joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45b048
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x45b07d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004043ec
jmp 0x45b08a
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404350
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45c0f4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45c135
mov eax, esi
call fcn.00442880
test al, al
je 0x45c135
mov eax, dword [ebx + 0x84]
call fcn.0044257c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45c135
push 0
mov eax, dword [ebx + 0x84]
call fcn.0044257c
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x465a98
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x465c09
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x465be4
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x111], 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x105
lea eax, [ebp - 0x111]
push eax
lea eax, [ebp - 0x118]
mov edx, ebx
call fcn.004044e4
lea eax, [ebp - 0x118]
mov edx, 0x465c20
call fcn.004045c4
mov eax, dword [ebp - 0x118]
call fcn.004047bc
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x465b56
lea eax, [ebp - 0x111]
call fcn.004093d0
mov ecx, eax
lea edx, [ebp - 0x111]
mov eax, esi
call fcn.004043ec
jmp 0x465b5d
mov eax, esi
call fcn.004042fc
cmp bl, 0x61
jae 0x465b7e
lea edx, [ebp - 0x11c]
mov eax, dword [esi]
call fcn.0040d288
mov edx, dword [ebp - 0x11c]
mov eax, esi
call fcn.00404350
jmp 0x465b98
lea edx, [ebp - 0x120]
mov eax, dword [esi]
call fcn.0040d1fc
mov edx, dword [ebp - 0x120]
mov eax, esi
call fcn.00404350
lea eax, [ebp - 0x124]
push eax
mov eax, dword [esi]
mov dword [ebp - 0x12c], eax
mov byte [ebp - 0x128], 0xb
lea edx, [ebp - 0x12c]
xor ecx, ecx
mov eax, 0x465c2c
call fcn.00409aac
mov edx, dword [ebp - 0x124]
mov eax, esi
call fcn.00404350
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x465beb
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x46adec
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004047ac
xor eax, eax
push ebp
push 0x46aedc
push dword fs:[eax]
mov dword fs:[eax], esp
mov ax, word [esi + 4]
mov word [ebx + 4], ax
mov ax, word [esi + 6]
mov word [ebx + 6], ax
mov ax, word [esi + 8]
mov word [ebx + 8], ax
mov ax, word [esi + 0xa]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xc]
call fcn.0046beec
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x18], eax
mov ax, word [esi + 0x1c]
mov word [ebx + 0x1c], ax
mov ax, word [esi + 0x1e]
mov word [ebx + 0x1e], ax
mov ax, word [esi + 0x20]
mov word [ebx + 0x22], ax
mov ax, word [esi + 0x22]
mov word [ebx + 0x24], ax
mov ax, word [esi + 0x24]
mov word [ebx + 0x26], ax
mov eax, dword [esi + 0x26]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2a]
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [ebx + 0x30], eax
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00409218
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0046b354
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004090fc
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.0046b3c8
xor eax, eax
mov dword [ebx + 0x3c], eax
mov byte [ebx + 0x40], 0
mov byte [ebx + 0x42], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46aee3
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404320
ret
Function at 0x46aeec
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004047ac
xor eax, eax
push ebp
push 0x46afec
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebx + 4], 0
mov ax, word [esi + 4]
mov word [ebx + 6], ax
mov ax, word [esi + 6]
mov word [ebx + 8], ax
mov ax, word [esi + 8]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xa]
call fcn.0046beec
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0xe]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x12]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x16]
mov dword [ebx + 0x18], eax
mov ax, word [esi + 0x1a]
mov word [ebx + 0x1c], ax
mov ax, word [esi + 0x1c]
mov word [ebx + 0x20], ax
mov word [ebx + 0x22], 0
mov word [ebx + 0x24], 0
mov word [ebx + 0x26], 0
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [ebx + 0x30], eax
cmp dword [ebp - 4], 0
je 0x46afb2
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00409218
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0046b354
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004090fc
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.0046b3c8
jmp 0x46afc4
xor edx, edx
mov eax, ebx
call fcn.0046b354
xor edx, edx
mov eax, ebx
call fcn.0046b3c8
xor eax, eax
mov dword [ebx + 0x3c], eax
mov byte [ebx + 0x40], 0
mov byte [ebx + 0x42], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46aff3
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404320
ret

Function at 0x46c148
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004047ac
xor eax, eax
push ebp
push 0x46c1ac
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xe
lea eax, [ebp - 0x1a]
push eax
lea eax, [ebp - 4]
call fcn.0046c1b8
push eax
call sub.kernel32.dll_GetVolumeInformationA
mov edx, ebx
lea eax, [ebp - 0x1a]
call fcn.004095bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46c1b3
lea eax, [ebp - 4]
call fcn.004042fc
ret

Function at 0x47197c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov ecx, dword [edi + 0x148]
mov edx, ebx
mov eax, edi
call fcn.00471ba0
mov esi, eax
mov dword [edi + 0x148], esi
and esi, 0xff
add dword [edi + 0x14c], esi
imul esi, dword [edi + 0x14c], 0x8088405
inc esi
mov dword [edi + 0x14c], esi
mov edx, esi
shr edx, 0x18
mov ecx, dword [edi + 0x150]
mov eax, edi
call fcn.00471ba0
mov dword [edi + 0x150], eax
pop edi
pop esi
pop ebx
ret

Function at 0x4719f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x471a15
inc esi
mov eax, edi
call fcn.004719d4
xor byte [ebx], al
mov dl, byte [ebx]
mov eax, edi
call fcn.0047197c
inc ebx
dec esi
jne 0x4719ff
pop edi
pop esi
pop ebx
ret
Function at 0x471aa4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.004047ac
xor eax, eax
push ebp
push 0x471b19
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.00471a1c
mov dword [ebp - 8], 0xc
lea esi, [ebp - 0x14]
mov eax, edi
call fcn.004719d4
mov ebx, eax
xor bl, byte [esi]
mov edx, ebx
mov eax, edi
call fcn.0047197c
mov byte [esi], bl
inc esi
dec dword [ebp - 8]
jne 0x471ae4
mov bl, byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x471b20
lea eax, [ebp - 4]
call fcn.004042fc
ret
Function at 0x4724d8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4726a8
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
jle 0x472664
mov eax, dword [ebp - 4]
call fcn.00473c0c
cmp ebx, eax
jge 0x472664
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xf8]
mov edx, ebx
call fcn.0046960c
mov edx, dword [0x46a8f4]
call fcn.004036d8
mov esi, eax
mov eax, esi
call fcn.0046b2e8
test al, al
je 0x47265a
xor eax, eax
mov dword [ebp - 0x10], eax
mov edi, dword [esi + 0x3c]
test edi, edi
jne 0x47264e
xor eax, eax
push ebp
push 0x472647
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00472a50
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x110]
call fcn.004178a0
mov dword [ebp - 0x10], eax
mov edx, dword [esi + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x110]
xor ecx, ecx
mov esi, dword [eax]
call dword [esi + 0x14]
lea edx, [ebp - 0x3e]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x110]
mov ecx, 0x2e
mov esi, dword [eax]
call dword [esi + 0xc]
movzx edx, word [ebp - 0x22]
movzx eax, word [ebp - 0x20]
add edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x110]
mov cx, 1
mov esi, dword [eax]
call dword [esi + 0x14]
movzx esi, word [ebp - 0x1e]
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.00404948
mov eax, dword [ebp - 8]
call fcn.00404814
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x110]
mov ecx, esi
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x138]
mov al, byte [eax + 0x24]
mov byte [ebp - 9], al
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00472838
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x138]
mov dl, byte [ebp - 9]
mov byte [eax + 0x24], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x472692
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x110]
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
jne 0x472646
mov eax, dword [ebp - 4]
call fcn.00472ad4
ret
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.004095bc
jmp 0x472692
mov eax, dword [ebp - 8]
call fcn.004042fc
jmp 0x472692
mov dword [ebp - 0x48], ebx
mov byte [ebp - 0x44], 0
lea eax, [ebp - 0x48]
push eax
push 0
lea edx, [ebp - 0x4c]
mov eax, 0xb3
call fcn.00408b44
mov ecx, dword [ebp - 0x4c]
mov dl, 1
mov eax, dword [0x412790]
call fcn.0040c43c
call fcn.00403cb4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4726af
lea eax, [ebp - 0x4c]
call fcn.004042fc
ret
Function at 0x481aa0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x481aa8
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x481c9a
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x481cb0
mov eax, esi
call fcn.0047f92c
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.00404350
lea ecx, [ebp - 0x10]
mov edx, 0x481cc4
mov eax, esi
call fcn.0047f92c
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.00404350
lea ecx, [ebp - 0x14]
mov edx, 0x481cdc
mov eax, esi
call fcn.0047f92c
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.00404350
lea ecx, [ebp - 0x18]
mov edx, 0x481cf8
mov eax, esi
call fcn.0047f92c
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.00404350
lea ecx, [ebp - 0x1c]
mov edx, 0x481d14
mov eax, esi
call fcn.0047f92c
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.00404350
lea ecx, [ebp - 0x24]
mov edx, 0x481d2c
mov eax, esi
call fcn.0047f92c
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408384
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.00408888
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x481d44
mov eax, esi
call fcn.0047f92c
mov eax, dword [ebp - 0x28]
call fcn.00479404
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x481d54
mov eax, esi
call fcn.0047f92c
mov eax, dword [ebp - 0x2c]
call fcn.00479404
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x481d6c
mov eax, esi
call fcn.0047f92c
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.00408888
inc eax
je 0x481c3d
lea ecx, [ebp - 0x34]
mov edx, 0x481d6c
mov eax, esi
call fcn.0047f92c
mov eax, dword [ebp - 0x34]
call fcn.0040884c
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040a37c
fstp qword [ebp - 0x3c]
wait
call fcn.0040a6e0
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x481c58
lea ecx, [ebp - 0x40]
mov edx, 0x481d6c
mov eax, esi
call fcn.0047f92c
mov eax, dword [ebp - 0x40]
call fcn.00479404
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x481d7c
mov eax, esi
call fcn.0047f92c
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.00404350
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x481ca1
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00404320
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.00404320
ret
Function at 0x488a2c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x488a86
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.00488a1c
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.00478070
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.00477c70
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x488a8d
lea eax, [ebp - 4]
call fcn.004042fc
ret

Function at 0x48bfa8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
xor edx, edx
mov dword [ebp - 0x114], edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x48c07a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
push 0x1a
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x10d]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
lea eax, [ebp - 8]
lea edx, [ebp - 0x10d]
mov ecx, 0x105
call fcn.0040456c
mov eax, dword [ebp - 8]
call fcn.00408cec
test al, al
jne 0x48c011
mov eax, dword [ebp - 8]
call fcn.00408d10
lea eax, [ebp - 0x114]
push eax
mov eax, dword [ebp - 8]
call fcn.004045bc
mov edx, eax
dec edx
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.0040481c
mov eax, dword [ebp - 0x114]
mov edx, 0x48c090
call fcn.00404708
je 0x48c04f
lea eax, [ebp - 8]
mov edx, 0x48c090
call fcn.004045c4
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00404350
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c081
lea eax, [ebp - 0x114]
call fcn.004042fc
lea eax, [ebp - 8]
call fcn.004042fc
ret
Function at 0x403139
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
jne 0x403146
or eax, 0xffffffff
jmp 0x403173
mov eax, dword [0x418af8]
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x403172
push edi
mov edi, dword [0x418a50]
xor edx, edx
mov dl, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edi + edx*4]
inc ecx
dec esi
jne 0x403155
pop edi
pop esi
mov dword [0x418af8], eax
not eax
ret

Function at 0x403e09
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x10c]
push eax
call dword [0x4141e0]
xor edi, edi
lea eax, [ebp - 0x10c]
push edi
push eax
call fcn.00403c6b
cmp dword [0x4186c0], edi
pop ecx
pop ecx
mov dword [ebp - 8], edi
je 0x403ea6
push ebx
push edi
push dword [ebp + 8]
call dword [0x41424c]
mov ebx, eax
cmp ebx, edi
jl 0x403ea5
push esi
mov esi, dword [0x414260]
push 2
lea eax, [ebp - 4]
push eax
push ebx
call esi
cmp word [ebp - 4], 0x5a4d
jne 0x403e9d
push edi
mov edi, dword [0x414250]
push 0x3c
push ebx
call edi
push 4
lea eax, [ebp - 0xc]
push eax
push ebx
call esi
push 0
push dword [ebp - 0xc]
push ebx
call edi
push 2
lea eax, [ebp - 4]
push eax
push ebx
call esi
cmp word [ebp - 4], 0x4550
jne 0x403e9d
mov dword [ebp - 8], 1
push ebx
call dword [0x414130]
pop esi
pop ebx
mov eax, dword [ebp - 8]
pop edi
leave
ret
Function at 0x4011b9
Capabilities:
Get number of processors

Disassembly:
mov eax, 0x42127e
call fcn.00418d7c
push ecx
push ebx
push esi
mov ebx, 0x42dc34
push edi
mov esi, ecx
push ebx
mov dword [ebp - 0x10], esi
call fcn.00401f7f
xor edi, edi
push ebx
lea ecx, [esi + 0x10]
mov dword [ebp - 4], edi
call fcn.00401f7f
push ebx
lea ecx, [esi + 0x20]
mov byte [ebp - 4], 1
call fcn.00401f7f
push ebx
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.00401f7f
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x4c], edi
fldz
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x40], 0x4232e4
mov dword [esi + 0x50], edi
fstp qword [esi + 0x98]
mov dword [esi + 0x54], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x7c], edi
mov word [esi + 0x8c], di
mov word [esi + 0x92], di
mov dword [esi + 0x64], edi
mov dword [esi + 0x60], edi
mov word [esi + 0x94], 0x64
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40252e
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x4214d3
call fcn.00418d7c
sub esp, 0x110
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push 0xffffffffffffffff
push 0x42dc34
mov dword [ebp - 0x18], esi
mov dword [esi], ebx
mov dword [esi + 4], 1
mov dword [esi + 8], ebx
call fcn.00401fa6
pop ecx
mov dword [esi + 0xc], eax
pop ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], ebx
cmp eax, ebx
je 0x402573
mov dword [esi + 0x10], eax
jmp 0x40257a
mov dword [esi + 0x10], 0x80000001
mov dword [ebp - 0x10], ebx
push 0x20019
push str.SoftwareInstallShieldUpdate_ServiceTrace
push dword [esi + 0x10]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.0040269a
test eax, eax
jne 0x402671
lea eax, [ebp + 8]
push edi
push eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x14]
push esi
push eax
push ebx
push str.Class
mov dword [ebp - 0x18], 0x104
push dword [ebp - 0x10]
mov dword [ebp - 0x14], ebx
mov dword [ebp + 8], 4
call edi
test eax, eax
je 0x4025d0
mov dword [esi], ebx
lea eax, [ebp - 0x18]
mov dword [ebp + 8], ebx
push eax
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp + 8]
push eax
push ebx
push str.Param
push dword [ebp - 0x10]
call edi
push dword [esi + 0xc]
test eax, eax
je 0x402603
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push 0xffffffffffffffff
push str.c:ISUSTrace.TXT
jmp 0x402612
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea eax, [ebp - 0x11c]
push 0xffffffffffffffff
push eax
call fcn.00401fa6
pop ecx
mov dword [esi + 0xc], eax
pop ecx
lea eax, [ebp + 8]
push eax
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push str.Options
mov dword [ebp - 0x14], ebx
push dword [ebp - 0x10]
mov dword [ebp + 8], 4
call edi
test eax, eax
je 0x402644
mov dword [esi + 8], ebx
lea eax, [ebp + 8]
mov dword [ebp - 0x14], ebx
push eax
lea eax, [esi + 4]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push str.Channel
mov dword [ebp + 8], 4
push dword [ebp - 0x10]
call edi
test eax, eax
pop edi
je 0x402671
mov dword [esi + 4], 1
cmp dword [ebp - 0x10], ebx
je 0x40267f
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x40411e
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x421689
call fcn.00418d7c
sub esp, 0x14
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [ebp - 0x10], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi], 0x4232e4
mov edi, 0x42dc34
lea ecx, [esi + 0x10]
push edi
mov dword [ebp - 4], ebx
call fcn.00401f7f
push edi
lea ecx, [esi + 0x20]
mov byte [ebp - 4], 1
call fcn.00401f7f
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
push 0x27
push edi
mov byte [ebp - 4], 3
call fcn.00401fa6
pop ecx
mov ebx, eax
pop ecx
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
push 0x27
lea eax, [ebp - 0x20]
push ebx
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
push dword [esi + 0xc]
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call edi
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
push ebx
mov dword [esi + 0xc], eax
call edi
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x404516
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4216e0
call fcn.00418d7c
push ecx
push ebx
push esi
mov ebx, ecx
push edi
mov dword [ebp - 0x10], ebx
call fcn.00419555
mov eax, 0x424990
lea edi, [ebx + 0x10]
mov esi, eax
xor ecx, ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edi, [ebx + 0x20]
mov esi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
mov dword [ebp - 4], ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x30], ecx
mov dword [ebx + 0x34], ecx
mov ecx, ebx
mov dword [ebx], 0x4236c8
mov dword [ebx + 0xc], eax
call fcn.0040462c
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x404576
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4216f4
call fcn.00418d7c
push ecx
push ebx
push esi
mov ebx, ecx
push edi
mov dword [ebp - 0x10], ebx
call fcn.00419555
mov esi, dword [ebp + 8]
and dword [ebp - 4], 0
mov dword [ebx], 0x4236c8
mov eax, dword [esi + 0xc]
mov dword [ebx + 0xc], eax
push dword [esi + 0x30]
call fcn.00419720
inc eax
push eax
call fcn.00418e6d
mov dword [ebx + 0x30], eax
push dword [esi + 0x30]
push eax
call fcn.00419630
push dword [esi + 0x34]
call fcn.00419720
inc eax
push eax
call fcn.00418e6d
mov dword [ebx + 0x34], eax
push dword [esi + 0x34]
push eax
call fcn.00419630
add esp, 0x20
add esi, 0x20
lea edi, [ebx + 0x20]
mov eax, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [eax + 0x10]
lea edi, [ebx + 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0xc]
mov eax, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4