joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406bfc
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
add esp, 4
xor edi, 0x25c
add edi, 0xb
jmp 0x406b03
pop edi
push eax
and eax, 0x21b
jmp 0x406b13
jmp 0x406b1a
pop eax
lea edx, [ebp - 0x1628]
mov dword [ebp - 0xc38], edx
mov eax, dword [ebp - 0x4dc]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc34], ecx
xor edx, edx
mov word [ebp - 0x200], dx
xor eax, eax
mov word [ebp - 0x34], ax
push edx
push ecx
add esp, 4
xor edx, 0xbaeb
xor edx, 0xc6ab
pop edx
push eax
push ebx
add esp, 4
xor eax, 0xc5a4
pop eax
push ecx
push edi
add esp, 4
sub ecx, 0x3074
jmp 0x406b76
pop ecx
mov ecx, dword [ebp - 0xc34]
mov dx, word [ecx]
mov word [ebp - 0xf86], dx
mov eax, dword [ebp - 0xc34]
add eax, 2
mov dword [ebp - 0xc34], eax
mov cx, word [ebp - 0xf86]
mov word [ebp - 0x200], cx
mov edx, dword [ebp - 0xc38]
mov ax, word [edx]
mov word [ebp - 0xf88], ax
mov ecx, dword [ebp - 0xc38]
add ecx, 2
mov dword [ebp - 0xc38], ecx
mov dx, word [ebp - 0xf88]
mov word [ebp - 0x34], dx
push edx
push ebx
add esp, 4
jmp 0x406bd8
call fcn.00406be4
add byte [ebx], dh
xor esi, dword [edx]
cmp al, 0x37
dec edi
add esp, 4
pop edx
push eax
push edi
add esp, 4
add al, 0xe8
or al, byte [eax]
add byte [eax], al
add byte [ecx + 0x3b], cl
dec edi
push eax
cmp ecx, dword [eax + 0x47]
dec edx
dec eax
add esp, 4
pop eax
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x406c1d
movzx ecx, word [ebp - 0x200]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x14fc], ecx
jmp 0x406c77
movzx eax, word [ebp - 0x200]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x406b45
movzx edx, word [ebp - 0x200]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x406b45
movzx ecx, word [ebp - 0x200]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x406c61
mov dword [ebp - 0x14f8], 0xffffffff
jmp 0x406c6b
mov dword [ebp - 0x14f8], 1
mov eax, dword [ebp - 0x14f8]
mov dword [ebp - 0x14fc], eax
cmp dword [ebp - 0x14fc], 0
jne 0x406cc0
push edx
xor edx, 0x12777
call 0x406c97
add byte [ebp + esi + 0x3b], cl
xor al, 0x3e
dec eax
xor eax, 0x833c3432
les eax, [eax + ebp*8]
or dword [eax], eax
add byte [eax], al
add byte [ebx + 0x34], cl
inc esi
cmp al, 0x3d
aas
dec edx
add esp, 4
and edx, 0x9b40
pop edx
mov ecx, dword [ebp - 0x4dc]
invalid
lea esp, [eax]
std
Function at 0x406c97
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
add esp, 4
xor edi, 0x25c
add edi, 0xb
jmp 0x406b03
pop edi
push eax
and eax, 0x21b
jmp 0x406b13
jmp 0x406b1a
pop eax
lea edx, [ebp - 0x1628]
mov dword [ebp - 0xc38], edx
mov eax, dword [ebp - 0x4dc]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc34], ecx
xor edx, edx
mov word [ebp - 0x200], dx
xor eax, eax
mov word [ebp - 0x34], ax
push edx
push ecx
add esp, 4
xor edx, 0xbaeb
xor edx, 0xc6ab
pop edx
push eax
push ebx
add esp, 4
xor eax, 0xc5a4
pop eax
push ecx
push edi
add esp, 4
sub ecx, 0x3074
jmp 0x406b76
pop ecx
mov ecx, dword [ebp - 0xc34]
mov dx, word [ecx]
mov word [ebp - 0xf86], dx
mov eax, dword [ebp - 0xc34]
add eax, 2
mov dword [ebp - 0xc34], eax
mov cx, word [ebp - 0xf86]
mov word [ebp - 0x200], cx
mov edx, dword [ebp - 0xc38]
mov ax, word [edx]
mov word [ebp - 0xf88], ax
mov ecx, dword [ebp - 0xc38]
add ecx, 2
mov dword [ebp - 0xc38], ecx
mov dx, word [ebp - 0xf88]
mov word [ebp - 0x34], dx
push edx
push ebx
add esp, 4
jmp 0x406bd8
call fcn.00406be4
add byte [ebx], dh
xor esi, dword [edx]
cmp al, 0x37
dec edi
add esp, 4
pop edx
push eax
push edi
add esp, 4
add al, 0xe8
or al, byte [eax]
add byte [eax], al
add byte [ecx + 0x3b], cl
dec edi
push eax
cmp ecx, dword [eax + 0x47]
dec edx
dec eax
add esp, 4
pop eax
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x406c1d
movzx ecx, word [ebp - 0x200]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x14fc], ecx
jmp 0x406c77
movzx eax, word [ebp - 0x200]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x406b45
movzx edx, word [ebp - 0x200]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x406b45
movzx ecx, word [ebp - 0x200]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x406c61
mov dword [ebp - 0x14f8], 0xffffffff
jmp 0x406c6b
mov dword [ebp - 0x14f8], 1
mov eax, dword [ebp - 0x14f8]
mov dword [ebp - 0x14fc], eax
cmp dword [ebp - 0x14fc], 0
jne 0x406cc0
push edx
xor edx, 0x12777
call 0x406c97
add byte [ebp + esi + 0x3b], cl
xor al, 0x3e
dec eax
xor eax, 0x833c3432
les eax, [eax + ebp*8]
or dword [eax], eax
add byte [eax], al
add byte [ebx + 0x34], cl
inc esi
cmp al, 0x3d
aas
dec edx
add esp, 4
and edx, 0x9b40
pop edx
mov ecx, dword [ebp - 0x4dc]
invalid
lea esp, [eax]
std
Function at 0x406ca8
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
add esp, 4
xor edi, 0x25c
add edi, 0xb
jmp 0x406b03
pop edi
push eax
and eax, 0x21b
jmp 0x406b13
jmp 0x406b1a
pop eax
lea edx, [ebp - 0x1628]
mov dword [ebp - 0xc38], edx
mov eax, dword [ebp - 0x4dc]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc34], ecx
xor edx, edx
mov word [ebp - 0x200], dx
xor eax, eax
mov word [ebp - 0x34], ax
push edx
push ecx
add esp, 4
xor edx, 0xbaeb
xor edx, 0xc6ab
pop edx
push eax
push ebx
add esp, 4
xor eax, 0xc5a4
pop eax
push ecx
push edi
add esp, 4
sub ecx, 0x3074
jmp 0x406b76
pop ecx
mov ecx, dword [ebp - 0xc34]
mov dx, word [ecx]
mov word [ebp - 0xf86], dx
mov eax, dword [ebp - 0xc34]
add eax, 2
mov dword [ebp - 0xc34], eax
mov cx, word [ebp - 0xf86]
mov word [ebp - 0x200], cx
mov edx, dword [ebp - 0xc38]
mov ax, word [edx]
mov word [ebp - 0xf88], ax
mov ecx, dword [ebp - 0xc38]
add ecx, 2
mov dword [ebp - 0xc38], ecx
mov dx, word [ebp - 0xf88]
mov word [ebp - 0x34], dx
push edx
push ebx
add esp, 4
jmp 0x406bd8
call fcn.00406be4
add byte [ebx], dh
xor esi, dword [edx]
cmp al, 0x37
dec edi
add esp, 4
pop edx
push eax
push edi
add esp, 4
add al, 0xe8
or al, byte [eax]
add byte [eax], al
add byte [ecx + 0x3b], cl
dec edi
push eax
cmp ecx, dword [eax + 0x47]
dec edx
dec eax
add esp, 4
pop eax
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x406c1d
movzx ecx, word [ebp - 0x200]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x14fc], ecx
jmp 0x406c77
movzx eax, word [ebp - 0x200]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x406b45
movzx edx, word [ebp - 0x200]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x406b45
movzx ecx, word [ebp - 0x200]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x406c61
mov dword [ebp - 0x14f8], 0xffffffff
jmp 0x406c6b
mov dword [ebp - 0x14f8], 1
mov eax, dword [ebp - 0x14f8]
mov dword [ebp - 0x14fc], eax
cmp dword [ebp - 0x14fc], 0
jne 0x406cc0
push edx
xor edx, 0x12777
call 0x406c97
add byte [ebp + esi + 0x3b], cl
xor al, 0x3e
dec eax
xor eax, 0x833c3432
les eax, [eax + ebp*8]
or dword [eax], eax
add byte [eax], al
add byte [ebx + 0x34], cl
inc esi
cmp al, 0x3d
aas
dec edx
add esp, 4
and edx, 0x9b40
pop edx
mov ecx, dword [ebp - 0x4dc]
invalid
lea esp, [eax]
std
Function at 0x406d30
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
sub byte [ecx], al
add byte [ecx + 0x6050e9], al
add al, ch
or dword [eax], eax
add byte [eax], al
add byte [edi + ecx*2 + 0x3c], cl
dec esp
dec ebp
cmp eax, dword [ecx + 0x37]
add esp, 4
call 0x406d56
add byte [edi], bh
inc esp
inc ebp
dec esp
inc ecx
add esp, 4
pop ecx
mov eax, dword [ebp - 0x2e0]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x2fc], ecx
push esi
push esi
add esp, 4
jmp 0x406d76
xor esi, 0xb19e
jmp 0x406d85
pop esi
push esi
push esi
add esp, 4
call 0x406d97
add byte [edx + 0x3a], cl
xor al, 0x3b
xor al, 0x41
add esp, 4
pop esi
mov dword [ebp - 0x70c], 0
mov edx, dword [ebp - 0x2fc]
mov dword [ebp - 0x1500], edx
cmp dword [ebp - 0x1500], 0
jne 0x406dcb
mov eax, dword [ebp - 0x70c]
mov dword [ebp - 0x4e0], eax
jmp 0x4070bc
mov ecx, dword [ebp - 0x1500]
mov edx, dword [ebp - 0x2fc]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x1504], edx
jne 0x406df3
mov eax, dword [ebp - 0x70c]
mov dword [ebp - 0x4e0], eax
jmp 0x4070bc
mov ecx, 8
imul edx, ecx, 0
mov eax, dword [ebp - 0x1504]
mov ecx, dword [eax + edx + 0x78]
mov dword [ebp - 0x1508], ecx
cmp dword [ebp - 0x1508], 0
jne 0x406e25
mov edx, dword [ebp - 0x70c]
mov dword [ebp - 0x4e0], edx
jmp 0x4070bc
mov eax, dword [ebp - 0x2fc]
add eax, dword [ebp - 0x1508]
mov dword [ebp - 0x700], eax
jne 0x406e4a
mov ecx, dword [ebp - 0x70c]
mov dword [ebp - 0x4e0], ecx
jmp 0x4070bc
mov edx, dword [ebp - 0x700]
mov eax, dword [ebp - 0x2fc]
add eax, dword [edx + 0x20]
mov dword [ebp - 0x18c0], eax
mov ecx, dword [ebp - 0x700]
mov edx, dword [ebp - 0x2fc]
add edx, dword [ecx + 0x24]
mov dword [ebp - 0x18c4], edx
mov eax, dword [ebp - 0x700]
mov ecx, dword [ebp - 0x2fc]
add ecx, dword [eax + 0x1c]
mov dword [ebp - 0x18c8], ecx
mov dword [ebp - 0x704], 0
jmp 0x406ea4
Function at 0x406d47
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
sub byte [ecx], al
add byte [ecx + 0x6050e9], al
add al, ch
or dword [eax], eax
add byte [eax], al
add byte [edi + ecx*2 + 0x3c], cl
dec esp
dec ebp
cmp eax, dword [ecx + 0x37]
add esp, 4
call 0x406d56
add byte [edi], bh
inc esp
inc ebp
dec esp
inc ecx
add esp, 4
pop ecx
mov eax, dword [ebp - 0x2e0]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x2fc], ecx
push esi
push esi
add esp, 4
jmp 0x406d76
xor esi, 0xb19e
jmp 0x406d85
pop esi
push esi
push esi
add esp, 4
call 0x406d97
add byte [edx + 0x3a], cl
xor al, 0x3b
xor al, 0x41
add esp, 4
pop esi
mov dword [ebp - 0x70c], 0
mov edx, dword [ebp - 0x2fc]
mov dword [ebp - 0x1500], edx
cmp dword [ebp - 0x1500], 0
jne 0x406dcb
mov eax, dword [ebp - 0x70c]
mov dword [ebp - 0x4e0], eax
jmp 0x4070bc
mov ecx, dword [ebp - 0x1500]
mov edx, dword [ebp - 0x2fc]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x1504], edx
jne 0x406df3
mov eax, dword [ebp - 0x70c]
mov dword [ebp - 0x4e0], eax
jmp 0x4070bc
mov ecx, 8
imul edx, ecx, 0
mov eax, dword [ebp - 0x1504]
mov ecx, dword [eax + edx + 0x78]
mov dword [ebp - 0x1508], ecx
cmp dword [ebp - 0x1508], 0
jne 0x406e25
mov edx, dword [ebp - 0x70c]
mov dword [ebp - 0x4e0], edx
jmp 0x4070bc
mov eax, dword [ebp - 0x2fc]
add eax, dword [ebp - 0x1508]
mov dword [ebp - 0x700], eax
jne 0x406e4a
mov ecx, dword [ebp - 0x70c]
mov dword [ebp - 0x4e0], ecx
jmp 0x4070bc
mov edx, dword [ebp - 0x700]
mov eax, dword [ebp - 0x2fc]
add eax, dword [edx + 0x20]
mov dword [ebp - 0x18c0], eax
mov ecx, dword [ebp - 0x700]
mov edx, dword [ebp - 0x2fc]
add edx, dword [ecx + 0x24]
mov dword [ebp - 0x18c4], edx
mov eax, dword [ebp - 0x700]
mov ecx, dword [ebp - 0x2fc]
add ecx, dword [eax + 0x1c]
mov dword [ebp - 0x18c8], ecx
mov dword [ebp - 0x704], 0
jmp 0x406ea4
Function at 0x406d56
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
sub byte [ecx], al
add byte [ecx + 0x6050e9], al
add al, ch
or dword [eax], eax
add byte [eax], al
add byte [edi + ecx*2 + 0x3c], cl
dec esp
dec ebp
cmp eax, dword [ecx + 0x37]
add esp, 4
call 0x406d56
add byte [edi], bh
inc esp
inc ebp
dec esp
inc ecx
add esp, 4
pop ecx
mov eax, dword [ebp - 0x2e0]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x2fc], ecx
push esi
push esi
add esp, 4
jmp 0x406d76
xor esi, 0xb19e
jmp 0x406d85
pop esi
push esi
push esi
add esp, 4
call 0x406d97
add byte [edx + 0x3a], cl
xor al, 0x3b
xor al, 0x41
add esp, 4
pop esi
mov dword [ebp - 0x70c], 0
mov edx, dword [ebp - 0x2fc]
mov dword [ebp - 0x1500], edx
cmp dword [ebp - 0x1500], 0
jne 0x406dcb
mov eax, dword [ebp - 0x70c]
mov dword [ebp - 0x4e0], eax
jmp 0x4070bc
mov ecx, dword [ebp - 0x1500]
mov edx, dword [ebp - 0x2fc]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x1504], edx
jne 0x406df3
mov eax, dword [ebp - 0x70c]
mov dword [ebp - 0x4e0], eax
jmp 0x4070bc
mov ecx, 8
imul edx, ecx, 0
mov eax, dword [ebp - 0x1504]
mov ecx, dword [eax + edx + 0x78]
mov dword [ebp - 0x1508], ecx
cmp dword [ebp - 0x1508], 0
jne 0x406e25
mov edx, dword [ebp - 0x70c]
mov dword [ebp - 0x4e0], edx
jmp 0x4070bc
mov eax, dword [ebp - 0x2fc]
add eax, dword [ebp - 0x1508]
mov dword [ebp - 0x700], eax
jne 0x406e4a
mov ecx, dword [ebp - 0x70c]
mov dword [ebp - 0x4e0], ecx
jmp 0x4070bc
mov edx, dword [ebp - 0x700]
mov eax, dword [ebp - 0x2fc]
add eax, dword [edx + 0x20]
mov dword [ebp - 0x18c0], eax
mov ecx, dword [ebp - 0x700]
mov edx, dword [ebp - 0x2fc]
add edx, dword [ecx + 0x24]
mov dword [ebp - 0x18c4], edx
mov eax, dword [ebp - 0x700]
mov ecx, dword [ebp - 0x2fc]
add ecx, dword [eax + 0x1c]
mov dword [ebp - 0x18c8], ecx
mov dword [ebp - 0x704], 0
jmp 0x406ea4
Function at 0x406d97
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
sub byte [ecx], al
add byte [ecx + 0x6050e9], al
add al, ch
or dword [eax], eax
add byte [eax], al
add byte [edi + ecx*2 + 0x3c], cl
dec esp
dec ebp
cmp eax, dword [ecx + 0x37]
add esp, 4
call 0x406d56
add byte [edi], bh
inc esp
inc ebp
dec esp
inc ecx
add esp, 4
pop ecx
mov eax, dword [ebp - 0x2e0]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x2fc], ecx
push esi
push esi
add esp, 4
jmp 0x406d76
xor esi, 0xb19e
jmp 0x406d85
pop esi
push esi
push esi
add esp, 4
call 0x406d97
add byte [edx + 0x3a], cl
xor al, 0x3b
xor al, 0x41
add esp, 4
pop esi
mov dword [ebp - 0x70c], 0
mov edx, dword [ebp - 0x2fc]
mov dword [ebp - 0x1500], edx
cmp dword [ebp - 0x1500], 0
jne 0x406dcb
mov eax, dword [ebp - 0x70c]
mov dword [ebp - 0x4e0], eax
jmp 0x4070bc
mov ecx, dword [ebp - 0x1500]
mov edx, dword [ebp - 0x2fc]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x1504], edx
jne 0x406df3
mov eax, dword [ebp - 0x70c]
mov dword [ebp - 0x4e0], eax
jmp 0x4070bc
mov ecx, 8
imul edx, ecx, 0
mov eax, dword [ebp - 0x1504]
mov ecx, dword [eax + edx + 0x78]
mov dword [ebp - 0x1508], ecx
cmp dword [ebp - 0x1508], 0
jne 0x406e25
mov edx, dword [ebp - 0x70c]
mov dword [ebp - 0x4e0], edx
jmp 0x4070bc
mov eax, dword [ebp - 0x2fc]
add eax, dword [ebp - 0x1508]
mov dword [ebp - 0x700], eax
jne 0x406e4a
mov ecx, dword [ebp - 0x70c]
mov dword [ebp - 0x4e0], ecx
jmp 0x4070bc
mov edx, dword [ebp - 0x700]
mov eax, dword [ebp - 0x2fc]
add eax, dword [edx + 0x20]
mov dword [ebp - 0x18c0], eax
mov ecx, dword [ebp - 0x700]
mov edx, dword [ebp - 0x2fc]
add edx, dword [ecx + 0x24]
mov dword [ebp - 0x18c4], edx
mov eax, dword [ebp - 0x700]
mov ecx, dword [ebp - 0x2fc]
add ecx, dword [eax + 0x1c]
mov dword [ebp - 0x18c8], ecx
mov dword [ebp - 0x704], 0
jmp 0x406ea4
Function at 0x406eb8
Capabilities:
Get number of processors

Disassembly:
add byte [ebx - 0x7036b], cl
dec dword [ebx - 0x18bf7b]
dec dword [ebx - 0x2fb73]
inc dword [ebx]
or al, 0x90
Function at 0x4071ec
Capabilities:
Get number of processors

Disassembly:
mov byte [ebp - 0x381], cl
mov edx, dword [ebp - 0xa5c]
sub edx, dword [ebp - 0x3cc]
mov dword [ebp - 0x158c], edx
je 0x4071d8
invalid
inc edi
test dword [eax + 0xfffff3], edx
add byte [eax], al
add byte [edi + 0x52], dl
add esp, 4
add edi, 0x1143f
sub edi, 0x13f78
xor edi, 0x253
pop edi
push esi
add esi, 0xc8e2
call 0x407228
add byte [eax + 0x36], cl
dec edi
xor esi, dword [edi]
dec esp
cmp byte [ecx + 0x4b], al
add esp, 4
pop esi
mov byte [ebp - 0x960], 0x56
mov byte [ebp - 0x95f], 0x69
mov byte [ebp - 0x95e], 0x72
mov byte [ebp - 0x95d], 0x74
mov byte [ebp - 0x95c], 0x75
mov byte [ebp - 0x95b], 0x61
mov byte [ebp - 0x95a], 0x6c
mov byte [ebp - 0x959], 0x50
mov byte [ebp - 0x958], 0x72
mov byte [ebp - 0x957], 0x6f
mov byte [ebp - 0x956], 0x74
mov byte [ebp - 0x955], 0x65
mov byte [ebp - 0x954], 0x63
invalid
jmp dword [ebx - 0x3a]
test dword [ebp + 0x74fffff6], ebp
mov byte [ebp - 0x952], 0
scasb al, byte es:[edi]
idiv bh
inc dword [eax]
je 0x4071d8
invalid

Function at 0x407228
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
mov byte [ebp - 0x381], cl
mov edx, dword [ebp - 0xa5c]
sub edx, dword [ebp - 0x3cc]
mov dword [ebp - 0x158c], edx
je 0x4071d8
invalid
inc edi
test dword [eax + 0xfffff3], edx
add byte [eax], al
add byte [edi + 0x52], dl
add esp, 4
add edi, 0x1143f
sub edi, 0x13f78
xor edi, 0x253
pop edi
push esi
add esi, 0xc8e2
call 0x407228
add byte [eax + 0x36], cl
dec edi
xor esi, dword [edi]
dec esp
cmp byte [ecx + 0x4b], al
add esp, 4
pop esi
mov byte [ebp - 0x960], 0x56
mov byte [ebp - 0x95f], 0x69
mov byte [ebp - 0x95e], 0x72
mov byte [ebp - 0x95d], 0x74
mov byte [ebp - 0x95c], 0x75
mov byte [ebp - 0x95b], 0x61
mov byte [ebp - 0x95a], 0x6c
mov byte [ebp - 0x959], 0x50
mov byte [ebp - 0x958], 0x72
mov byte [ebp - 0x957], 0x6f
mov byte [ebp - 0x956], 0x74
mov byte [ebp - 0x955], 0x65
mov byte [ebp - 0x954], 0x63
invalid
jmp dword [ebx - 0x3a]
test dword [ebp + 0x74fffff6], ebp
mov byte [ebp - 0x952], 0
scasb al, byte es:[edi]
idiv bh
inc dword [eax]
je 0x4071d8
invalid
Function at 0x407290
Capabilities:
Get number of processors

Disassembly:
scasb al, byte es:[edi]
idiv bh
inc dword [eax]
push ecx
push edi
add esp, 4
xor ecx, 0x5168
sub ecx, 0x1471
pop ecx
push ebx
push edi
add esp, 4
and ebx, 0xdbd6
add ebx, 0x6f88
or ebx, 0x41f2
pop ebx
push edi
xor edi, 0x5c27
pop edi
mov eax, dword fs:[0x18]
mov dword [ebp - 0x1c34], eax
mov ecx, dword [ebp - 0x1c34]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x18d4], edx
invalid
dec dword [ebx - 0x18d37b]
dec dword [ecx - 0x150b7b]
call dword [edi - 0x7f]
iretd
mov word [ebx + 1], ds
add byte [ecx + 0x97e6e7], al
add byte [edi + 0x50], bl
push eax
add esp, 4
xor eax, 0x7a31
pop eax
push esi
push esi
add esp, 4
xor esi, 0x15fd2
sub esi, 0x28eb
and esi, 0x3c78
pop esi
cmp dword [ebp - 0x150c], 0
jne 0x407338
mov dword [ebp - 0x2a8], 0
jmp 0x4075df
mov ecx, dword [ebp - 0x150c]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xc4c], eax
push ecx
push edi
add esp, 4
sub ecx, 0xcebf
jmp 0x40735a
pop ecx
push edx
jmp 0x407363
or edx, 0x3b61
add edx, 0xb846
pop edx
push ecx
push eax
add esp, 4
jmp 0x40737b
pop ecx
cmp dword [ebp - 0xc4c], 0
jne 0x407394
mov dword [ebp - 0x2a8], 0
jmp 0x4075df
mov ecx, dword [ebp - 0xc4c]
mov dword [ebp - 0x4e4], ecx
Function at 0x40766c
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
mov dword [ebp - 0x16dc], eax
mov dword [ebp - 0x710], 0
jmp 0x407a5d
mov edx, dword [ebp - 0x1518]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc58], ecx
push edx
push ecx
add esp, 4
xor edx, 0x724d
jmp 0x4077d9
invalid
call 0x4077e5
add byte [edi + 0x47], cl
xor al, 0x37
cmp cl, byte [ebx + eax*4 - 0x3c]
add al, 0xe8
or dword [eax], eax
add byte [eax], al
add byte [ebx + 0x47], al
inc edx
cmp dword [eax], edi
cmp al, 0x40
add esp, 4
add al, 0x5a
cmp dword [ebp - 0xc58], 0
jne 0x407812
mov dword [ebp - 0x710], 0
jmp 0x407a5d
mov edx, dword [ebp - 0xc58]
mov dword [ebp - 0x4e8], edx
push edx
call 0x40782c
add byte [0x44364246], bh
inc eax
inc esp
add esp, 4
or edx, 0x6906
add edx, 0x13311
pop edx
push ecx
add ecx, 0xbc1
pop ecx
push eax
push ecx
add esp, 4
xor eax, 0x8dbc
pop eax
lea eax, [ebp - 0x16e8]
mov dword [ebp - 0xc54], eax
mov ecx, dword [ebp - 0x4e8]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc50], edx
xor eax, eax
mov word [ebp - 0x208], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
push eax
call 0x407888
add byte [ebp + 0x4c], al
xor eax, dword [eax + 0x4b]
inc esp
push eax
add esp, 4
jmp 0x407890
call 0x4078a0
add byte [eax + 0x41], al
dec edx
cmp byte [edi], dh
push eax
cmp byte [edi + ecx*2], bh
add esp, 4
pop eax
push esi
sub esi, 0x4156
pop esi
mov edx, dword [ebp - 0xc50]
mov ax, word [edx]
mov word [ebp - 0xf8e], ax
mov ecx, dword [ebp - 0xc50]
add ecx, 2
mov dword [ebp - 0xc50], ecx
mov dx, word [ebp - 0xf8e]
invalid
invalid
xchg ebp, eax
clc
std
invalid

Function at 0x407690
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
mov dword [ebp - 0x16d6], eax
mov ecx, 0x6c
mov word [ebp - 0x16d4], cx
mov edx, 0x6c
mov word [ebp - 0x16d2], dx
xor eax, eax
mov word [ebp - 0x16d0], ax
jmp 0x529176b8
add esp, 4
sub eax, 0x464d
pop eax
push esi
push esi
add esp, 4
and esi, 0x2366
add esi, 0x16de7
out 0x6d, eax
add dword [eax], eax

Function at 0x4076d0
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
out 0x6d, eax
add dword [eax], eax
and esi, 0x68bd
pop esi
push eax
or eax, 0x10ba4
or eax, 0x65df
pop eax
mov byte [ebp - 0x830], 0x4c
mov byte [ebp - 0x82f], 0x6f
mov byte [ebp - 0x82e], 0x61
mov byte [ebp - 0x82d], 0x64
mov byte [ebp - 0x82c], 0x4c
mov byte [ebp - 0x82b], 0x69
mov byte [ebp - 0x82a], 0x62
mov byte [ebp - 0x829], 0x72
mov byte [ebp - 0x828], 0x61
mov byte [ebp - 0x827], 0x72
mov byte [ebp - 0x826], 0x79
mov byte [ebp - 0x825], 0x57
mov byte [ebp - 0x824], 0
mov ecx, dword fs:[0x18]
invalid
lea ebp, [eax]
out 0xff, eax
Function at 0x407f3f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [eax], 0x57525900
add esp, 4
and edx, 0xfb1
sub edx, 0x179b8
pop edx
mov ecx, dword [ebp - 0x3c8]
mov dword [ebp - 0x18f0], ecx
push esi
or esi, 0xb1aa
jmp 0x407e96
or esi, 0x1f5f
and esi, 0xda50
pop esi
push ebx
call 0x407eb4
add byte [edx], dh
cmp eax, 0x35454b4c
dec eax
xor eax, 0xc4834843
add al, 0x5b
mov edx, dword [ebp - 0x18f0]
mov dword [ebp - 0x18f4], edx
lea eax, [ebp - 0x1628]
push eax
call dword [ebp - 0x18f4]
test eax, eax
jne 0x407f16
push edi
and edi, 0xf50d
add edi, 0x89b5
and edi, 0x48a3
or edi, 0x1537c
pop edi
push edx
push edx
add esp, 4
or edx, 0x4bce
and edx, 0x1796d
and edx, 0xf67d
pop edx
mov dword [ebp - 0xa58], 0
jmp 0x408601
push edi
call 0x407f26
add byte [ebx + 0x36], cl
xor al, 0x45
inc ebx
inc ecx
cmp dword [ecx + 0x42], eax
add esp, 4
or edi, 0x1e85
call 0x407f3f
add byte [edx], dh
dec esi
cmp dword [edi + 0x41], eax
cmp al, 0x4d
cmp eax, dword [edi + eax*2 - 0x7d]
les eax, [ebx + ebp*8]
add ecx, dword [eax + 0x3d]
inc edx
pop edi
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x18f8], ecx
mov edx, dword [ebp - 0x18f8]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x18fc], eax
mov ecx, dword [ebp - 0x18fc]
mov dword [ebp - 0x1574], ecx
push edx
push esi
add esp, 4
jmp 0x407f7a
call 0x407f89
add byte [edi + 0x3a], cl
cmp ecx, dword [esi + 0x41]
inc edx
aas
inc eax
push eax
add esp, 4
xor edx, 0x2187
call 0x407f9e
add byte [ebx], dh
inc ebp
dec esp
cmp cl, byte [ecx + 0x3c]
add esp, 4
pop edx
cmp dword [ebp - 0x1574], 0
jne 0x407fba
mov dword [ebp - 0x2a8], 0
jmp 0x408261
mov edx, dword [ebp - 0x1574]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc68], ecx
push eax
and eax, 0x10d50
pop eax
push edx
push esi
add esp, 4
sub edx, 0xcff1
pop edx
push eax
call 0x407fee
add byte [ecx + 0x40], al
aaa
dec ecx
inc ebp
cmp eax, dword [ebx - 0x1f7efb3c]
in eax, 0x62
add byte [eax], al
jmp 0x407ffd
pop eax
cmp dword [ebp - 0xc68], 0
jne 0x408016
mov dword [ebp - 0x2a8], 0
jmp 0x408261
mov edx, dword [ebp - 0xc68]
mov dword [ebp - 0x4ec], edx
push ebx
push ebx