joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4044f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b8538
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push 0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 0
call fcn.004440d0
mov eax, dword [esp + 0x34]
lea ecx, [esp]
push eax
mov byte [esp + 0x30], 1
call fcn.004a9c8d
lea ecx, [esp + 8]
mov byte [esp + 0x2c], 2
push ecx
lea ecx, [esp + 4]
call fcn.00434f30
push eax
lea ecx, [esp + 4]
mov byte [esp + 0x30], 3
call fcn.004a9d0c
lea ecx, [esp + 8]
mov byte [esp + 0x2c], 2
call fcn.004a9c1f
push ecx
mov ecx, esp
mov dword [esp + 0x10], esp
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
call fcn.004a9c8d
lea ecx, [esp + 0x1c]
call fcn.004447a0
push str.Regist
lea ecx, [esp + 8]
call fcn.004a9c8d
lea edx, [esp]
lea ecx, [esp + 4]
push edx
mov byte [esp + 0x30], 4
call fcn.004a9feb
lea eax, [esp + 0x34]
lea ecx, [esp + 0xc]
push eax
push str.Regsvr32__s__
push ecx
call fcn.004a9edc
push 0x4ee4f8
lea edx, [esp + 0xc]
push eax
push edx
mov byte [esp + 0x38], 5
call fcn.004a9e68
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x30], 6
call fcn.004a9d0c
lea ecx, [esp + 8]
mov byte [esp + 0x2c], 5
call fcn.004a9c1f
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 4
call fcn.004a9c1f
push ecx
lea eax, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004a9994
push ecx
lea edx, [esp + 0xc]
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
mov byte [esp + 0x38], 7
call fcn.004a9994
mov byte [esp + 0x34], 4
lea ecx, [esp + 0x20]
call fcn.00444360
lea ecx, [esp + 4]
mov byte [esp + 0x2c], 2
call fcn.004a9c1f
lea ecx, [esp]
mov byte [esp + 0x2c], 1
call fcn.004a9c1f
lea ecx, [esp + 0x20]
mov byte [esp + 0x2c], 8
call fcn.004a9c1f
lea ecx, [esp + 0x34]
mov dword [esp + 0x2c], 0xffffffff
call fcn.004a9c1f
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret 4
Function at 0x405890
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x4b8b96
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10c
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x4f5b3c]
mov dword [esp + 8], eax
mov esi, dword [esp + 0x124]
mov dword [esp + 0x11c], 0
mov ecx, esi
call fcn.004a9baa
lea ecx, [esp + 0xc]
push 2
push ecx
mov ecx, 0x4ff13c
call fcn.004a7219
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x120], 1
call fcn.004a9d0c
lea ecx, [esp + 0xc]
mov byte [esp + 0x11c], 0
call fcn.004a9c1f
mov edx, dword [esp + 8]
cmp byte [edx + 1], 0x3a
jne 0x40595f
push 0x4ee660
lea ecx, [esp + 0xc]
call fcn.004a9faf
mov ecx, dword [esp + 8]
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x24]
push 0x104
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x40595f
lea edx, [esp + 0x10]
mov ecx, esi
push edx
call fcn.004a9d5c
lea ecx, [esp + 8]
mov dword [esp + 0x11c], 0xffffffff
call fcn.004a9c1f
mov ecx, dword [esp + 0x114]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x118
ret 4
Function at 0x4070d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b9010
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
push 1
lea ecx, [esp + 0xc]
call fcn.004440d0
mov eax, dword [esi + 0x68]
lea edx, [esi + 0x30]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0xc], esp
push edx
mov dword [esp + 0x28], 0
call fcn.004a9994
lea ecx, [esp + 0x10]
call fcn.004444a0
mov dword [esi + 0x64], eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 1
call fcn.004a9c1f
mov ecx, dword [esp + 0x14]
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x408e40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b950f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x88
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0x20]
call fcn.00415cc0
mov eax, dword [0x4f5b3c]
mov dword [esp + 0x94], 0
mov dword [esp + 4], eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
add esi, 0x30
lea ecx, [esp + 8]
push esi
mov byte [esp + 0x98], 3
call fcn.004a9d0c
lea eax, [esp + 0x10]
lea ecx, [esp + 8]
push eax
call fcn.004354c0
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x98], 4
call fcn.004a9d0c
lea ecx, [esp + 0x10]
mov byte [esp + 0x94], 3
call fcn.004a9c1f
push 0x7f5
lea ecx, [esp + 8]
call fcn.004abac8
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push ecx
lea eax, [esp + 0x10]
push edx
push eax
call fcn.004a768f
add esp, 0xc
lea ecx, [esp + 4]
push 0x7d8
call fcn.004abac8
push 3
push ecx
lea edx, [esp + 0xc]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call fcn.004a9994
push ecx
lea eax, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
mov byte [esp + 0xa4], 5
call fcn.004a9994
lea ecx, [esp + 0x28]
mov byte [esp + 0xa0], 3
call fcn.004162a0
push 0
push 0
push 0x69
lea ecx, [esp + 0x28]
mov dword [0x4feef0], 0x69
call fcn.00416340
lea ecx, [esp + 8]
mov byte [esp + 0x94], 2
call fcn.004a9c1f
lea ecx, [esp + 0xc]
mov byte [esp + 0x94], 1
call fcn.004a9c1f
lea ecx, [esp + 4]
mov byte [esp + 0x94], 0
call fcn.004a9c1f
mov dword [esp + 0x94], 7
lea ecx, [esp + 0x88]
call fcn.004a9c1f
lea ecx, [esp + 0x84]
mov byte [esp + 0x94], 6
call fcn.004a9c1f
lea ecx, [esp + 0x78]
mov dword [esp + 0x94], 8
mov dword [esp + 0x14], ecx
mov dword [esp + 0x78], vtable.CGdiObject.0
lea ecx, [esp + 0x78]
mov byte [esp + 0x94], 9
call fcn.004b1077
lea ecx, [esp + 0x1c]
mov dword [esp + 0x94], 0xffffffff
call fcn.004ab31a
mov ecx, dword [esp + 0x8c]
pop esi
mov dword fs:[0], ecx
add esp, 0x94
ret
Function at 0x40d7f0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
lea eax, [ebp - 0x1c]
push edi
push eax
or esi, 0xffffffff
xor edi, edi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
jne 0x40d823
mov eax, dword [ebp + 8]
mov ecx, edi
mov edx, eax
mov dword [edx], edi
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push ebx
mov dword [ebp - 4], 0xa
lea eax, [ebp - 0x14]
push eax
call edi
mov eax, 0x80000000
mov bx, 0xfa0
bsf ecx, eax
dec bx
jne 0x40d840
lea ecx, [ebp - 0xc]
push ecx
call edi
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
sub eax, edx
cmp eax, esi
jae 0x40d85b
mov esi, eax
mov eax, dword [ebp - 4]
dec eax
mov dword [ebp - 4], eax
jne 0x40d831
lea eax, [esi + esi*4]
mov ecx, dword [ebp - 0x1c]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea esi, [eax + eax*4]
mov eax, 0xcccccccd
mul ecx
shl esi, 5
mov edi, edx
mov eax, esi
shr edi, 3
xor edx, edx
div edi
xor edx, edx
mov esi, eax
div ecx
shr ecx, 1
cmp edx, ecx
jbe 0x40d898
inc esi
mov edi, dword [ebp + 0xc]
xor edx, edx
mov eax, edi
div esi
xor edx, edx
mov ecx, eax
mov eax, edi
div esi
mov eax, esi
mov ebx, ecx
shr eax, 1
cmp edx, eax
jbe 0x40d8b4
inc ecx
mov eax, dword [ebp + 8]
mov edx, eax
mov dword [edx], edi
mov dword [edx + 4], esi
mov dword [edx + 8], ebx
pop ebx
pop edi
pop esi
mov dword [edx + 0xc], ecx
mov esp, ebp
pop ebp
ret
Function at 0x40e840
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4ba037
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
mov dword [esp + 0x10], 0
mov ebp, 1
push 0x4fc5e4
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], ebp
call fcn.004a9c8d
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov bl, 2
mov eax, dword [edx - 8]
mov byte [esp + 0x24], bl
cmp eax, ecx
jge 0x40e8a8
mov esi, dword [esp + 0x2c]
lea eax, [esp + 0x30]
push eax
mov ecx, esi
call fcn.004a9994
mov dword [esp + 0x10], ebp
jmp 0x40ea3a
cmp ecx, 0x14
jl 0x40ea26
cmp byte [edx + 1], 0x3a
jne 0x40ea26
push edi
lea edi, [ecx - 6]
push 0x5c
lea ecx, [esp + 0x38]
call fcn.004a72e7
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
mov esi, eax
mov eax, dword [edx - 8]
mov ecx, dword [ecx - 8]
sub eax, esi
add eax, ecx
cmp eax, edi
jg 0x40e960
lea eax, [esp + 0x18]
push esi
push eax
lea ecx, [esp + 0x3c]
call fcn.004a70e4
lea ecx, [esp + 0x10]
lea edx, [esp + 0x38]
push ecx
push eax
push edx
mov byte [esp + 0x34], 3
call fcn.004a9e02
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 4
call fcn.004a9d0c
lea ecx, [esp + 0x38]
mov byte [esp + 0x28], 3
call fcn.004a9c1f
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], bl
call fcn.004a9c1f
lea eax, [esp + 0x1c]
push esi
push eax
lea ecx, [esp + 0x3c]
call fcn.004a7219
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x2c], 5
call fcn.004a9d0c
lea ecx, [esp + 0x1c]
mov byte [esp + 0x28], bl
call fcn.004a9c1f
jmp 0x40e8bf
lea ecx, [esp + 0x38]
push 3
push ecx
lea ecx, [esp + 0x3c]
call fcn.004a7219
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x2c], 6
call fcn.004a9d0c
lea ecx, [esp + 0x38]
mov byte [esp + 0x28], bl
call fcn.004a9c1f
lea edx, [esp + 0x34]
push 0x4eeda8
lea eax, [esp + 0x20]
push edx
push eax
call fcn.004a9e68
lea ecx, [esp + 0x10]
lea edx, [esp + 0x38]
push ecx
push eax
push edx
mov byte [esp + 0x34], 7
call fcn.004a9e02
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 8
call fcn.004a9d0c
lea ecx, [esp + 0x38]
mov byte [esp + 0x28], 7
call fcn.004a9c1f
lea ecx, [esp + 0x1c]
mov byte [esp + 0x28], bl
call fcn.004a9c1f
mov esi, dword [esp + 0x30]
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call fcn.004a9994
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], ebp
mov byte [esp + 0x28], 1
call fcn.004a9c1f
lea ecx, [esp + 0x34]
mov byte [esp + 0x28], 0
call fcn.004a9c1f
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc
mov esi, dword [esp + 0x2c]
lea ecx, [esp + 0x30]
push ecx
mov ecx, esi
call fcn.004a9994
mov dword [esp + 0x10], ebp
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 1
call fcn.004a9c1f
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], 0
call fcn.004a9c1f
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc
Function at 0x40ea70
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4ba078
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebp
push esi
push edi
mov esi, ecx
xor ebp, ebp
mov dword [esp + 0x2c], ebp
mov eax, dword [0x4f5b3c]
mov dword [esp + 0xc], eax
push 0x3c
push ecx
lea edx, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
mov byte [esp + 0x38], 2
call fcn.004a9994
lea eax, [esp + 0x18]
mov ecx, esi
push eax
call fcn.0040e840
mov eax, dword [eax]
lea ecx, [esp + 0x34]
push eax
mov byte [esp + 0x30], 3
call fcn.004a9d5c
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 2
call fcn.004a9c1f
push 0x2f
lea ecx, [esp + 0x3c]
call fcn.004aa09a
mov edi, eax
cmp edi, ebp
jle 0x40eb50
lea ecx, [esp + 0x10]
push edi
push ecx
lea ecx, [esp + 0x40]
call fcn.004a7219
mov eax, dword [eax]
push eax
call fcn.00474e22
add esp, 4
lea ecx, [esp + 0x10]
mov ebp, eax
call fcn.004a9c1f
inc edi
lea edx, [esp + 0x10]
push edi
push edx
lea ecx, [esp + 0x40]
call fcn.004a70e4
mov eax, dword [eax]
push eax
call fcn.00474e22
add esp, 4
lea ecx, [esp + 0x10]
mov edi, eax
call fcn.004a9c1f
lea eax, [ebp + ebp*4]
xor edx, edx
lea eax, [eax + eax*4]
shl eax, 2
div edi
xor ebp, ebp
mov dword [esi + 0x68], eax
jmp 0x40eb53
mov dword [esi + 0x68], ebp
mov eax, dword [esp + 0x38]
cmp dword [eax - 8], ebp
je 0x40ebbe
lea ecx, [esp + 0x10]
mov dword [esi + 0x6c], ebp
push ecx
lea ecx, [esp + 0x38]
call fcn.004354c0
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x30], 4
call fcn.004a9d0c
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 2
call fcn.004a9c1f
mov edx, dword [esp + 0x34]
mov ecx, esi
push edx
push 0x40d
call fcn.004aeaf9
push 0x7de
lea ecx, [esp + 0x10]
call fcn.004372c0
lea eax, [esp + 0x34]
lea ecx, [esp + 0xc]
push eax
call fcn.004a9feb
mov ecx, dword [esp + 0xc]
push ecx
jmp 0x40ebdc
push 0x44
lea ecx, [esp + 0x10]
call fcn.004372c0
lea edx, [esp + 0x34]
lea ecx, [esp + 0xc]
push edx
call fcn.004a9feb
mov eax, dword [esp + 0xc]
push eax
push 0x403
mov ecx, esi
call fcn.004aeaf9
cmp dword [0x4fef8c], ebp
je 0x40ec2e
push 0x74
mov ecx, esi
call fcn.004aea37
mov edx, dword [eax + 0x1c]
lea ecx, [esp + 0x14]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [esp + 0x14]
mov ecx, esi
push eax
call fcn.004b0d00
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x14]
push ebp
push ecx
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [esi + 0x1c]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 1
call fcn.004a9c1f
lea ecx, [esp + 0x34]
mov byte [esp + 0x2c], 0
call fcn.004a9c1f
lea ecx, [esp + 0x38]
mov dword [esp + 0x2c], 0xffffffff
call fcn.004a9c1f
mov ecx, dword [esp + 0x24]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0x24
ret 8
Function at 0x410210
Capabilities:
Create process on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4ba508
push eax
mov eax, dword [0x4fef7c]
mov dword fs:[0], esp
sub esp, 0x20
test eax, eax
push ebx
push esi
push edi
mov ebx, ecx
je 0x410258
mov eax, dword [0x4fef84]
test eax, eax
jne 0x410258
pop edi
pop esi
mov eax, 0x62
pop ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret 8
mov eax, dword [ebx + 0x20]
test eax, eax
jne 0x410269
mov eax, dword [ebx + 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetParent]
push eax
call fcn.004ac100
push 0
mov ecx, ebx
call fcn.004ae13f
push 0x4ca9c0
mov ecx, ebx
call fcn.004af6a0
test eax, eax
je 0x410292
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 0xe4]
test byte [0x4feef8], 0x1a
jne 0x4102a4
push 5
mov ecx, ebx
call fcn.004aec92
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x4102b3
push 0
call fcn.004aec92
mov eax, dword [0x4ffabc]
test eax, eax
jle 0x410316
mov eax, dword [0x4f5b3c]
mov dword [esp + 0xc], eax
mov esi, dword [0x4ffab4]
mov dword [esp + 0x34], 0
test esi, esi
je 0x4102fb
mov edi, dword [sym.imp.KERNEL32.dll_WinExec]
mov eax, esi
mov esi, dword [esi]
add eax, 8
lea ecx, [esp + 0xc]
push eax
call fcn.004a9d0c
mov ecx, dword [esp + 0xc]
push 5
push ecx
call edi
test esi, esi
jne 0x4102dd
mov ecx, 0x4ffab0
call fcn.004a7fc2
lea ecx, [esp + 0xc]
mov dword [esp + 0x34], 0xffffffff
call fcn.004a9c1f
mov al, byte [0x4feef8]
xor esi, esi
test al, 0x1a
je 0x41033a
pop edi
pop esi
mov eax, 0x62
pop ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret 8
mov edi, dword [sym.imp.USER32.dll_IsWindow]
push ebp
mov ebp, dword [sym.imp.USER32.dll_PeekMessageA]
mov edx, dword [ebx + 0x1c]
push edx
call edi
test eax, eax
je 0x4103e8
mov eax, dword [ebx + 0x1c]
push eax
call edi
test eax, eax
je 0x4103dd
push 1
push 0
push 0
lea ecx, [esp + 0x20]
push 0
push ecx
call ebp
test eax, eax
je 0x4103d9
mov edx, dword [ebx]
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
call dword [edx + 0x90]
test eax, eax
jne 0x4103cf
mov eax, dword [esp + 0x18]
cmp eax, 0x12
je 0x41039a
cmp eax, 0x10
je 0x41039a
cmp eax, 0x405
jne 0x41039f
mov esi, 0x63
cmp eax, 0x404
jne 0x4103ad
mov esi, 0x61
jmp 0x4103b9
cmp eax, 0x403
jne 0x4103b9
mov esi, 0x62
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageA]
mov eax, dword [ebx + 0x1c]
push eax
call edi
test eax, eax
jne 0x41035f
test esi, esi
jne 0x4103e8
call dword [sym.imp.USER32.dll_WaitMessage]
jmp 0x410347
mov eax, dword [esp + 0x40]
pop ebp
test eax, eax
jne 0x410404
mov ecx, dword [ebx + 0x1c]
push ecx
call edi
test eax, eax
je 0x410404
push 0
mov ecx, ebx
call fcn.004aec92
mov ecx, dword [esp + 0x2c]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 8
Function at 0x410820
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4ba67c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [esp + 0x24]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push eax
push 0x68
mov dword [esp + 0x20], esi
call fcn.0040fc00
mov ecx, dword [0x4f5b3c]
mov dword [esp + 0x28], 0
mov dword [esi + 0xa0], ecx
mov edx, dword [0x4f5b3c]
lea ebp, [esi + 0xa4]
mov dword [ebp], edx
mov dword [esi], 0x4cac90
mov eax, dword [0x4f5b3c]
mov dword [esp + 0x10], eax
mov dword [esp + 0x34], eax
mov ebx, dword [esp + 0x30]
mov byte [esp + 0x28], 4
mov ecx, ebx
mov eax, dword [ebx + 4]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
call fcn.00410c00
push ecx
mov ecx, esp
mov dword [esp + 0x34], esp
push eax
call fcn.004a9994
lea ecx, [esp + 0x38]
call fcn.0040cea0
lea ecx, [esp + 0x10]
push 1
push ecx
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.fontname
call fcn.004a9c8d
lea ecx, [esp + 0x40]
call fcn.00436ed0
test eax, eax
je 0x4108e8
lea edx, [esp + 0x10]
lea ecx, [esi + 0x74]
push edx
call fcn.004a9d0c
lea eax, [esp + 0x10]
push 1
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.fontsize
call fcn.004a9c8d
lea ecx, [esp + 0x40]
call fcn.00436ed0
test eax, eax
je 0x410920
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00474ead
add esp, 4
mov dword [esi + 0x84], eax
lea edx, [esi + 0x68]
push 1
push edx
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.title
call fcn.004a9c8d
lea ecx, [esp + 0x40]
call fcn.00436ed0
lea eax, [esi + 0x64]
push 1
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.caption
call fcn.004a9c8d
lea ecx, [esp + 0x40]
call fcn.00436ed0
lea edi, [esi + 0x8c]
push 1
push edi
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.bmpfile
call fcn.004a9c8d
lea ecx, [esp + 0x40]
call fcn.00436ed0
test eax, eax
je 0x4109db
lea ecx, [esp + 0x30]
push ecx
mov ecx, edi
call fcn.004354c0
push eax
mov ecx, edi
mov byte [esp + 0x2c], 5
call fcn.004a9d0c
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 4
call fcn.004a9c1f
push edi
lea edx, [esp + 0x34]
push 0x4fef18
push edx
call fcn.004a9e02
mov eax, dword [eax]
mov ecx, edi
push eax
mov byte [esp + 0x2c], 6
call fcn.004a9d5c
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 4
call fcn.004a9c1f
mov eax, dword [esp + 0x14]
test eax, eax
je 0x410a3c
lea eax, [esp + 0x14]
mov ecx, ebx
push eax
call fcn.00410c00
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.004a9994
lea ecx, [esp + 0x38]
call fcn.0040cea0
lea ecx, [esp + 0x34]
push 0x4eef44
lea edx, [esp + 0x34]
push ecx
push edx
call fcn.004a9e68
push eax
mov ecx, ebp
mov byte [esp + 0x2c], 7
call fcn.004a9feb
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 4
call fcn.004a9c1f
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x4109e3
lea ecx, [esp + 0x34]
mov byte [esp + 0x28], 3
call fcn.004a9c1f
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 2
call fcn.004a9c1f
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x1c
ret 8
Function at 0x412080
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4bab66
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x1c], 0
push eax
push 0x6a
call fcn.0040fc00
mov ecx, dword [0x4f5b3c]
lea ebx, [esi + 0xa0]
mov dword [ebx], ecx
mov edx, dword [0x4f5b3c]
lea ebp, [esi + 0xa4]
mov dword [ebp], edx
mov eax, dword [0x4f5b3c]
mov dword [esi + 0xa8], eax
mov ecx, dword [0x4f5b3c]
mov dword [esi + 0xac], ecx
mov edx, dword [0x4f5b3c]
mov dword [esi + 0xb0], edx
push ecx
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
mov byte [esp + 0x24], 6
mov dword [esi], 0x4caf48
call fcn.004a9994
lea edi, [esi + 0x94]
mov ecx, edi
call fcn.0040cea0
mov edx, dword [esp + 0x24]
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push edx
call fcn.004a9c8d
mov ecx, esi
call fcn.00412230
push 1
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push str.prompt
call fcn.004a9c8d
mov ecx, edi
call fcn.00436ed0
lea eax, [esi + 0x64]
push 1
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push str.caption
call fcn.004a9c8d
mov ecx, edi
call fcn.00436ed0
push 1
push ebp
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push str.folderprompt
call fcn.004a9c8d
mov ecx, edi
call fcn.00436ed0
push 0x3a
push ecx
mov dword [esi + 0xb4], 0
mov ecx, esp
mov dword [esp + 0x34], esp
push str.noaskdrive
call fcn.004a9c8d
mov ecx, edi
call fcn.00438180
test eax, eax
je 0x4121bd
mov dword [esi + 0xb4], 1
jmp 0x4121e5
push 0x3a
push ecx
mov ecx, esp
mov dword [esp + 0x34], esp
push str.noaskdir
call fcn.004a9c8d
mov ecx, edi
call fcn.00438180
test eax, eax
je 0x4121e5
mov dword [esi + 0xb4], 2
push ecx
lea edx, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x30], esp
push edx
call fcn.004a9994
mov ecx, edi
call fcn.0040cea0
lea ecx, [esp + 0x28]
mov dword [esp + 0x1c], 0xffffffff
call fcn.004a9c1f
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x10
ret 0xc
Function at 0x412098
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4bab66
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x1c], 0
push eax
push 0x6a
call fcn.0040fc00
mov ecx, dword [0x4f5b3c]
lea ebx, [esi + 0xa0]
mov dword [ebx], ecx
mov edx, dword [0x4f5b3c]
lea ebp, [esi + 0xa4]
mov dword [ebp], edx
mov eax, dword [0x4f5b3c]
mov dword [esi + 0xa8], eax
mov ecx, dword [0x4f5b3c]
mov dword [esi + 0xac], ecx
mov edx, dword [0x4f5b3c]
mov dword [esi + 0xb0], edx
push ecx
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
mov byte [esp + 0x24], 6
mov dword [esi], 0x4caf48
call fcn.004a9994
lea edi, [esi + 0x94]
mov ecx, edi
call fcn.0040cea0
mov edx, dword [esp + 0x24]
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push edx
call fcn.004a9c8d
mov ecx, esi
call fcn.00412230
push 1
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push str.prompt
call fcn.004a9c8d
mov ecx, edi
call fcn.00436ed0
lea eax, [esi + 0x64]
push 1
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push str.caption
call fcn.004a9c8d
mov ecx, edi
call fcn.00436ed0
push 1
push ebp
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push str.folderprompt
call fcn.004a9c8d
mov ecx, edi
call fcn.00436ed0
push 0x3a
push ecx
mov dword [esi + 0xb4], 0
mov ecx, esp
mov dword [esp + 0x34], esp
push str.noaskdrive
call fcn.004a9c8d
mov ecx, edi
call fcn.00438180
test eax, eax
je 0x4121bd
mov dword [esi + 0xb4], 1
jmp 0x4121e5
push 0x3a
push ecx
mov ecx, esp
mov dword [esp + 0x34], esp
push str.noaskdir
call fcn.004a9c8d
mov ecx, edi
call fcn.00438180
test eax, eax
je 0x4121e5
mov dword [esi + 0xb4], 2
push ecx
lea edx, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x30], esp
push edx
call fcn.004a9994
mov ecx, edi
call fcn.0040cea0
lea ecx, [esp + 0x28]
mov dword [esp + 0x1c], 0xffffffff
call fcn.004a9c1f
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x10
ret 0xc