joyce8/EMBER2024-capa huggingface dataset:
Function at 0x468860
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47dbd9
mov eax, dword fs:[0]
push eax
sub esp, 0xd8
mov eax, dword [0x4ba494]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xe4], ecx
mov dword [ebp - 0xe0], 0
push 0xc8
lea eax, [ebp - 0xdc]
push eax
push str._APPDATA_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push 0x487c52
lea ecx, [ebp - 0x10]
call fcn.00403210
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xdc]
push ecx
push str._sMozillaFirefox
lea edx, [ebp - 0x10]
push edx
call fcn.00404910
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
call fcn.00401f30
mov ecx, dword [ebp - 0xe0]
or ecx, 1
mov dword [ebp - 0xe0], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00413390
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00443d53
mov esp, ebp
pop ebp
ret 4

Function at 0x46b370
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
lea ecx, [ebp + 0xc]
call fcn.0040aa10
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x46b3bf
lea ecx, [ebp + 0x14]
call fcn.0040aa10
push eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 0xc]
call fcn.00413390
lea ecx, [ebp + 0x10]
call fcn.00413390
lea ecx, [ebp + 0x14]
call fcn.00413390
mov esp, ebp
pop ebp
ret 0x10
Function at 0x46b3e0
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47c427
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x4ba494]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x228], ecx
mov dword [ebp - 4], 2
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jge 0x46b455
mov byte [ebp - 4], 1
lea ecx, [ebp + 8]
call fcn.00413390
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.00413390
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call fcn.00413390
jmp 0x46b54b
lea eax, [ebp - 0x14]
push eax
push 0x487278
push 1
push 0
push 0x487288
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x46b524
lea ecx, [ebp - 0x18]
push ecx
push 0x4872c8
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [eax]
call edx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x46b516
lea ecx, [ebp + 8]
call fcn.0040aa10
push eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ecx + 0x50]
call eax
mov dword [ebp - 0x10], eax
lea ecx, [ebp + 0xc]
call fcn.0040aa10
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [edx + 0x1c]
call ecx
mov dword [ebp - 0x10], eax
push 0x104
lea edx, [ebp - 0x224]
push edx
push 0xffffffffffffffff
lea ecx, [ebp + 0x10]
call fcn.0040aa10
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 1
lea eax, [ebp - 0x224]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [edx + 0x18]
call ecx
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x18]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [eax + 8]
call edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ecx + 8]
call eax
mov byte [ebp - 4], 1
lea ecx, [ebp + 8]
call fcn.00413390
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.00413390
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call fcn.00413390
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00443d53
mov esp, ebp
pop ebp
ret 0xc

Function at 0x46b570
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
lea ecx, [ebp + 0xc]
call fcn.0040aa10
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x46b5bf
lea ecx, [ebp + 0x10]
call fcn.0040aa10
push eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 0xc]
call fcn.00413390
lea ecx, [ebp + 0x10]
call fcn.00413390
lea ecx, [ebp + 0x14]
call fcn.00413390
mov esp, ebp
pop ebp
ret 0x10
Function at 0x46b5e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47c6d8
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x4ba494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x58], ecx
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], 0
lea ecx, [ebp + 8]
call fcn.00402000
movzx eax, al
test eax, eax
jne 0x46b6d0
mov dword [ebp - 0x4c], 0
push 0x38
push 0
lea ecx, [ebp - 0x48]
push ecx
call fcn.00445390
add esp, 0xc
mov dword [ebp - 0x4c], 0x3c
mov dword [ebp - 0x48], 0x40
mov dword [ebp - 0x40], str.open
lea ecx, [ebp + 8]
call fcn.0040aa10
mov dword [ebp - 0x3c], eax
lea ecx, [ebp + 0xc]
call fcn.0040aa10
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x30], 1
mov edx, dword [ebp - 0x58]
mov eax, dword [edx + 0x20]
mov dword [ebp - 0x44], eax
lea ecx, [ebp - 0x4c]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x46b6d0
push 0
mov ecx, dword [ebp - 0x58]
call fcn.0042eb0f
mov dword [ebp - 0x50], 0
push 0xffffffffffffffff
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x50]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push 1
mov ecx, dword [ebp - 0x58]
call fcn.0042eb0f
cmp dword [ebp - 0x50], 0x103
je 0x46b6ce
jmp 0x46b6d0
jmp 0x46b688
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x54], edx
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00413390
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00413390
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x46bb60
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47cd9b
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x4ba494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 2
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push 0xf003f
push 0
lea ecx, [ebp + 0xc]
call fcn.0040aa10
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x46bc01
lea ecx, [ebp + 0x14]
call fcn.00412ea0
add eax, 1
push eax
lea ecx, [ebp + 0x14]
call fcn.00412ea0
push eax
lea ecx, [ebp + 0x14]
call fcn.00401fe0
push eax
push 1
push 0
lea ecx, [ebp + 0x10]
call fcn.0040aa10
push eax
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xffffffffffffffff
lea ecx, [ebp + 0x14]
call fcn.00412d50
mov byte [ebp - 4], 1
lea ecx, [ebp + 0xc]
call fcn.00413390
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x10]
call fcn.00413390
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x14]
call fcn.00413390
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4711b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47e104
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x4ba494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x50], 0
push str.SoftwareAdware_ProNE
lea ecx, [ebp - 0x18]
call fcn.00403210
mov dword [ebp - 4], 0
push 0x49a184
lea ecx, [ebp - 0x18]
call fcn.00405670
push 0x4995d8
lea ecx, [ebp - 0x18]
call fcn.00405670
push 0x487cd7
lea ecx, [ebp - 0x14]
call fcn.00403210
mov byte [ebp - 4], 1
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push 0xf003f
push 0
lea ecx, [ebp - 0x18]
call fcn.0040aa10
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x47135f
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x20], 0
push 0x104
lea ecx, [ebp - 0x34]
call fcn.0041bf00
mov byte [ebp - 4], 2
mov dword [ebp - 0x1c], 0x104
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x24]
push ecx
push 0
lea edx, [ebp - 0x20]
push edx
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
lea ecx, [ebp - 0x34]
call fcn.0041bfa0
push eax
mov ecx, dword [ebp - 0x38]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x471353
cmp dword [ebp - 0x24], 0
ja 0x4712c9
mov dword [ebp - 0x1c], 0x104
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x38]
add eax, 1
mov dword [ebp - 0x38], eax
jmp 0x471279
mov byte [ebp - 0x49], 0
lea ecx, [ebp - 0x49]
push ecx
mov edx, dword [ebp - 0x24]
add edx, 1
push edx
lea ecx, [ebp - 0x48]
call fcn.0041bf40
mov byte [ebp - 4], 3
mov dword [ebp - 0x1c], 0x104
lea eax, [ebp - 0x24]
push eax
push 0
lea ecx, [ebp - 0x48]
call fcn.0041bfa0
push eax
lea ecx, [ebp - 0x20]
push ecx
push 0
lea edx, [ebp - 0x1c]
push edx
push 0
lea ecx, [ebp - 0x34]
call fcn.0041bfa0
push eax
mov eax, dword [ebp - 0x38]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
je 0x47132f
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x48]
call fcn.0041bf80
jmp 0x471353
push 0
lea ecx, [ebp - 0x48]
call fcn.0041bfa0
push eax
lea ecx, [ebp - 0x14]
call fcn.00403290
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x48]
call fcn.0041bf80
jmp 0x471279
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34]
call fcn.0041bf80
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x14]
call fcn.00402000
movzx eax, al
test eax, eax
je 0x471385
push 0x49a188
lea ecx, [ebp - 0x14]
call fcn.00403290
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00401f30
mov edx, dword [ebp - 0x50]
or edx, 1
mov dword [ebp - 0x50], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00413390
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00413390
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4730d0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
call fcn.0042a6fc
mov eax, dword [ebp - 4]
mov dword [eax], vtable.CLiveProgressCtrl.0
mov ecx, dword [ebp - 4]
add ecx, 0x58
call fcn.0041d360
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x84], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x7c], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x80], 1
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x70], 6
mov edx, dword [ebp - 4]
mov dword [edx + 0x74], 1
mov eax, dword [ebp - 4]
mov dword [eax + 0x78], 0x64
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x6c], 0
cmp dword [0x4bf35c], 0
jne 0x4731f1
push str.UxTheme.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x4bf35c], eax
cmp dword [0x4bf35c], 0
je 0x4731f1
push str.OpenThemeData
mov edx, dword [0x4bf35c]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4bf360], eax
push str.DrawThemeParentBackground
mov eax, dword [0x4bf35c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4bf364], eax
push str.DrawThemeBackground
mov ecx, dword [0x4bf35c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4bf368], eax
push str.CloseThemeData
mov edx, dword [0x4bf35c]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4bf36c], eax
push str.GetThemeBackgroundContentRect
mov eax, dword [0x4bf35c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4bf370], eax
push str.GetThemeInt
mov ecx, dword [0x4bf35c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4bf374], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130

Function at 0x401100
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0x405047], eax
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
push 0
push 0x80000000
push 0x80000000
push 0x80000000
push 0xcf0000
push 0x405228
push 0x405290
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40114b
xor eax, eax
jmp 0x401166
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x400010a0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
push 0x24
lea eax, [esp + 4]
push 0
push eax
call fcn.40001a40
add esp, 0xc
lea ecx, [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x2c]
xor edx, edx
div ecx
mov edx, dword [esp + 0x28]
mov edx, dword [edx + 0xc]
imul eax, ecx
cmp eax, edx
jb 0x400010ef
imul ecx, ecx, 0x402
add ecx, edx
cmp eax, ecx
jae 0x400010ef
mov eax, 1
add esp, 0x24
ret 8
xor eax, eax
add esp, 0x24
ret 8

Function at 0x40001100
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
push ebx
push esi
push edi
push 0x24
lea eax, [esp + 0x10]
push 0
push eax
call fcn.40001a40
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, dword [esp + 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, esi
imul edx, edx, 0x402
push 4
push 0x2000
push edx
push 0
call ebx
mov edi, eax
test edi, edi
jne 0x4000114d
pop edi
pop esi
pop ebx
add esp, 0x24
ret
mov eax, esi
imul esi, esi, 0x301
push 4
push 0x1000
shl eax, 8
push eax
add esi, edi
push esi
call ebx
neg eax
sbb eax, eax
and eax, edi
pop edi
pop esi
pop ebx
add esp, 0x24
ret

Function at 0x40001180
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
push 0x24
lea eax, [esp + 4]
push 0
push eax
call fcn.40001a40
add esp, 0xc
lea ecx, [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [esp + 4]
mov eax, dword [esp + 0x28]
push 4
push 0x1000
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
neg eax
sbb eax, eax
and eax, 0xffffff01
add eax, 0x7dff
add esp, 0x24
ret 4

Function at 0x400012e0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
push ebx
push esi
push edi
mov esi, eax
call fcn.4000b610
mov edi, eax
push 0x24
lea eax, [esp + 0x10]
push 0
push eax
not edi
call fcn.40001a40
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ebx, edi
and ebx, esi
inc esi
and esi, edi
push 4
sub esi, ebx
add esi, dword [esp + 0x14]
push 0x3000
push esi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
jne 0x4000133c
pop edi
pop esi
mov eax, 0x7d1c
pop ebx
add esp, 0x24
ret
push esi
push ebx
push edi
call fcn.40001a60
add esp, 0xc
mov ecx, edi
mov edx, esi
mov eax, ebx
call fcn.40001260
mov esi, eax
cmp esi, 0x7d00
je 0x4000136a
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x24
ret

Function at 0x40001380
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
test edi, edi
jne 0x40001390
mov eax, 0x7d02
add esp, 0x24
ret
push esi
mov ecx, eax
shr ecx, 0xc
mov esi, dword [ecx*4 + 0x40077248]
push 0x24
push 0
lea edx, [esp + 0xc]
and esi, 0xfffff000
push edx
add esi, eax
call fcn.40001a40
add esp, 0xc
mov eax, edx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [esp + 8]
mov eax, 0x7d00
setb cl
mov byte [edi], cl
pop esi
add esp, 0x24
ret
Function at 0x400013e0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
push esi
call fcn.4000b610
mov esi, eax
push 0x24
lea eax, [esp + 8]
push 0
push eax
not esi
call fcn.40001a40
add esp, 0xc
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
test ebx, ebx
jne 0x40001419
mov eax, 0x7d02
pop esi
add esp, 0x24
ret 4
mov edx, dword [esp + 0x2c]
and esi, edi
mov eax, esi
lea edx, [edi + edx - 1]
cmp eax, edx
ja 0x4000144e
mov ecx, dword [esp + 8]
lea ecx, [ecx]
mov esi, eax
shr esi, 0xc
mov esi, dword [esi*4 + 0x40077248]
and esi, 0xfffff000
add esi, eax
cmp esi, ecx
jae 0x4000145d
add eax, ecx
cmp eax, edx
jbe 0x40001430
mov byte [ebx], 1
mov eax, 0x7d00
pop esi
add esp, 0x24
ret 4
mov byte [ebx], 0
mov eax, 0x7d00
pop esi
add esp, 0x24
ret 4

Function at 0x400014e0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
push esi
push 0x24
mov esi, eax
lea eax, [esp + 8]
push 0
push eax
call fcn.40001a40
add esp, 0xc
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 8]
xor ecx, ecx
test al, 1
jne 0x40001517
lea esp, [esp]
shr eax, 1
inc ecx
test al, 1
je 0x40001510
shr esi, cl
mov eax, dword [esi*4 + 0x40077248]
pop esi
test al, 7
je 0x4000152f
shr eax, 8
and eax, 0xf
add esp, 0x24
ret
or eax, 0xffffffff
add esp, 0x24
ret

Function at 0x400018d0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
push ebp
mov ebp, dword [esp + 0x2c]
push esi
mov esi, eax
lea eax, [esi + 0xc]
push edi
push eax
mov dword [esp + 0x38], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 8]
mov esi, dword [eax + 4]
mov edi, 0x7d00
test esi, esi
je 0x40001968
push ebx
lea ebx, [ebx]
mov edi, dword [esi]
mov ebx, dword [ebp + 0x18]
push 0x24
lea ecx, [esp + 0x14]
push 0
push ecx
call fcn.40001a40
add esp, 0xc
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 0x14]
xor edx, edx
mov eax, ebx
div ecx
mov edx, dword [edi + 0xc]
imul eax, ecx
cmp eax, edx
jb 0x40001941
imul ecx, ecx, 0x402
add ecx, edx
cmp eax, ecx
jb 0x4000194f
mov esi, dword [esi + 8]
mov edi, 0x7d03
test esi, esi
jne 0x40001900
jmp 0x40001967
mov eax, dword [ebp + 0x18]
push eax
call fcn.40001180
mov edi, eax
cmp edi, 0x7d00
je 0x40001967
mov edi, 0x7d03
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 0x24
ret 4

Function at 0x40001a00
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
push 0x24
lea eax, [esp + 4]
push 0
push eax
call fcn.40001a40
add esp, 0xc
lea ecx, [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 4]
imul eax, eax, 0x401
add eax, dword [esp + 0x28]
add esp, 0x24
ret
Function at 0x40001a80
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push esi
push 3
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov esi, dword [sym.imp.KERNEL32.dll_TlsAlloc]
call esi
cmp dword [0x40477438], 0
mov dword [0x40075978], eax
jne 0x40001ab6
push 0
push 0x400
push 0x40000
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [0x40477438], eax
call esi
mov dword [0x4007597c], eax
pop esi
cmp eax, 0xffffffff
jne 0x40001ac9
mov eax, 0x7d23
ret
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
neg eax
sbb eax, eax
and eax, 0xffffffdd
add eax, 0x7d23
ret

Function at 0x40001af0
Capabilities:
Get thread local storage value
Set thread local storage value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4007597c]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40001b51
mov eax, 0x40
call fcn.40007410
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
jne 0x40001b32
push 0x7d05
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov edx, dword [ebp - 4]
push edx
mov eax, dword [0x4007597c]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x40001b51
push 0x7d23
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp + 8]
mov edi, dword [ebp - 4]
mov esi, 0x40001b93
mov ecx, 0x40001b99
mov edx, 0x40001b93
sub ecx, edx
rep movsb byte es:[edi], byte [esi]
mov byte [edi], 0xe9
mov ecx, dword [eax + 0x18]
sub ecx, edi
sub ecx, 5
mov dword [edi + 1], ecx
lea ebx, [ebp - 4]
push dword [eax + 0x3c]
popfd
mov ecx, dword [eax + 0x34]
mov edx, dword [eax + 0x30]
mov esi, dword [eax + 0x20]
mov edi, dword [eax + 0x1c]
mov ebp, dword [eax + 0x24]
mov esp, dword [eax + 0x28]
jmp dword [ebx]