joyce8/EMBER2024-capa huggingface dataset:
Function at 0x511fe1
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x4d0]
add edx, 1
mov dword [ebp - 0x4d0], edx
push ebx
push esi
add esp, 4
jmp 0x511de6
and ebx, 0x9828
pop ebx
push esi
push ecx
add esp, 4
and esi, 0x5e4d
sub esi, 0xcd7b
pop esi
push ecx
sub ecx, 0x1616
sub ecx, 0x1680f
pop ecx
mov eax, dword [ebp - 0x4d0]
sub eax, dword [ebp - 0x3c0]
cmp eax, 0xffffffff
jb 0x511e55
push eax
sub eax, 0xfa36
call fcn.00511e33
add byte [ebx + 0x47], cl
inc ecx
inc esp
inc esp
xor eax, 0xc483393e
add esp, 4
pop eax
mov dword [ebp - 0xc10], 7
mov ecx, dword [ebp - 0x4d0]
mov dword [ebp - 0xa60], ecx
push eax
xor eax, 0xe2e0
pop eax
push edi
push eax
add esp, 4
sub edi, 0x6b2f
jmp 0x511e85
jmp 0x511e8e
pop edi
push edx
add edx, 0x12ff6
sub edx, 0xe007
pop edx
mov edx, dword [ebp - 0x14c8]
mov dword [ebp - 0x9f0], edx
mov dword [ebp - 0xc14], 0
mov eax, dword [ebp - 0x4d0]
cmp eax, dword [ebp - 0x14c8]
jne 0x511f04
push edx
and edx, 0xd44a
or edx, 0x7179
sub edx, 0x4cd4
pop edx
push ecx
push edx
add esp, 4
and ecx, 0xeef4
xor ecx, 0x4120
sub ecx, 0x99ce
sub ecx, 0x1450c
pop ecx
mov ecx, dword [ebp - 0xc14]
mov dword [ebp - 0x14d0], ecx
jmp 0x512035
cmp dword [ebp - 0xc10], 0
jle 0x512029
push edi
call fcn.00511f21
add byte [ecx], bh
dec edx
inc edx
dec esi
inc eax
dec edx
cmp byte [ecx + ecx*2 - 0x7d], al
add esp, 4
sub edi, 0xd924
add esp, 4
sub edi, 0xd924
or edi, 0xd54c
pop edi
push ebx
push esi
add esp, 4
jmp 0x511f3c
or ebx, 0xdab5
pop ebx
mov edx, dword [ebp - 0xa60]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x9f0]
movzx edx, byte [ecx]
cmp eax, edx
je 0x511fc5
push ecx
xor ecx, 0x13e3
or ecx, 0x9847
call 0x511f75
add byte [edi + edi], dh
dec edx
cmp eax, 0x4b3e454b
dec edi
add esp, 4
and ecx, 0x6b58
pop ecx
push eax
push ebx
add esp, 4
and eax, 0x13b31
pop eax
mov eax, dword [ebp - 0xa60]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x9f0]
movzx eax, byte [edx]
cmp ecx, eax
jle 0x511fad
mov dword [ebp - 0x14cc], 1
jmp 0x511fb7
mov dword [ebp - 0x14cc], 0xffffffff
mov ecx, dword [ebp - 0x14cc]
mov dword [ebp - 0xc14], ecx
jmp 0x512029
push edi
and edi, 0x1904
add edi, 0x50b8
call 0x511fe1
add byte [ebp + 0x44], cl
cmp eax, 0x32504940
xor eax, 0x4c48342
call 0x511ff3
add byte [edx + 0x3a], al
aaa
dec edx
cmp eax, 0x484f4834
add esp, 4
pop edi
mov edx, dword [ebp - 0xc10]
sub edx, 1
mov dword [ebp - 0xc10], edx
mov eax, dword [ebp - 0xa60]
add eax, 1
mov dword [ebp - 0xa60], eax
mov ecx, dword [ebp - 0x9f0]
add ecx, 1
mov dword [ebp - 0x9f0], ecx
jmp 0x511f04
mov edx, dword [ebp - 0xc14]
mov dword [ebp - 0x14d0], edx
cmp dword [ebp - 0x14d0], 0
jne 0x51207e
push ebx
or ebx, 0xc971
xor ebx, 0x1544e
pop ebx
push ecx
push ecx
add esp, 4
or ecx, 0x68d
and ecx, 0x9ab0
call 0x51206c
add byte [ebp + 0x4f], al
inc edi
inc ebx
inc ebx
cmp byte [esi + 0x4c], al
aaa
add esp, 4
pop ecx
mov eax, dword [ebp - 0x4d0]
mov dword [ebp - 0xa5c], eax
jmp 0x5120bf
jmp 0x511dcc
Function at 0x511ff3
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x4d0]
add edx, 1
mov dword [ebp - 0x4d0], edx
push ebx
push esi
add esp, 4
jmp 0x511de6
and ebx, 0x9828
pop ebx
push esi
push ecx
add esp, 4
and esi, 0x5e4d
sub esi, 0xcd7b
pop esi
push ecx
sub ecx, 0x1616
sub ecx, 0x1680f
pop ecx
mov eax, dword [ebp - 0x4d0]
sub eax, dword [ebp - 0x3c0]
cmp eax, 0xffffffff
jb 0x511e55
push eax
sub eax, 0xfa36
call fcn.00511e33
add byte [ebx + 0x47], cl
inc ecx
inc esp
inc esp
xor eax, 0xc483393e
add esp, 4
pop eax
mov dword [ebp - 0xc10], 7
mov ecx, dword [ebp - 0x4d0]
mov dword [ebp - 0xa60], ecx
push eax
xor eax, 0xe2e0
pop eax
push edi
push eax
add esp, 4
sub edi, 0x6b2f
jmp 0x511e85
jmp 0x511e8e
pop edi
push edx
add edx, 0x12ff6
sub edx, 0xe007
pop edx
mov edx, dword [ebp - 0x14c8]
mov dword [ebp - 0x9f0], edx
mov dword [ebp - 0xc14], 0
mov eax, dword [ebp - 0x4d0]
cmp eax, dword [ebp - 0x14c8]
jne 0x511f04
push edx
and edx, 0xd44a
or edx, 0x7179
sub edx, 0x4cd4
pop edx
push ecx
push edx
add esp, 4
and ecx, 0xeef4
xor ecx, 0x4120
sub ecx, 0x99ce
sub ecx, 0x1450c
pop ecx
mov ecx, dword [ebp - 0xc14]
mov dword [ebp - 0x14d0], ecx
jmp 0x512035
cmp dword [ebp - 0xc10], 0
jle 0x512029
push edi
call fcn.00511f21
add byte [ecx], bh
dec edx
inc edx
dec esi
inc eax
dec edx
cmp byte [ecx + ecx*2 - 0x7d], al
add esp, 4
sub edi, 0xd924
add esp, 4
sub edi, 0xd924
or edi, 0xd54c
pop edi
push ebx
push esi
add esp, 4
jmp 0x511f3c
or ebx, 0xdab5
pop ebx
mov edx, dword [ebp - 0xa60]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x9f0]
movzx edx, byte [ecx]
cmp eax, edx
je 0x511fc5
push ecx
xor ecx, 0x13e3
or ecx, 0x9847
call 0x511f75
add byte [edi + edi], dh
dec edx
cmp eax, 0x4b3e454b
dec edi
add esp, 4
and ecx, 0x6b58
pop ecx
push eax
push ebx
add esp, 4
and eax, 0x13b31
pop eax
mov eax, dword [ebp - 0xa60]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x9f0]
movzx eax, byte [edx]
cmp ecx, eax
jle 0x511fad
mov dword [ebp - 0x14cc], 1
jmp 0x511fb7
mov dword [ebp - 0x14cc], 0xffffffff
mov ecx, dword [ebp - 0x14cc]
mov dword [ebp - 0xc14], ecx
jmp 0x512029
push edi
and edi, 0x1904
add edi, 0x50b8
call 0x511fe1
add byte [ebp + 0x44], cl
cmp eax, 0x32504940
xor eax, 0x4c48342
call 0x511ff3
add byte [edx + 0x3a], al
aaa
dec edx
cmp eax, 0x484f4834
add esp, 4
pop edi
mov edx, dword [ebp - 0xc10]
sub edx, 1
mov dword [ebp - 0xc10], edx
mov eax, dword [ebp - 0xa60]
add eax, 1
mov dword [ebp - 0xa60], eax
mov ecx, dword [ebp - 0x9f0]
add ecx, 1
mov dword [ebp - 0x9f0], ecx
jmp 0x511f04
mov edx, dword [ebp - 0xc14]
mov dword [ebp - 0x14d0], edx
cmp dword [ebp - 0x14d0], 0
jne 0x51207e
push ebx
or ebx, 0xc971
xor ebx, 0x1544e
pop ebx
push ecx
push ecx
add esp, 4
or ecx, 0x68d
and ecx, 0x9ab0
call 0x51206c
add byte [ebp + 0x4f], al
inc edi
inc ebx
inc ebx
cmp byte [esi + 0x4c], al
aaa
add esp, 4
pop ecx
mov eax, dword [ebp - 0x4d0]
mov dword [ebp - 0xa5c], eax
jmp 0x5120bf
jmp 0x511dcc
Function at 0x51206c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x4d0]
add edx, 1
mov dword [ebp - 0x4d0], edx
push ebx
push esi
add esp, 4
jmp 0x511de6
and ebx, 0x9828
pop ebx
push esi
push ecx
add esp, 4
and esi, 0x5e4d
sub esi, 0xcd7b
pop esi
push ecx
sub ecx, 0x1616
sub ecx, 0x1680f
pop ecx
mov eax, dword [ebp - 0x4d0]
sub eax, dword [ebp - 0x3c0]
cmp eax, 0xffffffff
jb 0x511e55
push eax
sub eax, 0xfa36
call fcn.00511e33
add byte [ebx + 0x47], cl
inc ecx
inc esp
inc esp
xor eax, 0xc483393e
add esp, 4
pop eax
mov dword [ebp - 0xc10], 7
mov ecx, dword [ebp - 0x4d0]
mov dword [ebp - 0xa60], ecx
push eax
xor eax, 0xe2e0
pop eax
push edi
push eax
add esp, 4
sub edi, 0x6b2f
jmp 0x511e85
jmp 0x511e8e
pop edi
push edx
add edx, 0x12ff6
sub edx, 0xe007
pop edx
mov edx, dword [ebp - 0x14c8]
mov dword [ebp - 0x9f0], edx
mov dword [ebp - 0xc14], 0
mov eax, dword [ebp - 0x4d0]
cmp eax, dword [ebp - 0x14c8]
jne 0x511f04
push edx
and edx, 0xd44a
or edx, 0x7179
sub edx, 0x4cd4
pop edx
push ecx
push edx
add esp, 4
and ecx, 0xeef4
xor ecx, 0x4120
sub ecx, 0x99ce
sub ecx, 0x1450c
pop ecx
mov ecx, dword [ebp - 0xc14]
mov dword [ebp - 0x14d0], ecx
jmp 0x512035
cmp dword [ebp - 0xc10], 0
jle 0x512029
push edi
call fcn.00511f21
add byte [ecx], bh
dec edx
inc edx
dec esi
inc eax
dec edx
cmp byte [ecx + ecx*2 - 0x7d], al
add esp, 4
sub edi, 0xd924
add esp, 4
sub edi, 0xd924
or edi, 0xd54c
pop edi
push ebx
push esi
add esp, 4
jmp 0x511f3c
or ebx, 0xdab5
pop ebx
mov edx, dword [ebp - 0xa60]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x9f0]
movzx edx, byte [ecx]
cmp eax, edx
je 0x511fc5
push ecx
xor ecx, 0x13e3
or ecx, 0x9847
call 0x511f75
add byte [edi + edi], dh
dec edx
cmp eax, 0x4b3e454b
dec edi
add esp, 4
and ecx, 0x6b58
pop ecx
push eax
push ebx
add esp, 4
and eax, 0x13b31
pop eax
mov eax, dword [ebp - 0xa60]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x9f0]
movzx eax, byte [edx]
cmp ecx, eax
jle 0x511fad
mov dword [ebp - 0x14cc], 1
jmp 0x511fb7
mov dword [ebp - 0x14cc], 0xffffffff
mov ecx, dword [ebp - 0x14cc]
mov dword [ebp - 0xc14], ecx
jmp 0x512029
push edi
and edi, 0x1904
add edi, 0x50b8
call 0x511fe1
add byte [ebp + 0x44], cl
cmp eax, 0x32504940
xor eax, 0x4c48342
call 0x511ff3
add byte [edx + 0x3a], al
aaa
dec edx
cmp eax, 0x484f4834
add esp, 4
pop edi
mov edx, dword [ebp - 0xc10]
sub edx, 1
mov dword [ebp - 0xc10], edx
mov eax, dword [ebp - 0xa60]
add eax, 1
mov dword [ebp - 0xa60], eax
mov ecx, dword [ebp - 0x9f0]
add ecx, 1
mov dword [ebp - 0x9f0], ecx
jmp 0x511f04
mov edx, dword [ebp - 0xc14]
mov dword [ebp - 0x14d0], edx
cmp dword [ebp - 0x14d0], 0
jne 0x51207e
push ebx
or ebx, 0xc971
xor ebx, 0x1544e
pop ebx
push ecx
push ecx
add esp, 4
or ecx, 0x68d
and ecx, 0x9ab0
call 0x51206c
add byte [ebp + 0x4f], al
inc edi
inc ebx
inc ebx
cmp byte [esi + 0x4c], al
aaa
add esp, 4
pop ecx
mov eax, dword [ebp - 0x4d0]
mov dword [ebp - 0xa5c], eax
jmp 0x5120bf
jmp 0x511dcc
Function at 0x5120b1
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop eax
push eax
xor eax, 0x46a5
or eax, 0x72b1
jmp 0x511e49
sub eax, 0x2b9f
pop eax
jmp 0x512083
push esi
push ecx
add esp, 4
sub esi, 0x41c0
or esi, 0xd21e
pop esi
push esi
jmp 0x51209b
xor esi, 0x3e84
call 0x5120b1
add byte [ecx], bh
inc ecx
inc edi
xor al, 0x34
dec ecx
inc ecx
dec ecx
xor al, 0x4c
add esp, 4
pop esi
mov dword [ebp - 0xa5c], 0
push ecx
push esi
add esp, 4
call 0x5120d4
add byte [esi + 0x4c], al
cmp dh, byte [esp + eax*2]
cmp al, 0x40
dec ebp
push eax
inc ecx
add esp, 4
pop ecx
push ebx
push esi
add esp, 4
call 0x5120ed
add byte [edi], bh
dec edi
push eax
xor edi, dword [ecx]
xor eax, 0x45353d37
add esp, 4
pop ebx
mov byte [ebp - 0x804], 0x45
mov byte [ebp - 0x803], 0x78
mov byte [ebp - 0x802], 0x69
mov byte [ebp - 0x801], 0x74
mov byte [ebp - 0x800], 0x50
mov byte [ebp - 0x7ff], 0x72
mov byte [ebp - 0x7fe], 0x6f
mov byte [ebp - 0x7fd], 0x63
mov byte [ebp - 0x7fc], 0x65
mov byte [ebp - 0x7fb], 0x73
mov byte [ebp - 0x7fa], 0x73
mov byte [ebp - 0x7f9], 0
push ecx
jmp 0x51214c
or ecx, 0x1282f
pop ecx
push ecx
and ecx, 0x1644e
call 0x512167
add byte [ebp + 0x42], al
dec ecx
xor eax, 0x834b333f
les eax, [ecx + eax*4]
loope 0x51218b
cmp al, 0
add byte [ecx + 0xd519c9], al
add byte [ecx - 0x47], bl
imul eax, dword [eax], 0
add byte [esi - 0x77], ah
invalid
fucompp
invalid

Function at 0x5120d4
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop eax
push eax
xor eax, 0x46a5
or eax, 0x72b1
jmp 0x511e49
sub eax, 0x2b9f
pop eax
jmp 0x512083
push esi
push ecx
add esp, 4
sub esi, 0x41c0
or esi, 0xd21e
pop esi
push esi
jmp 0x51209b
xor esi, 0x3e84
call 0x5120b1
add byte [ecx], bh
inc ecx
inc edi
xor al, 0x34
dec ecx
inc ecx
dec ecx
xor al, 0x4c
add esp, 4
pop esi
mov dword [ebp - 0xa5c], 0
push ecx
push esi
add esp, 4
call 0x5120d4
add byte [esi + 0x4c], al
cmp dh, byte [esp + eax*2]
cmp al, 0x40
dec ebp
push eax
inc ecx
add esp, 4
pop ecx
push ebx
push esi
add esp, 4
call 0x5120ed
add byte [edi], bh
dec edi
push eax
xor edi, dword [ecx]
xor eax, 0x45353d37
add esp, 4
pop ebx
mov byte [ebp - 0x804], 0x45
mov byte [ebp - 0x803], 0x78
mov byte [ebp - 0x802], 0x69
mov byte [ebp - 0x801], 0x74
mov byte [ebp - 0x800], 0x50
mov byte [ebp - 0x7ff], 0x72
mov byte [ebp - 0x7fe], 0x6f
mov byte [ebp - 0x7fd], 0x63
mov byte [ebp - 0x7fc], 0x65
mov byte [ebp - 0x7fb], 0x73
mov byte [ebp - 0x7fa], 0x73
mov byte [ebp - 0x7f9], 0
push ecx
jmp 0x51214c
or ecx, 0x1282f
pop ecx
push ecx
and ecx, 0x1644e
call 0x512167
add byte [ebp + 0x42], al
dec ecx
xor eax, 0x834b333f
les eax, [ecx + eax*4]
loope 0x51218b
cmp al, 0
add byte [ecx + 0xd519c9], al
add byte [ecx - 0x47], bl
imul eax, dword [eax], 0
add byte [esi - 0x77], ah
invalid
fucompp
invalid
Function at 0x5120ed
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop eax
push eax
xor eax, 0x46a5
or eax, 0x72b1
jmp 0x511e49
sub eax, 0x2b9f
pop eax
jmp 0x512083
push esi
push ecx
add esp, 4
sub esi, 0x41c0
or esi, 0xd21e
pop esi
push esi
jmp 0x51209b
xor esi, 0x3e84
call 0x5120b1
add byte [ecx], bh
inc ecx
inc edi
xor al, 0x34
dec ecx
inc ecx
dec ecx
xor al, 0x4c
add esp, 4
pop esi
mov dword [ebp - 0xa5c], 0
push ecx
push esi
add esp, 4
call 0x5120d4
add byte [esi + 0x4c], al
cmp dh, byte [esp + eax*2]
cmp al, 0x40
dec ebp
push eax
inc ecx
add esp, 4
pop ecx
push ebx
push esi
add esp, 4
call 0x5120ed
add byte [edi], bh
dec edi
push eax
xor edi, dword [ecx]
xor eax, 0x45353d37
add esp, 4
pop ebx
mov byte [ebp - 0x804], 0x45
mov byte [ebp - 0x803], 0x78
mov byte [ebp - 0x802], 0x69
mov byte [ebp - 0x801], 0x74
mov byte [ebp - 0x800], 0x50
mov byte [ebp - 0x7ff], 0x72
mov byte [ebp - 0x7fe], 0x6f
mov byte [ebp - 0x7fd], 0x63
mov byte [ebp - 0x7fc], 0x65
mov byte [ebp - 0x7fb], 0x73
mov byte [ebp - 0x7fa], 0x73
mov byte [ebp - 0x7f9], 0
push ecx
jmp 0x51214c
or ecx, 0x1282f
pop ecx
push ecx
and ecx, 0x1644e
call 0x512167
add byte [ebp + 0x42], al
dec ecx
xor eax, 0x834b333f
les eax, [ecx + eax*4]
loope 0x51218b
cmp al, 0
add byte [ecx + 0xd519c9], al
add byte [ecx - 0x47], bl
imul eax, dword [eax], 0
add byte [esi - 0x77], ah
invalid
fucompp
invalid

Function at 0x512167
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop eax
push eax
xor eax, 0x46a5
or eax, 0x72b1
jmp 0x511e49
sub eax, 0x2b9f
pop eax
jmp 0x512083
push esi
push ecx
add esp, 4
sub esi, 0x41c0
or esi, 0xd21e
pop esi
push esi
jmp 0x51209b
xor esi, 0x3e84
call 0x5120b1
add byte [ecx], bh
inc ecx
inc edi
xor al, 0x34
dec ecx
inc ecx
dec ecx
xor al, 0x4c
add esp, 4
pop esi
mov dword [ebp - 0xa5c], 0
push ecx
push esi
add esp, 4
call 0x5120d4
add byte [esi + 0x4c], al
cmp dh, byte [esp + eax*2]
cmp al, 0x40
dec ebp
push eax
inc ecx
add esp, 4
pop ecx
push ebx
push esi
add esp, 4
call 0x5120ed
add byte [edi], bh
dec edi
push eax
xor edi, dword [ecx]
xor eax, 0x45353d37
add esp, 4
pop ebx
mov byte [ebp - 0x804], 0x45
mov byte [ebp - 0x803], 0x78
mov byte [ebp - 0x802], 0x69
mov byte [ebp - 0x801], 0x74
mov byte [ebp - 0x800], 0x50
mov byte [ebp - 0x7ff], 0x72
mov byte [ebp - 0x7fe], 0x6f
mov byte [ebp - 0x7fd], 0x63
mov byte [ebp - 0x7fc], 0x65
mov byte [ebp - 0x7fb], 0x73
mov byte [ebp - 0x7fa], 0x73
mov byte [ebp - 0x7f9], 0
push ecx
jmp 0x51214c
or ecx, 0x1282f
pop ecx
push ecx
and ecx, 0x1644e
call 0x512167
add byte [ebp + 0x42], al
dec ecx
xor eax, 0x834b333f
les eax, [ecx + eax*4]
loope 0x51218b
cmp al, 0
add byte [ecx + 0xd519c9], al
add byte [ecx - 0x47], bl
imul eax, dword [eax], 0
add byte [esi - 0x77], ah
invalid
fucompp
invalid
Function at 0x512508
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or ecx, 0x14501
jmp 0x51251a
pop ecx
push edx
and edx, 0x7cb4
jmp 0x51252b
pop edx
mov eax, dword [ebp - 0x4d4]
mov dword [ebp - 0x2e0], eax
jmp 0x5125a2

Function at 0x51254b
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop eax
push ebx
push ebx
add esp, 4
add ebx, 0xc29f
add ebx, 0xc46
sub ebx, 0x5a11
jmp 0x51256b
pop ebx
mov ecx, dword [ebp - 0x4d4]
mov edx, dword [ecx]
mov dword [ebp - 0x4d4], edx
mov eax, dword [ebp - 0x4d4]
cmp eax, dword [ebp - 0xc20]
je 0x512598
mov ecx, dword [ebp - 0x4d4]
cmp dword [ecx + 0x30], 0
jne 0x51234e
mov dword [ebp - 0x2e0], 0
Function at 0x513e34
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
or ecx, 0x4719
pop ecx
push esi
push edi
add esp, 4
add esi, 0xc58c
add esi, 0xd3ab
sub esi, 0x166e7
call 0x513d5b
add byte [edi + esi + 0x36], al
xor al, 0x3b
cmp byte [ebp + 0x37], al
inc ebx
add esp, 4
pop esi
lea eax, [ebp - 0x16e8]
mov dword [ebp - 0xc54], eax
mov ecx, dword [ebp - 0x4e8]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc50], edx
xor eax, eax
mov word [ebp - 0x208], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
push ecx
push ecx
add esp, 4
add ecx, 0xf724
sub ecx, 0xc2f7
pop ecx
push eax
push edi
add esp, 4
add eax, 0x20fc
pop eax
push ebx
or ebx, 0x142e1
xor ebx, 0xdd29
xor ebx, 0x7862
pop ebx
mov edx, dword [ebp - 0xc50]
mov ax, word [edx]
mov word [ebp - 0xf8e], ax
mov ecx, dword [ebp - 0xc50]
add ecx, 2
mov dword [ebp - 0xc50], ecx
mov dx, word [ebp - 0xf8e]
mov word [ebp - 0x208], dx
mov eax, dword [ebp - 0xc54]
mov cx, word [eax]
mov word [ebp - 0xf90], cx
mov edx, dword [ebp - 0xc54]
add edx, 2
mov dword [ebp - 0xc54], edx
mov ax, word [ebp - 0xf90]
mov word [ebp - 0x3c], ax
push esi
or esi, 0xcb91
and esi, 0x804a
xor esi, 0xef0b
pop esi
push ecx
call 0x513e34
add byte [ebx], bh
cmp al, 0x36
xor cl, byte [eax + 0x4d]
xor al, byte [ebx - 0x367efb3c]
daa
jnp 0x513e3c
add byte [ecx + 0xd7f8e9], al
add byte [ecx + 0xf], bl
mov bh, 0x4d
les eax, [ebp + 0xf1575c9]
mov bh, 0x95
clc
std
invalid
add dword [eax], eax
pop eax
mov eax, dword [ebp - 0x4e8]
mov ecx, dword [eax]
mov dword [ebp - 0x4e8], ecx
mov edx, dword [ebp - 0x4e8]
cmp edx, dword [ebp - 0xc58]
je 0x513f62
mov eax, dword [ebp - 0x4e8]
cmp dword [eax + 0x30], 0
jne 0x513d2d
invalid

Function at 0x513ed8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor edi, 0x3334
pop edi
push eax
add eax, 0xf722
sub eax, 0x14816
or eax, 0xa134
pop eax
mov edx, dword [ebp - 0x4e8]
mov dword [ebp - 0x710], edx
jmp 0x513f6c
Function at 0x513f33
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
or ecx, 0x4719
pop ecx
push esi
push edi
add esp, 4
add esi, 0xc58c
add esi, 0xd3ab
sub esi, 0x166e7
call 0x513d5b
add byte [edi + esi + 0x36], al
xor al, 0x3b
cmp byte [ebp + 0x37], al
inc ebx
add esp, 4
pop esi
lea eax, [ebp - 0x16e8]
mov dword [ebp - 0xc54], eax
mov ecx, dword [ebp - 0x4e8]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc50], edx
xor eax, eax
mov word [ebp - 0x208], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
push ecx
push ecx
add esp, 4
add ecx, 0xf724
sub ecx, 0xc2f7
pop ecx
push eax
push edi
add esp, 4
add eax, 0x20fc
pop eax
push ebx
or ebx, 0x142e1
xor ebx, 0xdd29
xor ebx, 0x7862
pop ebx
mov edx, dword [ebp - 0xc50]
mov ax, word [edx]
mov word [ebp - 0xf8e], ax
mov ecx, dword [ebp - 0xc50]
add ecx, 2
mov dword [ebp - 0xc50], ecx
mov dx, word [ebp - 0xf8e]
mov word [ebp - 0x208], dx
mov eax, dword [ebp - 0xc54]
mov cx, word [eax]
mov word [ebp - 0xf90], cx
mov edx, dword [ebp - 0xc54]
add edx, 2
mov dword [ebp - 0xc54], edx
mov ax, word [ebp - 0xf90]
mov word [ebp - 0x3c], ax
push esi
or esi, 0xcb91
and esi, 0x804a
xor esi, 0xef0b
pop esi
push ecx
call 0x513e34
add byte [ebx], bh
cmp al, 0x36
xor cl, byte [eax + 0x4d]
xor al, byte [ebx - 0x367efb3c]
daa
jnp 0x513e3c
add byte [ecx + 0xd7f8e9], al
add byte [ecx + 0xf], bl
mov bh, 0x4d
les eax, [ebp + 0xf1575c9]
mov bh, 0x95
clc
std
invalid
add dword [eax], eax
pop eax
mov eax, dword [ebp - 0x4e8]
mov ecx, dword [eax]
mov dword [ebp - 0x4e8], ecx
mov edx, dword [ebp - 0x4e8]
cmp edx, dword [ebp - 0xc58]
je 0x513f62
mov eax, dword [ebp - 0x4e8]
cmp dword [eax + 0x30], 0
jne 0x513d2d
invalid

Function at 0x513ff8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test dword [eax + 0xfffff5], ebp
add byte [eax], al
add cl, ch
sub byte [ebx], cl
add byte [eax], al
push ecx
call 0x513ff8
add byte [ecx + 0x49], cl
inc edx
cmp eax, 0x4b434c4b
add esp, 4
call 0x514008
add byte [edx + 0x4f], cl
inc edi
inc ebx
inc edi
cmp eax, dword [ebx + 0x515904c4]
xor ecx, 0x11b0e
sub ecx, 0x10e66
pop ecx
mov ecx, dword [ebp - 0x710]

Function at 0x514008
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test dword [eax + 0xfffff5], ebp
add byte [eax], al
add cl, ch
sub byte [ebx], cl
add byte [eax], al
push ecx
call 0x513ff8
add byte [ecx + 0x49], cl
inc edx
cmp eax, 0x4b434c4b
add esp, 4
call 0x514008
add byte [edx + 0x4f], cl
inc edi
inc ebx
inc edi
cmp eax, dword [ebx + 0x515904c4]
xor ecx, 0x11b0e
sub ecx, 0x10e66
pop ecx
mov ecx, dword [ebp - 0x710]
Function at 0x56d271
Capabilities:
Get common file path
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0056d10c

Function at 0x579332
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005791b1

Function at 0x57ebad
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0057e51b

Function at 0x57ebb8
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0057e756
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41b008]
jne 0x40100a
repz ret
jmp fcn.00401c7a

Function at 0x405afb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004032a3
and dword [ebp - 4], 0
cmp dword [0x41d134], 0
mov ebx, eax
jne 0x405bac
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x405c5d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x405c5d
push eax
call fcn.00403231
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x41d134], eax
call esi
push eax
call fcn.00403231
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x41d138], eax
call esi
push eax
call fcn.00403231
mov dword [esp], 0x418974
push edi
mov dword [0x41d13c], eax
call esi
push eax
call fcn.00403231
pop ecx
mov dword [0x41d144], eax
test eax, eax
je 0x405bac
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00403231
pop ecx
mov dword [0x41d140], eax
mov eax, dword [0x41d140]
cmp eax, ebx
je 0x405c04
cmp dword [0x41d144], ebx
je 0x405c04
push eax
call fcn.004032ac
push dword [0x41d144]
mov esi, eax
call fcn.004032ac
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x405c04
test edi, edi
je 0x405c04
call esi
test eax, eax
je 0x405bfb
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x405bfb
test byte [ebp - 0xc], 1
jne 0x405c04
or dword [ebp + 0x10], 0x200000
jmp 0x405c3d
mov eax, dword [0x41d138]
cmp eax, ebx
je 0x405c3d
push eax
call fcn.004032ac
pop ecx
test eax, eax
je 0x405c3d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x405c3d
mov eax, dword [0x41d13c]
cmp eax, ebx
je 0x405c3d
push eax
call fcn.004032ac
pop ecx
test eax, eax
je 0x405c3d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x41d134]
call fcn.004032ac
pop ecx
test eax, eax
je 0x405c5d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x405c5f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret