joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10b5a058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.10b5a1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x10b5a07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10b5a06a
add dl, dl
jne 0x10b5a089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10b5a0dc
xor eax, eax
add dl, dl
jne 0x10b5a096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10b5a17d
add dl, dl
jne 0x10b5a0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10b5a0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10b5a0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10b5a0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x10b5a0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10b5a075
mov eax, 1
add dl, dl
jne 0x10b5a0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10b5a0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10b5a0e1
sub eax, ebx
mov ebx, 1
jne 0x10b5a128
mov ecx, 1
add dl, dl
jne 0x10b5a10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10b5a119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10b5a105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10b5a075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x10b5a13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10b5a14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10b5a136
cmp eax, 0x7d00
jae 0x10b5a16d
cmp eax, 0x500
jb 0x10b5a168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10b5a075
cmp eax, 0x7f
ja 0x10b5a170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10b5a075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x10b5a19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10b5a075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4100e5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x428044]
jne 0x4100ef
repz ret
jmp fcn.00411dd9

Function at 0x41ada1
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041213b
and dword [ebp - 4], 0
cmp dword [0x429f30], 0
mov ebx, eax
jne 0x41ae52
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41af03
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x41af03
push eax
call fcn.004120c9
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x429f30], eax
call esi
push eax
call fcn.004120c9
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x429f34], eax
call esi
push eax
call fcn.004120c9
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x429f38], eax
call esi
push eax
call fcn.004120c9
pop ecx
mov dword [0x429f40], eax
test eax, eax
je 0x41ae52
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004120c9
pop ecx
mov dword [0x429f3c], eax
mov eax, dword [0x429f3c]
cmp eax, ebx
je 0x41aeaa
cmp dword [0x429f40], ebx
je 0x41aeaa
push eax
call fcn.00412144
push dword [0x429f40]
mov esi, eax
call fcn.00412144
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41aeaa
test edi, edi
je 0x41aeaa
call esi
test eax, eax
je 0x41aea1
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41aea1
test byte [ebp - 0xc], 1
jne 0x41aeaa
or dword [ebp + 0x10], 0x200000
jmp 0x41aee3
mov eax, dword [0x429f34]
cmp eax, ebx
je 0x41aee3
push eax
call fcn.00412144
pop ecx
test eax, eax
je 0x41aee3
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41aee3
mov eax, dword [0x429f38]
cmp eax, ebx
je 0x41aee3
push eax
call fcn.00412144
pop ecx
test eax, eax
je 0x41aee3
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x429f30]
call fcn.00412144
pop ecx
test eax, eax
je 0x41af03
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41af05
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..00cfg
mov ebx, 0x408ecc
nop
mov ecx, 0x3dc53d0b
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x6a545d56
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43201e
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x41dda0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
add esp, 4
call fcn.0041ddac
or byte [eax], al
add byte [eax], al
add byte [eax + 0x49], al
inc ebp
cmp al, 0x3d
cmp al, 0x40
add esp, 4
pop ebx
push edi
add edi, 0x127d4
sub edi, 0x17ee6
and edi, 0x5dd8
pop edi
push edx
add edx, 0x1b7c
pop edx
lea eax, [ebp - 0x1774]
mov dword [ebp - 0xca0], eax
mov ecx, dword [ebp - 0x508]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc9c], edx
xor eax, eax
mov word [ebp - 0x214], ax
xor ecx, ecx
mov word [ebp - 0x110], cx
push edx
sub edx, 0x12c8c
xor edx, 0x1603d
pop edx
push ebx
push esi
add esp, 4
add ebx, 0x150eb
pop ebx
push edx
push ebx
add esp, 4
add edx, 0xd981
add edx, 0x16a33
xor edx, 0x102d5
pop edx
mov edx, dword [ebp - 0xc9c]
mov ax, word [edx]
mov word [ebp - 0x1036], ax
mov ecx, dword [ebp - 0xc9c]
add ecx, 2
mov dword [ebp - 0xc9c], ecx
mov dx, word [ebp - 0x1036]
mov word [ebp - 0x214], dx
mov eax, dword [ebp - 0xca0]
mov cx, word [eax]
mov word [ebp - 0x1038], cx
mov edx, dword [ebp - 0xca0]
add edx, 2
mov dword [ebp - 0xca0], edx
mov ax, word [ebp - 0x1038]
mov word [ebp - 0x110], ax
push eax
add eax, 0x8646
pop eax
push eax
push ecx
add esp, 4
jmp 0x41de9a
add eax, 0x15b73
add eax, 0x1544c
call 0x41deb3
add byte [ebp + 0x3b], cl
xor eax, 0x4a453e42
add esp, 4
pop eax
movzx ecx, word [ebp - 0x110]
test ecx, ecx
jne 0x41deda
movzx edx, word [ebp - 0x214]
movzx eax, word [ebp - 0x110]
sub edx, eax
mov dword [ebp - 0x15ec], edx
jmp 0x41df3d
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
cmp ecx, edx
je 0x41ddf9
movzx eax, word [ebp - 0x214]
xor eax, 0x20
movzx ecx, word [ebp - 0x110]
cmp eax, ecx
je 0x41ddf9
movzx edx, word [ebp - 0x214]
movzx eax, word [ebp - 0x110]
cmp edx, eax
jge 0x41df27
mov dword [ebp - 0x15e8], 0xffffffff
jmp 0x41df31
mov dword [ebp - 0x15e8], 1
mov ecx, dword [ebp - 0x15e8]
mov dword [ebp - 0x15ec], ecx
cmp dword [ebp - 0x15ec], 0
jne 0x41df86
push eax
push edx
add esp, 4
and eax, 0xf993
jmp 0x41df56
and eax, 0xb82f
pop eax
push edx
add edx, 0xf17f
jmp 0x41df6b
add edx, 0x4814
xor edx, 0x109ce
pop edx
mov edx, dword [ebp - 0x508]
mov dword [ebp - 0x750], edx
jmp 0x41dfee
push ebx
push ebx
add esp, 4
call 0x41df9a
add byte [edi], dh
aaa
xor dl, byte [eax + 0x34]
cmp al, 0x41
inc eax
add esp, 4
add ebx, 0xf983
or ebx, 0x16643
add ebx, 0xcb74
pop ebx
push ecx
sub ecx, 0xbf91
pop ecx
mov eax, dword [ebp - 0x508]
mov ecx, dword [eax]
mov dword [ebp - 0x508], ecx
mov edx, dword [ebp - 0x508]
cmp edx, dword [ebp - 0xca4]
je 0x41dfe4
mov eax, dword [ebp - 0x508]
cmp dword [eax + 0x30], 0
jne 0x41dd9a
mov dword [ebp - 0x750], 0
Function at 0x41ddac
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
add esp, 4
call fcn.0041ddac
or byte [eax], al
add byte [eax], al
add byte [eax + 0x49], al
inc ebp
cmp al, 0x3d
cmp al, 0x40
add esp, 4
pop ebx
push edi
add edi, 0x127d4
sub edi, 0x17ee6
and edi, 0x5dd8
pop edi
push edx
add edx, 0x1b7c
pop edx
lea eax, [ebp - 0x1774]
mov dword [ebp - 0xca0], eax
mov ecx, dword [ebp - 0x508]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc9c], edx
xor eax, eax
mov word [ebp - 0x214], ax
xor ecx, ecx
mov word [ebp - 0x110], cx
push edx
sub edx, 0x12c8c
xor edx, 0x1603d
pop edx
push ebx
push esi
add esp, 4
add ebx, 0x150eb
pop ebx
push edx
push ebx
add esp, 4
add edx, 0xd981
add edx, 0x16a33
xor edx, 0x102d5
pop edx
mov edx, dword [ebp - 0xc9c]
mov ax, word [edx]
mov word [ebp - 0x1036], ax
mov ecx, dword [ebp - 0xc9c]
add ecx, 2
mov dword [ebp - 0xc9c], ecx
mov dx, word [ebp - 0x1036]
mov word [ebp - 0x214], dx
mov eax, dword [ebp - 0xca0]
mov cx, word [eax]
mov word [ebp - 0x1038], cx
mov edx, dword [ebp - 0xca0]
add edx, 2
mov dword [ebp - 0xca0], edx
mov ax, word [ebp - 0x1038]
mov word [ebp - 0x110], ax
push eax
add eax, 0x8646
pop eax
push eax
push ecx
add esp, 4
jmp 0x41de9a
add eax, 0x15b73
add eax, 0x1544c
call 0x41deb3
add byte [ebp + 0x3b], cl
xor eax, 0x4a453e42
add esp, 4
pop eax
movzx ecx, word [ebp - 0x110]
test ecx, ecx
jne 0x41deda
movzx edx, word [ebp - 0x214]
movzx eax, word [ebp - 0x110]
sub edx, eax
mov dword [ebp - 0x15ec], edx
jmp 0x41df3d
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
cmp ecx, edx
je 0x41ddf9
movzx eax, word [ebp - 0x214]
xor eax, 0x20
movzx ecx, word [ebp - 0x110]
cmp eax, ecx
je 0x41ddf9
movzx edx, word [ebp - 0x214]
movzx eax, word [ebp - 0x110]
cmp edx, eax
jge 0x41df27
mov dword [ebp - 0x15e8], 0xffffffff
jmp 0x41df31
mov dword [ebp - 0x15e8], 1
mov ecx, dword [ebp - 0x15e8]
mov dword [ebp - 0x15ec], ecx
cmp dword [ebp - 0x15ec], 0
jne 0x41df86
push eax
push edx
add esp, 4
and eax, 0xf993
jmp 0x41df56
and eax, 0xb82f
pop eax
push edx
add edx, 0xf17f
jmp 0x41df6b
add edx, 0x4814
xor edx, 0x109ce
pop edx
mov edx, dword [ebp - 0x508]
mov dword [ebp - 0x750], edx
jmp 0x41dfee
push ebx
push ebx
add esp, 4
call 0x41df9a
add byte [edi], dh
aaa
xor dl, byte [eax + 0x34]
cmp al, 0x41
inc eax
add esp, 4
add ebx, 0xf983
or ebx, 0x16643
add ebx, 0xcb74
pop ebx
push ecx
sub ecx, 0xbf91
pop ecx
mov eax, dword [ebp - 0x508]
mov ecx, dword [eax]
mov dword [ebp - 0x508], ecx
mov edx, dword [ebp - 0x508]
cmp edx, dword [ebp - 0xca4]
je 0x41dfe4
mov eax, dword [ebp - 0x508]
cmp dword [eax + 0x30], 0
jne 0x41dd9a
mov dword [ebp - 0x750], 0
Function at 0x41deb3
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
add esp, 4
call fcn.0041ddac
or byte [eax], al
add byte [eax], al
add byte [eax + 0x49], al
inc ebp
cmp al, 0x3d
cmp al, 0x40
add esp, 4
pop ebx
push edi
add edi, 0x127d4
sub edi, 0x17ee6
and edi, 0x5dd8
pop edi
push edx
add edx, 0x1b7c
pop edx
lea eax, [ebp - 0x1774]
mov dword [ebp - 0xca0], eax
mov ecx, dword [ebp - 0x508]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc9c], edx
xor eax, eax
mov word [ebp - 0x214], ax
xor ecx, ecx
mov word [ebp - 0x110], cx
push edx
sub edx, 0x12c8c
xor edx, 0x1603d
pop edx
push ebx
push esi
add esp, 4
add ebx, 0x150eb
pop ebx
push edx
push ebx
add esp, 4
add edx, 0xd981
add edx, 0x16a33
xor edx, 0x102d5
pop edx
mov edx, dword [ebp - 0xc9c]
mov ax, word [edx]
mov word [ebp - 0x1036], ax
mov ecx, dword [ebp - 0xc9c]
add ecx, 2
mov dword [ebp - 0xc9c], ecx
mov dx, word [ebp - 0x1036]
mov word [ebp - 0x214], dx
mov eax, dword [ebp - 0xca0]
mov cx, word [eax]
mov word [ebp - 0x1038], cx
mov edx, dword [ebp - 0xca0]
add edx, 2
mov dword [ebp - 0xca0], edx
mov ax, word [ebp - 0x1038]
mov word [ebp - 0x110], ax
push eax
add eax, 0x8646
pop eax
push eax
push ecx
add esp, 4
jmp 0x41de9a
add eax, 0x15b73
add eax, 0x1544c
call 0x41deb3
add byte [ebp + 0x3b], cl
xor eax, 0x4a453e42
add esp, 4
pop eax
movzx ecx, word [ebp - 0x110]
test ecx, ecx
jne 0x41deda
movzx edx, word [ebp - 0x214]
movzx eax, word [ebp - 0x110]
sub edx, eax
mov dword [ebp - 0x15ec], edx
jmp 0x41df3d
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
cmp ecx, edx
je 0x41ddf9
movzx eax, word [ebp - 0x214]
xor eax, 0x20
movzx ecx, word [ebp - 0x110]
cmp eax, ecx
je 0x41ddf9
movzx edx, word [ebp - 0x214]
movzx eax, word [ebp - 0x110]
cmp edx, eax
jge 0x41df27
mov dword [ebp - 0x15e8], 0xffffffff
jmp 0x41df31
mov dword [ebp - 0x15e8], 1
mov ecx, dword [ebp - 0x15e8]
mov dword [ebp - 0x15ec], ecx
cmp dword [ebp - 0x15ec], 0
jne 0x41df86
push eax
push edx
add esp, 4
and eax, 0xf993
jmp 0x41df56
and eax, 0xb82f
pop eax
push edx
add edx, 0xf17f
jmp 0x41df6b
add edx, 0x4814
xor edx, 0x109ce
pop edx
mov edx, dword [ebp - 0x508]
mov dword [ebp - 0x750], edx
jmp 0x41dfee
push ebx
push ebx
add esp, 4
call 0x41df9a
add byte [edi], dh
aaa
xor dl, byte [eax + 0x34]
cmp al, 0x41
inc eax
add esp, 4
add ebx, 0xf983
or ebx, 0x16643
add ebx, 0xcb74
pop ebx
push ecx
sub ecx, 0xbf91
pop ecx
mov eax, dword [ebp - 0x508]
mov ecx, dword [eax]
mov dword [ebp - 0x508], ecx
mov edx, dword [ebp - 0x508]
cmp edx, dword [ebp - 0xca4]
je 0x41dfe4
mov eax, dword [ebp - 0x508]
cmp dword [eax + 0x30], 0
jne 0x41dd9a
mov dword [ebp - 0x750], 0
Function at 0x41df9a
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
add esp, 4
call fcn.0041ddac
or byte [eax], al
add byte [eax], al
add byte [eax + 0x49], al
inc ebp
cmp al, 0x3d
cmp al, 0x40
add esp, 4
pop ebx
push edi
add edi, 0x127d4
sub edi, 0x17ee6
and edi, 0x5dd8
pop edi
push edx
add edx, 0x1b7c
pop edx
lea eax, [ebp - 0x1774]
mov dword [ebp - 0xca0], eax
mov ecx, dword [ebp - 0x508]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc9c], edx
xor eax, eax
mov word [ebp - 0x214], ax
xor ecx, ecx
mov word [ebp - 0x110], cx
push edx
sub edx, 0x12c8c
xor edx, 0x1603d
pop edx
push ebx
push esi
add esp, 4
add ebx, 0x150eb
pop ebx
push edx
push ebx
add esp, 4
add edx, 0xd981
add edx, 0x16a33
xor edx, 0x102d5
pop edx
mov edx, dword [ebp - 0xc9c]
mov ax, word [edx]
mov word [ebp - 0x1036], ax
mov ecx, dword [ebp - 0xc9c]
add ecx, 2
mov dword [ebp - 0xc9c], ecx
mov dx, word [ebp - 0x1036]
mov word [ebp - 0x214], dx
mov eax, dword [ebp - 0xca0]
mov cx, word [eax]
mov word [ebp - 0x1038], cx
mov edx, dword [ebp - 0xca0]
add edx, 2
mov dword [ebp - 0xca0], edx
mov ax, word [ebp - 0x1038]
mov word [ebp - 0x110], ax
push eax
add eax, 0x8646
pop eax
push eax
push ecx
add esp, 4
jmp 0x41de9a
add eax, 0x15b73
add eax, 0x1544c
call 0x41deb3
add byte [ebp + 0x3b], cl
xor eax, 0x4a453e42
add esp, 4
pop eax
movzx ecx, word [ebp - 0x110]
test ecx, ecx
jne 0x41deda
movzx edx, word [ebp - 0x214]
movzx eax, word [ebp - 0x110]
sub edx, eax
mov dword [ebp - 0x15ec], edx
jmp 0x41df3d
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
cmp ecx, edx
je 0x41ddf9
movzx eax, word [ebp - 0x214]
xor eax, 0x20
movzx ecx, word [ebp - 0x110]
cmp eax, ecx
je 0x41ddf9
movzx edx, word [ebp - 0x214]
movzx eax, word [ebp - 0x110]
cmp edx, eax
jge 0x41df27
mov dword [ebp - 0x15e8], 0xffffffff
jmp 0x41df31
mov dword [ebp - 0x15e8], 1
mov ecx, dword [ebp - 0x15e8]
mov dword [ebp - 0x15ec], ecx
cmp dword [ebp - 0x15ec], 0
jne 0x41df86
push eax
push edx
add esp, 4
and eax, 0xf993
jmp 0x41df56
and eax, 0xb82f
pop eax
push edx
add edx, 0xf17f
jmp 0x41df6b
add edx, 0x4814
xor edx, 0x109ce
pop edx
mov edx, dword [ebp - 0x508]
mov dword [ebp - 0x750], edx
jmp 0x41dfee
push ebx
push ebx
add esp, 4
call 0x41df9a
add byte [edi], dh
aaa
xor dl, byte [eax + 0x34]
cmp al, 0x41
inc eax
add esp, 4
add ebx, 0xf983
or ebx, 0x16643
add ebx, 0xcb74
pop ebx
push ecx
sub ecx, 0xbf91
pop ecx
mov eax, dword [ebp - 0x508]
mov ecx, dword [eax]
mov dword [ebp - 0x508], ecx
mov edx, dword [ebp - 0x508]
cmp edx, dword [ebp - 0xca4]
je 0x41dfe4
mov eax, dword [ebp - 0x508]
cmp dword [eax + 0x30], 0
jne 0x41dd9a
mov dword [ebp - 0x750], 0
Function at 0x41eee3
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
add esp, 4
or ebx, 0x2488
add byte [eax], al
pop ebx
push ebx
call fcn.0041eee3
add byte [ebx + 0x32], al
dec ebp
xor esi, dword [esi + eax*2]
push eax
xor eax, dword [ebx - 0x7d]
add esp, 4
invalid
jecxz 0x41eed0
add esp, 4
and ebx, 0x78e7
sub ebx, 0x617e
xor ebx, 0x1280c
pop ebx
mov edx, dword [ebp - 0xcbc]
mov ax, word [edx]
mov word [ebp - 0x103e], ax
mov ecx, dword [ebp - 0xcbc]
add ecx, 2
mov dword [ebp - 0xcbc], ecx
mov dx, word [ebp - 0x103e]
mov word [ebp - 0x21c], dx
mov eax, dword [ebp - 0xcc0]
mov cx, word [eax]
mov word [ebp - 0x1040], cx
mov edx, dword [ebp - 0xcc0]
add edx, 2
mov dword [ebp - 0xcc0], edx
mov ax, word [ebp - 0x1040]
mov word [ebp - 0x38], ax
push esi
push eax
add esp, 4
and esi, 0xeb2e
pop esi
push ebx
and ebx, 0x16b72
sub ebx, 0x100da
or ebx, 0xf0e8
pop ebx
push edx
push edi
add esp, 4
or edx, 0xbe41
and edx, 0x7451
pop edx
movzx ecx, word [ebp - 0x38]
test ecx, ecx
jne 0x41ef9f
js 0x41eeeb
add byte [ecx + 0x617eeb], al
add byte [ecx + 0x1280cf3], al
add byte [ebx - 0x75], bl
xchg ebp, eax
inc esp
invalid
movzx edx, word [ebp - 0x21c]
movzx eax, word [ebp - 0x38]
sub edx, eax
mov dword [ebp - 0x161c], edx
jmp 0x41eff9
movzx ecx, word [ebp - 0x21c]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
je 0x41eec7
movzx eax, word [ebp - 0x21c]
xor eax, 0x20
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x41eec7
movzx edx, word [ebp - 0x21c]
movzx eax, word [ebp - 0x38]
cmp edx, eax
jge 0x41efe3
mov dword [ebp - 0x1618], 0xffffffff
jmp 0x41efed
mov dword [ebp - 0x1618], 1
mov ecx, dword [ebp - 0x1618]
mov dword [ebp - 0x161c], ecx
cmp dword [ebp - 0x161c], 0
jne 0x41f042
push eax
push edx
add esp, 4
xor eax, 0x125fe
jmp 0x41f013
xor eax, 0x9a3e
jmp 0x41f01f
pop eax
push ebx
push edx
add esp, 4
add ebx, 0x303a
pop ebx
push edi
xor edi, 0x106db
pop edi
mov edx, dword [ebp - 0x514]
mov dword [ebp - 0x2fc], edx
jmp 0x41f0aa
push edx
jmp 0x41f04b
pop edx
push edi
push edi
add esp, 4
jmp 0x41f059
pop edi
push esi
add esi, 0x125f2
add esi, 0xfd1c
pop esi
push ecx
push ecx
add esp, 4
xor ecx, 0xa8bd
pop ecx
mov eax, dword [ebp - 0x514]
mov ecx, dword [eax]
mov dword [ebp - 0x514], ecx
mov edx, dword [ebp - 0x514]
cmp edx, dword [ebp - 0xcc4]
je 0x41f0a0
mov eax, dword [ebp - 0x514]
cmp dword [eax + 0x30], 0
jne 0x41ee6b
mov dword [ebp - 0x2fc], 0
Function at 0x438e20
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3a8
mov eax, dword [0x594ccc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
xor ecx, ecx
push 0x18e
push ecx
lea edx, [ebp - 0x3a2]
push edx
mov dword [ebp - 0x3a8], eax
mov word [ebp - 0x3a4], cx
call fcn.0051d250
add esp, 0xc
lea eax, [ebp - 0x3a4]
push eax
push 0xc7
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
jne 0x438e83
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051d23b
mov esp, ebp
pop ebp
ret
push edi
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x212]
push edx
mov word [ebp - 0x214], cx
call fcn.0051d250
mov eax, dword [0x561044]
mov cx, word [0x561048]
add esp, 0xc
mov dword [ebp - 0xc], eax
mov word [ebp - 8], cx
lea edi, [ebp - 0x3a4]
push esi
lea esp, [esp]
mov dx, word [edi]
push 0x104
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0xc]
push ecx
mov word [ebp - 0xc], dx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x438f30
lea eax, [ebp - 0x214]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x438ef0
sub eax, edx
sar eax, 1
mov esi, eax
mov edx, 0x5c
mov word [ebp + esi*2 - 0x214], dx
inc esi
push esi
lea ecx, [ebp - 0x214]
push ecx
xor eax, eax
push ebx
mov word [ebp + esi*2 - 0x214], ax
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
je 0x438f53
lea esp, [esp]
mov dx, word [edi]
add edi, 2
test dx, dx
jne 0x438f30
cmp word [edi], dx
jne 0x438ec0
pop esi
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051d23b
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0x10]
lea eax, [ebx + esi*2]
push eax
mov eax, dword [ebp - 0x3a8]
lea ecx, [ebp - 0xc]
push ecx
push 0x561038
push edx
push eax
call fcn.00436ed0
mov ecx, dword [ebp - 4]
add esp, 0x14
pop esi
pop edi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0051d23b
mov esp, ebp
pop ebp
ret
Function at 0x45a640
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x594ccc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
mov dword [ebp - 0x210], 1
call fcn.0051d250
add esp, 0xc
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x20c]
push edx
lea eax, [ebp - 0x210]
push eax
push str.UninstallString
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallKingsoft_Office
push SysReAllocString
mov dword [ebp - 0x214], 0x208
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], 0
test eax, eax
jne 0x45a6e9
xor ecx, ecx
lea eax, [ebp - 0x20c]
mov word [esi + 4], cx
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x45a6d0
sub eax, edx
sar eax, 1
push eax
lea edx, [ebp - 0x20c]
push edx
jmp 0x45a6f5
xor eax, eax
push eax
mov word [esi + 4], ax
push 0x576bd0
mov ecx, esi
call fcn.0044fc50
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0051d23b
mov esp, ebp
pop ebp
ret