joyce8/EMBER2024-capa huggingface dataset:
Function at 0x463370
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c75b8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x50e008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
push ecx
lea ecx, [ebp - 0x28]
call fcn.00402770
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00412760
lea ecx, [ebp - 0x28]
call fcn.00402860
lea ecx, [ebp - 0x28]
cmp eax, 2
jbe 0x463499
call fcn.00402850
mov esi, eax
mov ecx, esi
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x4633dc
mov ecx, dword [esi]
cmp word [ecx], 0x5c
jne 0x4633f6
mov ecx, esi
cmp eax, 8
jb 0x4633eb
mov ecx, dword [esi]
cmp word [ecx + 2], 0x5c
je 0x463514
mov ecx, esi
cmp eax, 8
jb 0x4633ff
mov ecx, dword [esi]
cmp word [ecx], 0x2f
jne 0x463415
mov ecx, esi
cmp eax, 8
jb 0x46340e
mov ecx, dword [esi]
cmp word [ecx + 2], 0x2f
je 0x46346a
push 0x5c
mov edx, 0x2f
lea ecx, [ebp - 0x28]
call fcn.004125a0
mov eax, dword [esi + 0x14]
add esp, 4
mov ecx, esi
cmp eax, 8
jb 0x463433
mov ecx, dword [esi]
cmp word [ecx + 2], 0x3a
jne 0x46346a
mov ecx, esi
cmp eax, 8
jb 0x463443
mov ecx, dword [esi]
cmp word [ecx + 4], 0x5c
jne 0x46346a
mov ecx, esi
cmp eax, 8
jb 0x463453
mov ecx, dword [esi]
cmp word [ecx], 0x61
jb 0x46346a
cmp eax, 8
jb 0x463460
mov esi, dword [esi]
cmp word [esi], 0x7a
jbe 0x4634f5
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00402290
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a100a
mov esp, ebp
pop ebp
ret
call fcn.00402860
cmp eax, 2
jne 0x46346a
lea ecx, [ebp - 0x28]
call fcn.00402850
mov edx, eax
mov ecx, dword [eax + 0x14]
cmp ecx, 8
jb 0x4634b7
mov edx, dword [eax]
cmp word [edx + 2], 0x3a
jne 0x46346a
mov edx, eax
cmp ecx, 8
jb 0x4634c7
mov edx, dword [eax]
cmp word [edx], 0x61
jb 0x46346a
cmp ecx, 8
jb 0x4634d4
mov eax, dword [eax]
cmp word [eax], 0x7a
ja 0x46346a
push 0x4ed160
call fcn.00402a80
add esp, 4
lea ecx, [ebp - 0x28]
push eax
push 0x4ed160
call fcn.00407190
lea ecx, [ebp - 0x28]
call fcn.00405b00
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x46346a
shr eax, 4
and al, 1
mov byte [edi], al
mov bl, 1
jmp 0x46346c
Function at 0x4684a0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x4684ab
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.004684c0
Function at 0x46aec0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d440b
mov eax, dword fs:[0]
push eax
sub esp, 0x144
mov eax, dword [0x50e008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi], 0
je 0x46aef9
call fcn.0046b060
cmp byte [0x5107e8], 0
jne 0x46af0c
mov eax, 0x80000001
jmp 0x46b03c
mov eax, dword [esi]
test eax, eax
jne 0x46af8c
push 8
call fcn.004a101b
mov edi, eax
add esp, 4
mov dword [ebp - 0x138], edi
mov dword [ebp - 4], 0
push 1
call fcn.004a101b
add esp, 4
mov dword [edi + 4], eax
mov byte [eax], 0
lea eax, [ebp - 0x130]
push 0x118
push 0
push eax
call fcn.004a2d80
add esp, 0xc
mov dword [ebp - 0x134], 0x11c
lea eax, [ebp - 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x46af7b
cmp dword [ebp - 0x130], 6
mov eax, dword [edi + 4]
setae cl
mov byte [eax], cl
mov dword [ebp - 4], 0xffffffff
mov dword [esi], edi
mov dword [edi], 0
mov eax, dword [esi]
cmp dword [eax], 0
jne 0x46b02b
call fcn.0040b080
test al, al
jne 0x46afc6
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [esi]
push eax
add ecx, 4
call fcn.0040b5f0
test al, al
je 0x46b02b
mov ecx, dword [esi]
add ecx, 4
call fcn.0040aba0
call fcn.0040b080
test al, al
je 0x46b02b
push str.Advapi32.dll
lea ecx, [ebp - 0x150]
call fcn.00402700
mov dword [ebp - 4], 2
lea eax, [ebp - 0x150]
push eax
call fcn.004131f0
mov ecx, eax
call fcn.004132b0
mov edi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x150]
call fcn.00402290
test edi, edi
je 0x46b02b
push str.RegOpenCurrentUser
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x46b02b
push dword [esi]
push dword [ebp + 8]
call eax
test eax, eax
je 0x46b02b
mov eax, dword [esi]
mov dword [eax], 0
mov eax, dword [esi]
cmp dword [eax], 0
jne 0x46b03a
mov dword [eax], 0x80000001
mov eax, dword [esi]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004a100a
mov esp, ebp
pop ebp
ret 4
Function at 0x46b220
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d4486
mov eax, dword fs:[0]
push eax
sub esp, 0x64c
mov eax, dword [0x50e008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x654]
mov ebx, dword [ebp + 0xc]
call fcn.00402750
mov dword [ebp - 4], 0
mov eax, dword [0x5107fc]
mov dword [ebp - 0x63c], 0
mov dword [ebp - 0x63c], 0x5107fc
test eax, eax
je 0x46b28c
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 1
mov ecx, 0x510800
call fcn.00402650
test al, al
jne 0x46b2d3
mov ecx, 0x510800
call fcn.00402850
lea ecx, [ebp - 0x654]
cmp ecx, eax
je 0x46b397
mov ecx, 0x510800
call fcn.00402850
mov ecx, eax
cmp dword [eax + 0x14], 8
jb 0x46b2ca
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
jmp 0x46b38c
push 0x20c
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.004a2d80
add esp, 0xc
lea eax, [ebp - 0x220]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x103
ja 0x46b43c
xor eax, eax
push 0x412
push eax
mov word [ebp - 0x16], ax
lea eax, [ebp - 0x638]
push eax
call fcn.004a2d80
add esp, 0xc
lea eax, [ebp - 0x638]
push 0x208
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, 0x208
ja 0x46b375
test eax, eax
je 0x46b375
add eax, eax
cmp eax, 0x412
jae 0x46b48e
xor ecx, ecx
mov word [ebp + eax - 0x638], cx
lea eax, [ebp - 0x638]
push eax
call fcn.00402a80
add esp, 4
push eax
lea eax, [ebp - 0x638]
jmp 0x46b38b
lea eax, [ebp - 0x220]
push eax
call fcn.00402a80
add esp, 4
push eax
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x654]
call fcn.00402870
mov byte [ebp - 4], 0
mov eax, dword [0x5107fc]
test eax, eax
je 0x46b3ab
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push ebx
push edi
lea eax, [ebp - 0x654]
mov dword [ebp - 0x63c], 0
push eax
mov ecx, esi
call fcn.0046b1b0
test al, al
je 0x46b3d0
mov bl, 1
jmp 0x46b45c
push 0x20c
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.004a2d80
add esp, 0xc
lea eax, [ebp - 0x220]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec eax
cmp eax, 0x103
ja 0x46b45a
xor eax, eax
mov word [ebp - 0x16], ax
lea eax, [ebp - 0x220]
push eax
call fcn.00402a80
add esp, 4
lea ecx, [ebp - 0x654]
push eax
lea eax, [ebp - 0x220]
push eax
call fcn.00402870
push ebx
push edi
lea eax, [ebp - 0x654]
mov ecx, esi
push eax
call fcn.0046b1b0
mov bl, al
jmp 0x46b45c
mov byte [ebp - 4], 0
mov eax, dword [0x5107fc]
test eax, eax
je 0x46b450
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 0x63c], 0
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x654]
call fcn.00402290
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a100a
mov esp, ebp
pop ebp
ret 8
call fcn.004a165f
int3
Function at 0x46d0d0
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d4954
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x50e008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.00402750
mov dword [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.00402750
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.00402750
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.00402750
mov byte [ebp - 4], 3
lea ecx, [esi + 0x70]
mov word [esi + 0x60], 0x101
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
call fcn.00402750
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x473320
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d562f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x50e008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 0xc]
mov edx, dword [edi + 4]
push eax
lea ecx, [eax + 0x94]
call fcn.00473aa0
mov esi, dword [edi + 4]
add esp, 4
sub esi, 0x94
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 4
lea ecx, [esi + 0x7c]
call fcn.00402290
mov byte [ebp - 4], 3
lea ecx, [esi + 0x64]
call fcn.00402290
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.00402290
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.00402290
mov byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.00402290
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00402290
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
add dword [edi + 4], 0xffffff6c
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x474040
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d581f
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x50e008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 4
lea ecx, [esi + 0x7c]
call fcn.00402290
mov byte [ebp - 4], 3
lea ecx, [esi + 0x64]
call fcn.00402290
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.00402290
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.00402290
mov byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.00402290
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00402290
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x475350
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d59ef
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x50e008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push esi
call fcn.00405b10
mov dword [ebp - 4], 0
lea eax, [esi + 0x18]
push eax
lea ecx, [edi + 0x18]
call fcn.00405b10
mov byte [ebp - 4], 1
lea eax, [esi + 0x30]
push eax
lea ecx, [edi + 0x30]
call fcn.00405b10
mov byte [ebp - 4], 2
lea eax, [esi + 0x48]
push eax
lea ecx, [edi + 0x48]
call fcn.00405b10
mov byte [ebp - 4], 3
lea ecx, [edi + 0x64]
mov al, byte [esi + 0x60]
mov byte [edi + 0x60], al
lea eax, [esi + 0x64]
push eax
call fcn.00405b10
mov byte [ebp - 4], 4
lea eax, [esi + 0x7c]
push eax
lea ecx, [edi + 0x7c]
call fcn.00405b10
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x477760
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x507688
push 0x4a2330
mov eax, dword fs:[0]
push eax
sub esp, 0x430
mov eax, dword [0x50e008]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x440], edi
mov dword [ebp - 0x438], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.00402850
mov dword [ebp - 0x43c], 0
mov dword [eax + 0x10], 0
cmp dword [eax + 0x14], 8
jb 0x4777d0
mov eax, dword [eax]
lea ecx, [ebp - 0x43c]
push ecx
push eax
call fcn.00402a20
add esp, 8
mov edx, esi
mov ecx, edi
call fcn.004778e0
mov bl, al
mov byte [ebp - 0x431], bl
mov dword [ebp - 4], 0xfffffffe
jmp 0x47781e
test bl, bl
jne 0x4778bb
cmp edi, 0x1a
jne 0x4778bb
mov ecx, esi
call fcn.00402850
mov dword [ebp - 0x438], 0
mov dword [eax + 0x10], 0
cmp dword [eax + 0x14], 8
jb 0x47784f
mov eax, dword [eax]
lea ecx, [ebp - 0x438]
push ecx
push eax
call fcn.00402a20
push 0x410
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.004a2d80
add esp, 0x14
push 0x207
lea eax, [ebp - 0x430]
push eax
push str.APPDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [ebp - 0x430]
push eax
call fcn.00402a80
add esp, 4
push eax
lea eax, [ebp - 0x430]
push eax
mov ecx, esi
call fcn.00402870
mov ecx, esi
call fcn.00402650
movzx ebx, bl
mov ecx, 1
test al, al
cmove ebx, ecx
mov al, bl
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004a100a
mov esp, ebp
pop ebp
ret

Function at 0x4788e0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x50e008]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
push ebx
push ebp
mov ebp, ecx
mov dword [esp + 8], eax
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
push edi
cmp dword [ebp + 0x10], 0xffffffff
mov edi, dword [esp + 0x20]
je 0x478962
mov ecx, 0x100000
nop dword [eax]
nop word [eax + eax]
cmp esi, 0x100000
mov dword [esp + 0x14], 0
push 0
mov eax, esi
cmova eax, ecx
lea ecx, [esp + 0x18]
push ecx
push eax
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x14]
add ebx, ecx
test eax, eax
je 0x478962
test ecx, ecx
je 0x47895e
add edi, ecx
sub esi, ecx
mov ecx, 0x100000
jne 0x478920
xor eax, eax
jmp 0x478967
mov eax, 1
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x478971
mov dword [ecx], ebx
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004a100a
add esp, 0xc
ret 0xc
Function at 0x4793f0
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x50e008]
xor eax, esp
mov dword [esp + 4], eax
push esi
mov esi, dword [esp + 0x10]
push edi
mov dword [esi], 0
mov dword [esi + 4], 0
mov eax, dword [ecx + 0x10]
cmp eax, 0xffffffff
je 0x479463
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x47943e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x479463
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, edi
pop edi
adc eax, 0
mov dword [esi], ecx
mov dword [esi + 4], eax
xor eax, eax
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.004a100a
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
mov eax, 1
pop edi
pop esi
xor ecx, esp
call fcn.004a100a
add esp, 8
ret 4

Function at 0x4797e0
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x50e008]
xor eax, esp
mov dword [esp + 4], eax
push esi
mov esi, dword [esp + 0x10]
push edi
mov dword [esi], 0
mov dword [esi + 4], 0
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
je 0x479853
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x47982e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x479853
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, edi
pop edi
adc eax, 0
mov dword [esi], ecx
mov dword [esi + 4], eax
xor eax, eax
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.004a100a
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
mov eax, 1
pop edi
pop esi
xor ecx, esp
call fcn.004a100a
add esp, 8
ret 4
Function at 0x47c400
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d6a61
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x50e008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.DL::RCSimpleDownloadHandler.0
mov dword [edi + 4], vtable.DL::RCSimpleDownloadHandler.1.0
mov dword [ebp - 4], 7
mov dword [edi + 0x98], 0
mov byte [ebp - 4], 6
or ebx, 0xffffffff
mov esi, dword [edi + 0xf8]
test esi, esi
je 0x47c47b
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x47c47b
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov eax, ebx
lock xadd dword [esi + 8], eax
jne 0x47c47b
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov byte [ebp - 4], 5
mov ecx, dword [edi + 0xec]
test ecx, ecx
je 0x47c496
lock xadd dword [ecx + 8], ebx
dec ebx
jne 0x47c496
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 4
mov eax, dword [edi + 0xe4]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
test eax, eax
je 0x47c4c7
push eax
call ebx
push 0x18
push dword [edi + 0xe4]
call fcn.004a12e5
add esp, 8
mov dword [edi + 0xe4], 0
mov byte [ebp - 4], 3
lea esi, [edi + 0xc0]
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 8
mov eax, dword [esi]
test eax, eax
je 0x47c4eb
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
mov byte [ebp - 4], 3
lea ecx, [esi + 8]
call fcn.00402290
mov byte [ebp - 4], 2
mov eax, dword [edi + 0xac]
test eax, eax
je 0x47c522
push eax
call ebx
push 0x18
push dword [edi + 0xac]
call fcn.004a12e5
add esp, 8
mov dword [edi + 0xac], 0
mov byte [ebp - 4], 1
mov ecx, dword [edi + 0xa0]
test ecx, ecx
je 0x47c59d
mov edx, dword [edi + 0xa4]
push ecx
call fcn.00411450
mov eax, dword [edi + 0xa8]
add esp, 4
mov ecx, dword [edi + 0xa0]
sub eax, ecx
sar eax, 3
lea edx, [eax*8]
cmp edx, 0x1000
jb 0x47c575
mov esi, dword [ecx - 4]
add edx, 0x23
sub ecx, esi
lea eax, [ecx - 4]
cmp eax, 0x1f
ja 0x47c61c
mov ecx, esi
push edx
push ecx
call fcn.004a12e5
add esp, 8
mov dword [edi + 0xa0], 0
mov dword [edi + 0xa4], 0
mov dword [edi + 0xa8], 0
mov byte [ebp - 4], 0
lea esi, [edi + 0x10]
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 0xc
lea ecx, [esi + 0x70]
call fcn.00402290
mov byte [ebp - 4], 0xb
lea ecx, [esi + 0x48]
call fcn.00402290
mov byte [ebp - 4], 0xa
lea ecx, [esi + 0x30]
call fcn.00402290
mov byte [ebp - 4], 9
lea ecx, [esi + 0x18]
call fcn.00402290
mov byte [ebp - 4], 0
mov ecx, esi
call fcn.00402290
mov dword [ebp - 4], 0xe
mov dword [edi + 4], vtable.RC::RCRefCounted.0
mov dword [ebp - 4], 0xffffffff
mov dword [edi], vtable.DL::ISimpleDownloadHandler.0
mov dword [ebp - 4], 0xffffffff
mov dword [edi], vtable.RC::IRefCount.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004a4ce9
int3
Function at 0x47eb90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d7008
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x50e008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
mov esi, dword [ebp + 8]
mov ecx, esi
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x3c]
push eax
push 2
push 0xffffffffffffffff
push 0xffff8000
movlpd qword [ebp - 0x3c], xmm0
call fcn.00414390
test al, al
jne 0x47ebf0
mov eax, 1
jmp 0x47ed6d
push 0x10000
call fcn.004a173e
mov ebx, eax
mov dword [ebp - 0x18], 0
add esp, 4
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], 0
push 0x10000
push 0
push ebx
call fcn.004a2d80
mov eax, dword [esi]
add esp, 0xc
mov dword [ebp - 0x1c], 0
test eax, eax
je 0x47ed46
test ebx, ebx
je 0x47ed46
cmp dword [eax], 0xffffffff
je 0x47ed46
push 0
lea ecx, [ebp - 0x1c]
push ecx
push 0x8000
push ebx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x47ed46
mov esi, dword [ebp - 0x20]
mov ecx, 0x8000
xor ebx, ebx
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], ecx
add esi, ecx
nop word [eax + eax]
cmp byte [edi + 0x9c], 0
jne 0x47ed3c
lea edx, [ebp - 0x30]
mov dword [ebp - 0x30], 0
push edx
lea edx, [ebp - 0x24]
mov dword [ebp - 0x24], 0
push edx
push ecx
mov ecx, dword [ebp - 0x34]
lea eax, [esi + ebx]
push eax
call fcn.0049b920
test al, al
je 0x47ed2f
mov eax, dword [ebp - 0x24]
test eax, eax
jne 0x47ece2
mov eax, dword [edi + 0xc0]
test eax, eax
je 0x47ecd1
push 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [edi + 0x9c], 0
jne 0x47ed3c
inc dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
jmp 0x47ecec
add ebx, eax
cmp ebx, 0x8000
je 0x47ecfc
cmp dword [ebp - 0x28], 0xf
ja 0x47ed25
mov ecx, dword [ebp - 0x2c]
sub ecx, eax
mov dword [ebp - 0x2c], ecx
jne 0x47ec80
mov ebx, dword [ebp - 0x20]
mov edx, 0x7ffc
mov ecx, ebx
mov eax, dword [ecx]
cmp eax, dword [esi]
jne 0x47ed1e
add ecx, 4
add esi, 4
sub edx, 4
jae 0x47ed06
mov esi, 4
jmp 0x47ed57
mov esi, 5
jmp 0x47ed57
mov ebx, dword [ebp - 0x20]
mov esi, 3
jmp 0x47ed57
mov eax, dword [ebp - 0x30]
mov esi, 3
mov ebx, dword [ebp - 0x20]
jmp 0x47ed51
mov ebx, dword [ebp - 0x20]
mov esi, 2
jmp 0x47ed57
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 1
mov dword [edi + 0xb0], eax
mov dword [ebp - 4], 0xffffffff
test ebx, ebx
je 0x47ed6b
push ebx
call fcn.004a1739
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004a100a
mov esp, ebp
pop ebp
ret 0xc
Function at 0x482930
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d562f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x50e008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push edx
push 0x94
call fcn.004018d0
mov esi, dword [ebp + 8]
add esp, 8
mov edi, eax
mov ecx, eax
mov dword [ebp - 0x10], edi
push esi
call fcn.00402770
mov dword [ebp - 4], 0
lea ecx, [esi + 0x18]
push ecx
lea ecx, [edi + 0x18]
call fcn.00402770
mov byte [ebp - 4], 1
lea eax, [esi + 0x30]
push eax
lea ecx, [edi + 0x30]
call fcn.00402770
mov byte [ebp - 4], 2
lea eax, [esi + 0x48]
push eax
lea ecx, [edi + 0x48]
call fcn.00402770
mov byte [ebp - 4], 3
lea ecx, [edi + 0x64]
mov al, byte [esi + 0x60]
mov byte [edi + 0x60], al
lea eax, [esi + 0x64]
push eax
call fcn.00402770
mov byte [ebp - 4], 4
lea eax, [esi + 0x7c]
push eax
lea ecx, [edi + 0x7c]
call fcn.00402770
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x485540
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x50e008]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [ecx]
push esi
push edi
mov edi, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x4855a5
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x485580
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4855a5
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, esi
mov dword [edi], ecx
adc eax, 0
mov dword [edi + 4], eax
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.004a100a
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.004a100a
add esp, 8
ret 4