joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48fff0
Capabilities:
Terminate process

Disassembly:
sub esp, 4
push ebx
push esi
push edi
mov esi, ecx
push ebp
mov ecx, dword [esi + 4]
cmp dword [esi + 8], ecx
je 0x49003f
lea eax, [ecx - 4]
test ecx, ecx
je 0x49000c
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [esi + 4]
mov edx, dword [esp + 0x18]
lea ecx, [eax - 4]
cmp ecx, edx
je 0x490029
mov edi, dword [ecx - 4]
sub eax, 4
sub ecx, 4
mov dword [eax], edi
cmp ecx, edx
jne 0x49001a
mov eax, dword [esp + 0x1c]
pop ebp
pop edi
mov ecx, dword [eax]
mov dword [edx], ecx
add dword [esi + 4], 4
pop esi
pop ebx
add esp, 4
ret 8
sub ecx, dword [esi]
test ecx, 0xfffffffc
je 0x490054
sar ecx, 2
add ecx, ecx
mov dword [esp + 0x10], ecx
jmp 0x49005c
mov dword [esp + 0x10], 0x400
push 0
call dword [sym.imp.MSVCRT40.dll_void____cdecl___void____cdecl_set_new_handler_void____cdecl___void__]
mov eax, dword [esp + 0x14]
add esp, 4
shl eax, 2
push eax
call sub.MFC40.DLL_operator_new
add esp, 4
mov edi, eax
test edi, edi
jne 0x4900a5
mov ebx, dword [sym.imp.MSVCRT40.dll_class_ostream____cdecl_endl_class_ostream__]
push 0x4fc498
mov ecx, dword [sym.imp.MSVCRT40.dll_class_ostream_withassign_cerr]
call dword [sym.imp.MSVCRT40.dll_public:_class_ostream____thiscall_ostream::operator___char_const__]
push eax
call ebx
add esp, 4
push 1
call dword [sym.imp.MSVCRT40.dll_exit]
add esp, 4
mov eax, edi
mov ecx, dword [esi]
mov edx, dword [esp + 0x18]
cmp ecx, edx
je 0x4900c8
mov ebp, ecx
mov ebx, eax
add ecx, 4
add eax, 4
test ebx, ebx
je 0x4900c4
mov ebp, dword [ebp]
mov dword [ebx], ebp
cmp ecx, edx
jne 0x4900b1
mov eax, edx
sub eax, dword [esi]
and eax, 0xfffffffc
lea ecx, [eax + edi]
test ecx, ecx
je 0x4900de
mov eax, dword [esp + 0x1c]
mov ebx, dword [eax]
mov dword [ecx], ebx
mov eax, edx
mov ecx, dword [esi + 4]
sub eax, dword [esi]
and eax, 0xfffffffc
cmp ecx, edx
lea eax, [eax + edi + 4]
je 0x490107
mov ebp, edx
mov ebx, eax
add edx, 4
add eax, 4
test ebx, ebx
je 0x490103
mov ebp, dword [ebp]
mov dword [ebx], ebp
cmp edx, ecx
jne 0x4900f0
mov ecx, dword [esi]
mov eax, dword [esi + 4]
mov edx, ecx
cmp edx, eax
je 0x490117
add edx, 4
jmp 0x49010e
push ecx
call sub.MFC40.DLL_operator_delete
mov eax, dword [esp + 0x14]
add esp, 4
lea ecx, [edi + eax*4]
mov eax, dword [esi + 4]
sub eax, dword [esi]
mov dword [esi + 8], ecx
sar eax, 2
pop ebp
mov dword [esi], edi
lea eax, [edi + eax*4]
add eax, 4
pop edi
mov dword [esi + 4], eax
pop esi
pop ebx
add esp, 4
ret 8

Function at 0x492c70
Capabilities:
Get number of processors

Disassembly:
mov ecx, 0x50b178
jmp 0x401020
Function at 0x499630
Capabilities:
Terminate process

Disassembly:
sub esp, 4
push ebx
push esi
push edi
mov esi, ecx
push ebp
mov ecx, dword [esi + 4]
cmp dword [esi + 8], ecx
je 0x49967a
lea eax, [ecx - 1]
test ecx, ecx
je 0x49964c
mov al, byte [eax]
mov byte [ecx], al
mov eax, dword [esi + 4]
mov ecx, dword [esp + 0x18]
lea edi, [eax - 1]
cmp ecx, edi
je 0x499665
mov dl, byte [edi - 1]
dec eax
dec edi
mov byte [eax], dl
cmp ecx, edi
jne 0x49965a
mov eax, dword [esp + 0x1c]
pop ebp
pop edi
mov al, byte [eax]
mov byte [ecx], al
inc dword [esi + 4]
pop esi
pop ebx
add esp, 4
ret 8
mov eax, dword [esi]
cmp ecx, eax
je 0x49968a
sub ecx, eax
add ecx, ecx
mov dword [esp + 0x10], ecx
jmp 0x499692
mov dword [esp + 0x10], 0x1000
push 0
call dword [sym.imp.MSVCRT40.dll_void____cdecl___void____cdecl_set_new_handler_void____cdecl___void__]
mov eax, dword [esp + 0x14]
add esp, 4
push eax
call sub.MFC40.DLL_operator_new
add esp, 4
mov edi, eax
test edi, edi
jne 0x4996d8
mov ebx, dword [sym.imp.MSVCRT40.dll_class_ostream____cdecl_endl_class_ostream__]
push 0x4fc498
mov ecx, dword [sym.imp.MSVCRT40.dll_class_ostream_withassign_cerr]
call dword [sym.imp.MSVCRT40.dll_public:_class_ostream____thiscall_ostream::operator___char_const__]
push eax
call ebx
add esp, 4
push 1
call dword [sym.imp.MSVCRT40.dll_exit]
add esp, 4
mov ebx, edi
mov ebp, dword [esi]
mov ecx, dword [esp + 0x18]
cmp ebp, ecx
je 0x4996f6
mov eax, ebp
mov edx, ebx
inc ebp
inc ebx
test edx, edx
je 0x4996f2
mov al, byte [eax]
mov byte [edx], al
cmp ebp, ecx
jne 0x4996e4
mov eax, ecx
sub eax, dword [esi]
lea edx, [eax + edi]
test edx, edx
je 0x499709
mov eax, dword [esp + 0x1c]
mov al, byte [eax]
mov byte [edx], al
mov eax, ecx
mov ebx, dword [esi + 4]
sub eax, dword [esi]
cmp ebx, ecx
lea edx, [eax + edi + 1]
je 0x49972b
mov eax, ecx
mov ebp, edx
inc ecx
inc edx
test ebp, ebp
je 0x499727
mov al, byte [eax]
mov byte [ebp], al
cmp ecx, ebx
jne 0x499718
mov eax, dword [esi]
push eax
call sub.MFC40.DLL_operator_delete
mov eax, dword [esp + 0x14]
add esp, 4
add eax, edi
mov dword [esi + 8], eax
mov eax, dword [esi + 4]
sub eax, dword [esi]
pop ebp
add eax, edi
mov dword [esi], edi
inc eax
pop edi
mov dword [esi + 4], eax
pop esi
pop ebx
add esp, 4
ret 8
Function at 0x49c5f0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49c71f
push eax
mov dword fs:[0], esp
mov eax, dword [0x4ff654]
sub esp, 0x28
push ebx
push esi
mov esi, ecx
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.USER32.dll_GetDC]
push eax
call sub.MFC40.DLL_CDC::FromHandle
push 0
mov ecx, dword [0x4ff654]
push 0
mov dword [ebp - 0x10], eax
push 0x31
mov eax, dword [ecx + 0x20]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push eax
call sub.MFC40.DLL_CGdiObject::FromHandle
mov ecx, dword [ebp - 0x10]
push eax
mov edx, dword [ecx]
mov ebx, dword [edx + 0x30]
mov dword [ebp - 0x20], ebx
call ebx
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x2c], eax
call sub.MFC40.DLL_CString::CString_3
lea ecx, [ebp - 0x14]
mov edx, dword [ebp + 8]
mov dword [ebp - 4], 0
push ecx
mov eax, dword [edx + 8]
push eax
mov ecx, esi
call sub.MFC40.DLL_CListBox::GetText
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
push eax
mov ebx, dword [ebp - 0x10]
mov edx, dword [ecx - 8]
mov esi, dword [sym.imp.GDI32.dll_GetTextExtentPointA]
push edx
mov eax, dword [ebx + 8]
push ecx
push eax
call esi
mov edx, dword [ebp - 0x28]
push str.WVUTSRQPONMLKJIHGFEDCBAZYX
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x34], edx
call sub.MFC40.DLL_CString::CString_1
mov byte [ebp - 4], 1
mov ecx, dword [eax]
lea eax, [ebp - 0x1c]
push eax
mov edx, dword [ecx - 8]
push edx
push ecx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx + 8]
push eax
call esi
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x18], ecx
call fcn.0049c717
mov ecx, dword [ebp - 0x2c]
push ecx
mov ecx, dword [ebp - 0x10]
call dword [ebp - 0x20]
mov edx, dword [ebp - 0x34]
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x18]
mov dword [ecx + 0xc], edx
mov edx, dword [ebp - 0x10]
mov dword [ecx + 0x10], eax
mov ecx, dword [0x4ff654]
mov eax, dword [edx + 4]
push eax
mov edx, dword [ecx + 0x20]
push edx
call dword [sym.imp.USER32.dll_ReleaseDC]
mov dword [ebp - 4], 0xffffffff
call fcn.0049c729
mov eax, dword [ebp - 0xc]
pop esi
mov dword fs:[0], eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x49ecd0
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
mov ebx, ecx
lea ecx, [esp + 0x10]
push ebp
call fcn.0041a5c0
cmp dword [esp + 0x14], 2
jne 0x49ecf3
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x10
ret
push str.IntercimAutoProOptFileMmap
push 0x600
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebx + 0x10], eax
test eax, eax
jne 0x49ed1c
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x10
ret
push 0
push 0
push 0
push 0xf001f
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebp, eax
mov dword [ebx + 0x14], eax
test ebp, ebp
jne 0x49ed54
mov eax, dword [ebx + 0x10]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call ebp
xor eax, eax
pop ebp
mov dword [ebx + 0x10], 0
pop edi
pop esi
pop ebx
add esp, 0x10
ret
push str.IntercimAutoProOptFileMutx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esp + 0x10], eax
test eax, eax
je 0x49edbd
push 0xffffffffffffffff
add ebp, 4
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], 0
mov edx, 6
mov edi, 0x4fc820
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
add ebp, 0xff
and ecx, 3
rep movsb byte es:[edi], byte [esi]
dec edx
jne 0x49ed83
mov eax, dword [esp + 0x10]
mov ebp, dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push eax
call ebp
mov eax, dword [esp + 0x10]
pop ebp
pop edi
mov dword [ebx + 8], eax
mov eax, 1
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x4a2040
Capabilities:
Get number of processors

Disassembly:
mov ecx, 0x50b1d8
jmp 0x401020
Function at 0x4a5fd0
Capabilities:
Terminate process

Disassembly:
sub esp, 8
push ebx
push esi
push edi
mov esi, ecx
push ebp
mov ecx, dword [esi + 4]
cmp dword [esi + 8], ecx
je 0x4a602e
lea eax, [ecx - 8]
test ecx, ecx
je 0x4a5fee
push eax
call fcn.004a1630
mov ecx, dword [esi + 4]
mov edi, dword [esp + 0x1c]
lea edx, [ecx - 8]
cmp edi, edx
je 0x4a6012
mov eax, dword [edx - 8]
sub edx, 8
mov dword [ecx - 8], eax
sub ecx, 8
mov ebx, dword [edx + 4]
cmp edi, edx
mov dword [ecx + 4], ebx
jne 0x4a5ffc
mov edx, dword [esp + 0x20]
pop ebp
mov eax, dword [edx]
mov dword [edi], eax
mov ecx, dword [edx + 4]
mov dword [edi + 4], ecx
pop edi
add dword [esi + 4], 8
pop esi
pop ebx
add esp, 8
ret 8
sub ecx, dword [esi]
test ecx, 0xfffffff8
je 0x4a6043
sar ecx, 3
add ecx, ecx
mov dword [esp + 0x14], ecx
jmp 0x4a604b
mov dword [esp + 0x14], 0x200
push 0
call dword [sym.imp.MSVCRT40.dll_void____cdecl___void____cdecl_set_new_handler_void____cdecl___void__]
mov eax, dword [esp + 0x18]
add esp, 4
shl eax, 3
push eax
call sub.MFC40.DLL_operator_new
mov dword [esp + 0x14], eax
add esp, 4
test eax, eax
jne 0x4a6096
mov edi, dword [sym.imp.MSVCRT40.dll_class_ostream____cdecl_endl_class_ostream__]
push 0x4fc498
mov ecx, dword [sym.imp.MSVCRT40.dll_class_ostream_withassign_cerr]
call dword [sym.imp.MSVCRT40.dll_public:_class_ostream____thiscall_ostream::operator___char_const__]
push eax
call edi
add esp, 4
push 1
call dword [sym.imp.MSVCRT40.dll_exit]
add esp, 4
mov ebx, dword [esp + 0x10]
mov ebp, dword [esi]
mov edi, dword [esp + 0x1c]
cmp edi, ebp
je 0x4a60bc
mov eax, ebp
mov ecx, ebx
add ebp, 8
add ebx, 8
test ecx, ecx
je 0x4a60b8
push eax
call fcn.004a1630
cmp edi, ebp
jne 0x4a60a4
mov eax, edi
mov ecx, dword [esp + 0x10]
sub eax, dword [esi]
and eax, 0xfffffff8
add ecx, eax
je 0x4a60d5
mov edx, dword [esp + 0x20]
push edx
call fcn.004a1630
mov eax, edi
mov ecx, dword [esp + 0x10]
sub eax, dword [esi]
mov ebp, dword [esi + 4]
and eax, 0xfffffff8
cmp ebp, edi
lea ebx, [eax + ecx + 8]
je 0x4a6103
mov eax, edi
mov ecx, ebx
add edi, 8
add ebx, 8
test ecx, ecx
je 0x4a60ff
push eax
call fcn.004a1630
cmp edi, ebp
jne 0x4a60eb
mov edx, dword [esi]
mov eax, dword [esi + 4]
mov ecx, edx
cmp eax, ecx
je 0x4a6113
add ecx, 8
jmp 0x4a610a
push edx
call sub.MFC40.DLL_operator_delete
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
add esp, 4
lea edx, [ecx + eax*8]
mov eax, dword [esi + 4]
mov dword [esi + 8], edx
sub eax, dword [esi]
pop ebp
sar eax, 3
pop edi
mov dword [esi], ecx
lea eax, [ecx + eax*8]
add eax, 8
mov dword [esi + 4], eax
pop esi
pop ebx
add esp, 8
ret 8

Function at 0x4aae10
Capabilities:
Get number of processors

Disassembly:
mov ecx, 0x50b240
jmp 0x401020

Function at 0x4acfb0
Capabilities:
Get number of processors

Disassembly:
mov ecx, 0x50b298
jmp 0x401020
Function at 0x4afc90
Capabilities:
Terminate process

Disassembly:
push esi
push edi
push 0
call dword [sym.imp.MSVCRT40.dll_void____cdecl___void____cdecl_set_new_handler_void____cdecl___void__]
mov eax, dword [esp + 0x10]
add esp, 4
shl eax, 2
lea ecx, [eax + eax*8]
push ecx
call sub.MFC40.DLL_operator_new
add esp, 4
mov edi, eax
test edi, edi
jne 0x4afcde
mov esi, dword [sym.imp.MSVCRT40.dll_class_ostream____cdecl_endl_class_ostream__]
push 0x4fc498
mov ecx, dword [sym.imp.MSVCRT40.dll_class_ostream_withassign_cerr]
call dword [sym.imp.MSVCRT40.dll_public:_class_ostream____thiscall_ostream::operator___char_const__]
push eax
call esi
add esp, 4
push 1
call dword [sym.imp.MSVCRT40.dll_exit]
add esp, 4
mov eax, edi
pop edi
pop esi
ret
Function at 0x4b0240
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, dword [esp + 0x10]
push ebp
mov ecx, 0x24
push 0
mov eax, dword [edi + 4]
sub eax, dword [edi]
cdq
idiv ecx
mov ebx, eax
call dword [sym.imp.MSVCRT40.dll_void____cdecl___void____cdecl_set_new_handler_void____cdecl___void__]
shl ebx, 2
add esp, 4
lea eax, [ebx + ebx*8]
push eax
call sub.MFC40.DLL_operator_new
add esp, 4
mov ebx, eax
test ebx, ebx
jne 0x4b02a1
mov ebp, dword [sym.imp.MSVCRT40.dll_class_ostream____cdecl_endl_class_ostream__]
push 0x4fc498
mov ecx, dword [sym.imp.MSVCRT40.dll_class_ostream_withassign_cerr]
call dword [sym.imp.MSVCRT40.dll_public:_class_ostream____thiscall_ostream::operator___char_const__]
push eax
call ebp
add esp, 4
push 1
call dword [sym.imp.MSVCRT40.dll_exit]
add esp, 4
mov dword [esi], ebx
mov ebp, dword [edi + 4]
mov edi, dword [edi]
cmp edi, ebp
je 0x4b02c4
mov eax, edi
mov ecx, ebx
add edi, 0x24
add ebx, 0x24
test ecx, ecx
je 0x4b02c0
push eax
call fcn.00419de0
cmp edi, ebp
jne 0x4b02ac
mov eax, esi
pop ebp
pop edi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
pop esi
pop ebx
ret 4

Function at 0x4b2e30
Capabilities:
Terminate process

Disassembly:
push esi
push edi
push 0
call dword [sym.imp.MSVCRT40.dll_void____cdecl___void____cdecl_set_new_handler_void____cdecl___void__]
mov eax, dword [esp + 0x10]
add esp, 4
shl eax, 2
push eax
call sub.MFC40.DLL_operator_new
add esp, 4
mov edi, eax
test edi, edi
jne 0x4b2e7b
mov esi, dword [sym.imp.MSVCRT40.dll_class_ostream____cdecl_endl_class_ostream__]
push 0x4fc498
mov ecx, dword [sym.imp.MSVCRT40.dll_class_ostream_withassign_cerr]
call dword [sym.imp.MSVCRT40.dll_public:_class_ostream____thiscall_ostream::operator___char_const__]
push eax
call esi
add esp, 4
push 1
call dword [sym.imp.MSVCRT40.dll_exit]
add esp, 4
mov eax, edi
pop edi
pop esi
ret

Function at 0x4bced0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bcf73
push eax
mov dword fs:[0], esp
sub esp, 4
push esi
push edi
mov dword [ebp - 0x10], ecx
mov esi, ecx
xor edi, edi
lea ecx, [esi + 8]
call sub.MFC40.DLL_CString::CString_3
lea ecx, [esi + 0xc]
mov dword [ebp - 4], edi
call sub.MFC40.DLL_CString::CString_3
mov byte [ebp - 4], 1
lea ecx, [esi + 0x10]
call sub.MFC40.DLL_CString::CString_3
mov byte [ebp - 4], 2
lea ecx, [esi + 0x14]
call fcn.004bce30
mov byte [ebp - 4], 3
mov word [esi + 0x2c], di
mov dword [esi + 0x28], edi
mov eax, esi
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], edi
mov dword [esi], vtable.CBaseOptionFileOld.0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x3c], edi
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4bd020
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bd13d
push eax
mov dword fs:[0], esp
sub esp, 4
push ebx
push esi
mov dword [ebp - 0x10], ecx
push edi
mov esi, ecx
lea ecx, [ecx + 8]
call sub.MFC40.DLL_CString::CString_3
mov dword [ebp - 4], 0
lea ecx, [esi + 0xc]
lea ebx, [esi + 0x14]
call sub.MFC40.DLL_CString::CString_3
mov byte [ebp - 4], 1
lea ecx, [esi + 0x10]
call sub.MFC40.DLL_CString::CString_3
mov byte [ebp - 4], 2
mov ecx, ebx
call fcn.004bce30
mov edi, dword [ebp + 8]
mov ecx, ebx
mov byte [ebp - 4], 3
lea eax, [edi + 0x14]
mov dword [esi], vtable.CBaseOptionFileOld.0
push eax
call sub.MFC40.DLL_CString::operator
lea eax, [edi + 0x18]
lea ecx, [esi + 0x18]
push eax
call sub.MFC40.DLL_CString::operator
lea eax, [edi + 0x1c]
lea ecx, [esi + 0x1c]
push eax
call sub.MFC40.DLL_CString::operator
lea eax, [edi + 0x20]
lea ecx, [esi + 0x20]
push eax
call sub.MFC40.DLL_CString::operator
mov al, byte [edi + 0x24]
mov byte [esi + 0x24], al
mov cl, byte [edi + 0x25]
mov byte [esi + 0x25], cl
mov dl, byte [edi + 0x26]
mov byte [esi + 0x26], dl
mov al, byte [edi + 0x27]
mov byte [esi + 0x27], al
mov cx, word [edi + 0x2c]
mov word [esi + 0x2c], cx
mov edx, dword [edi + 0x30]
mov dword [esi + 0x30], edx
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x3c], eax
mov ecx, dword [edi + 0x38]
mov dword [esi + 0x38], ecx
lea edx, [edi + 0xc]
push edx
lea ecx, [esi + 0xc]
call sub.MFC40.DLL_CString::operator
lea ecx, [edi + 0x10]
push ecx
lea ecx, [esi + 0x10]
call sub.MFC40.DLL_CString::operator
mov ecx, dword [edi + 0x28]
mov eax, esi
pop edi
mov dword [esi + 0x28], ecx
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4c2bf0
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
cmp ecx, esi
push ebp
mov edi, ecx
jne 0x4c2c07
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
ret 4
mov ebx, dword [esi + 4]
mov edx, dword [esi]
mov ebp, ebx
mov ecx, dword [edi]
sub ebp, edx
mov eax, dword [edi + 8]
sar ebp, 2
sub eax, ecx
sar eax, 2
cmp eax, ebp
jb 0x4c2c95
mov eax, dword [edi + 4]
sub eax, ecx
sar eax, 2
cmp eax, ebp
jb 0x4c2c48
cmp ebx, edx
je 0x4c2d10
mov eax, dword [edx]
add edx, 4
mov dword [ecx], eax
add ecx, 4
cmp ebx, edx
jne 0x4c2c35
jmp 0x4c2d10
lea eax, [edx + eax*4]
cmp edx, eax
je 0x4c2c5d
mov ebx, dword [edx]
add edx, 4
mov dword [ecx], ebx
add ecx, 4
cmp edx, eax
jne 0x4c2c4f
mov eax, dword [edi]
mov ecx, dword [edi + 4]
sub ecx, eax
mov ebx, dword [esi + 4]
sar ecx, 2
shl ecx, 2
lea edx, [eax + ecx]
mov eax, dword [esi]
add eax, ecx
cmp eax, ebx
je 0x4c2d10
mov ebp, eax
mov ecx, edx
add eax, 4
add edx, 4
test ecx, ecx
je 0x4c2c8f
mov ebp, dword [ebp]
mov dword [ecx], ebp
cmp eax, ebx
jne 0x4c2c7c
jmp 0x4c2d10
push ecx
call sub.MFC40.DLL_operator_delete
add esp, 4
mov ebx, dword [esi + 4]
sub ebx, dword [esi]
push 0
sar ebx, 2
call dword [sym.imp.MSVCRT40.dll_void____cdecl___void____cdecl_set_new_handler_void____cdecl___void__]
shl ebx, 2
add esp, 4
push ebx
call sub.MFC40.DLL_operator_new
add esp, 4
mov ebx, eax
test ebx, ebx
jne 0x4c2ceb
mov ebp, dword [sym.imp.MSVCRT40.dll_class_ostream____cdecl_endl_class_ostream__]
push 0x4fc498
mov ecx, dword [sym.imp.MSVCRT40.dll_class_ostream_withassign_cerr]
call dword [sym.imp.MSVCRT40.dll_public:_class_ostream____thiscall_ostream::operator___char_const__]
push eax
call ebp
add esp, 4
push 1
call dword [sym.imp.MSVCRT40.dll_exit]
add esp, 4
mov dword [edi], ebx
mov ecx, dword [esi + 4]
mov eax, dword [esi]
cmp eax, ecx
je 0x4c2d0d
mov ebp, eax
mov edx, ebx
add eax, 4
add ebx, 4
test edx, edx
je 0x4c2d09
mov ebp, dword [ebp]
mov dword [edx], ebp
cmp eax, ecx
jne 0x4c2cf6
mov dword [edi + 8], ebx
mov eax, dword [esi + 4]
pop ebp
sub eax, dword [esi]
sar eax, 2
shl eax, 2
add eax, dword [edi]
mov dword [edi + 4], eax
mov eax, edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x4c4680
Capabilities:
Get number of processors

Disassembly:
mov ecx, 0x50b320
jmp 0x401020
Function at 0x4c7550
Capabilities:
Terminate process

Disassembly:
sub esp, 8
push ebx
push esi
mov edx, dword [ecx + 4]
push edi
cmp dword [ecx + 8], edx
push ebp
mov esi, ecx
je 0x4c75b2
lea eax, [edx - 8]
test edx, edx
je 0x4c7572
mov ecx, dword [eax]
mov dword [edx], ecx
mov eax, dword [eax + 4]
mov dword [edx + 4], eax
mov edx, dword [esi + 4]
mov ecx, dword [esp + 0x1c]
lea edi, [edx - 8]
cmp ecx, edi
je 0x4c7596
mov eax, dword [edi - 8]
sub edi, 8
mov dword [edx - 8], eax
sub edx, 8
mov ebx, dword [edi + 4]
cmp ecx, edi
mov dword [edx + 4], ebx
jne 0x4c7580
mov edx, dword [esp + 0x20]
pop ebp
pop edi
mov eax, dword [edx]
mov dword [ecx], eax
mov ebx, dword [edx + 4]
mov dword [ecx + 4], ebx
add dword [esi + 4], 8
pop esi
pop ebx
add esp, 8
ret 8
sub edx, dword [esi]
test edx, 0xfffffff8
je 0x4c75c7
sar edx, 3
add edx, edx
mov dword [esp + 0x14], edx
jmp 0x4c75cf
mov dword [esp + 0x14], 0x200
push 0
call dword [sym.imp.MSVCRT40.dll_void____cdecl___void____cdecl_set_new_handler_void____cdecl___void__]
mov eax, dword [esp + 0x18]
add esp, 4
shl eax, 3
push eax
call sub.MFC40.DLL_operator_new
mov dword [esp + 0x14], eax
add esp, 4
test eax, eax
jne 0x4c761a
mov edi, dword [sym.imp.MSVCRT40.dll_class_ostream____cdecl_endl_class_ostream__]
push 0x4fc498
mov ecx, dword [sym.imp.MSVCRT40.dll_class_ostream_withassign_cerr]
call dword [sym.imp.MSVCRT40.dll_public:_class_ostream____thiscall_ostream::operator___char_const__]
push eax
call edi
add esp, 4
push 1
call dword [sym.imp.MSVCRT40.dll_exit]
add esp, 4
mov edx, dword [esp + 0x10]
mov edi, dword [esi]
mov ecx, dword [esp + 0x1c]
cmp edi, ecx
je 0x4c7644
mov eax, edi
mov ebx, edx
add edi, 8
add edx, 8
test ebx, ebx
je 0x4c7640
mov ebp, dword [eax]
mov dword [ebx], ebp
mov eax, dword [eax + 4]
mov dword [ebx + 4], eax
cmp edi, ecx
jne 0x4c7628
mov eax, ecx
mov edi, dword [esp + 0x10]
sub eax, dword [esi]
and eax, 0xfffffff8
add edi, eax
je 0x4c7661
mov edx, dword [esp + 0x20]
mov eax, dword [edx]
mov dword [edi], eax
mov ebx, dword [edx + 4]
mov dword [edi + 4], ebx
mov eax, ecx
mov edx, dword [esp + 0x10]
sub eax, dword [esi]
mov ebx, dword [esi + 4]
and eax, 0xfffffff8
cmp ebx, ecx
lea edx, [eax + edx + 8]
je 0x4c7693
mov eax, ecx
mov edi, edx
add ecx, 8
add edx, 8
test edi, edi
je 0x4c768f
mov ebp, dword [eax]
mov dword [edi], ebp
mov eax, dword [eax + 4]
mov dword [edi + 4], eax
cmp ebx, ecx
jne 0x4c7677
mov ecx, dword [esi]
mov eax, dword [esi + 4]
mov edx, ecx
cmp edx, eax
je 0x4c76a3
add edx, 8
jmp 0x4c769a
push ecx
call sub.MFC40.DLL_operator_delete
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
add esp, 4
lea ecx, [edx + eax*8]
mov eax, dword [esi + 4]
mov dword [esi + 8], ecx
sub eax, dword [esi]
pop ebp
sar eax, 3
pop edi
mov dword [esi], edx
lea eax, [edx + eax*8]
add eax, 8
mov dword [esi + 4], eax
pop esi
pop ebx
add esp, 8
ret 8
Function at 0x4c9ab0
Capabilities:
Terminate process

Disassembly:
push esi
push edi
push 0
call dword [sym.imp.MSVCRT40.dll_void____cdecl___void____cdecl_set_new_handler_void____cdecl___void__]
mov eax, dword [esp + 0x10]
add esp, 4
shl eax, 3
push eax
call sub.MFC40.DLL_operator_new
add esp, 4
mov edi, eax
test edi, edi
jne 0x4c9afb
mov esi, dword [sym.imp.MSVCRT40.dll_class_ostream____cdecl_endl_class_ostream__]
push 0x4fc498
mov ecx, dword [sym.imp.MSVCRT40.dll_class_ostream_withassign_cerr]
call dword [sym.imp.MSVCRT40.dll_public:_class_ostream____thiscall_ostream::operator___char_const__]
push eax
call esi
add esp, 4
push 1
call dword [sym.imp.MSVCRT40.dll_exit]
add esp, 4
mov eax, edi
pop edi
pop esi
ret