joyce8/EMBER2024-capa huggingface dataset:
Function at 0x471ff0
Capabilities:
Access peb ldr_data
Get common file path
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5ad619
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6b06f8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x2c]
xor esi, esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x18], esi
mov eax, dword [0x6c7718]
mov edx, dword [eax + 0xc]
mov ecx, 0x6c7718
call edx
add eax, 0x10
mov dword [ebp], eax
mov dword [esp + 0x24], esi
mov edi, 0x400
lea ebx, [esp + 0x14]
mov dword [esp + 0x18], 1
call fcn.00471d20
mov dword [esp + 0x24], 2
mov ecx, dword [esp + 0x30]
mov esi, dword [esp + 0x14]
mov eax, dword [esi]
push 1
push ecx
push eax
xor ebx, ebx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x47209e
mov edx, dword [esi]
cmp edx, ebx
jne 0x472081
xor eax, eax
jmp 0x472095
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x472086
sub eax, edi
sar eax, 1
push eax
push edx
mov eax, ebp
call fcn.0040b33c
mov byte [esp + 0x24], bl
add dword [esi + 8], 0xffffffff
jne 0x4720bc
xor edi, edi
call fcn.00471e10
push esi
call fcn.00573721
add esp, 4
mov dword [esp + 0x14], ebx
mov eax, ebp
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x472680
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x5b0132
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
mov eax, dword [0x6b06f8]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov eax, dword [0x6c7718]
mov edx, dword [eax + 0xc]
mov ecx, 0x6c7718
call edx
add eax, 0x10
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], 1
mov eax, 0x670fd0
test eax, 0xffff0000
jne 0x4726f6
mov ecx, eax
movzx esi, cx
push esi
call fcn.00402e8e
add esp, 4
cmp eax, ebx
je 0x472705
push esi
push eax
lea edx, [esp + 0x18]
push edx
call fcn.0040cde1
jmp 0x472705
push ebx
push 0x670fd0
lea eax, [esp + 0x18]
call fcn.0040b33c
mov dword [esp + 0x20], 2
lea ebp, [edi + 0xc]
lea eax, [esp + 0x10]
mov ecx, ebp
call fcn.004723b0
mov dword [esp + 0x20], ebx
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47273f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp byte [edi + 8], 0
jne 0x472778
mov eax, dword [edi]
push ebp
push eax
mov byte [edi + 8], 1
call ebx
mov esi, eax
mov eax, dword [edi + 0x260]
cmp esi, eax
je 0x47276d
cmp eax, 0xffffffff
je 0x47276d
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [edi + 0x260], esi
cmp esi, 0xffffffff
jmp 0x47278d
mov eax, dword [edi + 0x260]
cmp eax, 0xffffffff
je 0x4727a5
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x4727a5
lea esi, [edi + 0x38]
call fcn.0046eca0
test al, al
jne 0x472745
lea eax, [edi + 4]
mov ecx, ebp
call fcn.004723b0
mov esi, dword [esp + 0x28]
push ebp
push esi
call fcn.004727e0
mov dword [esp + 0x20], 0
mov dword [esp + 0x14], 1
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
Function at 0x472860
Capabilities:
Compare security identifiers

Disassembly:
push 0xffffffffffffffff
push 0x5a5a38
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x6b06f8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
xor esi, esi
cmp dword [ebx], esi
je 0x472928
mov dword [esp + 0xc], esi
mov dword [esp + 0x1c], esi
mov eax, dword [esp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esp + 0x10], esi
cmp eax, esi
je 0x4728b0
push eax
call edi
mov dword [esp + 0xc], esi
mov edx, dword [esp + 0x24]
lea eax, [esp + 0xc]
push eax
push esi
push esi
push esi
lea ecx, [esp + 0x20]
push ecx
push 1
push 1
push edx
call dword [sym.imp.ADVAPI32.dll_GetSecurityInfo]
test eax, eax
jne 0x472915
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x472915
cmp dword [esp + 0xc], esi
je 0x472915
mov ecx, dword [ebx]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x472915
mov dword [esp + 0x1c], 0xffffffff
mov eax, dword [esp + 0xc]
cmp eax, esi
je 0x4728ff
push eax
call edi
mov al, 1
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret 4
mov dword [esp + 0x1c], 0xffffffff
mov eax, dword [esp + 0xc]
cmp eax, esi
je 0x472928
push eax
call edi
xor al, al
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret 4

Function at 0x472b00
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebx
xor ebx, ebx
push ebp
push edi
cmp dword [esi + 0x34], ebx
ja 0x472b14
cmp dword [esi + 0x30], 0x40
jbe 0x472c18
mov edi, dword [esi + 0x28]
mov ebp, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 0x40
push edi
call ebp
test eax, eax
jne 0x472c1d
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x472c1d
mov byte [esi + 0x38], 1
mov eax, dword [edi + 0x3c]
mov edi, dword [esi + 0x34]
xor ecx, ecx
lea edx, [eax + 0xf8]
cmp edi, ecx
jb 0x472c18
ja 0x472b5f
mov ecx, dword [esi + 0x30]
cmp ecx, edx
jbe 0x472c18
mov edx, dword [esi + 0x28]
add eax, edx
push 0xf8
push eax
mov dword [esi + 0x24], eax
call ebp
test eax, eax
jne 0x472c1d
mov eax, dword [esi + 0x24]
cmp dword [eax], 0x4550
jne 0x472c1d
mov ecx, 0x2000
test word [eax + 0x16], cx
jne 0x472b95
mov byte [esi + 0x44], 1
mov edx, eax
movzx eax, word [edx + 0x18]
mov ecx, 0x10b
cmp ax, cx
jne 0x472bb1
mov dword [esi + 0x40], 1
add edx, 0x78
jmp 0x472bc8
mov ecx, 0x20b
cmp ax, cx
jne 0x472bcb
mov dword [esi + 0x40], 2
add edx, 0x88
mov dword [esi + 0x20], edx
cmp dword [esi + 0x20], ebx
je 0x472c1d
mov eax, dword [esi + 0x24]
movzx ecx, word [eax + 6]
mov dword [esi + 0x3c], ecx
test ecx, ecx
je 0x472c1d
movzx edx, word [eax + 0x14]
mov ebx, dword [esi + 0x34]
lea ecx, [ecx + ecx*4]
add ecx, ecx
add ecx, ecx
add ecx, ecx
sub ecx, dword [esi + 0x28]
add ecx, edx
lea edi, [ecx + eax + 0x18]
xor ecx, ecx
cmp ebx, ecx
jb 0x472c18
ja 0x472c06
mov ecx, dword [esi + 0x30]
cmp ecx, edi
jbe 0x472c18
pop edi
mov ebx, 1
lea edx, [edx + eax + 0x18]
pop ebp
mov eax, ebx
mov dword [esi + 0x1c], edx
pop ebx
ret
mov ebx, 2
pop edi
pop ebp
mov eax, ebx
pop ebx
ret
Function at 0x472e40
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [ecx + 0x24]
push ebx
push esi
mov ecx, eax
push edi
mov edi, dword [eax + 0x28]
movzx eax, word [eax + 0x14]
lea esi, [eax + ecx + 0x18]
movzx ecx, word [ecx + 6]
xor eax, eax
test ecx, ecx
jbe 0x472e78
lea ecx, [ecx]
mov edx, dword [esi + 0xc]
cmp edi, edx
jb 0x472e70
mov ebx, dword [esi + 8]
add ebx, edx
cmp edi, ebx
jb 0x472e80
inc eax
add esi, 0x28
cmp eax, ecx
jb 0x472e60
pop edi
pop esi
xor eax, eax
pop ebx
ret 0x10
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
mov eax, esi
lea edx, [eax + 1]
jmp 0x472e90
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x472e90
sub eax, edx
push eax
mov eax, dword [esp + 0x18]
push esi
call fcn.0040b232
mov eax, dword [esp + 0x18]
mov edx, edi
sub edx, dword [esi + 0xc]
mov dword [eax], edx
mov ecx, dword [esi + 8]
mov edx, dword [esp + 0x1c]
sub ecx, edi
add ecx, dword [esi + 0xc]
mov dword [edx], ecx
mov eax, dword [esi + 0x14]
sub eax, dword [esi + 0xc]
add eax, edi
pop edi
pop esi
pop ebx
ret 0x10

Function at 0x472ed0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [eax + 0x24]
movzx edx, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
lea eax, [edx + ecx + 0x18]
xor edx, edx
test esi, esi
jbe 0x472eff
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x472ef7
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x472f01
inc edx
add eax, 0x28
cmp edx, esi
jb 0x472ee7
xor eax, eax
pop esi
pop ebx
ret

Function at 0x472f10
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [eax + 0x24]
movzx ecx, word [eax + 0x14]
push ebx
push esi
movzx esi, word [eax + 6]
xor edx, edx
lea ecx, [ecx + eax + 0x18]
test esi, esi
jbe 0x472f3f
mov eax, dword [ecx + 0xc]
cmp edi, eax
jb 0x472f37
mov ebx, dword [ecx + 8]
add ebx, eax
cmp edi, ebx
jb 0x472f44
inc edx
add ecx, 0x28
cmp edx, esi
jb 0x472f27
pop esi
xor eax, eax
pop ebx
ret
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
pop esi
add eax, edi
pop ebx
ret

Function at 0x472f50
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [ebx + 0x24]
movzx ecx, word [eax + 0x14]
push ebp
push esi
movzx esi, word [eax + 6]
xor edx, edx
lea ecx, [ecx + eax + 0x18]
test esi, esi
jbe 0x472f7f
mov eax, dword [ecx + 0xc]
cmp edi, eax
jb 0x472f77
mov ebp, dword [ecx + 8]
add ebp, eax
cmp edi, ebp
jb 0x472f84
inc edx
add ecx, 0x28
cmp edx, esi
jb 0x472f67
pop esi
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
pop esi
add eax, dword [ebx + 0x28]
pop ebp
add eax, edi
ret
Function at 0x473330
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5b3591
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push edi
mov eax, dword [0x6b06f8]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
mov edi, dword [esp + 0x28]
xor ebx, ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x10], ebx
mov eax, dword [0x6c7718]
mov edx, dword [eax + 0xc]
mov ecx, 0x6c7718
call edx
add eax, 0x10
mov dword [edi], eax
mov dword [esp + 0x20], ebx
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x10], 1
cmp eax, ebx
jbe 0x473433
cmp eax, 1
jne 0x4733f2
test esi, esi
jns 0x4733d4
lea eax, [esp + 0x14]
push ebp
push eax
mov ecx, esi
call fcn.00473070
add esp, 8
mov dword [esp + 0x20], 2
call fcn.00408484
mov dword [esp + 0x20], ebx
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x473427
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
call fcn.00473250
add esp, 4
mov dword [esp + 0x20], 4
call fcn.00408484
jmp 0x47340f
lea ecx, [esp + 0x14]
push ebp
push ecx
mov ecx, esi
call fcn.00473070
add esp, 8
mov dword [esp + 0x20], 6
call fcn.00408484
mov dword [esp + 0x20], ebx
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
or ecx, 0xffffffff
lea edx, [eax + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x473433
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x473450
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x5b6bf8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6b06f8]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, dword [esp + 0x30]
mov ebp, dword [esp + 0x2c]
mov ebx, dword [esp + 0x28]
mov dword [esp + 0x14], 0
cmp ecx, 0x64
ja 0x473582
mov eax, dword [edx]
cmp eax, 0x4e20
jg 0x473582
inc eax
mov dword [edx], eax
mov eax, dword [ebp + 4]
test eax, eax
jns 0x4734d3
push edx
mov edx, dword [esp + 0x40]
push edx
mov edx, dword [esp + 0x40]
push edx
mov edx, dword [esp + 0x40]
push edx
mov edx, dword [ebp]
push edx
push ecx
and eax, 0x7fffffff
push edi
add eax, edi
push eax
mov ecx, ebx
call fcn.004735a0
jmp 0x473584
mov esi, dword [ebp]
push edi
push ecx
lea eax, [esp + 0x38]
push eax
call fcn.00473330
add esp, 0xc
mov dword [esp + 0x20], 0
mov ebp, dword [ebp + 4]
add ebp, edi
je 0x473571
mov edi, dword [ebp]
call fcn.00472f50
mov esi, dword [esp + 0x34]
lea ecx, [esp + 0x2c]
push 0x679bd0
push ecx
mov edi, eax
call fcn.004135f4
mov byte [esp + 0x28], 1
lea edx, [esp + 0x38]
push edx
lea ecx, [esp + 0x40]
push ecx
mov esi, eax
call fcn.004135a2
add esp, 0x10
mov byte [esp + 0x20], 2
mov edx, dword [esp + 0x3c]
mov ecx, dword [ebp + 4]
push edx
push ecx
push edi
push eax
call dword [esp + 0x48]
mov bl, al
mov byte [esp + 0x20], 1
lea ecx, [esp + 0x34]
call fcn.00408461
mov byte [esp + 0x20], 0
lea ecx, [esp + 0x2c]
call fcn.00408461
mov dword [esp + 0x20], 0xffffffff
lea ecx, [esp + 0x30]
call fcn.00408461
mov al, bl
jmp 0x473584
mov dword [esp + 0x20], 0xffffffff
lea ecx, [esp + 0x30]
call fcn.00408461
mov al, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x18
Function at 0x475760
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x5a6369
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6b06f8]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, dword [esp + 0x30]
xor ebx, ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x14], ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esp + 0x28], ebx
movzx eax, word [esp + 0x34]
push 0x67891c
push eax
push ebx
mov dword [esp + 0x20], 1
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, ebx
je 0x47581d
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
cmp ebp, ebx
je 0x47581d
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
mov dword [esp + 0x34], edi
mov dword [esp + 0x28], 1
cmp edi, ebx
je 0x47580e
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, ebp
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
mov byte [esp + 0x28], 2
mov dword [esi], eax
mov dword [esi + 4], ecx
mov byte [esp + 0x28], 1
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x28], bl
cmp edi, ebx
je 0x47581d
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret

Function at 0x475840
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x5a7a94
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6b06f8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x24], ebx
push 0xc
mov dword [esp + 0x18], ebx
call fcn.005737a7
add esp, 4
mov dword [esp + 0x18], eax
mov ecx, 1
mov dword [esp + 0x24], ecx
cmp eax, ebx
je 0x475896
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ecx
jmp 0x475898
xor eax, eax
mov byte [esp + 0x24], bl
mov edi, dword [esp + 0x2c]
mov dword [edi], eax
mov dword [esp + 0x24], ebx
movzx eax, word [esp + 0x30]
push 0x67891c
push eax
push ebx
mov dword [esp + 0x20], ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, ebx
je 0x475937
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebp, eax
mov dword [esp + 0x18], ebp
mov dword [esp + 0x24], 2
cmp ebp, ebx
je 0x475928
push ebp
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
cmp edi, ebx
je 0x475924
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp eax, ebx
je 0x475924
push edi
lea ecx, [esp + 0x34]
push ecx
mov edi, eax
call fcn.00475960
add esp, 8
mov byte [esp + 0x24], 3
mov ebx, dword [esp + 0x2c]
push eax
call fcn.0042cefe
mov byte [esp + 0x24], 2
lea ebx, [esp + 0x30]
call fcn.00426993
xor ebx, ebx
mov edi, dword [esp + 0x2c]
mov byte [esp + 0x24], bl
cmp ebp, ebx
je 0x475937
push ebp
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, edi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x47b4a0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x5ad348
mov eax, dword fs:[0]
push eax
sub esp, 0x814
mov eax, dword [0x6b06f8]
xor eax, esp
mov dword [esp + 0x810], eax
push ebx
push edi
mov eax, dword [0x6b06f8]
xor eax, esp
push eax
lea eax, [esp + 0x820]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x828], ebx
mov dword [esp + 0x14], ebx
mov eax, dword [0x6c7718]
mov edx, dword [eax + 0xc]
mov ecx, 0x6c7718
mov dword [esp + 0x18], esi
call edx
add eax, 0x10
mov dword [esi], eax
mov dword [esp + 0x828], ebx
mov dword [esp + 0x14], 1
mov dword [esp + 0xc], ebx
mov dword [esp + 0x828], 2
mov eax, dword [esp + 0xc]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
je 0x47b531
push eax
call edi
mov dword [esp + 0xc], ebx
lea eax, [esp + 0xc]
push eax
push 0x20119
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x47b5ac
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x20]
push edx
push ebx
push ebx
push str.ProgramFilesDir
push eax
mov dword [esp + 0x28], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x47b5ac
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x47b5ac
shr eax, 1
xor ecx, ecx
mov word [esp + eax*2 + 0x1c], cx
lea eax, [esp + 0x1c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x47b590
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x20]
push edx
mov eax, esi
call fcn.0040b33c
mov byte [esp + 0x828], bl
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x47b5be
push eax
call edi
mov eax, esi
mov ecx, dword [esp + 0x820]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [esp + 0x810]
xor ecx, esp
call fcn.0057372c
add esp, 0x820
ret
Function at 0x483a10
Capabilities:
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x5a6274
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebp
push esi
push edi
mov eax, dword [0x6b06f8]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x38]
xor esi, esi
mov dword [esp + 0x30], esi
push 0xc
mov dword [esp + 0x18], esi
call fcn.005737a7
add esp, 4
mov dword [esp + 0x1c], eax
mov ecx, 1
mov dword [esp + 0x30], ecx
cmp eax, esi
je 0x483a69
mov dword [eax], esi
mov dword [eax + 4], esi
mov dword [eax + 8], ecx
jmp 0x483a6b
xor eax, eax
mov byte [esp + 0x30], 0
mov dword [ebp], eax
mov dword [esp + 0x30], esi
mov esi, dword [ebx]
mov edi, dword [ebp]
mov eax, dword [ebx + 4]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x20], eax
cmp esi, dword [edi + 4]
je 0x483ab6
mov eax, dword [edi]
push esi
push eax
call fcn.005765a8
mov ecx, dword [edi + 4]
add esp, 8
mov dword [edi], eax
cmp esi, ecx
jbe 0x483ab3
mov edx, esi
sub edx, ecx
push edx
add ecx, eax
push 0
push ecx
call fcn.005783f0
add esp, 0xc
mov dword [edi + 4], esi
mov eax, dword [ebp]
mov ecx, dword [eax + 4]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x10], ecx
push 5
add edx, 0xfffffff3
mov dword [esp + 0x1c], edx
mov eax, dword [eax]
lea ecx, [ebx + 8]
push ecx
lea edx, [esp + 0x20]
push edx
add ecx, 5
push ecx
lea ecx, [esp + 0x20]
push ecx
push eax
call fcn.0056d5b6
mov esi, dword [ebp]
test eax, eax
jne 0x483b36
mov edi, dword [esp + 0x10]
cmp edi, dword [esi + 4]
je 0x483b52
mov eax, dword [esi]
push edi
push eax
call fcn.005765a8
mov ecx, dword [esi + 4]
add esp, 8
mov dword [esi], eax
cmp edi, ecx
jbe 0x483b1e
mov edx, edi
sub edx, ecx
push edx
add ecx, eax
push 0
push ecx
call fcn.005783f0
add esp, 0xc
mov dword [esi + 4], edi
mov eax, ebp
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x24
ret
cmp dword [esi + 4], 0
je 0x483b52
mov eax, dword [esi]
push 0
push eax
call fcn.005765a8
add esp, 8
mov dword [esi], eax
mov dword [esi + 4], 0
mov eax, ebp
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x24
ret
Function at 0x4844a0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x5ad184
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6b06f8]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x34]
mov ebp, dword [esp + 0x30]
xor esi, esi
mov dword [esp + 0x18], esi
cmp dword [ebp], esi
jne 0x4844df
call fcn.00483d50
mov eax, dword [ebp + 4]
cmp eax, esi
jne 0x4844eb
call fcn.00483d50
push eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x34], esi
call fcn.00563cac
add esp, 4
cmp eax, 6
jne 0x4845d8
jmp 0x484510
cmp dword [esp + 0x14], 0x3e8
jg 0x4845d8
cmp dword [esp + 0x30], 3
jg 0x4845d8
push esi
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 8
mov edi, eax
call fcn.005737a7
mov esi, eax
add esp, 4
mov dword [esp + 0x1c], esi
mov dword [esp + 0x28], 1
test esi, esi
je 0x484566
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [esi], edi
mov dword [esi + 4], eax
jmp 0x484568
xor esi, esi
mov byte [esp + 0x28], 0
mov eax, dword [ebp]
push esi
push 0x483b90
push eax
call fcn.0054dac2
add esp, 0xc
nop
push 1
push 0x1388
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
cmp eax, 0xc0
je 0x484580
test eax, eax
je 0x48459d
inc dword [esp + 0x30]
mov ecx, dword [ebp]
push 0
push 0
push ecx
call fcn.0054dac2
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp + 4]
inc dword [esp + 0x14]
push edx
call fcn.0055d5fe
mov eax, dword [ebp + 4]
push eax
call fcn.00563cac
add esp, 8
xor esi, esi
cmp eax, 6
je 0x484510
cmp eax, 0x65
jne 0x484620
mov eax, dword [ebp + 4]
mov ecx, dword [ebp]
push eax
mov dword [ebx], ecx
mov dword [ebx + 4], eax
mov byte [ebx + 8], 1
call fcn.00537f5f
add esp, 4
mov dword [ebx + 0xc], eax
mov byte [ebx + 0x10], 0
mov dword [esp + 0x28], esi
mov dword [esp + 0x18], 1
mov eax, ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 8
cmp eax, 0x64
mov eax, dword [ebp + 4]
push eax
jne 0x484646
mov edx, dword [ebp]
mov dword [ebx], edx
mov dword [ebx + 4], eax
mov byte [ebx + 8], 0
call fcn.00537f5f
add esp, 4
mov dword [ebx + 0xc], eax
mov byte [ebx + 0x10], 0
jmp 0x4845fc
call fcn.0055d5fe
mov ecx, dword [ebp]
push ecx
mov esi, eax
call fcn.00546263
add esp, 8
push 0x687b04
lea edx, [esp + 0x34]
push edx
mov dword [esp + 0x38], esi
call fcn.00578185
int3