joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406eea
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
call dword [ebp - 0x1990]
mov dword [ebp - 0x20a8], 0xa
push edx
push eax
add esp, 4
call 0x406eea
add byte [edx], dh
dec ecx
inc edi
aaa
cmp ecx, dword [eax - 0x7d]
les eax, [ebx + ebp*8]
pop es
dec ebx
cmp al, byte [eax + 0x4c]
dec edi
cmp eax, 0xe8505a41
or al, byte [eax]
add byte [eax], al
add byte [edx + 0x38], cl
dec ebx
xor dl, byte [eax + 0x49]
cmp eax, 0xc4834250
add al, 0x58
mov eax, dword [ebp - 0x3e8]
mov cl, byte [eax + 0xa]
mov byte [ebp - 0x3ae], cl
mov edx, dword [ebp - 0xab8]
invalid
xchg ebp, eax
sbb ah, bh

Function at 0x406f07
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
call dword [ebp - 0x1990]
mov dword [ebp - 0x20a8], 0xa
push edx
push eax
add esp, 4
call 0x406eea
add byte [edx], dh
dec ecx
inc edi
aaa
cmp ecx, dword [eax - 0x7d]
les eax, [ebx + ebp*8]
pop es
dec ebx
cmp al, byte [eax + 0x4c]
dec edi
cmp eax, 0xe8505a41
or al, byte [eax]
add byte [eax], al
add byte [edx + 0x38], cl
dec ebx
xor dl, byte [eax + 0x49]
cmp eax, 0xc4834250
add al, 0x58
mov eax, dword [ebp - 0x3e8]
mov cl, byte [eax + 0xa]
mov byte [ebp - 0x3ae], cl
mov edx, dword [ebp - 0xab8]
invalid
xchg ebp, eax
sbb ah, bh

Function at 0x406f7d
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov byte [ebp - 0x9d1], 0x74
mov byte [ebp - 0x9d0], 0x75
mov byte [ebp - 0x9cf], 0x61
mov byte [ebp - 0x9ce], 0x6c
mov byte [ebp - 0x9cd], 0x50
mov byte [ebp - 0x9cc], 0x72
mov byte [ebp - 0x9cb], 0x6f
mov byte [ebp - 0x9ca], 0x74
invalid
test dword [edi], esi
idiv bh

Function at 0x407058
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
xor esi, 0x1830a
sub esi, 0x576b
add esi, 0xf7ad
pop esi
push esi
push ebx
add esp, 4
or esi, 0xb29d
mov dl, 0
add byte [esi + 0x64], bl
mov eax, dword [0x18]
mov dword [ebp - 0x1994], eax
mov ecx, dword [ebp - 0x1994]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x1998], edx
push 0x8bffffe6
test dword [eax - 0x1a], ebp
invalid
dec dword [ecx - 0x16137b]
call dword [esi - 0x7f]
into
frstor dword [esi]
add byte [ecx + 0xfca2ee], al
add byte [ecx + 0x74ebe6], al
add byte [esi + 0x51], bl
add ecx, 0x5ae1
add byte [eax], al
and ecx, 0x2817
call 0x407058
add byte [eax + edi + 0x42], cl
xor dl, byte [eax + 0x4e]
dec esp
add esp, 4
pop ecx
cmp dword [ebp - 0x1614], 0
jne 0x407074
Function at 0x407a97
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x1a0]
add edx, 1
mov dword [ebp - 0x1a0], edx
mov eax, dword [ebp - 0x780]
add eax, dword [ebp - 0x1a0]
movsx ecx, byte [eax]
test ecx, ecx
je 0x407a81
mov edx, dword [ebp - 0x1a0]
movsx eax, byte [ebp + edx - 0x8a4]
mov esi, 0xf75c1584
invalid
inc dword [ebp - 0x7a7bf040]
add byte [eax], al
invalid
push esi
jmp 0x407a05
pop esi
push edi
xor edi, 0x295c
pop edi
push edi
xor edi, 0xda77
jmp 0x407a1b
pop edi
push eax
push ebx
add esp, 4
and eax, 0xd0d7
and eax, 0x16a92
pop eax
mov ecx, dword [ebp - 0x780]
add ecx, dword [ebp - 0x1a0]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x1a0]
movsx ecx, byte [ebp + eax - 0x8a4]
cmp edx, ecx
je 0x407a73
mov edx, dword [ebp - 0x780]
add edx, dword [ebp - 0x1a0]
movsx eax, byte [edx]
xor eax, 0x20
mov ecx, dword [ebp - 0x1a0]
movsx edx, byte [ebp + ecx - 0x8a4]
cmp eax, edx
jne 0x407a7a
jmp 0x4079c0
jmp 0x407a81
push esi
and esi, 0xdbe3
call 0x407a97
add byte [ebx], dh
cmp al, byte [edx + 0x4c]
xor eax, 0x323f373b
add esp, 4
and esi, 0xc0eb
call 0x407aaf
add byte [edx + 0x34], cl
xor eax, 0x373f3548
inc edi
add esp, 4
pop esi
mov eax, dword [ebp - 0x780]

Function at 0x407aaf
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x1a0]
add edx, 1
mov dword [ebp - 0x1a0], edx
mov eax, dword [ebp - 0x780]
add eax, dword [ebp - 0x1a0]
movsx ecx, byte [eax]
test ecx, ecx
je 0x407a81
mov edx, dword [ebp - 0x1a0]
movsx eax, byte [ebp + edx - 0x8a4]
mov esi, 0xf75c1584
invalid
inc dword [ebp - 0x7a7bf040]
add byte [eax], al
invalid
push esi
jmp 0x407a05
pop esi
push edi
xor edi, 0x295c
pop edi
push edi
xor edi, 0xda77
jmp 0x407a1b
pop edi
push eax
push ebx
add esp, 4
and eax, 0xd0d7
and eax, 0x16a92
pop eax
mov ecx, dword [ebp - 0x780]
add ecx, dword [ebp - 0x1a0]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x1a0]
movsx ecx, byte [ebp + eax - 0x8a4]
cmp edx, ecx
je 0x407a73
mov edx, dword [ebp - 0x780]
add edx, dword [ebp - 0x1a0]
movsx eax, byte [edx]
xor eax, 0x20
mov ecx, dword [ebp - 0x1a0]
movsx edx, byte [ebp + ecx - 0x8a4]
cmp eax, edx
jne 0x407a7a
jmp 0x4079c0
jmp 0x407a81
push esi
and esi, 0xdbe3
call 0x407a97
add byte [ebx], dh
cmp al, byte [edx + 0x4c]
xor eax, 0x323f373b
add esp, 4
and esi, 0xc0eb
call 0x407aaf
add byte [edx + 0x34], cl
xor eax, 0x373f3548
inc edi
add esp, 4
pop esi
mov eax, dword [ebp - 0x780]
Function at 0x407ab9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x77c]
add eax, 1
mov dword [ebp - 0x77c], eax
add eax, dword [ebp - 0x1a0]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x1a0]
movsx eax, byte [ebp + edx - 0x8a4]
cmp ecx, eax
jne 0x407ae0
mov dword [ebp - 0xcd4], 0
jmp 0x407b4f
push ebx
jmp 0x407aea
pop ebx
push esi
push eax
add esp, 4
call 0x407afc
add byte [ebx], bh
cmp dword [esi + 0x39], eax
dec esi
dec edx
add esp, 4
add esi, 0x12fc0
sub esi, 0xa8c7
add esi, 0xf105
pop esi
mov ecx, dword [ebp - 0x780]
add ecx, dword [ebp - 0x1a0]
movsx edx, byte [ecx]
or edx, 0x20
mov eax, dword [ebp - 0x1a0]
movsx ecx, byte [ebp + eax - 0x8a4]
or ecx, 0x20
cmp edx, ecx
jge 0x407b45
mov dword [ebp - 0xcd4], 0xffffffff
jmp 0x407b4f
mov dword [ebp - 0xcd4], 1
cmp dword [ebp - 0xcd4], 0
jne 0x407b66
mov edx, dword [ebp - 0x19b0]
invalid

Function at 0x407afc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x77c]
add eax, 1
mov dword [ebp - 0x77c], eax
add eax, dword [ebp - 0x1a0]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x1a0]
movsx eax, byte [ebp + edx - 0x8a4]
cmp ecx, eax
jne 0x407ae0
mov dword [ebp - 0xcd4], 0
jmp 0x407b4f
push ebx
jmp 0x407aea
pop ebx
push esi
push eax
add esp, 4
call 0x407afc
add byte [ebx], bh
cmp dword [esi + 0x39], eax
dec esi
dec edx
add esp, 4
add esi, 0x12fc0
sub esi, 0xa8c7
add esi, 0xf105
pop esi
mov ecx, dword [ebp - 0x780]
add ecx, dword [ebp - 0x1a0]
movsx edx, byte [ecx]
or edx, 0x20
mov eax, dword [ebp - 0x1a0]
movsx ecx, byte [ebp + eax - 0x8a4]
or ecx, 0x20
cmp edx, ecx
jge 0x407b45
mov dword [ebp - 0xcd4], 0xffffffff
jmp 0x407b4f
mov dword [ebp - 0xcd4], 1
cmp dword [ebp - 0xcd4], 0
jne 0x407b66
mov edx, dword [ebp - 0x19b0]
invalid
Function at 0x421101
Capabilities:
Encode data using xor

Disassembly:
mov dl, al
movsd dword es:[edi], dword [esi]
cmc
add al, 4
add eax, 0x8acc147a
inc ecx
add al, byte [esp + eax]
add eax, 0xee050505
pop es
add eax, 0xa5929005
cmc
add al, 4
mov ss, word [edx + 0x4040055]
xchg edx, eax
push ebp
add byte [esp + eax], al
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
jne 0x42110f
pop ebp
ret
mov ecx, dword [eax + 0x50]
test ecx, ecx
je 0x42111c
pop ebp
jmp 0x41b200
push 0
push eax
call fcn.00421055
and eax, 0x30
pop ebp
ret

Function at 0x425bb1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x502a10]
jne 0x425bbb
repz ret
jmp 0x42fd0e
add byte [eax - 1], bl
shr ah, 1
sub esp, 0x328
mov dword [0x50d738], eax
mov dword [0x50d734], ecx
mov dword [0x50d730], edx
mov dword [0x50d72c], ebx
mov dword [0x50d728], esi
mov dword [0x50d724], edi
mov word [0x50d750], ss
mov word [0x50d744], cs
mov word [0x50d720], ds
mov word [0x50d71c], es
mov word [0x50d718], fs
mov word [0x50d714], gs
pushfd
pop dword [0x50d748]
mov eax, dword [ebp]
mov dword [0x50d73c], eax
mov eax, dword [ebp + 4]
mov dword [0x50d740], eax
lea eax, [ebp + 8]
mov dword [0x50d74c], eax
mov eax, dword [ebp - 0x320]
mov dword [0x50d688], 0x10001
mov eax, dword [0x50d740]
mov dword [0x50d63c], eax
mov dword [0x50d630], 0xc0000409
mov dword [0x50d634], 1
mov eax, dword [0x502a10]
mov dword [ebp - 0x328], eax
mov eax, dword [0x502a14]
mov dword [ebp - 0x324], eax
call dword [sym.imp.KERNEL32.DLL_IsDebuggerPresent]
mov dword [0x50d680], eax
push 1
call fcn.0043e611
pop ecx
push 0
call dword [sym.imp.KERNEL32.DLL_SetUnhandledExceptionFilter]
push 0x4dc480
call dword [sym.imp.KERNEL32.DLL_UnhandledExceptionFilter]
cmp dword [0x50d680], 0
jne 0x42fe00
push 1
call fcn.0043e611
pop ecx
push 0xc0000409
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
leave
ret

Function at 0x42fcfb
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x502a10]
and dword [ebp - 8], 0
and dword [ebp - 4], 0
push ebx
push edi
mov edi, 0xbb40e64e
mov ebx, 0xffff0000
cmp eax, edi
je 0x42fcaa
test ebx, eax
je 0x42fcaa
not eax
mov dword [0x502a14], eax
jmp 0x42fd0a
push esi
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemTimeAsFileTime]
mov esi, dword [ebp - 4]
xor esi, dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
xor esi, eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
xor esi, eax
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
xor esi, eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_QueryPerformanceCounter]
mov eax, dword [ebp - 0xc]
xor eax, dword [ebp - 0x10]
xor esi, eax
cmp esi, edi
jne 0x42fcf0
mov esi, 0xbb40e64f
jmp 0x42fcfb
test ebx, esi
jne 0x42fcfb
mov eax, esi
shl eax, 0x10
or esi, eax
mov dword [0x502a10], esi
not esi
mov dword [0x502a14], esi
pop esi
push 0x401c3c
pop eax
call eax
in al, dx
Function at 0x42fd0e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x502a10]
jne 0x425bbb
repz ret
jmp 0x42fd0e
add byte [eax - 1], bl
shr ah, 1
sub esp, 0x328
mov dword [0x50d738], eax
mov dword [0x50d734], ecx
mov dword [0x50d730], edx
mov dword [0x50d72c], ebx
mov dword [0x50d728], esi
mov dword [0x50d724], edi
mov word [0x50d750], ss
mov word [0x50d744], cs
mov word [0x50d720], ds
mov word [0x50d71c], es
mov word [0x50d718], fs
mov word [0x50d714], gs
pushfd
pop dword [0x50d748]
mov eax, dword [ebp]
mov dword [0x50d73c], eax
mov eax, dword [ebp + 4]
mov dword [0x50d740], eax
lea eax, [ebp + 8]
mov dword [0x50d74c], eax
mov eax, dword [ebp - 0x320]
mov dword [0x50d688], 0x10001
mov eax, dword [0x50d740]
mov dword [0x50d63c], eax
mov dword [0x50d630], 0xc0000409
mov dword [0x50d634], 1
mov eax, dword [0x502a10]
mov dword [ebp - 0x328], eax
mov eax, dword [0x502a14]
mov dword [ebp - 0x324], eax
call dword [sym.imp.KERNEL32.DLL_IsDebuggerPresent]
mov dword [0x50d680], eax
push 1
call fcn.0043e611
pop ecx
push 0
call dword [sym.imp.KERNEL32.DLL_SetUnhandledExceptionFilter]
push 0x4dc480
call dword [sym.imp.KERNEL32.DLL_UnhandledExceptionFilter]
cmp dword [0x50d680], 0
jne 0x42fe00
push 1
call fcn.0043e611
pop ecx
push 0xc0000409
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
leave
ret
Function at 0x4393f3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0042f672
and dword [ebp - 4], 0
cmp dword [0x50db30], 0
mov ebx, eax
jne 0x4394a4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x439555
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 0x4dc744
push edi
call esi
test eax, eax
je 0x439555
push eax
call fcn.0042f600
mov dword [esp], 0x4dc734
push edi
mov dword [0x50db30], eax
call esi
push eax
call fcn.0042f600
mov dword [esp], 0x4dc720
push edi
mov dword [0x50db34], eax
call esi
push eax
call fcn.0042f600
mov dword [esp], str.GetUserObjectInformationW
push edi
mov dword [0x50db38], eax
call esi
push eax
call fcn.0042f600
pop ecx
mov dword [0x50db40], eax
test eax, eax
je 0x4394a4
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0042f600
pop ecx
mov dword [0x50db3c], eax
mov eax, dword [0x50db3c]
cmp eax, ebx
je 0x4394fc
cmp dword [0x50db40], ebx
je 0x4394fc
push eax
call fcn.0042f67b
push dword [0x50db40]
mov esi, eax
call fcn.0042f67b
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4394fc
test edi, edi
je 0x4394fc
call esi
test eax, eax
je 0x4394f3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4394f3
test byte [ebp - 0xc], 1
jne 0x4394fc
or dword [ebp + 0x10], 0x200000
jmp 0x439535
mov eax, dword [0x50db34]
cmp eax, ebx
je 0x439535
push eax
call fcn.0042f67b
pop ecx
test eax, eax
je 0x439535
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x439535
mov eax, dword [0x50db38]
cmp eax, ebx
je 0x439535
push eax
call fcn.0042f67b
pop ecx
test eax, eax
je 0x439535
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x50db30]
call fcn.0042f67b
pop ecx
test eax, eax
je 0x439555
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x439557
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43e37f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0042f672
and dword [ebp - 4], 0
cmp dword [0x50dc08], 0
mov ebx, eax
jne 0x43e430
push 0x4dc840
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x43e4e1
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x43e4e1
push eax
call fcn.0042f600
mov dword [esp], 0x4dc734
push edi
mov dword [0x50dc08], eax
call esi
push eax
call fcn.0042f600
mov dword [esp], 0x4dc720
push edi
mov dword [0x50dc0c], eax
call esi
push eax
call fcn.0042f600
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x50dc10], eax
call esi
push eax
call fcn.0042f600
pop ecx
mov dword [0x50dc18], eax
test eax, eax
je 0x43e430
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0042f600
pop ecx
mov dword [0x50dc14], eax
mov eax, dword [0x50dc14]
cmp eax, ebx
je 0x43e488
cmp dword [0x50dc18], ebx
je 0x43e488
push eax
call fcn.0042f67b
push dword [0x50dc18]
mov esi, eax
call fcn.0042f67b
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x43e488
test edi, edi
je 0x43e488
call esi
test eax, eax
je 0x43e47f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x43e47f
test byte [ebp - 0xc], 1
jne 0x43e488
or dword [ebp + 0x10], 0x200000
jmp 0x43e4c1
mov eax, dword [0x50dc0c]
cmp eax, ebx
je 0x43e4c1
push eax
call fcn.0042f67b
pop ecx
test eax, eax
je 0x43e4c1
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x43e4c1
mov eax, dword [0x50dc10]
cmp eax, ebx
je 0x43e4c1
push eax
call fcn.0042f67b
pop ecx
test eax, eax
je 0x43e4c1
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x50dc08]
call fcn.0042f67b
pop ecx
test eax, eax
je 0x43e4e1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x43e4e3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4471fa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x447252
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x447252
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x447252
xor eax, eax
inc eax
leave
ret
xor eax, eax
leave
ret
Function at 0x44727b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x4472e9
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push str.DisableMMX
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4472e0
cmp dword [ebp - 0xc], 4
jne 0x4472e0
cmp dword [ebp - 0x10], edi
je 0x4472e0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x503dc0], edi
xor eax, eax
jmp 0x447311
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x503dc0], edi
jge 0x44730c
mov dword [0x503dc0], edi
call fcn.00447256
test eax, eax
je 0x44730c
emms
mov dword [0x503dc0], 1
mov eax, dword [0x503dc0]
pop edi
leave
ret

Function at 0x4473f1
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x98
push ebx
push edi
push 0x25
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
xor bl, bl
and byte [ebp + 0x73], bl
push eax
mov dword [ebp - 0x24], 0x94
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
test eax, eax
jne 0x447428
inc bl
mov byte [ebp + 0x73], 1
cmp dword [ebp - 0x14], 1
jne 0x44744a
cmp dword [ebp - 0x20], 4
ja 0x447454
jne 0x447444
cmp dword [ebp - 0x1c], 0xa
jb 0x447444
cmp word [ebp - 0x18], 0x55d
jae 0x447454
mov byte [ebp + 0x73], 1
jmp 0x447454
cmp dword [ebp - 0x14], 2
jne 0x44746a
test bl, bl
je 0x447485
mov eax, dword [ebp + 0x7c]
sub eax, 6
je 0x447475
dec eax
je 0x44746e
sub eax, 3
jne 0x44746a
cmp byte [ebp + 0x73], 0
je 0x447496
xor eax, eax
jmp 0x44749e
call fcn.00447314
jmp 0x44749e
cmp byte [ebp + 0x73], 0
jne 0x44746a
call fcn.0044734c
and eax, 4
jmp 0x44749e
cmp dword [ebp + 0x7c], 0xa
je 0x447496
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.DLL_IsProcessorFeaturePresent]
jmp 0x44749e
call fcn.0044734c
and eax, 8
pop edi
pop ebx
add ebp, 0x74
leave
ret
Function at 0x44a53e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x18]
imul eax, edi
add eax, edx
cmp edx, eax
mov dword [ebp - 0x18], eax
jae 0x44a65f
mov eax, dword [ebp + 0x10]
lea eax, [edx + eax*4]
push ebx
push esi
mov dword [ebp + 0x14], eax
mov esi, 0xffc03fc0
mov eax, 0xff00ff
cmp edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
jae 0x44a643
mov ebx, dword [ebp + 0x14]
sub ebx, edx
dec ebx
shr ebx, 3
lea ecx, [edx + 4]
inc ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ebx
mov edx, dword [ecx + edi]
mov edi, dword [edi + ecx - 4]
mov dword [ebp - 0xc], edi
shr edi, 2
and edi, esi
mov dword [ebp - 4], edx
mov edx, dword [ecx]
mov ecx, dword [ecx - 4]
mov ebx, ecx
shr ebx, 2
and ebx, esi
add ebx, edi
mov edi, dword [ebp - 4]
shr edi, 2
and edi, esi
add ebx, edi
mov edi, edx
shr edi, 2
and edi, esi
lea ebx, [ebx + edi - 0x7fff80]
mov edi, dword [ebp - 0xc]
and edi, eax
mov esi, ecx
and esi, eax
add esi, edi
mov edi, dword [ebp - 4]
and edi, eax
add esi, edi
mov edi, edx
and edi, eax
lea esi, [esi + edi + 0x20002]
mov edi, dword [ebp - 0xc]
shr ecx, 2
shr esi, 2
xor ebx, esi
shr edi, 2
mov esi, 0x3fc03fc0
and ecx, esi
and edi, esi
add ecx, edi
mov edi, dword [ebp - 4]
shr edi, 2
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x18]
shr edx, 2
and edx, esi
lea ecx, [ecx + edx + 0x800080]
and ebx, eax
xor ebx, ecx
mov ecx, dword [ebp - 8]
add dword [ebp - 8], 4
mov dword [ecx], ebx
mov ecx, dword [ebp - 0x10]
add ecx, 8
dec dword [ebp - 0x14]
mov dword [ebp - 0x10], ecx
mov esi, 0xffc03fc0
jne 0x44a595
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
add dword [ebp + 8], ecx
lea ecx, [edi + edi]
add dword [ebp + 0x14], ecx
add edx, ecx
cmp edx, dword [ebp - 0x18]
mov dword [ebp + 0xc], edx
jb 0x44a573
pop esi
pop ebx
xor eax, eax
pop edi
leave
ret
Function at 0x44a92b
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x18]
push ebp
push esi
mov esi, dword [ecx]
mov ebp, dword [esi + 0x105c]
push edi
mov edi, dword [esi + 0x1050]
imul ebp, edi
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x18]
add ebp, eax
cmp eax, ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c], ebp
jae 0x44aa72
mov edx, 0xf81f
push ebx
mov ebx, dword [esp + 0x14]
mov esi, dword [esi + 0x1058]
lea esi, [eax + esi*2]
mov dword [esp + 0x10], ebx
add edi, eax
cmp eax, esi
mov ebx, eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], esi
jae 0x44aa4d
movzx ecx, word [ebx]
movzx esi, word [ebx + 2]
movzx eax, word [edi + 2]
movzx edi, word [edi]
mov ebp, ecx
mov ebx, eax
and bx, dx
and bp, dx
mov dword [esp + 0x24], ecx
and ecx, 0xffff07e0
add ebx, ebp
mov ebp, edi
and bp, dx
add ebx, ebp
mov ebp, esi
and bp, dx
lea ebx, [ebx + ebp + 0x1002]
mov ebp, eax
and ebp, 0xffff07e0
add ebp, ecx
mov ecx, edi
and ecx, 0xffff07e0
add ebp, ecx
mov ecx, esi
and ecx, 0xffff07e0
shr ebx, 2
lea ecx, [ecx + ebp + 0x40]
shr ecx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x24]
and eax, edx
and ecx, edx
add eax, ecx
and edi, edx
add eax, edi
mov edi, dword [esp + 0x1c]
and esi, edx
and ebx, 0xffff07e0
lea eax, [eax + esi + 0x1002]
shr eax, 2
xor ebx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 2
mov word [eax], bx
mov ebx, dword [esp + 0x18]
add ebx, 4
add edi, 4
cmp ebx, dword [esp + 0x28]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
jb 0x44a994
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov ebp, dword [esp + 0x30]
mov esi, dword [ecx + 4]
mov esi, dword [esi + 0x1050]
add dword [esp + 0x14], esi
mov esi, dword [ecx]
mov edi, dword [esi + 0x1050]
lea eax, [eax + edi*2]
cmp eax, ebp
mov dword [esp + 0x20], eax
jb 0x44a96b
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x24
ret
Function at 0x44ab9f
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x18]
push ebp
push esi
mov esi, dword [ecx]
mov ebp, dword [esi + 0x105c]
mov edx, dword [esi + 0x18]
push edi
mov edi, dword [esi + 0x1050]
imul ebp, edi
add ebp, edx
cmp edx, ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x2c], ebp
jae 0x44ace5
mov eax, 0x83e0
push ebx
mov ebx, dword [esp + 0x14]
mov esi, dword [esi + 0x1058]
lea esi, [edx + esi*2]
mov dword [esp + 0x10], ebx
add edi, edx
cmp edx, esi
mov ebx, edx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], esi
jae 0x44acc0
movzx ecx, word [ebx]
movzx esi, word [ebx + 2]
movzx edx, word [edi + 2]
movzx edi, word [edi]
mov ebp, ecx
and ebp, eax
mov ebx, edx
and ebx, eax
add ebx, ebp
mov ebp, edi
and ebp, eax
add ebx, ebp
mov dword [esp + 0x24], ecx
and ecx, 0x7c1f
mov ebp, esi
and ebp, eax
lea ebx, [ebx + ebp + 0x10040]
mov ebp, edx
and ebp, 0x7c1f
add ebp, ecx
mov ecx, edi
and ecx, 0x7c1f
add ebp, ecx
mov ecx, esi
and ecx, 0x7c1f
lea ecx, [ecx + ebp + 0x802]
shr ecx, 2
shr ebx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x24]
and ecx, eax
and edx, eax
add edx, ecx
and edi, eax
add edx, edi
mov edi, dword [esp + 0x1c]
and esi, eax
and ebx, 0xffff7c1f
lea ecx, [edx + esi + 0x10040]
shr ecx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x10]
add dword [esp + 0x10], 2
mov word [ecx], bx
mov ebx, dword [esp + 0x18]
add ebx, 4
add edi, 4
cmp ebx, dword [esp + 0x28]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
jb 0x44ac08
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x20]
mov ebp, dword [esp + 0x30]
mov esi, dword [ecx + 4]
mov esi, dword [esi + 0x1050]
add dword [esp + 0x14], esi
mov esi, dword [ecx]
mov edi, dword [esi + 0x1050]
lea edx, [edx + edi*2]
cmp edx, ebp
mov dword [esp + 0x20], edx
jb 0x44abdf
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x24
ret