joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2003b3a0
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x2009e65d
call fcn.2007d394
mov eax, 0x11dc
call fcn.2007eb40
mov eax, dword [0x200cc84c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
mov ebx, ecx
xor eax, eax
cmp dword [ebx + 0x2a0], eax
jne 0x2003b4e1
cmp dword [ebx + 0x548], eax
jne 0x2003b4e1
push esi
push edi
mov edi, 0x200a6b94
push edi
push eax
push 0x200a9130
mov esi, str.main
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push edi
push 0xfff
mov dword [ebp - 0x11e8], eax
lea eax, [ebp - 0x10d8]
push eax
push 0x200a4a9c
push 0x200a9124
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x64
xor esi, esi
lea eax, [ebp - 0x74]
push esi
push eax
call fcn.2007e690
push 4
lea eax, [ebp - 0x11e8]
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.2007ca70
push 6
add ebx, 0x19234
lea eax, [ebp - 0x70]
push ebx
push eax
call fcn.2007ca70
push 0x64
lea eax, [ebp - 0xd8]
push esi
push eax
call fcn.2007e690
lea eax, [ebp - 0xd8]
push eax
lea eax, [ebp - 0x74]
push 0xa
push eax
call fcn.2001729d
add esp, 0x3c
lea ecx, [ebp - 0x11e4]
call fcn.2001723b
mov dword [ebp - 4], esi
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0xd8]
push eax
lea ecx, [ebp - 0x11e4]
call fcn.200174a9
lea eax, [ebp - 0xd8]
push eax
lea eax, [ebp - 0x74]
push 0x14
push eax
call fcn.2001729d
add esp, 0xc
lea eax, [ebp - 0x10d8]
push eax
lea eax, [ebp - 0xd8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x2003b4c6
mov dword [ebp - 0x11e8], esi
mov esi, dword [ebp - 0x11e8]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x11e4]
call fcn.2001727c
pop edi
mov eax, esi
pop esi
jmp 0x2003b4e3
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
pop ebx
call fcn.2007c9ae
leave
ret

Function at 0x2003b627
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x200cc84c]
push esi
mov esi, dword [ebp + 8]
push edi
push 0x200a6b94
xor eax, ebp
push 0x64
mov dword [ebp - 4], eax
lea eax, [ebp - 0x68]
push eax
push 0x200a4a9c
push 0x200a8ba0
mov edi, ecx
push str.PSNetInfo
mov byte [edi + 0x10b10], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x2003b67c
lea eax, [ebp - 0x68]
push 0x18
push eax
call fcn.200175bd
pop ecx
pop ecx
mov byte [edi + 0x10b10], al
test esi, esi
je 0x2003b69a
cmp byte [esi], 0
je 0x2003b69a
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push 0x18
push eax
push esi
call fcn.2001762c
add esp, 0xc
jmp 0x2003b69c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.2007c9ae
leave
ret 4
Function at 0x2003b844
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push edi
mov esi, ecx
call ebx
sub eax, dword [esi + 0x194a0]
cmp eax, 0x7530
jbe 0x2003b927
lea ecx, [esi + 0x193c8]
call fcn.20073c88
mov ecx, dword [esi + 0x2a4]
cmp ecx, 2
mov edi, eax
jge 0x2003b887
cmp edi, 0x6ddd0
jb 0x2003b927
test edi, edi
mov edx, dword [esi + 0x194a4]
mov dword [esp + 0xc], edi
fild dword [esp + 0xc]
jge 0x2003b89f
fadd qword [0x200a7770]
test edx, edx
mov dword [esp + 0xc], edx
fild dword [esp + 0xc]
jge 0x2003b8b1
fadd qword [0x200a7770]
fmul qword [0x200a9140]
fcompp
fnstsw ax
test ah, 5
jp 0x2003b927
cmp ecx, 2
push 0x64
pop eax
jne 0x2003b8e0
cmp edx, 0x61a80
jb 0x2003b8f9
cmp edx, 0x927c0
sbb eax, eax
and eax, 0xffffffec
add eax, 0x5a
jmp 0x2003b908
jge 0x2003b908
cmp edx, 0xf4240
push 0x46
pop eax
jae 0x2003b8f1
push 0x3c
jmp 0x2003b907
cmp edx, 0x927c0
jae 0x2003b8fd
push 0x32
jmp 0x2003b907
cmp edx, 0x61a80
jae 0x2003b908
push 0x28
pop eax
cmp dword [esi + 0x198d4], eax
ja 0x2003b927
cmp edi, edx
jbe 0x2003b91a
mov dword [esi + 0x194a4], edi
call ebx
mov dword [esi + 0x194a0], eax
xor eax, eax
inc eax
jmp 0x2003b929
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x20040c70
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x2009eb60
call fcn.2007d394
sub esp, 0x108
mov eax, dword [0x200cc84c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
mov eax, ecx
push esi
mov dword [ebp - 0x114], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [ebp + 8], ebx
jne 0x20040ca5
xor esi, esi
jmp 0x20040e56
push dword [ebp + 0x10]
lea ecx, [eax + 0x877c]
call fcn.2001bb16
mov esi, eax
cmp esi, ebx
je 0x20040c9e
mov ecx, dword [ebp + 8]
add ecx, 0xb4
call fcn.200342ea
test eax, eax
je 0x20040c9e
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x2a8], ebx
je 0x20040cde
xor esi, esi
jmp 0x20040e55
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [edi + 0x218]
cmp eax, 0xbb8
jb 0x20040cd7
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0xf4]
push eax
add ecx, 0xb4
call fcn.20034401
mov byte [ebp - 4], 1
push 0xc8
lea eax, [ebp - 0xd8]
push eax
lea ecx, [ebp - 0x110]
call fcn.200030b0
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x108], eax
push ebx
lea ecx, [ebp - 0x110]
mov byte [eax], bl
call fcn.200012d7
push 0x43
lea ecx, [ebp - 0x110]
call fcn.20001294
push ebx
lea ecx, [ebp - 0x110]
call fcn.200012d7
push 0xe5
lea ecx, [ebp - 0x110]
call fcn.20001294
mov eax, dword [esi + 8]
inc dword [eax + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [esi + 0xb5]
push eax
lea ecx, [ebp - 0x110]
call fcn.2000122e
push ebx
lea ecx, [ebp - 0x110]
call fcn.20001294
push dword [esi + 0xe8]
lea ecx, [ebp - 0x110]
call fcn.2000133b
push dword [esi + 0x108]
lea ecx, [ebp - 0x110]
call fcn.2000133b
push dword [esi + 0xf8]
lea ecx, [ebp - 0x110]
call fcn.2000133b
mov edi, dword [esi + 8]
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
dec dword [edi + 0x18]
mov ecx, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x108]
sub eax, ecx
lea edx, [eax - 4]
mov word [ecx], dx
mov ecx, dword [ebp + 8]
xor edx, edx
mov dx, word [ecx + 0xb8]
movzx eax, ax
push edx
push dword [ecx + 0xb4]
mov ecx, dword [ebp - 0x114]
push eax
push dword [ebp - 0x10c]
add ecx, 0x10b5c
call fcn.2007625c
test eax, eax
je 0x20040e33
mov edi, dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [edi + 0x218], eax
inc dword [esi + 0x110]
xor esi, esi
inc esi
jmp 0x20040e35
xor esi, esi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x110]
call fcn.200030f4
mov byte [ebp - 4], bl
push ebx
push 1
lea ecx, [ebp - 0xf4]
call fcn.2000275e
pop edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.20001efb
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.2007c9ae
leave
ret 0xc
Function at 0x2004210e
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x2009ec0c
call fcn.2007d394
sub esp, 0x424
mov eax, dword [0x200cc84c]
push ebx
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
mov ebx, ecx
xor esi, esi
mov dword [ebp - 4], esi
cmp dword [ebx + 0x2a0], esi
mov dword [ebp - 0x414], esi
jne 0x2004227c
mov eax, dword [ebp + 8]
cmp eax, esi
je 0x2004227c
lea ecx, [eax + 0xb4]
call fcn.200342ea
test eax, eax
je 0x2004227c
cmp dword [ebx + 0x1c], esi
jne 0x2004227c
mov eax, dword [ebp + 8]
xor ecx, ecx
inc ecx
cmp word [eax + 0x1dc], cx
ja 0x20042196
cmp word [eax + 0x1de], cx
ja 0x20042196
cmp word [eax + 0x1e0], si
ja 0x20042196
cmp word [eax + 0x1e2], 0xa28
jbe 0x20042198
xor ecx, ecx
cmp byte [eax + 0xc0], 0
je 0x200421aa
cmp byte [eax + 0xbf], 3
jne 0x200421ac
xor ecx, ecx
cmp ecx, esi
jne 0x2004227c
cmp byte [eax + 0xfe], 0
jne 0x2004227c
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
mov edi, eax
call esi
mov ecx, dword [edi + 0x104]
add ecx, 0x3e8
cmp eax, ecx
jbe 0x2004227b
mov edi, dword [ebp + 8]
call esi
mov dword [edi + 0x104], eax
push 0x400
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x430]
call fcn.200030b0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x430]
push eax
mov ecx, ebx
call fcn.2003bce0
test al, al
je 0x2004226c
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x428]
sub eax, dword [ebp - 0x42c]
xor edx, edx
mov dx, word [ecx + 0xb8]
push edx
push dword [ecx + 0xb4]
lea ecx, [ebx + 0x10b5c]
push eax
push dword [ebp - 0x42c]
call fcn.2007625c
test eax, eax
je 0x2004226c
mov eax, dword [ebp - 0x428]
sub eax, dword [ebp - 0x42c]
mov ecx, dword [ebp + 8]
push eax
mov dword [ebp - 0x414], 1
call fcn.20020954
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x430]
call fcn.200030f4
pop edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.20001efb
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x414]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.2007c9ae
leave
ret 8
Function at 0x20044958
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x2009eea5
call fcn.2007d394
push ecx
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x10898], edi
jne 0x20044ae7
push ebx
lea ebx, [esi + 0x19050]
mov ecx, ebx
call fcn.20006782
cmp dword [esi + 0x191bc], edi
jne 0x2004499a
lea eax, [esi + 0x19670]
push eax
mov ecx, ebx
call fcn.20003500
cmp dword [esi + 0x2c4], edi
je 0x20044ae6
cmp dword [esi + 0x19550], 0xffffffff
je 0x20044ae6
cmp dword [esi + 0x10898], edi
jne 0x20044ae6
lea eax, [esi + 0x19528]
push eax
lea ecx, [ebp - 0x10]
call fcn.200011c0
mov dword [ebp - 4], edi
cmp dword [esi + 0x1954c], edi
je 0x20044ad1
mov eax, dword [esi + 0x19550]
cmp eax, edi
jne 0x200449f7
cmp dword [esi + 0x19554], edi
je 0x20044a1d
cmp eax, edi
je 0x20044ad1
mov ebx, dword [esi + 0x19554]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x19550]
imul ecx, ecx, 0x3e8
sub eax, ebx
cmp eax, ecx
ja 0x20044a1d
cmp ebx, edi
jne 0x20044ad1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x19554], eax
mov eax, dword [esi + 0x19548]
mov ebx, dword [eax]
cmp ebx, eax
je 0x20044ad1
push 0x60
call fcn.2008f9ce
pop ecx
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
cmp eax, edi
je 0x20044a55
mov ecx, eax
call fcn.2000a24a
mov edi, eax
mov byte [ebp - 4], 0
push 0xffffffffffffffff
push 0
lea eax, [esi + 0x440]
push eax
lea ecx, [edi + 0x1c]
call fcn.20002fc3
push 0xffffffffffffffff
push 0
lea eax, [esi + 0x1924c]
push eax
mov ecx, edi
call fcn.20002fc3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 0x19024]
xor edx, edx
mov ecx, 0x3e8
div ecx
push 0xffffffffffffffff
push 0
lea ecx, [edi + 0x40]
mov dword [edi + 0x38], eax
lea eax, [ebx + 8]
push eax
call fcn.20002fc3
mov eax, dword [esi + 0x19550]
mov dword [edi + 0x5c], eax
mov ecx, dword [esi + 0x2c4]
push edi
add ecx, 0x2d0
call fcn.2000af0e
mov ebx, dword [ebx]
xor edi, edi
cmp ebx, dword [esi + 0x19548]
jne 0x20044a39
or dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x10]
cmp esi, edi
je 0x20044ae6
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
dec dword [esi + 0x18]
pop ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x20050d65
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x2009f81e
call fcn.2007d394
sub esp, 0x3c
mov eax, dword [0x200cc84c]
push ebx
push esi
mov esi, ecx
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
mov dword [ebp - 0x48], esi
mov dword [esi], 0x200a9d9c
mov dword [ebp - 4], 0xf
xor ebx, ebx
cmp dword [esi + 0x15c], ebx
jne 0x20050da6
lea ecx, [esi + 0x164]
call fcn.2003183a
push 0x200a6b94
push ebx
push str.totalusedtimes
mov edi, str.stat
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
inc eax
push eax
lea eax, [ebp - 0x44]
push 0x200a4c68
push eax
call fcn.2007d900
add esp, 0xc
push 0x200a6b94
lea eax, [ebp - 0x44]
push eax
push str.totalusedtimes
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea edi, [esi + 0xa4]
mov ecx, edi
call fcn.20075704
mov ecx, edi
call fcn.200755bc
lea ecx, [esi + 0x2d0]
call fcn.20014bf5
push 0x186a0
push ebx
lea ecx, [esi + 0x2d0]
call fcn.20014aef
mov byte [ebp - 4], 0xe
lea ecx, [esi + 0x2d0]
call fcn.2000a462
mov byte [ebp - 4], 0xd
push ebx
push 1
lea ecx, [esi + 0x2a8]
call fcn.2000275e
mov byte [ebp - 4], 0xc
push ebx
push 1
lea ecx, [esi + 0x284]
call fcn.2000275e
mov byte [ebp - 4], 0xb
lea ecx, [esi + 0x27c]
call fcn.200254a4
mov byte [ebp - 4], 0xa
push ebx
push 1
lea ecx, [esi + 0x254]
call fcn.2000275e
mov byte [ebp - 4], 9
lea ecx, [esi + 0x164]
call fcn.20033f30
mov byte [ebp - 4], 8
push ebx
push 1
lea ecx, [esi + 0x134]
call fcn.2000275e
mov byte [ebp - 4], 7
lea ecx, [esi + 0x128]
call fcn.20050d42
mov byte [ebp - 4], 6
lea ecx, [esi + 0x11c]
call fcn.20050d1f
mov byte [ebp - 4], 5
push ebx
push 1
lea ecx, [esi + 0x100]
call fcn.2000275e
mov byte [ebp - 4], 4
mov ecx, edi
call fcn.2007554e
mov byte [ebp - 4], 3
lea ecx, [esi + 0x48]
call fcn.2007554e
mov byte [ebp - 4], 2
lea ecx, [esi + 0x3c]
call fcn.2004d09b
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.20050106
mov byte [ebp - 4], bl
lea ecx, [esi + 0x24]
call fcn.20050106
or dword [ebp - 4], 0xffffffff
add esi, 8
push esi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.2007c9ae
leave
ret
Function at 0x2005340c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, ecx
lea ebx, [esi + 0x192bc]
call edi
sub eax, dword [ebx]
cmp eax, 0x3e8
jb 0x2005350e
call edi
mov ecx, dword [esi + 0x19938]
mov dword [ebx], eax
call fcn.2002c871
cmp dword [esi + 0x2a0], 0
jne 0x20053460
mov ecx, esi
call fcn.20052e30
cmp dword [esi + 0x548], 0
jne 0x20053460
mov ecx, esi
call fcn.2004a099
call edi
lea ebx, [esi + 0x108f8]
inc dword [ebx + 0x18]
mov edi, eax
push ebx
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0x10e70]
test eax, eax
jne 0x20053489
mov dword [esi + 0x10e70], edi
jmp 0x20053504
sub edi, eax
cmp edi, 0x1388
jae 0x2005349c
and dword [esi + 0x10e74], 0
jmp 0x20053504
mov eax, dword [esi + 0x10e6c]
fild dword [esi + 0x10e6c]
test eax, eax
jge 0x200534b2
fadd dword [0x200a6f40]
test edi, edi
fmul dword [0x200a6f44]
mov dword [ebp - 8], edi
fild dword [ebp - 8]
jge 0x200534c8
fadd dword [0x200a6f40]
fdivp st(1)
call fcn.2007f3d0
mov ecx, eax
mov eax, edi
xor edx, edx
mov edi, 0x3e8
div edi
mov dword [esi + 0x10e74], ecx
cmp eax, 0x64
jle 0x200534ea
push 0x64
pop eax
imul ecx, eax
imul eax, eax, 0x3e8
mov dword [esi + 0x10e6c], ecx
mov ecx, dword [ebp - 4]
sub ecx, eax
mov dword [esi + 0x10e70], ecx
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
dec dword [ebx + 0x18]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x200553c2
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
mov eax, 0x2009fe61
call fcn.2007d394
push ecx
push ebx
push esi
mov esi, ecx
lea eax, [esi + 8]
mov dword [esi], 0x200a9f70
xor ebx, ebx
push eax
mov dword [ebp - 0x10], esi
mov dword [eax + 0x18], ebx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [ebp - 4], ebx
lea ecx, [esi + 0x24]
call fcn.2003fe3e
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.2004fd4d
mov byte [ebp - 4], 2
lea ecx, [esi + 0x58]
call fcn.2005517b
mov byte [ebp - 4], 3
lea ecx, [esi + 0x64]
call fcn.20019d24
mov byte [ebp - 4], 4
lea ecx, [esi + 0x8098]
call fcn.20002957
mov byte [ebp - 4], 5
lea ecx, [esi + 0x80d8]
call fcn.2004fd73
mov byte [ebp - 4], 6
lea eax, [esi + 0x80e4]
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov byte [ebp - 4], 7
mov dword [esi + 4], ebx
mov dword [esi + 0x3c], ebx
mov byte [esi + 0x44], bl
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x80b4], ebx
mov dword [esi + 0x80b8], ebx
mov dword [esi + 0x80bc], ebx
mov dword [esi + 0x80c0], ebx
mov dword [esi + 0x80c4], ebx
mov dword [esi + 0x80c8], ebx
mov dword [esi + 0x80cc], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x80d0], ebx
mov dword [esi + 0x80d4], ebx
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x200554af
Capabilities:
Get number of processors

Disassembly:
mov eax, 0x2009fe61
call fcn.2007d394
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], 0x200a9f70
mov dword [ebp - 4], 7
lea edi, [esi + 0x24]
mov ecx, edi
call fcn.2001fca1
mov byte [ebp - 4], 6
lea ecx, [esi + 0x80e4]
call fcn.2001b1f9
mov byte [ebp - 4], 5
lea ecx, [esi + 0x80d8]
call fcn.2004e48a
mov byte [ebp - 4], 4
push 0
push 1
lea ecx, [esi + 0x8098]
call fcn.2000275e
mov byte [ebp - 4], 3
lea ecx, [esi + 0x64]
call fcn.20019d64
mov byte [ebp - 4], 2
lea ecx, [esi + 0x58]
call fcn.20055158
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.2004e467
mov byte [ebp - 4], 0
mov ecx, edi
call fcn.2003fe7b
or dword [ebp - 4], 0xffffffff
add esi, 8
push esi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x2005c77f
Capabilities:
Get hostname

Disassembly:
mov eax, 0x200a12a3
call fcn.2007d394
sub esp, 0x490
mov eax, dword [0x200cc84c]
push ebx
push esi
push edi
xor eax, ebp
mov edi, 0x104
push edi
mov dword [ebp - 0x10], eax
xor ebx, ebx
lea eax, [ebp - 0x15c]
push ebx
push eax
mov esi, ecx
call fcn.2007e690
add esp, 0xc
push edi
lea eax, [ebp - 0x15c]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push ebx
call fcn.2007e6f0
pop ecx
push eax
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0x364]
push str._s_d_d
push eax
call fcn.2007d900
push 0x28
lea eax, [ebp - 0x38]
push ebx
push eax
call fcn.2007e690
push edi
lea eax, [ebp - 0x15c]
push ebx
push eax
call fcn.2007e690
add esp, 0x2c
lea ecx, [ebp - 0x48c]
call fcn.2001723b
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x364]
push eax
lea ecx, [ebp - 0x48c]
call fcn.200174a9
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0x38]
push 0x14
push eax
call fcn.2001729d
add esp, 0xc
lea eax, [ebp - 0x15c]
push eax
lea ecx, [esi + 0x134]
call fcn.20003a20
push 7
lea ecx, [esi + 0x48]
call fcn.20074fa6
mov ecx, dword [esi + 0x150]
cmp ecx, ebx
je 0x2005c87d
call fcn.2004eac1
mov ecx, dword [esi + 0x150]
cmp ecx, ebx
je 0x2005c87d
mov eax, dword [ecx]
push 1
call dword [eax + 0x38]
push ebx
lea ecx, [ebp - 0x380]
mov dword [ebp - 0x368], 0xf
call fcn.20001bc0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x498]
call fcn.20020d33
mov dword [ebp - 0x494], eax
mov dword [ebp - 0x490], ebx
mov byte [ebp - 4], 2
lea eax, [ebp - 0x498]
push eax
call fcn.20034639
mov edx, dword [ebp - 0x494]
pop ecx
mov ecx, dword [edx]
jmp 0x2005c8e5
mov eax, dword [ecx + 8]
cmp al, 0x7f
je 0x2005c8e9
cmp al, 0xa
je 0x2005c8e9
cmp al, 0xac
je 0x2005c8e9
cmp al, 0xc0
jne 0x2005c8e1
cmp ah, 0xa8
je 0x2005c8e9
mov ecx, dword [ecx]
xor eax, eax
cmp ecx, edx
jne 0x2005c8c9
cmp eax, ebx
je 0x2005c915
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
lea eax, [ebp - 0x58]
push 0x200a6adc
push eax
call fcn.2007d900
add esp, 0xc
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x380]
call fcn.20003a20
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x380]
push eax
lea ecx, [esi + 0x254]
call fcn.20002fc3
push ebx
lea ecx, [esi + 0x2d0]
call fcn.20014fa0
push 0x19940
call fcn.2008f9ce
pop ecx
mov dword [ebp - 0x49c], eax
mov byte [ebp - 4], 3
cmp eax, ebx
je 0x2005c959
push esi
mov ecx, eax
call fcn.20059e50
jmp 0x2005c95b
xor eax, eax
mov byte [ebp - 4], 2
mov dword [esi + 0x150], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x498]
call fcn.200223fd
mov byte [ebp - 4], bl
push ebx
push 1
lea ecx, [ebp - 0x380]
call fcn.2000275e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48c]
call fcn.2001727c
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.2007c9ae
leave
ret
Function at 0x2005edbf
Capabilities:
Create directory

Disassembly:
push esi
push edi
mov esi, 0x200a4a9c
push esi
mov ecx, 0x200cb8d8
call fcn.20003a20
mov edi, 0x200cb8f4
push esi
mov ecx, edi
call fcn.20003a20
push esi
mov ecx, 0x200cb910
call fcn.20003a20
push esi
mov ecx, 0x200cb92c
call fcn.20003a20
push dword [esp + 0xc]
mov ecx, edi
call fcn.20003a20
pop edi
pop esi
jmp fcn.2005eb04

Function at 0x2005ee06
Capabilities:
Create directory
Read .ini file

Disassembly:
mov ecx, dword [ecx + 0x2a8]
test ecx, ecx
je 0x2005ee15
jmp fcn.20042e81
mov eax, 0x200a4a9c
ret 4
Function at 0x2006146f
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x200a17b6
call fcn.2007d394
push ecx
push ebx
push esi
mov esi, ecx
push edi
lea eax, [esi + 8]
push eax
lea ecx, [ebp - 0x10]
call fcn.200011c0
xor edi, edi
mov dword [ebp - 4], edi
mov eax, dword [esi + 0x68]
mov ebx, dword [eax]
cmp dword [ebp + 8], edi
mov dword [ebp + 8], ebx
je 0x20061507
jmp 0x200614c4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebx + 0x14]
cmp eax, 0x4e20
jbe 0x200614b3
and dword [ebx + 0x1c], 0
add edi, dword [ebx + 0x1c]
lea ecx, [ebp + 8]
call fcn.2003c473
mov eax, dword [esi + 0x68]
mov ebx, dword [ebp + 8]
cmp ebx, eax
jne 0x2006149f
mov ecx, dword [esi + 0x2c]
cmp ecx, 0xc8
jb 0x200614de
mov eax, dword [esi + 0x44]
cmp ecx, eax
ja 0x200614de
add edi, eax
jmp 0x2006150e
add edi, ecx
jmp 0x2006150e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebx + 0x14]
cmp eax, 0xea60
jbe 0x200614f6
and dword [ebx + 0x18], 0
add edi, dword [ebx + 0x18]
lea ecx, [ebp + 8]
call fcn.2003c473
mov eax, dword [esi + 0x68]
mov ebx, dword [ebp + 8]
cmp ebx, eax
jne 0x200614e2
add edi, dword [esi + 0x2c]
mov dword [esi + 0x70], edi
or dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x10]
test esi, esi
je 0x20061526
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
dec dword [esi + 0x18]
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4