joyce8/EMBER2024-capa huggingface dataset:
Function at 0x73e724d2
Capabilities:
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x14]
xor esi, esi
cmp eax, esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
je 0x73e724f7
push dword [eax]
push 0xffffffffffffffff
call fcn.73e7146d
push 4
push esi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push 4
push dword [edi + 0x18]
call esi
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0xc], ebx
je 0x73e85a00
push dword [ebp - 0xc]
mov ebx, dword [ebx]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test ebx, ebx
jne 0x73e728a1
cmp dword [ebp - 4], 0
jl 0x73e7253b
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, dword [ebp + 0xc]
mov dword [eax], ebx
mov edi, dword [edi + 0x14]
test edi, edi
je 0x73e7254a
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8
lea eax, [ebx + 4]
push eax
push 0
push 0
push 4
push dword [edi + 0x18]
call esi
mov esi, eax
test esi, esi
je 0x73e85a0a
cmp dword [ebp - 4], 0
jl 0x73e728ec
push ebx
call fcn.73e714ab
mov dword [ebp - 8], eax
neg eax
sbb eax, eax
and eax, 0x7ff8fff2
add eax, 0x8007000e
mov dword [ebp - 4], eax
js 0x73e728ec
push ebx
lea eax, [esi + 4]
push eax
push dword [ebp - 8]
call fcn.73e723c0
add esp, 0xc
test esi, esi
je 0x73e72528
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
jmp 0x73e72528
test eax, eax
mov dword [ebp - 4], eax
jge 0x73e72515
jmp 0x73e7253b
call fcn.73e90cad
jmp 0x73e72900
call fcn.73e90cad
mov dword [ebp - 4], eax
jmp 0x73e728ba

Function at 0x73e740da
Capabilities:
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x14]
push edi
xor edi, edi
cmp eax, edi
mov dword [ebp - 4], edi
je 0x73e740f9
push dword [eax]
push 0xffffffffffffffff
call fcn.73e7146d
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebx + 4]
push eax
push edi
push edi
push 2
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
je 0x73e85a17
push ebx
push dword [ebp + 8]
lea eax, [edi + 4]
push eax
mov dword [edi], ebx
call fcn.73e723c0
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [esi + 0x14]
test esi, esi
pop ebx
je 0x73e74141
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 8
call fcn.73e90cad
mov dword [ebp - 4], eax
jmp 0x73e74131
Function at 0x73e7553d
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x354
mov eax, dword [0x73ec600c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x258], eax
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x20c]
xor edi, edi
push eax
mov dword [ebp - 0x250], edi
call fcn.73e7576d
mov esi, eax
cmp esi, edi
je 0x73e756ed
push edi
push edi
push 3
push edi
push 1
push 0x80000000
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, edi
mov dword [ebp - 0x250], eax
je 0x73e75708
cmp eax, 0xffffffff
je 0x73e75708
cmp esi, edi
je 0x73e756ed
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
lea eax, [ebp - 0x254]
push eax
push 0x40
lea eax, [ebp - 0x24c]
push eax
push dword [ebp - 0x250]
call ebx
mov esi, eax
cmp esi, edi
je 0x73e7570f
cmp dword [ebp - 0x254], 0x40
jne 0x73e7570f
cmp esi, edi
je 0x73e756ec
cmp word [ebp - 0x24c], 0x5a4d
jne 0x73e8308b
cmp esi, edi
je 0x73e756ec
push edi
push edi
push dword [ebp - 0x210]
push dword [ebp - 0x250]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, dword [ebp - 0x210]
mov dword [ebp - 0x254], eax
jne 0x73e83092
cmp esi, edi
je 0x73e756ec
push edi
lea eax, [ebp - 0x254]
push eax
push 0xf8
lea eax, [ebp - 0x354]
push eax
push dword [ebp - 0x250]
call ebx
mov esi, eax
cmp esi, edi
je 0x73e75716
cmp dword [ebp - 0x254], 0xf8
jne 0x73e75716
cmp esi, edi
je 0x73e756ec
cmp dword [ebp - 0x354], 0x4550
jne 0x73e83099
cmp esi, edi
je 0x73e756ec
push edi
push dword [ebp - 0x250]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x73e830a0
cmp esi, edi
je 0x73e756ec
push 0x73e75740
push dword [ebp - 0x25c]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x73e830a7
push ebx
push dword [ebp - 0x34c]
push dword [ebp - 0x25c]
push 0x73e75720
push dword [ebp - 0x258]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
push dword [ebp - 0x258]
call dword [sym.imp.USER32.dll_CharUpperW]
pop ebx
push dword [ebp - 0x250]
call fcn.73e71561
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
call fcn.73e71586
leave
ret 4
xor esi, esi
jmp 0x73e755b0
xor esi, esi
jmp 0x73e755ef
xor esi, esi
jmp 0x73e75672
xor esi, esi
jmp 0x73e75606
xor esi, esi
jmp 0x73e75634
xor esi, esi
jmp 0x73e75686
xor esi, esi
jmp 0x73e756a2
cmp dword [ebp - 0x34c], 0x38e50000
jae 0x73e756bf
push 0x73e830d0
push dword [ebp - 0x258]
call dword [sym.imp.USER32.dll_wsprintfW]
pop ecx
pop ecx
jmp 0x73e756ec
Function at 0x73e7640e
Capabilities:
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push dword [0x73ec601c]
mov dword [ebp - 4], ecx
push 0
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov ebx, eax
test ebx, ebx
je 0x73e76465
cmp ebx, 0xffffffff
je 0x73e76465
push esi
push 8
push 0
push 0
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
je 0x73e7645e
mov eax, dword [0x73ec6070]
cmp eax, dword [esi + 4]
jne 0x73e7fd9c
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push ebx
call fcn.73e71561
pop esi
pop ebx
leave
ret
mov ecx, dword [ebp - 4]
call fcn.73e73951
mov eax, dword [esi + 4]
mov dword [0x73ec6070], eax
jmp 0x73e76457
Function at 0x73e76974
Capabilities:
Enumerate gui resources

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, ecx
lea ecx, [ebx + 0x14]
call fcn.73e766ee
test eax, eax
je 0x73e76a78
push edi
xor edi, edi
mov dword [ebp - 0x24], 0x73e71f18
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0xcc]
cmp eax, edi
je 0x73e76a5d
mov eax, dword [eax + 0x14]
cmp eax, edi
je 0x73e769c7
mov ecx, eax
call fcn.73e71e0b
push esi
lea eax, [ebp - 0x24]
push eax
mov ecx, ebx
call fcn.73e7270d
mov esi, eax
call fcn.73e765a7
test eax, eax
mov ecx, dword [ebp - 0x20]
je 0x73e83d32
cmp esi, edi
jl 0x73e76a48
cmp ecx, edi
mov eax, ecx
jne 0x73e83d57
mov dword [ebp - 0x14], ecx
lea ecx, [ebx + 0x44]
mov eax, dword [ecx]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
call dword [eax + 0x24]
test eax, eax
jne 0x73e83d76
mov eax, dword [ebp - 0xc]
mov dword [ebp + 8], eax
lea ecx, [ebx + 0x44]
mov eax, dword [ecx]
mov dword [ebp - 8], 1
call dword [eax + 0x24]
mov esi, eax
cmp esi, edi
jne 0x73e83d8a
push edi
push dword [ebp - 4]
mov ecx, ebx
call fcn.73e765bf
mov esi, dword [ebp - 0x20]
cmp esi, edi
jne 0x73e83e0c
mov ecx, ebx
call fcn.73e76a82
mov eax, dword [ebx + 0xcc]
mov eax, dword [eax + 0x14]
cmp eax, edi
pop esi
je 0x73e76a5d
mov ecx, eax
call fcn.73e71dfd
mov ecx, dword [0x73ec6004]
call fcn.73e71dfd
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], 0x73e71f18
call fcn.73e71efd
pop edi
pop ebx
leave
ret 4
cmp esi, edi
jl 0x73e76a48
cmp ecx, edi
mov eax, ecx
je 0x73e769e5
test byte [eax + 0x15], 4
je 0x73e83dbe
mov eax, dword [eax + 8]
cmp eax, edi
je 0x73e769e5
jmp 0x73e83d44
mov edx, dword [ebp + 8]
cmp edx, dword [eax + 0x10]
jne 0x73e83d69
test byte [eax + 0x15], 2
je 0x73e76a12
mov eax, dword [eax + 8]
cmp eax, edi
je 0x73e769f3
jmp 0x73e83d57
lea eax, [ebp - 0x14]
push eax
push 0x73e95d66
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x73e76a0c
mov eax, dword [esi + 0xc]
cmp dword [eax + 0x58], edi
jl 0x73e83dc8
lea ecx, [eax + 0x34]
mov eax, dword [ecx]
call dword [eax + 0x24]
mov edi, eax
test edi, edi
je 0x73e83dc6
mov ecx, dword [edi + 0xc]
cmp dword [ecx + 0x50], 0
jl 0x73e83db9
push dword [ebp + 8]
call fcn.73e9a61f
test eax, eax
jge 0x73e83db9
and dword [ebp - 8], 0
mov edi, dword [edi + 8]
jmp 0x73e83d9c
mov eax, dword [eax + 0x10]
jmp 0x73e76a0f
xor edi, edi
mov esi, dword [esi + 8]
cmp esi, edi
jne 0x73e83d8a
cmp dword [ebp - 8], edi
jne 0x73e76a2b
mov eax, dword [ebp - 0x20]
jmp 0x73e83de6
test byte [eax + 0x14], 1
jne 0x73e83df0
mov eax, dword [eax + 8]
cmp eax, edi
je 0x73e76a36
jmp 0x73e83ddd
mov eax, dword [eax + 0xc]
cmp eax, edi
je 0x73e76a36
push 1
push eax
mov ecx, ebx
call fcn.73e765bf
push 1
jmp 0x73e76a2c
mov eax, dword [esi + 0xc]
cmp dword [ebp - 4], eax
je 0x73e83e1e
push 1
push eax
mov ecx, ebx
call fcn.73e765bf
mov esi, dword [esi + 8]
jmp 0x73e76a39
Function at 0x73e7a2e4
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 4
call fcn.73e714ab
mov esi, eax
neg esi
sbb esi, esi
mov ebx, 0x7ff8fff2
and esi, ebx
mov edi, 0x8007000e
add esi, edi
mov dword [ebp - 4], eax
js 0x73e7a32c
push eax
xor eax, eax
push eax
push dword [ebp + 0x10]
push dword [ebp + 8]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
mov dword [ebp + 0x10], esi
neg esi
sbb esi, esi
and esi, ebx
add esi, edi
cmp dword [ebp - 4], 0
je 0x73e7a33a
push dword [ebp - 4]
call fcn.73e71e1a
test esi, esi
jl 0x73e7a346
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov dword [eax], ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x10

Function at 0x73e7be5e
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x73e836b6
cmp dword [ebp + 0x18], 0
je 0x73e836be
lea eax, [ebp + 0x18]
push eax
push esi
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 0x7a
mov ebx, dword [ebp + 0x1c]
je 0x73e836c5
cmp eax, 3
je 0x73e7beba
cmp eax, 2
je 0x73e7beba
push eax
call fcn.73e74702
test ebx, ebx
jne 0x73e836e5
pop esi
pop ebx
pop ebp
ret 0x18
xor eax, eax
inc eax
jmp 0x73e7beac
and dword [ebp + 0x18], esi
jmp 0x73e7be7a
xor esi, esi
jmp 0x73e7be7a
test esi, esi
jne 0x73e7bea6
cmp dword [ebp + 0x18], esi
jne 0x73e7bea6
test ebx, ebx
je 0x73e7bea6
xor eax, eax
jmp 0x73e7be9c
mov ecx, dword [ebp + 0x18]
mov dword [ebx], ecx
jmp 0x73e7beb4

Function at 0x73e7c46d
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push 0
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
je 0x73e835b2
push ebx
push edi
call fcn.73e714ab
mov ebx, eax
mov esi, ebx
neg esi
sbb esi, esi
and esi, 0x7ff8fff2
add esi, 0x8007000e
js 0x73e7c4ee
push ebx
push edi
push 0
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x73e835bc
test esi, esi
jl 0x73e7c4ee
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0x73e75170
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x73e835c8
test esi, esi
jl 0x73e7c4ee
push 0x34
push dword [ebp - 4]
push dword [ebp + 0xc]
call fcn.73e73d19
add esp, 0xc
test ebx, ebx
je 0x73e7c4f8
push ebx
call fcn.73e71e1a
pop ebx
pop edi
mov eax, esi
pop esi
leave
ret 8
mov esi, eax
test esi, esi
jge 0x73e7c48a
jmp 0x73e7c4f9
call fcn.73e90cad
jmp 0x73e7c501
call fcn.73e90cad
mov esi, eax
jmp 0x73e7c4bb
call fcn.73e90cad
mov esi, eax
jmp 0x73e7c4da
Function at 0x73e7ed4f
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push dword [ebp + 0xc]
xor esi, esi
inc esi
call fcn.73e71657
push 0x73ec6028
mov edi, eax
call fcn.73e715a4
xor ebx, ebx
cmp dword [0x73ec6028], esi
jne 0x73e7ed90
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.73e7ee5b
mov esi, eax
cmp esi, ebx
je 0x73e836f6
cmp edi, ebx
je 0x73e7ed9a
push edi
call fcn.73e716ff
lea eax, [ebp - 4]
push eax
push 0x73e7ee20
push 0x80000002
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x73e7ede8
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push 0x73e7edf4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x73e83703
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
push dword [ebp + 0xc]
call fcn.73e82b6b
jmp 0x73e7ed90
cmp dword [ebp - 8], ebx
jbe 0x73e7eddf
call fcn.73ec4001
jmp 0x73e7eddf

Function at 0x73e92a5f
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x14]
test esi, esi
jne 0x73e92a72
and dword [ebp + 0x18], esi
jmp 0x73e92a7a
cmp dword [ebp + 0x18], 0
jne 0x73e92a7a
xor esi, esi
lea eax, [ebp + 0x18]
push eax
push esi
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 0x7a
mov ebx, dword [ebp + 0x1c]
jne 0x73e92aa7
test esi, esi
jne 0x73e92ab1
cmp dword [ebp + 0x18], esi
jne 0x73e92ab1
test ebx, ebx
je 0x73e92ab1
xor eax, eax
cmp eax, 3
je 0x73e92ab9
cmp eax, 2
je 0x73e92ab9
push eax
call fcn.73e74702
jmp 0x73e92abc
xor eax, eax
inc eax
test ebx, ebx
je 0x73e92ac5
mov ecx, dword [ebp + 0x18]
mov dword [ebx], ecx
pop esi
pop ebx
pop ebp
ret 0x18

Function at 0x73e9fe57
Capabilities:
Capture microphone audio

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x50]
push edi
mov edi, dword [ebp + 8]
mov dword [edi], eax
mov edx, dword [esi + 0x50]
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x4c]
lea ebx, [ecx + edx]
cmp ebx, eax
jbe 0x73e9fe80
sub eax, edx
mov dword [edi + 4], eax
jmp 0x73e9fe83
mov dword [edi + 4], ecx
push 0x20
push edi
push dword [esi + 0x5c]
call dword [sym.imp.WINMM.dll_waveInPrepareHeader]
mov ebx, eax
test ebx, ebx
jne 0x73e9feae
push 0x20
push edi
push dword [esi + 0x5c]
call dword [sym.imp.WINMM.dll_waveInAddBuffer]
mov ebx, eax
test ebx, ebx
mov dword [edi + 0xc], 0xdead0000
je 0x73e9feb9
push dword [esi + 0x5c]
call dword [sym.imp.WINMM.dll_waveInReset]
jmp 0x73e9fed0
mov eax, dword [edi + 4]
add dword [esi + 0x50], eax
mov eax, dword [esi + 0x50]
cmp eax, dword [esi + 0x4c]
jb 0x73e9fed0
mov eax, dword [esi + 0x40]
inc dword [esi + 0x54]
mov dword [esi + 0x50], eax
push ebx
call fcn.73e75b16
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x73ea28c5
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, ecx
push esi
call edi
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
push eax
lea eax, [esi + 0x94]
push 0x73ea2a24
push eax
call ebx
add esp, 0x10
push esi
call edi
push eax
lea eax, [esi + 0x54]
push 0x73ea29fc
push eax
call ebx
add esp, 0x10
push esi
call edi
push eax
lea eax, [esi + 0xd4]
push 0x73ea29d8
push eax
call ebx
add esp, 0x10
lea eax, [esi + 0x54]
push eax
xor edi, edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp eax, edi
mov dword [ebp - 0xc], eax
jne 0x73ea2938
push 7
pop eax
jmp 0x73ea29d0
lea eax, [ebp - 0x10]
push eax
push edi
push esi
push 0x73ea28af
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x4c], eax
neg eax
sbb eax, eax
and eax, 0xfffffff9
add eax, 7
mov ebx, eax
jne 0x73ea29c5
push dword [ebp - 0xc]
push 0xffffffffffffffff
call fcn.73e7146d
mov ebx, dword [esi + 0x50]
cmp ebx, edi
je 0x73ea29c5
push dword [0x73ec60ac]
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, edi
mov dword [ebp - 8], eax
je 0x73ea29c2
push 1
push edi
push 0x100001
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
push dword [esi + 0x4c]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x73ea29b9
push dword [ebp - 4]
push 0xffffffffffffffff
call fcn.73e7146d
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x4c], edi
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x73eb9ec1
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x73ec600c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
mov dword [ebp - 0x418], eax
je 0x73eb9fb6
push 0x104
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x73eb9fb6
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x73eb9fdc
lea eax, [ebp - 0x20c]
push eax
call esi
push dword [ebp - 0x418]
lea eax, [ebp - 0x20c]
push eax
call esi
push ebx
push ebx
push 3
push ebx
push 1
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
lea eax, [ebp - 0x20c]
push eax
call ebx
cmp eax, 0xffffffff
jne 0x73eb9f9e
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call edi
push 0x73eb9fc4
lea eax, [ebp - 0x20c]
push eax
call esi
push dword [ebp - 0x418]
lea eax, [ebp - 0x20c]
push eax
call esi
xor eax, eax
push eax
push eax
push 3
push eax
push 1
push eax
lea eax, [ebp - 0x20c]
push eax
call ebx
cmp eax, 0xffffffff
je 0x73eb9fb4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x418]
call edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
pop ebx
call fcn.73e71586
leave
ret 4
Function at 0x73eba1c7
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x620
mov ecx, dword [ebp + 8]
mov eax, dword [0x73ec600c]
push ecx
push 0x104
mov dword [ebp - 0x620], ecx
lea ecx, [ebp - 0x61c]
push ecx
push 0x73e86654
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push 0x73eba340
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
jne 0x73eba20e
inc eax
jmp 0x73eba330
push ebx
push esi
xor ebx, ebx
cmp word [ebp - 0x61c], bx
push edi
lea esi, [ebp - 0x61c]
je 0x73eba32a
push 2
pop edi
mov eax, esi
jmp 0x73eba235
cmp word [esi], 0x2c
je 0x73eba240
add esi, edi
cmp word [esi], bx
jne 0x73eba22d
cmp word [esi], 0x2c
jne 0x73eba249
mov word [esi], bx
add esi, edi
jmp 0x73eba249
add eax, edi
cmp word [eax], 0x20
je 0x73eba247
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp word [ebp - 0x414], bx
lea eax, [ebp - 0x414]
mov word [ebp - 0x20c], bx
je 0x73eba280
cmp word [eax], 0x28
je 0x73eba286
add eax, edi
cmp word [eax], bx
jne 0x73eba273
cmp word [eax], 0x28
jne 0x73eba2d6
mov word [eax], bx
add eax, edi
cmp word [eax], 0x20
je 0x73eba289
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp + eax*2 - 0x20e]
jmp 0x73eba2b7
sub eax, edi
cmp word [eax], 0x29
jne 0x73eba2b5
mov word [eax], bx
sub eax, edi
cmp word [eax], 0x20
je 0x73eba2bd
lea eax, [ebp - 0x20c]
push eax
call fcn.73eb9ec1
jmp 0x73eba2e9
push dword [ebp - 0x620]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp + eax*2 - 0x416]
jmp 0x73eba304
mov word [eax], bx
sub eax, edi
cmp word [eax], 0x20
je 0x73eba2ff
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.73eba15b
test eax, eax
je 0x73eba33c
cmp word [esi], bx
jne 0x73eba229
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
call fcn.73e71586
leave
ret 8
xor eax, eax
jmp 0x73eba32d
Function at 0x73ebe1b5
Capabilities:
Get number of processors

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x73ec452d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x18], esi
mov dword [esi], 0x73e73cac
mov dword [esi + 0x30], 0x73e90200
mov ecx, dword [esi + 0x90]
xor edi, edi
cmp ecx, edi
je 0x73ebe202
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi + 0x90], edi
mov dword [ebp - 0x14], esi
mov ecx, dword [0x73ec6010]
add ecx, 0x64
mov edx, dword [ecx]
lea eax, [ebp - 0x14]
push eax
call dword [edx + 0x18]
mov dword [ebp - 4], edi
mov eax, dword [esi + 0x78]
cmp eax, edi
je 0x73ebe22a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esi + 0x78], edi
mov eax, dword [esi + 0x7c]
cmp eax, edi
je 0x73ebe23a
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov dword [esi + 0x7c], edi
mov eax, dword [esi + 0xa8]
cmp eax, edi
je 0x73ebe262
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esi + 0xa8], edi
jmp 0x73ebe262
mov dword [ebp - 4], 0xffffffff
mov eax, dword [esi + 0x94]
cmp eax, edi
je 0x73ebe27f
push eax
call fcn.73e71e1a
mov dword [esi + 0x94], edi
mov eax, dword [esi + 0x98]
cmp eax, edi
je 0x73ebe295
push eax
call fcn.73e71e1a
mov dword [esi + 0x98], edi
mov eax, dword [esi + 0xa0]
cmp eax, edi
je 0x73ebe2ab
push eax
call fcn.73e71e1a
mov dword [esi + 0xa0], edi
mov eax, dword [esi + 0x9c]
cmp eax, edi
je 0x73ebe2c1
push eax
call fcn.73e71e1a
mov dword [esi + 0x9c], edi
mov eax, dword [esi + 0x34]
cmp eax, edi
je 0x73ebe2d5
lea ecx, [eax + 8]
mov edx, dword [ecx]
push 1
call dword [edx + 0xc]
mov dword [esi + 0x34], edi
mov eax, dword [esi + 0x38]
cmp eax, edi
je 0x73ebe2e9
lea ecx, [eax + 4]
mov eax, dword [ecx]
push 1
call dword [eax + 0xc]
mov dword [esi + 0x38], edi
mov eax, dword [esi + 0x3c]
cmp eax, edi
je 0x73ebe2fd
lea ecx, [eax + 4]
mov edx, dword [ecx]
push 1
call dword [edx + 0xc]
mov dword [esi + 0x3c], edi
lea ebx, [esi + 0x80]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
cmp eax, edi
je 0x73ebe31e
mov ecx, dword [eax + 0xc]
mov dword [ecx + 0xb4], edi
mov eax, dword [eax + 8]
cmp eax, edi
jne 0x73ebe30e
lea edx, [esi + 0xb4]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov ecx, ebx
call fcn.73ebdc87
mov ecx, esi
call fcn.73e7863b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret