joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4afaa0
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x628]
sub esp, 0x628
push 0xffffffffffffffff
push 0x5124b0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x5500a4]
xor eax, ebp
mov dword [ebp + 0x624], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 0x630]
lea ecx, [ebp - 0x24]
mov ebx, dword [ebp + 0x634]
call fcn.0040a890
mov dword [ebp - 4], 0
lea ecx, [ebp]
push 0x553158
mov dword [ebp], 0
call fcn.0040eb00
mov byte [ebp - 4], 1
mov ecx, 0x553134
call fcn.0040a730
test al, al
jne 0x4afb4e
mov ecx, 0x553134
call fcn.00402fb0
lea ecx, [ebp - 0x24]
cmp ecx, eax
je 0x4afc03
mov ecx, 0x553134
call fcn.00402fb0
mov ecx, eax
cmp dword [eax + 0x14], 8
jb 0x4afb45
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
jmp 0x4afbfb
push 0x20c
lea eax, [ebp + 0x418]
push 0
push eax
call fcn.004d9580
add esp, 0xc
lea eax, [ebp + 0x418]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x103
ja 0x4afc8d
xor eax, eax
push 0x412
push eax
mov word [ebp + 0x622], ax
lea eax, [ebp + 4]
push eax
call fcn.004d9580
add esp, 0xc
lea eax, [ebp + 4]
push 0x208
push eax
lea eax, [ebp + 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, 0x208
ja 0x4afbe4
test eax, eax
je 0x4afbe4
add eax, eax
cmp eax, 0x412
jae 0x4afcd1
xor ecx, ecx
mov word [ebp + eax + 4], cx
lea eax, [ebp + 4]
push eax
call fcn.0040acf0
add esp, 4
push eax
lea eax, [ebp + 4]
jmp 0x4afbfa
lea eax, [ebp + 0x418]
push eax
call fcn.0040acf0
add esp, 4
push eax
lea eax, [ebp + 0x418]
push eax
lea ecx, [ebp - 0x24]
call fcn.0040ab90
mov byte [ebp - 4], 0
lea ecx, [ebp]
call fcn.0040eb20
push ebx
push edi
lea eax, [ebp - 0x24]
mov ecx, esi
push eax
call fcn.004afa30
test al, al
je 0x4afc24
mov bl, 1
jmp 0x4afc9b
push 0x20c
lea eax, [ebp + 0x418]
push 0
push eax
call fcn.004d9580
add esp, 0xc
lea eax, [ebp + 0x418]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec eax
cmp eax, 0x103
ja 0x4afc99
xor eax, eax
mov word [ebp + 0x622], ax
lea eax, [ebp + 0x418]
push eax
call fcn.0040acf0
add esp, 4
lea ecx, [ebp - 0x24]
push eax
lea eax, [ebp + 0x418]
push eax
call fcn.0040ab90
push ebx
push edi
lea eax, [ebp - 0x24]
mov ecx, esi
push eax
call fcn.004afa30
mov bl, al
jmp 0x4afc9b
mov byte [ebp - 4], 0
lea ecx, [ebp]
call fcn.0040eb20
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.0040a7c0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x624]
xor ecx, ebp
call fcn.004d6ca5
lea esp, [ebp + 0x628]
pop ebp
ret 8
call fcn.004d735a
int3
Function at 0x4b1dc0
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5128e4
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5500a4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.0040a890
mov dword [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.0040a890
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.0040a890
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.0040a890
mov byte [ebp - 4], 3
lea ecx, [esi + 0x70]
mov word [esi + 0x60], 0x101
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
call fcn.0040a890
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4b4b40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x512d18
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x5500a4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
xorps xmm0, xmm0
movq qword [ebp - 0x30], xmm0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x30]
push eax
call fcn.004b40f0
test al, al
jne 0x4b4baf
xor bl, bl
jmp 0x4b4d13
lea ecx, [ebp - 0x5c]
call fcn.004b2380
mov byte [ebp - 4], 1
add esi, 0x24
mov eax, dword [esi]
cmp eax, dword [esi + 4]
je 0x4b4bec
push esi
lea ecx, [ebp - 0x5c]
call fcn.004b61f0
lea eax, [esi + 0xc]
push eax
lea ecx, [ebp - 0x50]
call fcn.004b61f0
lea eax, [esi + 0x18]
push eax
lea ecx, [ebp - 0x44]
call fcn.004b61f0
mov eax, dword [esi + 0x24]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x5c]
push eax
call fcn.004b3880
test al, al
jne 0x4b4c04
xor bl, bl
jmp 0x4b4d07
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
movq qword [ebp - 0x24], xmm0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov byte [ebp - 4], 2
lea edx, [ebp - 0x24]
lea ecx, [ebp - 0x5c]
call fcn.004b2f10
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x20]
je 0x4b4cf9
mov ecx, edi
call fcn.0041b9e0
test al, al
je 0x4b4cf9
mov ecx, dword [ebp - 0x20]
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 0x24]
sub ecx, eax
push edx
push ecx
push eax
mov ecx, edi
mov dword [ebp - 0x18], 0
call fcn.0041b820
test al, al
je 0x4b4cf9
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x24]
cmp dword [ebp - 0x18], eax
jne 0x4b4cf9
mov esi, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x30]
sub esi, ebx
mov eax, dword [edi]
mov dword [ebp - 0x34], esi
test eax, eax
je 0x4b4cf9
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x4b4cf9
push 0
lea ecx, [ebp - 0x18]
push ecx
push 4
lea ecx, [ebp - 0x34]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4b4cf9
cmp dword [ebp - 0x18], 4
jne 0x4b4cf9
cmp ebx, dword [ebp - 0x2c]
je 0x4b4cd1
lea eax, [ebp - 0x18]
mov ecx, edi
push eax
push esi
push ebx
call fcn.0041b820
test al, al
je 0x4b4cf9
cmp dword [ebp - 0x18], esi
jne 0x4b4cf9
lea eax, [ebp - 0x64]
xorps xmm0, xmm0
push eax
mov ecx, edi
movlpd qword [ebp - 0x64], xmm0
call fcn.0041b8a0
test al, al
je 0x4b4cf5
push dword [ebp - 0x60]
mov ecx, edi
push dword [ebp - 0x64]
call fcn.0041ba30
mov bl, 1
jmp 0x4b4cfb
xor bl, bl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
call fcn.0041a0f0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x5c]
call fcn.004b4fb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.0041a0f0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004d6ca5
mov esp, ebp
pop ebp
ret 4
Function at 0x4b4e60
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x512d98
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x5500a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ecx, eax
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
push 0x80
push dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
push dword [ebp + 0x14]
push esi
push edi
call fcn.0041b6f0
mov bl, al
test bl, bl
jne 0x4b4f8b
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, 0x50000000
je 0x4b4f3e
call eax
cmp eax, 5
jne 0x4b4f39
push 0x80
mov ecx, edi
call fcn.0040a750
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push eax
call ebx
test eax, eax
jne 0x4b4f1e
lea ecx, [ebp - 0x28]
call fcn.0040a890
mov dword [ebp - 4], 0
lea edx, [ebp - 0x28]
mov ecx, edi
call fcn.0041c200
test al, al
je 0x4b4f0f
push 0x80
lea ecx, [ebp - 0x28]
call fcn.0040a750
push eax
call ebx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040a7c0
mov ecx, dword [ebp - 0x2c]
push 0x80
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push esi
push edi
call fcn.0041b6f0
mov bl, al
test bl, bl
jne 0x4b4f8b
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
cmp eax, 0x21
je 0x4b4f4a
cmp eax, 0x20
jne 0x4b4f8b
xor esi, esi
nop dword [eax]
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x2c]
push 0x80
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edi
call fcn.0041b6f0
mov bl, al
test bl, bl
jne 0x4b4f8b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x21
je 0x4b4f85
cmp eax, 0x20
jne 0x4b4f8b
inc esi
cmp esi, 0x28
jb 0x4b4f50
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d6ca5
mov esp, ebp
pop ebp
ret 0x18
Function at 0x4b9010
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5135df
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5500a4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 4
lea ecx, [esi + 0x7c]
call fcn.0040a7c0
mov byte [ebp - 4], 3
lea ecx, [esi + 0x64]
call fcn.0040a7c0
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.0040a7c0
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.0040a7c0
mov byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.0040a7c0
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.0040a7c0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4b90a0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5135df
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5500a4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 4
lea ecx, [esi + 0x7c]
call fcn.0040a7c0
mov byte [ebp - 4], 3
lea ecx, [esi + 0x64]
call fcn.0040a7c0
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.0040a7c0
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.0040a7c0
mov byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.0040a7c0
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.0040a7c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4ba340
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5137af
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5500a4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push esi
call fcn.0040a810
mov dword [ebp - 4], 0
lea eax, [esi + 0x18]
push eax
lea ecx, [edi + 0x18]
call fcn.0040a810
mov byte [ebp - 4], 1
lea eax, [esi + 0x30]
push eax
lea ecx, [edi + 0x30]
call fcn.0040a810
mov byte [ebp - 4], 2
lea eax, [esi + 0x48]
push eax
lea ecx, [edi + 0x48]
call fcn.0040a810
mov byte [ebp - 4], 3
lea ecx, [edi + 0x64]
mov al, byte [esi + 0x60]
mov byte [edi + 0x60], al
lea eax, [esi + 0x64]
push eax
call fcn.0040a810
mov byte [ebp - 4], 4
lea eax, [esi + 0x7c]
push eax
lea ecx, [edi + 0x7c]
call fcn.0040a810
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4bb080
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5139b8
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x5500a4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
sub edx, ebx
mov eax, 0x2aaaaaab
imul edx
sar edx, 2
mov edi, edx
shr edi, 0x1f
add edi, edx
mov esi, edi
mov dword [ebp - 0x3c], edi
sar esi, 1
test esi, esi
jle 0x4bb221
lea eax, [ebp - 0x2c]
push eax
call fcn.0040bac0
mov dword [ebp - 0x44], eax
lea ecx, [esi + esi*2]
lea eax, [edi - 1]
add esp, 4
mov dword [ebp - 0x40], eax
sar eax, 1
mov dword [ebp - 0x34], eax
lea eax, [ebx + ecx*8]
nop
sub eax, 0x18
dec esi
push eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x4c], eax
call fcn.0040bac0
add esp, 4
lea ecx, [ebp - 0x2c]
push eax
call fcn.0040a810
mov dword [ebp - 4], 0
mov eax, esi
mov ecx, dword [ebp - 0x34]
mov edi, esi
mov dword [ebp - 0x30], eax
cmp esi, ecx
jge 0x4bb16a
add esi, esi
lea eax, [esi + 2]
lea eax, [eax + eax*2]
lea ecx, [ebx + eax*8]
lea edx, [ecx - 0x18]
call fcn.0040bd60
movzx eax, al
xor eax, 1
inc eax
add esi, eax
lea eax, [esi + esi*2]
lea eax, [ebx + eax*8]
push eax
call fcn.0040bac0
add esp, 4
push eax
lea eax, [edi + edi*2]
lea ecx, [ebx + eax*8]
call fcn.0040a7d0
mov edi, esi
cmp esi, dword [ebp - 0x34]
jl 0x4bb121
mov ecx, dword [ebp - 0x34]
mov eax, edi
mov dword [ebp - 0x30], esi
mov esi, dword [ebp - 0x38]
cmp eax, ecx
jne 0x4bb196
mov eax, dword [ebp - 0x3c]
test al, 1
jne 0x4bb196
lea eax, [eax + eax*2]
lea eax, [eax - 3]
lea eax, [ebx + eax*8]
push eax
call fcn.0040bac0
add esp, 4
push eax
lea eax, [edi + edi*2]
lea ecx, [ebx + eax*8]
call fcn.0040a7d0
mov edi, dword [ebp - 0x40]
push dword [ebp - 0x44]
call fcn.0040bac0
add esp, 4
mov ecx, eax
mov dword [ebp - 0x30], ecx
cmp esi, edi
jge 0x4bb1f2
nop word [eax + eax]
lea esi, [edi - 1]
mov edx, ecx
sar esi, 1
lea eax, [esi + esi*2]
lea eax, [ebx + eax*8]
mov ecx, eax
mov dword [ebp - 0x48], eax
call fcn.0040bd60
test al, al
je 0x4bb1ec
push dword [ebp - 0x48]
call fcn.0040bac0
add esp, 4
push eax
lea eax, [edi + edi*2]
lea ecx, [ebx + eax*8]
call fcn.0040a7d0
mov edi, esi
mov ecx, dword [ebp - 0x30]
cmp dword [ebp - 0x38], esi
jl 0x4bb1b0
mov esi, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.0040bac0
add esp, 4
push eax
lea eax, [edi + edi*2]
lea ecx, [ebx + eax*8]
call fcn.0040a7d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0040a7c0
mov eax, dword [ebp - 0x4c]
test esi, esi
jg 0x4bb0f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004d6ca5
mov esp, ebp
pop ebp
ret
Function at 0x4bbaf0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
push ebx
push ebp
mov ebx, ecx
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x14], ecx
lea ecx, [eax - 1]
push esi
mov ebp, ecx
mov dword [esp + 0x14], ecx
push edi
mov edi, edx
sar ebp, 1
mov dword [esp + 0x14], edi
mov esi, edi
cmp edi, ebp
jge 0x4bbb61
add esi, esi
lea eax, [esi + 2]
lea eax, [eax + eax*2]
lea ecx, [ebx + eax*8]
lea edx, [ecx - 0x18]
call fcn.0040bd60
movzx eax, al
xor eax, 1
inc eax
add esi, eax
lea eax, [esi + esi*2]
lea eax, [ebx + eax*8]
push eax
call fcn.0040bac0
add esp, 4
push eax
lea eax, [edi + edi*2]
lea ecx, [ebx + eax*8]
call fcn.0040a7d0
mov edi, esi
cmp esi, ebp
jl 0x4bbb20
mov eax, dword [esp + 0x10]
cmp esi, ebp
jne 0x4bbb8b
test al, 1
jne 0x4bbb8b
lea eax, [eax + eax*2]
lea eax, [eax - 3]
lea eax, [ebx + eax*8]
push eax
call fcn.0040bac0
add esp, 4
push eax
lea eax, [edi + edi*2]
lea ecx, [ebx + eax*8]
call fcn.0040a7d0
mov edi, dword [esp + 0x18]
push dword [esp + 0x1c]
call fcn.0040bac0
add esp, 4
mov ecx, eax
mov dword [esp + 0x10], ecx
cmp dword [esp + 0x14], edi
jge 0x4bbbe0
lea esi, [edi - 1]
mov edx, ecx
sar esi, 1
lea eax, [esi + esi*2]
lea ebp, [ebx + eax*8]
mov ecx, ebp
call fcn.0040bd60
test al, al
je 0x4bbbdc
push ebp
call fcn.0040bac0
add esp, 4
push eax
lea eax, [edi + edi*2]
lea ecx, [ebx + eax*8]
call fcn.0040a7d0
mov edi, esi
mov ecx, dword [esp + 0x10]
cmp dword [esp + 0x14], esi
jl 0x4bbba3
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0040bac0
add esp, 4
push eax
lea eax, [edi + edi*2]
lea ecx, [ebx + eax*8]
call fcn.0040a7d0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x4bbc00
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x513a4f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5500a4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push esi
call fcn.0040a8b0
mov dword [ebp - 4], 0
lea eax, [esi + 0x18]
push eax
lea ecx, [edi + 0x18]
call fcn.0040a8b0
mov byte [ebp - 4], 1
lea eax, [esi + 0x30]
push eax
lea ecx, [edi + 0x30]
call fcn.0040a8b0
mov byte [ebp - 4], 2
lea eax, [esi + 0x48]
push eax
lea ecx, [edi + 0x48]
call fcn.0040a8b0
mov byte [ebp - 4], 3
lea ecx, [edi + 0x64]
mov al, byte [esi + 0x60]
mov byte [edi + 0x60], al
lea eax, [esi + 0x64]
push eax
call fcn.0040a8b0
mov byte [ebp - 4], 4
lea eax, [esi + 0x7c]
push eax
lea ecx, [edi + 0x7c]
call fcn.0040a8b0
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4bcdf0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x513d2f
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5500a4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.0040a890
mov dword [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.0040a890
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.0040a890
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.0040a890
mov byte [ebp - 4], 3
lea ecx, [esi + 0x64]
call fcn.0040a890
mov byte [ebp - 4], 4
lea ecx, [esi + 0x7c]
call fcn.0040a890
mov byte [ebp - 4], 5
mov byte [esi + 0x60], 0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4bcf60
Capabilities:
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x414]
sub esp, 0x414
push 0xfffffffffffffffe
push 0x54a5a8
push 0x4d8e00
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x5500a4]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x410], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.0040ff60
mov edx, esi
mov ecx, edi
call fcn.004bd080
mov bl, al
mov byte [ebp - 0x19], bl
mov dword [ebp - 4], 0xfffffffe
jmp 0x4bcfee
test bl, bl
jne 0x4bd051
cmp edi, 0x1a
jne 0x4bd051
mov ecx, esi
call fcn.0040ff60
push 0x410
push 0
lea eax, [ebp]
push eax
call fcn.004d9580
add esp, 0xc
push 0x207
lea eax, [ebp]
push eax
push str.APPDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [ebp]
push eax
call fcn.0040acf0
add esp, 4
push eax
lea eax, [ebp]
push eax
mov ecx, esi
call fcn.0040ab90
mov ecx, esi
call fcn.0040a730
movzx ebx, bl
mov ecx, 1
test al, al
cmove ebx, ecx
mov al, bl
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x410]
xor ecx, ebp
call fcn.004d6ca5
lea esp, [ebp + 0x414]
pop ebp
ret

Function at 0x4bd200
Capabilities:
Query environment variable

Disassembly:
mov edx, dword [esp + 4]
mov ecx, 0x1a
jmp fcn.004bcf60
Function at 0x4be3b0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x5500a4]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
push ebx
push ebp
mov ebp, ecx
mov dword [esp + 8], eax
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
push edi
cmp dword [ebp + 0x10], 0xffffffff
mov edi, dword [esp + 0x20]
je 0x4be432
mov ecx, 0x100000
nop dword [eax]
nop word [eax + eax]
cmp esi, 0x100000
mov dword [esp + 0x14], 0
push 0
mov eax, esi
cmova eax, ecx
lea ecx, [esp + 0x18]
push ecx
push eax
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x14]
add ebx, ecx
test eax, eax
je 0x4be432
test ecx, ecx
je 0x4be42e
add edi, ecx
sub esi, ecx
mov ecx, 0x100000
jne 0x4be3f0
xor eax, eax
jmp 0x4be437
mov eax, 1
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x4be441
mov dword [ecx], ebx
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004d6ca5
add esp, 0xc
ret 0xc
Function at 0x4c1660
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x514a41
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5500a4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.DL::RCSimpleDownloadHandler.0
mov dword [edi + 4], vtable.DL::RCSimpleDownloadHandler.1.0
mov dword [ebp - 4], 7
mov dword [edi + 0x98], 0
mov byte [ebp - 4], 6
or ebx, 0xffffffff
mov esi, dword [edi + 0xf8]
test esi, esi
je 0x4c16db
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x4c16db
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov eax, ebx
lock xadd dword [esi + 8], eax
jne 0x4c16db
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov byte [ebp - 4], 5
mov ecx, dword [edi + 0xec]
test ecx, ecx
je 0x4c16f6
lock xadd dword [ecx + 8], ebx
dec ebx
jne 0x4c16f6
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 4
mov eax, dword [edi + 0xe4]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
test eax, eax
je 0x4c1727
push eax
call ebx
push 0x18
push dword [edi + 0xe4]
call fcn.004d6f80
add esp, 8
mov dword [edi + 0xe4], 0
mov byte [ebp - 4], 3
lea esi, [edi + 0xc0]
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 8
mov eax, dword [esi]
test eax, eax
je 0x4c174b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
mov byte [ebp - 4], 3
lea ecx, [esi + 8]
call fcn.0040a7c0
mov byte [ebp - 4], 2
mov eax, dword [edi + 0xac]
test eax, eax
je 0x4c1782
push eax
call ebx
push 0x18
push dword [edi + 0xac]
call fcn.004d6f80
add esp, 8
mov dword [edi + 0xac], 0
mov byte [ebp - 4], 1
mov ecx, dword [edi + 0xa0]
test ecx, ecx
je 0x4c17fd
mov edx, dword [edi + 0xa4]
push ecx
call fcn.00425bd0
mov eax, dword [edi + 0xa8]
add esp, 4
mov ecx, dword [edi + 0xa0]
sub eax, ecx
sar eax, 3
lea edx, [eax*8]
cmp edx, 0x1000
jb 0x4c17d5
mov esi, dword [ecx - 4]
add edx, 0x23
sub ecx, esi
lea eax, [ecx - 4]
cmp eax, 0x1f
ja 0x4c187c
mov ecx, esi
push edx
push ecx
call fcn.004d6f80
add esp, 8
mov dword [edi + 0xa0], 0
mov dword [edi + 0xa4], 0
mov dword [edi + 0xa8], 0
mov byte [ebp - 4], 0
lea esi, [edi + 0x10]
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 0xc
lea ecx, [esi + 0x70]
call fcn.0040a7c0
mov byte [ebp - 4], 0xb
lea ecx, [esi + 0x48]
call fcn.0040a7c0
mov byte [ebp - 4], 0xa
lea ecx, [esi + 0x30]
call fcn.0040a7c0
mov byte [ebp - 4], 9
lea ecx, [esi + 0x18]
call fcn.0040a7c0
mov byte [ebp - 4], 0
mov ecx, esi
call fcn.0040a7c0
mov dword [ebp - 4], 0xe
mov dword [edi + 4], vtable.RC::RCRefCounted.0
mov dword [ebp - 4], 0xffffffff
mov dword [edi], vtable.DL::ISimpleDownloadHandler.0
mov dword [ebp - 4], 0xffffffff
mov dword [edi], vtable.RC::IRefCount.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004dc8f9
int3