joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3c4acf4
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x3c4ad25
mov ecx, dword [0x3c79d48]
mov dl, 1
mov eax, dword [0x3c482b4]
call fcn.03a8d0bc
call fcn.03a69944
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], ebx
inc ebx
jne 0x3c4ad52
mov ecx, dword [0x3c79cac]
mov dl, 1
mov eax, dword [0x3c482b4]
call fcn.03a8d0bc
call fcn.03a69944
xor eax, eax
push ebp
push 0x3c4adce
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xffff
call fcn.03a68858
cmp byte [ebp + 8], 0
je 0x3c4adaa
mov eax, dword [ebp + 0x10]
push eax
movzx eax, word [ebp + 0xc]
push eax
push 1
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.03c4ab10
mov edi, dword [ebp - 4]
lea esi, [ebp - 0x18]
add edi, 0x18
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 4]
call fcn.03c4a4fc
jmp 0x3c4adc4
mov eax, dword [ebp + 0x10]
push eax
movzx eax, word [ebp + 0xc]
push eax
push 0
push 1
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.03c49e9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x3c4adeb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x3c4b000
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.03c4a2ac
xor eax, eax
push ebp
push 0x3c4b176
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x3c4b15e
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
je 0x3c4b04c
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x3c4b056
call fcn.03a69a38
jmp 0x3c4b17d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.03b15bd8
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x1010]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov ecx, 0x1000
mov ebx, dword [eax]
call dword [ebx + 0x18]
mov ebx, eax
test ebx, ebx
jle 0x3c4b153
push 0
push ebx
lea eax, [ebp - 0x1010]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov edi, eax
cmp edi, 0xffffffff
jne 0x3c4b105
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2733
je 0x3c4b0f2
lea eax, [ebp - 0x10]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.03a68858
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
push ebp
call fcn.03c4afb8
pop ecx
mov eax, dword [ebp - 4]
movzx edx, byte [0x3c4b188]
cmp dl, byte [eax + 0x28]
je 0x3c4b15a
call fcn.03a8cf54
jmp 0x3c4b15a
mov eax, dword [ebp - 0xc]
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.03b15bf8
jmp 0x3c4b15a
cmp edi, ebx
jge 0x3c4b121
mov eax, dword [ebp - 0xc]
add eax, edi
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.03b15bf8
jmp 0x3c4b056
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
call dword [edx + 0xc]
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.03b15bd8
cmp edx, dword [esp + 4]
jne 0x3c4b142
cmp eax, dword [esp]
pop edx
pop eax
jne 0x3c4b056
push ebp
call fcn.03c4afb8
pop ecx
jmp 0x3c4b15a
push ebp
call fcn.03c4afb8
pop ecx
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3c4b17d
mov eax, dword [ebp - 4]
call fcn.03c4a2b4
pop eax
jmp eax
movzx eax, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x3c4b1bc
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x3c4b2e4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.03c4a2ac
xor eax, eax
push ebp
push 0x3c4b2c5
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x3c4b20c
call fcn.03a69a38
jmp 0x3c4b2cc
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x3c4b2ad
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x3c4b2ad
lea eax, [ebp - 0xc]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.03a68858
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x3c4b2ad
lea ecx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.03a8b024
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x3c4b300
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x3c79ec8]
mov dl, 1
mov eax, dword [0x3c482b4]
call fcn.03a8d190
call fcn.03a69944
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3c4b2cc
mov eax, dword [ebp - 4]
call fcn.03c4a2b4
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3c4b2eb
lea eax, [ebp - 0x28]
call fcn.03a6a25c
pop eax
jmp eax
Function at 0x3c4b350
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x3c4b4c7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.03c4a2ac
xor eax, eax
push ebp
push 0x3c4b4a8
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp ebx, 0xffffffff
jne 0x3c4b3b5
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x3c4b3b5
lea eax, [ebp - 8]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
jmp 0x3c4b490
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x3c4b3c8
call fcn.03a69a38
jmp 0x3c4b4af
lea eax, [ebp - 0x10]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
test eax, eax
jne 0x3c4b3ef
cmp dword [ebp - 0x10], 0
jle 0x3c4b3ef
cmp ebx, dword [ebp - 0x10]
jle 0x3c4b3ef
mov ebx, dword [ebp - 0x10]
push 0
push ebx
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x3c4b490
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x3c4b490
lea eax, [ebp - 0xc]
push eax
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.03a68858
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x3c4b490
lea ecx, [ebp - 0x2c]
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.03a8b024
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0x11
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
mov eax, 0x3c4b4e4
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0x11
lea eax, [ebp - 0x28]
push eax
push 2
mov ecx, dword [0x3c79ec8]
mov dl, 1
mov eax, dword [0x3c482b4]
call fcn.03a8d190
call fcn.03a69944
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3c4b4af
mov eax, dword [ebp - 4]
call fcn.03c4a2b4
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3c4b4ce
lea eax, [ebp - 0x2c]
call fcn.03a6a25c
pop eax
jmp eax
Function at 0x3c54a48
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x3c54a76
mov eax, ebx
call fcn.03c55504
cmp dword [ebx + 0x40], 0
je 0x3c54a6f
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x3c54ae7
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x3c54ad9
cmp dword [ebx + 8], 0
je 0x3c54a98
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x3c54aaa
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x3c54ad9
cmp dword [ebx + 8], 0
je 0x3c54a8b
cmp eax, 3
je 0x3c54abd
dec eax
jne 0x3c54a8b
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x3c54a8b
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x3c54a8b
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x3c54b05
cmp dword [ebx + 0x14], 0xcc
je 0x3c54b05
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.03c54b10
pop ebx
ret
Function at 0x3c653f8
Capabilities:
Get disk information
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff90
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x50], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x3c6554a
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.03a8861c
fstp qword [ebp - 0x28]
wait
push dword [ebp - 0x24]
push dword [ebp - 0x28]
lea ecx, [ebp - 8]
mov edx, dword [0x3c79e94]
mov eax, 0x3c65568
call fcn.03a895fc
lea eax, [ebp - 4]
mov edx, 0x3c655a4
call fcn.03a6a694
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0x3c655ac
call sub.kernel32.dll_GetVolumeInformationW
test eax, eax
lea eax, [ebp - 0x4c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov esi, dword [ebp - 0xc]
xor esi, 0x12b586fe
mov edi, dword [ebp - 0x34]
xor edi, 0x5d78a569
movzx eax, word [ebp - 0x2c]
and ax, 0xffff
movzx eax, ax
movzx edx, word [ebp - 0x4c]
shl edx, 0x10
or eax, edx
xor eax, 0xf45bc123
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x38]
and eax, 0xffff
movzx edx, word [ebp - 0x2a]
shl edx, 0x10
or eax, edx
xor eax, 0xb542d8e1
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x50]
push eax
mov dword [ebp - 0x70], esi
mov byte [ebp - 0x6c], 0
mov dword [ebp - 0x68], edi
mov byte [ebp - 0x64], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x60], eax
mov byte [ebp - 0x5c], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x58], eax
mov byte [ebp - 0x54], 0
lea edx, [ebp - 0x70]
mov ecx, 3
mov eax, 0x3c655c0
call fcn.03a868c4
mov edx, dword [ebp - 0x50]
lea eax, [ebx + 4]
call fcn.03a6a64c
mov eax, dword [ebx + 4]
call fcn.03c65728
mov eax, 0x3c81dcc
mov edx, dword [ebx + 4]
call fcn.03a6a64c
call fcn.03c655ec
test al, al
jne 0x3c65523
push 0
call sub.kernel32.dll_ExitProcess
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3c65551
lea eax, [ebp - 0x50]
call fcn.03a6a25c
lea eax, [ebp - 8]
mov edx, 2
call fcn.03a6a2bc
pop eax
jmp eax
Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, 0xe4c0a2f
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, str._nTQ
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x544a06c9
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e084
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x412722
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x4186e0], 0
push ebx
push esi
mov esi, 0x4186e8
jne 0x41274e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x418700], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4186e0], 1
push dword [0x418700]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x4127eb
push 0x14
push 8
push dword [0x418068]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x412815
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4186e4]
test eax, eax
je 0x412790
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x4186e4], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x41281a
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x418700]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x418068]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x412815
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8

Function at 0xdd4f06
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0xdd4f0c
pop ebp
sub ebp, 0x10
sub ebp, 0x9d4efc
jmp 0xdd4f22
mov eax, 0x9d4efc
add eax, ebp
add eax, 0x4c
mov ecx, 0x5d8
mov edx, 0x13ba533e
xor byte [eax], dl
inc eax
dec ecx
jne 0xdd4f39
jmp 0xdd4f4c
mov ch, 0xf3
mov ch, 0xb7
add bh, byte [esi]
mov edi, 0x3e3ec6ff
cmp eax, 0x3e3b86f3
test byte ds:[esi], dl
leave
fdivr qword [0x32bfb5f6]
cmp eax, 0x1a5ab3fb
ret 0x3ab7
Function at 0x6d67113f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x6d67114e
pop dword [ebp - 0x38]
mov eax, 0x4c22d495
add eax, 0x21443cb9
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xbbd451b9
add dword [ebp - 0x48], 0x927df392
mov dword [ebp - 0x44], 0xba12d879
sub dword [ebp - 0x44], 0x87df8c34
mov dword [ebp - 0x40], 0xf7702d43
add dword [ebp - 0x40], 0x54dc16eb
mov dword [ebp - 0x3c], 0xf31d249
add dword [ebp - 0x3c], 0xf0ce2db7
lea eax, [ebp - 0x48]
push eax
mov eax, 0x8d7e6484
add eax, 0xdfe8cbc4
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x8f7477b1
add dword [ebp - 0x48], 0xe4fdf1a5
mov dword [ebp - 0x44], 0xea65cbbc
sub dword [ebp - 0x44], 0xa8f96a47
mov dword [ebp - 0x40], 0x204a72d1
sub dword [ebp - 0x40], 0xbcdb0665
mov dword [ebp - 0x3c], 0xc3faf75
sub dword [ebp - 0x3c], 0xc3faf75
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x8eb7fb15
sub eax, 0x2150cb15
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x3bc46
push 0
call eax
mov ecx, 0xf012cec5
sub ecx, 0xf01271b6
xor ebx, ebx
add ebx, eax
mov esi, 0x6d676200
add esi, dword [ebp - 0x38]
mov edx, 0x52bdd6c2
sub dword [ebp - 4], 0xbf55a9dd
mov edi, dword [esi]
xor dword [ebp - 0x30], ecx
sub edi, edx
add dword [ebp - 0x18], edx
mov dword [ebx], edi
add dword [ebp - 0x34], ecx
add ebx, 0x6bfad165
sub ebx, 0x6bfad161
add esi, 4
loop 0x6d671266
add eax, 0x1670f
mov ebx, eax
add eax, 5
mov ecx, 0x4bec6474
sub ecx, 0xde856474
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x6d6717f1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x6d6717fb
repz ret
jmp fcn.6d671b91
Function at 0x40611c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop esi
push edi
push ecx
add esp, 4
sub edi, 0x5e0
pop edi
push edx
xor edx, 0xb733
pop edx
mov ecx, dword [ebp - 0x510]
mov dword [ebp - 0x300], ecx
jmp 0x4061aa

Function at 0x406a7c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp dword [ebp - 0x162c], 0
jne 0x4069f9
push ebx
push edx
add esp, 4
or ebx, 0x1694e
and ebx, 0xefe4
sub ebx, 0x13d73
push esi
add esi, 0x1289e
pop esi
push edx
call 0x406a10
add byte [ebx + 0x44], al
dec edx
push eax
dec edx
aaa
cmp al, 0x83
les eax, [eax + ebp*8]
or dword [eax], eax
add byte [eax], al
add byte [ecx + 0x48], al
inc ebx
inc ebx
cmp eax, 0x834d3f3e
les eax, [ecx + eax*4]
ljmp 0x8b5a
push eax
and eax, 0x87b0
jmp 0x406a6e
call 0x406a7c
add byte [0x45414c36], bh
dec edi
inc edx
xor eax, 0xeb04c483

Function at 0x406ad0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, 0x65
mov word [ebp - 0x17d4], cx
mov edx, 0x6c
mov word [ebp - 0x17d2], dx
mov eax, 0x33
mov word [ebp - 0x17d0], ax
xor al, ch
invalid
invalid
mov ecx, 0x32
mov word [ebp - 0x17ce], cx
mov edx, 0x2e
mov word [ebp - 0x17cc], dx
invalid
add byte fs:[eax], al

Function at 0x406c20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp dword [ebp - 0x1630], 0
jne 0x406c38
mov dword [ebp - 0x768], 0
jmp 0x406edf
mov edx, dword [ebp - 0x1630]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xce0], ecx
push edi
push ebx
add esp, 4
call fcn.00406c5f
add byte [eax + 0x3d], al
inc ebx
dec edi
inc eax
xor edi, dword [edi]
inc esp
dec ebx
dec eax

Function at 0x406c78
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or edi, 0xba0
call 0x406c78
add byte [ecx + 0x3b], al
cmp bh, byte [edi + edi]
inc eax
dec edi
xor eax, 0xc483484f
add al, 0x5f
cmp dword [ebp - 0xce0], 0
jne 0x406c94
mov dword [ebp - 0x768], 0
jmp 0x406edf
mov edx, dword [ebp - 0xce0]
mov dword [ebp - 0x51c], edx
push edi
call 0x406cae
add byte [ecx], bh
dec eax
inc edx
inc esp
inc eax
dec edi
add esp, 4
jmp 0x406cb9
or edi, 0x28df
and edi, 0x11631
pop edi
push ecx
push ebx
add esp, 4
xor ecx, 0xe6ee
add byte [ecx - 0x73], bl
test dword [eax + ebp*8], esp
invalid
dec dword [ecx - 0xcdb7b]
dec dword [ebx - 0x51b73]
dec dword [ebx - 0x6a76cfaf]
sub bl, dh
invalid
push dword [ebx]
shl byte [esi - 0x77], 0x85
loopne 0x406cf1
invalid
push dword [ebx]
leave
mov word [ebp - 0x3c], cx
push eax
xor eax, 0x8787
call 0x406d12
add byte [edx + eax*2 + 0x46], al
inc ecx
xor cl, byte [esi + 0x3c]
dec esi
inc esp
add esp, 4
pop eax
push ebx
push edx
add esp, 4
sub ebx, 0x2780
add ebx, 0x794e
sub ebx, 0xbe3e
pop ebx
mov edx, dword [ebp - 0xcd8]
mov ax, word [edx]
mov word [ebp - 0x1056], ax
mov ecx, dword [ebp - 0xcd8]
add ecx, 2
mov dword [ebp - 0xcd8], ecx
invalid
invalid
xchg ebp, eax
Function at 0x406cae
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or edi, 0xba0
call 0x406c78
add byte [ecx + 0x3b], al
cmp bh, byte [edi + edi]
inc eax
dec edi
xor eax, 0xc483484f
add al, 0x5f
cmp dword [ebp - 0xce0], 0
jne 0x406c94
mov dword [ebp - 0x768], 0
jmp 0x406edf
mov edx, dword [ebp - 0xce0]
mov dword [ebp - 0x51c], edx
push edi
call 0x406cae
add byte [ecx], bh
dec eax
inc edx
inc esp
inc eax
dec edi
add esp, 4
jmp 0x406cb9
or edi, 0x28df
and edi, 0x11631
pop edi
push ecx
push ebx
add esp, 4
xor ecx, 0xe6ee
add byte [ecx - 0x73], bl
test dword [eax + ebp*8], esp
invalid
dec dword [ecx - 0xcdb7b]
dec dword [ebx - 0x51b73]
dec dword [ebx - 0x6a76cfaf]
sub bl, dh
invalid
push dword [ebx]
shl byte [esi - 0x77], 0x85
loopne 0x406cf1
invalid
push dword [ebx]
leave
mov word [ebp - 0x3c], cx
push eax
xor eax, 0x8787
call 0x406d12
add byte [edx + eax*2 + 0x46], al
inc ecx
xor cl, byte [esi + 0x3c]
dec esi
inc esp
add esp, 4
pop eax
push ebx
push edx
add esp, 4
sub ebx, 0x2780
add ebx, 0x794e
sub ebx, 0xbe3e
pop ebx
mov edx, dword [ebp - 0xcd8]
mov ax, word [edx]
mov word [ebp - 0x1056], ax
mov ecx, dword [ebp - 0xcd8]
add ecx, 2
mov dword [ebp - 0xcd8], ecx
invalid
invalid
xchg ebp, eax

Function at 0x406d12
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or edi, 0xba0
call 0x406c78
add byte [ecx + 0x3b], al
cmp bh, byte [edi + edi]
inc eax
dec edi
xor eax, 0xc483484f
add al, 0x5f
cmp dword [ebp - 0xce0], 0
jne 0x406c94
mov dword [ebp - 0x768], 0
jmp 0x406edf
mov edx, dword [ebp - 0xce0]
mov dword [ebp - 0x51c], edx
push edi
call 0x406cae
add byte [ecx], bh
dec eax
inc edx
inc esp
inc eax
dec edi
add esp, 4
jmp 0x406cb9
or edi, 0x28df
and edi, 0x11631
pop edi
push ecx
push ebx
add esp, 4
xor ecx, 0xe6ee
add byte [ecx - 0x73], bl
test dword [eax + ebp*8], esp
invalid
dec dword [ecx - 0xcdb7b]
dec dword [ebx - 0x51b73]
dec dword [ebx - 0x6a76cfaf]
sub bl, dh
invalid
push dword [ebx]
shl byte [esi - 0x77], 0x85
loopne 0x406cf1
invalid
push dword [ebx]
leave
mov word [ebp - 0x3c], cx
push eax
xor eax, 0x8787
call 0x406d12
add byte [edx + eax*2 + 0x46], al
inc ecx
xor cl, byte [esi + 0x3c]
dec esi
inc esp
add esp, 4
pop eax
push ebx
push edx
add esp, 4
sub ebx, 0x2780
add ebx, 0x794e
sub ebx, 0xbe3e
pop ebx
mov edx, dword [ebp - 0xcd8]
mov ax, word [edx]
mov word [ebp - 0x1056], ax
mov ecx, dword [ebp - 0xcd8]
add ecx, 2
mov dword [ebp - 0xcd8], ecx
invalid
invalid
xchg ebp, eax
Function at 0x406e20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
mov ecx, dword [ebp - 0x1634]
mov dword [ebp - 0x1680], ecx
cmp dword [ebp - 0x1680], 0
jne 0x406e77
push ebx
push edx
add esp, 4
or ebx, 0x3364
add byte [eax], al
pop ebx
push edx
and edx, 0x1104b
xor edx, 0x55cd
and edx, 0x22c
pop edx
push ebx
push eax
add esp, 4
or ebx, 0x124fc
add ebx, 0x1613b
pop ebx
mov edx, dword [ebp - 0x51c]
mov dword [ebp - 0x768], edx
jmp 0x406edf
push eax
push edx
add esp, 4
and eax, 0x1088e
or eax, 0x3915
and eax, 0xef7b
pop eax
push edx
call 0x406e9d
add byte [ebp + 0x3a], al
xor cl, byte [edx + edi + 0x42]
xor al, 0x83
les eax, [edx + ebx*2]
push esi
or esi, 0x4d44
pop esi
mov eax, dword [ebp - 0x51c]
mov ecx, dword [eax]
mov dword [ebp - 0x51c], ecx
mov edx, dword [ebp - 0x51c]
cmp edx, dword [ebp - 0xce0]
je 0x406ed5
mov eax, dword [ebp - 0x51c]
cmp dword [eax + 0x30], 0
jne 0x406ca0
mov dword [ebp - 0x768], 0
push edi
push edx
add esp, 4
add edi, 0x3481
call 0x406ef6
add byte [esi + 0x3a], cl
inc edx
xor eax, 0xc483503f
add al, 0xe8
or dword [eax], eax
add byte [eax], al
add byte [edi + 0x4c], al
dec edx
dec ebx
aaa
aas
xor dh, byte [ebx + eax*4]
les eax, [ecx + eax*4]
idiv esp
or al, byte [eax]
add byte [edi - 0x7d], bl
mov ebp, 0xfffff898
add byte [ebp + 0x41], dh
push ecx
push esi
add esp, 4
sub ecx, 0xe702
jmp 0x415627
pop ecx
push eax
add eax, 0xe408
jmp 0x406f33
or eax, 0xbc21
add eax, 0x1165b
pop eax
push edx
push edi
add esp, 4
and edx, 0x14516
pop edx
mov dword [ebp - 0xac0], 0
invalid
inc dword [eax]
add byte [eax], al
add cl, ch
sub byte [ebx], cl
add byte [eax], al