joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d6374
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040546c
xor eax, eax
push ebp
push 0x4d647d
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebx + 4], 0
mov ax, word [esi + 4]
mov word [ebx + 6], ax
mov ax, word [esi + 6]
mov word [ebx + 8], ax
mov ax, word [esi + 8]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xa]
call fcn.004d7c90
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0xe]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x12]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x16]
mov dword [ebx + 0x18], eax
mov ax, word [esi + 0x1a]
mov word [ebx + 0x1c], ax
mov ax, word [esi + 0x1c]
mov word [ebx + 0x20], ax
mov word [ebx + 0x22], 0
mov word [ebx + 0x24], 0
mov word [ebx + 0x26], 0
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
cmp dword [ebp - 4], 0
je 0x4d6443
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040ca34
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004d6c58
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040c918
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004d6ccc
jmp 0x4d6455
xor edx, edx
mov eax, ebx
call fcn.004d6c58
xor edx, edx
mov eax, ebx
call fcn.004d6ccc
xor eax, eax
mov dword [ebx + 0x44], eax
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d6484
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404fe0
ret

Function at 0x4d7ef4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040546c
xor eax, eax
push ebp
push 0x4d7f52
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 4]
call fcn.004d7fd0
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
je 0x4d7f3a
lea eax, [ebp - 4]
call fcn.004d7fd0
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 5
jne 0x4d7f3c
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d7f59
lea eax, [ebp - 4]
call fcn.00404fbc
ret

Function at 0x4d7f60
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040546c
xor eax, eax
push ebp
push 0x4d7fc4
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xe
lea eax, [ebp - 0x1a]
push eax
lea eax, [ebp - 4]
call fcn.004d7fd0
push eax
call sub.kernel32.dll_GetVolumeInformationA
mov edx, ebx
lea eax, [ebp - 0x1a]
call fcn.0040ce28
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d7fcb
lea eax, [ebp - 4]
call fcn.00404fbc
ret
Function at 0x4dd4fc
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov ecx, dword [edi + 0x170]
mov edx, ebx
mov eax, edi
call fcn.004dd730
mov esi, eax
mov dword [edi + 0x170], esi
and esi, 0xff
add dword [edi + 0x174], esi
imul esi, dword [edi + 0x174], 0x8088405
inc esi
mov dword [edi + 0x174], esi
mov edx, esi
shr edx, 0x18
mov ecx, dword [edi + 0x178]
mov eax, edi
call fcn.004dd730
mov dword [edi + 0x178], eax
pop edi
pop esi
pop ebx
ret

Function at 0x4dd570
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x4dd595
inc esi
mov eax, edi
call fcn.004dd554
xor byte [ebx], al
mov dl, byte [ebx]
mov eax, edi
call fcn.004dd4fc
inc ebx
dec esi
jne 0x4dd57f
pop edi
pop esi
pop ebx
ret

Function at 0x4dd624
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.0040546c
xor eax, eax
push ebp
push 0x4dd699
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.004dd59c
mov dword [ebp - 8], 0xc
lea esi, [ebp - 0x14]
mov eax, edi
call fcn.004dd554
mov ebx, eax
xor bl, byte [esi]
mov edx, ebx
mov eax, edi
call fcn.004dd4fc
mov byte [esi], bl
inc esi
dec dword [ebp - 8]
jne 0x4dd664
mov bl, byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dd6a0
lea eax, [ebp - 4]
call fcn.00404fbc
ret
Function at 0x4de25c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4de440
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
jle 0x4de3fc
mov eax, dword [ebp - 4]
call fcn.004dfbe4
cmp ebx, eax
jge 0x4de3fc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x118]
mov edx, ebx
call fcn.004d4930
mov edx, dword [0x4d5d0c]
call fcn.00404368
mov esi, eax
mov eax, esi
call fcn.004d6bec
test al, al
je 0x4de3f2
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov edi, dword [esi + 0x44]
test edi, edi
jne 0x4de3e6
xor eax, eax
push ebp
push 0x4de3df
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004de814
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
call fcn.0041f128
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push dword [esi + 0x34]
push dword [esi + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
lea edx, [ebp - 0x46]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, 0x2e
mov esi, dword [eax]
call dword [esi + 0xc]
movzx eax, word [ebp - 0x2a]
movzx edx, word [ebp - 0x28]
add eax, edx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x18]
movzx esi, word [ebp - 0x26]
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.00405608
mov eax, dword [ebp - 8]
call fcn.004054d4
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, esi
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
mov al, byte [eax + 0x28]
mov byte [ebp - 9], al
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004de5d8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
mov dl, byte [ebp - 9]
mov byte [eax + 0x28], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4de42a
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
jne 0x4de3de
mov eax, dword [ebp - 4]
call fcn.004de898
ret
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.0040ce28
jmp 0x4de42a
mov eax, dword [ebp - 8]
call fcn.00404fbc
jmp 0x4de42a
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x4c], 0
lea eax, [ebp - 0x50]
push eax
push 0
lea edx, [ebp - 0x54]
mov eax, 0xb3
call fcn.0040c350
mov ecx, dword [ebp - 0x54]
mov dl, 1
mov eax, dword [0x419cfc]
call fcn.0041020c
call fcn.0040494c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4de447
lea eax, [ebp - 0x54]
call fcn.00404fbc
ret
Function at 0x4eb0f8
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
xor ebx, ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.0040546c
mov eax, dword [ebp - 8]
call fcn.0040546c
xor eax, eax
push ebp
push 0x4eb1d5
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 8]
call fcn.0040c918
mov eax, dword [ebp - 0x2c]
push eax
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 4]
call fcn.0040c918
mov eax, dword [ebp - 0x30]
pop edx
call fcn.0040ba80
test eax, eax
jne 0x4eb161
mov dword [ebp - 0x22], 4
jmp 0x4eb168
mov dword [ebp - 0x22], 1
lea eax, [ebp - 0x34]
mov ecx, 0x4eb1ec
mov edx, dword [ebp - 4]
call fcn.004052c8
mov eax, dword [ebp - 0x34]
call fcn.0040547c
mov dword [ebp - 0x1e], eax
lea eax, [ebp - 0x38]
mov ecx, 0x4eb1ec
mov edx, dword [ebp - 8]
call fcn.004052c8
mov eax, dword [ebp - 0x38]
call fcn.0040547c
mov dword [ebp - 0x1a], eax
mov word [ebp - 0x16], 0x410
lea eax, [ebp - 0x26]
push eax
call sub.shell32.dll_SHFileOperationA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4eb1dc
lea eax, [ebp - 0x38]
mov edx, 4
call fcn.00404fe0
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404fe0
ret
Function at 0x4ef4cc
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4ef56e
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
lea ebx, [esi + 0x41]
lea eax, [ebp - 8]
mov edx, ebx
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 8]
lea eax, [ebp - 0xc]
call fcn.00403910
mov edx, 0x4ef57c
lea eax, [ebp - 0xc]
mov cl, 2
call fcn.004038e0
lea edx, [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.00405220
mov eax, dword [ebp - 4]
call fcn.0040547c
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp ax, 3
jne 0x4ef54a
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.004051a4
mov edx, dword [ebp - 0x10]
mov eax, edi
call fcn.00405284
inc esi
cmp esi, 0x1a
jne 0x4ef4ef
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ef575
lea eax, [ebp - 0x10]
call fcn.00404fbc
lea eax, [ebp - 4]
call fcn.00404fbc
ret
Function at 0x4f253c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe18
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x1e8], ebx
mov dword [ebp - 0x1c4], ebx
mov dword [ebp - 0x1c0], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040546c
mov eax, dword [ebp - 8]
call fcn.0040546c
mov eax, dword [ebp + 0x14]
call fcn.0040546c
xor eax, eax
push ebp
push 0x4f2789
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
lea eax, [ebp - 0x54]
xor ecx, ecx
mov edx, 0x44
call fcn.00403a2c
cmp byte [ebx + 0x29], 0
je 0x4f2607
lea ecx, [ebp - 0x1c0]
mov edx, 0x4f27a4
mov eax, dword [ebx + 0x10]
call fcn.0049bdd8
mov edx, dword [ebp - 0x1c0]
lea eax, [ebp - 0x1bc]
mov ecx, 0xff
call fcn.00405258
lea edx, [ebp - 0x1bc]
lea eax, [ebp - 0x9d]
mov cl, 0x1e
call fcn.0040391c
lea ecx, [ebp - 0x1c4]
mov edx, 0x4f27a4
mov eax, dword [ebx + 0x18]
call fcn.0049bdd8
mov eax, dword [ebp - 0x1c4]
xor edx, edx
call fcn.0049c730
mov dword [ebp - 0x7c], eax
jmp 0x4f263a
lea eax, [ebp - 0x1bc]
mov edx, dword [ebx + 0x10]
mov ecx, 0xff
call fcn.00405258
lea edx, [ebp - 0x1bc]
lea eax, [ebp - 0x9d]
mov cl, 0x1e
call fcn.0040391c
xor edx, edx
mov eax, dword [ebx + 0x18]
call fcn.0049c730
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x1bc]
mov edx, dword [ebx + 0xc]
mov ecx, 0xff
call fcn.00405258
lea edx, [ebp - 0x1bc]
lea eax, [ebp - 0xbc]
mov cl, 0x1e
call fcn.0040391c
mov eax, dword [0x4ffac8]
mov al, byte [eax]
mov byte [ebp - 0x78], al
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x54]
push eax
call sub.kernel32.dll_GetStartupInfoA_1
mov word [ebp - 0x24], 5
mov dword [ebp - 0x28], 0x10
mov dword [ebp - 0x2c], 0x18
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1e4], eax
mov byte [ebp - 0x1e0], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1dc], eax
mov byte [ebp - 0x1d8], 0xb
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1d4], eax
mov byte [ebp - 0x1d0], 0xb
lea ecx, [ebp - 0x1e8]
lea eax, [ebp - 0xbc]
mov edx, 0x58
call fcn.0049c14c
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x1cc], eax
mov byte [ebp - 0x1c8], 0xb
lea edx, [ebp - 0x1e4]
mov ecx, 3
mov eax, 0x4f27b4
call fcn.0040d340
call sub.kernel32.dll_GetTickCount_1
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.00405054
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp - 0x10]
call fcn.0040547c
push eax
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.0040547c
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x4f274b
call sub.kernel32.dll_GetLastError_1
mov esi, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f2790
lea eax, [ebp - 0x1e8]
call fcn.00404fbc
lea eax, [ebp - 0x1c4]
mov edx, 2
call fcn.00404fe0
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404fe0
lea eax, [ebp + 0x14]
call fcn.00404fbc
ret
Function at 0x4f2a20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
xor edx, edx
mov dword [ebp - 0x5c], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040546c
xor eax, eax
push ebp
push 0x4f2ac8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00408170
mov word [ebp - 0x18], 5
mov dword [ebp - 0x1c], 0x10
mov dword [ebp - 0x20], 0x18
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.0040c918
mov eax, dword [ebp - 0x5c]
call fcn.0040547c
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040547c
push eax
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x4f2aa7
mov ebx, dword [ebp - 0x50]
jmp 0x4f2aaa
or ebx, 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f2acf
lea eax, [ebp - 0x5c]
call fcn.00404fbc
lea eax, [ebp - 4]
call fcn.00404fbc
ret
Function at 0x41c00e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x42c53c]
push edi
push 0x4236c0
push ecx
lea edx, [ebp - 4]
push edx
mov dword [ebp - 0x10], 1
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
push eax
call fcn.00456776
add esp, 0xc
test eax, eax
jne 0x41bfd7
mov edi, dword [ebp - 4]
test edi, edi
je 0x41bfd7
lea eax, [ebp - 8]
push eax
call fcn.0041b9d0
mov ecx, dword [ebp - 4]
push ecx
mov edi, eax
call dword [0x423180]
add esp, 8
test edi, edi
jne 0x41bfde
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
push ebx
push esi
mov esi, eax
shr esi, 2
add esi, esi
add esi, esi
xor ecx, ecx
test esi, esi
jle 0x41c000
xor dword [ecx + edi], 0x19630905
add ecx, 4
cmp ecx, esi
jl 0x41bff2
push 2
call fcn.0041e650
add esp, 4
xor eax, eax
test esi, esi
jle 0x41c01e
xor dword [eax + edi], 0x20120711
add eax, 4
cmp eax, esi
jl 0x41c010
mov ebx, dword [edi + 0xc]
mov edx, dword [edi + 8]
lea esi, [ebx + ebx*2]
add esi, esi
add esi, esi
push esi
mov dword [0x42c520], edx
call fcn.004d0145
ror dword [ebx - 0x3b7c0bb3], 1
add al, 0x89
inc ecx
add al, 0x85
sal byte [ebp + 0x15], 0x57
xor esi, esi
push ebp
call fcn.00486200
add esp, 4
mov eax, esi
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x41e3e7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
push 0x4236c0
push eax
lea ecx, [ebp - 4]
push ecx
mov dword [ebp - 4], 0
call fcn.004c2339
pushal
add esp, 0xc
test eax, eax
jne 0x41e3a8
mov edi, dword [ebp - 4]
test edi, edi
je 0x41e3a8
lea edx, [ebp - 8]
push edx
call fcn.0041b9d0
mov edi, eax
mov eax, dword [ebp - 4]
push eax
call dword [0x423180]
add esp, 8
test edi, edi
jne 0x41e3af
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [ebp - 8]
xor eax, eax
test esi, esi
jle 0x41e3c9
lea esp, [esp]
xor byte [eax + edi], 0x90
inc eax
cmp eax, esi
jl 0x41e3c0
push 3
mov eax, esi
call fcn.0041e650
shr esi, 1
add esi, esi
add esp, 4
xor eax, eax
test esi, esi
jle 0x41e3f0
nop
mov ecx, 0x2015
xor word [eax + edi], cx
add eax, 2
cmp eax, esi
jl 0x41e3e0
mov esi, dword [edi + 4]
mov edx, dword [ebp + 8]
mov dword [edx], esi
test esi, esi
jg 0x41e404
pop esi
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
imul esi, esi, 0x70
push ebx
push esi
push ebx
call fcn.0045cf47
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x41e41f
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret
push esi
lea eax, [edi + 8]
push eax
push ebx
call fcn.0041f4d6
push edi
push edx
call fcn.004ace6b
add esp, 0x10
mov eax, ebx
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x404c90
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50f69b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push ebx
push esi
push edi
mov eax, str.userdata
xor edi, edi
mov esi, ecx
mov dword [ebp - 0x30], 0xf
mov dword [ebp - 0x34], edi
mov byte [ebp - 0x44], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404cc8
sub eax, edx
lea ecx, [ebp - 0x48]
push eax
push str.userdata
call fcn.00403230
lea eax, [ebp - 0x48]
mov ecx, esi
push eax
mov dword [ebp - 4], edi
call fcn.0044e890
test al, al
mov eax, dword [ebp - 0x30]
mov dword [ebp - 4], 0xffffffff
sete bl
cmp eax, 0x10
jb 0x404d0d
mov ecx, dword [ebp - 0x44]
push ecx
call fcn.004fb06d
add esp, 4
test bl, bl
je 0x404d1e
push str.userdata
call fcn.0050f21a
add esp, 4
mov eax, dword [esi + 0x148c]
cmp eax, edi
je 0x404e5c
mov ecx, dword [esi + 0x1490]
sub ecx, eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [ebp - 0x10], edx
je 0x404e5c
push 0x20
call fcn.004eb990
add esp, 4
mov dword [ebp - 0x10], eax
cmp eax, edi
mov dword [ebp - 4], 1
je 0x404d71
mov ecx, eax
call fcn.004a3670
mov ebx, eax
jmp 0x404d73
xor ebx, ebx
push edi
mov ecx, ebx
mov dword [ebp - 4], 0xffffffff
call fcn.004a49a0
mov dword [ebp - 0x10], 0
mov eax, dword [esi + 0x148c]
test eax, eax
je 0x404dd1
mov ecx, dword [esi + 0x1490]
sub ecx, eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
cmp edi, edx
jae 0x404dd1
mov edx, dword [esi + 0x148c]
mov ecx, dword [ebp - 0x10]
add edx, ecx
push 0x60
push edx
mov ecx, ebx
call fcn.004a4bf0
mov eax, dword [ebp - 0x10]
inc edi
add eax, 0x60
mov dword [ebp - 0x10], eax
jmp 0x404d89
mov eax, str.userdatausers.dat
mov edi, 0xf
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404dec
sub eax, edx
lea ecx, [ebp - 0x2c]
push eax
push str.userdatausers.dat
call fcn.00403230
lea eax, [ebp - 0x2c]
push ebx
push eax
mov ecx, esi
mov dword [ebp - 4], 2
call fcn.0044f480
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
cmp eax, 0x10
jb 0x404e31
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.004fb06d
add esp, 4
test ebx, ebx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
je 0x404e67
mov edx, dword [ebx]
push 1
mov ecx, ebx
call dword [edx]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push str.userdatausers.dat
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x40ed50
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51007b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
xor ecx, ecx
mov dword [ebp - 0x18], edi
mov dword [edi + 0x34], 0xf
mov dword [edi + 0x30], ecx
mov byte [edi + 0x20], cl
mov dword [ebp - 4], ecx
lea eax, [edi + 0x3c]
mov edx, 0x18
mov dword [eax], ecx
mov dword [eax + 4], ecx
add eax, 8
dec edx
jne 0x40ed8d
mov eax, dword [ebp + 8]
mov dword [edi], eax
mov eax, dword [eax + 0x5c]
mov dword [edi + 0x10], ecx
mov dword [edi + 8], ecx
mov dword [edi + 0x38], ecx
mov ecx, eax
mov dword [edi + 4], eax
mov dword [edi + 0xc], 0xfe
mov edx, dword [ecx + 0x960]
push edx
call fcn.004015f0
shl eax, 5
mov ecx, eax
mov dword [ebp + 8], 0xffffffca
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], 0xa
mov ebx, 0xfffffff6
lea esi, [edi + 0x4c]
jmp 0x40ede4
mov ecx, dword [ebp - 0x14]
lea eax, [esi - 0x10]
lea edx, [ebx + 8]
mov dword [esi + 8], ebx
mov dword [eax], edx
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff8
mov dword [esi - 8], edx
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
mov dword [esi - 4], edx
mov edx, dword [ebp - 0x10]
mov dword [esi], edx
mov edx, dword [ebp + 8]
mov dword [esi + 4], edx
mov dword [esi + 0xc], edx
mov edx, dword [ecx + 0x52af04]
fild dword [ecx + 0x52aefc]
push edx
mov edx, dword [ecx + 0x52af00]
push edx
sub esp, 0x10
fstp qword [esp + 8]
fild dword [ecx + 0x52aef8]
mov ecx, edi
fstp qword [esp]
push 4
push eax
call fcn.0040e730
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
sub ebx, 0xa
add ecx, 0xa
add edx, 0x14
add esi, 0x20
cmp ebx, 0xffffffba
mov dword [ebp - 0x10], ecx
mov dword [ebp + 8], edx
jg 0x40ede1
mov ecx, edi
call fcn.0040eb30
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4320c0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x511fe8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, ecx
push eax
mov dword [ebp - 0x10], esi
call fcn.00431550
mov ecx, dword [esi + 0x50]
xor ebx, ebx
mov dword [esi], 0x530238
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov edx, dword [ecx + 0x11c0]
mov dword [esi + 0x58], edx
mov dword [ebp - 4], ebx
mov eax, dword [ecx + 0x11c4]
mov ecx, dword [esi + 0x4c]
mov dword [esi + 0x5c], eax
mov edx, dword [ecx + 0x5c]
mov ecx, esi
mov eax, dword [edx + 0x8e0]
mov dword [esi + 0x60], eax
call fcn.00431320
mov edi, 0xe6
sub edi, eax
call fcn.004977e0
cdq
idiv edi
mov ecx, esi
mov edi, edx
call fcn.00431320
cdq
sub eax, edx
sar eax, 1
lea ecx, [edi + eax + 0x32]
mov dword [ebp + 8], ecx
mov ecx, esi
fild dword [ebp + 8]
fstp qword [esi + 0x10]
call fcn.00431650
mov edx, dword [esi + 0x50]
mov ecx, esi
mov eax, dword [edx + 0x11b4]
mov dword [esi + 0x78], ebx
mov dword [esi + 0x64], eax
mov al, byte [esi + 0x30]
cmp al, bl
mov dword [esi + 0x7c], ebx
jne 0x4321ad
call fcn.00431310
cdq
sub eax, edx
mov ecx, 0xfffffec0
sar eax, 1
sub ecx, eax
mov dword [ebp + 8], ecx
fild dword [ebp + 8]
fstp qword [esi + 8]
call fcn.004977e0
cdq
mov ecx, 0x64
idiv ecx
mov dword [ebp + 8], edx
fild dword [ebp + 8]
fmul qword [0x52c538]
fadd qword [0x52a0e8]
jmp 0x4321e6
call fcn.00431310
cdq
sub eax, edx
sar eax, 1
add eax, 0x140
mov dword [ebp + 8], eax
fild dword [ebp + 8]
fstp qword [esi + 8]
call fcn.004977e0
cdq
mov ecx, 0x64
idiv ecx
mov dword [ebp + 8], edx
fild dword [ebp + 8]
fmul qword [0x52c538]
fadd qword [0x52a0e8]
fchs
mov edx, dword [esi + 0x50]
mov eax, dword [esi + 0x4c]
fstp qword [esi + 0x18]
mov ecx, dword [edx + 0x11b8]
mov edx, dword [eax + 0x7c]
add edx, ecx
mov ecx, dword [ebp - 0xc]
mov dword [eax + 0x7c], edx
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4