joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44b610
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0xb0
mov al, byte [0x660049]
mov cl, byte [0x660048]
xor cl, al
push esi
mov byte [0x660048], cl
mov cl, byte [0x660043]
or cl, 8
mov esi, dword [esp + 0xb8]
shr cl, 3
and ecx, 0xff
push 5
mov dword [esp + 8], ecx
fild dword [esp + 8]
fdivr qword [0x663960]
fadd qword [0x660050]
fstp qword [0x663950]
mov dword [esi], 0
call dword [sym.imp.USER32.dll_GetSysColor]
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x44b67e
or dword [esi], 0x4000000
mov al, byte [0x660046]
mov dl, byte [0x660045]
xor al, dl
mov byte [0x660046], al
or al, 0x30
shr al, 4
and eax, 0xff
mov dword [esp + 4], eax
fild dword [esp + 4]
fdivr qword [0x6639c0]
fstp qword [0x663950]
fld qword [0x660050]
fadd qword [0x663960]
fstp qword [0x663960]
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov eax, esi
pop esi
add esp, 0xb0
ret

Function at 0x4559c5
Capabilities:
Encode data using xor

Disassembly:
fucompi st(6)
and dword [eax - 0x263bf154], eax
sub dword [eax - 2], 0xffffff9f
xor al, 0x18
rcl dword [eax], 0xb5
lea esi, es:[eax - 0x380ed224]
and dword [ebx], ecx
xchg byte [ecx - 0x67a275b8], dh
dec eax
mov bl, byte [ebp - 0x68]
push es
ljmp 0x6916
mov eax, 0x3db21821
cld
xor eax, 0xdf066059
dec edi
fcomp st(0)
leave
mov dl, 0xb0
jae 0x455965
movsb byte es:[edi], byte [esi]
mov ecx, 0x88af9440
add byte [edx], bh
xor ebp, dword [ebx - 0x572c6531]
jbe 0x455918
mov dh, 0x2a
in eax, 0xe
cmc
jmp 0x4559c6
jg 0x455934
dec ebx
leave
jl 0x45595f
inc esi
inc esp
mov ebx, 0x5d30e124
fmul qword [ebp + 0x69fcf22b]
inc esi
mov al, 0xba
or ch, byte [edx + 0x22]
cld
loope 0x4559ab
in al, 0xe1
add al, 0x6e
loope 0x4559cd
outsb dx, byte [esi]
out dx, al
lodsb al, byte [esi]
nop
cmpsd dword [esi], dword es:[edi]
mov ebp, 0x6a2151c6
mov ebp, 0xb6a401b5
in al, 0xeb
test eax, 0x8f8a1670
test al, 0x9b
cmp eax, 0x81dc78d1
leave
ljmp 0xf994
Function at 0x46c546
Capabilities:
Encode data using xor

Disassembly:
lds eax, [esi + 0x237de9e1]
test eax, 0x9dace89a
xlatb
sbb byte [ecx + 0x62bc07eb], bl
sbb byte [edx], cl
aas
aad 0x59
cmp cl, byte [edx + 0x23242e74]
and bl, byte [edx + 0x3a6ba7dd]
mov ebx, 0x5c3db4ab
mov ah, 0x3d
pop esp
add eax, 0x5c68a359
rcl byte [ebx - 0x9f3d1fc], cl
xor eax, 0xc50234bf
mov ah, 0x1c
mov eax, dword [0xfe0e9d38]
dec esp
invalid
cmp byte [ebp - 0x71b301f2], bl
cld
and esp, eax
ficom word [eax + 0x11]
or byte [esi], dh
push eax
and byte [esi + 0x20b47f42], cl
and esp, ecx
jae 0x46c51a
mov bl, 0xa1
shr byte [eax], 0x9d
popfd
popfd
mov byte [edi + 0x1eacc776], dh
fstp dword [ecx + 0x45144922]
push ebx
jne 0x46c4ed
push edi
and byte [eax + esi*8], al
and al, 0x32
pop ebp
cmp dword [0x95b4b8d0], 0x3a
shr bh, 1
pop ss
pop eax
inc esp
js 0x46c542
je 0x46c530
enter 0x18c4, 0x4b
scasb al, byte es:[edi]
aam 0x94
push edx
out dx, eax
cmp ebx, dword [ebx + 0x36]
js 0x46c512
pop ecx
sbb eax, 0xf5cd1ad5
sub byte [eax + 0x23], dl
rcr byte [eax], 1
aas
pop es
mov edx, edi
adc dword [eax - 0xd], esp
out 0xa9, al
pop ebp
dec eax
js 0x46c529
inc edi
pop ecx
xchg ebp, ecx
or dl, byte [ebp + 0x3d6ea309]
xchg edx, eax
xor ah, ch
pop ebx
or ebp, ecx
mov eax, 0xe417f338
inc edx
hlt

Function at 0x48943e
Capabilities:
Encode data using xor

Disassembly:
sub dword [ecx - 0xf478899], esp
or eax, 0xe5eceae9
salc
or ah, 0x58
or dword [esp + edx*8 - 0x14], esi
mov ebp, ss
xchg dword [eax], edi
jne 0x4893f6
and byte [edx + 0x45], ah
or dl, byte [eax + esi + 0x45ac2966]
xchg esp, eax
xor byte [esi + 0x29], ah
lodsb al, byte [esi]
inc ebp
adc esp, dword [ebp + 0x21]
inc esp
cmpsb byte [esi], byte es:[edi]
shr byte [ebp + 0x5d29a311], 0x3a
out 0x5a, al
mov ebp, edi
cmpsd dword [esi], dword es:[edi]
adc cl, bl
wait
push esp
inc ebx
xchg esp, eax
or ebx, dword [esi - 3]
pop esi
std
adc al, 0x88
push 0x6a
jb 0x4893d9
ror esp, cl
xchg dword [esi], ebx
jbe 0x489430
in al, dx
sub esi, esi
std
dec ebx
invalid
xor ah, byte [edx + 0x32]
inc byte [ecx*8 - 0x238922b1]
xor bh, dh
add al, 0xcd
dec edi
fnsave dword [esi - 0x24]
imul al
and ebp, edi
dec edi
or ah, dl
aam 0xe8
lcall 0xcd09, 0x5688d52b
aam 0xe8
lcall 0xcd09, 0x5688d52b
sbb eax, 0x2da37aa8
ror byte [ebx + 0x25], 1
mov bh, 0xa2
mov ecx, 0x28bc7a57
inc esi
mov edi, 0xd895ecf0
jle 0x489414
mov ch, pe_nt_image_headers32
out dx, al
cdq
les esi, [ebx + 0x29df91c6]
jg 0x48940c
imul ebp, dword [ecx - 0x65], 0x6b
adc al, 0x75
xchg ecx, eax
xchg ebx, eax
push esi
mov eax, 0x1c7a6354
and byte [edi], dl
pop ds
salc
xchg esp, ebx
jno 0x48942e
or al, 0x36
fmul st(2)
add cl, al
xor ebp, ebp
mov word [ebx - 0x6c], fs
outsb dx, byte [esi]
test byte [edi], dh
dec eax
mov edx, 0x56fb0e7e
inc edi
xor byte [edi + 0x1dca5e69], 0xbd
inc esp
loopne 0x489491
or ebx, edx
push eax
invalid
Function at 0x62c9d6
Capabilities:
Encode data using xor

Disassembly:
pop ebx
mov cl, 0xcb
rcr dword [ebp*8 + 0x712e55d2], 1
fadd dword [ebp + 0x2bfdf895]
outsd dx, dword [esi]
mov esp, 0x5cca0096
mov esp, 0x4131c6de
sar dword [edx - 0x15], cl
xlatb
lahf
jg 0x62ca16
fiadd word [edi - 0x40]
jne 0x62ca34
lahf
in eax, dx
xchg dl, bh
push ebp
rol byte [ecx], 0xe6
cmp bl, bh
xchg dword es:[esi + eax*4], ecx
mov eax, dword [0x8a67e9a0]
push eax
ljmp 0x939f
pushfd
lahf
xchg ebx, eax
out dx, al
xchg ebp, eax
adc cl, bl
scasd eax, dword es:[edi]
scasd eax, dword es:[edi]
cdq
xchg edx, eax
adc byte [edx], ah
invalid
mov esp, 0x93ac1c49
xor bh, byte [esi + 0x7920c9dc]
and eax, edi
call 0x5124871f
push eax
in al, 0xe0
push esi
wait
xchg ebx, eax
sbb bh, 0xc0
xor esp, dword [edx]
sar byte [edx + 0x3c], 0xb9
inc edx
and byte [esi + esi*2 + 0x556cdabb], ah
les eax, [esi + edi*2]
push ds
sbb edi, edx
loope 0x62ca45
ja 0x62ca1e
inc ebp
push 0x1ae68faf
mov ebp, 0xa8c25866
movsd dword es:[edi], dword fs:[esi]
add byte [ebp - 0x25], 0xea
inc edx
test eax, 0x298096a2
xchg ebp, eax
cmp al, 0x56
int3

Function at 0x6579fd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x660398
cmp edx, dword [eax]
je 0x657a1f
add eax, 8
inc ecx
cmp eax, 0x660428
jl 0x657a10
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x660398]
jne 0x657b4d
mov eax, dword [0xa5cd74]
cmp eax, 1
je 0x657b27
test eax, eax
jne 0x657a50
cmp dword [0x6602c4], 1
je 0x657b27
cmp edx, 0xfc
je 0x657b4d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x657a87
lea eax, [ebp - 0x1a4]
push 0x65caa8
push eax
call fcn.006583e0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00658870
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x657aca
lea eax, [ebp - 0x1a4]
push eax
call fcn.00658870
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65caa4
push edi
call fcn.0065a740
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x65ca88
push eax
call fcn.006583e0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.006583f0
lea eax, [ebp - 0xa0]
push 0x65ca84
push eax
call fcn.006583f0
push dword [esi + 0x66039c]
lea eax, [ebp - 0xa0]
push eax
call fcn.006583f0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x65ca5c
push eax
call fcn.0065a6b4
add esp, 0x2c
pop edi
jmp 0x657b4d
lea eax, [ebp + 8]
lea esi, [esi + 0x66039c]
push 0
push eax
push dword [esi]
call fcn.00658870
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x20083700
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x200d12c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov ebx, ecx
push edi
mov dword [esp + 0xc], ebx
call fcn.200836c0
xor eax, eax
lea edi, [ebx + 0xc]
mov ecx, 6
mov esi, 0x200da488
mov dword [ebx], 0x200d72e0
mov dword [ebx + 8], eax
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov dword [esp + 0x18], eax
mov dword [ebx + 0x24], eax
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x38], eax
mov dword [ebx + 0x3c], eax
mov dword [ebx + 0x34], eax
call fcn.200839f0
mov ecx, dword [esp + 0x10]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x20094380
Capabilities:
Delete file
Get common file path

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x200d1b65
push eax
mov dword fs:[0], esp
sub esp, 0x118
lea eax, [esp + 0x14]
push ebp
push esi
push edi
push eax
mov edi, ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp + 0x20]
xor ebp, ebp
push ecx
push ebp
lea edx, [esp + 0x28]
push 0x200e91e0
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea esi, [edi + 0x24c]
mov ecx, esi
call fcn.2009e700
cmp eax, 3
jne 0x20094405
push 2
mov ecx, esi
call fcn.2009df80
lea eax, [esp + 0x20]
lea ecx, [edi + 0x1ec]
push eax
push ebp
push 3
push ebp
push ebp
push ebp
push ebp
call fcn.200a83c0
push 3
mov ecx, esi
call fcn.2009df80
jmp 0x2009441c
lea ecx, [esp + 0x20]
push ecx
push ebp
push 3
push ebp
push ebp
push ebp
push ebp
lea ecx, [edi + 0x1ec]
call fcn.200a83c0
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.GDI32.dll_GetMetaFileA]
cmp eax, ebp
mov dword [esp + 0x14], eax
je 0x20094508
push ebx
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], 0x200da288
mov edi, dword [esp + 0x13c]
mov dword [esp + 0x130], ebp
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
mov edx, dword [edi + 4]
mov esi, dword [edi]
push eax
push ecx
push edx
push esi
call dword [sym.imp.GDI32.dll_CreateRectRgn]
push eax
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CGdiObject::Attach
mov esi, dword [esp + 0x138]
mov ecx, esi
mov eax, dword [esi]
call dword [eax + 0x24]
mov edx, dword [esi]
push 8
mov ecx, esi
mov ebx, eax
call dword [edx + 0x3c]
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 4]
mov edx, dword [edi]
sub eax, ecx
mov ecx, dword [edi + 8]
push eax
sub ecx, edx
mov edx, dword [esi]
lea eax, [esp + 0x20]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x48]
mov eax, dword [edi + 4]
mov ecx, dword [edi]
mov edx, dword [esi]
push eax
lea eax, [esp + 0x20]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x40]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call sub.MFC42.DLL_CDC::SelectObject
cmp esi, ebp
je 0x200944c9
mov ebp, dword [esi + 4]
mov edi, dword [esp + 0x18]
push 1
push 0x20096f20
push edi
push ebp
call dword [sym.imp.GDI32.dll_EnumMetaFile]
mov edx, dword [esi]
push ebx
mov ecx, esi
call dword [edx + 0x28]
push edi
call dword [sym.imp.GDI32.dll_DeleteMetaFile]
mov dword [esp + 0x10], 0x200da274
lea ecx, [esp + 0x10]
mov dword [esp + 0x130], 1
call sub.MFC42.DLL_CGdiObject::DeleteObject
pop ebx
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [esp + 0x124]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x124
ret 8
Function at 0x20095750
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x200d1bef
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebp
push esi
xor esi, esi
push edi
lea ecx, [esp + 0xc]
mov dword [esp + 0x10], esi
call sub.MFC42.DLL_CString::CString
mov ebp, dword [esp + 0x3c]
mov dword [esp + 0x30], 1
mov ecx, ebp
call fcn.2009b0d0
mov edi, eax
dec edi
js 0x200957d4
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_sprintf]
push esi
mov ecx, ebp
call fcn.200a8f50
push eax
lea eax, [esp + 0x1c]
push 0x200e9214
push eax
call ebx
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::operator_1
cmp esi, edi
jge 0x200957ce
push 0x7e
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::operator
inc esi
cmp esi, edi
jle 0x20095799
pop ebx
mov esi, dword [esp + 0x38]
lea edx, [esp + 0xc]
push edx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_1
mov dword [esp + 0x10], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 0
call fcn.200cd6be
mov ecx, dword [esp + 0x28]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x28
ret 8

Function at 0x200958d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x200d1c49
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
xor esi, esi
push edi
lea ecx, [esp + 0xc]
mov dword [esp + 0x10], esi
call sub.MFC42.DLL_CString::CString
mov ebx, dword [ebp + 0xc]
mov dword [esp + 0x30], 1
mov ecx, ebx
call fcn.2009b0d0
mov edi, eax
dec edi
js 0x2009595a
push esi
mov ecx, ebx
call fcn.200a8700
sub esp, 8
lea eax, [esp + 0x1c]
fstp qword [esp]
push 0x200e9218
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::operator_1
cmp esi, edi
jge 0x20095955
push 0x7e
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::operator
inc esi
cmp esi, edi
jle 0x20095917
mov esi, dword [ebp + 8]
lea edx, [esp + 0xc]
push edx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_1
mov dword [esp + 0x10], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 0
call fcn.200cd6be
mov ecx, dword [esp + 0x28]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x20097c60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [ecx + 0x54]
jmp 0x20099650
sahf
sub eax, 0x119f45c6

Function at 0x20097c70
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
mov ebx, ecx
push 0x11
mov dword [esp + 0x1c], ebx
call esi
test ax, ax
jl 0x20097d76
push 0x10
call esi
mov esi, dword [sym.imp.USER32.dll_GetFocus]
xor ecx, ecx
test ax, ax
setl cl
push 0
mov edi, ecx
push 0
push 0x87
mov dword [esp + 0x20], edi
call esi
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
test al, 6
jne 0x20097d76
call esi
mov edx, dword [ebx + 0x20]
mov esi, eax
push esi
push edx
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x20097d76
mov ebx, dword [sym.imp.USER32.dll_GetParent]
mov ebp, dword [sym.imp.USER32.dll_GetClassNameA]
xor eax, eax
test edi, edi
setne al
add eax, 2
mov dword [esp + 0x10], eax
push esi
call ebx
lea ecx, [esp + 0x1c]
mov edi, eax
push 0xa
push ecx
push edi
call ebp
lea edx, [esp + 0x1c]
push str.combobox
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x20097d1e
mov eax, dword [esp + 0x10]
push eax
push edi
jmp 0x20097d24
mov ecx, dword [esp + 0x10]
push ecx
push esi
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
test esi, esi
je 0x20097d47
push 0xfffffffffffffff0
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
and eax, 0x8010000
cmp eax, 0x10000
je 0x20097d76
jmp 0x20097cf3
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
push edx
mov edx, dword [eax + 0x54]
mov ecx, dword [eax + 0x20]
push ecx
mov eax, dword [edx + 0x20]
push eax
call dword [sym.imp.USER32.dll_GetNextDlgTabItem]
push eax
call fcn.20097d90
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x18
ret 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 4

Function at 0x20097ed0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
push 5
mov eax, dword [edi + 0x44]
push eax
call sub.MFC42.DLL_AfxFindResourceHandle
mov ecx, dword [edi + 0x44]
mov esi, eax
push 5
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, dword [sym.imp.MSVCRT.dll_wcslen]
mov esi, eax
add esi, 0x12
cmp word [esi], 0xffff
jne 0x20097f17
mov eax, 2
jmp 0x20097f1e
push esi
call ebx
add esp, 4
inc eax
cmp word [esi + eax*2], 0xffff
lea esi, [esi + eax*2]
jne 0x20097f3e
mov eax, 2
lea ecx, [edi + 0x60]
lea edx, [esi + eax*2]
push edx
call fcn.200cd784
pop edi
pop esi
pop ebx
ret
push esi
call ebx
add esp, 4
inc eax
lea ecx, [edi + 0x60]
lea edx, [esi + eax*2]
push edx
call fcn.200cd784
pop edi
pop esi
pop ebx
ret
Function at 0x20099550
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sal byte [esi + eax - 1], cl
test dword [edi + edi*8 - 1], esi
dec dword [edi]
scasd eax, dword es:[edi]
lea esi, [edi + edi*8 - 1]
dec dword [ecx + 0x5d880c4d]
ror byte [eax + 0x45c6c15d], 0xc2
in al, dx
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.2009926b
push esp
or byte [eax + 0x2a], dh
lea eax, [ebp - 0x40]
push eax
call fcn.2009927b
push eax
push esi
push dword [ebp + 8]
call fcn.20099230
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.2009926b
aad 0xdb

Function at 0x200995d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xor eax, 0xe8458d9c
mov byte [ebp - 0x18], bl
push eax
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.2009927b
push eax
push esi
push dword [ebp + 8]
call fcn.20099230
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.2009927b
push eax
push esi
push dword [ebp + 8]
call fcn.20099230
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.2009927b
push eax
push esi
push dword [ebp + 8]
call fcn.20099230
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.2009926b
cmp bl, byte [edx - 0x62779520]
jl 0x200996f0
invalid
invalid
Function at 0x20099940
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x20099942
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x20099960
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x200999be
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x200999a5
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x200999ae
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x200999b8
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x2009999a
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x20099924
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x20099a0b
dec eax
je 0x20099a02
sub eax, 3
je 0x200999f9
mov dword [ebp - 4], 0x40
jmp 0x20099a28
mov dword [ebp - 4], 4
jmp 0x20099a0e
mov dword [ebp - 4], 0x20
jmp 0x20099a0e
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x20099a5a
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x200999da
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.2009926b
and ebx, esi
dec byte [edx + 0x6a1475ff]
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x20099a66
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x200c6e10
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x200d5560
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov eax, dword [esp + 0x3c]
push ebx
push ebp
push esi
mov esi, ecx
push edi
push eax
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString_3
xor ebx, ebx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x44], ebx
call sub.MFC42.DLL_CDC::CDC
push ebx
mov byte [esp + 0x48], 1
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0x30]
call sub.MFC42.DLL_CDC::Attach
cmp eax, ebx
je 0x200c6f8e
mov ecx, dword [esp + 0x34]
push 0x5a
push ecx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov ebp, dword [sym.imp.KERNEL32.dll_MulDiv]
push 0x48
push eax
push 8
call ebp
push str.MS_Sans_Serif
push 0x22
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x190
push ebx
push ebx
neg eax
push ebx
push eax
lea edi, [esi + 0x4c]
call dword [sym.imp.GDI32.dll_CreateFontA]
push eax
mov ecx, edi
call sub.MFC42.DLL_CGdiObject::Attach
cmp eax, ebx
je 0x200c6f8e
push edi
lea ecx, [esp + 0x30]
call sub.MFC42.DLL_CDC::SelectObject_2
mov edi, eax
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
mov ecx, dword [eax - 8]
push edx
push ecx
push eax
mov eax, dword [esp + 0x40]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
push edi
lea ecx, [esp + 0x30]
call sub.MFC42.DLL_CDC::SelectObject_2
mov edi, dword [esp + 0x50]
lea ecx, [esp + 0x54]
push ecx
mov edx, dword [edi + 0x20]
push edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
add ecx, eax
mov eax, dword [esp + 0x58]
push 0x64
add edx, eax
push 0x43
push 0xe
mov dword [esp + 0x30], ecx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x34], edx
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push eax
call ebp
push eax
lea eax, [esp + 0x20]
push ebx
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
mov ecx, dword [esi + 0x44]
mov eax, dword [esi + 0x40]
push ecx
lea ecx, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.USER32.dll_InflateRect]
mov edx, dword [esp + 0x5c]
cmp edi, ebx
mov dword [esi + 0x48], edx
jne 0x200c6f59
xor edi, edi
jmp 0x200c6f5c
mov edi, dword [edi + 0x20]
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov ebp, dword [esp + 0x1c]
push ebx
sub eax, edx
push ebx
sub ecx, ebp
push edi
push eax
mov eax, dword [esp + 0x5c]
push ecx
push edx
push ebp
push 0x88800000
push eax
push ebx
push ebx
mov ecx, esi
call sub.MFC42.DLL_CWnd::CreateEx
test eax, eax
jne 0x200c6fb0
lea ecx, [esp + 0x2c]
mov byte [esp + 0x44], bl
call fcn.200cdd66
lea ecx, [esp + 0x10]
mov dword [esp + 0x44], 0xffffffff
call fcn.200cd6be
xor eax, eax
jmp 0x200c6fdc
push 8
mov ecx, esi
call sub.MFC42.DLL_CWnd::ShowWindow
lea ecx, [esp + 0x2c]
mov byte [esp + 0x44], bl
call fcn.200cdd66
lea ecx, [esp + 0x10]
mov dword [esp + 0x44], 0xffffffff
call fcn.200cd6be
mov eax, 1
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret 0x14