joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42ed90
Capabilities:
Check if file exists
Create directory
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 8], 0
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], 0xc
push 0x104
mov ecx, dword [ebp + 8]
push ecx
push str.Temp
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x42ede0
mov dword [0x830ad0], 6
mov eax, 2
jmp 0x42ef4b
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movsx eax, byte [edx]
test eax, eax
je 0x42edff
cmp dword [ebp - 4], 0x104
jae 0x42edff
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
mov byte [ecx], 0
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movsx eax, byte [edx - 1]
cmp eax, 0x5c
je 0x42ee20
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
mov byte [ecx], 0x5c
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x42ee37
cmp dword [ebp - 0xc], 1
je 0x42ee8b
jmp 0x42eedd
push 0x4c1608
push 0x104
mov ecx, dword [ebp + 8]
push ecx
call fcn.0049cd97
add esp, 0xc
push 0x104
push str.Helper
call fcn.0042d470
add esp, 8
add eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
mov byte [edx], 0x5c
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
mov byte [ecx], 0
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
jmp 0x42eedd
push 0x4c1618
push 0x104
mov eax, dword [ebp + 8]
push eax
call fcn.0049cd97
add esp, 0xc
push 0x104
push str.DBUtil_Driver
call fcn.0042d470
add esp, 8
add eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
mov byte [ecx], 0x5c
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
mov byte [eax], 0
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x42ef05
mov eax, dword [ebp + 8]
push eax
call fcn.0042eca0
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x42ef05
mov eax, dword [ebp - 8]
jmp 0x42ef4b
lea ecx, [ebp - 0x1c]
push ecx
call fcn.0042e9c0
add esp, 4
test eax, eax
jne 0x42ef23
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x42ef4b
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x42ef48
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x42ef4b
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x42f6c0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push str.DBUTILDRVMUX
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42f6fd
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x42f6fd
mov dword [0x830ad0], 4
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x430270
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x828208]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x12c], 2
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x114], 0
cmp dword [ebp + 0xc], 0
je 0x4302cf
mov eax, 3
jmp 0x43047b
cmp dword [ebp + 0x14], 2
jge 0x4302df
mov eax, 3
jmp 0x43047b
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp + 0x18]
mov eax, dword [edx + ecx]
mov dword [ebp - 0x10c], eax
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp - 0x10c]
movsx ecx, byte [eax + edx]
test ecx, ecx
jne 0x430313
mov eax, 3
jmp 0x43047b
mov edx, 4
shl edx, 0
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax + edx]
mov dword [ebp - 0x118], ecx
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp - 0x118]
movsx edx, byte [ecx + eax]
test edx, edx
jne 0x430347
mov eax, 3
jmp 0x43047b
push 0
lea eax, [ebp - 0x108]
push eax
push 0x104
mov ecx, dword [ebp - 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0x104
jae 0x43037d
cmp dword [ebp - 0x11c], 0
jne 0x430387
mov eax, 2
jmp 0x43047b
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4303a3
mov eax, 2
jmp 0x43047b
lea eax, [ebp - 0x108]
mov dword [ebp - 0x10c], eax
mov ecx, dword [ebp - 0x114]
or ecx, 1
mov dword [ebp - 0x114], ecx
push 0x800
push 0
push str.newdev.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
jne 0x4303e3
jmp 0x43045f
push str.UpdateDriverForPlugAndPlayDevicesA
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
jne 0x430408
jmp 0x43045f
lea eax, [ebp - 0x124]
push eax
mov ecx, dword [ebp - 0x114]
push ecx
mov edx, dword [ebp - 0x10c]
push edx
mov eax, dword [ebp - 0x118]
push eax
push 0
call dword [ebp - 0x120]
test eax, eax
jne 0x430434
jmp 0x43045f
cmp dword [ebp - 0x124], 0
je 0x430449
mov dword [ebp - 0x128], 1
jmp 0x430453
mov dword [ebp - 0x128], 0
mov ecx, dword [ebp - 0x128]
mov dword [ebp - 0x12c], ecx
cmp dword [ebp - 0x110], 0
je 0x430475
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048980e
mov esp, ebp
pop ebp
ret
Function at 0x43b3c0
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.0043bf50
movzx eax, al
test eax, eax
jne 0x43b593
lea ecx, [ebp + 8]
call fcn.0040bc50
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x10
je 0x43b58a
push 0x5c
lea ecx, [ebp + 8]
call fcn.0040ba80
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x43b439
push 0x2f
lea ecx, [ebp + 8]
call fcn.0040ba80
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x43b439
mov dword [ebp - 0x1c], 0xf
lea ecx, [ebp + 8]
call fcn.0040bb10
mov eax, dword [ebp - 0x1c]
jmp 0x43b5ab
mov ecx, dword [ebp - 0xc]
push ecx
lea edx, [ebp - 0x14]
push edx
lea ecx, [ebp + 8]
call fcn.0040ba00
lea ecx, [ebp - 0x14]
call fcn.0040bc50
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x43b46d
mov dword [ebp - 4], 0xf
jmp 0x43b580
mov eax, dword [ebp - 0x18]
and eax, 0x400
je 0x43b49f
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
lea edx, [ebp - 0x14]
push edx
call fcn.0040bc10
call fcn.0043b8a0
add esp, 4
cmp eax, 0x17
jne 0x43b49f
mov dword [ebp - 4], 0x13
jmp 0x43b580
cmp dword [ebp - 0x10], 0xffffffff
jne 0x43b4e9
push 0
push 0x80
push 1
mov eax, dword [ebp + 0xc]
push eax
push 0
push 0xc0000000
lea ecx, [ebp + 8]
call fcn.0040bc50
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x43b4da
mov dword [ebp - 4], 0xd
jmp 0x43b4e4
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x43b580
mov edx, dword [ebp - 0x10]
and edx, 0x400
je 0x43b580
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
lea eax, [ebp + 8]
push eax
call fcn.0040bc10
call fcn.0043b8a0
add esp, 4
cmp eax, 0x14
jne 0x43b579
movzx ecx, byte [ebp + 0x10]
test ecx, ecx
je 0x43b579
lea ecx, [ebp + 8]
call fcn.0040bc50
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x43b570
push 0
push 0x80
push 1
mov edx, dword [ebp + 0xc]
push edx
push 0
push 0xc0000000
lea ecx, [ebp + 8]
call fcn.0040bc50
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x43b564
mov dword [ebp - 4], 0xd
jmp 0x43b56e
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x43b577
mov dword [ebp - 4], 0xe
jmp 0x43b580
mov dword [ebp - 4], 0x12
lea ecx, [ebp - 0x14]
call fcn.0040bb10
jmp 0x43b591
mov dword [ebp - 4], 0xf
jmp 0x43b59a
mov dword [ebp - 4], 0xf
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x20], ecx
lea ecx, [ebp + 8]
call fcn.0040bb10
mov eax, dword [ebp - 0x20]
mov esp, ebp
pop ebp
ret
Function at 0x43dbc0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
movzx eax, byte [0x83501e]
cmp eax, 1
jne 0x43dbea
mov al, byte [0x83501f]
jmp 0x43dcb5
mov dword [ebp - 4], 0
jmp 0x43dbfc
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 2
jge 0x43dc1c
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov edx, dword [ebp - 4]
mov dword [edx*4 + 0x834ff0], eax
jmp 0x43dbf3
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x834fec], eax
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x834fe4], eax
push str.Calling_CreateThread_n
call fcn.0043dd40
add esp, 4
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0x43f0e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x834fe8], eax
push 0xffffffffffffffff
mov ecx, dword [0x834fe4]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x43dc8c
cmp dword [ebp - 8], 0x80
jne 0x43dc99
push str.Something_wrong_in_the_thread_n
call fcn.0043dd40
add esp, 4
cmp dword [0x834fe8], 0
je 0x43dca9
mov byte [0x83501f], 1
mov byte [0x83501e], 1
mov al, byte [0x83501f]
mov esp, ebp
pop ebp
ret
Function at 0x43dd50
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b9968
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x828208]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x835010
call fcn.0040bc50
test eax, eax
je 0x43dd8d
mov ecx, 0x835010
call fcn.0043ff40
push 0xc
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jge 0x43ddbd
cmp dword [ebp - 0x14], 0x80010106
je 0x43ddbd
push str.Error_initializing_COM___n
call fcn.0043dd40
add esp, 4
xor al, al
jmp 0x43df53
cmp dword [ebp - 0x14], 0
jne 0x43de07
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jge 0x43de07
cmp dword [ebp - 0x14], 0x80010119
je 0x43de07
push 0x4c5120
call fcn.0043dd40
add esp, 4
call dword [sym.imp.ole32.dll_CoUninitialize]
xor al, al
jmp 0x43df53
lea ecx, [ebp - 0x18]
call fcn.0043f7e0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00402540
push eax
push 0x4d1128
push 1
push 0
push 0x4d1138
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jge 0x43de6a
push str.Failed_to_create_IWbemLocator_object._n
call fcn.0043dd40
add esp, 4
call dword [sym.imp.ole32.dll_CoUninitialize]
mov byte [ebp - 0xd], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0041eed0
mov al, byte [ebp - 0xd]
jmp 0x43df53
push 0x4c516c
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x18]
call fcn.0040bc50
mov dword [ebp - 0x1c], eax
mov ecx, 0x835010
call fcn.00402540
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
mov ecx, dword [eax + 0xc]
call ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jge 0x43dee0
push str.Could_not_connect._n
call fcn.0043dd40
add esp, 4
call dword [sym.imp.ole32.dll_CoUninitialize]
mov byte [ebp - 0xe], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0041eed0
mov al, byte [ebp - 0xe]
jmp 0x43df53
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
mov ecx, 0x835010
call fcn.0040bc50
push eax
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jge 0x43df3d
push str.Could_not_set_proxy_blanket._n
call fcn.0043dd40
add esp, 4
call dword [sym.imp.ole32.dll_CoUninitialize]
mov byte [ebp - 0xf], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0041eed0
mov al, byte [ebp - 0xf]
jmp 0x43df53
mov byte [ebp - 0x10], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0041eed0
mov al, byte [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x444040
Capabilities:
Get system firmware table

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
cmp dword [0x835034], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
jne 0x444185
mov ebx, dword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
push 0
push 0
push 0
push 0x52534d42
call ebx
mov esi, eax
push esi
call fcn.00489f55
add esp, 4
mov edi, eax
push esi
push edi
push 0
push 0x52534d42
call ebx
movzx ecx, byte [edi + 1]
lea ebx, [edi + 8]
mov word [0x835028], cx
mov dword [ebp - 0xc], ebx
movzx esi, byte [ebx + 1]
mov byte [ebp - 1], 0xff
add esi, ebx
nop
cmp byte [esi], 0
jne 0x4440ab
cmp byte [esi + 1], 0
je 0x4440ae
inc esi
jmp 0x4440a0
mov eax, esi
sub eax, ebx
lea ebx, [eax + 1]
push ebx
call fcn.00489f55
add esp, 4
mov edi, eax
test ebx, ebx
je 0x4440e7
test edi, edi
jne 0x4440da
call fcn.0049ba15
mov dword [eax], 0x16
call fcn.0049b7df
jmp 0x4440e7
push ebx
push dword [ebp - 0xc]
push edi
call fcn.0048f9d0
add esp, 0xc
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 1]
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
lea ebx, [esi + 2]
push edi
mov dword [ebp - 0xc], ebx
call fcn.004421a0
test al, al
je 0x44418e
mov esi, dword [0x835030]
mov eax, esi
mov dl, byte [ebp - 1]
mov ecx, dword [eax + 4]
cmp byte [ecx + 0xd], 0
jne 0x44413e
cmp byte [ecx + 0x10], dl
jae 0x44412b
mov ecx, dword [ecx + 8]
jmp 0x44412f
mov eax, ecx
mov ecx, dword [ecx]
cmp byte [ecx + 0xd], 0
je 0x444121
cmp eax, esi
je 0x44413e
cmp dl, byte [eax + 0x10]
jae 0x444140
mov eax, esi
cmp eax, esi
mov esi, dword [ebp - 8]
jne 0x444172
lea eax, [ebp - 0x18]
mov byte [ebp - 0x18], dl
push eax
mov ecx, 0x835030
mov dword [ebp - 0x14], esi
call fcn.004407f0
push eax
add eax, 0x10
mov ecx, 0x835030
push eax
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.00440990
jmp 0x44417b
mov ecx, dword [eax + 0x14]
push esi
mov eax, dword [ecx]
call dword [eax + 8]
cmp byte [esi + 0xc], 0x7f
jne 0x444095
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 8], 0
jne 0x44419d
push edi
call fcn.00489f8e
add esp, 4
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4441b0
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ba3df
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x828208]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [ebp - 0x20]
mov dword [ebp - 0x18], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x18]
mov word [ebp - 0x14], 0x500
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x444252
mov esi, dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
push 0
push 0
push eax
push 0
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push 0
push esi
call fcn.00440510
push eax
call fcn.00440b10
add esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, 0xd
jmp 0x444365
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
push eax
push dword [ebp - 0x20]
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x444210
cmp dword [ebp - 0x1c], 1
je 0x44427c
mov eax, 0xd
jmp 0x444365
mov ecx, esi
call fcn.00444390
mov byte [esi + 0x18], al
test al, al
jne 0x444294
mov eax, 9
jmp 0x444365
mov ecx, esi
call fcn.00444040
test al, al
jne 0x4442a9
mov eax, 0xb
jmp 0x444365
mov ecx, esi
call fcn.00443a90
test al, al
jne 0x4442be
mov eax, 0xa
jmp 0x444365
mov ecx, esi
call fcn.00444680
test al, al
jne 0x4442d3
mov eax, 0x10
jmp 0x444365
cmp word [0x835028], 2
jbe 0x444363
cmp byte [ebp + 8], 1
jne 0x444363
push 0xda
mov ecx, esi
call fcn.00443ff0
test eax, eax
je 0x444382
push 0
push 0x82a404
push 0x82a3e8
push 0
push eax
call fcn.00491ac9
mov edi, eax
add esp, 0x14
test edi, edi
je 0x444382
cmp dword [esi + 0x20], 0
jne 0x444363
push 0x18
call fcn.00489f5e
add esp, 4
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x44435e
push dword [ebp + 0x10]
xorps xmm0, xmm0
mov ecx, eax
push dword [ebp + 0xc]
movups xmmword [eax], xmm0
push 0x83502c
movq qword [eax + 0x10], xmm0
push dword [0x835024]
push 0
push edi
call fcn.00471cc0
jmp 0x444360
xor eax, eax
mov dword [esi + 0x20], eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048980e
mov esp, ebp
pop ebp
ret 0xc
mov eax, 0xf
jmp 0x444365
Function at 0x449090
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4baa77
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x828208]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
cmp dword [ebp + 0xc], 0
mov dword [ebp - 0x10], 0
je 0x4490ec
mov dword [esi], 0x4c5e88
mov dword [esi + 0x10], 0x4c5e90
mov dword [esi + 0x68], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
push 0
lea edi, [esi + 0x18]
mov ecx, esi
push edi
call fcn.00448ec0
mov eax, dword [esi]
push 8
mov dword [ebp - 4], 1
mov dword [ebp + 0xc], edi
mov eax, dword [eax + 4]
mov dword [esi + eax], vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ecx + esi - 4], eax
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00489f5e
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x44914b
xorps xmm0, xmm0
movq qword [ebx], xmm0
push 1
mov byte [ebp - 4], 2
call fcn.0048c4a2
add esp, 4
mov dword [ebx + 4], eax
jmp 0x44914d
xor ebx, ebx
lea eax, [edi + 4]
mov dword [edi + 0x34], ebx
mov dword [edi + 0xc], eax
lea ecx, [edi + 8]
mov ebx, dword [ebp + 8]
lea eax, [edi + 0x14]
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [edi + 0x10], ecx
mov dword [ecx], 0
mov ecx, ebx
mov eax, dword [edi + 0x20]
not ecx
and ecx, 1
shl ecx, 2
mov edx, ecx
mov dword [eax], 0
or edx, 2
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, ebx
and al, 2
mov dword [edi], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, ebx
mov dword [edi + 0x38], 0
cmovne edx, ecx
mov ecx, edx
or ecx, 8
and al, 8
cmove ecx, edx
mov eax, ecx
or eax, 0x10
and bl, 4
cmove eax, ecx
mov dword [edi + 0x3c], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x486440
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bdff0
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x828208]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x68], 0x4cd7c8
mov dword [ebp - 0x38], eax
mov word [ebp - 0x34], ax
mov byte [ebp - 0x32], al
mov dword [ebp - 0x30], eax
mov word [ebp - 0x2c], ax
mov byte [ebp - 0x2a], al
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
lea edx, [ebp - 0x68]
mov eax, dword [ecx]
push edx
call dword [eax + 0x10]
movzx eax, byte [ebp - 0x32]
push 0x4cba54
push dword [ebp - 0x30]
push 0x4dc178
push eax
movzx eax, byte [ebp - 0x33]
push 0x4c9690
push eax
movzx eax, byte [ebp - 0x34]
push 0x4c9690
push eax
movzx eax, word [ebp - 0x38]
push 0x4cba54
push eax
movzx eax, byte [ebp - 0x36]
push 0x4cb768
push eax
movzx eax, byte [ebp - 0x35]
push 0x4cb768
push eax
push str.Time_:
push 0x835458
call fcn.00440510
add esp, 8
mov ecx, eax
call fcn.0044b3d0
push eax
call fcn.00440510
add esp, 8
mov ecx, eax
call fcn.0044b3d0
push eax
call fcn.00440510
add esp, 8
mov ecx, eax
call fcn.0044b3d0
push eax
call fcn.00440510
add esp, 8
mov ecx, eax
call fcn.0044b3d0
push eax
call fcn.00440510
add esp, 8
mov ecx, eax
call fcn.0044b3d0
push eax
call fcn.00440510
add esp, 8
mov ecx, eax
call fcn.0044b3d0
push eax
call fcn.00440510
add esp, 8
mov ecx, eax
call fcn.00441d80
push eax
call fcn.00440510
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
push eax
push 0x835710
call fcn.00475b90
mov esi, eax
add esp, 0x14
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
mov ecx, dword [ecx + esi + 0x30]
mov ecx, dword [ecx + 4]
mov byte [ebp - 4], 1
mov dword [ebp - 0x6c], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 2
push eax
call fcn.00476070
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0xa
call dword [edx + 0x30]
movzx edi, ax
mov ecx, dword [ebp - 0x6c]
mov byte [ebp - 4], 3
test ecx, ecx
je 0x486611
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
je 0x486611
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
push edi
mov ecx, esi
mov byte [ebp - 4], 0
call fcn.004796a0
mov ecx, esi
call fcn.00479540
lea ecx, [ebp - 0x68]
call fcn.00486380
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048980e
mov esp, ebp
pop ebp
ret