joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5826d5
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.00582651
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x582844
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x582844
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x5827f9
jg 0x582731
test eax, eax
je 0x5827ef
push 1
push 0x1000
call fcn.0057262c
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x582754
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x5827e6
push 0x8000
push ebx
call fcn.005704fc
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x58277d
jg 0x582778
cmp ecx, 0x1000
jb 0x58277d
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.0057789d
add esp, 0x10
cmp eax, 0xffffffff
je 0x5827c2
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x582778
jl 0x5827a9
test ecx, ecx
jne 0x58276a
push dword [ebp - 0xc]
push ebx
call fcn.005704fc
push esi
call fcn.00572689
add esp, 0xc
xor ebx, ebx
jmp 0x582852
cmp byte [edi + 0x24], 0
je 0x5827d9
cmp dword [edi + 0x20], 5
jne 0x5827d9
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x5827e4
mov ebx, dword [edi + 0x18]
jmp 0x5827e6
xor ebx, ebx
push esi
call fcn.00572689
pop ecx
jmp 0x582852
test ecx, ecx
jg 0x5827bb
jl 0x5827f9
test eax, eax
jae 0x5827bb
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.005786a1
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x582819
cmp byte [edi + 0x1c], 0
je 0x5827bb
jmp 0x58284a
push ebx
call fcn.005754b3
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x5827bb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x582852
cmp byte [edi + 0x1c], 0
je 0x58284f
mov ebx, dword [edi + 0x18]
jmp 0x582852
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.005786a1
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43200c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x432030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43201e
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x401080
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x13c
mov eax, dword [0x404008]
xor eax, esp
mov dword [esp + 0x138], eax
push esi
lea eax, [esp + 8]
mov dword [esp + 4], 0
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionOpenWith
xorps xmm0, xmm0
mov dword [esp + 0x18], 0
push reloc.OLEAUT32.dll_SysReAllocString
movaps xmmword [esp + 0x34], xmm0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401191
mov esi, dword [esp + 8]
test esi, esi
je 0x401191
push pe_nt_image_headers32
push eax
lea eax, [esp + 0x40]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0x1c], pe_nt_image_headers32
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 0x403224
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x401191
lea ecx, [esp + 0x38]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401130
sub ecx, edx
sar ecx, 1
cmp ecx, 0x26
jne 0x401191
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
test eax, eax
js 0x401191
lea eax, [esp + 4]
mov dword [esp + 0xc], 0x6a283fe2
push eax
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 0x4599ecfa
push eax
push 4
push 0
lea eax, [esp + 0x30]
mov dword [esp + 0x24], 0x9e8c491
push eax
mov dword [esp + 0x2c], 0x267b1357
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ecx, dword [esp + 0x13c]
mov eax, dword [esp + 4]
pop esi
xor ecx, esp
call fcn.004012f0
mov esp, ebp
pop ebp
ret

Function at 0x4011b0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push 2
push 0
mov dword [ebp - 4], eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
call fcn.00401080
mov ebx, eax
push 0
push ebx
call dword [sym.imp.ole32.dll_CoAllowSetForegroundWindow]
push str..pdf
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
test esi, esi
je 0x401232
mov edi, dword [ebx]
push 4
push esi
push dword [ebp - 4]
mov edi, dword [edi + 0xc]
mov ecx, edi
push ebx
call dword [0x403110]
call edi
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebx]
push ebx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x403110]
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x8007000e
call fcn.00401030
int3

Function at 0x710c71
Capabilities:
Encode data using xor

Disassembly:
push 0x7109ec
pop eax
sub edi, 0x220550a1
mov edx, edi
call fcn.00710ca2
inc edx
add edx, edi
xor dword [esi], eax
add edi, 0x5f4757c1
or edx, edx
inc esi
inc edx
and edi, edx
cmp esi, ebx
jne fcn.00710c71
dec edi
ret
Function at 0x100059e0
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10009018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
push ebx
push 4
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
test esi, esi
je 0x10005a51
lea eax, [ebp - 0x20]
push eax
push esi
mov dword [ebp - 0x20], 0x1c
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x10005a51
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Thread32Next]
cmp dword [ebp - 0x14], ebx
je 0x10005a36
lea ecx, [ebp - 0x20]
push ecx
push esi
call edi
test eax, eax
jne 0x10005a26
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x18]
push edx
push 1
push 0x1a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [0x10fa9a74], eax
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.10005bba
mov esp, ebp
pop ebp
ret

Function at 0x10005bba
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10009018]
jne 0x10005bc4
repz ret
jmp fcn.100060d1

Function at 0x43b653
Capabilities:
Encode data using xor

Disassembly:
push 0x43b3c1
pop esi
mov edi, ebx
call fcn.0043b68c
sub edi, 1
sub edi, 0x7c5d8dda
inc ebx
xor dword [eax], esi
mov ebx, 0x72a034cb
add eax, 1
and edi, edi
inc edi
sub ebx, edi
cmp eax, edx
jne fcn.0043b653
add ebx, 0x5b7a12fe
ret
Function at 0x180fb6c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x181b520]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.01806e52
and dword [ebp - 0x14], 0
cmp dword [0x185d558], 0
mov dword [ebp - 0x18], eax
jne 0x180fc1f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x180fcc7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x180fcc7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x185d558], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x185d55c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x185d560], eax
call edi
push eax
call esi
mov dword [0x185d568], eax
test eax, eax
je 0x180fc1f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x185d564], eax
mov eax, dword [0x185d564]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x180fc78
cmp dword [0x185d568], ecx
je 0x180fc78
push eax
call esi
push dword [0x185d568]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x180fc78
test ebx, ebx
je 0x180fc78
call edi
test eax, eax
je 0x180fc6f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x180fc6f
test byte [ebp - 8], 1
jne 0x180fc78
or dword [ebp + 0x10], 0x200000
jmp 0x180fcab
mov eax, dword [0x185d55c]
cmp eax, dword [ebp - 0x18]
je 0x180fcab
push eax
call esi
test eax, eax
je 0x180fcab
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x180fcab
mov eax, dword [0x185d560]
cmp eax, dword [ebp - 0x18]
je 0x180fcab
push eax
call esi
test eax, eax
je 0x180fcab
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x185d558]
call esi
test eax, eax
je 0x180fcc7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x180fcc9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.018013cb
leave
ret

Function at 0x408934
Capabilities:
Encode data using xor

Disassembly:
push 0x4085d8
mov ecx, dword [esp]
add esp, 4
call fcn.0040895c
xor dword [edx], ecx
inc edx
add edi, 0x5ded153
push 0x19c3f321
pop edi
cmp edx, eax
jne fcn.00408934
add edi, edi
and edi, esi
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..reloc
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, 0xe235158
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
mov eax, str.O_W
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x5b0f22cf
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x401cb0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x407044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40703c]
sub esp, 4
test ebx, ebx
je 0x401cfb
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401cf4
test esi, esi
je 0x401cf4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401cd0
mov dword [esp], 0x407044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x401ee0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x401f30
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x402008
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x401f6e
cmp eax, 4
jne 0x401f90
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x401f7e
cmp edx, 4
je 0x401f7e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00401ee0
Function at 0x10155c17
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x102bb2c8]
jne 0x10155c21
repz ret
jmp fcn.1015b459

Function at 0x1015bc3f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10155cba
and dword [ebp - 4], 0
cmp dword [0x102bcb28], 0
mov ebx, eax
jne 0x1015bcf0
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1015bda1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1015bda1
push eax
call fcn.10155c48
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x102bcb28], eax
call esi
push eax
call fcn.10155c48
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x102bcb2c], eax
call esi
push eax
call fcn.10155c48
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x102bcb30], eax
call esi
push eax
call fcn.10155c48
pop ecx
mov dword [0x102bcb38], eax
test eax, eax
je 0x1015bcf0
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10155c48
pop ecx
mov dword [0x102bcb34], eax
mov eax, dword [0x102bcb34]
cmp eax, ebx
je 0x1015bd48
cmp dword [0x102bcb38], ebx
je 0x1015bd48
push eax
call fcn.10155cc3
push dword [0x102bcb38]
mov esi, eax
call fcn.10155cc3
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1015bd48
test edi, edi
je 0x1015bd48
call esi
test eax, eax
je 0x1015bd3f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1015bd3f
test byte [ebp - 0xc], 1
jne 0x1015bd48
or dword [ebp + 0x10], 0x200000
jmp 0x1015bd81
mov eax, dword [0x102bcb2c]
cmp eax, ebx
je 0x1015bd81
push eax
call fcn.10155cc3
pop ecx
test eax, eax
je 0x1015bd81
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1015bd81
mov eax, dword [0x102bcb30]
cmp eax, ebx
je 0x1015bd81
push eax
call fcn.10155cc3
pop ecx
test eax, eax
je 0x1015bd81
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x102bcb28]
call fcn.10155cc3
pop ecx
test eax, eax
je 0x1015bda1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1015bda3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x101672f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [0x102bad4c], 0
mov dword [0x102bad50], 0
mov dword [0x102bad5c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
mov dword [0x102bad44], 0x145d
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x10]
jae 0x10167477
mov eax, 0x100
mov ecx, dword [0x102bad44]
add ecx, 0x21fe
mov dword [0x102bad44], ecx
mov ecx, dword [0x102bad4c]
add ecx, 1
mov dword [ebp - 0x28], eax
mov eax, ecx
cdq
mov ecx, dword [ebp - 0x28]
idiv ecx
mov dword [0x102bad4c], edx
mov edx, dword [0x102bad44]
add edx, 0xf93
mov dword [0x102bad48], edx
mov edx, dword [0x102bad50]
mov esi, dword [0x102bad4c]
mov edi, dword [ebp - 0x1c]
movzx esi, byte [edi + esi]
add edx, esi
mov eax, edx
cdq
idiv ecx
mov dword [0x102bad50], edx
mov edx, dword [0x102bad4c]
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + edx]
mov byte [0x102bad54], bl
mov edx, dword [0x102bad50]
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + edx]
mov edx, dword [0x102bad4c]
mov esi, dword [ebp - 0x1c]
mov byte [esi + edx], bl
mov dword [0x102bad48], 0x2b4
mov bl, byte [0x102bad54]
mov edx, dword [0x102bad50]
mov esi, dword [ebp - 0x1c]
mov byte [esi + edx], bl
mov edx, dword [0x102bad4c]
mov esi, dword [ebp - 0x1c]
movzx edx, byte [esi + edx]
mov esi, dword [0x102bad50]
mov edi, dword [ebp - 0x1c]
movzx esi, byte [edi + esi]
add edx, esi
mov dword [ebp - 0x20], edx
mov dword [0x102bad48], 0xdf3
mov edx, dword [ebp - 0x20]
mov eax, edx
cdq
idiv ecx
mov dword [0x102bad5c], edx
mov edx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
mov esi, dword [0x102bad5c]
mov edi, dword [ebp - 0x1c]
movzx esi, byte [edi + esi]
xor edx, esi
mov bl, dl
mov edx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x18]
mov byte [esi + edx], bl
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0x24], eax
jmp 0x1016734e
mov dword [0x102bad48], 0x2692
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10167490
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [0x102bad44], 0x1c6a
mov dword [ebp - 8], 0
mov dword [0x102bad48], 0x2f2
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [0x102bad44], 0xb29
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x3c]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], 0
jmp 0x101675a8
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x101675a8
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x16]
cmp eax, 0x61
je 0x101675de
jmp 0x101675a6
mov dword [ebp - 4], 1
jmp 0x10167619
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov dx, word [eax + ecx*2 - 0x18]
mov word [ebp - 0x16], dx
mov ax, word [ebp - 0x16]
movzx ecx, ax
cmp ecx, 0x6f
je 0x101674f5
jmp 0x101675fb
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2]
cmp eax, 0
je 0x101675b3
jmp 0x101675b5
jmp 0x101675f7
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0xe]
cmp eax, 0x6c
je 0x10167510
jmp 0x101675f2
mov dword [0x102bad48], 0xa81
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp eax, 0x6c
je 0x10167557
jmp 0x10167552
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x12]
cmp eax, 0x64
je 0x1016756e
jmp 0x101675f7
jmp 0x101675fb
cmp dword [ebp - 0x10], 0x104
jl 0x1016753f
jmp 0x101675ba
jmp 0x101675ba
jmp 0x101674e5
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov dx, word [eax + ecx*2 - 0x1a]
mov word [ebp - 0x1e], dx
mov ax, word [ebp - 0x1e]
movzx ecx, ax
cmp ecx, 0x6c
je 0x1016751c
jmp 0x101675fd
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x14]
cmp eax, 0x64
je 0x10167592
jmp 0x101675f9
jmp 0x10167552
jmp 0x101675f9
jmp 0x101675a6
jmp 0x101675fd
mov eax, dword [0x102bad48]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
sub eax, 0x94b
mov dword [0x102bad48], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
add esp, 0x24
pop ebp
ret
Function at 0x4ad02758
Capabilities:
Packed with generic packer

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
and dword [ebp - 8], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [0x4ad33b74]
xor ebx, ebx
mov bx, word [eax]
cmp bx, 0x3c
je 0x4ad03bf9
cmp bx, 0x3e
je 0x4ad03bf9
push ebx
call dword [0x4ad010fc]
test eax, eax
pop ecx
jne 0x4ad03cbe
mov eax, dword [ebp - 4]
test eax, eax
pop edi
pop esi
pop ebx
jne 0x4ad03c83
xor eax, eax
leave
ret 4
push 0x18
call fcn.4ad01725
test eax, eax
mov dword [edi], eax
je 0x4ad15409
mov esi, dword [0x4ad33b74]
inc dword [ebp - 4]
mov word [eax + 0x10], bx
xor eax, eax
mov ax, word [esi]
push eax
call dword [0x4ad010fc]
test eax, eax
pop ecx
je 0x4ad0d70c
movzx eax, word [esi]
mov ecx, dword [edi]
sub eax, 0x30
inc esi
mov dword [ecx], eax
inc esi
mov cx, word [esi]
lea eax, [esi + 2]
cmp cx, word [eax]
mov dword [ebp + 8], eax
je 0x4ad0d731
inc esi
inc esi
cmp word [esi], 0x26
je 0x4ad0b3db
push 0
call fcn.4ad03b7f
mov ecx, dword [edi]
mov dword [ecx + 4], eax
call fcn.4ad02892
test eax, eax
je 0x4ad0279b
push 0
call fcn.4ad02053
mov edi, dword [edi]
add edi, 0x14
inc dword [ebp - 8]
jmp 0x4ad0276d
cmp dword [ebp - 8], eax
jne 0x4ad03c91
push 0
push 0
call fcn.4ad020b7
xor eax, eax
inc eax
jmp 0x4ad027ab
mov eax, dword [0x4ad33b74]
mov bx, word [eax + 2]
cmp bx, 0x3c
je 0x4ad03bf9
cmp bx, 0x3e
jne 0x4ad0279b
jmp 0x4ad03bf9
add al, 0x75
or eax, 0x7abe05eb
add byte [edi], al
xor byte [ebx], 0xc0
dec ebp
cld
mov cl, 0x44
add byte [ebp - 0x547af040], al
add byte [eax], al
add bh, bh
adc eax, 0x44b0e8
cmp eax, 0xb7
jne 0x4ad0d750
xor esi, esi
jmp 0x4ad0d7e7
cmp eax, 3
je 0x4ad0d761
push 0
push edi
call fcn.4ad0d7ef
test eax, eax
jne 0x4ad0d749
movzx eax, word [edi]
mov ecx, edi
push ebx
xor ebx, ebx
test ax, ax
je 0x4ad0d7d4
push 0x5c
pop edx
cmp ax, dx
cmove ebx, ecx
add ecx, 2
movzx eax, word [ecx]
test ax, ax
jne 0x4ad0d771
test ebx, ebx
je 0x4ad0d7d4
push dword [ebp + 0xc]
xor eax, eax
push edi
mov word [ebx], ax
call fcn.4ad0d720
mov esi, eax
push 0x5c
pop eax
mov word [ebx], ax
test esi, esi
js 0x4ad0d7e6
push dword [ebp + 0xc]
push edi
call dword [0x44b120]
test eax, eax
jne 0x4ad0d7d0
call dword [0x44b0e8]
cmp eax, 0xb7
jne 0x4ad0d7c0
xor esi, esi
inc esi
jmp 0x4ad0d7e6
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
jmp 0x4ad0d7e6
xor esi, esi
jmp 0x4ad0d7e6
mov esi, 0x80070003
push esi
push 0x72
push 0x44b824
call fcn.4ad0cee0
pop ebx
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
adc byte [eax], ah
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
adc byte [ecx], ah
add byte [eax], al
nop
add byte [eax], al
add byte [eax], al