joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002980
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x10027008]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
xorps xmm0, xmm0
push edi
push 0
mov edi, ecx
mov dword [ebp - 0x54], 0
push 0
push 0x130b
movdqu xmmword [ebp - 0x50], xmm0
push dword [edi + 0x40]
movq qword [ebp - 0x40], xmm0
call esi
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x54], 8
push ecx
push eax
push 0x1305
push dword [edi + 0x40]
call esi
lea eax, [ebp - 0x38]
push eax
push 0
push 0x130a
push dword [edi + 0x40]
call esi
lea eax, [ebp - 0x28]
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [ebp - 0x18]
push eax
push dword [edi + 0x40]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x2c]
sub eax, ecx
sub eax, dword [ebp - 0x14]
add ecx, 2
sub eax, 4
push 0
push eax
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
sub eax, 4
push eax
mov eax, dword [ebp - 0x24]
add eax, ecx
push eax
mov eax, dword [ebp - 0x28]
inc eax
push eax
push dword [ebp - 0x3c]
call dword [sym.imp.USER32.dll_MoveWindow]
push 5
push dword [ebp - 0x3c]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebp - 0x3c]
call dword [sym.imp.USER32.dll_UpdateWindow]
push dword [ebp - 0x3c]
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [ebp - 8]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.1000d362
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10002a60
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
push 0
mov edi, ecx
mov dword [ebp - 0x1c], 0
push 0
push 0x130b
xorps xmm0, xmm0
push dword [edi + 0x40]
movdqu xmmword [ebp - 0x18], xmm0
movq qword [ebp - 8], xmm0
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 8
push ecx
push eax
push 0x1305
push dword [edi + 0x40]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10005340
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
test ebx, ebx
jne 0x10005359
lea eax, [ebx + 0xd]
pop ebx
mov esp, ebp
pop ebp
ret 8
push esi
push edi
xor esi, esi
mov edx, ebx
nop
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10005365
sub eax, edi
inc eax
add edx, eax
add esi, eax
cmp eax, 1
jne 0x10005360
mov eax, dword [ebp - 4]
push esi
push ebx
push 7
push 0
push dword [ebp + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10009da0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, ecx
push edi
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea edi, [eax + 1]
test edi, edi
js 0x10009e1a
mov esi, dword [ebp + 8]
mov ecx, 1
mov eax, dword [esi]
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edi
or ecx, eax
jge 0x10009dd5
push edi
mov ecx, esi
call fcn.100025f0
push edi
push dword [esi]
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov edi, eax
mov ecx, edi
cmp edi, 0xffffffff
jne 0x10009dfd
mov ecx, dword [esi]
test ecx, ecx
je 0x10009e01
push dword [ecx - 8]
push ecx
call fcn.1000d43b
add esp, 8
mov ecx, eax
test ecx, ecx
js 0x10009e1a
mov eax, dword [esi]
cmp ecx, dword [eax - 8]
jg 0x10009e1a
mov dword [eax - 0xc], ecx
mov eax, dword [esi]
mov byte [ecx + eax], 0
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 4
push 0x80070057
call fcn.10002580
int3

Function at 0x1000a120
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [0x10029914]
push edi
push 0x1002301c
push 0x6c
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x1000a15b
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 0xc]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000a152
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp edi, dword [ebp - 4]
pop edi
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x56641e50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x5666dc68
call fcn.566541a0
sub esp, 0x14
mov eax, dword [0x5667b8ac]
mov al, byte [eax + 0x38]
push ebx
mov dword [ebp - 0x14], ecx
xor ecx, ecx
xor ebx, ebx
cmp al, bl
sete cl
push esi
push edi
push ecx
lea ecx, [ebp - 0x1c]
call fcn.56641d1e
movzx eax, word [ebp + 8]
push 5
mov esi, 0x5667bcc8
push eax
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.56662069
push eax
call dword [0x5667b95c]
mov edi, eax
cmp edi, ebx
jne 0x56641eab
push 0x80004005
call fcn.5666003f
pop ecx
push edi
mov ecx, esi
call fcn.56662069
push eax
call dword [sym.imp.kernel32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp + 8], eax
jne 0x56641ecc
push 0x8007000e
call fcn.5666b104
pop ecx
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_LockResource]
cmp eax, ebx
mov dword [ebp - 0x18], eax
jne 0x56641ee7
push 0x8007000e
call fcn.5666b104
pop ecx
push edi
mov ecx, esi
call fcn.56662069
push eax
call dword [sym.imp.kernel32.dll_SizeofResource]
cmp dword [ebp - 0x1c], ebx
mov esi, eax
je 0x56641f60
push ebx
push 0x566316d0
push 0x5667bcc8
lea ecx, [ebp + 8]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp + 8], ebx
call fcn.56641ac1
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x20]
push edx
push dword [ebp - 0x18]
mov byte [ebp - 4], 1
push esi
push eax
call dword [ecx + 0xc]
cmp eax, ebx
jge 0x56641f3d
push eax
call fcn.5665fd4a
pop ecx
mov eax, dword [ebp - 0x10]
cmp word [eax + 2], 0xffff
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov esi, eax
jne 0x56641f52
add eax, 0xc
push eax
call dword [edx + 0x10]
lea ecx, [ebp + 8]
call fcn.5665f161
jmp 0x56641f6d
push esi
push dword [ebp - 0x18]
call fcn.56657a4c
pop ecx
pop ecx
mov esi, eax
lea ecx, [ebp - 0x1c]
call fcn.5665f161
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x56647161
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x5666e1e6
call fcn.566541a0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esi + 0x1c], ebx
mov byte [esi + 0x20], 1
mov dword [esi + 4], ebx
lea ecx, [esi + 0x24]
mov dword [ebp - 0x10], esi
mov dword [esi + 0xc], ebx
call fcn.5666b104
mov dword [ebp - 4], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
lea ecx, [esi + 0x3c]
mov byte [ebp - 4], 1
call fcn.56644031
lea ecx, [esi + 0x68]
call fcn.5664a893
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x78], ebx
mov byte [esi + 0x7c], bl
mov byte [esi + 0x7d], bl
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x56652fba
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
mov eax, 0x5666ebf1
call fcn.566541a0
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x7c]
mov dword [ebp - 4], 0xb
call fcn.566423b4
lea ecx, [esi + 0x78]
call fcn.5665f161
lea ecx, [esi + 0x70]
mov byte [ebp - 4], 9
call fcn.5664fcfe
lea ecx, [esi + 0x68]
mov byte [ebp - 4], 8
call fcn.5664fcfe
lea ecx, [esi + 0x60]
mov byte [ebp - 4], 7
call fcn.5664fcbc
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 6
call fcn.5664fc7a
lea ecx, [esi + 0x50]
mov byte [ebp - 4], 5
call fcn.5664fc7a
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 4
call fcn.5664fcfe
lea ecx, [esi + 0x40]
mov byte [ebp - 4], 3
call fcn.5664fcfe
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 2
call fcn.5664fc38
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
call fcn.5664fbf6
and byte [ebp - 4], 0
lea ecx, [esi + 0x28]
call fcn.5664fbb4
mov ecx, esi
call fcn.5664fa23
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
jmp 0x5665089c

Function at 0x56653256
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push esi
mov esi, ecx
push 0x5667bcd0
mov dword [esi], 0x56634674
mov dword [esi + 4], 0x56634660
mov dword [esi + 0x18], 0x56634638
mov dword [esi + 0x1c], 0x56634628
mov dword [esi + 0x20], 1
call dword [sym.imp.kernel32.dll_InterlockedDecrement]
mov ecx, esi
pop esi
jmp 0x5665089c

Function at 0x56653697
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push esi
mov esi, ecx
push 0x5667bcd0
mov dword [esi], 0x56634758
mov dword [esi + 4], 1
call dword [sym.imp.kernel32.dll_InterlockedDecrement]
lea ecx, [esi + 8]
pop esi
jmp 0x5665089c

Function at 0x566543f9
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x94
push esi
mov esi, ecx
call fcn.566543e2
and byte [esi + 0xc], 0
mov eax, 0x56630000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x1c]
push 0
push eax
mov dword [esi], 0x3c
call sub.msvcr70.dll_memset
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [ebp - 0xc], 2
jne 0x56654453
cmp dword [ebp - 0x18], 5
jb 0x5665446b
jmp 0x56654467
cmp dword [ebp - 0xc], 1
jne 0x5665446b
cmp dword [ebp - 0x18], 4
ja 0x56654467
jne 0x5665446b
cmp dword [ebp - 0x14], 0
jbe 0x5665446b
mov byte [esi + 0xc], 1
lea eax, [esi + 0x18]
push eax
mov dword [esi + 0x10], 0x700
mov dword [esi + 0x14], 0x5667b100
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
add ebp, 0x78
leave
ret
Function at 0x56654718
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x5666ef94
call fcn.566541a0
sub esp, 0x14
mov eax, dword [0x5667b8ac]
mov al, byte [eax + 0x38]
push ebx
mov dword [ebp - 0x14], ecx
xor ecx, ecx
xor ebx, ebx
cmp al, bl
sete cl
push esi
push edi
push ecx
lea ecx, [ebp - 0x1c]
call fcn.56641d1e
movzx eax, word [ebp + 8]
push 5
mov esi, 0x5667bcc8
push eax
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.56662069
push eax
call dword [0x5667b95c]
mov edi, eax
cmp edi, ebx
jne 0x56654773
push 0x80004005
call fcn.5666003f
pop ecx
push edi
mov ecx, esi
call fcn.56662069
push eax
call dword [sym.imp.kernel32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp + 8], eax
jne 0x56654794
push 0x8007000e
call fcn.5666b104
pop ecx
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_LockResource]
cmp eax, ebx
mov dword [ebp - 0x18], eax
jne 0x566547af
push 0x8007000e
call fcn.5666b104
pop ecx
push edi
mov ecx, esi
call fcn.56662069
push eax
call dword [sym.imp.kernel32.dll_SizeofResource]
cmp dword [ebp - 0x1c], ebx
mov esi, eax
je 0x56654828
push ebx
push 0x566316d0
push 0x5667bcc8
lea ecx, [ebp + 8]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp + 8], ebx
call fcn.56641ac1
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x20]
push edx
push dword [ebp - 0x18]
mov byte [ebp - 4], 1
push esi
push eax
call dword [ecx + 0xc]
cmp eax, ebx
jge 0x56654805
push eax
call fcn.5665fd4a
pop ecx
mov eax, dword [ebp - 0x10]
cmp word [eax + 2], 0xffff
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov esi, eax
jne 0x5665481a
add eax, 0xc
push eax
call dword [edx + 0x10]
lea ecx, [ebp + 8]
call fcn.5665f161
jmp 0x56654835
push esi
push dword [ebp - 0x18]
call fcn.56657a4c
pop ecx
pop ecx
mov esi, eax
lea ecx, [ebp - 0x1c]
call fcn.5665f161
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x566572bc
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x5666f249
call fcn.566541a0
push ecx
push esi
push edi
xor edi, edi
push edi
mov esi, ecx
push edi
push edi
push edi
lea ecx, [esi + 0xc]
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
call fcn.5665f8c4
push edi
push edi
push edi
push edi
lea ecx, [esi + 0x14]
mov dword [ebp - 4], edi
call fcn.5665f8c4
push edi
push edi
push edi
push edi
lea ecx, [esi + 0x1c]
mov byte [ebp - 4], 1
call fcn.5665f8c4
push edi
push edi
push 1
push edi
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call fcn.5665f8c4
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x30], eax
mov dword [esi], 0x56636420
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 8

Function at 0x566602f2
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8
Function at 0x5666030c
Capabilities:
Set registry value

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, ecx
call dword [sym.imp.kernel32.dll_lstrlenA]
inc eax
push eax
push dword [esp + 0x10]
push dword [esp + 0x18]
push 0
push dword [esp + 0x18]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop esi
ret 0xc

Function at 0x56660335
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov ebx, ecx
xor edi, edi
push esi
call dword [sym.imp.kernel32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x56660340
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8
Function at 0x56666847
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x56670224
call fcn.566541a0
sub esp, 0xa8
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 4], ebx
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.oleaut32.dll_SetErrorInfo]
mov esi, dword [ebp + 8]
call fcn.5666b104
lea eax, [ebp - 0xb4]
push eax
mov byte [ebp - 0x14], bl
mov dword [ebp - 0xb4], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [ebp - 0xa4], 2
jne 0x566668af
cmp dword [ebp - 0xb0], 4
jb 0x566668af
mov byte [ebp - 0x14], 1
push ebx
push ebx
push 0x5663742c
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x566668c3
mov byte [ebp - 0x14], bl
mov esi, dword [ebp - 0x14]
push esi
call fcn.566686f2
pop ecx
push esi
call fcn.56668446
pop ecx
push esi
call fcn.5666803a
pop ecx
push esi
call fcn.56667fae
pop ecx
push esi
call fcn.5666798f
pop ecx
push esi
call fcn.5666790f
pop ecx
push esi
call fcn.5666788f
pop ecx
push esi
call fcn.566677b6
pop ecx
push esi
call fcn.566672ab
pop ecx
push esi
call fcn.56666967
pop ecx
push dword [ebp - 0x18]
push ebx
call dword [sym.imp.oleaut32.dll_CreateErrorInfo]
lea ecx, [ebp - 0x18]
call fcn.5665f161
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x5666b104
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x5666b113
pop dword [ebp - 0x20]
mov eax, 0x78220508
sub eax, 0x21bb53f5
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x9a3d622
sub dword [ebp - 0x30], 0xbb5190d7
mov dword [ebp - 0x2c], 0x497dc209
sub dword [ebp - 0x2c], 0x174a75c4
mov dword [ebp - 0x28], 0x3126c4
sub dword [ebp - 0x28], 0xb3e4e296
mov dword [ebp - 0x24], 0x63dda2de
add dword [ebp - 0x24], 0x9c225d22
lea eax, [ebp - 0x30]
push eax
mov eax, 0x422aeeae
add eax, 0x14382296
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xc9ac8eb0
sub dword [ebp - 0x30], 0x553a255a
mov dword [ebp - 0x2c], 0xf75499af
add dword [ebp - 0x2c], 0x4a17c7c6
mov dword [ebp - 0x28], 0xc3a2f293
sub dword [ebp - 0x28], 0x60338627
mov dword [ebp - 0x24], 0x63c1f71f
add dword [ebp - 0x24], 0x9c3e08e1
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x3cc53
push 0
call eax
mov ecx, 0xb5ff4847
sub ecx, 0xb5fefa90
xor ebx, ebx
add ebx, eax
mov esi, 0x56688000
add esi, dword [ebp - 0x20]
mov edx, 0xa54bbb11
add edx, 0x933cc4d4
xor dword [ebp - 4], eax
mov edi, dword [esi]
xor dword [ebp - 4], 0x8cfeb72b
xor edi, edx
sub dword [ebp - 0x14], edx
mov dword [ebx], edi
add dword [ebp - 0xc], eax
add ebx, 4
add esi, 4
loop 0x5666b22c
add eax, 0x31e401bb
add eax, 0xce1d27f4
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x2965f332
add ecx, 0x2cfd0cce
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x401a1d
Capabilities:
Get number of processors

Disassembly:
mov ecx, 0x504e58
jmp 0x401a11
mov eax, 0x4c4e8c
call fcn.00494300
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.00401b2a
mov eax, dword [0x500810]
lea ecx, [esi + 0xa0]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ecx], eax
mov eax, dword [0x500810]
mov dword [esi + 0xa8], eax
push 1
mov dword [esi], 0x4cc9b4
pop eax
mov ebx, 0x504e54
mov dword [esi + 0x1c], eax
push 0xa
mov dword [esi + 0x20], eax
or dword [esi + 0x28], 0xffffffff
or dword [esi + 0x24], 0xffffffff
pop edx
mov dword [esi + 0x30], edi
push ebx
mov byte [ebp - 4], 2
mov dword [esi + 0x2c], edi
mov dword [esi + 0x34], 2
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], 5
mov dword [esi + 0x60], eax
mov dword [esi + 0x64], edx
mov dword [esi + 0x68], eax
mov dword [esi + 0x6c], edx
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], eax
mov dword [esi + 0x78], 0x3e8
mov dword [esi + 0x7c], eax
mov dword [esi + 0x80], eax
mov dword [esi + 0x84], eax
mov dword [esi + 0x88], edi
mov dword [esi + 0x8c], 0xc0
mov dword [esi + 0x90], 0x6c
mov dword [esi + 0x94], edi
mov dword [esi + 0x98], edi
mov dword [esi + 0x9c], edi
call fcn.004b4288
push ebx
lea ecx, [esi + 0xa8]
mov dword [esi + 0xa4], edi
call fcn.004b4288
mov ecx, dword [ebp - 0xc]
push 0x64
pop eax
mov dword [esi + 0xb4], edi
mov dword [esi + 0xac], eax
mov dword [esi + 0xb0], eax
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40ac2e
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x4c5bfc
call fcn.00494300
sub esp, 0x22c
push ebx
push esi
mov dword [ebp - 0x2c], ecx
mov esi, 0x504c38
push str.DataFile_Types
mov ecx, esi
call fcn.004c2a0e
xor ebx, ebx
mov dword [ebp - 0x18], eax
cmp eax, ebx
jne 0x40ac64
xor eax, eax
jmp 0x40adac
mov eax, dword [0x500810]
push edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x38]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push eax
push ebx
push ebx
lea eax, [ebp - 0x24]
push ebx
push eax
lea eax, [ebp - 0x238]
mov byte [ebp - 4], 2
push eax
push ebx
push dword [ebp - 0x18]
mov dword [ebp - 0x24], 0x100
mov dword [ebp - 0x20], ebx
call edi
cmp eax, 0x103
je 0x40ad7c
lea eax, [ebp - 0x238]
push eax
push str.DataFile_Types
lea eax, [ebp - 0x10]
push 0x4ebfd4
push eax
call fcn.004acda7
add esp, 0x10
lea eax, [ebp - 0x28]
mov ecx, esi
push ebx
push str.Name
push dword [ebp - 0x10]
push eax
call fcn.004c2ac0
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.004b4238
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.004b40f1
push ebx
push str.Extension
push dword [ebp - 0x10]
lea eax, [ebp - 0x30]
mov ecx, esi
push eax
call fcn.004c2ac0
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 4
call fcn.004b4238
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 2
call fcn.004b40f1
push 0xffffffffffffffff
push str.Icon
push dword [ebp - 0x10]
mov ecx, esi
call fcn.004c2a54
mov ecx, dword [ebp - 0x14]
cmp dword [ecx - 8], ebx
je 0x40ad55
mov edx, dword [ebp - 0x1c]
cmp dword [edx - 8], ebx
je 0x40ad55
cmp eax, 0xffffffff
je 0x40ad55
push eax
push edx
push ecx
mov ecx, dword [ebp - 0x2c]
call fcn.0040ae99
lea eax, [ebp - 0x38]
inc dword [ebp - 0x20]
push eax
push ebx
push ebx
lea eax, [ebp - 0x24]
push ebx
push eax
lea eax, [ebp - 0x238]
mov dword [ebp - 0x24], 0x100
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x18]
jmp 0x40aca0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.004b40f1
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], bl
call fcn.004b40f1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004b40f1
push 1
pop eax
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40beee
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
push ebx
push esi
lea eax, [ebp - 4]
push edi
xor ebx, ebx
push eax
mov edi, 0x4ceb68
push ebx
push ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov esi, 0x2b4
lea eax, [ebp - 0x2bc]
push esi
push ebx
push eax
call fcn.00494320
lea eax, [ebp - 8]
add esp, 0xc
neg eax
sbb eax, eax
lea ecx, [ebp - 4]
and eax, ecx
xor ecx, ecx
cmp dword [ebp + 8], ebx
mov eax, dword [eax]
sete cl
or cx, 0x4008
push ecx
lea ecx, [ebp - 0x2bc]
push esi
push ecx
push ebx
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea ecx, [ebp - 8]
mov esi, eax
neg ecx
sbb ecx, ecx
lea eax, [ebp - 4]
and ecx, eax
mov dword [ebp - 8], edi
call fcn.0040c262
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4