joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44848a
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0x587d39
call fcn.00510ecc
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], 0x5a1164
lea edi, [esi + 0x168]
mov dword [ebp - 4], 0x10
mov ecx, edi
mov dword [edi], 0x59d698
call fcn.004ed1a0
mov ecx, edi
call fcn.004ed0f0
lea ecx, [esi + 0x88]
mov byte [ebp - 4], 0xf
call fcn.00435d2c
lea ecx, [esi + 0x80]
mov byte [ebp - 4], 0xe
call fcn.00567f23
lea ecx, [esi + 0x7c]
mov byte [ebp - 4], 0xd
call fcn.00567f23
lea ecx, [esi + 0x78]
mov byte [ebp - 4], 0xc
call fcn.00567f23
lea ecx, [esi + 0x74]
mov byte [ebp - 4], 0xb
call fcn.00567f23
lea ecx, [esi + 0x70]
mov byte [ebp - 4], 0xa
call fcn.00567f23
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 9
call fcn.00567f23
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 8
call fcn.00567f23
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 7
call fcn.00567f23
lea ecx, [esi + 0x2c]
mov byte [ebp - 4], 6
call fcn.00567f23
lea ecx, [esi + 0x28]
mov byte [ebp - 4], 5
call fcn.00567f23
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 4
call fcn.00567f23
lea ecx, [esi + 0x20]
mov byte [ebp - 4], 3
call fcn.00567f23
lea ecx, [esi + 0x1c]
mov byte [ebp - 4], 2
call fcn.00567f23
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.00567f23
and byte [ebp - 4], 0
lea ecx, [esi + 0x10]
call fcn.00567f23
or dword [ebp - 4], 0xffffffff
lea ecx, [esi + 0xc]
call fcn.00567f23
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x449244
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x588044
call fcn.00510ecc
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push dword [ebp + 0xc]
call edi
test eax, eax
je 0x449325
xor ebx, ebx
mov esi, 0x3e8
push dword [ebp + 0xc]
call fcn.004105a6
cmp eax, 0xffffffff
pop ecx
jne 0x449325
push dword [ebp + 0xc]
call edi
test eax, eax
je 0x449325
push dword [ebp + 0x10]
push esi
call fcn.004139c6
pop ecx
test eax, eax
pop ecx
jne 0x4492a4
add ebx, esi
cmp ebx, 0x1388
jl 0x44926c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x4492f1
push str.If_you_are_previewing_the_downloading_video_audio__please_stop_previewing__then_click_OK_button.
lea ecx, [ebp - 0x10]
call fcn.00567f97
push 0x31
push 0x5dd750
push dword [ebp - 0x10]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 2
jne 0x4492e5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00567f23
push 1
pop eax
jmp 0x44932c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00567f23
xor ebx, ebx
push dword [ebp + 0xc]
call fcn.004105a6
cmp eax, 0xffffffff
pop ecx
jne 0x449325
push dword [ebp + 0xc]
call edi
test eax, eax
je 0x449325
push dword [ebp + 0x10]
push esi
call fcn.004139c6
pop ecx
test eax, eax
pop ecx
jne 0x449329
add ebx, esi
cmp ebx, 0x2710
jge 0x449329
jmp 0x4492f3
xor eax, eax
jmp 0x44932c
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x44933b
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push edi
push dword [ebp + 0xc]
call esi
test eax, eax
je 0x4493b7
push dword [ebp + 0x10]
call esi
xor ebx, ebx
test eax, eax
je 0x449375
cmp dword [ebp + 0x14], ebx
je 0x4493bc
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.00449244
add esp, 0xc
test eax, eax
jl 0x4493bc
mov edi, 0x3e8
push 1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.004105ca
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4493b3
push dword [ebp + 0xc]
call esi
test eax, eax
je 0x4493b7
push dword [ebp + 0x18]
push edi
call fcn.004139c6
pop ecx
test eax, eax
pop ecx
jne 0x4493bc
add ebx, edi
cmp ebx, 0x1388
jge 0x4493bc
jmp 0x44937a
xor eax, eax
jmp 0x4493bf
push 0xfffffffffffffffe
pop eax
jmp 0x4493bf
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x44fa16
Capabilities:
Check if file exists

Disassembly:
push dword [0x67536c]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44fa3b
push 0
push 0x414
push dword [0x67536c]
call fcn.00410529
add esp, 0xc
ret

Function at 0x450d72
Capabilities:
Check if file exists
Create process on windows

Disassembly:
mov eax, 0x588528
call fcn.00510ecc
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
push esi
lea ecx, [ebp - 0x20]
call fcn.0044f1cc
xor edi, edi
push 0x6752e4
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], edi
mov dword [ebp - 0x18], edi
call fcn.00567f97
xor ebx, ebx
cmp dword [esi + 0x14], edi
mov byte [ebp - 4], 1
jle 0x450e0b
jmp 0x450da3
xor edi, edi
cmp ebx, edi
jl 0x450db2
cmp ebx, dword [esi + 0x14]
jge 0x450db2
mov eax, dword [esi + 0x10]
mov edi, dword [eax + ebx*4]
test edi, edi
je 0x450e03
mov ecx, edi
call fcn.00450e78
test eax, eax
je 0x450e03
mov eax, dword [ebp - 0x10]
cmp dword [eax - 8], 0
je 0x450dd7
push 0x5de0ec
lea ecx, [ebp - 0x10]
call fcn.00568314
push 0x5ddef4
lea ecx, [ebp - 0x10]
call fcn.00568314
add edi, 0x6ac
lea ecx, [ebp - 0x10]
push edi
call fcn.00568350
push 0x5ddef4
lea ecx, [ebp - 0x10]
call fcn.00568314
inc dword [ebp - 0x18]
inc ebx
cmp ebx, dword [esi + 0x14]
jl 0x450da1
xor edi, edi
mov eax, dword [ebp - 0x10]
cmp dword [eax - 8], edi
je 0x450e4e
lea eax, [ebp - 0x14]
push eax
call fcn.00404065
pop ecx
push dword [ebp - 0x14]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
push 1
push edi
je 0x450e36
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push edi
jmp 0x450e3f
push edi
push dword [ebp - 0x10]
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x14]
call fcn.00567f23
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00567f23
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.0044f1fb
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4559ef
Capabilities:
Resume thread

Disassembly:
mov eax, 0x588c5d
call fcn.00510ecc
push ecx
push ebx
push esi
push edi
mov edi, ecx
push 0x70
call fcn.00568512
pop ecx
mov ecx, eax
mov dword [ebp - 0x10], ecx
xor ebx, ebx
cmp ecx, ebx
mov dword [ebp - 4], ebx
je 0x455a20
push dword [edi]
call fcn.0045590e
mov esi, eax
jmp 0x455a22
xor esi, esi
or eax, 0xffffffff
cmp esi, ebx
mov dword [ebp - 4], eax
je 0x455a70
push ebx
push ebx
push 4
mov ecx, esi
call fcn.0056c236
test eax, eax
jne 0x455a49
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 4]
or eax, 0xffffffff
jmp 0x455a70
mov ecx, dword [edi]
push ebx
push 0x64
push ebx
mov eax, dword [ecx]
push ebx
call dword [eax + 0x128]
push ebx
mov dword [edi + 4], esi
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x455d15
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x588da5
call fcn.00510ecc
push ecx
mov eax, dword [0x66d540]
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0xc]
mov dword [ecx], eax
mov eax, dword [0x66d540]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x10], eax
mov eax, dword [0x66d540]
mov dword [esi + 0x20], eax
mov eax, dword [0x66d540]
mov dword [esi + 0x40], eax
mov eax, dword [0x66d540]
mov dword [esi + 0x44], eax
mov eax, dword [0x66d540]
mov dword [esi + 0x48], eax
mov eax, dword [0x66d540]
mov dword [esi + 0x4c], eax
mov edi, 0x6752e4
mov byte [ebp - 4], 6
push edi
mov dword [esi], ebx
mov dword [esi + 4], 1
mov dword [esi + 8], ebx
call fcn.005680ba
push edi
lea ecx, [esi + 0x10]
call fcn.005680ba
push edi
lea ecx, [esi + 0x20]
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
call fcn.005680ba
push edi
lea ecx, [esi + 0x40]
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], 0x14
call fcn.005680ba
push edi
lea ecx, [esi + 0x44]
call fcn.005680ba
push edi
lea ecx, [esi + 0x48]
call fcn.005680ba
push edi
lea ecx, [esi + 0x4c]
call fcn.005680ba
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x45899c
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x5891f2
call fcn.00510ecc
sub esp, 0x248
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.00419d95
pop ecx
mov eax, dword [eax]
push 1
xor esi, esi
push 1
push eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], esi
call fcn.00410059
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.00567f23
lea ecx, [ebp - 0x8c]
call fcn.00458795
push dword [ebp + 0x2c]
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 3
push dword [ebp + 0x28]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x20]
push dword [ebp + 8]
call fcn.004583aa
cmp eax, esi
je 0x458a18
mov byte [ebp - 4], 4
mov esi, eax
jmp 0x458b01
push dword [ebp - 0x20]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x458a31
mov byte [ebp - 4], 5
or esi, 0xffffffff
jmp 0x458b01
push esi
lea ecx, [ebp - 0x254]
call fcn.004ed0d0
push 3
lea ecx, [ebp - 0x254]
push dword [ebp - 0x20]
mov byte [ebp - 4], 6
call fcn.004ee240
test al, al
jne 0x458a7f
lea ecx, [ebp - 0x254]
mov byte [ebp - 4], 3
mov dword [ebp - 0x254], 0x59d698
call fcn.004ed1a0
lea ecx, [ebp - 0x254]
call fcn.004ed0f0
mov byte [ebp - 4], 7
jmp 0x458a29
cmp dword [ebp + 0x24], esi
jle 0x458ac9
cmp dword [ebp + 0x20], esi
jle 0x458ac9
push edi
lea ecx, [ebp - 0x254]
call fcn.004ec070
lea ecx, [ebp - 0x254]
mov edi, eax
call fcn.004ec060
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push eax
lea eax, [ebp + 0x18]
push edi
push eax
call fcn.0045a41c
push dword [ebp + 0x1c]
lea eax, [ebp - 0x254]
push dword [ebp + 0x18]
push eax
call fcn.00412212
add esp, 0x20
pop edi
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x254]
push esi
push eax
call fcn.004ed6f0
lea ecx, [ebp - 0x254]
mov byte [ebp - 4], 3
mov dword [ebp - 0x254], 0x59d698
call fcn.004ed1a0
lea ecx, [ebp - 0x254]
call fcn.004ed0f0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x74]
call fcn.00567f23
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x8c], 0x59d6d0
call fcn.004100c6
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x458b2e
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x58921c
call fcn.00510ecc
sub esp, 0x68
push esi
lea ecx, [ebp - 0x74]
call fcn.00458795
push dword [ebp + 0x14]
xor esi, esi
lea ecx, [ebp - 0x74]
mov dword [ebp - 4], esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00458692
cmp eax, esi
je 0x458b6c
mov dword [ebp - 4], 1
mov esi, eax
jmp 0x458b8c
push dword [ebp + 0xc]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x458b85
mov dword [ebp - 4], 2
or esi, 0xffffffff
jmp 0x458b8c
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x5c]
call fcn.00567f23
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x45a47f
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x5893f0
call fcn.00510ecc
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ebx
mov edi, 0x6752fc
push str._sMediaProbe.exe
push edi
call fcn.005651d9
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0xc
push dword [0x6752fc]
call esi
test eax, eax
jne 0x45a4c3
push str.MediaProbe.exe
mov ecx, edi
call fcn.005680ba
push ebx
mov edi, 0x675300
push str._sMediaEncode.exe
push edi
call fcn.005651d9
add esp, 0xc
push dword [0x675300]
call esi
test eax, eax
jne 0x45a4ef
push str.MediaEncode.exe
mov ecx, edi
call fcn.005680ba
push dword [0x675300]
lea eax, [ebp - 0x14]
push eax
call fcn.0041113e
pop ecx
pop ecx
and dword [ebp - 4], 0
push 0x5efdec
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.005681c8
push eax
mov ecx, 0x675304
mov byte [ebp - 4], 1
call fcn.0056806a
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00567f23
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00567f23
push ebx
mov edi, 0x675308
push str._sMediaPlay.exe
push edi
call fcn.005651d9
add esp, 0xc
push dword [0x675308]
call esi
test eax, eax
jne 0x45a566
push str.MediaPlay.exe
mov ecx, edi
call fcn.005680ba
cmp dword [0x67530c], 0
jne 0x45a66a
mov eax, dword [0x66d540]
mov dword [ebp + 8], eax
push 2
lea eax, [ebp + 8]
pop edi
push ebx
push str._s_avcodec_60.dll
push eax
mov dword [ebp - 4], edi
call fcn.005651d9
add esp, 0xc
push dword [ebp + 8]
call esi
test eax, eax
je 0x45a5a6
mov dword [0x67530c], 6
cmp dword [0x67530c], 0
jne 0x45a65e
push ebx
lea eax, [ebp + 8]
push str._s_avcodec_59.dll
push eax
call fcn.005651d9
add esp, 0xc
push dword [ebp + 8]
call esi
test eax, eax
je 0x45a5d8
mov dword [0x67530c], 5
cmp dword [0x67530c], 0
jne 0x45a65e
push ebx
lea eax, [ebp + 8]
push str._s_avcodec_58.dll
push eax
call fcn.005651d9
add esp, 0xc
push dword [ebp + 8]
call esi
test eax, eax
je 0x45a606
mov dword [0x67530c], 4
cmp dword [0x67530c], 0
jne 0x45a65e
push ebx
lea eax, [ebp + 8]
push str._s_avcodec_57.dll
push eax
call fcn.005651d9
add esp, 0xc
push dword [ebp + 8]
call esi
test eax, eax
je 0x45a634
mov dword [0x67530c], 3
cmp dword [0x67530c], 0
jne 0x45a65e
push ebx
lea eax, [ebp + 8]
push str._s_avcodec_56.dll
push eax
call fcn.005651d9
add esp, 0xc
push dword [ebp + 8]
call esi
test eax, eax
je 0x45a65e
mov dword [0x67530c], edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00567f23
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword [0x675310], 1
xor eax, eax
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x45a685
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push dword [0x675308]
call esi
test eax, eax
je 0x45a6a5
xor eax, eax
push eax
push eax
push eax
push dword [0x675308]
jmp 0x45a6d5
push dword [0x675300]
call esi
test eax, eax
je 0x45a6be
xor eax, eax
push eax
push eax
push eax
push dword [0x675300]
jmp 0x45a6d5
push dword [0x6752fc]
call esi
test eax, eax
je 0x45a6dd
xor eax, eax
push eax
push eax
push eax
push dword [0x6752fc]
push eax
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
pop esi
ret

Function at 0x45a946
Capabilities:
Check if file exists
Set current directory

Disassembly:
mov eax, 0x58944c
call fcn.00510ecc
sub esp, 0x1c
push ebx
push esi
push edi
mov esi, ecx
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45a984
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.0041113e
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea ecx, [ebp - 0x10]
call fcn.00567f23
lea eax, [ebp - 0x14]
push eax
call fcn.00419d95
pop ecx
mov eax, dword [eax]
and dword [ebp - 4], 0
push 1
push 1
push eax
lea ecx, [ebp - 0x28]
call fcn.00410059
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.00567f23
push dword [ebp + 8]
lea edi, [esi + 0x18]
mov ecx, edi
call fcn.005680ba
push dword [ebp + 0x10]
mov eax, esi
neg eax
push dword [ebp - 0x24]
lea ecx, [esi + 0x10]
sbb eax, eax
and eax, ecx
mov ecx, esi
push eax
call fcn.0045a702
test eax, eax
je 0x45a9db
mov esi, eax
jmp 0x45aa10
push dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov eax, dword [esi]
mov ecx, esi
push ebx
push dword [ebp - 0x24]
call dword [eax + 0x24]
test eax, eax
je 0x45a9f5
or esi, 0xffffffff
jmp 0x45aa10
mov edi, dword [edi]
mov eax, dword [esi]
push edi
push ebx
mov ecx, esi
call dword [eax + 0x28]
or esi, 0xffffffff
cmp eax, esi
je 0x45aa10
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xc]
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004100c6
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x45cc95
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x5897fd
call fcn.00510ecc
push ecx
push ecx
push esi
push edi
mov edi, ecx
call fcn.0045ce2f
mov esi, dword [ebp + 8]
lea ecx, [edi + 4]
lea eax, [esi + 4]
push eax
call fcn.0056806a
lea eax, [esi + 8]
lea ecx, [edi + 8]
push eax
call fcn.0056806a
mov eax, dword [esi + 0xc]
lea ecx, [edi + 0x2c]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [edi + 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [edi + 0x1c], eax
mov eax, dword [esi + 0x20]
mov dword [edi + 0x20], eax
mov eax, dword [esi + 0x24]
mov dword [edi + 0x24], eax
mov eax, dword [esi + 0x28]
mov dword [edi + 0x28], eax
lea eax, [esi + 0x2c]
push eax
call fcn.0056806a
lea eax, [esi + 0x30]
lea ecx, [edi + 0x30]
push eax
call fcn.0056806a
lea eax, [esi + 0x34]
lea ecx, [edi + 0x34]
push eax
call fcn.0056806a
lea eax, [esi + 0x38]
lea ecx, [edi + 0x38]
push eax
call fcn.0056806a
lea eax, [esi + 0x3c]
lea ecx, [edi + 0x3c]
push eax
call fcn.0056806a
lea eax, [esi + 0x40]
lea ecx, [edi + 0x40]
push eax
call fcn.0056806a
lea eax, [esi + 0x44]
lea ecx, [edi + 0x44]
push eax
call fcn.0056806a
lea eax, [esi + 0x48]
lea ecx, [edi + 0x48]
push eax
call fcn.0056806a
lea eax, [esi + 0x4c]
lea ecx, [edi + 0x4c]
push eax
call fcn.0056806a
and dword [ebp + 8], 0
cmp dword [esi + 0x58], 0
jle 0x45cde0
push ebx
mov eax, dword [esi + 0x54]
mov ecx, dword [ebp + 8]
push 8
mov eax, dword [eax + ecx*4]
mov dword [ebp - 0x10], eax
call fcn.00568512
mov ebx, eax
pop ecx
mov dword [ebp - 0x14], ebx
and dword [ebp - 4], 0
test ebx, ebx
je 0x45cdc2
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 4]
mov eax, dword [eax]
mov dword [ebp - 0x10], ecx
mov ecx, dword [0x66d540]
mov dword [ebx], ecx
mov ecx, dword [0x66d540]
mov dword [ebx + 4], ecx
push eax
mov ecx, ebx
mov byte [ebp - 4], 2
call fcn.005680ba
push dword [ebp - 0x10]
lea ecx, [ebx + 4]
call fcn.005680ba
jmp 0x45cdc4
xor ebx, ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [edi + 0x50]
push ebx
push dword [ecx + 8]
call fcn.005674ba
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
cmp eax, dword [esi + 0x58]
jl 0x45cd6c
pop ebx
push dword [0x59d724]
lea eax, [esi + 0x64]
lea ecx, [edi + 0x64]
push 0
push eax
call fcn.00422285
cmp dword [esi + 0x74], 0
je 0x45ce1f
mov eax, dword [esi + 0x78]
test eax, eax
jbe 0x45ce1f
push eax
call fcn.00568512
mov dword [edi + 0x74], eax
push dword [esi + 0x78]
push dword [esi + 0x74]
push eax
call fcn.00511550
mov eax, dword [esi + 0x78]
add esp, 0x10
mov dword [edi + 0x78], eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x45db2e
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
mov eax, 0x589a1f
call fcn.00510ecc
push ecx
mov eax, dword [0x66d540]
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
lea edi, [esi + 4]
mov dword [edi], eax
mov eax, dword [0x66d540]
and dword [ebp - 4], 0
lea ebx, [esi + 8]
mov dword [ebx], eax
mov eax, dword [0x66d540]
mov dword [esi + 0x2c], eax
mov eax, dword [0x66d540]
mov dword [esi + 0x30], eax
mov eax, dword [0x66d540]
mov dword [esi + 0x34], eax
mov eax, dword [0x66d540]
mov dword [esi + 0x38], eax
mov eax, dword [0x66d540]
mov dword [esi + 0x3c], eax
mov eax, dword [0x66d540]
mov dword [esi + 0x40], eax
mov eax, dword [0x66d540]
mov dword [esi + 0x44], eax
mov eax, dword [0x66d540]
mov dword [esi + 0x48], eax
mov eax, dword [0x66d540]
mov dword [esi + 0x4c], eax
lea ecx, [esi + 0x50]
mov byte [ebp - 4], 0xa
call fcn.00567420
mov dword [esi + 0x50], 0x59e004
mov al, byte [ebp + 0xb]
lea ecx, [esi + 0x64]
push 0
mov byte [ebp - 4], 0xb
mov byte [ecx], al
call fcn.004142cb
and dword [esi + 0x74], 0
and dword [esi + 0x78], 0
mov ecx, esi
mov byte [ebp - 4], 0xc
mov dword [esi], 0x5a34c4
call fcn.0045ce2f
push dword [ebp + 8]
mov ecx, edi
call fcn.005680ba
push dword [ebp + 0xc]
mov ecx, ebx
call fcn.005680ba
and dword [esi + 0xc], 0
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x45dc0b
Capabilities:
Get number of processors

Disassembly:
mov eax, 0x589ac3
call fcn.00510ecc
push ecx
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], 0x5a34c4
mov dword [ebp - 4], 0xc
call fcn.0045d0ed
push 1
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 0xb
call fcn.004142cb
lea edi, [esi + 0x50]
mov dword [ebp - 0x14], edi
mov dword [edi], method.CPtrArray.virtual_0
mov ecx, edi
mov byte [ebp - 4], 0xd
call fcn.00425700
mov ecx, edi
mov byte [ebp - 4], 0xa
call fcn.00567453
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 9
call fcn.00567f23
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 8
call fcn.00567f23
lea ecx, [esi + 0x44]
mov byte [ebp - 4], 7
call fcn.00567f23
lea ecx, [esi + 0x40]
mov byte [ebp - 4], 6
call fcn.00567f23
lea ecx, [esi + 0x3c]
mov byte [ebp - 4], 5
call fcn.00567f23
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 4
call fcn.00567f23
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 3
call fcn.00567f23
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.00567f23
lea ecx, [esi + 0x2c]
mov byte [ebp - 4], 1
call fcn.00567f23
and byte [ebp - 4], 0
lea ecx, [esi + 8]
call fcn.00567f23
or dword [ebp - 4], 0xffffffff
lea ecx, [esi + 4]
call fcn.00567f23
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x460c82
Capabilities:
Resume thread

Disassembly:
mov eax, 0x58a21d
call fcn.00510ecc
push ecx
push esi
mov esi, ecx
push 0x74
call fcn.00568512
pop ecx
mov ecx, eax
mov dword [ebp - 0x10], ecx
and dword [ebp - 4], 0
test ecx, ecx
je 0x460ca7
push dword [ebp + 8]
push esi
call fcn.00461f59
mov esi, eax
jmp 0x460ca9
xor esi, esi
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x460ccb
push 0
push 0
push 4
mov ecx, esi
call fcn.0056c236
test eax, eax
jne 0x460ccf
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 4]
xor eax, eax
jmp 0x460ce5
push 0
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x464091
Capabilities:
Get proxy
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push 0x6752e4
mov dword [edi], esi
call fcn.005680ba
lea eax, [ebp + 8]
mov dword [ebp + 8], esi
push eax
push 1
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x464172
cmp dword [ebp + 8], esi
je 0x464172
push ebx
push 4
pop eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
mov dword [ebp - 0xc], esi
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push esi
push str.ProxyEnable
push dword [ebp + 8]
call ebx
test eax, eax
jne 0x464111
cmp dword [ebp - 0xc], esi
setne al
mov dword [edi], eax
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x80a]
mov word [ebp - 0x80c], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 8]
mov dword [ebp - 4], 1
push eax
lea eax, [ebp - 0x80c]
push eax
lea eax, [ebp - 4]
push eax
push esi
push str.ProxyServer
mov dword [ebp - 8], 0x400
push dword [ebp + 8]
call ebx
test eax, eax
pop ebx
jne 0x464165
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x80c]
push eax
call fcn.005680ba
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x464175
or eax, 0xffffffff
pop edi
pop esi
leave
ret 8