joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409e50
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x522cf5
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x575464]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [ebp - 0x2c]
push eax
call fcn.00409f60
mov ebx, eax
lea esi, [edi + 0x28]
cmp esi, ebx
je 0x409ec6
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x409e9f
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.00405d30
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x409eb7
mov eax, dword [esi]
jmp 0x409eb9
mov eax, esi
xor ecx, ecx
mov word [eax], cx
mov ecx, esi
push ebx
call fcn.00405370
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
cmp eax, 8
jb 0x409ee2
inc eax
lea ecx, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
call fcn.00405d30
push 0x50
call fcn.004e0ff0
mov esi, eax
mov dword [ebp - 0x10], esi
push 0x50
push 0
push esi
mov dword [ebp - 4], 1
call fcn.0049e2e0
add esp, 0x10
mov ecx, 0x40b2d0
push 0x55eb2c
push edi
sub esp, 0x28
mov eax, esp
mov dword [eax + 0x24], 0
test ecx, ecx
je 0x409f2d
mov dword [eax], vtable.std::_Func_impl_unsigned_long_int____stdcall___void____class_std::allocator_int___unsigned_long_int__void__.0
mov dword [eax + 4], 0x40b2d0
mov dword [eax + 0x24], eax
mov ecx, esi
call fcn.0043a400
mov dword [edi + 0x74], eax
mov eax, dword [eax + 4]
test eax, eax
je 0x409f45
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c5e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x522f76
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x575464]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.004e0ff0
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.004de8a2
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40d440
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52312a
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x575464]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x28], esi
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x2c], esi
call fcn.004dec69
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x40d500
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], vtable.std::exception.0
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], str.bad_locale_name
xorps xmm0, xmm0
mov byte [ebp - 0x14], 1
push eax
movq qword [ebp - 0x20], xmm0
call fcn.0049d8fe
add esp, 8
mov dword [ebp - 0x24], vtable.std::runtime_error.0
lea eax, [ebp - 0x24]
push 0x571fc0
push eax
call fcn.0049e810
push edi
push esi
call fcn.004de9a5
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e0fae
mov esp, ebp
pop ebp
ret 4
Function at 0x410040
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x575464]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push 2
mov dword [ebp - 0x238], ecx
mov dword [ebp - 0x234], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [ebp - 0x230], 0x22c
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x41009b
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e0fae
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Process32NextW]
lea eax, [ebp - 0x230]
push eax
push esi
mov dword [ebp - 0x230], 0x22c
call edi
test eax, eax
je 0x4100fb
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpW]
push dword [ebp - 0x238]
lea eax, [ebp - 0x20c]
push eax
call ebx
test eax, eax
je 0x4100ee
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push esi
call edi
test eax, eax
jne 0x4100c1
jmp 0x4100fa
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x234], eax
pop ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x234]
xor ecx, ebp
pop edi
pop esi
call fcn.004e0fae
mov esp, ebp
pop ebp
ret
Function at 0x410790
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x575464]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push 0x208
push 0
push eax
mov esi, ecx
mov dword [ebp - 0x210], 0
call fcn.0049e2e0
add esi, 0x6b8
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x4107d8
mov esi, dword [esi]
push 0
push str.set.ini
push esi
push 0
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00505213
add esp, 0x18
lea eax, [ebp - 0x20c]
push eax
push 0x104
push eax
push 0x55ecfc
push 0x55f500
push 0x55f4f0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor eax, eax
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
mov word [edi], ax
cmp word [ebp - 0x20c], ax
jne 0x410838
xor ecx, ecx
jmp 0x410850
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x410841
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.00405bd0
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.004e0fae
mov esp, ebp
pop ebp
ret 4
Function at 0x410880
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52371b
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x575464]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ecx + 0x6e4], 8
lea esi, [ecx + 0x6d0]
jb 0x4108c0
mov eax, dword [esi]
jmp 0x4108c2
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esi + 0x14], 8
jb 0x4108d1
mov esi, dword [esi]
push ecx
push esi
push ecx
mov edx, 0x104
lea ecx, [ebp - 0x218]
call fcn.0040ee30
mov esi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov edi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea eax, [ebp - 0x218]
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
jne 0x4108f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0x3e
xor eax, eax
mov dword [ebp - 0x22c], 7
push str._P_05d__T_05d___04d__02d__02d__02d:_02d:_02d._03d___s___04d_:
lea ecx, [ebp - 0x240]
mov dword [ebp - 0x230], 0
mov word [ebp - 0x240], ax
call fcn.00405bd0
push 6
push str.Err:_d
lea ecx, [ebp - 0x240]
mov dword [ebp - 4], 0
call fcn.004055e0
mov esi, eax
cmp dword [esi + 0x14], 8
jb 0x41096d
mov esi, dword [esi]
movzx eax, word [ebp - 0x21a]
push edi
push 0x247
push str.CMainWnd::RemoveSensorIni
push eax
movzx eax, word [ebp - 0x21c]
push eax
movzx eax, word [ebp - 0x21e]
push eax
movzx eax, word [ebp - 0x220]
push eax
movzx eax, word [ebp - 0x222]
push eax
movzx eax, word [ebp - 0x226]
push eax
movzx eax, word [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push esi
call fcn.0043bf80
mov eax, dword [ebp - 0x22c]
add esp, 0x34
cmp eax, 8
jb 0x4109e5
inc eax
lea ecx, [ebp - 0x240]
push eax
push dword [ebp - 0x240]
call fcn.00405d30
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e0fae
mov esp, ebp
pop ebp
ret
Function at 0x412e90
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x575464]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x10], eax
mov eax, dword [edx + 0x14]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 0x1c], eax
push edi
mov edi, dword [edx + 0x10]
cmp eax, 0x10
jb 0x412ec4
mov ebx, dword [edx]
jmp 0x412ec6
mov ebx, edx
xor ecx, ecx
mov esi, 0x811c9dc5
test edi, edi
je 0x412ee2
movzx eax, byte [ebx + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edi
jb 0x412ed1
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, esi
mov ebx, dword [ebx + 4]
mov dword [ebp - 0xc], ebx
mov esi, dword [ecx + eax*8]
add eax, eax
mov edx, dword [ecx + eax*4]
inc eax
mov dword [ebp - 0x14], edx
lea eax, [ecx + eax*4]
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 8]
cmp dword [ebp - 0x14], ebx
jne 0x412f11
mov eax, ebx
jmp 0x412f15
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x412fad
cmp dword [edx + 0x14], 0x10
lea ecx, [esi + 8]
jb 0x412f28
mov edx, dword [edx]
cmp dword [ecx + 0x14], 0x10
lea ebx, [ecx + 0x10]
jb 0x412f33
mov ecx, dword [ecx]
mov ebx, dword [ebx]
mov eax, edi
cmp ebx, edi
cmovb eax, ebx
push eax
push edx
push ecx
call fcn.00412290
add esp, 0xc
test eax, eax
jne 0x412f51
cmp ebx, edi
jb 0x412f51
jbe 0x412f5b
mov esi, dword [esi]
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
jmp 0x412f05
cmp dword [esi + 0x1c], 0x10
lea edx, [esi + 8]
lea ebx, [edx + 0x10]
jb 0x412f69
mov edx, dword [edx]
cmp dword [ebp - 0x1c], 0x10
mov ecx, dword [ebp - 8]
jb 0x412f74
mov ecx, dword [ecx]
mov ebx, dword [ebx]
cmp edi, ebx
mov eax, ebx
cmovb eax, edi
push eax
push edx
push ecx
call fcn.00412290
add esp, 0xc
test eax, eax
jne 0x412f92
cmp edi, ebx
jb 0x412f92
jbe 0x412f95
mov esi, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e0fae
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov dword [eax], ebx
xor ecx, ebp
pop ebx
call fcn.004e0fae
mov esp, ebp
pop ebp
ret 8
Function at 0x4141f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x575464]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
cmp dword [edi + 0x1c], 0x10
lea edx, [edi + 8]
mov ebx, dword [edx + 0x10]
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], eax
jb 0x41421d
mov edx, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
test ebx, ebx
je 0x414239
movzx eax, byte [edx + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x414228
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x18]
mov ecx, dword [edx + 0xc]
and eax, esi
lea esi, [eax*8]
add ecx, esi
cmp dword [ecx + 4], edi
jne 0x41426f
cmp dword [ecx], edi
jne 0x414267
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [edx + 0xc]
mov eax, dword [edx + 4]
mov dword [esi + ecx + 4], eax
jmp 0x414277
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x414277
cmp dword [ecx], edi
jne 0x41427a
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov esi, dword [edi]
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 8]
dec dword [edx + 8]
call fcn.004143c0
push edi
call fcn.004e1030
mov eax, dword [ebp - 0xc]
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
mov dword [eax], esi
pop esi
pop ebx
call fcn.004e0fae
mov esp, ebp
pop ebp
ret 8

Function at 0x4183e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x522f76
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x575464]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004e0ff0
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.004de8a2
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4197d0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x522a20
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x575464]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov ecx, dword [ebp + 8]
lea edx, [ebx + 0x1c]
mov dword [ebx], vtable.hudun::sensors::SensorsTrackerImpl.0
mov dword [ebx + 0x18], 0xf
mov dword [ebx + 0x14], 0
mov byte [ebx + 4], 0
mov dword [edx + 0x14], 0xf
mov dword [edx + 0x10], 0
mov byte [edx], 0
mov dword [ebx + 0x48], 0xf
mov dword [ebx + 0x44], 0
mov byte [ebx + 0x34], 0
mov dword [ebx + 0x60], 0xf
mov dword [ebx + 0x5c], 0
mov byte [ebx + 0x4c], 0
mov dword [ebx + 0x78], 0xf
mov dword [ebx + 0x74], 0
mov byte [ebx + 0x64], 0
mov dword [ebx + 0x90], 0xf
mov dword [ebx + 0x8c], 0
mov byte [ebx + 0x7c], 0
call fcn.00419510
mov ecx, dword [ebp + 8]
lea edx, [ebx + 0x4c]
lea ecx, [ecx + 0x30]
call fcn.00419510
mov ecx, dword [ebp + 8]
lea edx, [ebx + 0x34]
lea ecx, [ecx + 0x18]
call fcn.00419510
mov edi, dword [ebp + 8]
lea esi, [ebx + 4]
mov dword [ebx + 0x94], 0
lea eax, [edi + 0x7c]
cmp esi, eax
je 0x4198b8
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.00405f40
push 0
push 0x55ebac
lea ecx, [ebx + 0x64]
call fcn.00406380
push 0
push 0x55ebac
lea ecx, [ebx + 0x7c]
call fcn.00406380
mov eax, dword [edi + 0x78]
lea ecx, [edi + 0x7c]
mov edx, esi
mov dword [ebx + 0x9c], eax
call fcn.00419510
push 0x330
call fcn.004e0ff0
add esp, 4
mov ecx, eax
call fcn.00419970
mov esi, eax
push edi
lea ecx, [esi + 0x100]
call fcn.00419b50
push ecx
lea edx, [edi + 0x60]
mov ecx, esi
call fcn.00419730
add esp, 4
mov dword [ebx + 0xa0], esi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x422b10
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5252c0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x575464]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov esi, ecx
push 0x57ba60
call fcn.004dfa4e
add esp, 4
test eax, eax
je 0x422b58
push eax
call fcn.004dfe59
add esp, 4
mov al, byte [0x57a9c4]
push 0x57ba60
mov byte [ebp - 0x19], al
call fcn.004dfaab
add esp, 4
test eax, eax
je 0x422b7a
push eax
call fcn.004dfe59
add esp, 4
cmp byte [ebp - 0x19], 0
je 0x422ba5
push ebx
push esi
call fcn.004229f0
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e0fae
mov esp, ebp
pop ebp
ret
push str._Sensors__Sending_messages_asynchronously
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea edx, [ebp - 0x2c]
mov dword [ebp - 0x2c], fcn.004229f0
lea ecx, [ebp - 0x20]
mov byte [ebp - 0x28], bl
mov dword [ebp - 0x24], esi
call fcn.00426130
mov edx, eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00426170
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x422beb
push 0xc
push eax
call fcn.004e0fe2
add esp, 8
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 1
call fcn.00419210
cmp dword [ebp - 0x14], 0
je 0x422b8a
call fcn.00509287
int3

Function at 0x423620
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x575464]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x104
lea eax, [ebp - 0x108]
mov dword [ebp - 0x21c], 0
mov esi, ecx
push 0
push eax
mov dword [ebp - 0x214], esi
call fcn.0049e2e0
push 0x104
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0049e2e0
lea eax, [ebp - 0x220]
mov dword [ebp - 0x210], 0
push eax
lea edx, [ebp - 0x214]
lea ecx, [ebp - 0x218]
call fcn.00423560
add esp, 0x1c
test al, al
je 0x4236b6
mov eax, dword [ebp - 0x218]
cmp eax, 6
ja 0x4236ab
jne 0x4236b6
cmp dword [ebp - 0x214], 1
jb 0x4236b6
lea eax, [ebp - 0x210]
push eax
push 0x1c
jmp 0x4236bf
lea eax, [ebp - 0x210]
push eax
push 0x2e
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov eax, dword [ebp - 0x210]
test eax, eax
je 0x4236fc
lea ecx, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
je 0x4236fc
push 0x104
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
cmp byte [ebp - 0x108], 0
jne 0x42371a
xor ecx, ecx
jmp 0x42372c
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x423723
sub ecx, edx
push ecx
lea eax, [ebp - 0x108]
mov ecx, esi
push eax
call fcn.00406380
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004e0fae
mov esp, ebp
pop ebp
ret
Function at 0x423960
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x525426
mov eax, dword fs:[0]
push eax
sub esp, 0xbc
mov eax, dword [0x575464]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0xc4], esi
lea ecx, [ebp - 0xa8]
mov dword [ebp - 0xc8], 0
call fcn.00423750
mov dword [ebp - 4], 0
lea eax, [ebp - 0xa8]
cmp dword [ebp - 0x94], 0x10
push 0
cmovae eax, dword [ebp - 0xa8]
push eax
call fcn.00509827
add esp, 8
cmp eax, 0xffffffff
jne 0x423a09
push 0
mov dword [esi + 0x14], 0xf
mov ecx, esi
mov dword [esi + 0x10], 0
push 0x55ebac
mov byte [esi], 0
call fcn.00406380
mov ecx, dword [ebp - 0x94]
cmp ecx, 0x10
jb 0x423b1a
inc ecx
push ecx
jmp 0x423b09
push 0x80
lea eax, [ebp - 0x90]
push 0
push eax
call fcn.0049e2e0
add esp, 0xc
lea eax, [ebp - 0xa8]
cmp dword [ebp - 0x94], 0x10
cmovae eax, dword [ebp - 0xa8]
push eax
push 0x80
lea eax, [ebp - 0x90]
push eax
push 0x55ebac
push str.HDSensorsAnalyticsIni
push str.Install
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp - 0x90], 0
mov dword [ebp - 0xac], 0xf
mov dword [ebp - 0xb0], 0
mov byte [ebp - 0xc0], 0
jne 0x423a7d
xor ecx, ecx
jmp 0x423a8f
lea ecx, [ebp - 0x90]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x423a86
sub ecx, edx
push ecx
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0xc0]
call fcn.00406380
push ecx
lea ecx, [ebp - 0xc0]
mov byte [ebp - 4], 1
call fcn.004195b0
add esp, 4
lea eax, [ebp - 0xc0]
mov ecx, esi
push eax
call fcn.0040da30
mov eax, dword [ebp - 0xac]
cmp eax, 0x10
jb 0x423ae1
inc eax
lea ecx, [ebp - 0xc0]
push eax
push dword [ebp - 0xc0]
call fcn.00406260
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0xac], 0xf
mov dword [ebp - 0xb0], 0
mov byte [ebp - 0xc0], 0
cmp eax, 0x10
jb 0x423b1a
inc eax
push eax
push dword [ebp - 0xa8]
lea ecx, [ebp - 0xa8]
call fcn.00406260
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e0fae
mov esp, ebp
pop ebp
ret
Function at 0x423eb0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5254be
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x575464]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x38], ecx
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
xorps xmm0, xmm0
push 0x10
push eax
push 0x59
push 0x400
movups xmmword [ebp - 0x24], xmm0
movups xmmword [ebp - 0x34], xmm0
call esi
push 0x10
mov ebx, eax
lea eax, [ebp - 0x34]
push eax
push 0x5a
push 0x400
call esi
test eax, eax
je 0x42401a
test ebx, ebx
je 0x42401a
cmp byte [ebp - 0x24], 0
jne 0x423f2f
xor ecx, ecx
jmp 0x423f3e
lea ecx, [ebp - 0x24]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x423f35
sub ecx, edx
mov esi, dword [ebp - 0x38]
lea eax, [ebp - 0x24]
push ecx
push eax
mov ecx, esi
call fcn.00406380
cmp byte [ebp - 0x34], 0
jne 0x423f57
xor ecx, ecx
jmp 0x423f69
lea ecx, [ebp - 0x34]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x423f60
sub ecx, edx
mov ebx, dword [ebp - 0x3c]
lea eax, [ebp - 0x34]
push ecx
push eax
mov ecx, ebx
call fcn.00406380
push 0x57b0b8
mov edx, esi
lea ecx, [ebp - 0x6c]
call fcn.00425e40
push ebx
mov edx, eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x54]
call fcn.00425e10
add esp, 8
mov esi, eax
cmp edi, esi
je 0x423fda
mov eax, dword [edi + 0x14]
cmp eax, 0x10
jb 0x423fb5
inc eax
mov ecx, edi
push eax
push dword [edi]
call fcn.00406260
mov dword [edi + 0x14], 0xf
cmp dword [edi + 0x14], 0x10
mov dword [edi + 0x10], 0
jb 0x423fcd
mov eax, dword [edi]
jmp 0x423fcf
mov eax, edi
push esi
mov ecx, edi
mov byte [eax], 0
call fcn.00404e50
mov eax, dword [ebp - 0x40]
cmp eax, 0x10
jb 0x423fef
inc eax
lea ecx, [ebp - 0x54]
push eax
push dword [ebp - 0x54]
call fcn.00406260
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x40], 0xf
mov dword [ebp - 0x44], 0
mov byte [ebp - 0x54], 0
cmp eax, 0x10
jb 0x424016
inc eax
lea ecx, [ebp - 0x6c]
push eax
push dword [ebp - 0x6c]
call fcn.00406260
mov al, 1
jmp 0x42401c
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004e0fae
mov esp, ebp
pop ebp
ret