joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a6790
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0xec56c0]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0xffffffff
jne 0x4a67b4
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
mov dword [ebp + 0xc], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov edx, dword [ebp + 8]
lea eax, [ecx + edx*2]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
sub edx, 4
cmp dword [ebp - 8], edx
jl 0x4a6804
mov eax, dword [ebp - 8]
add eax, 0x4000
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
add eax, 0xa
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [0xf43114]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x4a684c
mov edx, dword [ebp - 4]
cmp dword [edx + 4], 0x100000
jle 0x4a684c
cmp dword [ebp - 8], 0x100000
jge 0x4a6820
mov dword [ebp - 8], 0x100000
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
add eax, 0xa
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [0xf43114]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
lea eax, [edx + ecx*2]
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 8

Function at 0x4a6870
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0xec56c0]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
shl ecx, 1
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
sub eax, ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
mov esp, ebp
pop ebp
ret 4

Function at 0x4a6b40
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0xec56c0]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
cmp edx, dword [ecx]
jb 0x4a6b7e
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 8]
cmp dword [ebp + 8], ecx
ja 0x4a6b7e
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
sub ecx, dword [eax]
add ecx, 1
mov eax, ecx
jmp 0x4a6b80
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x4a6c10
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0xec56c0]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
add eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret 4
Function at 0x4a6fa0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0xec56c0]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 8]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 4

Function at 0x4a6fe0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebx
mov ebx, edx
mov edx, dword [esp + 0x18]
push ebp
push esi
push edi
movzx esi, word [edx]
mov ebp, ecx
mov edi, dword [esp + 0x28]
mov eax, esi
xor eax, 0x7f0
shr esi, 4
shr eax, 4
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ebp
mov ecx, dword [edi + esi*4]
mov eax, dword [edi + eax*4]
mov dword [esp + 0x28], eax
movzx eax, word [edx + 0x10]
mov esi, dword [esp + 0x28]
shr eax, 4
mov dword [esp + 0x1c], ecx
mov eax, dword [edi + eax*4]
add eax, esi
mov dword [esp + 0x18], eax
test ebx, ebx
je 0x4a707a
lea ebx, [ebp + 4]
mov esi, edx
mov ebp, dword [esp + 0x14]
lea ebx, [ebx]
push edi
push ebx
push ecx
push esi
call fcn.004aad50
push edi
lea eax, [ebx + 0x20]
push eax
push dword [esp + 0x30]
lea eax, [esi + 0x10]
push eax
call fcn.004aad50
mov ecx, dword [esp + 0x3c]
add esp, 0x20
add ebx, 0x440
add esi, 0x20
dec ebp
jne 0x4a7040
mov edx, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov ebp, dword [esp + 0x10]
mov ebx, dword [ebp]
cmp ebx, 0x10
jbe 0x4a7150
lea eax, [ebp + 0x44]
add ebx, 0xfffffff1
mov dword [esp + 0x18], eax
movzx eax, word [edx + 0x10]
xor eax, 0x7f0
shr ebx, 1
shr eax, 4
lea ebp, [ebx + 0x180]
add esi, dword [edi + eax*4]
lea ebp, [edx + ebp*2]
mov dword [esp + 0x28], esi
mov edi, edi
dec ebx
lea ebp, [ebp - 2]
mov dword [esp + 0x1c], ebx
lea eax, [ebx + 0x80]
mov ebx, dword [esp + 0x24]
mov edx, eax
shr eax, 1
and edx, 1
neg edx
shr edx, 4
movzx ecx, word [ebx + eax*2 + 0x200]
and edx, 0x7f
shr ecx, 4
xor ecx, edx
add esi, dword [edi + ecx*4]
cmp eax, 2
jae 0x4a70c2
movzx ecx, word [ebp]
mov ebx, dword [esp + 0x1c]
mov eax, ecx
mov edx, dword [esp + 0x18]
xor ecx, 0x7f0
shr eax, 4
shr ecx, 4
mov eax, dword [edi + eax*4]
add eax, esi
mov dword [edx + ebx*8], eax
mov eax, dword [edi + ecx*4]
add eax, esi
mov esi, dword [esp + 0x28]
mov dword [edx + ebx*8 + 4], eax
test ebx, ebx
jne 0x4a70b0
mov esi, dword [esp + 0x10]
mov eax, dword [esi]
lea ebx, [eax*4 - 0x40]
mov eax, dword [esp + 0x14]
cmp eax, 1
jbe 0x4a7150
add esi, 0x484
lea edi, [eax - 1]
push ebx
push edx
push esi
call sub.MSVCRT.dll_memcpy
mov edx, dword [esp + 0x24]
add esp, 0xc
add esi, 0x440
dec edi
jne 0x4a7138
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
Function at 0x4c43f0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jns 0x4c4408
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 9
or eax, 0xffffffff
ret
cmp dword [esp + 0xc], 0
jne 0x4c4412
xor eax, eax
ret
push eax
call dword [sym.imp.MSVCRT.dll__get_osfhandle]
add esp, 4
lea ecx, [esp + 4]
push 0
push ecx
push dword [esp + 0x14]
push dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4c447a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe8
jne 0x4c4453
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 0xb
or eax, 0xffffffff
ret
cmp eax, 0x6d
je 0x4c440f
cmp eax, 5
jne 0x4c446d
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 9
or eax, 0xffffffff
ret
push eax
call fcn.004c4120
add esp, 4
or eax, 0xffffffff
ret
mov eax, dword [esp + 4]
ret

Function at 0x4c46b0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jns 0x4c46c8
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 9
or eax, 0xffffffff
ret
push 0
lea ecx, [esp + 8]
push ecx
push dword [esp + 0x14]
push dword [esp + 0x14]
push eax
call dword [sym.imp.MSVCRT.dll__get_osfhandle]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4c4714
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x4c4707
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 9
or eax, 0xffffffff
ret
push eax
call fcn.004c4120
add esp, 4
or eax, 0xffffffff
ret
mov eax, dword [esp + 4]
ret

Function at 0x4d2ce0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [eax + 0x38]
mov bl, byte [eax + 0x34]
test esi, esi
jle 0x4d2d1b
mov edx, dword [eax + 0x260]
push edi
movzx edi, bl
lea ebx, [ebx]
mov ecx, edx
shl edx, 8
shr ecx, 0x18
xor ecx, edi
xor edx, dword [ecx*4 + 0xec5b90]
mov dword [eax + 0x260], edx
dec esi
jne 0x4d2d00
pop edi
mov ecx, dword [eax + 0x34]
mov byte [eax + ecx + 0x58], 1
mov edx, dword [eax + 0x38]
mov ecx, edx
dec ecx
je 0x4d2da2
dec ecx
je 0x4d2d87
dec ecx
je 0x4d2d7b
mov byte [edx + eax + 0x54], 1
mov edx, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
mov edx, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
mov edx, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
mov edx, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
mov esi, dword [eax + 0x44]
mov dl, byte [eax + 0x38]
mov ecx, dword [eax + 0x24]
sub dl, 4
mov byte [esi + ecx], dl
inc dword [eax + 0x44]
pop esi
pop ebx
ret
mov edx, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
mov edx, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
pop esi
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
mov edx, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
pop ebx
ret
mov ecx, dword [eax + 0x44]
mov edx, dword [eax + 0x24]
pop esi
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
pop ebx
ret
Function at 0x4e28c0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x4e28e0
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x4e28e0
mov eax, dword [eax + 0x44]
test eax, eax
je 0x4e28e0
push dword [esp + 8]
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x4f348c
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0xf42b60], 0
push ebx
push esi
mov esi, 0xf42b68
jne 0x4f34b8
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0xf42b80], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0xf42b60], 1
push dword [0xf42b80]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x4f3555
push 0x14
push 8
push dword [0xec90cc]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x4f357f
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0xf42b64]
test eax, eax
je 0x4f34fa
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0xf42b64], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x4f3584
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0xf42b80]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0xec90cc]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x4f357f
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8

Function at 0x4f3bf9
Capabilities:
Set thread local storage value

Disassembly:
push esi
push 0x184
push 8
push dword [0xec90cc]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
push esi
push dword [0xf43000]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push dword [esp + 8]
mov dword [0xf43004], esi
and dword [esi + 0xa8], 0
or dword [esi + 0xac], 0xffffffff
or dword [esi + 0xb0], 0xffffffff
push esi
mov dword [esi + 0xa4], 0xffffff
mov dword [esi + 0x74], 2
mov dword [esi + 0x78], 0x3f
call fcn.004f6809
mov dword [esi + 0x58], 0x4f480c
mov eax, esi
mov dword [esi + 0x5c], 0x4f4858
mov dword [esi + 0x10], fcn.004f43ad
mov dword [esi + 0x30], 0x4f429f
mov dword [esi + 0x64], 0x4f48e2
mov dword [esi + 0x60], 0x4f489a
mov dword [esi + 0x34], 0x4f3f4f
mov dword [esi + 0x24], 0x4f3f26
mov dword [esi + 0x28], 0x4f3efb
mov dword [esi + 0x2c], 0x4f3e4d
mov dword [esi + 0x44], 0x4f4612
pop esi
ret 4
Function at 0x4443c9
Capabilities:
Write file on windows

Disassembly:
push edx
push edx
popal
pop ecx
push esp
dec edx
inc edi
inc ebx

Function at 0x444ad0
Capabilities:
Packed with generic packer

Disassembly:
xor edi, edx
jne 0x444ab9
mov word [0x40ad84], cs
push dword [esi + 8]
pop ecx
jne 0x444ac9
mov esi, eax
jo 0x444aff
cmp eax, esi
inc di
push dword fs:[esp]
add dword [esp], 0xfffbc7a2
add dword [esp + 4], 0xa9
inc esp
and al, 4
test eax, 0xc3000000
and al, 0
mov byte [0x81fffbc7], al
pop esi

Function at 0x444b1e
Capabilities:
Packed with generic packer

Disassembly:
push eax
pop ecx
inc esi
push 0x625a5966
insb byte es:[edi], dx
pop edx
push esi
inc esp
push edx
pushal
pop ebx
inc esp
dec ebx
inc edx
insb byte es:[edi], dx
popal
arpl word [ecx + 0x67], di
push ebp
imul edi, dword [ebx + 0x48], 0x5e
imul ax, word [esi + 0x6e], 0x5a48
pop esi
cmp ecx, 0x62fcdfbf
jne 0x444b68
add byte [eax], al
pop ecx
push eax
push eax
push ebp
mov cl, byte [edi + eax + 4]
jne 0x444b4b
je 0x444b5c
push 2
call fcn.004448d5
je 0x444b6c
jne 0x444b5b
invalid
xor eax, ebp
mov dword [eax + 0xc], ecx
ret
mov esp, ebp
and al, 0x68
mov ch, 0xdc
mov dl, 0x49
Function at 0x444f3a
Capabilities:
Encode data using base64

Disassembly:
cmp cl, dh
xchg esp, eax
ja 0x438148
xor al, 0xde
imul ecx, dword [esi - 0x3b], 0xffffffe9
sbb dword [edi], ecx
push ds
scasb al, byte es:[edi]
fisttp dword [esi]
cmp dword [edi - 0x52], eax
and ebp, dword [edx + 0x1a3440d5]
add dword [edi + 0x7a34af07], ecx
je 0x438105
pop ecx
dec esp
mov word [edi + 0x33], ds
inc eax
push dword [0xa1a31a20]
mov al, 0x87
or byte [ecx], bh
wait
in al, 0x9e
cmpsb byte [esi], byte es:[edi]
movsb byte es:[edi], byte [esi]
add byte [edx - 0x2d0501ff], dl
out dx, eax
fadd qword [ecx + ebp*8 - 0x60]
ja 0x4380c3
jmp 0x27fdf8aa
daa
xchg edx, eax
dec esi
lea esp, [edi + 0x40845925]
add al, 0xe6
and eax, 0xa29d9da
add byte [esi + 0x4223bbf0], 0x26
and eax, dword [edx + 0x26]
pop ebp
mov ebx, 0x5d264223
and eax, dword [edx + 0x26]
pop ebp
loope 0x43819b
ftst
popal
dec ecx
dec edx
mov eax, dword [0xd313c3bb]
fistp dword [ebp - 0x1f]
mov word [ebp + 0x5262c8ac], fs
bound edx, qword [edx + 0x56]
inc esi
pushfd
lea esi, [ecx + 7]
jno 0x438143
enter 0xffffffffffffd3a8, 0xffffffffffffffb1
aam 6
jnp 0x4380e8
mov ah, 0x3d
inc esi
inc edi
mov ss, word [edi]
xchg ecx, eax
inc edx
jb 0x4381c7
push esi
inc ecx
dec esp
inc edx
in eax, dx
xchg ecx, eax
sub eax, edx
arpl di, cx
add dword [eax], ebx
arpl word [edx + 0x54], ax
xchg ebp, eax
jl 0x438154
sbb dword [eax - 0x26], ebp
dec ebp
push eax
pop ss
adc byte [edx - 0x604816b8], dl
dec eax
jmp 0x79b42125
ljmp 0xb1d8:0x4433d871
jo 0x4381bd
lodsb al, byte [esi]
stc
bound eax, qword [eax]
lodsb al, byte [esi]
sbb al, 0xbc
mov dl, byte [ecx - 0xae61b42]
mov dword [0xa4edaadd], eax
invalid
add eax, 0x8369d4f0
xor ah, byte [eax - 0x61]
lahf
outsb dx, byte [esi]
nop
in eax, 0x9c
mov cl, 0x86
dec edx
sub al, 3
xor ebp, dword [ebx - 0x1a]
leave
pop dword [edx]
invalid
push edx
das
mov eax, 0x7fd762e0
retf
push eax
mov ebp, esp
mov eax, dword [ebx]
lea edx, [eax + 2]
push ebp
push ebp
cmp esi, eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov edi, eax
jne 0x444f9b
add eax, 2
push ecx
inc ebp
push 0x6a6d5e67
inc edx
push edx
dec ebp
insb byte es:[edi], dx
inc ebp
outsd dx, dword [esi]
push ecx
dec ebx
inc ebx
arpl word [edx + 0x62], ax
pop eax
pop esi
dec ebp
inc esi
push esi
js 0x445011
push ecx
insb byte es:[edi], dx
dec esi
push 0x51
inc ecx
inc eax
pop eax
inc esp
outsb dx, byte [esi]
cmp dword fs:[esp - 8], 0x209f9e9
je 0x43811c
mov edi, 0xfffffffe
cmp dword [esp - 8], 0xd3406791
je 0x444ffd
push esi
cmp dword [esp + 0xc], 0x9eede7ad
jne 0x445046
add byte [eax], al
call fcn.004438c5
mov eax, dword [0x40a004]
inc eax
add byte [edx + 0x3f], ch
push eax
mov esi, dword [ebp + 8]
mov eax, dword [ebx - 4]
pop ecx
jb 0x444feb
xor ecx, ebp
invalid

Function at 0x445158
Capabilities:
Packed with generic packer

Disassembly:
add byte [ecx], bh
pop ebp
and al, ch
xchg ebp, eax
and al, 0
add byte [ebp + 4], dh
mov ecx, eax
push dword [ebp - 0x1c]
mov edi, eax
mov eax, 0x411
push edi
je 0x44518d
pop ecx
pop ecx
ret
add byte [ecx + 0x5f], ah
Function at 0x4455d6
Capabilities:
Packed with generic packer

Disassembly:
inc eax
arpl word [eax + 0x4e], bx
push ecx
push 0x664c505f
pop ebx
dec esi
js 0x44563f
inc ebp
pop ecx
dec edx
inc ebx
js 0x445634
push ebp
jge 0x445639
add byte [ebx - 0x137cf7b3], cl
adc al, 0x8b
adc byte [ebp - 0xfbfdb4], cl
jne 0x445665

Function at 0x4495d3
Capabilities:
Packed with generic packer

Disassembly:
js 0x44963f
dec ecx
dec ebx
push ax
pop edx
outsd dx, dword [esi]
inc edx
outsd dx, dword [esi]
push 0x4a
imul esp, dword [esi + 0x43], 0x59594367
dec ebp
imul edi, dword [ebx + 0x51], 0x54555a57
outsd dx, dword [esi]
call 0x4495f5
lea esp, [esp + 2]
mov word [esp], ax
lahf
lock xchg word [esp], ax
add dword [esp + 2], 0x930
lock xchg word [esp], ax
sahf
pop ax
ret 0x20

Function at 0x44b7a8
Capabilities:
Get number of processors

Disassembly:
mov eax, dword [esp]
lea esp, [esp + 4]
push edx
add eax, 0x280a2301
push dword [esp + 4]
pop dword [eax - 0x280e2cb4]
lock xchg dword [esp], edx
lea esp, [esp + 4]
lea esp, [esp + 4]
cmp edi, 0x40eb6dc9
je 0x44b816
mov eax, dword [ebp]
cmp dword [esp - 8], 0x4ba7eb25
jne 0x44b80e
insb byte es:[edi], dx
dec edx
push eax
inc esp
push 0x62
pop ecx
imul eax, dword [ebx + 0x61], 0x5c
inc ebx
popal
jns 0x44b855
outsd dx, dword [esi]
pop eax
arpl word [esi + ebp*2 + 0x45], bx
pop ecx
insd dword es:[edi], dx
pop edx
push esp
imul ebp, dword [edi + 0x5a], 0x64
popal
push 0x425a4462
push eax
inc esi
pop edi
push 0x465f7968
pushf
lea esp, [esp - 4]
mov dword [esp], edx
call fcn.0044b896
and al, 0xe8
jp 0x44b81a
add byte [eax], al
inc eax
pop ebp
imul edi, dword [ebx + 0x66], 0x64656c54
push esi
dec esp
bound ecx, qword [edx + 0x5a]
push edx
pop ecx
imul ebx, dword [edx + 0x6f], 0x57
dec esp
push eax
pop ebx
push ecx
push ebx
pop esi
dec edx
push ebp
Function at 0x44ba72
Capabilities:
Check for peb beingdebugged flag

Disassembly:
pop ebp
push esi
lea esi, [esp + 0xa]
invalid

Function at 0x44c46e
Capabilities:
Packed with generic packer

Disassembly:
push esi
inc ecx
arpl word [ebx + 0x41], sp
pop edi
push 0x6f5f4266
dec esp
inc edi
push esp
insd dword es:[edi], dx
inc edi
pop eax
inc esi
imul esp, dword [esi + 0x57], 0x4348425b
push eax
dec esi
outsd dx, dword [esi]
imul eax, dword [edx + 0x5f], 0x6f586556
push ecx
inc edi
pop esp
sti
push eax
xchg dword [esp], esi
cmp eax, 0xd5c39451
cmove edx, ecx
call fcn.0044c4df
jne 0x44c489
inc edi
mov esi, eax
jmp 0x44c491
dec ecx
pop ds
add byte [eax], al
jne 0x44c2eb
invalid
push 0xc
call 0x4496e9
mov dword [ebp - 0xc], edx
sub eax, dword [ebp - 0x1c]
push 0x4095b8
jmp 0x44c507
call 0x44c50c
mov dword [esp], esi
call fcn.0044c54a
mov ebp, esp
call fcn.0044e955
pop ecx
mov ecx, dword [0x40b6bc]
pop ecx
Function at 0x44c7ae
Capabilities:
Link function at runtime on windows

Disassembly:
add byte [eax], al
add bh, bh
jne 0x44c7cc
push esi
inc ecx
inc cl
call fcn.0044a825
call fcn.0044e406
ja 0x44c7df
cmp dword [0x40b7ec], edi
mov al, byte [esi + 3]
pop edi
push 0x74595467
pop es
add ebx, dword [edi + 0x68]
push esp
pop ecx
je 0x44c7db
mov dword [ebp - 8], eax
jne 0x44c7f1
je 0x44c909
sub al, byte [ecx]
add byte [eax], al
mov ecx, dword [ebp + 8]
push ebp
jne 0x44c7ef
jne 0x44c804
cmp byte [ebp + 0xf], 0
pop ecx
ret
and al, 0x57
add dword [esp + 4], 0xfffbb87f
mov edi, dword [esp + 4]
mov edi, dword [edi]
mov dword [esp + 4], edi
add dword [esp + 8], 0x63
add byte [eax], al
inc esp
and al, 8
arpl word [eax], ax
add byte [ecx + eax*2 + 0x58], cl
push 0x4d4b5b6d
push edx
insb byte es:[edi], dx
insd dword es:[edi], dx
insb byte es:[edi], dx
imul ebp, dword [esi + 0x42], 0x53564078
pop eax
pushal
pop eax
pop ebp
pop esi
pop edx
popaw
outsb dx, byte [esi]
jns 0x44c972
pop ecx
dec esi
inc ebx
pop ebx
dec edx
arpl word [ebx + 0x43], bp
jnp 0x44c999
inc esi
dec eax
pop edi
outsd dx, dword [esi]
popal
push esp
pop edi
inc esp
arpl word [ecx + 0x66], bp
inc esi
dec eax
imul ebp, dword [ecx + 0x4b], 0x60626b48
pop edi
inc edx
insd dword es:[edi], dx
push edi
pop ebx
pop ecx
or cl, byte [ebx + 0x648d241c]
and al, 4
cld
add byte [eax], al
add byte [edx + 0x43], ch
inc ebx
inc edi
pop edx
push esp
push dword [esi + 0x78]
jne 0x44c9ae
add esi, 2
je 0x44c9c9
sbb al, byte [ebp + 0x52df3bff]
test edi, edi
cmp ebx, edi
push edx
jns 0x44ca2a
add esi, dword [ebp + 6]
jne 0x44c9bf
inc esi
jne 0x44c9ff
sub ecx, eax
jge 0x44c9d0
adc byte [ebx - 0x74108a14], cl
push ebp
or al, 0x43
mov ebp, esp
jne 0x44c9b3
mov edx, dword [ebp + 0xc]
inc ebx
mov dword [ebp - 0x1c], eax
sub dword [ebp + 8], 0x14
ret
inc ebp
in al, 0x83
insd dword es:[edi], dx
or byte [ebx + eax*8], dl
pop esi
mov eax, dword [0x40a438]
mov ebp, esp
push eax
push dword [ebp + 0x24]
mov edi, eax
jne 0x44ca72
test eax, 0xff000000
jb 0x44c9b7
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp dword [esp - 0xc], 0xcfe132e3
cmove ebx, esi
sub eax, 0xd
push edx
push ebx
push edx
push 0x73a9
push 0x8c22
push 0x67e9f514
push ebx
push 0xe6349541
call 0x44ca1a
lea esp, [esp + 2]
mov word [esp], ax
lahf
lock xchg word [esp], ax
lea esp, [esp - 4]
and al, 0xfc
mov dword [esp], eax
call 0x44ca64
mov edi, edi
inc dword [ebp - 0x20]
call fcn.0044de34
cmp byte [esi], 0
push dword [ebp + 8]
mov byte [edi], al
jne 0x44ca74
pop edi
call fcn.0044cb7a
xor eax, eax
mov esi, ecx
mov ebx, dword [edi]
call fcn.0044f3d6
mov dword [edx + 8], ecx
push edi
cmp ebx, 8
xor ebx, dword [ecx]
cmp ebx, esi
mov eax, dword [esp]
lea esp, [esp + 4]
push ebp
mov ebp, 0xe6349395
cmove ebp, dword [esp + 0xa]
inc esp
insb byte es:[edi], dx
and al, 0xa
lea eax, [eax + ebp + 0x19cb6cf6]
lock xchg dword [esp + 0xa], eax
pop ebp
lock xchg dword [esp], eax
lea esp, [esp + 4]
lock xchg word [esp], ax
sahf
pop ax
ret 0x18
Function at 0x44cd88
Capabilities:
Check for software breakpoints
Packed with generic packer

Disassembly:
mov dword [ebp - 4], edi
mov ebp, esp
shl edi, 2
cmp dword [ebp - 0xc], ebx
mov esp, ebp
jmp 0x444c68
mov dword [ebp - 0x2c], edi
jmp 0x444c9b
push edi
dec esp
dec ebp
outsb dx, byte [esi]
jnp 0x444d1c
pop esp
popal
pop edi
js 0x444d01
insd dword es:[edi], dx
push ebx
imul eax, dword [edi + 0x56], 0x68
inc esp
push edi
push esp
dec ecx
inc edx
imul ebp, dword [edx + 0x6a], 0x63
insd dword es:[edi], dx
pop esi
push esp
push edx
inc esp
dec ebx
dec ax
dec eax
jns 0x444d0d
inc edi
pop esi
inc ebp
js 0x444d3e
outsd dx, dword [esi]
dec esi
imul esp, dword [edi + 0x46], 0x54565869
push ecx
pop ecx
inc ebx
dec sp
push edx
insb byte es:[edi], dx
dec eax
pop ecx
inc eax
inc esp
and al, 4
xchg dword [ebx], esi
cld
dec dword [ebx - 0x74fbdba4]
sbb ecx, dword [ecx - 0x7efbdba4]
inc esp
and al, 8
wait
add byte [eax], al
add byte [ebx - 0x3d], bl
test eax, eax
push 0x284
lea esp, [esp - 2]
mov word [esp], ax
loopne 0x444cc6
rol byte [eax + eax*8 + 0x4071f868], 0
cmp dword [esp + 0x30], 0xdb5f518d
je 0x444c57
lea eax, [esi + 0x1c]
cmp dword [esp + 0x48], 0xad135807
je 0x44ea20