joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43ce70
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6a30b0
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x778400]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x6c], ecx
push 0xc
lea ecx, [ebp - 0x24]
call fcn.00413f70
lea eax, [ebp - 0x24]
push eax
call fcn.00415440
add esp, 4
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x58], ecx
push 4
lea ecx, [ebp - 0x14]
call fcn.00413f70
lea edx, [ebp - 0x14]
push edx
mov ecx, dword [ebp - 0x58]
call fcn.00416630
push 4
lea ecx, [ebp - 0x18]
call fcn.00413f70
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x58]
call fcn.00416660
jmp 0x43cef4
lea ecx, [ebp - 0x14]
call fcn.00418400
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x14]
call fcn.0041fb00
movzx edx, al
test edx, edx
je 0x43cfbf
lea ecx, [ebp - 0x14]
call fcn.00416e70
push eax
lea ecx, [ebp - 0x3c]
call fcn.00417770
mov byte [ebp - 4], 1
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x64], esp
lea eax, [ebp - 0x3c]
push eax
call fcn.00417770
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x5c]
mov dword [ebp - 0x60], ecx
mov byte [ebp - 4], 2
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x74], esp
mov edx, dword [ebp + 8]
push edx
call fcn.00417770
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x54]
push eax
mov byte [ebp - 4], 1
call fcn.004ead10
add esp, 0x34
mov dword [ebp - 0x70], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x54]
call fcn.0041b040
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43cfa2
lea ecx, [ebp - 0x54]
call fcn.0041b040
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x43cfa2
push 0
lea ecx, [ebp - 0x3c]
call fcn.0041b040
push eax
call fcn.004e8d10
add esp, 8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x54]
call fcn.00419320
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3c]
call fcn.00419320
jmp 0x43ceec
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.00415ba0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0066c98d
mov esp, ebp
pop ebp
ret 4
Function at 0x43d730
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6a31e6
mov eax, dword fs:[0]
push eax
sub esp, 0x298
mov eax, dword [0x778400]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x240], ecx
mov dword [ebp - 0x238], 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x270], esp
push 0x74166c
call fcn.00418f80
mov dword [ebp - 0x24c], eax
mov eax, dword [ebp - 0x24c]
mov dword [ebp - 0x268], eax
mov dword [ebp - 4], 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x264], esp
mov edx, dword [ebp + 8]
push edx
call fcn.00417770
mov dword [ebp - 0x26c], eax
lea eax, [ebp - 0x230]
push eax
mov dword [ebp - 4], 0xffffffff
call fcn.004ead10
add esp, 0x34
mov dword [ebp - 0x274], eax
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x230]
call fcn.0041b040
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [ebp - 0x23c], eax
mov ecx, dword [ebp - 0x23c]
push ecx
push str.Begin_IsNewInstall_:_bHasOldVersion___d__n
call fcn.004e64c0
add esp, 8
cmp dword [ebp - 0x23c], 0
jne 0x43d85c
lea edx, [ebp - 0x28c]
push edx
mov eax, dword [ebp - 0x240]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x240]
mov eax, dword [edx + 0x70]
call eax
mov dword [ebp - 0x260], eax
mov ecx, dword [ebp - 0x238]
or ecx, 1
mov dword [ebp - 0x238], ecx
mov ecx, dword [ebp - 0x260]
call fcn.0041af60
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x43d85c
mov dword [ebp - 0x244], 0
jmp 0x43d866
mov dword [ebp - 0x244], 1
mov dl, byte [ebp - 0x244]
mov byte [ebp - 0x231], dl
mov eax, dword [ebp - 0x238]
and eax, 1
je 0x43d88f
and dword [ebp - 0x238], 0xfffffffe
lea ecx, [ebp - 0x28c]
call fcn.00419eb0
movzx ecx, byte [ebp - 0x231]
test ecx, ecx
je 0x43d8d5
mov edx, dword [ebp - 0x23c]
push edx
push str.IsNewInstall_:_bHasOldVersion__d_._n
call fcn.004e64c0
add esp, 8
mov dword [ebp - 0x25c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.00419320
mov eax, dword [ebp - 0x25c]
jmp 0x43d9ac
mov dword [ebp - 0x248], 1
xor eax, eax
mov word [ebp - 0x218], ax
push 0x206
push 0
lea ecx, [ebp - 0x216]
push ecx
call fcn.0066eb10
add esp, 0xc
lea edx, [ebp - 0x218]
push edx
call fcn.004e9420
add esp, 4
lea eax, [ebp - 0x2a4]
push eax
call fcn.00414550
add esp, 4
mov dword [ebp - 0x258], eax
mov ecx, dword [ebp - 0x258]
call fcn.0041b040
push eax
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x2a4]
call fcn.00419320
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43d988
push str.IsNewInstall_:_appdata_folder_n
call fcn.004e64c0
add esp, 4
mov dword [ebp - 0x254], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.00419320
mov eax, dword [ebp - 0x254]
jmp 0x43d9ac
mov eax, dword [ebp - 0x248]
mov dword [ebp - 0x250], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.00419320
mov eax, dword [ebp - 0x250]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0066c98d
mov esp, ebp
pop ebp
ret 4
Function at 0x442050
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x630
mov eax, dword [0x778400]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x62c], ecx
push 0x741d84
mov ecx, dword [ebp - 0x62c]
add ecx, 0x1380
call fcn.00415810
push 0x741d88
mov ecx, dword [ebp - 0x62c]
add ecx, 0x1398
call fcn.00415810
mov eax, dword [ebp - 0x62c]
add eax, 0xcc
mov dword [ebp - 0x630], eax
push 4
lea ecx, [ebp - 0x620]
call fcn.00413f70
lea ecx, [ebp - 0x620]
push ecx
mov ecx, dword [ebp - 0x630]
call fcn.00416630
push 4
lea ecx, [ebp - 0x624]
call fcn.00413f70
lea edx, [ebp - 0x624]
push edx
mov ecx, dword [ebp - 0x630]
call fcn.00416660
jmp 0x4420f1
lea ecx, [ebp - 0x620]
call fcn.00445ae0
lea eax, [ebp - 0x624]
push eax
lea ecx, [ebp - 0x620]
call fcn.0041fb00
movzx ecx, al
test ecx, ecx
je 0x4421d9
lea ecx, [ebp - 0x620]
call fcn.00416e70
mov dword [ebp - 0x628], eax
mov edx, dword [ebp - 0x628]
cmp dword [edx], 0
je 0x4421d4
mov eax, dword [ebp - 0x628]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x628]
mov eax, dword [ecx]
mov ecx, dword [edx]
mov edx, dword [eax + 0x7c]
call edx
test eax, eax
je 0x4421d4
mov eax, dword [ebp - 0x628]
mov ecx, dword [eax + 8]
push ecx
call fcn.004f59e0
add esp, 4
push eax
mov ecx, dword [ebp - 0x62c]
add ecx, 0x1380
call fcn.00415810
mov edx, dword [ebp - 0x628]
mov eax, dword [edx + 4]
and eax, 1
je 0x4421d2
xor ecx, ecx
mov word [ebp - 0x61c], cx
push 0x616
push 0
lea edx, [ebp - 0x61a]
push edx
call fcn.0066eb10
add esp, 0xc
push 0x30c
lea eax, [ebp - 0x61c]
push eax
mov ecx, dword [ebp - 0x628]
mov edx, dword [ecx + 0x4c]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x61c]
push eax
mov ecx, dword [ebp - 0x62c]
add ecx, 0x1398
call fcn.00415810
jmp 0x4421d9
jmp 0x4420e6
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0066c98d
mov esp, ebp
pop ebp
ret
Function at 0x4428c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6a37f8
mov eax, dword fs:[0]
push eax
sub esp, 0xb0
mov eax, dword [0x778400]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x44]
cmp dword [eax + 0x134], 0
jne 0x442a7b
mov ecx, dword [ebp - 0x44]
cmp dword [ecx + 0xf8], 6
jne 0x442a7b
call fcn.00444c90
test eax, eax
jne 0x442a7b
lea edx, [ebp - 0x28]
push edx
call fcn.00415610
add esp, 4
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00419090
movzx eax, al
test eax, eax
jne 0x442a6c
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x8c]
push edx
mov ecx, dword [ebp - 0x44]
call fcn.004416f0
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
push eax
lea ecx, [ebp - 0x28]
call fcn.00415700
lea ecx, [ebp - 0x8c]
call fcn.00419eb0
push 0x73e6df
lea ecx, [ebp - 0x74]
call fcn.00419d50
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x74]
push ecx
push 0
push 0
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0xa4]
push eax
mov ecx, dword [ebp - 0x44]
call fcn.00441b50
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x28]
call fcn.00415700
lea ecx, [ebp - 0xa4]
call fcn.00419eb0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x74]
call fcn.00419eb0
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0xbc]
push eax
mov ecx, dword [ebp - 0x44]
call fcn.00441f00
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
push ecx
lea ecx, [ebp - 0x28]
call fcn.00415700
lea ecx, [ebp - 0xbc]
call fcn.00419eb0
push 0x741e38
lea ecx, [ebp - 0x28]
call fcn.004157f0
mov edx, dword [ebp - 0x44]
add edx, 0x231
push edx
lea ecx, [ebp - 0x28]
call fcn.004157f0
lea ecx, [ebp - 0x40]
call fcn.00419520
mov byte [ebp - 4], 2
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x5c], esp
lea eax, [ebp - 0x28]
push eax
call fcn.004190c0
mov dword [ebp - 0x58], eax
lea ecx, [ebp - 0x40]
push ecx
call fcn.004e65b0
add esp, 0x1c
push 5
push 0
push 0
lea ecx, [ebp - 0x40]
call fcn.0041b040
push eax
push 0x741e3c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x50], eax
mov edx, dword [ebp - 0x50]
mov dword [0x7797c0], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00419320
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00419eb0
push str.botton
mov ecx, 0x78b158
call fcn.004157b0
push 0
push 0
push 0x10
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0066c98d
mov esp, ebp
pop ebp
ret
Function at 0x452050
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.004f4c50
mov ecx, dword [ebp - 4]
call fcn.00452350
mov ecx, dword [ebp - 4]
call fcn.00453020
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x453410
push 0
push 0
call fcn.0066da1a
add esp, 0x18
mov edx, dword [ebp - 4]
mov dword [edx + 0xb8], eax
mov eax, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x453dc0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.004f4c50
mov ecx, dword [ebp - 4]
call fcn.004540a0
mov ecx, dword [ebp - 4]
call fcn.00418610
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x455270
push 0
push 0
call fcn.0066da1a
add esp, 0x18
mov edx, dword [ebp - 4]
mov dword [edx + 0x54], eax
mov eax, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x4570e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0xc]
and ecx, 1
je 0x457145
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 0xc]
and eax, 8
jne 0x457145
push 0xfffffffffffffff0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
and edx, 0x10000000
je 0x457145
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0xc]
or ecx, 4
mov edx, dword [ebp - 4]
mov byte [edx + 0xc], cl
mov eax, dword [ebp - 8]
and eax, 0x21000000
jne 0x457145
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + 0xc]
or edx, 2
mov eax, dword [ebp - 4]
mov byte [eax + 0xc], dl
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + 0xc]
and edx, 2
je 0x45716e
push 8
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call fcn.00455ad0
jmp 0x45717d
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov esp, ebp
pop ebp
ret 4

Function at 0x459f60
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6a4c24
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push esi
push edi
mov eax, dword [0x778400]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.boost::detail::thread_data_base.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [ebp - 4], 0
lea ecx, [edi + 0x14]
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
call fcn.00462210
mov dword [edi + 0x14], eax
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
push 0
push 0
push 1
push 0
mov byte [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
jne 0x45a031
push str.boost::thread_resource_error
push 0xb
lea ecx, [ebp - 0x3c]
call fcn.00459d80
mov dword [ebp - 0x3c], vtable.boost::thread_resource_error.0
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 4
push eax
call fcn.004625d0
mov dword [edi + 0x34], eax
mov eax, edi
mov byte [edi + 0x38], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x45f880
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x6a5558
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x778400]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
push edi
mov eax, dword [0x778400]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x40], 0
je 0x45fa34
cmp byte [edi + 0x45], 0
je 0x45fa34
mov esi, dword [edi]
call fcn.00426d20
push eax
mov ecx, edi
call dword [esi + 0xc]
mov dword [esp + 0x14], eax
call fcn.00426d20
mov dword [esp + 0x18], eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.00427280
add esp, 8
test al, al
je 0x45f904
xor al, al
jmp 0x45fa36
lea ecx, [esp + 0x13]
call fcn.00414210
push eax
lea ecx, [esp + 0x34]
call fcn.00419370
push 0
push 0
lea ecx, [esp + 0x38]
call fcn.00419e10
push 0
push 8
lea ecx, [esp + 0x38]
call fcn.00419ba0
test al, al
je 0x45f94f
push 0
push 8
push 0
lea ecx, [esp + 0x3c]
call fcn.00426370
push 8
lea ecx, [esp + 0x34]
call fcn.00419dd0
mov dword [esp + 0x58], 0
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x34]
call fcn.004187f0
mov ecx, eax
call fcn.00416e70
lea ecx, [esp + 0x30]
mov esi, eax
call fcn.004188e0
add esi, eax
lea ecx, [esp + 0x30]
lea eax, [esp + 0x28]
push eax
call fcn.004187f0
mov ecx, eax
call fcn.00416e70
mov ecx, dword [edi + 0x40]
lea ebx, [esp + 0x2c]
push ebx
push esi
push eax
mov edx, dword [ecx]
lea ebx, [edi + 0x48]
push ebx
call dword [edx + 0x20]
sub eax, 0
je 0x45f9bd
dec eax
je 0x45f9c1
sub eax, 2
je 0x45fa25
lea ecx, [esp + 0x30]
xor bl, bl
call fcn.00419eb0
mov al, bl
jmp 0x45fa36
mov byte [edi + 0x45], 0
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x34]
call fcn.004187f0
mov ecx, eax
call fcn.00416e70
mov esi, dword [esp + 0x2c]
sub esi, eax
je 0x45fa06
push dword [edi + 0x50]
lea eax, [esp + 0x28]
push esi
push 1
push eax
lea ecx, [esp + 0x40]
call fcn.004187f0
mov ecx, eax
call fcn.00416e70
push eax
call fcn.00673e65
add esp, 0x10
cmp esi, eax
jne 0x45f9ae
cmp byte [edi + 0x45], 0
je 0x45fa25
test esi, esi
jne 0x45f957
push esi
push 8
lea ecx, [esp + 0x38]
call fcn.0041dad0
jmp 0x45f957
lea ecx, [esp + 0x30]
mov bl, 1
call fcn.00419eb0
mov al, bl
jmp 0x45fa36
mov al, 1
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.0066c98d
mov esp, ebp
pop ebp
ret
Function at 0x465920
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6a5fe3
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x778400]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
mov dword [ebp - 0x14], esi
call fcn.004190c0
lea eax, [ebp + 0x20]
mov byte [ebp - 4], 1
push eax
lea ecx, [esi + 0x18]
call fcn.004190c0
mov al, byte [ebp + 0x38]
mov byte [esi + 0x30], al
mov al, byte [ebp + 0x39]
mov byte [esi + 0x31], al
mov eax, dword [ebp + 0x3c]
mov dword [esi + 0x34], eax
mov al, byte [ebp + 0x40]
mov byte [esi + 0x38], al
mov byte [ebp - 4], 2
lea edi, [esi + 0x3c]
mov eax, dword [ebp + 0x44]
lea ebx, [esi + 0x40]
mov dword [edi], eax
mov eax, dword [ebp + 0x48]
mov dword [ebx], eax
lea eax, [esi + 0x48]
mov ecx, eax
mov byte [esi + 0x44], 0
call fcn.00419670
mov byte [ebp - 4], 3
cmp byte [esi + 0x44], 0
jne 0x4659d5
push ebx
mov ecx, edi
call fcn.0041fb00
test al, al
je 0x4659d0
lea eax, [esi + 0x48]
mov ecx, esi
push eax
push dword [ebx]
push edi
call fcn.00466d30
jmp 0x4659d2
xor al, al
mov byte [esi + 0x44], al
lea ecx, [ebp + 0x20]
call fcn.00419eb0
lea ecx, [ebp + 8]
call fcn.00419eb0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x44
Function at 0x466360
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x6a6231
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x778400]
xor eax, esp
mov dword [esp + 0x5c], eax
push esi
push edi
mov eax, dword [0x778400]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea ecx, [esp + 0x48]
mov dword [esp + 0x18], 0
call fcn.0041b060
push 1
lea eax, [esp + 0x10]
mov dword [esp + 0x7c], 0
push eax
lea ecx, [esp + 0x64]
mov dword [esp + 0x14], str.bad_allocation
call fcn.0066d65c
mov dword [esp + 0x48], vtable.boost::exception_detail::bad_alloc_.0
mov dword [esp + 0x5c], vtable.boost::exception_detail::bad_alloc_.1.0
push 1
lea eax, [esp + 0x4c]
mov dword [esp + 0x7c], 1
push eax
lea ecx, [esp + 0x24]
call fcn.00467b00
mov byte [esp + 0x78], 2
mov esi, 1
mov eax, dword [0x78b374]
mov dword [esp + 0x24], str.class_boost::exception_ptr___cdecl_boost::exception_detail::get_static_exception_object_struct_boost::exception_detail::bad_alloc___void_
mov dword [esp + 0x28], str.C:_boostsdkinclude_boost_exception_detail_exception_ptr.hpp
mov dword [esp + 0x2c], 0x80
test al, 1
jne 0x4664a3
or eax, esi
mov dword [0x78b374], eax
xorps xmm0, xmm0
mov byte [esp + 0x78], 3
push 0x2c
movq qword [0x78b354], xmm0
call fcn.00480108
add esp, 4
mov dword [esp + 0xc], eax
mov byte [esp + 0x78], 4
test eax, eax
je 0x46645e
push esi
lea ecx, [esp + 0x20]
push ecx
mov ecx, eax
call fcn.00467150
jmp 0x466460
xor eax, eax
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x7c], 3
call fcn.004680b0
mov ecx, eax
mov eax, dword [ecx]
mov dword [0x78b354], eax
mov eax, dword [ecx + 4]
mov dword [0x78b358], eax
test eax, eax
je 0x46648d
add eax, 4
mov ecx, esi
lock xadd dword [eax], ecx
lea ecx, [esp + 0x14]
call fcn.00414240
push 0x6b6380
call fcn.0066d110
add esp, 4
mov eax, dword [0x78b354]
mov dword [edi], eax
mov eax, dword [0x78b358]
mov dword [edi + 4], eax
test eax, eax
je 0x4664be
add eax, 4
lock xadd dword [eax], esi
inc esi
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x1c], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::bad_alloc__.0
mov dword [esp + 0x30], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::bad_alloc__.1.0
mov eax, dword [eax + 4]
mov dword [esp + eax + 0x3c], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::bad_alloc__.2.0
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [esp + ecx + 0x38], eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x1c], vtable.boost::exception_detail::bad_alloc_.0
mov dword [esp + 0x30], vtable.std::bad_alloc.0
call fcn.0066d6ab
lea ecx, [esp + 0x1c]
call fcn.0041b0a0
lea ecx, [esp + 0x44]
call fcn.0041b0c0
lea ecx, [esp + 0x5c]
mov dword [esp + 0x48], vtable.boost::exception_detail::bad_alloc_.0
mov dword [esp + 0x5c], vtable.std::bad_alloc.0
call fcn.0066d6ab
lea ecx, [esp + 0x48]
call fcn.0041b0a0
mov eax, edi
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.0066c98d
mov esp, ebp
pop ebp
ret
Function at 0x469be0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
xor ecx, ecx
lea esi, [edi + 0x1c]
shr edi, 2
mov eax, edi
mov dword [ebp - 0xc], esi
shr eax, 1
add eax, 3
mov dword [ebx], eax
add ebx, 0x10
mov dword [ebp - 8], ebx
test edi, edi
je 0x469c1d
lea esp, [esp]
mov eax, dword [edx]
lea edx, [edx + 4]
mov dword [ebx + ecx*4], eax
inc ecx
cmp ecx, edi
jb 0x469c10
cmp ecx, esi
jae 0x469d03
mov eax, ecx
sub eax, edi
lea esi, [ebx + eax*4]
mov dword [ebp + 8], esi
nop
xor edx, edx
mov ebx, dword [ebx + ecx*4 - 4]
mov eax, ecx
div edi
mov dword [ebp - 4], eax
test edx, edx
jne 0x469c98
movzx edx, bl
movzx esi, byte [edx + str.cw]
mov edx, ebx
shr edx, 0x18
shl esi, 8
movzx eax, byte [edx + str.cw]
or esi, eax
mov eax, ebx
shr eax, 0x10
and eax, 0xff
shl esi, 8
shr ebx, 8
and ebx, 0xff
movzx eax, byte [eax + str.cw]
or esi, eax
mov eax, dword [ebp - 4]
movzx ebx, byte [ebx + str.cw]
shl esi, 8
movzx eax, byte [eax + 0x6b94a8]
xor ebx, eax
or ebx, esi
mov esi, dword [ebp + 8]
jmp 0x469ce9
cmp edi, 6
jbe 0x469ce9
cmp edx, 4
jne 0x469ce9
mov eax, ebx
shr eax, 0x10
and eax, 0xff
movzx edx, byte [eax + str.cw]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + str.cw]
shl eax, 8
or edx, eax
mov eax, ebx
shr eax, 8
and eax, 0xff
shl edx, 8
movzx eax, byte [eax + str.cw]
or edx, eax
movzx eax, bl
shl edx, 8
movzx ebx, byte [eax + str.cw]
or ebx, edx
mov eax, dword [esi]
add esi, 4
xor eax, ebx
mov dword [ebp + 8], esi
mov ebx, dword [ebp - 8]
mov dword [ebx + ecx*4], eax
inc ecx
cmp ecx, dword [ebp - 0xc]
jb 0x469c30
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x46b7a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
push edi
xor edi, edi
mov esi, dword [esi]
and esi, 7
cmp eax, 5
jae 0x46b7c2
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x14
add dword [ebp + 0x10], 5
lea edx, [eax - 4]
push ebx
mov ebx, dword [ebp + 8]
add edx, ebx
mov dword [ebp - 4], edx
lea eax, [edi + ebx]
cmp eax, edx
jae 0x46b7ef
lea esp, [esp]
mov cl, byte [eax]
and cl, 0xfe
cmp cl, 0xe8
je 0x46b7ef
inc eax
cmp eax, edx
jb 0x46b7e0
mov ecx, eax
sub ecx, edi
mov edi, eax
sub ecx, ebx
sub edi, ebx
cmp eax, edx
jae 0x46b8db
cmp ecx, 2
jbe 0x46b848
xor esi, esi
movzx ebx, byte [eax + 4]
lea ecx, [ebx + 1]
test cl, 0xfe
jne 0x46b8cd
movzx ecx, byte [eax + 3]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [eax + 2]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [eax + 1]
shl ebx, 8
or ebx, ecx
mov ecx, dword [ebp + 0x10]
add ecx, edi
add edi, 5
cmp dword [ebp + 0x18], 0
mov dword [ebp + 0xc], ecx
je 0x46b872
add ebx, ecx
jmp 0x46b874
shr esi, cl
test esi, esi
je 0x46b808
cmp esi, 4
ja 0x46b867
cmp esi, 3
je 0x46b867
mov ecx, esi
shr ecx, 1
movzx ecx, byte [ecx + eax + 1]
inc ecx
test cl, 0xfe
jne 0x46b808
or esi, 8
shr esi, 1
inc edi
jmp 0x46b7d2
sub ebx, ecx
test esi, esi
je 0x46b8a7
and esi, 6
mov edx, ebx
shl esi, 2
mov ecx, esi
shr edx, cl
inc edx
test dl, 0xfe
jne 0x46b8a2
mov edx, 0x100
shl edx, cl
dec edx
xor ebx, edx
cmp dword [ebp + 0x18], 0
je 0x46b89f
add ebx, dword [ebp + 0xc]
jmp 0x46b8a2
sub ebx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
xor esi, esi
mov ecx, ebx
mov byte [eax + 1], bl
shr ecx, 8
mov byte [eax + 2], cl
mov ecx, ebx
shr ebx, 0x18
and bl, 1
shr ecx, 0x10
neg bl
mov byte [eax + 3], cl
mov byte [eax + 4], bl
mov ebx, dword [ebp + 8]
jmp 0x46b7d2
mov ebx, dword [ebp + 8]
or esi, 8
shr esi, 1
inc edi
jmp 0x46b7d2
pop ebx
cmp ecx, 2
jbe 0x46b8f2
mov eax, dword [ebp + 0x14]
xor esi, esi
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp + 0x14]
shr esi, cl
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x14