joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41097c
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [0x41d844]
test eax, eax
je 0x4109c3
mov ecx, dword [eax]
xor edi, edi
test ecx, ecx
je 0x410a4e
add eax, 4
xor edi, edi
nop word cs:[eax + eax]
cmp byte [ecx], 1
sbb ecx, ecx
lea edi, [edi + ecx + 1]
mov ecx, dword [eax]
add eax, 4
test ecx, ecx
jne 0x4109ac
jmp 0x410a4e
mov esi, dword [0x41d880]
test esi, esi
jne 0x4109f0
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov esi, eax
mov dword [0x41d880], esi
test esi, esi
jne 0x4109f0
mov dword [esp], 0x4155b8
call fcn.0040fb10
mov esi, dword [0x41d880]
mov dword [esp], esi
call fcn.00409414
xor ebx, ebx
mov ebp, 1
xor edi, edi
test eax, eax
je 0x410a24
mov ebp, esi
nop dword [eax + eax]
lea ebp, [ebp + eax + 1]
mov dword [esp], ebp
lea ebx, [eax + ebx + 1]
inc edi
call fcn.00409414
test eax, eax
jne 0x410a0c
inc ebx
mov ebp, ebx
mov dword [esp], ebp
call fcn.00406bf0
mov ecx, eax
mov dword [0x41d840], ecx
xor eax, eax
test ecx, ecx
je 0x410af9
mov dword [esp + 8], ebp
mov dword [esp + 4], esi
mov dword [esp], ecx
call fcn.00409134
lea eax, [edi + 4]
mov dword [0x41d848], eax
add edi, 5
mov dword [esp], edi
mov dword [esp + 4], 4
call fcn.00406bd8
mov esi, eax
xor eax, eax
test esi, esi
je 0x410af9
mov edi, dword [0x41d844]
test edi, edi
je 0x410aab
mov edx, dword [edi]
test edx, edx
je 0x410ae6
lea eax, [edi + 4]
xor ecx, ecx
nop
cmp byte [edx], 0
jne 0x410a9c
dec ecx
jmp 0x410a9f
mov dword [esi + ecx*4], edx
inc ecx
mov edx, dword [eax]
add eax, 4
test edx, edx
jne 0x410a8c
jmp 0x410ae2
mov ebx, dword [0x41d840]
mov dword [esp], ebx
call fcn.00409414
test eax, eax
je 0x410aee
mov ebp, esi
nop word cs:[eax + eax]
mov dword [ebp], ebx
lea ebx, [eax + ebx + 1]
mov dword [esp], ebx
add ebp, 4
call fcn.00409414
test eax, eax
jne 0x410acc
test edi, edi
je 0x410aee
mov dword [esp], edi
call fcn.00406c00
mov dword [0x41d844], esi
mov eax, 1
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10001600
Capabilities:
Get file size
Print debug messages
Read .ini file

Disassembly:
sub esp, 0xc
xor eax, eax
push ebp
mov ebp, dword [esp + 0x14]
mov word [esp + 5], ax
push esi
push eax
push 0x80
push 3
push eax
push eax
push 0x80000000
push ebp
mov byte [esp + 0x24], 0
mov byte [esp + 0x27], al
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000173c
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [edi + 1]
push ecx
call fcn.10001aeb
add esp, 4
mov esi, eax
mov dword [esp + 0x14], esi
push ebp
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesA]
cmp byte [esi], 0
je 0x10001732
mov edi, 0x10009b6c
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [esp + 0x14], edi
mov dword [esp + 0x20], 0x1000bb6c
jmp 0x1000168f
mov edi, dword [esp + 0x14]
push ebp
lea edx, [esp + 0x14]
push 0x104
push edx
push 0x1000db6c
push str.FROMNAME
push esi
mov dword [esp + 0x28], 0
call ebx
lea eax, [esp + 0x10]
push 0x100070fc
push eax
call fcn.10001a60
add esp, 8
test eax, eax
push ebp
push 0x104
je 0x100016ed
mov edi, dword [esp + 0x28]
push edi
push 0x1000db6c
push str.NAME
push esi
call ebx
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add edi, 0x20
mov dword [esp + 0x20], edi
jmp 0x10001709
push edi
push 0x1000db6c
push str.CLASS
push esi
call ebx
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add edi, 0x20
mov dword [esp + 0x14], edi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov al, byte [esi + ecx + 1]
lea esi, [esi + ecx + 1]
test al, al
jne 0x1000168b
mov esi, dword [esp + 0x18]
pop ebx
push esi
call fcn.10001ae0
add esp, 4
pop edi
pop esi
pop ebp
add esp, 0xc
ret

Function at 0x10001910
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x128
push esi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [esp + 4]
push eax
push esi
mov dword [esp + 0xc], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x100019df
lea ecx, [esp + 0x28]
push str.Explorer
push ecx
call fcn.10001a60
add esp, 8
test eax, eax
jne 0x100019a4
lea edx, [esp + 0x28]
push str.EXPLORER
push edx
call fcn.10001a60
add esp, 8
test eax, eax
jne 0x100019bc
lea eax, [esp + 0x28]
push str.explorer
push eax
call fcn.10001a60
add esp, 8
test eax, eax
jne 0x100019d5
lea ecx, [esp + 4]
push ecx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x100019df
lea edx, [esp + 0x28]
push str.Explorer
push edx
call fcn.10001a60
add esp, 8
test eax, eax
je 0x10001953
mov eax, dword [esp + 0xc]
push esi
mov dword [0x10009b68], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
add esp, 0x128
ret
mov ecx, dword [esp + 0xc]
push esi
mov dword [0x10009b68], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
add esp, 0x128
ret
mov edx, dword [esp + 0xc]
mov dword [0x10009b68], edx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
add esp, 0x128
ret
Function at 0x100019f0
Capabilities:
Create thread

Disassembly:
cmp dword [esp + 8], 1
jne 0x10001a2e
push esi
call fcn.10001910
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x10001750
push 0
push 0
call esi
push 0
push 0
push 0
push 0x10001850
push 0
push 0
call esi
mov eax, 1
pop esi
ret 0xc
mov eax, 1
ret 0xc
Function at 0x10001000
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x10075200]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x18], 0x71afdce0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
sub eax, 0x2032e6cc
je 0x10001096
jmp 0x1000103b
mov eax, dword [ebp - 0x24]
sub eax, 0x71afdce0
je 0x10001053
jmp 0x1000104e
jmp 0x100010a7
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], eax
push ebx
pop ebx
nop
mov ebx, eax
xor ebx, 0x39
mov ecx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x14]
not byte [edi]
push ebx
pop ebx
nop
mov ebx, eax
xor ebx, 0x39
add byte [edi], 0x47
sub byte [edi], 0x25
push ebx
pop ebx
nop
mov ebx, eax
xor ebx, 0x39
imul byte [edi]
inc edi
loop 0x1000106d
mov dword [ebp - 0x18], 0x2032e6cc
jmp 0x100010a7
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.10016d60
add esp, 0x1c
pop edi
pop ebx
pop ebp
ret
jmp 0x10001025
Function at 0x1001a133
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1001a172
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001a172
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001a172
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1001a172
cmp dword [ecx + 0x74], 0xe
jbe 0x1001a172
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1001cdef
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1001ce8c
push ebx
push esi
call fcn.1001cdb8
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1001cd4c
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1001ce39
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001ce8b
push edi
push eax
call fcn.1001ddaa
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1001ce59
call fcn.1001b894
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001ce8a
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1001cd4c
add esp, 0x20
test eax, eax
jne 0x1001ce78
push edi
call fcn.1001b894
jmp 0x1001ce80
push ebx
call fcn.1001b894
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1001d0f9
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10024cc8
push 0x10024cc0
push str.FlsAlloc
push 0x1f
call fcn.1001d015
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001d12d
push dword [ebp + 8]
mov ecx, esi
call dword [0x1002314c]
call esi
jmp 0x1001d133
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1001d177
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10024cd8
push 0x10024cd0
push str.FlsGetValue
push 0x21
call fcn.1001d015
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001d1ae
push dword [ebp + 8]
mov ecx, esi
call dword [0x1002314c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1001d1b6
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10024ce0
push 0x10024cd8
push str.FlsSetValue
push 0x22
call fcn.1001d015
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001d1f0
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1002314c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10022890
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100228bd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100228bd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4033e7
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x4033f3
call 0x403402
add byte [edi + 0x34], cl
dec ebp
inc edx
cmp eax, dword [ecx + 0x3c]
cmp eax, dword [ebx + 0x695b04c4]
xchg ebp, eax
push esp
invalid

Function at 0x403402
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x4033f3
call 0x403402
add byte [edi + 0x34], cl
dec ebp
inc edx
cmp eax, dword [ecx + 0x3c]
cmp eax, dword [ebx + 0x695b04c4]
xchg ebp, eax
push esp
invalid

Function at 0x403463
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ebx
push ebx
push eax
add esp, 4
and ebx, 0x5809
pop ebx
mov dword [ebp - 0x10], 1
push edi
and edi, 0x155c
pop edi
push eax
push esi
add esp, 4
call 0x403496
add byte [edx + 0x3a], cl
dec edi
cmp dword [esi + esi + 0x4d], ecx
dec ebx
inc ecx
add esp, 4
xor eax, 0x11d2e
or eax, 0x4317
sub eax, 0x14ce5
pop eax
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push edx
add edx, 0x142e1
or edx, 0x7a2b
or edx, 0xe3ba
or edx, 0x8d0d
pop edx
push eax
push esi
add esp, 4
or eax, 0x17d6c
add eax, 0x2383
add eax, 0x7989
pop eax
push eax
push eax
add esp, 4
and eax, 0x17dda
sub eax, 0x146fa
or eax, 0x27d2
pop eax
push eax
sub eax, 0xe500
add eax, 0xb042
xor eax, 0xcf49
or eax, 0x181cf
pop eax
mov dword [ebp - 0x2c], 1
push eax
push ecx
add esp, 4
or eax, 0xb4e7
sub eax, 0xaf7
and eax, 0x8607
jmp 0x403560
pop eax
push ecx
sub ecx, 0x174a7
xor ecx, 0x3694
xor ecx, 0x124f1
pop ecx
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
push ebp
aam 0x69
dec ebp
aam 0x38
add dword [eax], eax
add byte [ebx], ch
ror dword [ecx - 0x4c162fab], 1
add dword [eax], eax
invalid
Function at 0x403496
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ebx
push ebx
push eax
add esp, 4
and ebx, 0x5809
pop ebx
mov dword [ebp - 0x10], 1
push edi
and edi, 0x155c
pop edi
push eax
push esi
add esp, 4
call 0x403496
add byte [edx + 0x3a], cl
dec edi
cmp dword [esi + esi + 0x4d], ecx
dec ebx
inc ecx
add esp, 4
xor eax, 0x11d2e
or eax, 0x4317
sub eax, 0x14ce5
pop eax
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push edx
add edx, 0x142e1
or edx, 0x7a2b
or edx, 0xe3ba
or edx, 0x8d0d
pop edx
push eax
push esi
add esp, 4
or eax, 0x17d6c
add eax, 0x2383
add eax, 0x7989
pop eax
push eax
push eax
add esp, 4
and eax, 0x17dda
sub eax, 0x146fa
or eax, 0x27d2
pop eax
push eax
sub eax, 0xe500
add eax, 0xb042
xor eax, 0xcf49
or eax, 0x181cf
pop eax
mov dword [ebp - 0x2c], 1
push eax
push ecx
add esp, 4
or eax, 0xb4e7
sub eax, 0xaf7
and eax, 0x8607
jmp 0x403560
pop eax
push ecx
sub ecx, 0x174a7
xor ecx, 0x3694
xor ecx, 0x124f1
pop ecx
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
push ebp
aam 0x69
dec ebp
aam 0x38
add dword [eax], eax
add byte [ebx], ch
ror dword [ecx - 0x4c162fab], 1
add dword [eax], eax
invalid

Function at 0x403590
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
aam 0x69
dec ebp
aam 0x38
add dword [eax], eax
add byte [ebx], ch
ror dword [ecx - 0x4c162fab], 1
add dword [eax], eax
add byte [ecx + 0x56], dl

Function at 0x406970
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add byte [edi], bh
dec eax
inc ebx
inc ebx
aaa
dec ebp
cmp bh, byte [ecx]
xor al, 0x83
les eax, [ebx + ebx*2]
push edx
xor edx, 0x3e4f
and edx, 0x16adc
xor edx, 0x3df9
add byte [edx - 0x75], bl
push ebp
in al, dx

Function at 0x40697a
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add byte [edi], bh
dec eax
inc ebx
inc ebx
aaa
dec ebp
cmp bh, byte [ecx]
xor al, 0x83
les eax, [ebx + ebx*2]
push edx
xor edx, 0x3e4f
and edx, 0x16adc
xor edx, 0x3df9
add byte [edx - 0x75], bl
push ebp
in al, dx
Function at 0x406b3e
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
call dword [edx - 0x3a]
test dword [ecx - 0x4600000c], ecx
mov byte [ebp - 0xb76], 0x10
mov byte [ebp - 0xb75], 0x10
mov byte [ebp - 0xb74], 0x10
mov byte [ebp - 0xb73], 0x10
mov byte [ebp - 0xb72], 0x5a
push edi
push edx
add esp, 4
jmp 0x406a47
add edi, 0x8968
add edi, 0x17a6
sub edi, 0xd72
pop edi
push esi
jmp 0x406a62
or esi, 0x13f52
or esi, 0xdd9
pop esi
mov byte [ebp - 0xb80], 0x52
mov byte [ebp - 0xb7f], 0xb9
mov byte [ebp - 0xb7e], 0x20
mov byte [ebp - 0xb7d], 0x20
mov byte [ebp - 0xb7c], 0x20
jmp dword [eax]
mov byte [ebp - 0xb7b], 0x20
mov byte [ebp - 0xb7a], 0x5a
push ebx
and ebx, 0x1575
add ebx, 0x116d0
sub ebx, 0x566c
push esi
add byte [eax], al
or ebx, 0x11128
pop ebx
push ecx
push esi
add esp, 4
add ecx, 0x62bf
sub ecx, 0x4091
sub ecx, 0x683f
pop ecx
mov dword [ebp - 0x1fa4], 0xe
push ebx
push eax
add esp, 4
and ebx, 0x12d17
pop ebx
push edi
push edi
add esp, 4
sub edi, 0x73a3
jae 0x406af2
add byte [ecx + 0x10683c7], al
add byte [edi + 0x57], bl
push ebx
add esp, 4
jmp 0x406b07
or edi, 0xa1f3
pop edi
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xb78]
mov dword [ebp - 0x14bc], eax
push ecx
jmp 0x406b2c
pop ecx
push edi
call 0x406b3e
add byte [edx], dh
cmp eax, dword [ebx + 0x48]
inc esi
dec ebp
xor al, 0x3b
xor al, byte ss:[ebx + 0x5eb04c4]
cmp esi, dword [edx]
cmp al, byte [ebx + 0x34]
pop edi
push ebx
push eax
add esp, 4
sub ebx, 0x13122
pop ebx
mov dword [ebp - 0x1fa8], 0xffffffff
push ecx
sub ecx, 0xb799
and ecx, 0x3960
pop ecx
push ebx
call 0x406b7b
add byte [edx], dh
dec ebx
cmp dh, byte [edi]
inc edx
xor edi, dword [ebx]
add esp, 4
add ebx, 0x1587d
sub ebx, 0x9f7e
sub ebx, 0x6d09
pop ebx
mov ecx, dword [ebp - 0x3c0]
mov dword [ebp - 0x4cc], ecx
jmp 0x406bae
Function at 0x406b7b
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
call dword [edx - 0x3a]
test dword [ecx - 0x4600000c], ecx
mov byte [ebp - 0xb76], 0x10
mov byte [ebp - 0xb75], 0x10
mov byte [ebp - 0xb74], 0x10
mov byte [ebp - 0xb73], 0x10
mov byte [ebp - 0xb72], 0x5a
push edi
push edx
add esp, 4
jmp 0x406a47
add edi, 0x8968
add edi, 0x17a6
sub edi, 0xd72
pop edi
push esi
jmp 0x406a62
or esi, 0x13f52
or esi, 0xdd9
pop esi
mov byte [ebp - 0xb80], 0x52
mov byte [ebp - 0xb7f], 0xb9
mov byte [ebp - 0xb7e], 0x20
mov byte [ebp - 0xb7d], 0x20
mov byte [ebp - 0xb7c], 0x20
jmp dword [eax]
mov byte [ebp - 0xb7b], 0x20
mov byte [ebp - 0xb7a], 0x5a
push ebx
and ebx, 0x1575
add ebx, 0x116d0
sub ebx, 0x566c
push esi
add byte [eax], al
or ebx, 0x11128
pop ebx
push ecx
push esi
add esp, 4
add ecx, 0x62bf
sub ecx, 0x4091
sub ecx, 0x683f
pop ecx
mov dword [ebp - 0x1fa4], 0xe
push ebx
push eax
add esp, 4
and ebx, 0x12d17
pop ebx
push edi
push edi
add esp, 4
sub edi, 0x73a3
jae 0x406af2
add byte [ecx + 0x10683c7], al
add byte [edi + 0x57], bl
push ebx
add esp, 4
jmp 0x406b07
or edi, 0xa1f3
pop edi
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xb78]
mov dword [ebp - 0x14bc], eax
push ecx
jmp 0x406b2c
pop ecx
push edi
call 0x406b3e
add byte [edx], dh
cmp eax, dword [ebx + 0x48]
inc esi
dec ebp
xor al, 0x3b
xor al, byte ss:[ebx + 0x5eb04c4]
cmp esi, dword [edx]
cmp al, byte [ebx + 0x34]
pop edi
push ebx
push eax
add esp, 4
sub ebx, 0x13122
pop ebx
mov dword [ebp - 0x1fa8], 0xffffffff
push ecx
sub ecx, 0xb799
and ecx, 0x3960
pop ecx
push ebx
call 0x406b7b
add byte [edx], dh
dec ebx
cmp dh, byte [edi]
inc edx
xor edi, dword [ebx]
add esp, 4
add ebx, 0x1587d
sub ebx, 0x9f7e
sub ebx, 0x6d09
pop ebx
mov ecx, dword [ebp - 0x3c0]
mov dword [ebp - 0x4cc], ecx
jmp 0x406bae
Function at 0x406fc4
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ebx
mov eax, dword [ebp - 0x4d0]
sub eax, dword [ebp - 0x3c0]
cmp eax, 0xffffffff
jb 0x407010
push ecx
push esi
add esp, 4
call 0x406fea
add byte [edx + 0x34], al
dec ebp
cmp al, byte [edx + 0x46]
add esp, 4
add ecx, 0x1173
pop ecx
push edi
jmp 0x406ffe
invalid
iretd

Function at 0x406fea
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ebx
mov eax, dword [ebp - 0x4d0]
sub eax, dword [ebp - 0x3c0]
cmp eax, 0xffffffff
jb 0x407010
push ecx
push esi
add esp, 4
call 0x406fea
add byte [edx + 0x34], al
dec ebp
cmp al, byte [edx + 0x46]
add esp, 4
add ecx, 0x1173
pop ecx
push edi
jmp 0x406ffe
invalid
iretd

Function at 0x407110
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x4d0]
add edx, 1
mov dword [ebp - 0x4d0], edx
cmp dword [ebp - 0xc10], 0
jle 0x4071e4
push eax
push eax
add esp, 4
or eax, 0x941f
sub eax, 0x15d28
pop eax
push edi
sub edi, 0xf9f0
xor edi, 0xf86d
or edi, 0xea79
pop edi
push edx
push edx
add esp, 4
and edx, 0x1856b
pop edx
mov edx, dword [ebp - 0xa60]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x9f0]
movzx edx, byte [ecx]
cmp eax, edx
je 0x407180
push edx
add edx, 0xcbbe
xor edx, 0x364a
and edx, 0x91e5
pop edx
push ebx
sub ebx, 0x3f03
xor ebx, 0x17b59
call 0x407142
add byte [edi + 0x47], al
dec ebp
inc eax
inc edx
inc esi
dec ebx
add esp, 4
pop ebx
mov eax, dword [ebp - 0xa60]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x9f0]
movzx eax, byte [edx]
cmp ecx, eax
jle 0x407168
mov dword [ebp - 0x14cc], 1
jmp 0x407172
mov dword [ebp - 0x14cc], 0xffffffff
mov ecx, dword [ebp - 0x14cc]
mov dword [ebp - 0xc14], ecx
jmp 0x4071e4
push esi
push ecx
add esp, 4
or esi, 0xf92a
pop esi
push esi
or esi, 0x10f38
pop esi
push edi
push ebx
add esp, 4
add edi, 0x1722
pop edi
push ebx
push esi
add esp, 4
sub ebx, 0x3fe5
sub ebx, 0x14b0f
pop ebx
mov edx, dword [ebp - 0xc10]
sub edx, 1
mov dword [ebp - 0xc10], edx
mov eax, dword [ebp - 0xa60]
add eax, 1
mov dword [ebp - 0xa60], eax
mov ecx, dword [ebp - 0x9f0]
add ecx, 1
mov dword [ebp - 0x9f0], ecx
jmp 0x4070bf
mov edx, dword [ebp - 0xc14]
mov dword [ebp - 0x14d0], edx
cmp dword [ebp - 0x14d0], 0
jne 0x407239
push esi
and esi, 0x3922
xor esi, 0x4879
call 0x407215
add byte [edi + 0x36], cl
xor ecx, dword [edx + edi + 0x36]
inc eax
inc eax
inc esp
add esp, 4
sub esi, 0x4526
pop esi
push ecx
push esi
add esp, 4
and ecx, 0xb952
pop ecx
mov eax, dword [ebp - 0x4d0]
mov dword [ebp - 0xa5c], eax
jmp 0x40727a
jmp 0x406f87
push ecx
push edx
add esp, 4
sub ecx, 0x1754
pop ecx
push edi
add edi, 0x3b5f
add edi, 0xe225
or edi, 0x18460
sub edi, 0xf2b4
pop edi
Function at 0x407142
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x4d0]
add edx, 1
mov dword [ebp - 0x4d0], edx
cmp dword [ebp - 0xc10], 0
jle 0x4071e4
push eax
push eax
add esp, 4
or eax, 0x941f
sub eax, 0x15d28
pop eax
push edi
sub edi, 0xf9f0
xor edi, 0xf86d
or edi, 0xea79
pop edi
push edx
push edx
add esp, 4
and edx, 0x1856b
pop edx
mov edx, dword [ebp - 0xa60]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x9f0]
movzx edx, byte [ecx]
cmp eax, edx
je 0x407180
push edx
add edx, 0xcbbe
xor edx, 0x364a
and edx, 0x91e5
pop edx
push ebx
sub ebx, 0x3f03
xor ebx, 0x17b59
call 0x407142
add byte [edi + 0x47], al
dec ebp
inc eax
inc edx
inc esi
dec ebx
add esp, 4
pop ebx
mov eax, dword [ebp - 0xa60]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x9f0]
movzx eax, byte [edx]
cmp ecx, eax
jle 0x407168
mov dword [ebp - 0x14cc], 1
jmp 0x407172
mov dword [ebp - 0x14cc], 0xffffffff
mov ecx, dword [ebp - 0x14cc]
mov dword [ebp - 0xc14], ecx
jmp 0x4071e4
push esi
push ecx
add esp, 4
or esi, 0xf92a
pop esi
push esi
or esi, 0x10f38
pop esi
push edi
push ebx
add esp, 4
add edi, 0x1722
pop edi
push ebx
push esi
add esp, 4
sub ebx, 0x3fe5
sub ebx, 0x14b0f
pop ebx
mov edx, dword [ebp - 0xc10]
sub edx, 1
mov dword [ebp - 0xc10], edx
mov eax, dword [ebp - 0xa60]
add eax, 1
mov dword [ebp - 0xa60], eax
mov ecx, dword [ebp - 0x9f0]
add ecx, 1
mov dword [ebp - 0x9f0], ecx
jmp 0x4070bf
mov edx, dword [ebp - 0xc14]
mov dword [ebp - 0x14d0], edx
cmp dword [ebp - 0x14d0], 0
jne 0x407239
push esi
and esi, 0x3922
xor esi, 0x4879
call 0x407215
add byte [edi + 0x36], cl
xor ecx, dword [edx + edi + 0x36]
inc eax
inc eax
inc esp
add esp, 4
sub esi, 0x4526
pop esi
push ecx
push esi
add esp, 4
and ecx, 0xb952
pop ecx
mov eax, dword [ebp - 0x4d0]
mov dword [ebp - 0xa5c], eax
jmp 0x40727a
jmp 0x406f87
push ecx
push edx
add esp, 4
sub ecx, 0x1754
pop ecx
push edi
add edi, 0x3b5f
add edi, 0xe225
or edi, 0x18460
sub edi, 0xf2b4
pop edi