joyce8/EMBER2024-capa huggingface dataset:
Function at 0x71d000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x71d131
push esi
call fcn.00720145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.0070f080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x71d131
push 0
push ebp
call fcn.0070f3a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.0070f260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x71d08b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.0070f2f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x71d121
push 0x735918
push edi
call fcn.0071e3f0
push eax
push ebx
push esi
call fcn.0071cf60
push 0x7358f8
push edi
call fcn.0071e3f0
push eax
push ebx
push esi
call fcn.0071cf60
push 0x7358d8
push edi
call fcn.0071e3f0
push eax
push ebx
push esi
call fcn.0071cf60
push 0x7358c0
push edi
call fcn.0071e3f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.0071cf60
push 0x7358a0
push edi
call fcn.0071e3f0
push eax
push ebx
push esi
call fcn.0071cf60
push 0x735888
push edi
call fcn.0071e3f0
push eax
push ebx
push esi
call fcn.0071cf60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x71e1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.0071e140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.0071e140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.0071e140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.0071e140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x71ebfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x71ec50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x73087c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x71ec43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x71ec52
xor eax, eax
pop esi
leave
ret 4
Function at 0x4072ad
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x46bc7c], 0
jne 0x4072eb
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4072c1
mov dword [ecx*4 + 0x46bc78], eax
inc ecx
cmp ecx, 0x100
jl 0x4072bc
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x407318
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x46bc78]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4072f9
not eax
pop ebp
ret 0xc

Function at 0x408964
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x4085d8
dec ebx
call fcn.0040898a
dec ebx
add ebx, 0x50aaf1ec
xor dword [eax], esi
inc eax
mov ebx, edi
cmp eax, ecx
jne fcn.00408964
add edi, 0xa3a8dc7
add edi, ebx
ret
Function at 0x403228
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x400
mov esi, 0x44f800
push esi
add eax, 0x3e8
push ebx
mov dword [0x42b8a0], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 3
push 0x80000000
push esi
call fcn.0040631a
mov edi, eax
mov dword [ebp - 0xc], edi
mov dword [0x40b010], edi
cmp edi, 0xffffffff
jne 0x403282
mov eax, 0x409314
jmp 0x403457
push esi
mov esi, 0x44d800
push esi
call fcn.00405a3b
push esi
call fcn.00406264
push eax
push 0x450000
call fcn.00405a3b
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, ebx
mov dword [0x4219b8], eax
mov esi, eax
jle 0x40339d
mov ebx, 0x419930
mov eax, dword [0x42b8ac]
neg eax
sbb eax, eax
and eax, 0x7e00
add eax, 0x200
cmp esi, eax
mov edi, esi
jl 0x4032d6
mov edi, eax
push edi
push ebx
call fcn.00402f21
test eax, eax
je 0x40345e
cmp dword [0x42b8ac], 0
jne 0x403368
push 0x1c
push ebx
lea eax, [ebp - 0x28]
push eax
call fcn.004062ed
mov eax, dword [ebp - 0x28]
test eax, 0xfffffff0
jne 0x403376
cmp dword [ebp - 0x24], 0x6206fa04
jne 0x403376
cmp dword [ebp - 0x18], 0xc5d1423b
jne 0x403376
cmp dword [ebp - 0x1c], 0x57743cf7
jne 0x403376
cmp dword [ebp - 0x20], 0xb891433b
jne 0x403376
or dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [0x41992c]
and eax, 2
or dword [0x42b920], eax
mov eax, dword [ebp - 0x10]
cmp eax, esi
mov dword [0x42b8ac], ecx
jg 0x403466
test byte [ebp + 8], 8
jne 0x40335a
test byte [ebp + 8], 4
jne 0x40339b
inc dword [ebp - 4]
lea esi, [eax - 4]
cmp edi, esi
jbe 0x403376
mov edi, esi
jmp 0x403376
test byte [ebp + 8], 2
jne 0x403376
push 0
call fcn.00402ebd
pop ecx
cmp esi, dword [0x4219b8]
jge 0x40338b
push edi
push ebx
push dword [ebp - 8]
call fcn.00406f06
mov dword [ebp - 8], eax
add dword [0x41992c], edi
sub esi, edi
test esi, esi
jg 0x4032bb
xor ebx, ebx
push 1
call fcn.00402ebd
pop ecx
cmp dword [0x42b8ac], ebx
je 0x403466
cmp dword [ebp - 4], ebx
je 0x4033e0
push dword [0x41992c]
call fcn.00402f5a
push 4
lea eax, [ebp + 8]
push eax
call fcn.00402f21
test eax, eax
je 0x403466
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x403466
push dword [ebp - 0x14]
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
mov eax, dword [0x42b8ac]
add eax, 0x1c
push eax
call fcn.00402f5a
push dword [ebp - 0x14]
push esi
push ebx
push 0xffffffffffffffff
call fcn.00402f77
cmp eax, dword [ebp - 0x14]
jne 0x403466
test byte [ebp - 0x28], 1
mov dword [0x42b84c], esi
mov eax, dword [esi]
mov dword [0x42b8a8], eax
je 0x403425
inc dword [0x42b8a4]
push 8
pop ecx
lea eax, [esi + 0x44]
sub eax, 8
add dword [eax], esi
dec ecx
cmp ecx, ebx
jne 0x40342b
push 1
push ebx
push ebx
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [esi + 0x3c], eax
push 0x40
add esi, 4
push esi
push 0x42b860
call fcn.004062ed
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
push 1
call fcn.00402ebd
pop ecx
mov eax, str._n_n_n_n_n
jmp 0x403457
Function at 0x409780
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x664
mov eax, dword [0x463074]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x404]
push 0x200
xorps xmm0, xmm0
mov dword [ebp - 0x65c], ebx
push 0
push eax
movlpd qword [ebp - 0x664], xmm0
call fcn.00429c60
add esp, 0xc
lea eax, [ebp - 0x404]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatW]
push eax
call ebx
push 0x44eb6c
lea eax, [ebp - 0x404]
push eax
call ebx
lea eax, [ebp - 0x654]
push eax
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x658], eax
cmp eax, 0xffffffff
jne 0x40980e
xor eax, eax
xor edx, edx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042784a
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpW]
push esi
mov esi, dword [ebp - 0x660]
push edi
mov edi, dword [ebp - 0x664]
push 0x44e988
lea eax, [ebp - 0x628]
push eax
call ebx
test eax, eax
jne 0x4098c3
push 0x44e98c
lea eax, [ebp - 0x628]
push eax
call ebx
test eax, eax
jne 0x4098c3
test byte [ebp - 0x654], 0x10
je 0x4098b2
push 0x200
push eax
lea eax, [ebp - 0x204]
push eax
call fcn.00429c60
add esp, 0xc
lea eax, [ebp - 0x204]
push dword [ebp - 0x65c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x44e9c8
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x204]
push eax
call fcn.00409780
add esp, 4
jmp 0x4098c3
mov eax, dword [ebp - 0x634]
sub eax, dword [ebp - 0x638]
add edi, eax
adc esi, 0
lea eax, [ebp - 0x654]
push eax
push dword [ebp - 0x658]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x409822
push dword [ebp - 0x658]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
mov edx, esi
xor ecx, ebp
pop esi
pop ebx
call fcn.0042784a
mov esp, ebp
pop ebp
ret
Function at 0x40a990
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44aaa6
mov eax, dword fs:[0]
push eax
sub esp, 0xc40
mov eax, dword [0x463074]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp byte [0x4648c8], 0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0xc38], eax
mov dword [ebp - 0xc3c], eax
jne 0x40a9fb
mov byte [0x4648c8], 1
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [esi + 0x10], 0
jne 0x40aa2f
push 0xd
push str.no_native_cmd
mov ecx, ebx
call fcn.00402cb0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0042784a
mov esp, ebp
pop ebp
ret 0x10
push 0
mov dword [ebp - 4], 0
call fcn.004309a3
add esp, 4
mov dword [ebp - 0xc30], eax
cmp dword [esi + 0x14], 0x10
mov dword [ebp - 0xc34], edx
jb 0x40aa54
mov esi, dword [esi]
push 0x44f044
push esi
call fcn.004307ef
mov edi, eax
add esp, 8
mov dword [ebp - 0xc40], edi
test edi, edi
jne 0x40aa77
push 0x17
push str.create_environment_fail
jmp 0x40aa08
push 0xc00
lea eax, [ebp - 0xc14]
push 0
push eax
call fcn.00429c60
push edi
lea eax, [ebp - 0xc14]
xor esi, esi
push 0xc00
push eax
call fcn.0043011b
add esp, 0x18
test eax, eax
je 0x40ab06
mov ebx, dword [ebp - 0xc30]
nop dword [eax + eax]
lea eax, [ebp - 0xc14]
lea edx, [eax + 1]
nop dword [eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40aac0
sub eax, edx
push 0
add esi, eax
call fcn.004309a3
add esp, 4
sub eax, ebx
sbb edx, dword [ebp - 0xc34]
test edx, edx
jg 0x40ab06
jl 0x40aae8
cmp eax, 2
ja 0x40ab06
mov eax, 0xc00
sub eax, esi
push edi
push eax
lea eax, [ebp - 0xc14]
add eax, esi
push eax
call fcn.0043011b
add esp, 0xc
test eax, eax
jne 0x40aab0
lea edx, [ebp - 0xc14]
lea esi, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x40ab10
mov ecx, dword [ebp - 0xc38]
lea eax, [ebp - 0xc14]
sub edx, esi
push edx
push eax
call fcn.00402cb0
push edi
call fcn.0043071b
add esp, 4
mov al, 1
jmp 0x40aa11
Function at 0x40b000
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44ab1b
mov eax, dword fs:[0]
push eax
sub esp, 0x124
mov eax, dword [0x463074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x114]
push 0x104
push 0
push eax
mov dword [ebp - 0x130], esi
call fcn.00429c60
add esp, 0xc
lea eax, [ebp - 0x114]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0xf
lea edx, [ecx + 1]
mov byte [ebp - 0x12c], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40b084
sub ecx, edx
lea eax, [ebp - 0x114]
push ecx
push eax
lea ecx, [ebp - 0x12c]
call fcn.00403200
lea eax, [ebp - 0x12c]
mov dword [ebp - 4], 0
push eax
push esi
call fcn.00409580
mov edx, dword [ebp - 0x118]
add esp, 8
cmp edx, 0x10
jb 0x40b0ed
mov ecx, dword [ebp - 0x12c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40b0e3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40b10b
push edx
push ecx
call fcn.0042730e
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042784a
mov esp, ebp
pop ebp
ret 4
call fcn.0042c719
int3
Function at 0x40b260
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44abb0
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x463074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ecx]
lea edx, [ebp - 0x58]
push edx
call dword [eax + 0x1c]
mov ecx, 3
mov dword [ebp - 4], 0
cmp dword [ebp - 0x48], ecx
lea eax, [ebp - 0x58]
mov dword [ebp - 0x30], 0
cmovb ecx, dword [ebp - 0x48]
cmp dword [ebp - 0x44], 0x10
push ecx
cmovae eax, dword [ebp - 0x58]
lea ecx, [ebp - 0x40]
push eax
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
call fcn.00403200
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0040fac0
mov edx, dword [ebp - 0x2c]
add esp, 8
cmp edx, 0x10
jb 0x40b315
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40b30b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40b3ed
push edx
push ecx
call fcn.0042730e
add esp, 8
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x70]
push ecx
lea ecx, [ebp - 0x78]
push ecx
lea ecx, [ebp - 0x68]
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x40b347
xorps xmm0, xmm0
movlpd qword [ebp - 0x60], xmm0
mov esi, dword [ebp - 0x5c]
mov edi, dword [ebp - 0x60]
jmp 0x40b354
mov edi, dword [ebp - 0x68]
mov esi, dword [ebp - 0x64]
shrd edi, esi, 0x14
shr esi, 0x14
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x40b38a
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40b380
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40b3f2
push edx
push ecx
call fcn.0042730e
add esp, 8
mov edx, dword [ebp - 0x44]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 0x10
jb 0x40b3ce
mov ecx, dword [ebp - 0x58]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40b3c4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40b3f7
push edx
push ecx
call fcn.0042730e
add esp, 8
mov eax, edi
mov edx, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042784a
mov esp, ebp
pop ebp
ret
call fcn.0042c719
call fcn.0042c719
call fcn.0042c719
int3
Function at 0x40b400
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [ebp - 0x24]
cmp eax, 0xe
ja case.default.0x40b41e
jmp dword [eax*4 + 0x40b4d0]
push 5
push str.INTEL
jmp 0x40b4aa
push 4
push str.MIPS
jmp 0x40b4aa
push 5
push str.ALPHA
jmp 0x40b4aa
push 3
push 0x44ecf0
jmp 0x40b4aa
push 3
push 0x44ecf4
jmp 0x40b4aa
push 3
push 0x44ecf8
jmp 0x40b4aa
push 4
push str.IA64
jmp 0x40b4aa
push 7
push str.ALPHA64
jmp 0x40b4aa
push 4
push str.MSIL
jmp 0x40b4aa
push 5
push str.AMD64
jmp 0x40b4aa
push 4
push str.IA32
jmp 0x40b4aa
push 7
push str.NEUTRAL
jmp 0x40b4aa
push 5
push str.ARM64
jmp 0x40b4aa
push 5
push str.ARM32
jmp 0x40b4aa
push 7
push str.UNKNOWN
mov esi, dword [ebp + 8]
mov ecx, esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
call fcn.00403200
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x40b510
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [ebp - 0x24]
cmp eax, 6
je 0x40b549
cmp eax, 9
je 0x40b549
mov eax, dword [ebp - 0xc]
cmp eax, 0x898
je 0x40b549
cmp eax, 0x21d8
je 0x40b549
push 2
push 0x44ecd4
jmp 0x40b550
push 2
push 0x44ecd0
mov esi, dword [ebp + 8]
mov ecx, esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
call fcn.00403200
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x40b5a0
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
mov dword [ebp - 8], 0
push eax
push 1
push 0
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push 0x80000002
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40b5f7
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push str.MHz
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
test eax, eax
je 0x40b5ff
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
xor edx, edx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
xor edx, edx
mov esp, ebp
pop ebp
ret
Function at 0x40c670
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44ab1b
mov eax, dword fs:[0]
push eax
sub esp, 0x124
mov eax, dword [0x463074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x114]
push 0x104
push 0
push eax
mov dword [ebp - 0x130], esi
call fcn.00429c60
add esp, 0xc
lea eax, [ebp - 0x114]
push eax
push 0
push 0
push 0x28
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0xf
lea edx, [ecx + 1]
mov byte [ebp - 0x12c], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40c6f4
sub ecx, edx
lea eax, [ebp - 0x114]
push ecx
push eax
lea ecx, [ebp - 0x12c]
call fcn.00403200
lea eax, [ebp - 0x12c]
mov dword [ebp - 4], 0
push eax
push esi
call fcn.00409580
mov edx, dword [ebp - 0x118]
add esp, 8
cmp edx, 0x10
jb 0x40c75d
mov ecx, dword [ebp - 0x12c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40c753
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40c77b
push edx
push ecx
call fcn.0042730e
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042784a
mov esp, ebp
pop ebp
ret 4
call fcn.0042c719
int3
Function at 0x40d4e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44ad96
mov eax, dword fs:[0]
push eax
sub esp, 0xec
mov eax, dword [0x463074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x90]
push 0x80
push 0
push eax
mov dword [ebp - 0xe0], esi
call fcn.00429c60
add esp, 0xc
mov dword [ebp - 0xe0], 0x80
lea ecx, [ebp - 0xa8]
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x94], 0xf
mov byte [ebp - 0xa8], 0
push 7
push str.Windows
call fcn.00403200
lea eax, [ebp - 0xdc]
mov dword [ebp - 4], 0
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40d5b3
movups xmm0, xmmword [ebp - 0xa8]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x98]
movq qword [esi + 0x10], xmm0
jmp 0x40d73e
lea eax, [ebp - 0xe0]
push eax
lea eax, [ebp - 0x90]
push eax
push 0
push 0
push str.ProductName
push dword [ebp - 0xdc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0xdc]
test eax, eax
je 0x40d60b
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
movups xmm0, xmmword [ebp - 0xa8]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x98]
jmp 0x40d713
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [ebp - 0xb0], 0
lea ecx, [ebp - 0x90]
mov dword [ebp - 0xac], 7
mov word [ebp - 0xc0], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40d637
sub ecx, edx
lea eax, [ebp - 0x90]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0xc0]
call fcn.004032f0
lea eax, [ebp - 0xc0]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0xd8]
push eax
call fcn.00410050
mov edi, eax
add esp, 8
lea eax, [ebp - 0xa8]
cmp eax, edi
je 0x40d6bf
mov ecx, eax
call fcn.00402040
movups xmm0, xmmword [edi]
movups xmmword [ebp - 0xf8], xmm0
movups xmmword [ebp - 0xa8], xmm0
movq xmm0, qword [edi + 0x10]
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
movq qword [ebp - 0xe8], xmm0
movq qword [ebp - 0x98], xmm0
mov byte [edi], 0
jmp 0x40d6dd
movq xmm0, qword [ebp - 0x98]
movq qword [ebp - 0xe8], xmm0
movups xmm0, xmmword [ebp - 0xa8]
movups xmmword [ebp - 0xf8], xmm0
lea ecx, [ebp - 0xd8]
call fcn.00402040
lea ecx, [ebp - 0xc0]
call fcn.00402090
movups xmm0, xmmword [ebp - 0xf8]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0xe8]
lea ecx, [ebp - 0xa8]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x94], 0xf
mov byte [ebp - 0xa8], 0
call fcn.00402040
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042784a
mov esp, ebp
pop ebp
ret 4