joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43d0f0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x47c6a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
lea eax, [esp + 0xc]
mov ecx, dword [esi + 0x1c]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
push 0
lea ecx, [esp + 0x20]
call fcn.004750cb
mov eax, dword [esi + 0xd0]
lea edx, [esp + 0x1c]
push eax
push eax
push edx
mov dword [esp + 0x44], 0
call fcn.0043ca90
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x48]
add eax, 0x64
add esp, 0xc
add ecx, 0x64
mov dword [esp + 8], eax
lea eax, [esp + 4]
mov dword [esp + 4], ecx
push eax
lea ecx, [esp + 0x20]
call fcn.00474ff9
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
push 1
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
lea eax, [edx + ecx + 1]
xor edx, edx
test eax, eax
setl dl
dec edx
mov ecx, esi
and eax, edx
push eax
push 0
push 0
call fcn.004718b4
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 8]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
xor ecx, ecx
sar edx, 4
mov eax, edx
push 1
shr eax, 0x1f
lea eax, [edx + eax + 1]
test eax, eax
setl cl
dec ecx
and eax, ecx
mov ecx, esi
push eax
push 0
push 1
call fcn.004718b4
push 1
push 0
push 0
mov ecx, esi
call fcn.0047185c
push 1
push 0
push 1
mov ecx, esi
call fcn.0047185c
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.0047513d
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret

Function at 0x43d270
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x47c6c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0x20]
call fcn.004750cb
push 0x3e8
lea eax, [esp + 0x20]
push 0x3e8
push eax
mov dword [esp + 0x44], 0
call fcn.0043ca90
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x4c]
add ecx, 0x64
add esp, 0xc
mov dword [esp + 4], ecx
lea ecx, [esp + 4]
add eax, 0x96
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], eax
call fcn.00474ff9
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, eax
mov eax, dword [esp + 0x14]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 4]
cmp dword [esp + 0x44], 1
jne 0x43d334
cmp dword [esp + 0x40], 1
jne 0x43d332
cmp ecx, eax
jge 0x43d334
mov eax, ecx
cmp eax, 0xc8
jge 0x43d340
mov eax, 0xc8
mov ecx, esi
mov dword [esi + 0xd0], eax
call fcn.0043d0f0
mov ecx, dword [esi + 0x1c]
push 1
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.0047513d
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret 8
Function at 0x43dac0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x47c733
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0046fcd4
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.00475373
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.0047688f
test eax, eax
je 0x43dbdc
mov ecx, dword [esp + 0x3c]
call fcn.004753a0
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x43dba0
push edi
mov ecx, esi
call fcn.004729ff
mov ecx, esi
call fcn.0043dd40
cmp dword [esp + 0x38], 1
jne 0x43dbd5
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.00472b3a
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x440600
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x440633
push esi
call fcn.004436f0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x44062c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x4406b9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x4406a2
mov eax, dword [esi + 8]
test eax, eax
je 0x440657
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x44069e
cmp eax, 2
je 0x4406a2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x44064a
cmp eax, 3
je 0x44067d
cmp eax, 1
jne 0x44064a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x44064a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x44064a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.004406e0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x4406c8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.004406e0
add esp, 4
pop esi
ret

Function at 0x44ba70
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x44bad6
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x44bad6
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x44bab7
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x44be60
Capabilities:
Create http request

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x44be98
mov edx, dword [esi + 4]
xor eax, eax
push 0
push 0
mov ecx, dword [edx - 8]
test ecx, ecx
setne al
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edx
neg eax
sbb eax, eax
push ecx
and eax, 2
inc eax
push eax
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.0_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi], eax
mov ecx, dword [esi]
xor eax, eax
test ecx, ecx
setne al
pop esi
ret
Function at 0x44cb10
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x44cb59
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x44cfd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x47cc30
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.0044cb80
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.0044cc00
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.0044cc00
lea ecx, [esi + 0xc]
call fcn.0046e6b1
lea ecx, [esi + 0x10]
call fcn.0046e6b1
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.0044e190
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.0044e190
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.0044e190
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.0046e726
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.0046e726
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x44f120
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x44f1c3
test eax, eax
jbe 0x44f1c3
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x44f1c3
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x44f16e
xor esi, esi
jmp 0x44f174
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x44f19f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.004053f0
add esi, eax
push esi
mov ebx, esi
call fcn.004053f0
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x44f180
pop ebp
test edi, edi
pop edi
jne 0x44f1c3
test ebx, ebx
je 0x44f1c3
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.0045e650
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc

Function at 0x44f305
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x44f41d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x44f41d
mov eax, dword [esi + 0x3c]
push eax
call fcn.00470126
mov esi, eax
test esi, esi
je 0x44f41d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x44f41d
mov ecx, esi
call fcn.0044f270
cmp edi, eax
jge 0x44f41d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x44f3a3
mov dword [esp + 0x34], 1
jmp 0x44f3fe
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x44f41d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.0044e7f0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc
Function at 0x454140
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x10
lea eax, [esp]
push esi
mov esi, dword [esp + 0x18]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [esi]
push edx
call dword [sym.imp.USER32.dll_GetWindowDC]
push eax
mov dword [esi + 4], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 1
push eax
mov dword [esi + 8], eax
call dword [sym.imp.GDI32.dll_SetBkMode]
mov eax, dword [esi + 0x10]
test eax, eax
je 0x45418a
push eax
mov eax, dword [esi + 8]
mov dword [esi + 0x18], 0
push eax
jmp 0x4541b9
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
sub ecx, eax
mov eax, dword [esi + 4]
push ecx
mov ecx, dword [esp + 8]
mov dword [esi + 0x18], 1
sub edx, ecx
push edx
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ecx, dword [esi + 8]
push eax
mov dword [esi + 0x10], eax
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0xc]
cmp eax, 1
jne 0x4541fb
mov edx, dword [esi + 4]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push 0xcc0020
push 0
push 0
push edx
mov edx, dword [esp + 0x18]
sub eax, edx
mov edx, dword [esp + 0x14]
sub ecx, edx
mov edx, dword [esi + 8]
push eax
push ecx
push 0
push 0
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esi + 8]
pop esi
add esp, 0x10
ret 4
Function at 0x470aca
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x470b02
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0046eb81
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0046eb59
jmp 0x470b0e
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4721bc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4721fe
call fcn.00477f35
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4721fe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4721f5
xor eax, eax
jmp 0x472206
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0047220c
pop edi
pop esi
pop ebx
ret 4

Function at 0x478465
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x478493
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4784b1
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004783cb
jmp 0x4784b1
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4784b1
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004783cb
test edi, edi
mov eax, edi
jne 0x47849b
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4762fe
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.004764ae
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x4763fc
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x47639f
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x4763e2
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x4763b6
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x4763d1
test al, 0x40
je 0x4763c8
mov ecx, dword [edi + 0x20]
jmp 0x4763cf
test al, 0x80
je 0x4763e2
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x4763e2
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x47636e
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x4099ad
Capabilities:
Encode data using xor

Disassembly:
push ebp
cld
push edx
push eax
call fcn.0040f73a
mov ebx, eax
mov eax, dword [ebp - 4]
test byte [ebp], bl
add byte [ebx - 0x3ba7428], cl
imul dword [ebp - 8]
xor edx, edx
mov dword [ebp - 0x18], eax
push eax
jecxz 0x4099b2
in al, dx

Function at 0x43d87b
Capabilities:
Get number of processors

Disassembly:
inc ebx
add byte [edi + edi*8 + 0x30], ah
mov dword fs:[eax], esp
mov esi, dword [ebp - 8]
clc
mov esi, dword [esi + 8]
mov eax, dword [esi + 8]
cmp eax, 0xffffff97
jg 0x43d8f6
je 0x43e2bb
cmp eax, 0xffffff8d
jg 0x43d8cf
je 0x43e28e
sub eax, 0xfffffecc
je 0x43d944
sub eax, 0x97
je 0x4109da0
sub eax, 0xffffffc3
fild dword [edi + 0x905]
sub eax, 0xffffffc9
fild dword [edi + 0x7e0]
jmp 0x47b1b8
sub eax, 0x64
fadd qword [edi + 0x8d3]
sub eax, 0xffffffe2
fild dword [edi + 0x75b]
add byte [eax], al
dec eax
je 0x43e36a
sub eax, 0xfffffff0
fild dword [edi + 0xa4c]
jmp 0x47b1df
cmp eax, 0xffffff9c
jg 0x43d924
je 0x43e3b2
sub eax, 0xffffff9f
fadd qword [edi + 0x75d]
pop es
add byte [eax], al
dec eax
je 0x43e050
dec eax
je 0x43e38b
dec eax
je 0x43e3f0
jmp 0x47b20d
sub eax, 0x1e
invalid
invalid
pushfd

Function at 0x45e3cc
Capabilities:
Packed with generic packer

Disassembly:
add byte [eax + 0x27], bl
inc esi
add byte [edi + ebp + 0x46], al
add byte [esi], cl
add byte [eax], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [eax + edx + 0x3c0040], dl
add byte [eax], al
add eax, dword [eax]
std
invalid
insd dword es:[edi], dx
jae 0x45e2ff
inc eax
add al, al
jecxz 0x45e3bc
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [esp], cl
inc ebp
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add ah, bh
jecxz 0x45e3dc
add byte [eax], ah
add byte [eax], al
and dl, 0x45
add byte [eax], cl
cmp byte [edx], al
push esp
xor eax, 0x315c0040
inc edx
add byte [ebp + esi + 0x40], bl
add byte [eax + 0x35], dl
inc eax
add byte [eax - 0x4bffbfce], bl
xor al, byte [eax]
add al, 0x27
inc esi
add byte [eax + 0x100041a9], al
xor al, 0x42
add byte [eax + ebp*4 + 0x2f2c0041], bl
sub al, 0x2f
inc esi
add al, cl
das
inc esi
add al, bh
xor al, 0x42
add al, dh
xor eax, 0x38200042
and byte [eax], bh
inc edx
add byte [eax], cl
xor eax, 0x35000042
inc edx
add byte [eax], ch
cmp byte [edx], al
push 0x14004626
das
inc esi
add byte [esi + 0x34480046], al
inc esi
add byte [ecx], cl
push esp
dec ebp
popal
imul ebp, dword [esi + 0x4d], 0x8b756e65
ror byte [esp], 0x45
add byte [edi], al
or dword [ebp + ecx*2 + 0x61], edx
imul ebp, dword [esi + 0x4d], 0xc0756e65
jecxz 0x45e45f
add byte [ebx], dh
inc ebp
add byte [ebx], cl
add byte [eax], al
add byte [eax], al
Function at 0x473472
Capabilities:
Check for software breakpoints

Disassembly:
cmp dword [ebx + 0x14], 0xcb
jne 0x4734e3
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4734d5
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x473501
mov eax, ebx
call 0x4e5e14
pop ebx
ret

Function at 0x4792c8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call dword [ebx + 0x20]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x40]
mov edx, dword [eax + 0xc]
shl edx, 2
add dword [esp + 0x28], edx
xor ecx, ecx
mov dword [esp + 0x48], ecx
jmp 0x479310
Function at 0x47948f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [ebx - 0x17d3dbbc], cl
or al, 0xc8
pop es
add byte [ebx + 0x3b102444], cl
inc esp
and al, 0x14

Function at 0x47954b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
or byte [ebx], ch
ror dword [ebx - 0x6086636], 0x85
fstp xword [esi + 0x17]

Function at 0x479568
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
add bl, dl
loopne 0x4795b6
push esp
and al, 0x64

Function at 0x479623
Capabilities:
Resolve function by parsing pe exports

Disassembly:
or al, 0x85
fisttp dword [edi]
test byte [ecx + 0x66000000], bl
cmp dword [esp + 0xb8], 0
and al, 0xb8
add byte [eax], al
add byte [eax], al

Function at 0x47966b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cdq
idiv ecx
test ebx, ebx
fstp xword [esi + 0x4b]
mov ecx, ebx
mov edx, 1
shl edx, cl
cmp eax, edx
jl 0x4796bd
mov ecx, ebx
mov eax, 1
add byte [eax], al
invalid

Function at 0x47966f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cdq
idiv ecx
test ebx, ebx
fstp xword [esi + 0x4b]
mov ecx, ebx
mov edx, 1
shl edx, cl
cmp eax, edx
jl 0x4796bd
mov ecx, ebx
mov eax, 1
add byte [eax], al
invalid

Function at 0x479686
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
add bl, dl
shl eax, cl
dec eax
add byte [eax], al
add byte [esi - 0x7d], ah
mov esp, 0xaa24
add byte [eax], al
Function at 0x48b19e
Capabilities:
Packed with generic packer

Disassembly:
je 0x48b209
outsd dx, dword [esi]
outsb dx, byte [esi]
dec ecx
outsb dx, byte [esi]
je 0x48b20b
jb 0x48b20b
jo 0x48b21f
add al, al
mov dl, 0x48
add byte [ecx + esi*4 + 0x17080048], dh
push esp
dec ecx
dec ecx
outsb dx, byte [esi]
je 0x48b222
jb 0x48b222
jo 0x48b236
push ebx
je 0x48b237
popal
insd dword es:[edi], dx
inc ebp
jbe fcn.0048b230
outsb dx, byte [esi]
je 0x48b1ce
add cl, byte [eax]
pop es
inc ecx
push ebx
outsb dx, byte gs:[esi]
jb 0x48b1ef
push esp
lea eax, [eax]
pop eax
mov dl, 0x48
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
test al, 0xb2
dec eax
add byte [eax], ah
pushal
add byte [eax], al
invalid

Function at 0x48d002
Capabilities:
Encode data using xor

Disassembly:
ror byte [eax], 1
mov eax, 0x8000000
inc eax
add byte [eax - 0x4bffbfce], bl
xor al, byte [eax]
je 0x48cfe5
dec eax
add byte [eax + 0x100041a9], al
xor al, 0x42
add byte [eax + ebp*4 + 0x55e80041], bl
push es
or dword [eax - 0x1e], ebp
dec eax
add al, bh

Function at 0x48f015
Capabilities:
Encode data using xor

Disassembly:
or byte [edi - 0x58c7ffb8], ah
cmpsd dword [esi], dword es:[edi]
dec eax
add byte [eax], bh
cmpsd dword [esi], dword es:[edi]
dec eax
add byte [eax], dl
fmul dword [eax]
dec eax
add byte [eax], dh
loop 0x48f06b
add ah, ch
aam 0x48
add byte [ebp + edx*8 - 0x163fffb8], dl
jp 0x48f014
cwde
jmp 0x48f07b
add byte [esi], cl
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, 0
add byte [eax], al
xchg esp, eax
adc byte [eax], al
mov eax, 0x94000000
adc byte [eax], al
enter 0, 0
xchg esp, eax

Function at 0x48ff0d
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
add byte [eax], al
cmp bh, bh
dec eax
add byte [eax], dh
add byte [eax], al
add ah, dh
popfd
dec eax
add byte [eax], cl
cmp byte [edx], al
push esp
xor eax, 0x315c0040
inc edx
add byte [ebp + esi + 0x40], bl
add byte [eax + 0x35], dl
inc eax
add byte [eax - 0x4bffbfce], bl
xor al, byte [eax]
in al, 0x30
inc edx
add byte [eax + 0x100041a9], al
adc byte [edx + eax*2], dh
adc byte [edx + eax*2], dh
add byte [eax + ebp*4 + 0x49e80041], bl
xor eax, 0x4233b409
add al, bh
xor al, 0x42
add al, dh
xor eax, 0x38200042
inc edx
add byte [eax], cl
xor eax, 0x35000042
inc edx
add byte [eax], ch
cmp byte [edx], al
cwde
xor byte [edx], al
fsubr dword [edx]
inc eax
add byte [edx], cl
push esp
dec ecx
inc ebp
outsb dx, byte [esi]
arpl word [edi + 0x64], bp
jb 0x48fed4
dec eax
dec dword [eax]
dec eax
add byte [edi], al

Function at 0x4912d3
Capabilities:
Packed with generic packer

Disassembly:
add byte [eax], al
add byte [eax + edx + 0x40040], dl
adc byte [eax], al
add al, 0
add byte [eax], al
xchg esp, eax
adc byte [eax], al
or al, 0
add byte [eax], al

Function at 0x4912d7
Capabilities:
Packed with generic packer

Disassembly:
add byte [eax], al
add byte [eax + edx + 0x40040], dl
adc byte [eax], al
add al, 0
add byte [eax], al
xchg esp, eax
adc byte [eax], al
or al, 0
add byte [eax], al