x409214]
mov dword [eax], ecx
mov ebx, edx
test ebx, ebx
jle 0x4070a1
mov eax, 0xff
call fcn.00402680
xor byte [esi], al
inc esi
dec ebx
jne 0x407091
pop esi
pop ebx
ret
Function at 0x415859
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x58e916
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5fe480]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
push edi
mov eax, dword [0x5fe480]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
push str.Loading_AO_database...
mov esi, ecx
push 3
pop ecx
call fcn.00463ba1
mov esi, dword [esi + 0x68]
pop ecx
lea eax, [esp + 0xc]
push eax
call fcn.00416ae9
pop ecx
and dword [esp + 0x38], 0
mov edx, dword [esi]
push eax
mov ecx, esi
call dword [edx + 4]
or dword [esp + 0x38], 0xffffffff
push 1
xor edi, edi
lea esi, [esp + 0x10]
call fcn.00401d98
push str.updtAppManager::LoadAODatabaseAO_database_loaded.
push 3
pop ecx
call fcn.00463ba1
pop ecx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.005413de
mov esp, ebp
pop ebp
ret
Function at 0x4407ae
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x59368d
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x5fe480]
xor eax, esp
mov dword [esp + 0x5c], eax
push esi
push edi
mov eax, dword [0x5fe480]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
lea edi, [esp + 0x1c]
call fcn.0040c611
and dword [esp + 0x78], 0
lea ecx, [esp + 0x4c]
push ecx
push eax
call fcn.00467d3d
mov edi, eax
lea eax, [esp + 0x30]
mov byte [esp + 0x78], 1
call fcn.0043f172
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0x14]
lea esi, [esp + 0x14]
call fcn.0043d429
push edi
lea ecx, [esp + 0x14]
push ecx
mov byte [esp + 0x80], 3
push dword [eax + 4]
mov eax, dword [esp + 0x18]
call fcn.0040c803
mov eax, dword [esp + 0x10]
test eax, eax
je 0x440850
dec dword [eax + 4]
cmp dword [eax + 4], 0
mov ecx, eax
jg 0x440850
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x440860
push dword [eax]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 1
xor edi, edi
lea esi, [esp + 0x34]
call fcn.00401d98
push 1
lea esi, [esp + 0x50]
call fcn.00401d98
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.005413de
mov esp, ebp
pop ebp
ret
Function at 0x45aa23
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x590a30
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x5fe480]
xor eax, esp
mov dword [esp + 0x44], eax
push esi
push edi
mov eax, dword [0x5fe480]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor esi, esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x60], esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
xor edx, edx
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], esi
mov word [esp + 0x34], dx
mov byte [esp + 0x60], 2
mov ecx, dword [ecx]
push 0xffffffffffffffff
mov dword [esp + 0x30], ecx
push esi
lea ecx, [esp + 0x3c]
mov dword [esp + 0x38], 1
call fcn.00401cfe
lea ecx, [esp + 0x2c]
lea edi, [esp + 0xc]
call fcn.0045b6a2
mov edi, dword [ebx + 0xd0]
cmp edi, esi
je 0x45aad2
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.0045b9f3
push 1
xor edi, edi
lea esi, [esp + 0x38]
call fcn.00401d98
lea esi, [esp + 0xc]
call fcn.00422e3b
lea esi, [esp + 0x1c]
call fcn.004265f2
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.005413de
mov esp, ebp
pop ebp
ret 4

Function at 0x45b9f3
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5909b1
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x5fe480]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
push dword [edi]
mov dword [esp + 0xc], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor esi, esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
push edi
lea edx, [esp + 0x10]
lea ecx, [esp + 0x20]
mov byte [esp + 0x3c], 2
call fcn.0045bb66
mov edx, dword [ebp + 8]
push esi
lea eax, [esp + 0x10]
push eax
push dword [ebp + 0xc]
lea ecx, [esp + 0x28]
call fcn.0045c922
lea eax, [esp + 0xc]
push eax
lea edx, [esp + 0x20]
mov ecx, edi
call fcn.0045c1f8
lea esi, [esp + 0xc]
call fcn.00422e3b
lea esi, [esp + 0x1c]
call fcn.004265f2
push dword [edi]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x45baac
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5909b1
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x5fe480]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
push dword [edi]
mov dword [esp + 0xc], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor eax, eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
push edi
lea edx, [esp + 0x10]
lea ecx, [esp + 0x20]
mov byte [esp + 0x3c], 2
call fcn.0045bb66
mov edx, dword [ebp + 8]
push 1
lea eax, [esp + 0x10]
push eax
push dword [ebp + 0xc]
lea ecx, [esp + 0x28]
call fcn.0045c922
lea eax, [esp + 0xc]
push eax
lea edx, [esp + 0x20]
mov ecx, edi
call fcn.0045c1f8
lea esi, [esp + 0xc]
call fcn.00422e3b
lea esi, [esp + 0x1c]
call fcn.004265f2
push dword [edi]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x45d1a9
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x5fe480]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
xor edi, edi
push 0x208
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push edi
push eax
mov esi, ecx
mov dword [ebp - 0x21c], edi
call fcn.00543fe0
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push edi
push edi
push dword [ebp + 8]
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edx, eax
cmp edx, edi
jge 0x45d20b
push 0x18
mov eax, str.srcClientPaths.cpp
call fcn.00433ba6
lea eax, [ebp - 0x218]
push eax
call fcn.004041a9
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.005413de
leave
ret
Function at 0x45ec7b
Capabilities:
Write file on windows

Disassembly:
push 0x34
mov eax, 0x57de1f
call fcn.0054f23c
mov eax, dword [ebp + 8]
mov ebx, ecx
mov dword [ebp - 0x38], ebx
cmp eax, 0xffffffff
jne 0x45ec9e
xor eax, eax
call fcn.0054f2bf
ret 4
mov ecx, dword [ebx + 0x24]
mov edx, dword [ecx]
xor esi, esi
cmp edx, esi
je 0x45ecc4
mov ecx, dword [ebx + 0x34]
mov edi, dword [ecx]
add edi, edx
cmp edx, edi
jae 0x45ecc4
dec dword [ecx]
mov ebx, dword [ebx + 0x24]
mov ecx, dword [ebx]
lea edx, [ecx + 1]
mov dword [ebx], edx
mov byte [ecx], al
jmp 0x45ec96
cmp dword [ebx + 0x54], esi
jne 0x45ecce
or eax, 0xffffffff
jmp 0x45ec96
mov eax, ebx
call fcn.0045f80f
cmp dword [ebx + 0x44], esi
jne 0x45ecf3
movsx eax, byte [ebp + 8]
push dword [ebx + 0x54]
push eax
call fcn.005430cb
pop ecx
pop ecx
cmp eax, 0xffffffff
je 0x45ecc9
mov eax, dword [ebp + 8]
jmp 0x45ec96
mov al, byte [ebp + 8]
push esi
push 8
pop edi
lea esi, [ebp - 0x2c]
mov byte [ebp - 0x2d], al
call fcn.0045f3d7
and dword [ebp - 4], 0
lea eax, [ebx + 0x4c]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x45edb0
lea eax, [ebp - 0x2c]
mov edx, eax
mov ecx, dword [ebx + 0x44]
mov esi, dword [ecx]
lea edi, [ebp - 0x34]
push edi
mov edi, dword [ebp - 0x1c]
add edi, eax
push edi
push edx
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x2d]
push eax
push dword [ebp - 0x40]
call dword [esi + 0x14]
test eax, eax
js 0x45edd8
cmp eax, 1
jg 0x45edb8
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x45ed5c
lea eax, [ebp - 0x2c]
mov esi, dword [ebp - 0x34]
sub esi, eax
je 0x45ed82
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x45ed6f
lea eax, [ebp - 0x2c]
push dword [ebx + 0x54]
push esi
push 1
push eax
call fcn.00543a60
add esp, 0x10
cmp esi, eax
jne 0x45edd8
lea eax, [ebp - 0x2d]
mov byte [ebx + 0x49], 1
cmp dword [ebp - 0x3c], eax
jne 0x45edd3
test esi, esi
jne 0x45ed0f
cmp dword [ebp - 0x1c], 0x20
jae 0x45edd8
push esi
push 8
pop ebx
lea esi, [ebp - 0x2c]
call fcn.0040b285
mov ebx, dword [ebp - 0x38]
jmp 0x45ed0f
mov edx, dword [ebp - 0x2c]
jmp 0x45ed21
cmp eax, 3
jne 0x45edd8
movsx eax, byte [ebp - 0x2d]
push dword [ebx + 0x54]
push eax
call fcn.005430cb
or esi, 0xffffffff
pop ecx
pop ecx
cmp eax, esi
je 0x45eddb
mov esi, dword [ebp + 8]
jmp 0x45eddb
or esi, 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00404bdf
mov eax, esi
jmp 0x45ec96
Function at 0x45f717
Capabilities:
Write file on windows

Disassembly:
push 0x2c
mov eax, 0x57ddf2
call fcn.0054f23c
mov ebx, ecx
cmp dword [ebx + 0x44], 0
mov dword [ebp - 0x34], ebx
je 0x45f807
cmp byte [ebx + 0x49], 0
je 0x45f807
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x45f74f
xor al, al
jmp 0x45f809
push 0
push 8
pop edi
lea esi, [ebp - 0x2c]
call fcn.0045f3d7
and dword [ebp - 4], 0
lea eax, [ebx + 0x4c]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x45f7a6
lea eax, [ebp - 0x2c]
mov edx, eax
add eax, dword [ebp - 0x1c]
mov ecx, dword [ebx + 0x44]
mov esi, dword [ecx]
lea edi, [ebp - 0x30]
push edi
push eax
push edx
push dword [ebp - 0x38]
call dword [esi + 0x18]
xor edi, edi
sub eax, edi
je 0x45f7ab
dec eax
je 0x45f7af
dec eax
dec eax
je 0x45f803
xor bl, bl
push edi
push 1
lea ecx, [ebp - 0x2c]
call fcn.00404bdf
mov al, bl
jmp 0x45f809
mov edx, dword [ebp - 0x2c]
jmp 0x45f774
mov byte [ebx + 0x49], 0
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x45f7bb
lea eax, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, eax
je 0x45f7e1
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x45f7ce
lea eax, [ebp - 0x2c]
push dword [ebx + 0x54]
push esi
push 1
push eax
call fcn.00543a60
add esp, 0x10
cmp esi, eax
jne 0x45f795
cmp byte [ebx + 0x49], 0
je 0x45f803
cmp esi, edi
jne 0x45f766
push edi
push 8
pop ebx
lea esi, [ebp - 0x2c]
call fcn.0040b285
mov ebx, dword [ebp - 0x34]
jmp 0x45f766
mov bl, 1
jmp 0x45f797
mov al, 1
call fcn.0054f2bf
ret
Function at 0x4670aa
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [eax + 0x14], 8
jb 0x4670b2
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
ret

Function at 0x467102
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [eax + 0x14], 8
jb 0x46710a
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x46711c
shr eax, 4
and al, 1
ret
xor al, al
ret

Function at 0x46711f
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x580dd1
mov eax, dword fs:[0]
push eax
mov eax, 0x202c
call fcn.0055bf10
mov eax, dword [0x5fe480]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, 0x5b8848
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
push 0x2000
lea eax, [ebp - 0x2018]
push 0
push eax
mov dword [ebp - 0x2038], 0x5c
movsw word es:[edi], word [esi]
call fcn.00543fe0
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
push eax
push ebx
lea eax, [ebp - 0x2018]
push 0x1000
push eax
call fcn.005413ed
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x2018]
push eax
call fcn.0054663c
add esp, 0x18
push 0x5a3728
lea esi, [ebp - 0x2034]
mov edi, eax
call fcn.004041a9
xor esi, esi
mov dword [ebp - 4], esi
jmp 0x467237
push edi
lea eax, [ebp - 0x2034]
push eax
call fcn.0040bb42
cmp dword [ebp - 0x2024], esi
jbe 0x467216
lea eax, [ebp - 0x2034]
call fcn.004670aa
test al, al
je 0x4671f5
lea eax, [ebp - 0x2034]
call fcn.00467102
test al, al
jmp 0x467214
cmp dword [ebp - 0x2020], 8
mov eax, dword [ebp - 0x2034]
jae 0x46720a
lea eax, [ebp - 0x2034]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x46724e
lea eax, [ebp - 0x2038]
push eax
lea eax, [ebp - 0x2034]
push eax
call fcn.0040bb42
lea eax, [ebp - 0x18]
push eax
push esi
call fcn.0054663c
pop ecx
pop ecx
mov edi, eax
cmp edi, esi
jne 0x4671c2
push 1
xor edi, edi
lea esi, [ebp - 0x2034]
call fcn.00401d98
mov al, 1
jmp 0x46725f
push 1
xor edi, edi
lea esi, [ebp - 0x2034]
call fcn.00401d98
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005413de
leave
ret

Function at 0x46822a
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push 0x24
lea eax, [ebp - 0x24]
push 0
push eax
call fcn.00543fe0
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [ebp - 0x24]
cmp eax, 0xa
ja case.default.0x468253
jmp dword [eax*4 + 0x4682ae]
mov eax, 0x5b8aa0
leave
ret
mov eax, str.MIPS
leave
ret
mov eax, str.ALPHA
leave
ret
mov eax, 0x5b8ac0
leave
ret
mov eax, 0x5b8ac8
leave
ret
mov eax, 0x5b8ad0
leave
ret
mov eax, str.IA64
leave
ret
mov eax, str.ALPHA64
leave
ret
mov eax, str.MSIL
leave
ret
mov eax, str.AMD64
leave
ret
mov eax, str.IA32_ON_WIN64
leave
ret
mov eax, str.UNKNOWN
leave
ret
Function at 0x46891c
Capabilities:
Create thread

Disassembly:
push 0xcc
mov eax, 0x584c39
call fcn.0054f23c
mov ebx, 0x6055a4
push ebx
push 0x11c
call fcn.00542e83
xor edi, edi
pop ecx
pop ecx
cmp eax, edi
je 0x468954
push 0x54485245
mov esi, eax
call fcn.00468086
mov dword [ebp - 0x30], eax
jmp 0x468957
mov dword [ebp - 0x30], edi
mov esi, dword [ebp - 0x30]
cmp esi, edi
jne 0x468973
xor ecx, ecx
push str.Allocate_memory_for_CreateThread_failed_
inc ecx
call fcn.00463ba1
pop ecx
xor eax, eax
jmp 0x468a5f
push ebx
push 8
call fcn.00542e83
mov ebx, eax
pop ecx
pop ecx
cmp ebx, edi
jne 0x468998
xor ecx, ecx
push str.Failed_to_allocate_memory_in_CreateThread
inc ecx
call fcn.00463ba1
pop ecx
call fcn.00468a65
jmp 0x46896c
mov eax, dword [ebp + 0xc]
push 0xc
mov dword [ebx + 4], eax
mov eax, dword [ebp + 8]
pop esi
push esi
mov dword [ebx], eax
lea eax, [ebp - 0x40]
push edi
push eax
call fcn.00543fe0
add esp, 0xc
lea eax, [ebp - 0x34]
push eax
push edi
push ebx
push 0x4688fe
lea eax, [ebp - 0x40]
push edi
push eax
mov dword [ebp - 0x40], esi
call fcn.005469a6
mov ecx, dword [ebp - 0x30]
add esp, 0x18
mov dword [ecx + 8], eax
cmp eax, edi
jne 0x468a57
lea eax, [ebp - 0xd8]
push eax
call fcn.004044d0
mov esi, eax
push str._beginthreadex_failed__errno
push esi
mov dword [ebp - 4], edi
call fcn.0040511f
pop ecx
pop ecx
call fcn.00546898
push dword [eax]
push esi
call fcn.0040bb6d
lea eax, [ebp - 0x2c]
push eax
mov eax, esi
call fcn.0040453a
mov byte [ebp - 4], 1
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x468a1f
lea eax, [ebp - 0x2c]
xor ecx, ecx
push eax
inc ecx
call fcn.00463ba1
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x2c]
call fcn.00401d98
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0xd8]
call fcn.00403cb2
mov esi, dword [ebp - 0x30]
call fcn.00468a65
push ebx
call fcn.00542025
jmp 0x46896b
mov eax, dword [ebp - 0x34]
mov dword [ecx + 4], eax
mov eax, ecx
call fcn.0054f2bf
ret
Function at 0x469699
Capabilities:
Create thread
Resume thread

Disassembly:
push 0xe4
mov eax, 0x587f3f
call fcn.0054f272
mov ebx, ecx
mov edi, dword [ebx + 4]
push dword [edi]
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x54], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor esi, esi
mov dword [ebp - 4], esi
mov eax, dword [ebx + 4]
cmp dword [eax + 4], esi
je 0x4696d8
push dword [edi]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor al, al
call fcn.0054f2ce
ret
add eax, 0x10
push eax
push 4
push ebx
push 0x46948c
push esi
push esi
call fcn.005469a6
mov ecx, dword [ebx + 4]
mov dword [ecx + 4], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax + 4]
add esp, 0x18
cmp eax, esi
je 0x469843
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
jne 0x4697a9
lea eax, [ebp - 0x4c]
push eax
mov byte [ebp - 4], 1
call fcn.004680b9
pop ecx
mov edi, eax
lea eax, [ebp - 0xf0]
push eax
mov byte [ebp - 4], 2
call fcn.004044d0
mov esi, eax
push str.SetThreadPriority_failed:
push esi
mov byte [ebp - 4], 3
call fcn.0040511f
pop ecx
pop ecx
push esi
mov ecx, edi
call fcn.0040c10b
pop ecx
lea eax, [ebp - 0x30]
push eax
mov eax, esi
call fcn.0040453a
mov byte [ebp - 4], 4
cmp dword [ebp - 0x1c], 8
mov eax, dword [ebp - 0x30]
jae 0x469769
lea eax, [ebp - 0x30]
push eax
xor ecx, ecx
call fcn.00463ba1
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x30]
call fcn.00401d98
lea eax, [ebp - 0xf0]
mov byte [ebp - 4], 2
call fcn.00403cb2
push 1
lea esi, [ebp - 0x4c]
call fcn.00401d98
and dword [ebp - 4], edi
jmp 0x4697a9
mov eax, dword [ebx + 4]
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x46985d
lea eax, [ebp - 0x4c]
push eax
mov byte [ebp - 4], 6
call fcn.004680b9
pop ecx
mov edi, eax
lea eax, [ebp - 0xf0]
push eax
mov byte [ebp - 4], 7
call fcn.004044d0
mov esi, eax
push str.ResumeThread_failed:
push esi
mov byte [ebp - 4], 8
call fcn.0040511f
pop ecx
pop ecx
push esi
mov ecx, edi
call fcn.0040c10b
pop ecx
lea eax, [ebp - 0x30]
push eax
mov eax, esi
call fcn.0040453a
mov byte [ebp - 4], 9
cmp dword [ebp - 0x1c], 8
mov eax, dword [ebp - 0x30]
jae 0x469815
lea eax, [ebp - 0x30]
push eax
xor ecx, ecx
call fcn.00463ba1
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x30]
call fcn.00401d98
lea eax, [ebp - 0xf0]
mov byte [ebp - 4], 7
call fcn.00403cb2
push 1
lea esi, [ebp - 0x4c]
call fcn.00401d98
xor bl, bl
mov eax, dword [ebp - 0x54]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
jmp 0x4696d2
mov eax, dword [ebx + 4]
mov byte [eax + 0xc], 1
mov eax, dword [ebx + 4]
mov byte [eax + 0xd], 0
mov bl, 1
jmp 0x469845

Function at 0x46c099
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x5fe480]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x198]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x46c0e2
cmp byte [ebp - 0x198], 2
jne 0x46c0dc
mov eax, dword [ebp - 0x198]
shr eax, 8
cmp al, 2
jne 0x46c0dc
dec al
jmp 0x46c0e4
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005413de
leave
ret