joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407120
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push eax
call 0x4070e5
add byte [eax], bh
xor al, byte [esp + ecx*2 + 0x39]
push eax
inc ecx
add esp, 4
xor eax, 0x981
pop eax
push ebx
or ebx, 0xe240
add ebx, 0x5d25
or ebx, 0x3ca4
xor ebx, 0x1354d
pop ebx
lea edx, [ebp - 0x173c]
mov dword [ebp - 0xcc0], edx
mov eax, dword [ebp - 0x514]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcbc], ecx
inc esp
invalid
invalid
push dword [ebx]
shl byte [esi - 0x77], cl
xchg ebp, eax
in al, 0xfd
invalid
push dword [ebx]
shl byte [esi - 0x77], 0x45
invalid
push eax
push esi
add esp, 4
jmp 0x40713d
xor eax, 0x76a7
pop eax
push esi
sub esi, 0xd00d
or esi, 0x14119
call 0x407161
add byte [ebp + 0x4d], al
xor eax, dword ds:[eax + 0x34]
inc ebp
dec ecx
xor dh, byte [edi]
add esp, 4
pop esi
mov ecx, dword [ebp - 0xcbc]
mov dx, word [ecx]
mov word [ebp - 0x103e], dx
mov eax, dword [ebp - 0xcbc]
add eax, 2
mov dword [ebp - 0xcbc], eax
mov cx, word [ebp - 0x103e]
mov word [ebp - 0x21c], cx
mov edx, dword [ebp - 0xcc0]
mov ax, word [edx]
mov word [ebp - 0x1040], ax
mov ecx, dword [ebp - 0xcc0]
add ecx, 2
mov dword [ebp - 0xcc0], ecx
mov dx, word [ebp - 0x1040]
mov word [ebp - 0x38], dx
push ecx
push ebx
add esp, 4
and ecx, 0x7c7f
jmp 0x4071cd
pop ecx
push eax
push ecx
add esp, 4
sub eax, 0xd3e9
pop eax
push esi
push esi
add esp, 4
add esi, 0x88a8
pop esi
push ebx
sub ebx, 0x3d33
pop ebx
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x40720b
movzx ecx, word [ebp - 0x21c]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x1620], ecx
jmp 0x407265
movzx eax, word [ebp - 0x21c]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x407133
movzx edx, word [ebp - 0x21c]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x407133
movzx ecx, word [ebp - 0x21c]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x40724f
mov dword [ebp - 0x161c], 0xffffffff
jmp 0x407259
mov dword [ebp - 0x161c], 1
mov eax, dword [ebp - 0x161c]
mov dword [ebp - 0x1620], eax
cmp dword [ebp - 0x1620], 0
jne 0x4072ae
push edx
or edx, 0x25ed
and edx, 0x1114a
add edx, 0x7469
pop edx
push esi
push esi
add esp, 4
jmp 0x40728e
jmp 0x407294
jmp 0x407299
or esi, 0x11787
pop esi
mov ecx, dword [ebp - 0x514]
mov dword [ebp - 0x2fc], ecx
jmp 0x407316
push edx
sub edx, 0x893d
pop edx
push ebx
add ebx, 0x9adf
jmp 0x4072c6
and ebx, 0xfc2a
call 0x4072dc
add byte [eax], al
push eax
inc esp
add byte [eax], al
push eax
inc esp
inc eax
cmp byte [0x48374837], dh
inc ecx
add esp, 4
pop ebx
mov edx, dword [ebp - 0x514]
mov eax, dword [edx]
mov dword [ebp - 0x514], eax
mov ecx, dword [ebp - 0x514]
cmp ecx, dword [ebp - 0xcc4]
je 0x40730c
mov edx, dword [ebp - 0x514]
cmp dword [edx + 0x30], 0
jne 0x4070d7
mov dword [ebp - 0x2fc], 0
push ebx
call 0x407326
add byte [ecx + 0x47], al
push eax
Function at 0x407161
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push eax
call 0x4070e5
add byte [eax], bh
xor al, byte [esp + ecx*2 + 0x39]
push eax
inc ecx
add esp, 4
xor eax, 0x981
pop eax
push ebx
or ebx, 0xe240
add ebx, 0x5d25
or ebx, 0x3ca4
xor ebx, 0x1354d
pop ebx
lea edx, [ebp - 0x173c]
mov dword [ebp - 0xcc0], edx
mov eax, dword [ebp - 0x514]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcbc], ecx
inc esp
invalid
invalid
push dword [ebx]
shl byte [esi - 0x77], cl
xchg ebp, eax
in al, 0xfd
invalid
push dword [ebx]
shl byte [esi - 0x77], 0x45
invalid
push eax
push esi
add esp, 4
jmp 0x40713d
xor eax, 0x76a7
pop eax
push esi
sub esi, 0xd00d
or esi, 0x14119
call 0x407161
add byte [ebp + 0x4d], al
xor eax, dword ds:[eax + 0x34]
inc ebp
dec ecx
xor dh, byte [edi]
add esp, 4
pop esi
mov ecx, dword [ebp - 0xcbc]
mov dx, word [ecx]
mov word [ebp - 0x103e], dx
mov eax, dword [ebp - 0xcbc]
add eax, 2
mov dword [ebp - 0xcbc], eax
mov cx, word [ebp - 0x103e]
mov word [ebp - 0x21c], cx
mov edx, dword [ebp - 0xcc0]
mov ax, word [edx]
mov word [ebp - 0x1040], ax
mov ecx, dword [ebp - 0xcc0]
add ecx, 2
mov dword [ebp - 0xcc0], ecx
mov dx, word [ebp - 0x1040]
mov word [ebp - 0x38], dx
push ecx
push ebx
add esp, 4
and ecx, 0x7c7f
jmp 0x4071cd
pop ecx
push eax
push ecx
add esp, 4
sub eax, 0xd3e9
pop eax
push esi
push esi
add esp, 4
add esi, 0x88a8
pop esi
push ebx
sub ebx, 0x3d33
pop ebx
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x40720b
movzx ecx, word [ebp - 0x21c]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x1620], ecx
jmp 0x407265
movzx eax, word [ebp - 0x21c]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x407133
movzx edx, word [ebp - 0x21c]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x407133
movzx ecx, word [ebp - 0x21c]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x40724f
mov dword [ebp - 0x161c], 0xffffffff
jmp 0x407259
mov dword [ebp - 0x161c], 1
mov eax, dword [ebp - 0x161c]
mov dword [ebp - 0x1620], eax
cmp dword [ebp - 0x1620], 0
jne 0x4072ae
push edx
or edx, 0x25ed
and edx, 0x1114a
add edx, 0x7469
pop edx
push esi
push esi
add esp, 4
jmp 0x40728e
jmp 0x407294
jmp 0x407299
or esi, 0x11787
pop esi
mov ecx, dword [ebp - 0x514]
mov dword [ebp - 0x2fc], ecx
jmp 0x407316
push edx
sub edx, 0x893d
pop edx
push ebx
add ebx, 0x9adf
jmp 0x4072c6
and ebx, 0xfc2a
call 0x4072dc
add byte [eax], al
push eax
inc esp
add byte [eax], al
push eax
inc esp
inc eax
cmp byte [0x48374837], dh
inc ecx
add esp, 4
pop ebx
mov edx, dword [ebp - 0x514]
mov eax, dword [edx]
mov dword [ebp - 0x514], eax
mov ecx, dword [ebp - 0x514]
cmp ecx, dword [ebp - 0xcc4]
je 0x40730c
mov edx, dword [ebp - 0x514]
cmp dword [edx + 0x30], 0
jne 0x4070d7
mov dword [ebp - 0x2fc], 0
push ebx
call 0x407326
add byte [ecx + 0x47], al
push eax
Function at 0x4072dc
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push eax
call 0x4070e5
add byte [eax], bh
xor al, byte [esp + ecx*2 + 0x39]
push eax
inc ecx
add esp, 4
xor eax, 0x981
pop eax
push ebx
or ebx, 0xe240
add ebx, 0x5d25
or ebx, 0x3ca4
xor ebx, 0x1354d
pop ebx
lea edx, [ebp - 0x173c]
mov dword [ebp - 0xcc0], edx
mov eax, dword [ebp - 0x514]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcbc], ecx
inc esp
invalid
invalid
push dword [ebx]
shl byte [esi - 0x77], cl
xchg ebp, eax
in al, 0xfd
invalid
push dword [ebx]
shl byte [esi - 0x77], 0x45
invalid
push eax
push esi
add esp, 4
jmp 0x40713d
xor eax, 0x76a7
pop eax
push esi
sub esi, 0xd00d
or esi, 0x14119
call 0x407161
add byte [ebp + 0x4d], al
xor eax, dword ds:[eax + 0x34]
inc ebp
dec ecx
xor dh, byte [edi]
add esp, 4
pop esi
mov ecx, dword [ebp - 0xcbc]
mov dx, word [ecx]
mov word [ebp - 0x103e], dx
mov eax, dword [ebp - 0xcbc]
add eax, 2
mov dword [ebp - 0xcbc], eax
mov cx, word [ebp - 0x103e]
mov word [ebp - 0x21c], cx
mov edx, dword [ebp - 0xcc0]
mov ax, word [edx]
mov word [ebp - 0x1040], ax
mov ecx, dword [ebp - 0xcc0]
add ecx, 2
mov dword [ebp - 0xcc0], ecx
mov dx, word [ebp - 0x1040]
mov word [ebp - 0x38], dx
push ecx
push ebx
add esp, 4
and ecx, 0x7c7f
jmp 0x4071cd
pop ecx
push eax
push ecx
add esp, 4
sub eax, 0xd3e9
pop eax
push esi
push esi
add esp, 4
add esi, 0x88a8
pop esi
push ebx
sub ebx, 0x3d33
pop ebx
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x40720b
movzx ecx, word [ebp - 0x21c]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x1620], ecx
jmp 0x407265
movzx eax, word [ebp - 0x21c]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x407133
movzx edx, word [ebp - 0x21c]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x407133
movzx ecx, word [ebp - 0x21c]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x40724f
mov dword [ebp - 0x161c], 0xffffffff
jmp 0x407259
mov dword [ebp - 0x161c], 1
mov eax, dword [ebp - 0x161c]
mov dword [ebp - 0x1620], eax
cmp dword [ebp - 0x1620], 0
jne 0x4072ae
push edx
or edx, 0x25ed
and edx, 0x1114a
add edx, 0x7469
pop edx
push esi
push esi
add esp, 4
jmp 0x40728e
jmp 0x407294
jmp 0x407299
or esi, 0x11787
pop esi
mov ecx, dword [ebp - 0x514]
mov dword [ebp - 0x2fc], ecx
jmp 0x407316
push edx
sub edx, 0x893d
pop edx
push ebx
add ebx, 0x9adf
jmp 0x4072c6
and ebx, 0xfc2a
call 0x4072dc
add byte [eax], al
push eax
inc esp
add byte [eax], al
push eax
inc esp
inc eax
cmp byte [0x48374837], dh
inc ecx
add esp, 4
pop ebx
mov edx, dword [ebp - 0x514]
mov eax, dword [edx]
mov dword [ebp - 0x514], eax
mov ecx, dword [ebp - 0x514]
cmp ecx, dword [ebp - 0xcc4]
je 0x40730c
mov edx, dword [ebp - 0x514]
cmp dword [edx + 0x30], 0
jne 0x4070d7
mov dword [ebp - 0x2fc], 0
push ebx
call 0x407326
add byte [ecx + 0x47], al
push eax
Function at 0x407320
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
dec esi
inc ecx
inc esi
cmp esi, dword [edi]
inc ebp
add esp, 4
add ebx, 0x360a
and ebx, 0xae33
call 0x407344
add byte [eax + 0x37], dl
xor eax, 0x4e4d4c44
cmp byte [ebx], dh
add esp, 4
pop ebx
cmp dword [ebp - 0x2fc], 0
jne 0x407c4d
mov eax, 0x6b
mov word [ebp - 0x1774], ax
mov ecx, 0x65
mov word [ebp - 0x1772], cx
mov edx, 0x72
mov word [ebp - 0x1770], dx
mov eax, 0x6e
mov word [ebp - 0x176e], ax
test dword [edx - 0x46000018], edx
add byte gs:[eax], al
add byte [esi - 0x77], ah
lea edx, [eax + ebp*8 + 0x6cbaffff]
add byte [eax], al
add byte [esi - 0x77], ah
xchg ebp, eax
xchg esi, eax
call 0x33f9739e
add byte [eax], al
add byte [esi - 0x77], ah
test dword [eax - 0x46000018], ebx
xor al, byte [eax]
add byte [eax], al
mov word [ebp - 0x1766], cx
mov edx, 0x2e
mov word [ebp - 0x1764], dx
mov eax, 0x64
mov word [ebp - 0x1762], ax
mov ecx, 0x6c
mov word [ebp - 0x1760], cx
mov edx, 0x6c
mov word [ebp - 0x175e], dx
xor eax, eax
mov word [ebp - 0x175c], ax
push edi
xor edi, 0x12764
or edi, 0x6306
and edi, 0x5026
pop edi
push edx
push ecx
add esp, 4
add edx, 0xde5
call 0x40741c
add byte [esi + esi], bh
inc ebp
inc edi
xor esi, dword [esi]
inc edx
inc edx
add esp, 4
pop edx
mov byte [ebp - 0x8a4], 0x4c
mov byte [ebp - 0x8a3], 0x6f
mov byte [ebp - 0x8a2], 0x61
mov byte [ebp - 0x8a1], 0x64
mov byte [ebp - 0x8a0], 0x4c
mov byte [ebp - 0x89f], 0x69
mov byte [ebp - 0x89e], 0x62
mov byte [ebp - 0x89d], 0x72
mov byte [ebp - 0x89c], 0x61
mov byte [ebp - 0x89b], 0x72
mov byte [ebp - 0x89a], 0x79
invalid
invalid
invalid
Function at 0x407326
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
dec esi
inc ecx
inc esi
cmp esi, dword [edi]
inc ebp
add esp, 4
add ebx, 0x360a
and ebx, 0xae33
call 0x407344
add byte [eax + 0x37], dl
xor eax, 0x4e4d4c44
cmp byte [ebx], dh
add esp, 4
pop ebx
cmp dword [ebp - 0x2fc], 0
jne 0x407c4d
mov eax, 0x6b
mov word [ebp - 0x1774], ax
mov ecx, 0x65
mov word [ebp - 0x1772], cx
mov edx, 0x72
mov word [ebp - 0x1770], dx
mov eax, 0x6e
mov word [ebp - 0x176e], ax
test dword [edx - 0x46000018], edx
add byte gs:[eax], al
add byte [esi - 0x77], ah
lea edx, [eax + ebp*8 + 0x6cbaffff]
add byte [eax], al
add byte [esi - 0x77], ah
xchg ebp, eax
xchg esi, eax
call 0x33f9739e
add byte [eax], al
add byte [esi - 0x77], ah
test dword [eax - 0x46000018], ebx
xor al, byte [eax]
add byte [eax], al
mov word [ebp - 0x1766], cx
mov edx, 0x2e
mov word [ebp - 0x1764], dx
mov eax, 0x64
mov word [ebp - 0x1762], ax
mov ecx, 0x6c
mov word [ebp - 0x1760], cx
mov edx, 0x6c
mov word [ebp - 0x175e], dx
xor eax, eax
mov word [ebp - 0x175c], ax
push edi
xor edi, 0x12764
or edi, 0x6306
and edi, 0x5026
pop edi
push edx
push ecx
add esp, 4
add edx, 0xde5
call 0x40741c
add byte [esi + esi], bh
inc ebp
inc edi
xor esi, dword [esi]
inc edx
inc edx
add esp, 4
pop edx
mov byte [ebp - 0x8a4], 0x4c
mov byte [ebp - 0x8a3], 0x6f
mov byte [ebp - 0x8a2], 0x61
mov byte [ebp - 0x8a1], 0x64
mov byte [ebp - 0x8a0], 0x4c
mov byte [ebp - 0x89f], 0x69
mov byte [ebp - 0x89e], 0x62
mov byte [ebp - 0x89d], 0x72
mov byte [ebp - 0x89c], 0x61
mov byte [ebp - 0x89b], 0x72
mov byte [ebp - 0x89a], 0x79
invalid
invalid
invalid
Function at 0x407344
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
dec esi
inc ecx
inc esi
cmp esi, dword [edi]
inc ebp
add esp, 4
add ebx, 0x360a
and ebx, 0xae33
call 0x407344
add byte [eax + 0x37], dl
xor eax, 0x4e4d4c44
cmp byte [ebx], dh
add esp, 4
pop ebx
cmp dword [ebp - 0x2fc], 0
jne 0x407c4d
mov eax, 0x6b
mov word [ebp - 0x1774], ax
mov ecx, 0x65
mov word [ebp - 0x1772], cx
mov edx, 0x72
mov word [ebp - 0x1770], dx
mov eax, 0x6e
mov word [ebp - 0x176e], ax
test dword [edx - 0x46000018], edx
add byte gs:[eax], al
add byte [esi - 0x77], ah
lea edx, [eax + ebp*8 + 0x6cbaffff]
add byte [eax], al
add byte [esi - 0x77], ah
xchg ebp, eax
xchg esi, eax
call 0x33f9739e
add byte [eax], al
add byte [esi - 0x77], ah
test dword [eax - 0x46000018], ebx
xor al, byte [eax]
add byte [eax], al
mov word [ebp - 0x1766], cx
mov edx, 0x2e
mov word [ebp - 0x1764], dx
mov eax, 0x64
mov word [ebp - 0x1762], ax
mov ecx, 0x6c
mov word [ebp - 0x1760], cx
mov edx, 0x6c
mov word [ebp - 0x175e], dx
xor eax, eax
mov word [ebp - 0x175c], ax
push edi
xor edi, 0x12764
or edi, 0x6306
and edi, 0x5026
pop edi
push edx
push ecx
add esp, 4
add edx, 0xde5
call 0x40741c
add byte [esi + esi], bh
inc ebp
inc edi
xor esi, dword [esi]
inc edx
inc edx
add esp, 4
pop edx
mov byte [ebp - 0x8a4], 0x4c
mov byte [ebp - 0x8a3], 0x6f
mov byte [ebp - 0x8a2], 0x61
mov byte [ebp - 0x8a1], 0x64
mov byte [ebp - 0x8a0], 0x4c
mov byte [ebp - 0x89f], 0x69
mov byte [ebp - 0x89e], 0x62
mov byte [ebp - 0x89d], 0x72
mov byte [ebp - 0x89c], 0x61
mov byte [ebp - 0x89b], 0x72
mov byte [ebp - 0x89a], 0x79
invalid
invalid
invalid

Function at 0x407380
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
test dword [edx - 0x46000018], edx
add byte gs:[eax], al
add byte [esi - 0x77], ah
lea edx, [eax + ebp*8 + 0x6cbaffff]
add byte [eax], al
add byte [esi - 0x77], ah
xchg ebp, eax
xchg esi, eax
call 0x33f9739e
add byte [eax], al
add byte [esi - 0x77], ah
test dword [eax - 0x46000018], ebx
xor al, byte [eax]
add byte [eax], al
call 0x4074c9
add byte [ecx + 0x47], al
xor al, byte [edi + 0x40]
xor ecx, dword [edi + 0x4f]
add esp, 4
pop eax
push edi
add edi, 0x9484
pop edi
cmp dword [ebp - 0x1624], 0
jne 0x4074ed
mov dword [ebp - 0x774], 0
jmp 0x407794
mov edx, dword [ebp - 0x1624]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xcd0], ecx
push eax
push edi
add esp, 4
add eax, 0x10a9d
xor eax, 0x997b
xor eax, 0x1626
pop eax
push eax
add eax, 0x13d0f
or eax, 0x17706
sub eax, 0xd0e8
or eax, 0xfff1
pop eax
cmp dword [ebp - 0xcd0], 0
jne 0x407549
mov dword [ebp - 0x774], 0
jmp 0x407794
mov edx, dword [ebp - 0xcd0]
mov dword [ebp - 0x518], edx
Function at 0x40741c
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
dec esi
inc ecx
inc esi
cmp esi, dword [edi]
inc ebp
add esp, 4
add ebx, 0x360a
and ebx, 0xae33
call 0x407344
add byte [eax + 0x37], dl
xor eax, 0x4e4d4c44
cmp byte [ebx], dh
add esp, 4
pop ebx
cmp dword [ebp - 0x2fc], 0
jne 0x407c4d
mov eax, 0x6b
mov word [ebp - 0x1774], ax
mov ecx, 0x65
mov word [ebp - 0x1772], cx
mov edx, 0x72
mov word [ebp - 0x1770], dx
mov eax, 0x6e
mov word [ebp - 0x176e], ax
test dword [edx - 0x46000018], edx
add byte gs:[eax], al
add byte [esi - 0x77], ah
lea edx, [eax + ebp*8 + 0x6cbaffff]
add byte [eax], al
add byte [esi - 0x77], ah
xchg ebp, eax
xchg esi, eax
call 0x33f9739e
add byte [eax], al
add byte [esi - 0x77], ah
test dword [eax - 0x46000018], ebx
xor al, byte [eax]
add byte [eax], al
mov word [ebp - 0x1766], cx
mov edx, 0x2e
mov word [ebp - 0x1764], dx
mov eax, 0x64
mov word [ebp - 0x1762], ax
mov ecx, 0x6c
mov word [ebp - 0x1760], cx
mov edx, 0x6c
mov word [ebp - 0x175e], dx
xor eax, eax
mov word [ebp - 0x175c], ax
push edi
xor edi, 0x12764
or edi, 0x6306
and edi, 0x5026
pop edi
push edx
push ecx
add esp, 4
add edx, 0xde5
call 0x40741c
add byte [esi + esi], bh
inc ebp
inc edi
xor esi, dword [esi]
inc edx
inc edx
add esp, 4
pop edx
mov byte [ebp - 0x8a4], 0x4c
mov byte [ebp - 0x8a3], 0x6f
mov byte [ebp - 0x8a2], 0x61
mov byte [ebp - 0x8a1], 0x64
mov byte [ebp - 0x8a0], 0x4c
mov byte [ebp - 0x89f], 0x69
mov byte [ebp - 0x89e], 0x62
mov byte [ebp - 0x89d], 0x72
mov byte [ebp - 0x89c], 0x61
mov byte [ebp - 0x89b], 0x72
mov byte [ebp - 0x89a], 0x79
invalid
invalid
invalid

Function at 0x407470
Capabilities:
Resolve function by parsing pe exports

Disassembly:
idiv edi
call dword [edi - 0x3a]
test dword [eax - 9], ebp
invalid

Function at 0x4074c9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test dword [edx - 0x46000018], edx
add byte gs:[eax], al
add byte [esi - 0x77], ah
lea edx, [eax + ebp*8 + 0x6cbaffff]
add byte [eax], al
add byte [esi - 0x77], ah
xchg ebp, eax
xchg esi, eax
call 0x33f9739e
add byte [eax], al
add byte [esi - 0x77], ah
test dword [eax - 0x46000018], ebx
xor al, byte [eax]
add byte [eax], al
call 0x4074c9
add byte [ecx + 0x47], al
xor al, byte [edi + 0x40]
xor ecx, dword [edi + 0x4f]
add esp, 4
pop eax
push edi
add edi, 0x9484
pop edi
cmp dword [ebp - 0x1624], 0
jne 0x4074ed
mov dword [ebp - 0x774], 0
jmp 0x407794
mov edx, dword [ebp - 0x1624]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xcd0], ecx
push eax
push edi
add esp, 4
add eax, 0x10a9d
xor eax, 0x997b
xor eax, 0x1626
pop eax
push eax
add eax, 0x13d0f
or eax, 0x17706
sub eax, 0xd0e8
or eax, 0xfff1
pop eax
cmp dword [ebp - 0xcd0], 0
jne 0x407549
mov dword [ebp - 0x774], 0
jmp 0x407794
mov edx, dword [ebp - 0xcd0]
mov dword [ebp - 0x518], edx
Function at 0x4267e0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push 0xffffffffffffffff
push 0x4f16a2
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x52e028]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x14]
call dword [0x4fff58]
xor ebx, ebx
mov dword [esp + 0x48], ebx
lea ecx, [esp + 0x18]
call dword [0x4fff58]
mov byte [esp + 0x48], 1
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x24]
push eax
call fcn.004289e0
test eax, eax
je 0x426908
push ebx
push 0x5c
lea ecx, [esp + 0x1c]
call dword [0x4ffb80]
cmp eax, 0xffffffff
je 0x426862
mov dword [esp + 0x1c], 2
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov edi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea edx, [esp + 0x34]
push edx
call edi
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x1c]
push ecx
push edx
push eax
call dword [0x4ff50c]
add esp, 0x10
lea ecx, [esp + 0x2c]
push ecx
call edi
mov edx, dword [esp + 0x2c]
sub edx, dword [esp + 0x34]
mov dword [esi + 0x8530], edx
mov eax, dword [esi + 0x8530]
imul eax, eax, 0x3e8
mov dword [esi + 0x8530], eax
mov eax, dword [esi + 0x8530]
mov ecx, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x28]
cdq
push ecx
push edx
push eax
call fcn.004f09c0
mov edx, dword [esi + 0x20]
mov edi, dword [sym.imp.USER32.dll_PostMessageW]
push ebx
push ebx
push 0x858
push edx
mov dword [esi + 0x8530], eax
call edi
mov eax, dword [esi + 0x20]
push ebx
push ebx
push 0x85b
push eax
mov dword [esi + 0x85e0], ebx
mov dword [esi + 0x85e8], ebx
call edi
mov byte [esp + 0x48], bl
lea ecx, [esp + 0x18]
call dword [0x4fff34]
mov dword [esp + 0x48], 0xffffffff
lea ecx, [esp + 0x14]
call dword [0x4fff34]
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x3c
ret

Function at 0x428f10
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4f17e9
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x52e028]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 0x24c]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push 2
push 0xffffffffffffffff
push 0x100c
push eax
call ebx
add eax, 1
je 0x428fc1
mov ecx, dword [edi + 0x24c]
push 2
lea esi, [eax - 1]
push esi
push 0x100c
push ecx
call ebx
cmp esi, 0xffffffff
je 0x428fc1
mov edx, dword [edi + 0x24c]
push 1
push esi
push 0x1013
push edx
call ebx
push 1
push esi
lea eax, [esp + 0x18]
push eax
mov ecx, edi
call fcn.00425960
mov dword [esp + 0x1c], 0
mov eax, dword [esp + 0x10]
cmp dword [eax - 0xc], 0
je 0x428faf
push 1
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [esp + 0x1c], 0xffffffff
lea ecx, [esp + 0x10]
call dword [0x4fff34]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x42dfe0
Capabilities:
Resume thread

Disassembly:
push edi
mov edi, eax
cmp dword [edi + 0x85a0], 0
jne 0x42e08a
mov eax, dword [edi + 0x85cc]
push ebx
push ebp
push esi
push eax
call dword [0x4ff500]
add esp, 4
push 0
push 0
push 4
push 0
push edi
push 0x425260
call fcn.004ef612
mov ebp, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
test esi, esi
je 0x42e04b
push 2
push 0
push 0
lea eax, [edi + 0x85a0]
push eax
call ebx
mov ecx, dword [esi + 0x2c]
push eax
push ecx
call ebx
push eax
call ebp
mov edx, dword [esi + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0
push 0
push 4
push 0
push edi
push 0x426480
call fcn.004ef612
mov esi, eax
test esi, esi
je 0x42e087
push 2
push 0
push 0
add edi, 0x85a4
push edi
call ebx
push eax
mov eax, dword [esi + 0x2c]
push eax
call ebx
push eax
call ebp
mov ecx, dword [esi + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop esi
pop ebp
pop ebx
pop edi
ret
Function at 0x437f00
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x10
push ebx
push ebp
movzx ebp, word [eax]
mov ecx, 0x76c
push edi
cmp bp, cx
jae 0x437f29
mov dword [esi], 0
mov dword [esi + 4], 0
mov eax, esi
pop edi
pop ebp
pop ebx
add esp, 0x10
ret
movzx ecx, word [eax + 0xc]
movzx edx, word [eax + 0xa]
movzx edi, word [eax + 8]
movzx ebx, word [eax + 6]
movzx eax, word [eax + 2]
push eax
movzx eax, bp
push eax
lea eax, [esp + 0x18]
push eax
call fcn.00437e30
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
pop edi
pop ebp
mov dword [esi], ecx
mov dword [esi + 4], edx
mov eax, esi
pop ebx
add esp, 0x10
ret

Function at 0x43d870
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x4f3244
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x52e028]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
cmp dword [esp + 0x2c], 0
je 0x43d995
lea eax, [esp + 0x2c]
push eax
mov ebx, str._systemroot_
call fcn.00403ea0
add esp, 4
mov dword [esp + 0x24], 0
lea ecx, [esp + 0x14]
call dword [0x4fff58]
mov byte [esp + 0x24], 1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebx, dword [0x4ffacc]
mov edi, 1
mov dword [esp + 0x18], eax
lea esi, [edi + 0x40]
lea ebp, [edi + 0x1f]
mov ecx, dword [esp + 0x18]
test ecx, edi
je 0x43d93d
mov edx, dword [esp + 0x2c]
cmp dword [edx - 0xc], 0
je 0x43d907
push 0x501d9c
lea ecx, [esp + 0x30]
call dword [0x4ffad4]
push esi
push esi
lea eax, [esp + 0x1c]
push str._c:_RECYCLE.BIN_c:System_Volume_Information
push eax
call ebx
mov ecx, dword [esp + 0x24]
add esp, 0x10
push 0
push ecx
lea ecx, [esp + 0x34]
call dword [0x4ffadc]
cmp eax, 0xffffffff
jne 0x43d93d
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x30]
call dword [0x4ff9e8]
inc esi
rol edi, 1
sub ebp, 1
jne 0x43d8e6
push ebp
push ecx
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call dword [0x4fff00]
mov byte [esp + 0x2c], 2
mov byte [esp + 0x2c], 1
call fcn.0041ee80
push 4
call dword [0x4ff4e0]
add esp, 0xc
mov byte [esp + 0x24], 0
lea ecx, [esp + 0x14]
call dword [0x4fff34]
mov dword [esp + 0x24], 0xffffffff
lea ecx, [esp + 0x2c]
call dword [0x4fff34]
jmp 0x43d9c9
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x34], esp
push 0x500820
call dword [0x4fff2c]
mov dword [esp + 0x2c], 3
mov dword [esp + 0x2c], 0xffffffff
call fcn.0041ee80
push 0
call dword [0x4ff4e0]
add esp, 0xc
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4