joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408337
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x423b88
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x42c2b8]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push esi
mov eax, dword [0x42c2b8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
lea eax, [edi + 0x30]
lea esi, [esp + 0xc]
call fcn.004050d0
and dword [esp + 0x38], 0
push 0x426b5c
mov eax, esi
push eax
call fcn.004045ad
push 0xffffffffffffffff
push 0
lea eax, [edi + 0x184]
call fcn.0040488f
push 0x426b70
mov eax, esi
push eax
call fcn.004045ad
push 0xffffffffffffffff
lea eax, [edi + 0xbc]
push eax
xor ebx, ebx
mov eax, esi
call fcn.004047f0
mov eax, esi
push eax
call fcn.0040cc9c
pop ecx
mov eax, esi
push eax
push 0x8c
call fcn.0040841f
test al, al
je 0x4083e0
push 1
mov edx, esi
mov ecx, edi
call fcn.00408524
jmp 0x4083f5
push 0
push 0x426a14
push 0x426b88
push dword [edi + 4]
call dword [fcn.004242d4]
push 0
push 1
lea esi, [esp + 0x14]
call fcn.00404711
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0040ebb9
mov esp, ebp
pop ebp
ret

Function at 0x40a5a4
Capabilities:
Write file on windows

Disassembly:
push 0x54
mov eax, 0x422f6a
call fcn.0041315d
mov edi, ecx
cmp dword [edi + 0x3c], 0
mov dword [ebp - 0x38], edi
je 0x40a6b4
cmp byte [edi + 0x41], 0
je 0x40a6b4
mov eax, dword [edi]
push 0xffffffffffffffff
call dword [eax + 4]
cmp eax, 0xffffffff
jne 0x40a5dc
xor al, al
jmp 0x40a6b6
lea esi, [ebp - 0x30]
call fcn.00409df3
and dword [ebp - 4], 0
lea eax, [edi + 0x44]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x48]
lea ecx, [ebp - 0x30]
call fcn.00409e6f
mov esi, eax
call fcn.0040a741
mov ebx, eax
add ebx, dword [ebp - 0x40]
lea eax, [ebp - 0x60]
lea ecx, [ebp - 0x30]
call fcn.00409e6f
mov esi, eax
call fcn.0040a741
mov ecx, dword [edi + 0x3c]
mov edx, dword [ecx]
lea esi, [ebp - 0x34]
push esi
push ebx
push eax
push dword [ebp - 0x3c]
call dword [edx + 0x18]
sub eax, 0
je 0x40a64c
dec eax
je 0x40a650
dec eax
dec eax
je 0x40a6b0
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.00406107
mov al, bl
jmp 0x40a6b6
mov byte [edi + 0x41], 0
lea eax, [ebp - 0x58]
lea ecx, [ebp - 0x30]
call fcn.00409e6f
mov esi, eax
call fcn.0040a741
mov ebx, dword [ebp - 0x34]
sub ebx, eax
je 0x40a68e
push dword [edi + 0x4c]
lea eax, [ebp - 0x50]
push ebx
push 1
lea ecx, [ebp - 0x30]
call fcn.00409e6f
mov esi, eax
call fcn.0040a741
push eax
call fcn.00410021
add esp, 0x10
cmp ebx, eax
jne 0x40a63a
cmp byte [edi + 0x41], 0
je 0x40a6b0
test ebx, ebx
jne 0x40a5ee
push ebx
push 8
pop ebx
lea edi, [ebp - 0x30]
call fcn.00409e2b
mov edi, dword [ebp - 0x38]
jmp 0x40a5ee
mov bl, 1
jmp 0x40a63c
mov al, 1
call fcn.004131e0
ret
Function at 0x40ca0d
Capabilities:
Create thread

Disassembly:
push 4
mov eax, 0x422e4d
call fcn.004130f4
mov esi, ecx
mov eax, dword [esi + 8]
xor ebx, ebx
cmp eax, ebx
jne 0x40ca2b
xor al, al
jmp 0x40cabe
lea edi, [eax + 0x20]
cmp edi, ebx
mov dword [ebp - 0x10], edi
je 0x40ca3c
mov eax, edi
call fcn.0040c636
mov dword [ebp - 4], ebx
mov eax, dword [esi + 8]
cmp dword [eax + 4], ebx
jne 0x40ca54
cmp edi, ebx
je 0x40ca24
mov eax, edi
call fcn.0040c644
jmp 0x40ca24
mov eax, esi
call fcn.0040ca03
mov eax, dword [esi + 8]
add eax, 0xc
push eax
push 4
push esi
push 0x4099be
push ebx
push ebx
call fcn.0040efe4
mov ecx, dword [esi + 8]
mov dword [ecx + 0x10], eax
mov eax, dword [esi + 8]
add esp, 0x18
cmp dword [eax + 0x10], ebx
jne 0x40ca91
call fcn.0040ca08
mov esi, dword [esi + 8]
call fcn.0040c919
jmp 0x40ca47
mov byte [eax + 8], 1
mov eax, dword [esi + 8]
add eax, 0x24
call fcn.0040d86d
mov eax, dword [esi + 8]
push dword [eax + 0x10]
call dword [0x424098]
cmp eax, 0xffffffff
je 0x40ca82
cmp edi, ebx
je 0x40cabc
mov eax, edi
call fcn.0040c644
mov al, 1
call fcn.004131cc
ret
Function at 0x435f82
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x4280a4], 0
jne 0x435fc0
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x435f96
mov dword [ecx*4 + 0x4280a0], eax
inc ecx
cmp ecx, 0x100
jl 0x435f91
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x435fed
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x4280a0]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x435fce
not eax
pop ebp
ret 0xc

Function at 0x436ab6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
xor eax, eax
and edx, 7
cmp ecx, 5
jae 0x436acf
leave
ret
add dword [ebp + 0x10], 5
or dword [ebp + 0xc], 0xffffffff
push ebx
push esi
mov esi, dword [ebp + 8]
lea ecx, [esi + ecx - 4]
push edi
mov dword [ebp - 4], ecx
lea edi, [eax + esi]
jmp 0x436af2
mov al, byte [edi]
and al, 0xfe
cmp al, 0xe8
je 0x436af7
inc edi
cmp edi, dword [ebp - 4]
jb 0x436ae9
mov eax, edi
sub eax, esi
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 4]
jae 0x436bef
mov ecx, eax
sub ecx, dword [ebp + 0xc]
cmp ecx, 3
jbe 0x436b4e
xor edx, edx
mov cl, byte [edi + 4]
mov dword [ebp + 0xc], eax
test cl, cl
je 0x436b22
cmp cl, 0xff
jne 0x436b79
movzx esi, cl
movzx ecx, byte [edi + 3]
shl esi, 8
or esi, ecx
movzx ecx, byte [edi + 2]
shl esi, 8
or esi, ecx
movzx ecx, byte [edi + 1]
shl esi, 8
or esi, ecx
cmp dword [ebp + 0x18], 0
je 0x436b87
lea ebx, [esi + eax]
add ebx, dword [ebp + 0x10]
jmp 0x436b8e
dec ecx
shl edx, cl
and edx, 7
je 0x436b13
movzx ecx, byte [edx + 0x408a00]
mov ebx, edi
sub ebx, ecx
cmp byte [edx + 0x4089f8], 0
mov cl, byte [ebx + 4]
je 0x436b76
test cl, cl
je 0x436b76
cmp cl, 0xff
jne 0x436b13
mov dword [ebp + 0xc], eax
and edx, 3
add edx, edx
or edx, 1
inc eax
jmp 0x436ae4
sub esi, eax
sub esi, dword [ebp + 0x10]
mov ebx, esi
test edx, edx
je 0x436bc2
movzx esi, byte [edx + 0x408a00]
push 0x18
shl esi, 3
pop ecx
sub ecx, esi
mov eax, ebx
shr eax, cl
test al, al
je 0x436bad
cmp al, 0xff
jne 0x436bbf
mov eax, dword [ebp - 8]
push 0x20
pop ecx
sub ecx, esi
xor esi, esi
inc esi
shl esi, cl
dec esi
xor esi, ebx
jmp 0x436b40
mov eax, dword [ebp - 8]
mov esi, dword [ebp + 8]
mov ecx, ebx
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [edi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [edi + 3], cl
mov ecx, ebx
shr ecx, 8
mov byte [edi + 2], cl
mov byte [edi + 1], bl
add eax, 5
jmp 0x436ae4
mov esi, eax
sub esi, dword [ebp + 0xc]
push 3
lea ecx, [esi - 1]
shl edx, cl
pop edi
and edx, 7
cmp edi, esi
sbb ecx, ecx
not ecx
pop edi
and ecx, edx
mov edx, dword [ebp + 0x14]
pop esi
mov dword [edx], ecx
pop ebx
leave
ret
Function at 0x93b57c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
inc eax
add byte [edi + 0x76], cl
mov edx, 0x6fea00fc
outsd dx, dword [esi]
jg 0x93b473
jmp [edx + 0x1a]
or al, 0x66
add dword [ebp - 4], edx
add dl, ch
in al, 0x7f
mov edi, 0x753f7aff
or eax, 0xc68a007a
cdq
jbe 0x93b4e1
mov al, byte [0xf73d36a1]
push dword [esi + eax*8 - 0x15]
imul byte [edx + 0x74a91374]
je 0x93b4a9
jmp 0x93b4db
mov dl, byte [esp + ecx*8]
aas
cdq
jbe 0x93b4ea
lea eax, [ebp + 0x18]
push eax
je 0x93b4b1
sbb byte [eax], cl
daa
in al, 0x3f
invalid
mov edi, 0x8a3f7aff
or al, 0x7c
sub bl, 1
je 0x93b54c
jl 0x93b4c5
jmp 0x93b547
int3
add byte [ebp + 0x18], dh
int3
stosb byte es:[edi], al
je 0x93b592
push ecx
push ecx
je 0x93b535
idiv dword [edx + ebx*4 + 3]
jmp dword [esi - 0x7d]
cmp dword [eax], edi
mov edx, 0xfffffe07
call [ebx + 0x75]
push es
inc ecx
inc ecx
or dword [ebp - 8], 0
cdq
jl 0x93b5df
xor byte [ebp + 0x27], dh
inc ecx
inc ecx
movzx edx, word [ecx]
cmp dx, 0x30
jb 0x93b5c0
cmp dx, 0x37
ja 0x93b5c0
push 8
pop eax
push 0x37
pop ebx
movzx edx, dx
and edx, 0xffffffdf
cmp edx, 0x58
jne 0x93b5d0
push 0x10
inc ecx
pop eax
inc ecx
movzx edx, word [ecx]
inc ecx
inc ecx
cmp edx, 0x30
jl 0x93b5e6
movzx esi, bx
cmp edx, esi
jg 0x93b5e6
sub edx, 0x30
jmp 0x93b601
cdq
jl 0x93b5f0
adc byte [ebp + 0x23], dh
mov esi, edx
and esi, 0xffffffdf
cmp esi, 0x41
jl 0x93b60f
fild word [ebx + 0x197c41fe]
cmp esi, 0x46
jg 0x93b60f
and edx, 7
add edx, 9
movzx esi, ax
imul esi, dword [ebp - 4]
add esi, edx
mov dword [edx - 0x743e14fd], ecx
inc ebp
clc
mov eax, dword [ebp - 8]
imul eax, dword [ebp - 4]
mov eax, dword [0xfb3d36a4]
invalid
Function at 0xd2a84d
Capabilities:
Check for software breakpoints

Disassembly:
lea eax, [ecx + eax*4]
ret
je 0xd2a844
and al, 0xe3
push eax
push ecx
push ebp
push edi
mov ecx, 0xffff0001
pop ss
in eax, 0xe7
add byte [eax], al
cmp dword [ebx], 0x10
add edi, 0x1c
jbe 0xd2a791
mul dword [eax + 0x3b7c5b5d]
or al, 0xc2
add al, 0
je 0xd2a89a
or byte [ebx], bh
fisttp word [ecx - 0x1a90e806]
add dword [eax], eax
push edi
push esi
push ebp
lea edx, [esp - 0x1d]
lodsd eax, dword [esi]
je 0xd2a7f6
call fcn.00d2ad1d
mov al, byte [0x3b7c5b5d]
or al, 0xc2
add al, 0
int3
int3
je 0xd2a808
add al, 0x85
sal byte [ecx + ecx + 0x50], 0xe8
mov edi, 0x8300fe13
cmp edi, ebx
mov dword [esi + 4], 0
mov dword [esi + 8], 0
cmp byte [ecx + 0xf3], bh
add bl, al
int3
dec ebx
or ah, dl
aaa
cmp ecx, edi
jae 0xd2a8eb
mov esi, dword [ebx + 8]
cmp eax, esi
mov edx, edi
pop ss
call 0x8bd2aa94
dec ebx
add al, 0x85
leave
jne 0xd2a899
xor eax, eax
push esi
sub edi, eax
push ebx
test al, 0x8d
inc esp
and al, 0x20
mov ecx, ebx
call fcn.00d2ae9d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
cmp al, 0x8b
inc ebx
or byte [ebx], ch
rcl dword [esi + 0x2b], 0xf8
push ebx
test al, 0x8d
inc esp
and al, 0x20
mov ecx, ebx
call fcn.00d2ae9d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
cmp al, 0x85
sal byte [esp + eax*2 - 0x75], 0x6b
or byte [ebx + 0x3b37d4cd], cl
stc
test eax, eax
je 0xd2a933
mov ebp, dword [ebx + 8]
mov ecx, ebp
aam 0x37
cmp edi, ecx
jae 0xd2a933
cmp eax, ebp
mov edx, edi
pop ss
xchg edx, eax
out 1, al
add byte [ebx + 0x733b0473], cl
or byte [ecx + 0x198517fa], cl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
cmp al, 0xcc
int3
Function at 0xd2ae9d
Capabilities:
Check for software breakpoints

Disassembly:
push eax
push esi
call 0x1d19e02
cmp dword [ebx], 0x10
mov dword [ebx + 8], edi
mov edi, dword [esp - 0x15]
mov dword [ebp], edi
pop edi
mov dword [ebp + 4], esi
pop esi
mov eax, ebp
pop ebp
ret 0xff14
sub esp, 0xfffffff7
push ebx
mov ebx, ecx
mov cl, byte [eax]
mov eax, dword [ebx + 4]
test eax, eax
push ebp
push esi
push edi
mov byte [esp - 0x15], cl
jne 0xd2aeb7
xor ecx, ecx
jmp 0xd2aebc
mov ecx, dword [ebx + 0xc]
sub ecx, eax
je 0xd2ae41
fninit
test edi, edi
je 0x1d1b077
test eax, eax
jne 0xd2aed0
xor edx, edx
jmp 0xd2aed5
mov edx, dword [ebx + 8]
sub edx, eax
or esi, 0xffffffff
sub esi, edx
cmp esi, edi
jae 0xd2aee3
call 0x1d1b9bd
test eax, eax
jne 0xd2aeeb
xor edx, edx
jmp 0xd2aef0
mov edx, dword [ebx + 8]
sub edx, eax
add edx, edi
cmp ecx, edx
jae 0xd3ae30
mov edx, ecx
shr edx, 1
or esi, 0xffffffff
sub esi, edx
cmp esi, ecx
jae 0xd2af15
mov dword [esp + 0x10], 0xff00
je 0xd2af5d
and al, 0x10
jmp 0xd2af1b
add ecx, edx
mov dword [esp + 0x10], ecx
test eax, eax
jne 0xd2af23
xor edx, edx
jmp 0xd2af28
mov edx, dword [ebx + 8]
sub edx, eax
add edx, edi
cmp ecx, edx
jae 0xd2af41
test eax, eax
jne 0xd2af36
xor ecx, ecx
jmp 0xd2af3b
mov ecx, dword [ebx + 8]
aam 0x37
add ecx, edi
mov dword [esp + 0x10], ecx
call fcn.00d3a53d
mov ecx, dword [ebx + 4]
mov ebp, eax
je 0xd2af91
and al, 0xdb
sub eax, ecx
lea esi, [eax + ebp]
je 0xd2af62
push eax
push ecx
push eax
push ebp
call fcn.00d4a002
add dword [eax], eax
add esp, 0x10
push esi
mov ecx, dword [ebx - 0x7c7220dc]
invalid
add eax, 0x2b08438b
rol dword [ebx], 0xf0
test ecx, ecx
je 0xd2afa6
push ecx
call fcn.00d3bc19
add esp, 4
je 0xd2affc
and al, 0x10
lea eax, [edx + ebp]
lea ecx, [esi + ebp]
mov dword [ebx + 0xc], eax
mov dword [ebx + 8], ecx
mov dword [ebx + 4], ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
add dword [ebx + 8], eax
mov ebx, dword [ebx + 8]
sub ebx, eax
cmp ebp, ebx
je 0xd2b077
je 0xd2b04e
and al, 0xeb
sub ebx, ebp
push ebx
push eax
push ebp
call 0x1d1935d
cmp dword [ebx], 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
sar byte [esi + 0xe], 0x50
push ebp
push eax
sub esi, eax
push esi
call fcn.00d3bf02
add esp, 0x10
lea eax, [edi + ebp]
cmp ebp, eax
je 0xd2b077
je 0xd2b0b4
and al, 0xeb
sub eax, ebp
push eax
push ecx
push ebp
call 0x1d0cc5d
cmp dword [ebx], 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
inc dword [ebx + 0x95083b]
push 0
mov esi, dword [ecx]
mov byte [esp + 0x68], 5
call fcn.00d2aa3d
mov byte [esp + 0x60], bl
invalid

Function at 0xd2b3fd
Capabilities:
Check for software breakpoints

Disassembly:
je 0xd2b455
sbb byte [ebx + 0x555308fa], al
mov ebp, dword [esp + 0x10]
push edi
lea ebx, [esi + 4]
jb 0xd2b413
mov ecx, dword [ebx]
jmp 0xd2b415
mov ecx, ebx
mov eax, dword [esp + 0x10]
cmp eax, ecx
jb 0xd2b44e
cli

Function at 0xd2b4cd
Capabilities:
Check for software breakpoints

Disassembly:
sub esp, 0xfffffff7
cmp dword [esi + 0x14], ebx
push edi
mov edi, eax
jae 0xd2b4dd
call fcn.00d3b6f6
mov eax, dword [esi + 0x14]
sub eax, ebx
cmp eax, edi
jae 0xd2b4e8
Function at 0xd2f367
Capabilities:
Get number of processors

Disassembly:
add byte [esi - 0x3e], bl
sbb byte [eax], al
cmp eax, 0x111
jne 0xd2f3d5
mov eax, dword [esp + 0x10]
cmp ax, 0x9c42
jne 0xd2f384
mov eax, dword [esi + 4]
push 5
push eax
add dl, ch
and ebp, dword [0x4e8bffbd]
mov ecx, dword [esi + 4]
push ecx
mov ecx, dword [esi + 4]
push ecx
add dl, ch
je 0xd2f341
inc edx
add byte [ebx - 0x38e724ac], cl
std
add byte [eax], al
add byte [eax], al
mov eax, 1
pop esi
ret 0x18
cmp ax, 0x3ea
jne 0xd2f39e
call 0xffd2f90d
je 0xd2f3dd
and al, 0x18
mov dword [ecx], eax
mov eax, 1
pop esi
ret 0x18
cmp ax, 2
jne 0xd2f3b8
call fcn.00d2f95d
mov ebp, dword [ebx + 0x2891824]
mov eax, 1
pop esi
ret 0x18
cmp ax, 1
jne 0xd2f445
mov eax, dword [esp + 0x18]
mov dword [eax], 0
mov eax, 1
pop esi
ret 0x18
cmp eax, 0xfb64
jne 0xd2f40c
je 0xd2f432
push esp
and al, 0x10
mov ecx, dword [esi + 0x18]
mov eax, dword [esp + 0x14]
push edx
mov dword [ecx + 0x20], 0xffff0001
pop ss
sub dword [eax], edx
add bh, bh
je 0xd2f442
and al, 0x18
mov dword [ecx], eax
je 0xd2f452
sbb byte [ebx + 0x7400207a], al
inc edx
mov eax, 1
pop esi
ret 0x18
cmp eax, 0x113
jne 0xd2f445
cmp dword [esp + 0x10], 0xfa1
mov eax, dword [esi + 0x18]
mov dword [eax + 0x20], 0xffff0001
jne 0xd2f42e
mov eax, esi
call 0xffd3049d
je 0xd2f47c
and al, 0x18
mov dword [ecx], 0
mov edx, dword [esi + 0x18]
cmp dword [edx + 0x20], 0
jne 0xd1f622
add edi, edi
push dword [ebx]
rcr byte [esi - 0x3e], 0x18
add ah, cl
int3
xor eax, eax
pop esi
ret 0x18
inc edx
add byte [ecx], ah
add byte [eax], al
add byte [eax + 0x53], dl
push esi
push edi
mov eax, dword [0x4351b0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword [edi + 0x18], ebx
Function at 0xd2f452
Capabilities:
Get number of processors

Disassembly:
add byte [esi - 0x3e], bl
sbb byte [eax], al
cmp eax, 0x111
jne 0xd2f3d5
mov eax, dword [esp + 0x10]
cmp ax, 0x9c42
jne 0xd2f384
mov eax, dword [esi + 4]
push 5
push eax
add dl, ch
and ebp, dword [0x4e8bffbd]
mov ecx, dword [esi + 4]
push ecx
mov ecx, dword [esi + 4]
push ecx
add dl, ch
je 0xd2f341
inc edx
add byte [ebx - 0x38e724ac], cl
std
add byte [eax], al
add byte [eax], al
mov eax, 1
pop esi
ret 0x18
cmp ax, 0x3ea
jne 0xd2f39e
call 0xffd2f90d
je 0xd2f3dd
and al, 0x18
mov dword [ecx], eax
mov eax, 1
pop esi
ret 0x18
cmp ax, 2
jne 0xd2f3b8
call fcn.00d2f95d
mov ebp, dword [ebx + 0x2891824]
mov eax, 1
pop esi
ret 0x18
cmp ax, 1
jne 0xd2f445
mov eax, dword [esp + 0x18]
mov dword [eax], 0
mov eax, 1
pop esi
ret 0x18
cmp eax, 0xfb64
jne 0xd2f40c
je 0xd2f432
push esp
and al, 0x10
mov ecx, dword [esi + 0x18]
mov eax, dword [esp + 0x14]
push edx
mov dword [ecx + 0x20], 0xffff0001
pop ss
sub dword [eax], edx
add bh, bh
je 0xd2f442
and al, 0x18
mov dword [ecx], eax
je 0xd2f452
sbb byte [ebx + 0x7400207a], al
inc edx
mov eax, 1
pop esi
ret 0x18
cmp eax, 0x113
jne 0xd2f445
cmp dword [esp + 0x10], 0xfa1
mov eax, dword [esi + 0x18]
mov dword [eax + 0x20], 0xffff0001
jne 0xd2f42e
mov eax, esi
call 0xffd3049d
je 0xd2f47c
and al, 0x18
mov dword [ecx], 0
mov edx, dword [esi + 0x18]
cmp dword [edx + 0x20], 0
jne 0xd1f622
add edi, edi
push dword [ebx]
rcr byte [esi - 0x3e], 0x18
add ah, cl
int3
xor eax, eax
pop esi
ret 0x18
inc edx
add byte [ecx], ah
add byte [eax], al
add byte [eax + 0x53], dl
push esi
push edi
mov eax, dword [0x4351b0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword [edi + 0x18], ebx

Function at 0xd3028d
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x42b9d8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4351b0]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebp
push esi
push edi
mov eax, dword [0x4351b0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, dword [ebx + 0x30]
xor edi, edi
cmp eax, edi
je 0xd302dc
lea ecx, [ebx + 0x24]
mov dword [eax], ecx
mov ecx, dword [ebx + 0x30]
call fcn.00d3d1cd
jnp 0xd30315
jne 0xd302e3
mov byte [ebx + 0x2d], 1
xor al, al
jmp 0xd303f5
mov eax, dword [ebx + 4]
mov esi, dword [0x42d290]
push 0x3eb
push eax
call esi
push edi
push 0x64
push 0x402
push eax
call dword [0x42d2a4]
mov ecx, dword [ebx + 4]
push edi
push ecx
add dl, ch
and ebp, dword [0x538bffbd]
add al, 0x68
in eax, dx
add eax, dword [eax]
add byte [edx - 1], dl
salc
push edi
push eax
call dword [0xffbd2d6c]
push 0xb
push 0x430180
lea esi, [esp + 0x18]
mov dword [esp + 0x30], 0xfff8
mov dword [ebx - 0x76662cdc], eax
and dword [esp + ebx], 0xffffffe8
mov ebx, 0x76ffffb0
sbb ebx, 0xffffffc7
cmp dword [esp + 0x28], 8
mov eax, dword [esp + 0x14]
invalid
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call 0x1d2c093
add esp, 0x2c
ret
Function at 0xd30eed
Capabilities:
Check for software breakpoints

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
mov ecx, dword [ebp + 4]
test ecx, ecx
push esi
push edi
mov edi, eax
jne 0xd30f03
xor eax, eax
jmp 0xd30f08
mov eax, dword [ebp - 9]
sub eax, ecx
mov esi, dword [edi]
lea ecx, [esi + 1]
cmp ecx, eax
ja 0xd40e5c
dec esi
add dword [ebx], edi
enter 0xffffffffffff870f, 0x47
inc dword [eax]
add byte [ecx + 0x44d8b0f], cl
mov dword [edi], ecx
mov ecx, dword [ebp + 4]
test ecx, ecx
je 0xd30f27
mov eax, dword [ebp - 9]
sub eax, ecx
cmp esi, eax
jb 0xd30f2c
call fcn.00d3c295
mov eax, dword [ebp + 4]
cmp byte [esi + eax], 3
jne 0xd40ea4
lea ecx, [esp + 0x18]
scasb al, byte es:[edi]
mov esi, ebp
mov dword [esp - 0x1d], 0xff
call fcn.00d30d1d
cmp dword [ebx], 0xfffffffb
jnp 0xd30f91
mov edi, dword [ecx - 0x75]
dec ebp
add al, 0x85
leave
jne 0xd30f5f
xor eax, eax
jmp 0xd30f64
mov eax, dword [ebp - 9]
sub eax, ecx
mov edx, dword [edi]
je 0xd30f0b
fistp dword [eax]
add edx, ebx
cmp edx, eax
ja 0xd30fcd
mov ecx, dword [ebx + 0x4e741c24]
add al, 0x85
leave
jne 0xd30f7f
xor eax, eax
jmp 0xd30f84
mov edi, dword [ecx + 0x3c12bf7]
ret
add eax, ebx
push eax
call 0x1d23a5d
test ebx, ebx
jle 0xd30fc5
mov dword [esp + 0x18], ebx
pop esp
and al, 0x18
mov esi, dword [edi]
lea eax, [esi + 1]
mov dword [edi], eax
mov ecx, dword [ebp + 4]
test ecx, ecx
je 0xd30fab
mov eax, dword [ebp - 9]
sub eax, ecx
cmp esi, eax
jb 0xd30fb0
call fcn.00d3c295
mov ebx, dword [ebp + 4]
add ebx, esi
mov ecx, dword [ebx + 0x4fe81c24]
sub eax, dword [eax]
add byte [ebx + 0x118246c], al
jne 0xd30f94
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
cmp al, 0xcc
int3
div dword [edx - 0xf]
pop edi
pop esi
ret
adc eax, 0x422e08
int3
Function at 0xd3cc5d
Capabilities:
Check for software breakpoints

Disassembly:
call 0x1d30779
test eax, eax
or byte [eax], 0x6a
or eax, ebp
xor eax, 0x59000026
push ebx
call fcn.00d3f2fa
daa
add byte [eax], al
pop ecx
test eax, eax
je 0xd3cbad
scasd eax, dword es:[edi]
call fcn.00d3f1de
pop ecx
call 0x1d3071c
test byte [ebp - 0x44], bl
je 0xd3cbcc
movzx ecx, word [ebp - 0x40]
jmp 0xd3cbcf
shr bl, 3
push 0xa
pop ecx
push ecx
push eax
push 0
push 0x400000
call fcn.00d2a2dd
jbe 0xd3cb99
sbb edi, dword [ebp + edi*2 - 0x20]
add byte [ebp + 6], dh
push eax
call 0x1d3a36e
call 0x1d3a390
jmp 0xd3cc21
mov eax, dword [ebp - 0x2c]
jbe 0xd3cbc9
sbb edi, dword [ebp + edi*2 - 0x20]
add byte [ebp + 6], dh
push eax
call 0x1d3a37f
call fcn.00d3f49f
mov dword [ebp + 3], 0xfffffffe
mov eax, dword [ebp - 0x1c]
jmp 0xd3cc40
call int.00d3e2ca
ret
je 0xd3cc0a
fcomi st(3)
je 0xd3ccaf
and al, 4
test edx, edx
je 0xd3ccd2
xor eax, eax
mov al, byte [esp + 8]
test al, al
jne 0xd3cc89
cmp edx, 0xff000100
jb 0xd3cc89
cmp dword [0xbc8b48], 0
je 0xd3cc89
jmp fcn.00d40f4d
test al, 0x74
stc
cmp edx, 4
jb 0xd3ccc2
neg ecx
and ecx, 3
je 0xd3cca4
sub edx, ecx
mov al, bh
jl 0xd3ccd6
add dword [ebx - 0x98afe17], eax
mov ecx, eax
shl eax, 8
add eax, ecx
mov ecx, eax
shl eax, 0x10
add eax, ecx
mov ecx, edx
and edx, 3
shr ecx, 2
je 0xd3ccc2
adc byte [ebx], al
ror dword [ebx + 0x3e283ca], 0xc1
jmp 0xf3da40bf
rep stosd dword es:[edi], eax
test edx, edx
je 0xd3cccc
mov al, bh
jl 0xd3ccfe
add dword [ebx - 0x98afe16], eax
mov eax, dword [esp + 8]
pop edi
ret
je 0xd3cc8f
invalid
cmp al, 0xcc
int3
add byte [edx - 0x5c], dh
and al, 0
add byte [eax], al
add byte [ebp + 0x24a4], cl
add byte [eax], al
mov eax, dword [ecx]
mov edx, 0x7efefeff
add edx, eax
xor eax, 0xffffffff
xor eax, edx
add ecx, 4
test eax, 0x81010100
je 0xd3cd0d
mov eax, dword [ecx - 4]
test al, al
je 0xd3cd5e
test ah, ah
je 0xd3cd54
test eax, 0xff0000
je 0xd3cd4a
test eax, 0
mov eax, dword [edx]
jmp 0xd3cd0d
lea eax, [ecx - 2]
mov ecx, dword [esp + 4]
sub eax, ecx
ret
lea eax, [ecx - 3]
mov ecx, dword [esp + 4]
sub eax, ecx
ret
lea eax, [ecx - 4]
mov ecx, dword [esp + 4]
sub eax, ecx
ret

Function at 0xd3d130
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov bh, 0xd1
sub eax, ebx
jp 0xd3d121
mov ecx, dword [esp + 0x10]
je 0xd3d115
adc byte [ebx + ebx + 0xf], dh
mov bh, 0x11
movzx edx, word [ecx]
jp 0xd3d12d
je 0xd3d12c
movzx ebx, word [eax + ecx]
movzx edx, dx
sub ebx, edx
jne 0xd3d115
inc ecx
inc ecx
cmp word [eax + ecx], bx
jne 0xd3d0fa
cmp word [ecx], 0
je 0xd3d12c
inc edi
inc edi
movzx edx, word [edi]
inc eax
inc eax
cdq
jp 0xd3d0f7
jne 0xd3d0f1
xor edi, dword [edi]
mov al, byte [0xc78b3ca4]
mov eax, edi
invalid
jmp 0xd3d129
je 0xd3d0ed
invalid