joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41baef
Capabilities:
Delete file
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
push ebx
push esi
lea eax, [ebp - 0x124]
push edi
mov esi, 0x104
push eax
mov edi, ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x41bb27
lea eax, [ebp - 0x124]
push str.C:Temp_
push eax
call fcn.004c02b0
pop ecx
pop ecx
lea eax, [ebp - 0x124]
push str.NMSSvc.log
push eax
call fcn.004c02c0
lea ecx, [ebp - 0x124]
lea eax, [edi + 0x284]
push ecx
push eax
mov dword [ebp - 0x10], eax
call fcn.004c02b0
add esp, 0x10
xor ebx, ebx
lea ecx, [ebp - 4]
mov dword [edi + 0x38c], ebx
push 0x20006
push str.AppID
push SysReAllocStringLen
mov dword [ebp - 4], ebx
call fcn.004198cc
test eax, eax
je 0x41bb8e
cmp dword [ebp - 4], ebx
je 0x41bc42
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41bc42
push 0x20019
push str.NMSSvc.EXE
push dword [ebp - 4]
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
call fcn.004198cc
test eax, eax
jne 0x41bc13
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], esi
push eax
lea eax, [ebp - 0x124]
push eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push eax
push ebx
push str.LogFile
push dword [ebp - 8]
call esi
test eax, eax
jne 0x41bbe5
lea eax, [ebp - 0x124]
push eax
push dword [ebp - 0x10]
call fcn.004c02b0
pop ecx
pop ecx
lea eax, [ebp - 0xc]
mov dword [ebp - 0x1c], ebx
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push str.Debug_Level
mov dword [ebp - 0xc], 4
push dword [ebp - 8]
call esi
test eax, eax
jne 0x41bc13
mov eax, dword [ebp - 0x18]
mov dword [edi + 0x38c], eax
cmp dword [edi + 0x38c], 2
jae 0x41bc25
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [ebp - 8], ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x41bc38
push dword [ebp - 8]
call esi
mov dword [ebp - 8], ebx
cmp dword [ebp - 4], ebx
je 0x41bc42
push dword [ebp - 4]
call esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41bfb1
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, ecx
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [esp + 0xc]
push 1
push 0
push dword [esp + 0x1c]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop esi
ret 8
Function at 0x41d5d6
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
lea eax, [ebp - 0x94]
mov dword [ebp - 0x94], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x84], 2
jne 0x41d60d
cmp dword [ebp - 0x90], 5
jne 0x41d60d
push 1
pop eax
leave
ret
xor eax, eax
leave
ret
Function at 0x41f7d3
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push ebx
push esi
mov esi, ecx
xor eax, eax
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
cmp dword [esi + 0x24], eax
mov ebx, 0x503ff0
jne 0x41f823
push str.m_pINMSEventSink___NULL
lea eax, [ebp - 0x410]
push str.ASSERT__s_
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x410]
mov ecx, ebx
push eax
push 0x168
push str.PollingThreadMgr.cpp
call fcn.00423080
xor eax, eax
cmp dword [esi + 0x34], eax
jne 0x41f858
push str.m_pcPollingObjMgr___NULL
lea eax, [ebp - 0x410]
push str.ASSERT__s_
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x410]
mov ecx, ebx
push eax
push 0x169
push str.PollingThreadMgr.cpp
call fcn.00423080
xor eax, eax
cmp dword [esi + 0x3c], eax
jne 0x41f862
cmp dword [esi + 0x40], eax
je 0x41f892
push str._m_hPollingThread__NULL____m_dwPollingThreadID__0_
lea eax, [ebp - 0x410]
push str.ASSERT__s_
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x410]
mov ecx, ebx
push eax
push 0x16a
push str.PollingThreadMgr.cpp
call fcn.00423080
xor eax, eax
push eax
push eax
push eax
push eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
xor ebx, ebx
mov dword [ebp - 0x10], eax
cmp eax, ebx
je 0x41f924
mov eax, dword [esi + 0x24]
lea ecx, [ebp - 0xc]
push ecx
push eax
push 0x4d6ae0
call dword [sym.imp.ole32.dll_CoMarshalInterThreadInterfaceInStream]
mov edi, eax
cmp edi, ebx
jl 0x41f929
mov ecx, dword [esi + 0x34]
mov dword [ebp - 8], ecx
mov eax, dword [ecx]
call dword [eax]
lea eax, [esi + 0x40]
push eax
lea eax, [ebp - 0x10]
push ebx
push eax
push 0x41dfc9
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
mov dword [esi + 0x3c], eax
je 0x41f915
push 0xffffffffffffffff
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 4]
cmp edi, ebx
jge 0x41f91a
mov ecx, esi
call fcn.0041f930
jmp 0x41f91a
mov edi, 0x8007000e
mov ecx, dword [ebp - 8]
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x41f929
mov edi, 0x8007000e
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x427070
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4cb666
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov ebp, ecx
mov eax, dword [ebp + 0x40]
xor ebx, ebx
cmp eax, ebx
mov dword [esp + 0x30], 3
jne 0x4270c9
push 0x14
call fcn.004bf598
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
mov byte [esp + 0x30], 4
je 0x4270bf
mov ecx, eax
call fcn.0046b380
jmp 0x4270c1
xor eax, eax
mov byte [esp + 0x30], 3
mov dword [ebp + 0x40], eax
push 0x64
call fcn.004bf598
mov edi, eax
add esp, 4
mov dword [esp + 0x14], edi
cmp edi, ebx
mov byte [esp + 0x30], 5
je 0x42718b
mov al, byte [esp + 0x38]
sub esp, 0x18
mov esi, esp
mov dword [esp + 0x30], esp
push ebx
mov ecx, esi
mov dword [esp + 0x38], esi
mov byte [esi], al
call fcn.00406ad6
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov ecx, dword [0x4d68ec]
lea edx, [esp + 0x98]
push ecx
push ebx
push edx
mov ecx, esi
mov byte [esp + 0x54], 6
call fcn.0040b3b2
sub esp, 0x18
lea eax, [esp + 0x98]
mov ecx, esp
mov dword [esp + 0x4c], esp
push eax
mov byte [esp + 0x64], 7
call fcn.0040907d
sub esp, 0x18
lea edx, [esp + 0x98]
mov ecx, esp
mov dword [esp + 0x68], esp
push edx
mov byte [esp + 0x7c], 8
call fcn.0040907d
sub esp, 0x18
lea eax, [esp + 0x98]
mov ecx, esp
mov dword [esp + 0x84], esp
push eax
mov byte [esp + 0x94], 9
call fcn.0040907d
mov ecx, edi
mov byte [esp + 0x90], 5
call fcn.0046b580
jmp 0x42718d
xor eax, eax
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x40]
lea edx, [esp + 0x10]
mov byte [esp + 0x30], 3
lea ecx, [eax + 4]
push edx
push 1
mov eax, dword [ecx + 8]
push eax
call fcn.0042c590
mov eax, dword [esp + 0x48]
cmp eax, ebx
je 0x4271c1
push eax
call fcn.004be17b
add esp, 4
mov dword [esp + 0x48], ebx
mov eax, dword [esp + 0x3c]
cmp eax, ebx
je 0x4271e6
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4271dd
cmp al, 0xff
je 0x4271dd
dec al
mov byte [ecx], al
jmp 0x4271e6
push ecx
call fcn.004be17b
add esp, 4
mov eax, dword [esp + 0x60]
mov dword [esp + 0x3c], ebx
cmp eax, ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
je 0x427207
push eax
call fcn.004be17b
add esp, 4
mov dword [esp + 0x60], ebx
mov eax, dword [esp + 0x54]
cmp eax, ebx
je 0x42722c
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x427223
cmp al, 0xff
je 0x427223
dec al
mov byte [ecx], al
jmp 0x42722c
push ecx
call fcn.004be17b
add esp, 4
mov eax, dword [esp + 0x78]
mov dword [esp + 0x54], ebx
cmp eax, ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], ebx
mov byte [esp + 0x30], bl
je 0x427251
push eax
call fcn.004be17b
add esp, 4
mov dword [esp + 0x78], ebx
push 1
lea ecx, [esp + 0x6c]
call fcn.00406ad6
mov eax, dword [esp + 0x90]
cmp eax, ebx
je 0x427277
push eax
call fcn.004be17b
add esp, 4
mov dword [esp + 0x90], ebx
mov ecx, dword [esp + 0x84]
cmp ecx, ebx
je 0x42729e
mov al, byte [ecx - 1]
cmp al, bl
je 0x427294
cmp al, 0xff
je 0x427294
dec al
mov byte [ecx - 1], al
jmp 0x42729e
dec ecx
push ecx
call fcn.004be17b
add esp, 4
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov eax, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0x24
ret 0x60
Function at 0x4276b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4cb6d6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
mov al, byte [esp + 3]
push ebx
push ebp
xor ebp, ebp
push esi
push edi
mov esi, ecx
mov dword [esp + 0x14], ebp
mov byte [esp + 0x34], al
mov dword [esp + 0x38], ebp
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x40], ebp
mov dword [esp + 0x30], vtable.ISOArray_unsigned_long_int_.0
push ebp
mov dword [esp + 0x6c], ebp
xor edi, edi
call fcn.00426b70
test eax, eax
jle 0x427734
push edi
mov ecx, esi
call fcn.00426cd0
mov edx, dword [esp + 0x3c]
mov eax, dword [eax + 0xb8]
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], eax
push ecx
push 1
push edx
lea ecx, [esp + 0x40]
call fcn.0042c590
push ebp
mov ecx, esi
inc edi
call fcn.00426b70
cmp edi, eax
jl 0x427700
push ebp
mov ecx, esi
xor ebx, ebx
call fcn.00426c20
test eax, eax
jle 0x4277ad
push ebx
mov ecx, esi
call fcn.00426d20
mov edi, eax
push ebp
mov ecx, edi
call fcn.00441080
test eax, eax
jle 0x427770
mov edi, dword [edi + 0xb8]
mov ecx, dword [esp + 0x3c]
lea eax, [esp + 0x18]
mov dword [esp + 0x18], edi
push eax
push 1
push ecx
jmp 0x427797
mov ecx, edi
call fcn.0043f190
test eax, eax
je 0x4277a0
mov edi, dword [edi + 0x174]
mov eax, dword [esp + 0x3c]
lea edx, [esp + 0x1c]
mov edi, dword [edi + 0xb8]
push edx
push 1
mov dword [esp + 0x24], edi
push eax
lea ecx, [esp + 0x40]
call fcn.0042c590
push ebp
mov ecx, esi
inc ebx
call fcn.00426c20
cmp ebx, eax
jl 0x427742
mov edi, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
xor edx, edx
mov esi, ecx
cmp ecx, ebp
jne 0x4277c1
xor eax, eax
jmp 0x4277c8
mov eax, edi
sub eax, ecx
sar eax, 2
cmp edx, eax
jge 0x4277fa
cmp edx, ebp
jl 0x4277e3
cmp ecx, ebp
je 0x4277e3
mov eax, edi
sub eax, ecx
sar eax, 2
cmp eax, edx
jbe 0x4277e3
mov eax, dword [esi]
jmp 0x4277e8
mov eax, dword [pe_dos_header]
cmp dword [esp + 0x14], eax
je 0x4277f4
inc edx
add esi, 4
jmp 0x4277b9
inc dword [esp + 0x14]
jmp 0x4277b5
mov dword [esp + 0x30], vtable.ISOArray_unsigned_long_int_.0
push edi
mov esi, ecx
push ecx
lea ecx, [esp + 0x3c]
mov dword [esp + 0x70], 2
call fcn.0045a920
mov dword [esp + 0x3c], esi
lea esi, [esp + 0x30]
neg esi
sbb esi, esi
lea ecx, [esp + 0x34]
and esi, ecx
mov eax, dword [esi + 4]
push eax
mov dword [esp + 0x20], eax
call fcn.004be17b
mov ecx, dword [esp + 0x64]
mov eax, dword [esp + 0x18]
add esp, 4
mov dword [esi + 4], ebp
mov dword [esi + 8], ebp
mov dword [esi + 0xc], ebp
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x5c
ret
Function at 0x42ab10
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x4cba7e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov al, byte [esp + 0x1c]
push ebx
push ebp
push esi
push edi
mov ebp, ecx
xor edi, edi
mov dword [esp + 0x14], ebp
push edi
mov byte [ebp], al
call fcn.00406ad6
mov ebx, dword [esp + 0x2c]
mov dword [ebp + 0x10], edi
mov dword [ebp + 0x14], edi
mov ecx, dword [0x4d68ec]
push ecx
push edi
push ebx
mov ecx, ebp
mov dword [esp + 0x30], edi
call fcn.0040b3b2
mov dl, byte [esp + 0x2c]
lea esi, [ebp + 0x18]
push edi
mov ecx, esi
mov dword [esp + 0x28], 1
mov dword [esp + 0x14], esi
mov byte [esi], dl
call fcn.00406ad6
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov eax, dword [0x4d68ec]
lea ecx, [ebx + 0x18]
push eax
push edi
push ecx
mov ecx, esi
mov byte [esp + 0x30], 2
call fcn.0040b3b2
mov dl, byte [esp + 0x2c]
lea esi, [ebp + 0x30]
push edi
mov ecx, esi
mov byte [esp + 0x28], 3
mov dword [esp + 0x14], esi
mov byte [esi], dl
call fcn.00406ad6
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov eax, dword [0x4d68ec]
lea ecx, [ebx + 0x30]
push eax
push edi
push ecx
mov ecx, esi
mov byte [esp + 0x30], 4
call fcn.0040b3b2
mov dl, byte [esp + 0x2c]
lea esi, [ebx + 0x48]
lea ebx, [ebp + 0x48]
mov dword [esp + 0x18], ebx
mov byte [ebx], dl
mov dword [ebx + 4], edi
mov dword [ebx + 8], edi
mov dword [ebx + 0xc], edi
mov dword [ebx + 0x10], edi
mov dword [ebx + 0x14], edi
mov ecx, dword [esi + 8]
mov edx, dword [0x4d68ec]
mov eax, ecx
mov byte [esp + 0x24], 6
cmp edx, eax
mov dword [esp + 0x10], eax
jae 0x42ac0d
mov dword [esp + 0x10], edx
mov eax, edx
cmp ebx, esi
jne 0x42ac28
push edx
push eax
mov ecx, ebx
call fcn.0040b480
push edi
push edi
mov ecx, ebx
call fcn.0040b480
jmp 0x42aca9
cmp eax, edi
jbe 0x42ac70
cmp eax, ecx
jne 0x42ac70
mov ecx, dword [esi + 4]
cmp ecx, edi
jne 0x42ac3c
mov ecx, 0x4d68e8
cmp byte [ecx - 1], 0xfe
jae 0x42ac70
push 1
mov ecx, ebx
call fcn.00406ad6
mov eax, dword [esi + 4]
cmp eax, edi
jne 0x42ac57
mov eax, 0x4d68e8
mov dword [ebx + 4], eax
mov ecx, dword [esi + 8]
mov dword [ebx + 8], ecx
mov edx, dword [esi + 0xc]
mov dword [ebx + 0xc], edx
mov cl, byte [eax - 1]
inc cl
mov byte [eax - 1], cl
jmp 0x42aca9
push 1
push eax
mov ecx, ebx
call fcn.00406a51
test al, al
je 0x42aca9
mov esi, dword [esi + 4]
cmp esi, edi
jne 0x42ac8a
mov esi, 0x4d68e8
mov ecx, dword [esp + 0x10]
mov edi, dword [ebx + 4]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, eax
push ecx
mov ecx, ebx
call fcn.0042bb00
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
mov edx, dword [eax + 0x60]
mov dword [ebp + 0x60], edx
mov eax, dword [eax + 0x64]
mov dword [ebp + 0x64], eax
mov eax, ebp
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 4
Function at 0x42cb00
Capabilities:
Get common file path
Get system information on windows

Disassembly:
mov ecx, 0x5040a8
jmp 0x42cae0
push 0xffffffffffffffff
push 0x4cbc9e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x418
mov al, byte [esp + 3]
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
mov byte [esi + 8], al
xor eax, eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push eax
push eax
mov dword [esp + 0x434], eax
mov dword [esi], vtable.CHelper.0
call ebx
mov edi, eax
push edi
call fcn.004bf598
add esp, 4
mov dword [esi + 0x24], eax
push edi
push eax
call ebx
lea eax, [esi + 0x4c]
push eax
mov dword [eax], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x42cb7b
push str..helpers.cpp
push 0x26c
push str.GetVersionEx_m_OSVersion_
lea ecx, [esp + 0x20]
push str.__s____d__in___s_
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea edx, [esi + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 0x424]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x424
ret
Function at 0x43d980
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4ccf30
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
mov al, byte [esp + 0x48]
push ebx
push ebp
push esi
mov dword [esp + 0xc], ecx
xor ebx, ebx
push edi
push ebx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], ebx
mov byte [esp + 0x1c], al
call fcn.00406ad6
mov edi, 0x503a34
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x54], ebx
mov ebp, ecx
lea ecx, [esp + 0x1c]
push ebp
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
call fcn.00406a51
test al, al
je 0x43da09
mov edi, dword [esp + 0x1c]
mov ecx, ebp
mov edx, ecx
mov esi, 0x503a34
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x20], ebp
mov byte [eax + ebp], bl
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x50], 1
mov edi, ecx
lea esi, [ecx + 0x194]
mov ecx, dword [edi + 0xdc]
call fcn.004715d0
test eax, eax
je 0x43da38
mov ecx, dword [edi + 0xdc]
push esi
call fcn.004719f0
mov al, byte [esi]
cmp al, bl
jne 0x43dae7
cmp byte [esi + 1], bl
jne 0x43dae7
cmp byte [esi + 2], bl
jne 0x43dae7
cmp byte [esi + 3], bl
jne 0x43dae7
cmp byte [esi + 4], bl
jne 0x43dae7
cmp byte [esi + 5], bl
jne 0x43dae7
mov ecx, dword [edi + 0xe4]
push 0xbeb
call fcn.00450a40
cmp eax, ebx
je 0x43db1d
lea edx, [esp + 0x30]
mov ecx, eax
push edx
call fcn.00454f10
mov ecx, dword [0x4d68ec]
mov byte [esp + 0x50], 2
push ecx
push ebx
push eax
lea ecx, [esp + 0x24]
call fcn.0040b3b2
mov eax, dword [esp + 0x40]
mov byte [esp + 0x50], 1
cmp eax, ebx
je 0x43dac0
push eax
call fcn.004be17b
add esp, 4
mov dword [esp + 0x40], ebx
mov eax, dword [esp + 0x34]
cmp eax, ebx
je 0x43db1d
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x43dadc
cmp al, 0xff
je 0x43dadc
dec al
mov byte [ecx], al
jmp 0x43db1d
push ecx
call fcn.004be17b
add esp, 4
jmp 0x43db1d
xor edx, edx
xor ecx, ecx
mov dl, byte [esi + 5]
mov cl, byte [esi + 4]
push edx
xor edx, edx
mov dl, byte [esi + 3]
push ecx
push edx
xor ecx, ecx
mov cl, byte [esi + 2]
xor edx, edx
mov dl, byte [esi + 1]
push ecx
and eax, 0xff
push edx
push eax
lea eax, [esp + 0x30]
push str._02X_02X_02X_02X_02X_02X
push eax
call fcn.00430ae0
add esp, 0x20
mov esi, dword [esp + 0x58]
mov cl, byte [esp + 0x58]
push ebx
mov byte [esi], cl
mov ecx, esi
call fcn.00406ad6
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov edx, dword [0x4d68ec]
lea eax, [esp + 0x18]
push edx
push ebx
push eax
mov ecx, esi
mov byte [esp + 0x5c], 3
call fcn.0040b3b2
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0x43db63
push eax
call fcn.004be17b
add esp, 4
mov dword [esp + 0x28], ebx
mov ecx, dword [esp + 0x1c]
cmp ecx, ebx
je 0x43db87
mov al, byte [ecx - 1]
cmp al, bl
je 0x43db7d
cmp al, 0xff
je 0x43db7d
dec al
mov byte [ecx - 1], al
jmp 0x43db87
dec ecx
push ecx
call fcn.004be17b
add esp, 4
mov ecx, dword [esp + 0x48]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x44
ret 4
Function at 0x440870
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ebp, dword [esi + 0x230]
lea edi, [esi + 0x158]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [esi + 0x150]
xor ebx, ebx
cmp ebp, edx
mov ebp, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push edi
sete bl
call ebp
test ebx, ebx
jne 0x4408b1
pop edi
pop esi
pop ebp
mov eax, 0xc1000438
pop ebx
pop ecx
ret 0x1c
mov eax, dword [esi + 0x1a8]
test eax, eax
je 0x4408c8
pop edi
pop esi
pop ebp
mov eax, 0xc100040b
pop ebx
pop ecx
ret 0x1c
lea edi, [esi + 0x20c]
push edi
mov dword [esp + 0x14], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0x170]
test eax, eax
jne 0x4408f3
push edi
call ebp
pop edi
pop esi
pop ebp
mov eax, 0xc1000411
pop ebx
pop ecx
ret 0x1c
mov ecx, esi
call fcn.00440bf0
test eax, eax
jne 0x4409b8
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
lea edi, [esi + 0x1cc]
mov dword [esi + 0x208], eax
mov dword [esi + 0x1f8], ecx
mov ecx, dword [esi + 0x18c]
mov dword [edi], eax
mov eax, dword [esp + 0x1c]
lea ebx, [esi + 0x1dc]
mov dword [esi + 0x1f4], eax
mov eax, dword [esp + 0x28]
push ebx
mov dword [esi + 0x1fc], edx
mov dword [esi + 0x200], eax
mov dword [esi + 0x204], ecx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x1d4], edx
mov edx, dword [esp + 0x28]
push ebx
mov dword [esi + 0x1d0], 0
mov dword [esi + 0x1d8], eax
mov dword [esi + 0x1fc], ecx
mov dword [esi + 0x200], edx
call ebp
lea eax, [esp + 0x18]
push eax
push 0
push edi
push 0x440c60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x1c8], eax
push ecx
call ebp
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 0x1c
push edi
call ebp
pop edi
pop esi
pop ebp
mov eax, 0xc1000417
pop ebx
pop ecx
ret 0x1c
Function at 0x452970
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4ce7e1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ecx, 0x504260
mov dword [esp + 0x14], esi
call fcn.004274e0
mov dword [esi + 4], eax
mov al, byte [esp + 0x30]
lea ebp, [esi + 0xc]
xor edi, edi
push edi
mov ecx, ebp
mov byte [ebp], al
call fcn.00406ad6
mov dword [ebp + 0x10], edi
mov dword [ebp + 0x14], edi
mov cl, byte [esp + 0x30]
lea ebx, [esi + 0x24]
push edi
mov dword [esp + 0x24], edi
mov byte [ebx], cl
mov ecx, ebx
call fcn.00406ad6
mov dword [ebx + 0x10], edi
mov dword [ebx + 0x14], edi
mov dl, byte [esp + 0x30]
lea ebx, [esi + 0x3c]
push edi
mov ecx, ebx
mov byte [esp + 0x24], 1
mov byte [ebx], dl
call fcn.00406ad6
mov dword [ebx + 0x10], edi
mov dword [ebx + 0x14], edi
mov al, byte [esp + 0x30]
lea ebx, [esi + 0x54]
push edi
mov ecx, ebx
mov byte [esp + 0x24], 2
mov byte [ebx], al
call fcn.00406ad6
mov dword [ebx + 0x10], edi
mov dword [ebx + 0x14], edi
mov dl, byte [esp + 0x30]
lea ecx, [esi + 0x6c]
push edi
mov byte [esp + 0x24], 3
mov byte [ecx], dl
call fcn.00406ad6
mov dword [esi + 0x7c], edi
mov dword [esi + 0x80], edi
mov al, byte [esp + 0x30]
lea ecx, [esi + 0x84]
push edi
mov byte [esp + 0x24], 4
mov byte [ecx], al
call fcn.00406ad6
mov dword [esi + 0x94], edi
mov dword [esi + 0x98], edi
lea edx, [esp + 0x12]
lea ecx, [esi + 0xbc]
push edx
mov byte [esp + 0x24], 5
call fcn.0041dbef
mov dword [esi + 0xcc], edi
mov dword [esi + 0xd0], edi
lea eax, [esp + 0x13]
lea ecx, [esi + 0xd8]
push eax
mov byte [esp + 0x24], 6
call fcn.004b9520
mov dword [esi + 0xd4], vtable.ISOArray_class_CSettingEnum__.0
mov ecx, esi
mov byte [esp + 0x20], 7
mov dword [esi], vtable.CSetting.0
call fcn.00453bf0
mov ecx, dword [0x4d68ec]
mov edx, dword [esp + 0x28]
push ecx
push edi
push edx
lea ecx, [esi + 0x6c]
call fcn.0040b3b2
mov eax, dword [esp + 0x2c]
push edi
mov ecx, ebx
mov dword [esi + 0xac], eax
call fcn.00445ee0
mov cl, byte [esp + 0x30]
mov dword [esi + 0x9c], edi
mov byte [esi + 0xa0], cl
mov edx, dword [0x4d68ec]
push edx
push edi
lea ecx, [esi + 0x84]
call fcn.0040b480
mov eax, dword [0x4d68ec]
mov ecx, ebp
push eax
push edi
call fcn.0040b480
mov ecx, dword [esi + 0xac]
push ecx
mov ecx, esi
call fcn.004551c0
mov ecx, dword [esp + 0x18]
mov dword [esi + 8], 1
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 0xc