joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418f50
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x47e00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], 4
mov eax, dword [ebp - 0xc]
push eax
push 0
lea ecx, [ebp - 8]
push ecx
call fcn.0044c410
add esp, 0xc
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x6f
jne 0x418fb0
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00450ef2
add esp, 4
mov dword [ebp - 8], eax
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp dword [ebp - 8], 0
jne 0x418fbb
jmp 0x419050
mov ecx, 1
imul edx, ecx, 5
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + edx + 0x194]
push ecx
mov edx, 1
shl edx, 2
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + edx + 0x194]
push ecx
mov edx, 1
imul eax, edx, 3
mov ecx, dword [ebp - 8]
movzx edx, byte [ecx + eax + 0x194]
push edx
mov eax, 1
shl eax, 1
mov ecx, dword [ebp - 8]
movzx edx, byte [ecx + eax + 0x194]
push edx
mov eax, 1
shl eax, 0
mov ecx, dword [ebp - 8]
movzx edx, byte [ecx + eax + 0x194]
push edx
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp - 8]
movzx eax, byte [edx + ecx + 0x194]
push eax
push str._0.2X__0.2X__0.2X__0.2X__0.2X__0.2X
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x20
mov edx, dword [ebp - 8]
push edx
call fcn.00450eed
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00449aef
mov esp, ebp
pop ebp
ret 4

Function at 0x4197c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x47e00c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0x20019
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [0x47e960]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x4197fd
xor al, al
jmp 0x41982b
lea ecx, [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x41981f
xor al, al
jmp 0x41982b
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00449aef
mov esp, ebp
pop ebp
ret
Function at 0x4271c0
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
movzx eax, byte [0x4805c6]
test eax, eax
jne 0x4271ed
mov ecx, dword [ebp - 4]
call fcn.00426ca0
movsx ecx, al
test ecx, ecx
je 0x4271eb
push 0
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x427207
mov byte [0x4805d9], 1
push 0
push 0
push 0
push 2
mov ecx, dword [0x48064c]
call fcn.00432920
mov dl, byte [ebp + 8]
mov byte [0x4805c5], dl
mov esp, ebp
pop ebp
ret 4
Function at 0x42a430
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 8]
mov byte [eax + 0x3c], 1
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
mov dword [ecx + 0x48], edx
mov eax, dword [ebp - 8]
cmp dword [eax + 0x48], 1
jle 0x42a463
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x48], 1
mov edx, dword [ebp - 8]
mov dword [edx + 0x44], 0
mov eax, dword [ebp - 8]
mov cl, byte [ebp + 0xc]
mov byte [eax + 0x4c], cl
mov dword [ebp - 4], 0
jmp 0x42a488
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 1
jge 0x42a4b0
imul eax, dword [ebp - 4], 0x24
mov ecx, dword [ebp - 8]
lea ecx, [ecx + eax + 0x5c]
call fcn.00416d30
imul edx, dword [ebp - 4], 0x24
mov eax, dword [ebp - 8]
lea ecx, [eax + edx + 0x68]
call fcn.0042aaf0
jmp 0x42a47f
mov dword [ebp - 4], 0
jmp 0x42a4c2
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 8]
add ecx, 0x10
call fcn.0042ada0
cmp dword [ebp - 4], eax
jae 0x42a504
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp - 8]
add ecx, 0x10
call fcn.0042ad60
push eax
imul eax, dword [ebp - 0xc], 0x24
mov ecx, dword [ebp - 8]
lea ecx, [ecx + eax + 0x68]
call fcn.0042abf0
mov eax, dword [ebp - 0xc]
add eax, 1
mov ecx, dword [ebp - 8]
cdq
idiv dword [ecx + 0x48]
mov dword [ebp - 0xc], edx
jmp 0x42a4b9
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
jmp 0x42a51d
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov ecx, dword [ebp - 8]
add ecx, 4
call fcn.00416fe0
cmp dword [ebp - 4], eax
jae 0x42a55f
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
add ecx, 4
call fcn.00416fa0
push eax
imul ecx, dword [ebp - 0xc], 0x24
mov edx, dword [ebp - 8]
lea ecx, [edx + ecx + 0x5c]
call fcn.00416e30
mov eax, dword [ebp - 0xc]
add eax, 1
mov ecx, dword [ebp - 8]
cdq
idiv dword [ecx + 0x48]
mov dword [ebp - 0xc], edx
jmp 0x42a514
mov dword [ebp - 4], 0
jmp 0x42a571
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax + 0x48]
jge 0x42a5dd
imul edx, dword [ebp - 4], 0x24
mov eax, dword [ebp - 8]
mov byte [eax + edx + 0x78], 1
imul ecx, dword [ebp - 4], 0x24
mov edx, dword [ebp - 8]
mov dword [edx + ecx + 0x7c], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax*4 + 0x34]
push edx
push 0
imul eax, dword [ebp - 4], 0x24
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax + 0x5c]
push edx
push 0x42a5f0
push 0
push 0
call fcn.00451051
add esp, 0x18
imul ecx, dword [ebp - 4], 0x24
mov edx, dword [ebp - 8]
mov dword [edx + ecx + 0x74], eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x44]
add ecx, 1
mov edx, dword [ebp - 8]
mov dword [edx + 0x44], ecx
jmp 0x42a568
mov esp, ebp
pop ebp
ret 8
Function at 0x432430
Capabilities:
Create directory
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x47e00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], 0
push 0
push str.c:OIDD
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0
push 0x80000080
push 2
push 0
push 1
push 0x40000000
push 0x470988
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebp - 8]
push eax
push 0x10
push 0x4812d6
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00449aef
mov esp, ebp
pop ebp
ret

Function at 0x4330a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x47e00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0xfc
call fcn.00416fe0
test eax, eax
jbe 0x4331f8
push 0
mov ecx, dword [ebp - 0x10]
add ecx, 0xfc
call fcn.00416fa0
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dl, byte [ecx]
mov byte [ebp - 0x14], dl
cmp byte [ebp - 0x14], 0
je 0x4330f7
cmp byte [ebp - 0x14], 1
je 0x433171
jmp 0x4331f8
push 0x400
push 0
push 0x480a60
call fcn.0044c410
add esp, 0xc
push 0x480a60
mov eax, dword [ebp - 0xc]
add eax, 0x14
push eax
mov ecx, dword [ebp - 0x10]
call fcn.004353d0
mov dword [0x480a58], eax
xor ecx, ecx
mov dword [0x480e7c], ecx
mov dword [0x480e80], ecx
mov dword [0x480e84], ecx
mov dword [0x480e88], ecx
mov dword [0x480e8c], ecx
push 0x480e7c
push 0x4812e8
mov edx, dword [0x480a58]
push edx
push 0x480a60
mov eax, dword [0x480a50]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0xc]
mov byte [ecx], 1
jmp 0x4331f8
push 0
push 0x4812e8
push 0x480e7c
mov edx, dword [0x480a50]
push edx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jne 0x4331af
mov eax, dword [ebp - 0xc]
mov byte [eax], 2
mov ecx, dword [ebp - 0xc]
mov byte [ecx + 0x10], 0
mov edx, dword [ebp - 0xc]
xorps xmm0, xmm0
movsd qword [edx + 8], xmm0
jmp 0x4331f8
cmp dword [0x4812e8], 0
je 0x4331f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x3e5
je 0x4331e1
cmp dword [ebp - 8], 0x3e4
je 0x4331e1
push 1
push 6
mov ecx, dword [ebp - 0x10]
call fcn.00432230
jmp 0x4331f8
push 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [0x480a50]
push ecx
call dword [sym.imp.KERNEL32.dll_ClearCommError]
xor eax, eax
jmp 0x4331fa
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00449aef
mov esp, ebp
pop ebp
ret 8
Function at 0x4347b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x18], ecx
push 0x471140
push str.C:_OIDD_initkey.dat
call fcn.0044f249
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4348b8
push 0x200
call fcn.00449dd6
add esp, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov dword [edx], ecx
push 2
push 0
mov eax, dword [ebp - 8]
push eax
call fcn.00450d30
add esp, 0xc
mov ecx, dword [ebp - 8]
push ecx
call fcn.00450a6b
add esp, 4
mov dword [ebp - 0x1c], eax
push 0
push 0
mov edx, dword [ebp - 8]
push edx
call fcn.00450d30
add esp, 0xc
mov eax, dword [ebp - 8]
push eax
push 0x10
push 1
mov ecx, dword [ebp - 4]
push ecx
call fcn.0044f999
add esp, 0x10
xor edx, edx
mov dword [0x4812d6], edx
mov dword [0x4812da], edx
mov dword [0x4812de], edx
mov dword [0x4812e2], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov dword [0x4812d6], ecx
mov edx, dword [eax + 4]
mov dword [0x4812da], edx
mov ecx, dword [eax + 8]
mov dword [0x4812de], ecx
mov edx, dword [eax + 0xc]
mov dword [0x4812e2], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00449b69
add esp, 4
cmp dword [ebp - 0xc], 0
jne 0x434899
mov dword [ebp - 0x14], 0
jmp 0x4348a6
mov dword [ebp - 4], 0x8123
mov edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 8]
push eax
call fcn.0044f4bd
add esp, 4
mov al, 1
jmp 0x4348ba
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x434ba0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x47e00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
push 0
push 0x40000080
push 3
push 0
push 0
push 0xc0000000
push 0x4812ac
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x480a50], eax
cmp dword [0x480a50], 0xffffffff
jne 0x434bf1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x434bf1
or eax, 0xffffffff
jmp 0x434ce6
mov dword [0x480e60], 0x1c
mov dword [0x480e64], 0x4b00
mov byte [0x480e72], 8
mov byte [0x480e74], 0
mov byte [0x480e73], 0
mov eax, dword [0x480e68]
and eax, 0xffffffcf
mov dword [0x480e68], eax
mov ecx, dword [0x480e68]
and ecx, 0xffffcfff
mov dword [0x480e68], ecx
mov dword [0x4812ec], 1
mov dword [0x4812f4], 0xa
mov dword [0x4812f0], 0xa
mov dword [0x4812fc], 0xa
mov dword [0x4812f8], 0xa
push 0x480e60
mov edx, dword [0x480a50]
push edx
call dword [sym.imp.KERNEL32.dll_SetCommState]
test eax, eax
jne 0x434c86
or eax, 0xffffffff
jmp 0x434ce6
push 0x4812ec
mov eax, dword [0x480a50]
push eax
call dword [sym.imp.KERNEL32.dll_SetCommTimeouts]
test eax, eax
jne 0x434ca0
or eax, 0xffffffff
jmp 0x434ce6
push 0x480e60
mov ecx, dword [0x480a50]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCommState]
test eax, eax
jne 0x434cbb
or eax, 0xffffffff
jmp 0x434ce6
push 0xf
mov edx, dword [0x480a50]
push edx
call dword [sym.imp.KERNEL32.dll_PurgeComm]
mov dword [ebp - 8], 0
push 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [0x480a50]
push ecx
call dword [sym.imp.KERNEL32.dll_ClearCommError]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00449aef
mov esp, ebp
pop ebp
ret
Function at 0x43d710
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0x800
call fcn.00449dd6
add esp, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
xor ecx, ecx
mov edx, dword [ebp - 4]
mov dword [edx], ecx
mov eax, dword [0x480638]
add eax, dword [0x48063c]
add eax, dword [0x480640]
add eax, dword [0x480644]
cdq
mov dword [0x480630], eax
mov dword [0x480634], edx
mov eax, dword [ebp - 4]
mov ecx, dword [0x480630]
mov dword [eax], ecx
mov edx, dword [0x480634]
mov dword [eax + 4], edx
mov ecx, dword [0x480638]
mov dword [eax + 8], ecx
mov edx, dword [0x48063c]
mov dword [eax + 0xc], edx
mov ecx, dword [0x480640]
mov dword [eax + 0x10], ecx
mov edx, dword [0x480644]
mov dword [eax + 0x14], edx
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 8], eax
push 0x471e10
push 0x471df4
call fcn.0044f249
add esp, 8
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
push 1
mov eax, dword [ebp - 4]
push eax
call fcn.0044f775
add esp, 0x10
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0044f3ee
add esp, 4
mov edx, dword [ebp - 0xc]
push edx
call fcn.0044f4bd
add esp, 4
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00449b69
add esp, 4
cmp dword [ebp - 0x10], 0
jne 0x43d802
mov dword [ebp - 0x18], 0
jmp 0x43d80f
mov dword [ebp - 4], 0x8123
mov edx, dword [ebp - 4]
mov dword [ebp - 0x18], edx
mov esp, ebp
pop ebp
ret
Function at 0x43dd50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push 0x800
call fcn.00449dd6
add esp, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
mov dword [ebp - 0x1c], 0
movzx ecx, byte [ebp + 8]
test ecx, ecx
jne 0x43dd92
push 0x471e14
push 0x471e80
call fcn.0044f249
add esp, 8
mov dword [ebp - 4], eax
jmp 0x43dda7
push 0x471e7c
push 0x471e5c
call fcn.0044f249
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x43de18
mov edx, dword [ebp - 4]
push edx
call fcn.00419630
add esp, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
push 1
mov edx, dword [ebp - 8]
push edx
call fcn.0044f999
add esp, 0x10
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov dword [0x480630], ecx
mov edx, dword [eax + 4]
mov dword [0x480634], edx
mov ecx, dword [eax + 8]
mov dword [0x480638], ecx
mov edx, dword [eax + 0xc]
mov dword [0x48063c], edx
mov ecx, dword [eax + 0x10]
mov dword [0x480640], ecx
mov edx, dword [eax + 0x14]
mov dword [0x480644], edx
mov eax, dword [ebp - 4]
push eax
call fcn.0044f4bd
add esp, 4
jmp 0x43de50
mov dword [0x48063c], 0
mov dword [0x480638], 0
mov dword [0x480644], 0
mov dword [0x480640], 0
xorps xmm0, xmm0
movlpd qword [0x480630], xmm0
call fcn.0043d710
mov ecx, dword [ebp - 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.00449b69
add esp, 4
cmp dword [ebp - 0xc], 0
jne 0x43de71
mov dword [ebp - 0x18], 0
jmp 0x43de7e
mov dword [ebp - 8], 0x8123
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov esp, ebp
pop ebp
ret
Function at 0x43de90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push 0x800
call fcn.00449dd6
add esp, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], 0
movzx ecx, byte [ebp + 8]
test ecx, ecx
jne 0x43ded9
push 0x471e58
push 0x471ec4
call fcn.0044f249
add esp, 8
mov dword [ebp - 0xc], eax
jmp 0x43deee
push 0x471ec0
push 0x471ea0
call fcn.0044f249
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x43df79
mov edx, dword [ebp - 0xc]
push edx
call fcn.00419630
add esp, 4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
push 1
mov edx, dword [ebp - 8]
push edx
call fcn.0044f999
add esp, 0x10
mov eax, dword [ebp - 8]
add eax, dword [ebp - 4]
mov ecx, dword [eax]
mov dword [0x48050c], ecx
mov edx, dword [eax + 4]
mov dword [0x480510], edx
mov eax, dword [ebp - 4]
add eax, 8
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [0x480514], edx
mov eax, dword [ebp - 4]
add eax, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [0x480518], edx
mov eax, dword [ebp - 4]
add eax, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0044f4bd
add esp, 4
jmp 0x43dfb3
mov dword [0x480518], 0
mov dword [0x480514], 0
mov eax, dword [0x480514]
add eax, dword [0x480518]
cdq
mov dword [0x48050c], eax
mov dword [0x480510], edx
mov dword [0x481328], 1
call fcn.0043dff0
mov edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.00449b69
add esp, 4
cmp dword [ebp - 0x10], 0
jne 0x43dfd4
mov dword [ebp - 0x1c], 0
jmp 0x43dfe1
mov dword [ebp - 8], 0x8123
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x1c], ecx
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x43dff0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push 0x1000
call fcn.00449dd6
add esp, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
xor ecx, ecx
mov edx, dword [ebp - 8]
mov dword [edx], ecx
mov eax, dword [0x480514]
add eax, dword [0x480518]
cdq
mov dword [0x48050c], eax
mov dword [0x480510], edx
mov eax, dword [ebp - 8]
add eax, dword [ebp - 4]
mov ecx, dword [0x48050c]
mov dword [eax], ecx
mov edx, dword [0x480510]
mov dword [eax + 4], edx
mov eax, dword [ebp - 4]
add eax, 8
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 4]
mov edx, dword [0x480514]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
add eax, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 4]
mov edx, dword [0x480518]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
add eax, 4
mov dword [ebp - 4], eax
push 0x471e9c
push 0x471f08
call fcn.0044f249
add esp, 8
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
push 1
mov eax, dword [ebp - 8]
push eax
call fcn.0044f775
add esp, 0x10
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0044f3ee
add esp, 4
mov edx, dword [ebp - 0xc]
push edx
call fcn.0044f4bd
add esp, 4
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00449b69
add esp, 4
cmp dword [ebp - 0x10], 0
jne 0x43e0ea
mov dword [ebp - 0x18], 0
jmp 0x43e0f7
mov dword [ebp - 8], 0x8123
mov edx, dword [ebp - 8]
mov dword [ebp - 0x18], edx
mov esp, ebp
pop ebp
ret

Function at 0x43e100
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
push 0x400
call fcn.00449dd6
add esp, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
xor ecx, ecx
mov edx, dword [ebp - 4]
mov dword [edx], ecx
mov eax, dword [0x4805e4]
add eax, dword [0x4805e0]
cdq
mov dword [0x4805e8], eax
mov dword [0x4805ec], edx
mov edi, dword [ebp - 4]
add edi, dword [ebp - 8]
mov ecx, 0x14
mov esi, 0x4805e0
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 8]
add eax, 0x50
mov dword [ebp - 8], eax
push 0x471f04
push 0x471ee4
call fcn.0044f249
add esp, 8
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
push 1
mov eax, dword [ebp - 4]
push eax
call fcn.0044f775
add esp, 0x10
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0044f3ee
add esp, 4
mov edx, dword [ebp - 0xc]
push edx
call fcn.0044f4bd
add esp, 4
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00449b69
add esp, 4
cmp dword [ebp - 0x10], 0
jne 0x43e1c2
mov dword [ebp - 0x18], 0
jmp 0x43e1cf
mov dword [ebp - 4], 0x8123
mov edx, dword [ebp - 4]
mov dword [ebp - 0x18], edx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x43e1e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
push 0x200
call fcn.00449dd6
add esp, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x20], 0
movzx ecx, byte [ebp + 8]
test ecx, ecx
jne 0x43e22b
push 0x471ee0
push 0x471f48
call fcn.0044f249
add esp, 8
mov dword [ebp - 4], eax
jmp 0x43e240
push 0x471f44
push 0x471f24
call fcn.0044f249
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x43e294
mov edx, dword [ebp - 4]
push edx
call fcn.00419630
add esp, 4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
push 1
mov edx, dword [ebp - 8]
push edx
call fcn.0044f999
add esp, 0x10
mov esi, dword [ebp - 8]
add esi, dword [ebp - 0xc]
mov ecx, 0x14
mov edi, 0x4805e0
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0xc]
add eax, 0x50
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0044f4bd
add esp, 4
jmp 0x43e2be
push 0x50
push 0
push 0x4805e0
call fcn.0044c410
add esp, 0xc
mov dword [0x4805e0], 1
mov dword [0x4805e4], 1
call fcn.0043e100
mov edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.00449b69
add esp, 4
cmp dword [ebp - 0x10], 0
jne 0x43e2df
mov dword [ebp - 0x1c], 0
jmp 0x43e2ec
mov dword [ebp - 8], 0x8123
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x1c], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x43e7a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x47e00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [0x47e9cd], 0
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x43e7f0
push 0
push 0
call fcn.00451051
add esp, 0x18
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00449aef
mov esp, ebp
pop ebp
ret

Function at 0x43e840
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x47e00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [0x47e9cc], 0
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x43e890
push 0
push 0
call fcn.00451051
add esp, 0x18
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00449aef
mov esp, ebp
pop ebp
ret
Function at 0x443980
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x466878
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x47e00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0xc
lea ecx, [ebp - 0x1c]
call fcn.00415380
lea ecx, [ebp - 0x1c]
call fcn.00416ca0
mov dword [ebp - 4], 0
mov eax, dword [0x47ff5c]
cdq
mov ecx, 0x3e8
idiv ecx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0
call fcn.00419460
cdq
mov ecx, 0x3e8
idiv ecx
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], 0x32
jge 0x4439f7
mov dword [ebp - 0x20], 2
jmp 0x443a31
cmp dword [ebp - 0x24], 0x64
jge 0x443a06
mov dword [ebp - 0x20], 3
jmp 0x443a31
cmp dword [ebp - 0x24], 0xc8
jge 0x443a18
mov dword [ebp - 0x20], 4
jmp 0x443a31
cmp dword [ebp - 0x24], 0x190
jge 0x443a2a
mov dword [ebp - 0x20], 5
jmp 0x443a31
mov dword [ebp - 0x20], 6
mov edx, dword [ebp - 0x20]
mov ecx, dword [edx*4 + 0x47e980]
imul ecx, dword [ebp - 0x28]
mov eax, dword [ebp + 0xc]
cdq
idiv ecx
mov dword [ebp - 0x3c], eax
mov edx, dword [ebp - 0x20]
mov eax, dword [edx*4 + 0x47e980]
imul eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 1
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x20]
mov dword [ecx + 0x28], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x2c]
mov dword [eax + 0x30], ecx
mov edx, dword [ebp - 0x30]
imul edx, dword [ebp - 0x2c]
imul edx, dword [ebp - 0x28]
mov eax, dword [ebp + 0xc]
sub eax, edx
mov dword [ebp - 0x34], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.004170d0
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00449aef
mov esp, ebp
pop ebp
ret