joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4daca0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x5ce9b4], 0x12c
push ebx
push esi
push edi
mov esi, ecx
jg 0x4dad61
lea eax, [ebp - 4]
push eax
lea eax, [esi + 0x10]
push eax
lea eax, [esi + 0x30]
push eax
call fcn.004f351c
add esp, 0xc
lea edi, [esi + 0xc]
mov dword [edi], eax
cmp eax, 0xffffffff
je 0x4dad30
cmp dword [ebp - 4], 0
jne 0x4dad30
cmp byte [esi + 0x48], 0
lea eax, [ebp - 4]
je 0x4dacf5
push eax
push edi
call fcn.004f351c
pop ecx
pop ecx
test al, al
jne 0x4dad08
jmp 0x4dad30
push 0x493e0
push eax
push edi
call fcn.00523748
add esp, 0xc
test al, al
je 0x4dad61
and dword [0x5ce9b4], 0
mov ebx, dword [esi + 0x14]
mov byte [esi + 0x48], 1
test ebx, ebx
je 0x4dad30
mov eax, dword [ebx]
push edi
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x55e434]
mov ecx, ebx
call esi
test al, al
jne 0x4dad5c
cmp dword [edi], 0xffffffff
je 0x4dad45
cmp dword [ebp - 4], 0
jne 0x4dad5c
push edi
call fcn.004f351c
or dword [edi], 0xffffffff
pop ecx
cmp dword [ebp - 4], 0
je 0x4dad5c
inc dword [0x5ce9b4]
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
pop edi
pop esi
pop ebx
leave
ret
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]

Function at 0x4f351c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x4f352b
pop dword [ebp - 0x20]
mov eax, 0x5f69a585
add eax, 0xa0e58fa6
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x8ae08
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0xdd69cde2
add ecx, 0x22967a43
mov edx, eax
mov esi, 0xa30000
add esi, dword [ebp - 0x20]
mov ebx, 0x25ddc81e
sub ebx, 0xbc3c29e2
add dword [ebp - 4], edx
mov edi, dword [esi]
xor edi, ebx
mov dword [edx], edi
xor dword [ebp - 8], 0x51bc70aa
add edx, 0x23a8e8a2
sub edx, 0x23a8e89e
add esi, 0x75f0205c
add esi, 0x8a0fdfa8
loop 0x4f357f
add eax, 0x11367
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x4062a3
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x42d008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
lea edx, [ebp - 0x6c]
push edi
xor edi, edi
mov dword [ebp - 0x6c], edi
mov ecx, dword [esi + 0x14]
call fcn.00404f02
mov eax, dword [ebp - 0x6c]
cmp eax, dword [esi + 4]
jbe 0x4062da
mov ecx, esi
call fcn.0040640c
xor eax, eax
cmp byte [esi + 0xa], al
push edi
setne al
push 0x80
lea eax, [eax*2 + 2]
push eax
push edi
push 3
push 0x40000000
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 0x18], eax
cmp eax, 0xffffffff
jne 0x406313
mov dword [esi + 0x18], edi
xor al, al
jmp 0x4063a4
lea ecx, [ebp - 0x8c]
call fcn.00402f99
push 0x221
push 0x20
push 2
lea eax, [ebp - 0x68]
push 0x4297fc
push eax
call fcn.00402af9
add esp, 0x10
lea eax, [ebp - 0x68]
lea ecx, [ebp - 0x8c]
push 0xc0010000
push eax
call fcn.00403016
lea ecx, [ebp - 0x68]
mov bl, al
call fcn.00402be2
test bl, bl
je 0x40636c
push ecx
mov ecx, dword [esi + 0x14]
lea eax, [ebp - 0x8c]
push eax
call fcn.00403895
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x406397
cmp byte [esi + 0xb], 0
je 0x406397
push edi
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x6c], edi
push eax
push 2
push 0x429558
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [ebp - 0x8c]
call fcn.00402fdf
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004093f2
leave
ret

Function at 0x4063b3
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
mov esi, ecx
push ebx
push 0x80
push 5
push ebx
push 3
push 0x40000000
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp dword [esi + 0x18], 0xffffffff
mov edi, eax
jne 0x4063e3
xor al, al
jmp 0x406407
cmp byte [esi + 0xb], bl
je 0x4063fe
push ebx
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push 2
push 0x429558
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40690d
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x42d008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x118
xor edi, edi
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x11c]
push edi
push eax
call fcn.00409f70
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je case.0x406a27.2
mov ebx, dword [ebp - 0x11c]
cmp ebx, 6
je 0x4069b8
cmp ebx, 0xa
je 0x4069b8
cmp ebx, 5
jne case.0x406a27.2
cmp dword [ebp - 0x118], 2
jne 0x4069a1
cmp byte [ebp - 6], 1
jne 0x406983
call fcn.004068c1
cmp eax, 9
je case.0x406a27.1
test dword [ebp - 8], 0x8000
je case.0x406a27.7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004093f2
leave
ret
cmp dword [ebp - 0x118], 1
jne case.0x406a27.2
test dword [ebp - 8], 0x200
jne case.0x406a27.2
xor eax, eax
inc eax
jmp 0x406992
mov eax, dword [ebp - 0x118]
mov ecx, 0x4297b0
mov dword [ebp - 0x124], edi
mov dword [ebp - 0x128], eax
call fcn.00403fdb
mov esi, eax
test esi, esi
je case.0x406a27.2
push str.GetProductInfo
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4069fe
lea ecx, [ebp - 0x124]
push ecx
push edi
push edi
push dword [ebp - 0x128]
push ebx
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test edi, edi
je case.0x406a27.2
mov eax, dword [ebp - 0x124]
cmp eax, 0x1b
ja 0x406a36
je case.0x406a27.4
dec eax
cmp eax, 0x18
ja case.0x406a27.2
movzx eax, byte [eax + 0x406a99]
jmp dword [eax*4 + 0x406a89]
push 2
pop eax
jmp 0x406992
cmp eax, 0x54
ja 0x406a56
je case.0x406a27.4
sub eax, 0x30
je case.0x406a27.1
sub eax, 0x16
je case.0x406a27.4
dec eax
sub eax, 1
je case.0x406a27.4
jmp case.0x406a27.2
cmp eax, 0x79
jb case.0x406a27.2
cmp eax, 0x7a
jbe 0x406a84
cmp eax, 0x7c
jbe case.0x406a27.2
cmp eax, 0x7e
jbe case.0x406a27.4
add eax, 0xffffff7f
cmp eax, 1
ja case.0x406a27.2
push 3
jmp 0x406a30
push 4
jmp 0x406a30

Function at 0x407427
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push edi
mov edi, ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0
mov ebx, eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x407496
push esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea ebx, [ebx*2 + 2]
push ebx
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x407472
push ebx
push edi
push eax
call fcn.0040b3a0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
jne 0x40748d
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop esi
pop edi
pop ebx
jmp dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop ebx
ret
Function at 0x100055c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x100055cf
pop dword [ebp - 0x24]
mov eax, 0x7641db82
sub eax, 0x664185b3
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x796e386c
add dword [ebp - 0x34], 0xd4e40cdf
mov dword [ebp - 0x30], 0xf4daeb6d
add dword [ebp - 0x30], 0x3d5860d8
mov dword [ebp - 0x2c], 0xeb17503f
sub dword [ebp - 0x2c], 0x9ecb0c11
mov dword [ebp - 0x28], 0xfef33024
add dword [ebp - 0x28], 0x10ccfdc
lea eax, [ebp - 0x34]
push eax
mov eax, 0x8f4572ac
add eax, 0x80ba9ed4
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x1a5b6176
add dword [ebp - 0x34], 0x5a1707e0
mov dword [ebp - 0x30], 0x3512f2d6
add dword [ebp - 0x30], 0xc596e9f
mov dword [ebp - 0x2c], 0xb68039a5
add dword [ebp - 0x2c], 0xacef32c7
mov dword [ebp - 0x28], 0xf81c832e
sub dword [ebp - 0x28], 0xf81c832e
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x3f3bc
push 0
call eax
mov ecx, 0x9aeb097c
sub ecx, 0x9aeaba9d
xor ebx, ebx
add ebx, eax
mov edx, 0x7980c75f
sub edx, 0x697ef95f
add edx, dword [ebp - 0x24]
mov edi, 0x7393dff0
mov esi, dword [edx]
add dword [ebp - 0x1c], 0x83de044e
add esi, edi
xor dword [ebp - 0x1c], esi
mov dword [ebx], esi
add dword [ebp - 0x10], ecx
add ebx, 0x96282c52
sub ebx, 0x96282c4e
add edx, 4
loop 0x100056e8
add eax, 0x12e4f
mov ebx, eax
add eax, 0x4993e549
sub eax, 0x4993e544
mov ecx, 0xe9732e46
add ecx, 0x268cd1ba
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x401f60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x473a1d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1018
call fcn.00439360
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 0xc]
mov dword [eax], 0xffffffff
mov dword [ebp - 4], 0
push 0
push 0x8000027
push 3
push 0
push 1
push 0x80000000
mov ecx, dword [ebp + 8]
push ecx
call dword [0x477324]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x401fda
call dword [0x477334]
mov dword [ebp - 0x18], eax
jmp 0x402071
mov dword [ebp - 0x1028], 0x4940d8
push 0
lea edx, [ebp - 0x1024]
push edx
push 0x1000
lea eax, [ebp - 0x1020]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [0x477328]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x402071
cmp dword [ebp - 0x1024], 0
je 0x402071
push esi
push edi
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edi, dword [ebp - 0x1028]
lea esi, [ebp - 0x1020]
mov ebx, dword [ebp - 0x1024]
lea edx, [esi + ebx]
xor eax, eax
mov bl, byte [esi]
mov al, cl
inc esi
xor al, bl
shr ecx, 8
mov ebx, dword [edi + eax*4]
xor ecx, ebx
cmp edx, esi
jne 0x402031
pop edi
pop esi
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
push 0
lea edx, [ebp - 0x1024]
push edx
push 0x1000
lea eax, [ebp - 0x1020]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [0x477328]
mov dword [ebp - 0x1c], eax
jmp 0x402006
jmp 0x402080
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
je 0x402097
mov edx, dword [ebp - 0x14]
push edx
call dword [0x47732c]
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
not ecx
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41bc00
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, ecx
mov eax, dword [ebx + 0xfc]
test byte [eax + 0xc], 1
je 0x41bc5d
mov eax, dword [ebx + 0x6c]
push ebp
xor ebp, ebp
test eax, eax
jbe 0x41bc5c
push esi
push edi
jmp 0x41bc20
mov esi, dword [ebx + 0x7c]
mov edi, dword [ebx + 0x1a0]
xor ecx, ecx
mov cl, byte [esi + ebp]
add esi, ebp
and edi, 0xfffd
or edi, 2
push ecx
mov ecx, ebx
call fcn.0041bb80
mov al, byte [esi]
mov edx, edi
xor edx, 1
imul edx, edi
sar edx, 8
xor al, dl
mov byte [esi], al
mov eax, dword [ebx + 0x6c]
inc ebp
cmp ebp, eax
jb 0x41bc20
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x41bc60
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, ecx
mov eax, dword [edi + 0xfc]
test byte [eax + 0xc], 1
je 0x41bcb8
push ebp
mov ebp, dword [esp + 0xc]
push esi
xor esi, esi
test ebp, ebp
jbe 0x41bcb6
jmp 0x41bc80
mov ecx, dword [edi + 0x1a0]
mov eax, dword [edi + 0x7c]
and ecx, 0xfffd
or ecx, 2
mov edx, ecx
xor edx, 1
imul edx, ecx
mov cl, byte [eax + esi]
add eax, esi
sar edx, 8
xor cl, dl
mov byte [eax], cl
movsx eax, cl
push eax
mov ecx, edi
call fcn.0041bb80
inc esi
cmp esi, ebp
jb 0x41bc80
pop esi
pop ebp
pop edi
ret 4
Function at 0x41bfc0
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x474d58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
xor esi, esi
push esi
mov edi, ecx
push 0xc
lea ecx, [esp + 0x18]
call fcn.0041f870
mov eax, dword [esp + 0x14]
push esi
push 0xc
push eax
lea ecx, [edi + 0x84]
mov dword [esp + 0x30], esi
call fcn.00422e20
mov eax, dword [edi + 0x1a0]
mov ecx, dword [esp + 0x14]
mov dl, byte [ecx + esi]
and eax, 0xfffd
or eax, 2
mov ebx, eax
xor ebx, 1
imul ebx, eax
sar ebx, 8
xor bl, dl
mov byte [esp + 0xc], bl
mov edx, dword [esp + 0xc]
push edx
mov ecx, edi
call fcn.0041bb80
inc esi
cmp esi, 0xc
jl 0x41c002
mov edi, dword [edi + 0xfc]
mov al, byte [edi + 0xc]
shr al, 3
test al, 1
je 0x41c04f
mov al, byte [edi + 0x11]
jmp 0x41c052
mov al, byte [edi + 0x17]
cmp al, bl
lea ecx, [esp + 0x10]
sete bl
mov dword [esp + 0x24], 0xffffffff
call fcn.0041f8a0
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
mov al, bl
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x4208b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x475238
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov ebx, ecx
mov eax, dword [ebx + 0x10]
push edi
lea ebp, [eax + 0x16]
push 0
push ebp
lea ecx, [esp + 0x18]
call fcn.0041f870
mov ecx, dword [esp + 0x14]
mov eax, dword [ebx + 0x10]
mov edx, dword [0x49792c]
mov dword [ecx], edx
mov cx, word [ebx + 0x6c]
mov edx, dword [esp + 0x14]
mov word [edx + 4], cx
mov cx, word [ebx + 0x6e]
mov edx, dword [esp + 0x14]
mov word [edx + 6], cx
mov cx, word [ebx + 0x70]
mov edx, dword [esp + 0x14]
mov word [edx + 8], cx
mov cx, word [ebx + 0x72]
mov edx, dword [esp + 0x14]
mov word [edx + 0xa], cx
mov ecx, dword [ebx + 0x74]
mov edx, dword [esp + 0x14]
mov dword [edx + 0xc], ecx
mov ecx, dword [ebx + 0x78]
mov edx, dword [esp + 0x14]
mov dword [edx + 0x10], ecx
mov ecx, dword [esp + 0x14]
mov word [ecx + 0x14], ax
mov edi, dword [esp + 0x14]
mov esi, dword [ebx + 0xc]
movzx ecx, ax
mov edx, ecx
shr ecx, 2
add edi, 0x16
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
push 1
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x18]
mov ecx, dword [ebx + 0x24]
push ebp
push eax
mov dword [esp + 0x30], 0
call fcn.004226a0
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.0041f8a0
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x423290
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x475650
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov eax, dword [esp + 0x2c]
push ebx
push esi
push eax
lea ecx, [esp + 0x10]
call fcn.0041c1a0
lea ecx, [esp + 8]
push ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], 0
call fcn.00423090
push 0x47a554
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 1
call fcn.0041cea0
push 0x5c
lea ecx, [esp + 0xc]
call fcn.0041c830
mov edx, dword [esp + 0x38]
mov esi, dword [esp + 8]
push edx
push esi
call dword [0x477298]
test eax, eax
lea eax, [esi - 0x10]
setne bl
mov byte [esp + 0x2c], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x423320
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 0xffffffff
call fcn.004233b0
mov ecx, dword [esp + 0x24]
pop esi
mov al, bl
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret

Function at 0x429422
Capabilities:
Get number of processors

Disassembly:
mov eax, 0x47579a
call fcn.0043ca14
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x18], esi
mov dword [esi], 0x47e568
lea eax, [ebp - 0x10]
lea ebx, [esi + 0x3c]
push eax
mov ecx, ebx
mov dword [ebp - 4], 4
call fcn.00429868
lea eax, [ebp - 0x14]
push eax
mov ecx, ebx
call fcn.0042987f
jmp 0x429478
lea ecx, [ebp - 0x10]
call fcn.00429892
push dword [eax + 4]
mov ecx, esi
call fcn.00428cbe
lea ecx, [ebp - 0x10]
call fcn.00429897
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x10]
push eax
call fcn.004297c5
test al, al
jne 0x42945e
push edi
mov edi, dword [0x477698]
call edi
mov dword [ebp - 0x14], eax
push 0xffffffffffffffff
mov ecx, esi
call fcn.00429199
push 0x64
call dword [0x4772ec]
call edi
sub eax, dword [ebp - 0x14]
cmp eax, 0x1388
jae 0x4294bc
mov ecx, ebx
call fcn.004297ba
test al, al
je 0x429494
mov ecx, esi
call fcn.00428db6
push 0x7d0
push esi
call fcn.0042ca8b
pop ecx
pop ecx
lea eax, [ebp - 0x14]
push eax
mov ecx, ebx
call fcn.00429868
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x1c]
push eax
mov ecx, ebx
call fcn.0042987f
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.004297c5
pop edi
jmp 0x42952a
lea ecx, [ebp - 0x10]
call fcn.00429892
mov eax, dword [eax + 4]
test eax, eax
je 0x429516
mov edx, dword [eax]
push 1
mov ecx, eax
call dword [edx]
lea ecx, [ebp - 0x10]
call fcn.00429897
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.004297c5
test al, al
jne 0x4294ff
lea ecx, [esi + 0x50]
mov byte [ebp - 4], 3
call fcn.0042b8f0
mov ecx, ebx
mov byte [ebp - 4], 2
call fcn.0042a2ff
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
call fcn.0042ad77
lea ecx, [esi + 8]
mov byte [ebp - 4], 0
call fcn.0042ad7c
mov ecx, esi
call fcn.00428b38
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x429430
Capabilities:
Get number of processors

Disassembly:
mov eax, 0x47579a
call fcn.0043ca14
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x18], esi
mov dword [esi], 0x47e568
lea eax, [ebp - 0x10]
lea ebx, [esi + 0x3c]
push eax
mov ecx, ebx
mov dword [ebp - 4], 4
call fcn.00429868
lea eax, [ebp - 0x14]
push eax
mov ecx, ebx
call fcn.0042987f
jmp 0x429478
lea ecx, [ebp - 0x10]
call fcn.00429892
push dword [eax + 4]
mov ecx, esi
call fcn.00428cbe
lea ecx, [ebp - 0x10]
call fcn.00429897
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x10]
push eax
call fcn.004297c5
test al, al
jne 0x42945e
push edi
mov edi, dword [0x477698]
call edi
mov dword [ebp - 0x14], eax
push 0xffffffffffffffff
mov ecx, esi
call fcn.00429199
push 0x64
call dword [0x4772ec]
call edi
sub eax, dword [ebp - 0x14]
cmp eax, 0x1388
jae 0x4294bc
mov ecx, ebx
call fcn.004297ba
test al, al
je 0x429494
mov ecx, esi
call fcn.00428db6
push 0x7d0
push esi
call fcn.0042ca8b
pop ecx
pop ecx
lea eax, [ebp - 0x14]
push eax
mov ecx, ebx
call fcn.00429868
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x1c]
push eax
mov ecx, ebx
call fcn.0042987f
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.004297c5
pop edi
jmp 0x42952a
lea ecx, [ebp - 0x10]
call fcn.00429892
mov eax, dword [eax + 4]
test eax, eax
je 0x429516
mov edx, dword [eax]
push 1
mov ecx, eax
call dword [edx]
lea ecx, [ebp - 0x10]
call fcn.00429897
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.004297c5
test al, al
jne 0x4294ff
lea ecx, [esi + 0x50]
mov byte [ebp - 4], 3
call fcn.0042b8f0
mov ecx, ebx
mov byte [ebp - 4], 2
call fcn.0042a2ff
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
call fcn.0042ad77
lea ecx, [esi + 8]
mov byte [ebp - 4], 0
call fcn.0042ad7c
mov ecx, esi
call fcn.00428b38
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x42c6e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
push esi
xor esi, esi
test eax, eax
jle 0x42c748
movzx eax, word [esp + 0x10]
movzx ecx, byte [esp + 0x14]
push ebx
lea eax, [eax + eax*4]
shl eax, 1
add ecx, eax
push ebp
push edi
lea edi, [ecx + ecx*4]
movzx ecx, byte [esp + 0x24]
add ecx, eax
lea ebp, [ecx + ecx*4]
mov ecx, dword [esp + 0x14]
shl edi, 3
shl ebp, 3
xor edx, edx
mov eax, esi
mov ebx, 0x28
div ebx
mov bl, byte [ecx]
mov al, byte [edx + edi + 0x47ee00]
xor bl, al
mov byte [ecx], bl
mov dl, byte [edx + ebp + 0x47ee00]
mov al, bl
xor dl, al
mov eax, dword [esp + 0x18]
mov byte [ecx], dl
inc ecx
inc esi
cmp esi, eax
jl 0x42c716
pop edi
pop ebp
pop ebx
pop esi
ret 0x14
Function at 0x42c8f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
push esi
xor esi, esi
test ebp, ebp
jle 0x42c94b
movzx eax, word [esp + 0x14]
movzx ecx, byte [esp + 0x18]
lea eax, [eax + eax*4]
push ebx
lea eax, [ecx + eax*2]
mov ecx, dword [esp + 0x10]
push edi
lea edi, [eax + eax*4]
shl edi, 3
jmp 0x42c920
xor edx, edx
mov eax, esi
mov ebx, 0x28
div ebx
mov al, byte [ecx]
mov dl, byte [edx + edi + 0x47ee00]
xor dl, al
mov al, dl
sar al, 7
and al, 1
shl dl, 1
or al, dl
mov byte [ecx], al
inc ecx
inc esi
cmp esi, ebp
jl 0x42c920
pop edi
pop ebx
pop esi
pop ebp
ret 0x10
Function at 0x43b66a
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x483778
call fcn.0043cd6c
mov edi, 0x94
mov eax, edi
call fcn.00439360
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [0x477368]
mov ecx, dword [esi + 0x10]
mov dword [0x49eb38], ecx
mov eax, dword [esi + 4]
mov dword [0x49eb44], eax
mov edx, dword [esi + 8]
mov dword [0x49eb48], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x49eb3c], esi
cmp ecx, 2
je 0x43b6ca
or esi, 0x8000
mov dword [0x49eb3c], esi
shl eax, 8
add eax, edx
mov dword [0x49eb40], eax
xor esi, esi
push esi
mov edi, dword [0x477260]
call edi
cmp word [eax], 0x5a4d
jne 0x43b705
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43b705
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x43b71d
cmp eax, 0x20b
je 0x43b70a
mov dword [ebp - 0x1c], esi
jmp 0x43b731
cmp dword [ecx + 0x84], 0xe
jbe 0x43b705
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x43b72b
cmp dword [ecx + 0x74], 0xe
jbe 0x43b705
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.0043ee53
pop ecx
test eax, eax
jne 0x43b745
push 0x1c
call fcn.0043b646
pop ecx
call fcn.0043e8eb
test eax, eax
jne 0x43b756
push 0x10
call fcn.0043b646
pop ecx
call fcn.004435ae
mov dword [ebp - 4], esi
call fcn.00443c3a
test eax, eax
jge 0x43b76f
push 0x1b
call fcn.0043b621
pop ecx
call dword [0x477148]
mov dword [0x4a0564], eax
call fcn.00443b18
mov dword [0x49eb7c], eax
call fcn.00443a76
test eax, eax
jge 0x43b795
push 8
call fcn.0043b621
pop ecx
call fcn.00443843
test eax, eax
jge 0x43b7a6
push 9
call fcn.0043b621
pop ecx
push 1
call fcn.0043b4b4
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x43b7bc
push eax
call fcn.0043b621
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [0x477144]
call fcn.004437e6
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x43b7dd
movzx eax, word [ebp - 0x40]
jmp 0x43b7e0
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.0044c650
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x43b7fe
push edi
call fcn.0043b5e1
call fcn.0043b603
jmp 0x43b830
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.0043cda7
ret