joyce8/EMBER2024-capa huggingface dataset:
Function at 0x138e80d
Capabilities:
Encode data using xor

Disassembly:
dec eax
xor ebx, ebx
inc ebp
movzx edx, byte [edi + ebx*4]
inc esp
sbb cl, bl
dec esp
mov dword [esp + ebx], ecx
adc byte [esp + ebx + 7], 0x12
inc esp
xor dl, dh
ror byte [esp + ebx], 0xa1
inc ecx
xor dl, 0x3a
dec edx
lea eax, [ecx*8 + 0x63b9f122]
dec ecx
lea ebp, [ecx - 0x3f57d67f]
or byte [esp + ebx*2 + 3], 0xaa
inc ecx
sbb dl, 0x23
inc ecx
mov edx, ecx
inc ecx
neg dl
inc ecx
sub dl, 3
bswap eax
inc ecx
sal ecx, 0x21
sal word [esp + ebx + 4], 0x46
inc ecx
xor dh, dl
sub dl, byte [esp + ebx*4]
dec eax
not dword [esp + ebx]
dec esi
lea edx, [esp + edx + 8]
inc ecx
pop esi
dec edx
add ebx, dword [ebx + edx]
inc esp
movzx eax, bp
dec edi
lea ebp, [ebp + ecx - 0x45ffe81a]
xor ax, 0x91af
dec ebx
mov dword [ebp + eax*8 - 0xec50], ebx
call fcn.0138f466
dec edi
aas
xchg edi, eax
lahf
sub al, 0xaa
cmp bl, byte [0xfe562816]
push edx
dec ecx
push ss
sub byte [esi - 0x76], dl
sahf
push ss
sub byte [esi + 0x5e], dl
xchg byte [ebp + 0x16], bl
sub byte [esi + 0x3e], dl
ror byte [0xee562816], cl
add al, 0x5f
sahf
mov bh, 0x30
push edx
insd dword es:[edi], dx
adc al, byte [ebp + 0x42]
dec edi
add byte [esi], bl
dec ebx
aas
cmp dword [eax - 0x44366db7], esi
xor ch, ch
xchg bx, ax
nop
or dword [eax], 0xf
cmp al, byte [edx + 0x1f29ef5c]
and al, byte [edx + 0x4b08ef5c]
outsb dx, byte [esi]
sbb byte [edi + ebp*8 + 0x5a], 0xe
sbb byte cs:[edi + ebp*8 + 0x15], 4
mov dword [edx + 1], 0x98a65545
inc ebp
push ebp
cmpsb byte [esi], byte es:[edi]
cwde
pop ebx
adc byte [eax], dl
or esp, dword [edi]
das
and dword [eax + 0x7c], ebp
outsd dx, dword [esi]
daa
das
and dword [eax + edi*8], ebp
das
daa
das
and dword [esp + ebx*2 + 0x57], edx
daa
das
and dword [eax + eax*2 + 0x53], esi
daa
das
and dword [eax + 0x5e], edi
or eax, 0x47b0af
pop esp
adc eax, 0x77e1e32
imul edx, edx, 0xab88b8c6
jp 0x138e8e8
mov ebx, 0x92ca5032
nop
sbb esp, 0xffffffff
mov byte [ebx - 0x414610a4], 0x8a
sbb dword [edi + ebp*8 - 6], 0xffffffcd
test byte [ebx - 0x306710a4], 0xea
sbb dword [edi + ebp*8 - 0x5d], 0xffffffa8
mov byte [edx + 1], 0xf8
add eax, edi
xor eax, 0xa003b49e
push ebx
lahf
add bh, byte [ecx - 0x67]
sub ebp, dword [ecx + eax - 0x63]
lahf
push ds
movsb byte es:[edi], byte [esi]
je 0x138e943
movsd dword es:[edi], dword [esi]
or edi, edi
wait
mov cl, 0x68
retf

Function at 0x139405a
Capabilities:
Encrypt data using chaskey

Disassembly:
lea esp, [esp + 0x14]
call fcn.0135236e
Function at 0x1397831
Capabilities:
Encode data using xor

Disassembly:
inc ebp
xor dh, al
inc word [esp + ecx*4 - 0x24237bea]
call fcn.0126ff0d
dec ebx
mov ecx, dword [0x362ee9cb]
leave
invalid

Function at 0x13a38c8
Capabilities:
Get number of processors

Disassembly:
xor ecx, ebx
xadd dx, ax
jle 0x13cb502
inc ecx
pop eax
add eax, 0x560b06
jmp eax

Function at 0x13a38dd
Capabilities:
Encode data using xor

Disassembly:
mov word [esp + ecx*2 + 4], cx
sub eax, 0x9fbdbe35
bswap ecx
neg eax
dec word [esp + ecx*2 + 5]
sub eax, 0xdaa0d001
ror eax, 3
sal cx, 0x49
neg eax
sar dl, 0xe7
xor ebx, eax
call fcn.01266aae

Function at 0x13a487a
Capabilities:
Authenticate hmac

Disassembly:
inc esp
add cl, al
inc esp
xor dword [esp + ebp*2 - 0x36d4], eax
inc ecx
movsx esi, bx
pop esi
shr dx, 0xb
dec ebp
lea ebp, [ebp + ebp - 0x1b6e]
add ebx, 0x20048417
inc ebp
mov dword [ebp + ebx - 0x20089f81], eax
jp fcn.013240cb
mov dword [esp + 0x10], 0x53d33f0d
push dword [esp + 8]
popfd
lea esp, [esp + 0x10]
call fcn.0135236e
inc edi
inc ebp
mov eax, dword [edi + ebp*8 - 0xdb50]
inc esp
xor eax, esi
sub di, bp
inc ecx
neg eax
inc ecx
bswap eax
inc ecx
push ebx
inc ecx
inc ecx
inc eax
not byte [esp + ebp - 0x1b6a]
inc ecx
rol eax, 2
dec eax
mov dword [esp + ebp - 0x1b6a], esi
and eax, 0xa281282d
jne 0x131c979

Function at 0x13ac843
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
test edx, edx
jmp 0x123d9bc
push ebp
xor ebp, edx
mov ebp, esp
mov edx, dword [ebp + 8]
cmp dh, 0x83
lea esp, [esp - 0x114]
cmc
stc
push esi
cmp edi, eax
jmp 0x136a517

Function at 0x13ad130
Capabilities:
Encode data using xor

Disassembly:
test byte [edx], cl
scasb al, byte es:[edi]
and ebp, dword [eax + 0xc94be0f]
loop 0x13ad086
and ebp, dword [eax - 0x3d012f09]
dec edi
lea edi, [edi + ebx - 0x928ade7]
call fcn.012385d2
sbb dword [edi + 0x324eb607], 0xffffffa6
mov cl, 0x86
add dword [edx + edx*2], esi
jbe 0x13ad0cc
xchg byte [ecx], al
xor al, 0xa2
mov bp, 0x186
xor al, 0xd6
sahf
mov cl, 0x86
add dword [edx + ebx*2], esi
in eax, 0x86
add dword [esi], esi
stc
stosd dword es:[edi], eax
push cs
sahf
push edx
cmpsb byte [esi], byte es:[edi]
std
cmp esp, dword [edi]
dec ecx
test byte [edi], 0x7c
aad 0x98
xor eax, dword [ecx]
sub edi, edi
invalid

Function at 0x13b4376
Capabilities:
Encode data using xor

Disassembly:
dec edx
mov dword [ebp + ebp - 0x762594fe], edi
dec esi
lea ebx, [ebp + ebp - 0x762594fe]
pop ebx
dec esi
mov dword [ebp + ebp - 0x76259506], ebx
inc ebp
xor cl, cl
dec eax
shr eax, 0xc7
dec edi
lea ebp, [eax + ebp - 0x1a36]
inc ecx
pop eax
ja fcn.013240cb
mov eax, dword [edi]
mov edx, 0xf9b3e7be
neg edx
xor edx, edx
xor edx, dword [edx + edi + 4]
push 0xd9bad680
pop ecx
jmp 0x136363e
Function at 0x13bacc9
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
jmp 0x137b702
dec ebx
lea ebp, [edx + esi + 0x232a9623]
dec ecx
not eax
dec ecx
xor edi, edx
dec edi
mov dword [ebp + edx*4 - 0x5ef10c18], eax
mov eax, 0x723dd0bc
call fcn.01357408
inc edx
xor dword [esp + ebx - 0x52b93a04], ebp
jmp 0x13334d6
xor dx, bx
shr eax, 0x3d
shl dword [esp + eax + 0xa], 0xaa
shl eax, 0x8c
adc dx, 0x92d
not al
shr cx, 0xab
ror dx, 1
neg cl
not dx
not dword [esp + eax*4 - 0x183ee]
rol dx, 1
rol edx, 1
xor bx, dx
lea edi, [edi + eax - 0x6101]
call fcn.01230a5f
ror byte [esp], 0xa6
xor eax, 0xc72a1fb2
sub dx, 0x2d39
add byte [esp], 0x37
dec eax
lea ecx, [edx + edx*2 - 0x6ad853cd]
xor eax, 0x14929b97
xor cx, word [esp + ecx*2 - 0x26ea090d]
call fcn.0124eb99
call fcn.0132a218
inc ecx
mov edx, 0x17bccc3b
inc ecx
movsx edi, dx
inc esp
movsx esi, di
dec edi
mov eax, dword [edx + ebp - 0x17bccc3b]
dec edi
lea esi, [edx + edx + 0x7693582d]
inc eax
shr bh, 0xe3
inc cx
sbb edx, 0x8b4b8935
test byte [ebp - 4], dl
jns 0x136e7dc
ror byte [edi - 0x73], 1
lodsb al, byte [esi]
push ebp
cld
jns 0x136e7e4
ror byte [ebx + ecx - 0x40], 1
jmp 0x1364b81
xor ebx, edx
ror eax, cl
add esi, edx
inc ecx
mov edx, ecx
setg cl
sub ebp, 2
lea edx, [ecx + edx + 0x352d542a]
movzx edx, word [ebp]
sal eax, 0x98
push eax
jne 0x136e7bb
jmp 0x1226026
Function at 0x13c6d04
Capabilities:
Encode data using base64

Disassembly:
rep stosd dword es:[edi], eax
jmp 0x135a537
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x2c], edi
jmp 0x1790ca6
je 0x138a046
movzx edx, byte [ecx]
cmp ecx, ebp
stc
shl esi, 8
jmp 0x1362939
jl 0x135a55c
mov dword [ebp - 8], ecx
lea esp, [esp]
bt edi, 0x2d
cmovno edi, ebp
adc ecx, ecx
rep stosw word es:[edi], ax
mov ecx, dword [ebp + 8]
shl al, cl
adc ax, bp
lea eax, [ecx - 1]
cmc
cmp ah, 0x18
mov dword [ebp - 0x40], eax
sub esi, esi
or eax, 0xffffffff
test bp, bx
cmp sp, bp
stc
sub edi, edi
cmp ecx, dword [ebp - 0x40]
jmp 0x134d82a
inc edi
or esi, edx
inc ecx
cmc
test ebp, edx
cmp edi, 5
jmp 0x134fc7b
mov eax, edx
test al, ah
cmp bx, bx
shl edx, 0x10
cmp ax, cx
clc
or eax, edx
shr ecx, 1
jmp 0x12145ab
inc cx
neg ebx
not dl
dec edx
mov dword [esp + ebx*2 - 0x1acb94], edi
mov eax, 0x80bac1bc
ror dl, 1
dec edx
add dword [esp + ebx - 0xd65c2], 0x26054ca9
xor dl, 0x3f
inc dx
inc dword [esp + ebx - 0xd65c9]
inc eax
xor dh, dl
dec eax
lea ebx, [edi*4 + 0x293dc521]
dec eax
lea edx, [esp + edx + 0x10]
inc esi
xor ecx, dword [esp + ebx - 0xd65c2]
inc esi
mov byte [edx + ebx*4 - 0x359728], dh
dec eax
shr ebx, 0xc9
inc ecx
movsx edx, ax
dec edi
lea edi, [ebx + edi - 0xd65ce]
inc dx
neg dword [esp + ebx - 0xd65ca]
adc byte [esp + edx - 0x3b6], dh
call fcn.017950b0
sub esi, edi
mov dword [ebp - 0x48], esi
mov esi, dword [eax]
mov dword [ecx], ebx
btr cx, si
mov ecx, dword [ebp + 0x14]
mov dword [ecx], ebx
sar ecx, 0x10
add ecx, 0x350e48be
mov ecx, dword [eax + 4]
add ecx, esi
mov eax, esp
shrd ax, cx, 7
clc
mov eax, 0x300
shl eax, cl
cmc
test si, bp
mov dword [ebp - 0x3c], esi
stc
mov dword [ebp - 0x14], ebx
cmp ebx, esp
cmp ch, 0x2d
cmc
mov dword [ebp - 0x10], edi
cmp bp, cx
add eax, 0x736
jmp 0x133c5e0
je 0x135a53c
mov ecx, eax
clc
rcl ax, cl
mov eax, 0x400
add di, 0xbeb1
mov edi, edx
bts edx, esp
test dx, 0x425
ror dh, 0x8b
movzx edx, ax
ror ah, 0x83
cmp si, di
jmp 0x137ea53

Function at 0x13c888b
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
lea eax, [eax + edx - 0x77acee75]
mov dword [esp + edx - 0x3c00c3ba], edx
neg dword [esp + edx - 0x3c00c3b2]
rol eax, cl
call fcn.0139f40e
mov dword [esp + edx*2 - 0x7801877c], edx
rol eax, cl
jmp 0x13acfbe
Function at 0x13cb434
Capabilities:
Get number of processors

Disassembly:
xchg byte [esp + edx*8 - 0x306b0], dh
inc ecx
pop ecx
not ebx
sal bp, 0x68
inc ecx
pop esi
dec eax
xchg edi, eax
neg ebx
lea ebx, [ebx + ebp - 0x4c2660e7]
rol word [esp + edx - 0xafd6], 0x47
dec eax
mov dword [esp + edx*4 - 0x2bf5c], esi
movsx ecx, dx
xor dword [esp + edx*2 - 0x15fae], ebx
pop esi
inc ecx
mov ecx, 0x1928930
dec ecx
sal ecx, 0xc5
inc cx
neg ebx
dec eax
arpl bx, bx
inc ecx
shl al, 0x43
call fcn.01254292

Function at 0x13d505c
Capabilities:
Get number of processors

Disassembly:
not cl
rol cl, 1
movsx edx, ax
sal dword [esp + edx*2 - 0x6d24], 0x25
xor bl, cl
shr eax, 0xdb
lea edi, [edi + eax*8 - 0xf2]
dec dword [esp + eax*4 - 0x78]
mov word [edi + eax*8 - 0xf0], cx
lea ebp, [eax + ebp - 0x22]
inc edx
mov ecx, dword [ebp + eax*2 - 0x3c]
sub edx, 0x2b5b102
xor ecx, ebx
rol ecx, 2
and ax, dx
jns 0x17a216b
sal ax, 0xe
add ecx, edx
lea eax, [eax + 0x65340e91]
mov dword [edi + eax - 0x172a0e91], ecx
movzx ecx, al
mov edx, eax
sar dx, 0xa6
lea ebp, [ebp + eax - 0x172a0e95]
mov eax, dword [ebp + eax*4 - 0x5ca83a44]
shl dl, 0x22
cmovae dx, cx
call fcn.0122839c
neg cl
lea eax, [eax + eax*8 + 0x6b96369b]
mov dword [esp], eax
ror cl, 1
dec byte [esp + 3]
jne 0x137df2f
bswap ecx
sbb ecx, 0xd598192e
not ecx
xor ebx, ecx
shr dword [esp + eax - 0x10], 0xcf
rol edx, 0xf4
adc esi, ecx
add byte [esp + eax - 0x10], dl
neg edx
pop eax
jbe fcn.013148ee

Function at 0x1788203
Capabilities:
Encrypt data using chaskey

Disassembly:
inc ecx
shr ecx, 8
inc esp
xor ecx, edi
dec eax
inc ebp
inc ecx
xor ecx, 0x8a38b10e
dec eax
dec eax
dec eax
lea esp, [esp + 0x18]
jne 0x13940e1
Function at 0x1789b26
Capabilities:
Encode data using xor

Disassembly:
xor ebx, eax
add esi, eax
sar cl, 0x61
lea eax, [edx + edx*8 - 0x74e33b60]
add edx, esi
jmp edx
pop esp
push eax
out dx, eax
push edi
jp 0x13436fa
pop esp
push eax
out dx, eax
inc ebp
push ecx
pop esp
push eax
out dx, eax
pushal
inc esi
jg 0x134371c
push eax
out dx, eax
pop edi
arpl word [edi + 0x5c], bx
push eax
out dx, eax
and eax, 0x14e1921
call fcn.01271ec5
push 0xd70a599c
mov dx, word [edi + 2]
add edi, 2
mov eax, 0x660abd2b
call fcn.0123d614
out 0xa, al
xchg dword [esi], esp
jl 0x1343710
ja 0x134375f
push es
xchg ecx, eax
push es
xchg dword [edi], edx
and al, 6
xchg ecx, eax
push es
out 0x7b, eax
push es
xchg ecx, eax
push es
inc edi
add edx, dword [esi + eax]
xchg ecx, eax
push es
ja 0x13436ad
push eax
push es
xchg ecx, eax
push es
jnp 0x134372c
pop edx
mov cs, word [esi]
pushal
push edi
jge 0x13436c2
adc eax, 0x4e9098ba
pop esi
ret
lodsd eax, dword [esi]
pop ebp
push eax
out dx, eax
mov cl, 0xf3
aad 0x5d
push eax
out dx, eax
jmp dword [edx - 0x10afa27f]
fisubr dword [0xd6360796]
push cs
inc ebp
xchg esi, eax
pop es
outsb dx, byte ss:[esi]
dec eax
sbb ebx, dword [esi]
cwde
push eax
push ss
in eax, dx
cmp eax, 0x608f125
jle 0x13437bb
or al, 0xc0
add dword [esi], esi
std
push ss
mov bh, 0x32
xchg dword [0x36839c4c], ecx
or eax, 0xef505d31
cmovge ebp, dword [ecx + 0x5d]
push eax
out dx, eax
inc esi
push 0xef505d51
dec ebp
inc ecx
jno 0x13437f9
push eax
out dx, eax
pop ebx
dec edi
sbb byte [esi + 1], cl
fyl2x
stosd dword es:[edi], eax
std
inc ebp
pop esp
push 0x3f4a2a87
dec edx
aas
cld
and al, 0xcf
sub cl, byte [edx + 0x3f]
mov ah, 0xf4
sbb ebp, dword [edx + edi*4]
adc dword [edx], edi
invalid
js 0x1343802
pop edx
mov al, byte [0x796684f0]
xchg edx, eax
sahf
jl 0x13437ac
invalid
dec ecx
sub edi, 4
inc ecx
mov edx, dword [edi]
xor edx, esi
jmp 0x13c5479
inc ecx
mov eax, 0x17b7d189
mov edi, 0xa795f139
dec edx
dec edx
lea eax, [eax*4 + 0x8252731]
call fcn.01319db4
or eax, dword [edx + ebp]
movzx ecx, dx
xor eax, ebx
not eax
and edx, edx
ja 0x1327c27
neg eax
shr edx, 0xf6
not eax
lea eax, [eax + edx*2 - 0x70357435]
sar edx, 3
lea ecx, [ecx + edx*2 - 0xe6529f1]
je 0x1262e7c
jne 0x13436cd
jmp 0x134cfc8
Function at 0x178f6f7
Capabilities:
Encode data using xor

Disassembly:
inc eax
xor cl, bl
or ax, dx
add ax, dx
shr ax, 0xab
not cl
shr dx, 0x21
neg cl
lea edx, [edx + 0x478bc40b]
sal al, 0x26
push edx
add cl, 0x2a
xor cl, 0x94
ror dl, 0xa5
jae 0x13cd0e2
dec esi
lea ebp, [ecx + ebp + 0x18ff004]
jge 0x13ab714
mov eax, dword [eax + ecx - 0x4f9400c0]
xadd byte [esp + edx - 0x478b874c], dh
mov dword [edx + edi - 0x478b8050], eax
lea edi, [edi + edx - 0x478b8050]
setb byte [esp + edx - 0x478b804b]
ror byte [esp + edx - 0x478b804d], 0x43
neg dword [esp + edx - 0x478b804e]
pop ecx
jne fcn.013148ee
call fcn.0131dbd4
mov dx, word [edi]
add edi, 2
sub ebp, 1
movzx ecx, byte [ebp]
mov eax, 0x6cbee492
xor cl, bl
inc cl
sar al, 0x27
sub eax, eax
and eax, eax
ror cl, 1
dec cl
not cl
or ax, ax
xor al, ah
ror cl, 1
not ax
lea eax, [eax + eax - 0x43c37ccf]
xor cl, 0x29
neg cl
shl al, 0xa3
not eax
xor bl, cl
not eax
xor al, ah
sub al, al
adc ecx, esp
neg al
dec eax
shr eax, 0x56
mov word [eax + ecx - 0x2f0], dx
lea ebp, [eax + ebp - 0x2f4]
movzx edx, al
mov edx, dword [ebp + eax*4 - 0xbc0]
mov ecx, eax
shr ecx, 0x64
xor edx, ebx
call fcn.01241198
jp 0x1374fa9
mov edx, dword [edi]
mov ecx, 0xe3b4e9a8
ror ecx, 0x43
mov eax, dword [edx + ecx*4 - 0x71da74d4]
mov dword [ecx + edi - 0x1c769d35], eax
mov eax, 0x75247a2a
mov eax, dword [ebp + ecx - 0x1c769d39]
dec ecx
or ecx, 0x82acd527
xor eax, ebx
sal ecx, 0x1a
dec eax
inc cx
not eax
call fcn.01266abc
dec edx
mov dword [esp + edx - 0x61b7a3be], esi
dec ecx
sbb eax, 0x4f9eef87
inc ecx
add bh, al
inc edx
xor dword [esp + ebx - 0x1aad], ebx
call fcn.01310e7c
mov ecx, dword [edi]
mov edx, dword [edi + 4]
adc edi, 4
push 0xa8067d21
xor eax, eax
test edx, edx
call fcn.01785d1e
invalid
movsx esi, al
push esi
mov dword [esp + eax*2 - 0x60], ebp
push ebx
jne 0x126b3ab
mov word [edi + 2], ax
lea eax, [ecx + ecx*8 - 0x45f0ffed]
bswap eax
inc eax
movzx ecx, byte [ebp + eax*4 - 0x28003ef1]
movsx edx, al
xor eax, 0x4594591c
and al, 0x9d
lea ebp, [ebp + eax - 0x4f94568a]
adc ax, 0xb631
jg 0x124f942
call fcn.0131ac4e
dec esp
mov dword [esp + ecx + 0x18ff000], esp
ret 0x18
adc dx, dx
xor bl, cl
and dword [esp + eax - 0x4f9400c0], eax
lea ecx, [esp + ecx + 4]
add dx, ax
jl 0x1257958
push 0x6982f617
mov dword [esp + 4], eax
pushfd
pop eax
mov dword [esp], eax
mov eax, 0xfe046225
dec eax
push edi
xor eax, eax
lea eax, [eax + eax*8 - 0x2e7c1856]
push ecx
shr eax, 0x7e
mov ecx, eax
lea edi, [esp + eax*4 - 0x1c]
rol al, cl
push edx
sub cl, ch
neg cx
add eax, eax
push esi
mov ecx, 0
mov dword [esp + eax*2 - 0x48], ecx
jns 0x1320a59
xor eax, 0x871fc9b5
mov ecx, 0xe2d0789
xor dl, cl
xor ebx, eax
add esi, eax
mov ecx, dword [edi + ecx*4 - 0x38b41e24]
mov eax, dword [edi + edx - 0x5f313dc5]
shr edx, 0x86
lea edi, [edi + edx*8 - 0xbe627b0]
inc edx
setge dl
or ecx, eax
lea eax, [edx + edx*8 - 0x3163c7fc]
not ecx
call fcn.013c96d3

Function at 0x1795263
Capabilities:
Encode data using xor
Parse pe header
Resolve function by parsing pe exports

Disassembly:
or ax, 0x6513
not cl
and al, 0x16
neg cl
sar edx, 0x47
call fcn.012503c0
or dword [ebp + 0x3cb21be1], ebp
xchg ebp, eax
cmp dword [eax - 0x79f2f92c], 0xffffffa9
rol byte [edx - 0xa], 0xd9
Function at 0x1796515
Capabilities:
Encode data using xor

Disassembly:
xor cl, 0x94
xadd al, dh
xor bl, cl
call fcn.013b34da
push eax
movzx ecx, byte [ebp]
neg edx
xor cl, bl
pop eax
push eax
not cl
neg cl
not dword [esp + edx - 0x6ddbb000]
mov dword [esp + edx - 0x6ddbaffc], 0xa88381b7
bswap eax
add cl, 0x2a
and edx, 0x548ac68e
inc edx
jne 0x1349a4b

Function at 0x179a929
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
inc esp
xor edx, esi
movzx ecx, al
inc esi
movzx ecx, byte [esp + eax + 9]
inc ecx
not edx
dec edx
ror dword [esp + eax + 0xc], 9
shl cl, 0x81
inc ecx
sbb edx, 0xe5a260b0
inc esp
movsx ebx, al
dec eax
bswap edx
inc ecx
xor edx, 0xf485ee86
inc esp
movsx esi, al
inc edi
lea edx, [edx + eax - 0x40833f40]
dec eax
sub edi, 0x69ba5797
inc ecx
rol edx, 1
inc ecx
inc edx
inc ecx
not edx
inc ecx
neg edx
inc esi
lea edx, [ebp + edx - 0x6afe366f]
dec edx
mov dword [esp + eax + 0x16], esi
inc esi
xor dword [esp + eax*2 + 0x14], edx
inc dx
and dword [esp + eax + 6], ecx
dec edx
mov esi, dword [esp + eax*2 + 0x14]
call fcn.0131197e
sar dx, 0x8b
xor ebx, ecx
add esi, ecx
movzx ecx, word [ebp + eax*4 - 6]
lea ebp, [eax + ebp - 6]
jmp 0x126a0aa
sal edx, 0x99
xor cx, bx
sub eax, edx
not edx
add cx, 0x92d
sar al, 0xc6
add al, 0xa2
ror cx, 1
xor cx, dx
lea edx, [edx + 0x59041113]
shr ax, 0xc4
bswap edx
rol cx, 1
push eax
xor bx, cx
and byte [esp + eax*4 - 0x10000027], al
mov word [edi + eax*2 - 0x8000014], cx
adc edx, 0x309a4ab7
ja 0x1270a7d
dec ecx
sub edi, 4
inc ecx
mov edx, 0xc001e5ad
inc ecx
mov edx, dword [edi]
inc ebp
movzx ecx, dl
xor edx, esi
inc ecx
mov edi, ecx
mov ebx, edi
inc edx
lea edx, [edx + ecx*2 + 0x21accc32]
inc ecx
movsx eax, dx
xor edx, 0xb9a2ac25
inc ecx
inc edx
bswap edx
not edx
js 0x178bc7f
mov dword [esp + eax - 0x400000a], esi
ret
call fcn.01233d38
je 0x13badf1
lea ebx, [ebx]
dec eax
shl eax, 0x5b
dec edx
dec eax
shr ebx, 0x68
push esi
dec eax
inc eax
inc ecx
mov ebx, 0xc728fab0
inc edx
xor dword [esp + ecx - 0xad], edx
jmp 0x134a853
dec eax
mov dword [esp + edi - 0x88], 0xaf9a97
inc ecx
xor dh, cl
inc ebp
mov edx, eax
rol di, 0x67
inc si
mov dword [edi + ebp - 0x4402], ecx
inc ebp
mov edx, dword [edi + edi*8 - 0x22005]
dec esp
xchg dword [esp + edi*4 - 0x10ff8], eax
inc ecx
push eax
dec edi
lea edi, [edi + eax - 0x8d]
inc cx
sar eax, 0x26
jns 0x12564ec
call fcn.013c7cec
jb 0x17a47bf
mov eax, dword fs:[0x30]
xor bx, sp
mov ecx, 0x548014a8
mov eax, dword [eax + 0xc]
mov ecx, dword [eax + 0xc]
dec bx
mov eax, dword [eax + 0x10]
cmp edi, ebx
mov bl, bh
mov dword [ebp - 4], eax
not bl
mov ebx, ecx
cmp ecx, eax
jmp 0x1375906
mov eax, 0xe73290b5
setp cl
mov cl, dl
ror si, 0x30
rol eax, cl
btr si, sp
movzx esi, si
lea esi, [ebp + edx - 0x10c]
test si, 0xbe85
add al, dl
test dx, 0xfe36
xor al, byte [edi + esi]
mov byte [esi], al
je 0x179a978
inc edx
test dl, 0xbb
cmp edx, 0x104
jmp 0x179a972

Function at 0x17a7c92
Capabilities:
Link function at runtime on windows

Disassembly:
cmp edi, eax
lea esp, [esp + 4]
ja 0x137d3fd
mov edx, esp
mov eax, 0x2da4138a
lea ecx, [eax - 0x2da41326]
call fcn.0134b752
Function at 0x401270
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401289
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x40129d
pop esi
pop edi
xor eax, eax
pop ebx
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x4012be
cmp esi, eax
jae 0x401297
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4012b0
cmp esi, eax
jae 0x401297
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x401850
Capabilities:
Set registry value

Disassembly:
sub esp, 0x88
mov eax, dword [0x431468]
mov dword [esp + 0x84], eax
call fcn.00410080
test eax, eax
jne 0x4018f0
lea eax, [esp + 4]
push esi
mov dword [esp + 4], eax
call dword [fcn.00430090]
mov ecx, dword [esp + 0x94]
push eax
push ecx
lea ecx, [esp + 0xc]
call fcn.00401350
mov edx, dword [esp + 0xa4]
mov eax, dword [esp + 0xa0]
mov ecx, dword [esp + 0x9c]
push edx
mov edx, dword [esp + 0x9c]
push eax
mov eax, dword [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x9c]
push edx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
mov eax, dword [esp + 4]
lea edx, [esp + 8]
cmp eax, edx
je 0x4018da
push eax
call fcn.004132e2
add esp, 4
mov eax, esi
pop esi
mov ecx, dword [esp + 0x84]
call fcn.00412e0b
add esp, 0x88
ret
mov eax, dword [esp + 0xa0]
mov ecx, dword [esp + 0x9c]
mov edx, dword [esp + 0x98]
push eax
mov eax, dword [esp + 0x98]
push ecx
mov ecx, dword [esp + 0x98]
push edx
mov edx, dword [esp + 0x98]
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [esp + 0x84]
call fcn.00412e0b
add esp, 0x88
ret

Function at 0x401940
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x88
mov eax, dword [0x431468]
mov dword [esp + 0x84], eax
call fcn.00410080
test eax, eax
jne 0x4019e0
lea eax, [esp + 4]
push esi
mov dword [esp + 4], eax
call dword [fcn.00430090]
mov ecx, dword [esp + 0x94]
push eax
push ecx
lea ecx, [esp + 0xc]
call fcn.00401350
mov edx, dword [esp + 0xa4]
mov eax, dword [esp + 0xa0]
mov ecx, dword [esp + 0x9c]
push edx
mov edx, dword [esp + 0x9c]
push eax
mov eax, dword [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x9c]
push edx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov eax, dword [esp + 4]
lea edx, [esp + 8]
cmp eax, edx
je 0x4019ca
push eax
call fcn.004132e2
add esp, 4
mov eax, esi
pop esi
mov ecx, dword [esp + 0x84]
call fcn.00412e0b
add esp, 0x88
ret
mov eax, dword [esp + 0xa0]
mov ecx, dword [esp + 0x9c]
mov edx, dword [esp + 0x98]
push eax
mov eax, dword [esp + 0x98]
push ecx
mov ecx, dword [esp + 0x98]
push edx
mov edx, dword [esp + 0x98]
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp + 0x84]
call fcn.00412e0b
add esp, 0x88
ret