joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406b8b
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 0x514], ecx
push eax
push edx
add esp, 4
add eax, 0x9413
pop eax
push edx
or edx, 0xec41
or edx, 0xbeaf
call 0x406b29
add byte [esi + 0x33], cl
dec esi
dec ebx
cmp esi, dword [edi]
inc esp
dec edi
cmp al, byte [ebx - 0xd7efb3c]
add al, 0x81
nop
add al, byte [eax]
add byte [edx - 0x73], bl
xchg ebp, eax
enter 0xffffffffffffffe8, 0xffffffffffffffff
mov dword [ebp - 0xcc0], edx
mov eax, dword [ebp - 0x514]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcbc], ecx
xor edx, edx
mov word [ebp - 0x21c], dx
xor eax, eax
mov word [ebp - 0x38], ax
push edx
push ebx
add esp, 4
call 0x406b70
add byte [esi + 0x4f], al
dec eax
cmp ecx, dword [eax + 0x42]
cmp al, 0x33
add esp, 4
or edx, 0x178f3
pop edx
push ebx
push esi
add esp, 4
call 0x406b8b
add byte [ebx], bh
xor eax, 0x39394d43
add esp, 4
pop ebx
mov ecx, dword [ebp - 0xcbc]
mov dx, word [ecx]
mov word [ebp - 0x103e], dx
mov eax, dword [ebp - 0xcbc]
add eax, 2
mov dword [ebp - 0xcbc], eax
mov cx, word [ebp - 0x103e]
mov word [ebp - 0x21c], cx
mov edx, dword [ebp - 0xcc0]
mov ax, word [edx]
mov word [ebp - 0x1040], ax
mov ecx, dword [ebp - 0xcc0]
add ecx, 2
mov dword [ebp - 0xcc0], ecx
mov dx, word [ebp - 0x1040]
mov word [ebp - 0x38], dx
push eax
and eax, 0x4f9e
pop eax
push eax
push esi
add esp, 4
xor eax, 0x81b7
pop eax
push edi
push eax
add esp, 4
or edi, 0x7331
or edi, 0x10dcf
and edi, 0x46c2
and edi, 0x13e71
pop edi
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x406c35
movzx ecx, word [ebp - 0x21c]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x161c], ecx
jmp 0x406c8f
movzx eax, word [ebp - 0x21c]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x406b5d
movzx edx, word [ebp - 0x21c]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x406b5d
movzx ecx, word [ebp - 0x21c]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x406c79
mov dword [ebp - 0x1618], 0xffffffff
jmp 0x406c83
mov dword [ebp - 0x1618], 1
mov eax, dword [ebp - 0x1618]
mov dword [ebp - 0x161c], eax
cmp dword [ebp - 0x161c], 0
jne 0x406cd8
push edi
push ebx
add esp, 4
sub edi, 0x5ff2
sub edi, 0xb0aa
jmp 0x406caf
xor edi, 0x109fc
pop edi
push ecx
sub ecx, 0x14e27
or ecx, 0x109a6
and ecx, 0x1658e
pop ecx
mov ecx, dword [ebp - 0x514]
mov dword [ebp - 0x2fc], ecx
jmp 0x406d40
push ecx
push ebx
add esp, 4
jmp 0x406ce6
pop ecx
push eax
or eax, 0xbd25
xor eax, 0x149db
jmp 0x406cfd
pop eax
push edx
push ecx
add esp, 4
and edx, 0xd944
pop edx
mov edx, dword [ebp - 0x514]
mov eax, dword [edx]
mov dword [ebp - 0x514], eax
mov ecx, dword [ebp - 0x514]
cmp ecx, dword [ebp - 0xcc4]
je 0x406d36
mov edx, dword [ebp - 0x514]
cmp dword [edx + 0x30], 0
jne 0x406b01
mov dword [ebp - 0x2fc], 0
Function at 0x406f17
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x1620]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xcd0], ecx
push ecx
jmp 0x406f30
pop ecx
push edi
push edi
add esp, 4
or edi, 0xcfbd
xor edi, 0xa211
xor edi, 0x6f05
or edi, 0x8a31
pop edi
push edx
push edx
add esp, 4
and edx, 0x8eee
pop edx
cmp dword [ebp - 0xcd0], 0
jne 0x406f73
mov dword [ebp - 0x774], 0
jmp 0x4071be
mov edx, dword [ebp - 0xcd0]
mov dword [ebp - 0x518], edx
push edx
push ebx
add esp, 4
add edx, 0x16e52
or edx, 0x3925
and edx, 0x7497
or edx, 0xea83
pop edx
push edi
push eax
add esp, 4
jmp 0x406faa
xor edi, 0x18133
pop edi
lea eax, [ebp - 0x1790]
mov dword [ebp - 0xccc], eax
mov ecx, dword [ebp - 0x518]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xcc8], edx
xor eax, eax
mov word [ebp - 0x220], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
push edi
push edx
add esp, 4
or edi, 0x10064
sub edi, 0x17254
pop edi
push esi
push edi
add esp, 4
or esi, 0x1841e
add esi, 0x9c87
pop esi
push eax
sub eax, 0xc82e
and eax, 0x16e33
pop eax
mov edx, dword [ebp - 0xcc8]
mov ax, word [edx]
mov word [ebp - 0x1042], ax
mov ecx, dword [ebp - 0xcc8]
add ecx, 2
mov dword [ebp - 0xcc8], ecx
mov dx, word [ebp - 0x1042]
mov word [ebp - 0x220], dx
mov eax, dword [ebp - 0xccc]
mov cx, word [eax]
mov word [ebp - 0x1044], cx
mov edx, dword [ebp - 0xccc]
add edx, 2
mov dword [ebp - 0xccc], edx
mov ax, word [ebp - 0x1044]
mov word [ebp - 0x3c], ax
push edi
or edi, 0x1124a
call 0x40707a
add byte [eax + 0x42], al
cmp al, 0x3a
inc ebp
xor eax, dword [ebp + 0x50]
inc ebp
add esp, 4
and edi, 0xe80a
call 0x407092
add byte [0x50335039], dh
inc edx
cmp ecx, dword [eax - 0x7d]
les eax, [edi + ebx*2]
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x4070b3
movzx edx, word [ebp - 0x220]
invalid
invalid
Function at 0x40707a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x1620]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xcd0], ecx
push ecx
jmp 0x406f30
pop ecx
push edi
push edi
add esp, 4
or edi, 0xcfbd
xor edi, 0xa211
xor edi, 0x6f05
or edi, 0x8a31
pop edi
push edx
push edx
add esp, 4
and edx, 0x8eee
pop edx
cmp dword [ebp - 0xcd0], 0
jne 0x406f73
mov dword [ebp - 0x774], 0
jmp 0x4071be
mov edx, dword [ebp - 0xcd0]
mov dword [ebp - 0x518], edx
push edx
push ebx
add esp, 4
add edx, 0x16e52
or edx, 0x3925
and edx, 0x7497
or edx, 0xea83
pop edx
push edi
push eax
add esp, 4
jmp 0x406faa
xor edi, 0x18133
pop edi
lea eax, [ebp - 0x1790]
mov dword [ebp - 0xccc], eax
mov ecx, dword [ebp - 0x518]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xcc8], edx
xor eax, eax
mov word [ebp - 0x220], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
push edi
push edx
add esp, 4
or edi, 0x10064
sub edi, 0x17254
pop edi
push esi
push edi
add esp, 4
or esi, 0x1841e
add esi, 0x9c87
pop esi
push eax
sub eax, 0xc82e
and eax, 0x16e33
pop eax
mov edx, dword [ebp - 0xcc8]
mov ax, word [edx]
mov word [ebp - 0x1042], ax
mov ecx, dword [ebp - 0xcc8]
add ecx, 2
mov dword [ebp - 0xcc8], ecx
mov dx, word [ebp - 0x1042]
mov word [ebp - 0x220], dx
mov eax, dword [ebp - 0xccc]
mov cx, word [eax]
mov word [ebp - 0x1044], cx
mov edx, dword [ebp - 0xccc]
add edx, 2
mov dword [ebp - 0xccc], edx
mov ax, word [ebp - 0x1044]
mov word [ebp - 0x3c], ax
push edi
or edi, 0x1124a
call 0x40707a
add byte [eax + 0x42], al
cmp al, 0x3a
inc ebp
xor eax, dword [ebp + 0x50]
inc ebp
add esp, 4
and edi, 0xe80a
call 0x407092
add byte [0x50335039], dh
inc edx
cmp ecx, dword [eax - 0x7d]
les eax, [edi + ebx*2]
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x4070b3
movzx edx, word [ebp - 0x220]
invalid
invalid
Function at 0x407092
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x1620]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xcd0], ecx
push ecx
jmp 0x406f30
pop ecx
push edi
push edi
add esp, 4
or edi, 0xcfbd
xor edi, 0xa211
xor edi, 0x6f05
or edi, 0x8a31
pop edi
push edx
push edx
add esp, 4
and edx, 0x8eee
pop edx
cmp dword [ebp - 0xcd0], 0
jne 0x406f73
mov dword [ebp - 0x774], 0
jmp 0x4071be
mov edx, dword [ebp - 0xcd0]
mov dword [ebp - 0x518], edx
push edx
push ebx
add esp, 4
add edx, 0x16e52
or edx, 0x3925
and edx, 0x7497
or edx, 0xea83
pop edx
push edi
push eax
add esp, 4
jmp 0x406faa
xor edi, 0x18133
pop edi
lea eax, [ebp - 0x1790]
mov dword [ebp - 0xccc], eax
mov ecx, dword [ebp - 0x518]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xcc8], edx
xor eax, eax
mov word [ebp - 0x220], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
push edi
push edx
add esp, 4
or edi, 0x10064
sub edi, 0x17254
pop edi
push esi
push edi
add esp, 4
or esi, 0x1841e
add esi, 0x9c87
pop esi
push eax
sub eax, 0xc82e
and eax, 0x16e33
pop eax
mov edx, dword [ebp - 0xcc8]
mov ax, word [edx]
mov word [ebp - 0x1042], ax
mov ecx, dword [ebp - 0xcc8]
add ecx, 2
mov dword [ebp - 0xcc8], ecx
mov dx, word [ebp - 0x1042]
mov word [ebp - 0x220], dx
mov eax, dword [ebp - 0xccc]
mov cx, word [eax]
mov word [ebp - 0x1044], cx
mov edx, dword [ebp - 0xccc]
add edx, 2
mov dword [ebp - 0xccc], edx
mov ax, word [ebp - 0x1044]
mov word [ebp - 0x3c], ax
push edi
or edi, 0x1124a
call 0x40707a
add byte [eax + 0x42], al
cmp al, 0x3a
inc ebp
xor eax, dword [ebp + 0x50]
inc ebp
add esp, 4
and edi, 0xe80a
call 0x407092
add byte [0x50335039], dh
inc edx
cmp ecx, dword [eax - 0x7d]
les eax, [edi + ebx*2]
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x4070b3
movzx edx, word [ebp - 0x220]
invalid
invalid

Function at 0x407247
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop ebx
push ecx
call 0x407256
add byte [ebp + 0x4c], cl
xor edi, dword [eax]
inc eax
xor al, 0x36
add esp, 4
jmp 0x40725f
or ecx, 0x8ae7
xor ecx, 0x403d
pop ecx
mov ecx, dword [ebp - 0x774]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x3a4], edx
mov dword [ebp - 0x784], 0
mov eax, dword [ebp - 0x3a4]
mov dword [ebp - 0x166c], eax
cmp dword [ebp - 0x166c], 0
jne 0x4072ab
mov ecx, dword [ebp - 0x784]
mov dword [ebp - 0x3f8], ecx
jmp 0x40759c
mov edx, dword [ebp - 0x166c]
mov eax, dword [ebp - 0x3a4]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x1670], eax
jne 0x4072d3
mov ecx, dword [ebp - 0x784]
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x1670]
mov edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x1678], edx
cmp dword [ebp - 0x1678], 0
jne 0x407305
mov eax, dword [ebp - 0x784]
mov dword [ebp - 0x3f8], eax
jmp 0x40759c
mov ecx, dword [ebp - 0x3a4]
add ecx, dword [ebp - 0x1678]
mov dword [ebp - 0x778], ecx
jne 0x40732a
mov edx, dword [ebp - 0x784]
mov dword [ebp - 0x3f8], edx
jmp 0x40759c
mov eax, dword [ebp - 0x778]
mov ecx, dword [ebp - 0x3a4]
add ecx, dword [eax + 0x20]
invalid
invalid
pop esp
invalid
Function at 0x407256
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop ebx
push ecx
call 0x407256
add byte [ebp + 0x4c], cl
xor edi, dword [eax]
inc eax
xor al, 0x36
add esp, 4
jmp 0x40725f
or ecx, 0x8ae7
xor ecx, 0x403d
pop ecx
mov ecx, dword [ebp - 0x774]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x3a4], edx
mov dword [ebp - 0x784], 0
mov eax, dword [ebp - 0x3a4]
mov dword [ebp - 0x166c], eax
cmp dword [ebp - 0x166c], 0
jne 0x4072ab
mov ecx, dword [ebp - 0x784]
mov dword [ebp - 0x3f8], ecx
jmp 0x40759c
mov edx, dword [ebp - 0x166c]
mov eax, dword [ebp - 0x3a4]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x1670], eax
jne 0x4072d3
mov ecx, dword [ebp - 0x784]
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x1670]
mov edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x1678], edx
cmp dword [ebp - 0x1678], 0
jne 0x407305
mov eax, dword [ebp - 0x784]
mov dword [ebp - 0x3f8], eax
jmp 0x40759c
mov ecx, dword [ebp - 0x3a4]
add ecx, dword [ebp - 0x1678]
mov dword [ebp - 0x778], ecx
jne 0x40732a
mov edx, dword [ebp - 0x784]
mov dword [ebp - 0x3f8], edx
jmp 0x40759c
mov eax, dword [ebp - 0x778]
mov ecx, dword [ebp - 0x3a4]
add ecx, dword [eax + 0x20]
invalid
invalid
pop esp
invalid

Function at 0x4072c8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 0x3f8], ecx
jmp 0x40759c

Function at 0x407418
Capabilities:
Resolve function by parsing pe exports

Disassembly:
or byte [ebp - 0x647bf037], al
add byte [eax], al
add byte [ebx - 0x19f6b], cl
dec dword [edi]
mov esi, 0xf75c1584
invalid
inc dword [ebp - 0x7a7bf040]
add byte [eax], al
add byte [eax - 0x7f], dl
loopne 0x407402
sub eax, 0xe0810000
test byte [eax + eax], dh
Function at 0x4076dd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
and ebx, 0x141e4
or ebx, 0x5378
call 0x4076f9
add byte [edx], dh
aaa
dec esi
cmp bh, byte [edi]
aas
xor eax, 0x834d333a
les eax, [ecx + eax*4]
jmp 0x407715
add cl, ch
cmpsd dword [esi], dword es:[edi]
add al, byte [eax]
add byte [ebx - 0x167b6b], cl
dec dword [ebx + 0x488b0c42]
or al, 0x89
lea esp, [eax]
invalid

Function at 0x4076f9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
and ebx, 0x141e4
or ebx, 0x5378
call 0x4076f9
add byte [edx], dh
aaa
dec esi
cmp bh, byte [edi]
aas
xor eax, 0x834d333a
les eax, [ecx + eax*4]
jmp 0x407715
add cl, ch
cmpsd dword [esi], dword es:[edi]
add al, byte [eax]
add byte [ebx - 0x167b6b], cl
dec dword [ebx + 0x488b0c42]
or al, 0x89
lea esp, [eax]
invalid

Function at 0x407755
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x407755
add byte [ebx], dh
dec ebp
xor al, 0x45
cmp dword [eax + 0x3c], edx
cmp eax, 0xc4833740
add al, 0x81
iretd

Function at 0x407787
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add al, 0x81
imul dword [ecx - 0x7effff56]
iretd
Function at 0x40e350
Capabilities:
Encode data using xor

Disassembly:
pop eax
push ebx
test ch, al
add eax, 0x957af882
add dword [ecx], eax
or al, 0x46
add dword ds:[ecx], eax
or al, 0x75
inc ecx
add dword [ecx], eax
or al, 0x7a
push ss
add al, byte [ecx]
pushal
push edi
push ecx
test ch, al
add eax, 0x4550e782
and bh, 0x50
inc ebp
add dword [ecx], eax
pop edi
mov dword [esi + 0xf5c5], 0xc686c753
cmc
add byte [eax], al
jne 0x40e2d1
xchg bh, al
cmc
add byte [eax], al
insd dword es:[edi], dx
mov dword [esi + 0xf5c8], 0xc986c74a
cmc
add byte [eax], al
outsd dx, dword [esi]
mov dword [esi + 0xf5ca], 0xcb86c76a
xchg dl, cl
cmc
add byte [eax], al
push 0xffffffffffffffc7
xchg bl, cl
xchg dl, cl
cmc
add byte [eax], al
push 0xffffffffffffffc7
xchg bl, cl
cmc
add byte [eax], al
jne 0x40e2f4
xchg ah, cl
cmc
add byte [eax], al
push esi
mov dword [esi + 0xf5cd], 0xce86c76f
cmc
add byte [eax], al
push 0xffffffffffffffc7
xchg bh, cl
mov dword [esi + 0xf5ce], 0xcf86c76a
cmc
add byte [eax], al
mov dword fs:[esi + 0xf5d0], 0xd186c770
xchg cl, dl
cmc
add byte [eax], al
mov dword gs:[esi + 0xf5d2], 0xd386c766
cmc
add byte [eax], al
push esp
mov dword [esi + 0xf5d4], 0xd586c775
cmc
add byte [eax], al
jae 0x40e33a
xchg dh, dl
cmc
add byte [eax], al
push 0xffffffffffffffc7
xchg bh, dl
cmc
add byte [eax], al
outsd dx, dword [esi]
mov dword [esi + 0xf5d8], 0xd986c768
cmc
add byte [eax], al
add dword [edi - 0x7e], edx
out dx, eax
call 0xec41e4ad
pop es
inc ebx
xor eax, 0x5034424a
pop edi
pop eax
push ebx
test ch, al
add eax, 0x25cbf882
add al, byte [ecx]
pushal
pop eax
push esp
test ch, al
add eax, 0x10109e9
add dword [ecx], eax
dec esp
push eax
xor eax, 0x3a4a3f37
test ch, al
add eax, 0x6586c760
cmc
add byte [eax], al
push ebx
mov dword [esi + 0xf566], 0x6786c775
cmc
mov dword [esi + 0xf565], 0x6686c753
cmc
add byte [eax], al
jne 0x40e396
xchg byte [edi - 0xb], ah
add byte [eax], al
insd dword es:[edi], dx
mov dword [esi + 0xf568], 0x6986c756
cmc
add byte [eax], al
jno 0x40e3ab
xchg byte [edx - 0xb], ch
add byte [eax], al
mov dword fs:[esi + 0xf56b], 0x6c86c762
cmc
add byte [eax], al
je 0x40e3c0
xchg byte [ebp - 0xb], ch
add byte [eax], al
mov word [esi + 0xf56e], 0xc756
xchg byte [edi - 0xb], ch
add byte [eax], al
outsd dx, dword [esi]
mov dword [esi + 0xf570], 0x7186c76a
cmc
add byte [eax], al
mov dword fs:[esi + 0xf572], 0x7386c770
cmc
add byte [eax], al
mov dword gs:[esi + 0xf574], 0x7586c766
cmc
add byte [eax], al
push esp
mov dword [esi + 0xf576], 0x7786c775
cmc
add byte [eax], al
jae 0x40e40d
xchg byte [eax - 0xb], bh
add byte [eax], al
push 0xffffffffffffffc7
xchg byte [ecx - 0xb], bh
add byte [eax], al
outsd dx, dword [esi]
mov dword [esi + 0xf57a], 0x7b86c768
cmc
add byte [eax], al
add dword [edx - 0x7e], edx
loop 0x40e489
add dword [edx], 0x10be901
cmp dword [ebp + 0x34], eax
dec edi
inc edx
test ch, al
add eax, 0x7d86c75a
cmc
add byte [eax], al
push ebx
mov dword [esi + 0xf57e], 0x7f86c775
cmc
Function at 0x421f0e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x421f72
cmp dword [ebp + 0xc], 1
je 0x421f4a
cmp dword [ebp + 0xc], 2
je 0x421f4a
push 0xd
pop eax
jmp 0x421f72
mov eax, dword [ebp - 4]
test edi, edi
je 0x421f6c
test eax, eax
je 0x421f67
test al, 1
jne 0x421f45
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x421f6c
jmp 0x421f45
xor ecx, ecx
mov word [edi], cx
shr eax, 1
mov dword [esi], eax
xor eax, eax
leave
ret 8
Function at 0x426580
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x630
mov eax, dword [0x577698]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, 0x208
mov dword [ebp - 0x628], eax
xor eax, eax
lea esi, [edi - 2]
push esi
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
mov dword [ebp - 0x620], edi
call fcn.004e7380
xor eax, eax
push esi
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.004e7380
xor eax, eax
push esi
push eax
mov word [ebp - 0x61c], ax
lea eax, [ebp - 0x61a]
push eax
call fcn.004e7380
add esp, 0x24
push str.system
push edi
lea eax, [ebp - 0x414]
push eax
mov dword [ebp - 0x624], edi
mov dword [ebp - 0x62c], 0x104
call fcn.00421170
lea eax, [ebp - 0x630]
push eax
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x42668d
mov esi, dword [sym.imp.ADVAPI32.dll_IsValidSid]
lea eax, [ebp - 0x20c]
push eax
call esi
test eax, eax
je 0x42668d
lea eax, [ebp - 0x20c]
push eax
call esi
test eax, eax
je 0x42668d
push dword [ebp - 0x628]
lea eax, [ebp - 0x20c]
push eax
lea edi, [ebp - 0x620]
call fcn.004263f0
test eax, eax
je 0x42668d
xor eax, eax
inc eax
jmp 0x42668f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004e736b
leave
ret 4

Function at 0x42669f
Capabilities:
Get session user name
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x634
mov eax, dword [0x577698]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, 0x208
mov dword [ebp - 0x630], eax
xor eax, eax
lea esi, [edi - 2]
push esi
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
mov dword [ebp - 0x620], edi
call fcn.004e7380
xor eax, eax
push esi
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.004e7380
xor eax, eax
push esi
push eax
mov word [ebp - 0x61c], ax
lea eax, [ebp - 0x61a]
push eax
call fcn.004e7380
mov eax, 0x104
mov dword [ebp - 0x628], eax
mov dword [ebp - 0x624], eax
add esp, 0x24
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x414]
push eax
mov dword [ebp - 0x62c], edi
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x4267b9
lea eax, [ebp - 0x634]
push eax
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x4267b9
mov esi, dword [sym.imp.ADVAPI32.dll_IsValidSid]
lea eax, [ebp - 0x20c]
push eax
call esi
test eax, eax
je 0x4267b9
lea eax, [ebp - 0x20c]
push eax
call esi
test eax, eax
je 0x4267b9
push dword [ebp - 0x630]
lea eax, [ebp - 0x20c]
push eax
lea edi, [ebp - 0x620]
call fcn.004263f0
test eax, eax
je 0x4267b9
xor eax, eax
inc eax
jmp 0x4267bb
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004e736b
leave
ret 4
Function at 0x42839d
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5191a2
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x577698]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
lea eax, [ebx + 0x74]
push eax
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
and dword [esp + 0x30], 0
mov eax, dword [ebx + 0x6c]
mov ecx, dword [ebx + 0x54]
mov dword [esp + 0x20], eax
mov eax, dword [eax]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
jmp 0x42841b
lea esi, [esp + 0x14]
call fcn.0046059e
mov eax, dword [eax + 4]
test eax, eax
je 0x428412
mov edx, dword [eax]
push 1
mov ecx, eax
call dword [edx + 8]
lea esi, [esp + 0x14]
call fcn.0043d92e
lea edi, [esp + 0x1c]
lea esi, [esp + 0x14]
call fcn.0049da45
test al, al
je 0x4283f9
lea edi, [ebx + 0x54]
call fcn.004815d8
or dword [ebx + 0xa8], 0xffffffff
xor esi, esi
lea eax, [ebx + 0x11c]
mov byte [ebx + 0x28], 0
mov dword [ebx + 0xac], 1
mov dword [ebx + 0x138], esi
call fcn.004172b9
lea eax, [ebx + 0x90]
call fcn.0042947d
push dword [ebx + 4]
mov dword [ebx + 0x4c], esi
mov dword [ebx + 0x50], esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x42848e
push 0x64
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4318c4
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x5152ab
call fcn.004f215e
and dword [ebp - 0x10], 0
xor eax, eax
mov esi, str.software360TotalSecurity
mov ebx, str.FullCheck
mov edi, str.Options
cmp eax, esi
je 0x43194d
cmp eax, ebx
je 0x43194d
cmp eax, edi
je 0x43194d
mov eax, dword [0x582d44]
mov ecx, 0x582d44
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
and dword [ebp - 4], 0
push ebx
push esi
push str._s_s
lea eax, [ebp - 0x14]
call fcn.00429c50
mov esi, dword [ebp - 0x14]
and dword [ebp - 0x1c], 0
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
push edi
push esi
push SysReAllocString
mov dword [ebp - 0x18], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
or dword [ebp - 4], 0xffffffff
lea eax, [esi - 0x10]
call fcn.0040557a
cmp byte [ebp + 0xc], 0
mov eax, dword [ebp + 8]
je 0x43195b
or dword [ebp - 0x10], eax
jmp 0x431960
not eax
and dword [ebp - 0x10], eax
push SysReAllocString
push dword [ebp - 0x10]
push edi
push ebx
call fcn.00434648
add esp, 0x10
call fcn.004f2236
ret

Function at 0x431c46
Capabilities:
Get common file path

Disassembly:
push 0x234
mov eax, 0x51bda9
call fcn.004f21c7
xor ebx, ebx
mov edi, ecx
mov dword [ebp - 0x23c], ebx
test byte [0x5875b4], 1
push 7
mov dword [ebp - 0x240], edi
pop esi
jne 0x431c97
or dword [0x5875b4], 1
xor eax, eax
push 0x529148
mov dword [0x5875b0], esi
mov dword [0x5875ac], ebx
mov word [0x58759c], ax
call fcn.004e9f4f
pop ecx
cmp byte [0x586ca8], 1
jne 0x431cb3
push 0x587598
mov esi, edi
call fcn.004250eb
mov eax, edi
jmp 0x431d90
xor eax, eax
push 0x206
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push ebx
push eax
call fcn.004e7380
add esp, 0xc
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edi, 0x587598
test eax, eax
je 0x431d7b
xor eax, eax
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x224], ebx
mov word [ebp - 0x234], ax
lea eax, [ebp - 0x23c]
push eax
mov dword [ebp - 4], ebx
push dword [ebp - 0x21c]
call fcn.0040dcc8
pop ecx
pop ecx
test al, al
je 0x431d69
lea eax, [ebp - 0x238]
push eax
push dword [ebp - 0x23c]
call fcn.0040dd87
pop ecx
pop ecx
test al, al
jne 0x431d54
lea eax, [ebp - 0x238]
push eax
push dword [ebp - 0x23c]
call fcn.0040df58
pop ecx
pop ecx
jmp 0x431d56
mov al, 1
cmp al, bl
je 0x431d69
push 0xffffffffffffffff
push ebx
push edi
lea eax, [ebp - 0x238]
call fcn.00404bcd
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea esi, [ebp - 0x238]
call fcn.00404e82
mov esi, dword [ebp - 0x240]
push edi
mov byte [0x586ca8], 1
call fcn.004250eb
mov eax, esi
call fcn.004f224a
ret