joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47bf57
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x13379797
pop eax
mov dword [ebp - 0x3f4], eax
push eax
sub eax, 0xa15d
or eax, 0x17e37
xor eax, 0xc6f
pop eax
push ecx
jmp 0x47bf43
or ecx, 0x1672a
call 0x47bf57
add byte [ebx], bh
xor al, byte [edi + 0x4b]
inc edx
inc edx
inc esp
aas
add esp, 4
pop ecx
mov ecx, dword [ebp - 0x20cc]
mov dword [ebp - 0x15c8], ecx
push esi
push esi
add esp, 4
xor esi, 0x18686
xor esi, 0x4dcb
pop esi
push eax
jmp 0x47bf80
and eax, 0xfa96
pop eax
push edi
push ecx
add esp, 4
and edi, 0x160d2
xor edi, 0x15ad
pop edi
mov edx, dword [ebp - 0x14]
add edx, 0x138
imul eax, dword [ebp - 0x10], 0x138
add eax, 0x55f3663b
imul ecx, dword [ebp - 0x10], 0x138
sub eax, ecx
xor edx, eax
imul edx, dword [ebp - 0x10]
mov dword [ebp - 0x15c8], edx
mov edx, dword [ebp - 0x3f4]
mov dword [ebp - 0x2014], edx
mov eax, dword [ebp - 0x2014]
add eax, dword [ebp - 0x15c8]
mov dword [ebp - 0x3f4], eax
push edi
push edi
add esp, 4
or edi, 0x12d18
xor edi, 0xd427
pop edi
push esi
push edx
add esp, 4
add esi, 0x464d
pop esi
push esi
sub esi, 0xfbf7
xor esi, 0x14bfb
sub esi, 0x9507
pop esi
mov byte [ebp - 0xbf0], 0x52
mov byte [ebp - 0xbef], 0xb9
mov byte [ebp - 0xbee], 0x10
mov byte [ebp - 0xbed], 0x10
mov byte [ebp - 0xbec], 0x10
mov byte [ebp - 0xbeb], 0x10
mov byte [ebp - 0xbea], 0x5a
push edx
and edx, 0xc0cf
and edx, 0x749a
add edx, 0x107fe
and edx, 0x7c9c
pop edx
push edi
push ebx
add esp, 4
or edi, 0x183d6
pop edi
push edi
push ecx
add esp, 4
or edi, 0x2462
pop edi
mov byte [ebp - 0xbe8], 0x52
mov byte [ebp - 0xbe7], 0xb9
mov byte [ebp - 0xbe6], 0x20
mov byte [ebp - 0xbe5], 0x20
mov byte [ebp - 0xbe4], 0x20
mov byte [ebp - 0xbe3], 0x20
mov byte [ebp - 0xbe2], 0x5a
push ecx
xor ecx, 0x14a54
pop ecx
push ebx
push esi
add esp, 4
or ebx, 0x1bb8
pop ebx
push ebx
push ecx
add esp, 4
sub ebx, 0x578
xor ebx, 0x8ebc
pop ebx
push eax
push eax
add esp, 4
sub eax, 0x3f30
pop eax
mov dword [ebp - 0x20d0], 0xe
push edx
push edx
add esp, 4
or edx, 0xd141
sub edx, 0xb28e
xor edx, 0x55e1
or edx, 0xc6e6
pop edx
push ecx
jmp 0x47c107
jmp 0x47c10e
add ecx, 0x1061e
pop ecx
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xbf0]
mov dword [ebp - 0x15cc], eax
push eax
push eax
add esp, 4
jmp 0x47c134
jmp 0x47c13b
xor eax, 0x9834
or eax, 0x6963
pop eax
push edx
and edx, 0x147d4
sub edx, 0x10ba9
and edx, 0x7595
pop edx
mov dword [ebp - 0x20d4], 0xffffffff
push edi
sub edi, 0x97de
xor edi, 0x14828
call 0x47c182
add byte [ebx], dh
inc edi
cmp dword [eax], edi
inc ecx
dec ebp
inc ecx
cmp al, byte [ebp - 0x7d]
les eax, [ecx + eax*4]
iretd
Function at 0x47c182
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x13379797
pop eax
mov dword [ebp - 0x3f4], eax
push eax
sub eax, 0xa15d
or eax, 0x17e37
xor eax, 0xc6f
pop eax
push ecx
jmp 0x47bf43
or ecx, 0x1672a
call 0x47bf57
add byte [ebx], bh
xor al, byte [edi + 0x4b]
inc edx
inc edx
inc esp
aas
add esp, 4
pop ecx
mov ecx, dword [ebp - 0x20cc]
mov dword [ebp - 0x15c8], ecx
push esi
push esi
add esp, 4
xor esi, 0x18686
xor esi, 0x4dcb
pop esi
push eax
jmp 0x47bf80
and eax, 0xfa96
pop eax
push edi
push ecx
add esp, 4
and edi, 0x160d2
xor edi, 0x15ad
pop edi
mov edx, dword [ebp - 0x14]
add edx, 0x138
imul eax, dword [ebp - 0x10], 0x138
add eax, 0x55f3663b
imul ecx, dword [ebp - 0x10], 0x138
sub eax, ecx
xor edx, eax
imul edx, dword [ebp - 0x10]
mov dword [ebp - 0x15c8], edx
mov edx, dword [ebp - 0x3f4]
mov dword [ebp - 0x2014], edx
mov eax, dword [ebp - 0x2014]
add eax, dword [ebp - 0x15c8]
mov dword [ebp - 0x3f4], eax
push edi
push edi
add esp, 4
or edi, 0x12d18
xor edi, 0xd427
pop edi
push esi
push edx
add esp, 4
add esi, 0x464d
pop esi
push esi
sub esi, 0xfbf7
xor esi, 0x14bfb
sub esi, 0x9507
pop esi
mov byte [ebp - 0xbf0], 0x52
mov byte [ebp - 0xbef], 0xb9
mov byte [ebp - 0xbee], 0x10
mov byte [ebp - 0xbed], 0x10
mov byte [ebp - 0xbec], 0x10
mov byte [ebp - 0xbeb], 0x10
mov byte [ebp - 0xbea], 0x5a
push edx
and edx, 0xc0cf
and edx, 0x749a
add edx, 0x107fe
and edx, 0x7c9c
pop edx
push edi
push ebx
add esp, 4
or edi, 0x183d6
pop edi
push edi
push ecx
add esp, 4
or edi, 0x2462
pop edi
mov byte [ebp - 0xbe8], 0x52
mov byte [ebp - 0xbe7], 0xb9
mov byte [ebp - 0xbe6], 0x20
mov byte [ebp - 0xbe5], 0x20
mov byte [ebp - 0xbe4], 0x20
mov byte [ebp - 0xbe3], 0x20
mov byte [ebp - 0xbe2], 0x5a
push ecx
xor ecx, 0x14a54
pop ecx
push ebx
push esi
add esp, 4
or ebx, 0x1bb8
pop ebx
push ebx
push ecx
add esp, 4
sub ebx, 0x578
xor ebx, 0x8ebc
pop ebx
push eax
push eax
add esp, 4
sub eax, 0x3f30
pop eax
mov dword [ebp - 0x20d0], 0xe
push edx
push edx
add esp, 4
or edx, 0xd141
sub edx, 0xb28e
xor edx, 0x55e1
or edx, 0xc6e6
pop edx
push ecx
jmp 0x47c107
jmp 0x47c10e
add ecx, 0x1061e
pop ecx
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xbf0]
mov dword [ebp - 0x15cc], eax
push eax
push eax
add esp, 4
jmp 0x47c134
jmp 0x47c13b
xor eax, 0x9834
or eax, 0x6963
pop eax
push edx
and edx, 0x147d4
sub edx, 0x10ba9
and edx, 0x7595
pop edx
mov dword [ebp - 0x20d4], 0xffffffff
push edi
sub edi, 0x97de
xor edi, 0x14828
call 0x47c182
add byte [ebx], dh
inc edi
cmp dword [eax], edi
inc ecx
dec ebp
inc ecx
cmp al, byte [ebp - 0x7d]
les eax, [ecx + eax*4]
iretd
Function at 0x47d490
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
inc dword [ebx]
test dword [esi + edi*8 - 1], ebp
dec dword [edi]
mov esi, 0x6c958b08
invalid

Function at 0x47d510
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x760]
add edx, dword [ebp - 0x194]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x194]
movsx edx, byte [ebp + ecx - 0x898]
cmp eax, edx
jne 0x47d53d
mov dword [ebp - 0xcac], 0
jmp 0x47d5ac
push ebx
push ecx
add esp, 4
add ebx, 0x5950
and ebx, 0xd684
pop ebx
push esi
push esi
add esp, 4
jmp 0x47d559
pop esi
push edi
xor edi, 0x7cb9
add byte [ecx + 0x1289cf], al
add bl, ch
invalid
pop edi
Function at 0x47e517
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or eax, 0x11bf5
pop eax
lea eax, [ebp - 0x17c8]
mov dword [ebp - 0xcd0], eax
mov ecx, dword [ebp - 0x51c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xccc], edx
xor eax, eax
mov word [ebp - 0x220], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
push edi
push eax
add esp, 4
call 0x47e55f
add byte [ebp + ecx*2 + 0x3f], al
dec edi
xor edi, dword [esi]
cmp dh, byte [edi]
cmp eax, 0x8104c483
iretd

Function at 0x47e55f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or eax, 0x11bf5
pop eax
lea eax, [ebp - 0x17c8]
mov dword [ebp - 0xcd0], eax
mov ecx, dword [ebp - 0x51c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xccc], edx
xor eax, eax
mov word [ebp - 0x220], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
push edi
push eax
add esp, 4
call 0x47e55f
add byte [ebp + ecx*2 + 0x3f], al
dec edi
xor edi, dword [esi]
cmp dh, byte [edi]
cmp eax, 0x8104c483
iretd

Function at 0x47e9b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and edi, 0x666f
or edi, 0x6afc
add edi, 0x10f50
pop edi
mov ecx, dword [ebp - 0x784]
add ecx, dword [ebp - 0x19c]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x19c]
movsx ecx, byte [ebp + eax - 0x8a8]

Function at 0x47e9e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x19c]
add edx, 1
mov dword [ebp - 0x19c], edx
mov eax, dword [ebp - 0x784]
add eax, dword [ebp - 0x19c]
movsx ecx, byte [eax]
test ecx, ecx
je 0x47ea16
mov edx, dword [ebp - 0x19c]
movsx eax, byte [ebp + edx - 0x8a8]
test eax, eax
je 0x47ea16
push eax
push eax
add esp, 4
sub eax, 0x4036
and eax, 0x10696
jmp 0x47e9a8
sub eax, 0x12fee
pop eax
push edi
cmp edx, ecx
je 0x47ea08
mov edx, dword [ebp - 0x784]
add edx, dword [ebp - 0x19c]
movsx eax, byte [edx]
xor eax, 0x20
mov ecx, dword [ebp - 0x19c]
movsx edx, byte [ebp + ecx - 0x8a8]
cmp eax, edx
jne 0x47ea0f
jmp 0x47e955
jmp 0x47ea16
push ebx
jmp 0x47ea1e
jmp 0x47ea27
or ebx, 0xf9e1
pop ebx
push ecx
sub ecx, 0x100cc
xor ecx, 0xaacb
invalid
int1
sti
push ecx
invalid

Function at 0x47ea70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
add bl, ch
outsd dx, dword [esi]
push ecx
push edi
add esp, 4
jmp 0x47ea82
sub ecx, 0x46c6
jmp 0x47ea90
pop ecx
push ecx
xor ecx, 0xa74e
pop ecx
push edx
add edx, 0x11b09

Function at 0x47eaa0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add edx, 0xaf1a
pop edx
mov ecx, dword [ebp - 0x784]
add ecx, dword [ebp - 0x19c]
movsx edx, byte [ecx]
or edx, 0x20
mov eax, dword [ebp - 0x19c]
movsx ecx, byte [ebp + eax - 0x8a8]
or ecx, 0x20
cmp edx, ecx
jge 0x47eada
mov dword [ebp - 0xcd8], 0xffffffff
jmp 0x47eae4
mov dword [ebp - 0xcd8], 1
Function at 0x47eb29
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor esi, 0xd8be
add byte [eax], al
push ecx
push edx
add esp, 4
sub ecx, 0x1477
and ecx, 0xd880
and ecx, 0xcd8
xor ecx, 0xa5d7
pop ecx
push ecx
and ecx, 0x143f
add ecx, 0x2518
or ecx, 0xfa1e
pop ecx
mov dword [ebp - 0xac0], 0
jmp 0x47f2d2
push edi
sub edi, 0x1651b
or edi, 0x182e
or edi, 0x15541
or edi, 0x14f45
pop edi
push ecx
push edx
add esp, 4
add ecx, 0x44c0
or ecx, 0x6797
and ecx, 0xb93f
pop ecx
mov ecx, dword fs:[0x18]
push eax
push ebx
add esp, 4
xor eax, 0x7c57
xor eax, 0x74c5
sub eax, 0x5c50
pop eax
push edx
or edx, 0xe789
pop edx
push ebx
push esi
add esp, 4
and ebx, 0x171b8
or ebx, 0x15a72
pop ebx
mov edx, dword [ebp - 0xac0]
mov dword [ebp - 0x1a08], edx
lea eax, [ebp - 0xcec]
push eax
push 0x40
mov ecx, dword [ebp - 0x169c]
push ecx
mov edx, dword [ebp - 0x3e4]
push edx
call dword [ebp - 0x1a08]
test eax, eax
jne 0x47f377
push ebx
and ebx, 0x1469a
or ebx, 0x14c77
pop ebx
push ebx
and ebx, 0xb96d
call fcn.0047f353
add byte [eax + 0x4a], al
dec eax
dec ebp

Function at 0x47ec20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 0x19f0], ecx
mov edx, dword [ebp - 0x19f0]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x19f4], eax
mov ecx, dword [ebp - 0x19f4]
mov dword [ebp - 0x1684], ecx
push esi
push esi
add esp, 4
or esi, 0x1719b
pop esi
push ecx
call 0x47ec5d
add byte [esi], dh
cmp dword [edx], edi
cmp ecx, dword ds:[eax + 0x40]
dec ebx
dec esi
add esp, 4
or ecx, 0xd69f
or ecx, 0x18253
and ecx, 0x17bb6
pop ecx
cmp dword [ebp - 0x1684], 0
jne 0x47ec8b
mov dword [ebp - 0x2f4], 0
jmp 0x47ef32
mov edx, dword [ebp - 0x1684]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xce4], ecx
push edi
or edi, 0x1447f
sub edi, 0xbeb6
xor edi, 0x572f

Function at 0x47ec5d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 0x19f0], ecx
mov edx, dword [ebp - 0x19f0]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x19f4], eax
mov ecx, dword [ebp - 0x19f4]
mov dword [ebp - 0x1684], ecx
push esi
push esi
add esp, 4
or esi, 0x1719b
pop esi
push ecx
call 0x47ec5d
add byte [esi], dh
cmp dword [edx], edi
cmp ecx, dword ds:[eax + 0x40]
dec ebx
dec esi
add esp, 4
or ecx, 0xd69f
or ecx, 0x18253
and ecx, 0x17bb6
pop ecx
cmp dword [ebp - 0x1684], 0
jne 0x47ec8b
mov dword [ebp - 0x2f4], 0
jmp 0x47ef32
mov edx, dword [ebp - 0x1684]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xce4], ecx
push edi
or edi, 0x1447f
sub edi, 0xbeb6
xor edi, 0x572f

Function at 0x47ecb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and edi, 0x10e15
pop edi
push edx
push esi
add esp, 4
add edx, 0x5a0
add edx, 0xd63a
or edx, 0x2bcd
pop edx
cmp dword [ebp - 0xce4], 0
jne 0x47ece7
mov dword [ebp - 0x2f4], 0
jmp 0x47ef32
mov edx, dword [ebp - 0xce4]
mov dword [ebp - 0x520], edx
Function at 0x47ed5e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edx
push esi
add esp, 4
sub edx, 0x8a2f
pop edx
push edi
push ebx
add esp, 4
jmp 0x47ed0a
add edi, 0x13ea7
or edi, 0xecd1
sub edi, 0x15fa6
pop edi
push eax
xor eax, 0x2ef2
pop eax
lea eax, [ebp - 0x1740]
mov dword [ebp - 0xce0], eax
mov ecx, dword [ebp - 0x520]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xcdc], edx
xor eax, eax
mov word [ebp - 0x224], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
push esi
call 0x47ed5e
add byte [ebp + 0x48], al
dec esi
cmp dword [0x833b3636], esi
les eax, [esi + ebx*2]
push edi
push edi
add esp, 4
or edi, 0xe7aa
call 0x47ed7d
add byte [edi], dh
dec esi
cmp bh, byte [esp + esi]
inc esi
cmp bh, byte [edi + ecx*2]
dec ebx
add esp, 4
pop edi
mov edx, dword [ebp - 0xcdc]
mov ax, word [edx]
mov word [ebp - 0x104a], ax
mov ecx, dword [ebp - 0xcdc]
add ecx, 2
mov dword [ebp - 0xcdc], ecx
push ebp
sar byte [ebx], 0xca
je 0x47ed4f
movzx eax, word [ebp - 0x224]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x47ed4f
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x47ee6b
mov dword [ebp - 0x1688], 0xffffffff
jmp 0x47ee75
mov dword [ebp - 0x1688], 1
mov ecx, dword [ebp - 0x1688]
mov dword [ebp - 0x168c], ecx
cmp dword [ebp - 0x168c], 0
jne 0x47eeca
push edx
xor edx, 0x806e
sub edx, 0x8c4c
xor edx, 0x6388
pop edx
push ecx
push edi
add esp, 4
and ecx, 0x143cb
and ecx, 0xbb8b
xor ecx, 0xa5dd
add ecx, 0xe8aa
pop ecx
invalid
xchg ebp, eax
loopne 0x47eeba

Function at 0x47ed7d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edx
push esi
add esp, 4
sub edx, 0x8a2f
pop edx
push edi
push ebx
add esp, 4
jmp 0x47ed0a
add edi, 0x13ea7
or edi, 0xecd1
sub edi, 0x15fa6
pop edi
push eax
xor eax, 0x2ef2
pop eax
lea eax, [ebp - 0x1740]
mov dword [ebp - 0xce0], eax
mov ecx, dword [ebp - 0x520]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xcdc], edx
xor eax, eax
mov word [ebp - 0x224], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
push esi
call 0x47ed5e
add byte [ebp + 0x48], al
dec esi
cmp dword [0x833b3636], esi
les eax, [esi + ebx*2]
push edi
push edi
add esp, 4
or edi, 0xe7aa
call 0x47ed7d
add byte [edi], dh
dec esi
cmp bh, byte [esp + esi]
inc esi
cmp bh, byte [edi + ecx*2]
dec ebx
add esp, 4
pop edi
mov edx, dword [ebp - 0xcdc]
mov ax, word [edx]
mov word [ebp - 0x104a], ax
mov ecx, dword [ebp - 0xcdc]
add ecx, 2
mov dword [ebp - 0xcdc], ecx
push ebp
sar byte [ebx], 0xca
je 0x47ed4f
movzx eax, word [ebp - 0x224]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x47ed4f
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x47ee6b
mov dword [ebp - 0x1688], 0xffffffff
jmp 0x47ee75
mov dword [ebp - 0x1688], 1
mov ecx, dword [ebp - 0x1688]
mov dword [ebp - 0x168c], ecx
cmp dword [ebp - 0x168c], 0
jne 0x47eeca
push edx
xor edx, 0x806e
sub edx, 0x8c4c
xor edx, 0x6388
pop edx
push ecx
push edi
add esp, 4
and ecx, 0x143cb
and ecx, 0xbb8b
xor ecx, 0xa5dd
add ecx, 0xe8aa
pop ecx
invalid
xchg ebp, eax
loopne 0x47eeba
Function at 0x47eda0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dx, word [ebp - 0x104a]
mov word [ebp - 0x224], dx
mov eax, dword [ebp - 0xce0]
mov cx, word [eax]
mov word [ebp - 0x104c], cx
mov edx, dword [ebp - 0xce0]
add edx, 2
mov dword [ebp - 0xce0], edx
mov ax, word [ebp - 0x104c]
mov word [ebp - 0x40], ax
push esi
push edx
add esp, 4
sub esi, 0x142cb
add esi, 0x15539
xor esi, 0x77f7
sub esi, 0x181c2
pop esi
push eax
push edx
add esp, 4
add eax, 0xbfd6
pop eax
push eax
xor eax, 0xb7c8
pop eax
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x47ee27
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x168c], edx
jmp 0x47ee81
movzx ecx, word [ebp - 0x224]
movzx edx, word [ebp - 0x40]
push ebp
sar byte [ebx], 0xca

Function at 0x47ee30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edx
push esi
add esp, 4
sub edx, 0x8a2f
pop edx
push edi
push ebx
add esp, 4
jmp 0x47ed0a
add edi, 0x13ea7
or edi, 0xecd1
sub edi, 0x15fa6
pop edi
push eax
xor eax, 0x2ef2
pop eax
lea eax, [ebp - 0x1740]
mov dword [ebp - 0xce0], eax
mov ecx, dword [ebp - 0x520]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xcdc], edx
xor eax, eax
mov word [ebp - 0x224], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
push esi
call 0x47ed5e
add byte [ebp + 0x48], al
dec esi
cmp dword [0x833b3636], esi
les eax, [esi + ebx*2]
push edi
push edi
add esp, 4
or edi, 0xe7aa
call 0x47ed7d
add byte [edi], dh
dec esi
cmp bh, byte [esp + esi]
inc esi
cmp bh, byte [edi + ecx*2]
dec ebx
add esp, 4
pop edi
mov edx, dword [ebp - 0xcdc]
mov ax, word [edx]
mov word [ebp - 0x104a], ax
mov ecx, dword [ebp - 0xcdc]
add ecx, 2
mov dword [ebp - 0xcdc], ecx
push ebp
sar byte [ebx], 0xca
je 0x47ed4f
movzx eax, word [ebp - 0x224]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x47ed4f
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x47ee6b
mov dword [ebp - 0x1688], 0xffffffff
jmp 0x47ee75
mov dword [ebp - 0x1688], 1
mov ecx, dword [ebp - 0x1688]
mov dword [ebp - 0x168c], ecx
cmp dword [ebp - 0x168c], 0
jne 0x47eeca
push edx
xor edx, 0x806e
sub edx, 0x8c4c
xor edx, 0x6388
pop edx
push ecx
push edi
add esp, 4
and ecx, 0x143cb
and ecx, 0xbb8b
xor ecx, 0xa5dd
add ecx, 0xe8aa
pop ecx
invalid
xchg ebp, eax
loopne 0x47eeba
Function at 0x482330
Capabilities:
Encode data using xor
Execute syscall

Disassembly:
ljmp 0xea81:0x9a900404
add al, 4
nop
xchg edx, eax
jge 0x482320
add al, 4
mov ss, word [edx + 0x404ede9]
pop esp
push esi
mov cl, cl
or ebp, ebp
or al, 5
add eax, 0x533c0505
dec ecx
dec ebx
dec ecx
push eax
invalid
Function at 0x20004370
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x20001284]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x10], 0x54
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xe], 0x6e
mov byte [ebp - 0xd], 0x53
mov byte [ebp - 0xc], 0x4c
mov byte [ebp - 0xb], 0x58
mov byte [ebp - 0xa], 0x2e
mov byte [ebp - 9], 0x64
mov byte [ebp - 8], 0x6c
mov byte [ebp - 7], 0x6c
mov byte [ebp - 6], 0
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x200043be
xor eax, eax
jmp 0x200043c3
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.2000e122
mov esp, ebp
pop ebp
ret
Function at 0x20005d80
Capabilities:
Check if file exists
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x2000ed88
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x20001284]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x3c]
call fcn.20006db0
mov dword [ebp - 4], 0
mov byte [ebp - 0x2c], 0x64
mov byte [ebp - 0x2b], 0x3a
mov byte [ebp - 0x2a], 0x5c
mov byte [ebp - 0x29], 0x44
mov byte [ebp - 0x28], 0x46
mov byte [ebp - 0x27], 0x4f
mov byte [ebp - 0x26], 0x2e
mov byte [ebp - 0x25], 0x49
mov byte [ebp - 0x24], 0x4e
mov byte [ebp - 0x23], 0x49
mov byte [ebp - 0x22], 0
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x3c]
call fcn.20006e50
mov byte [ebp - 0x44], 0xd0
mov byte [ebp - 0x43], 0xc5
mov byte [ebp - 0x42], 0xcf
mov byte [ebp - 0x41], 0xa2
mov byte [ebp - 0x40], 0
mov byte [ebp - 0x34], 0xd5
mov byte [ebp - 0x33], 0xcb
mov byte [ebp - 0x32], 0xba
mov byte [ebp - 0x31], 0xc5
mov byte [ebp - 0x30], 0
mov byte [ebp - 0x20], 0xb1
mov byte [ebp - 0x1f], 0xb6
mov byte [ebp - 0x1e], 0xca
mov byte [ebp - 0x1d], 0xfd
mov byte [ebp - 0x1c], 0
mov byte [ebp - 0x54], 0xc3
mov byte [ebp - 0x53], 0xdc
mov byte [ebp - 0x52], 0xc2
mov byte [ebp - 0x51], 0xeb
mov byte [ebp - 0x50], 0
mov byte [ebp - 0x4c], 0xc4
mov byte [ebp - 0x4b], 0xcd
mov byte [ebp - 0x4a], 0xbe
mov byte [ebp - 0x49], 0xc3
mov byte [ebp - 0x48], 0
mov byte [ebp - 0x18], 0xce
mov byte [ebp - 0x17], 0xfc
mov byte [ebp - 0x16], 0xb9
mov byte [ebp - 0x15], 0xd6
mov byte [ebp - 0x14], 0
lea ecx, [ebp - 0x2c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x20005edb
push 0x20002b13
lea edx, [ebp - 0x34]
push edx
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x3c]
call fcn.20006f60
push 0x20002b3e
lea ecx, [ebp - 0x54]
push ecx
lea edx, [ebp - 0x44]
push edx
lea ecx, [ebp - 0x3c]
call fcn.20006f60
push 0xa
push 0xa
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x44]
push ecx
lea ecx, [ebp - 0x3c]
call fcn.20007040
push 0xa
push 0
lea edx, [ebp - 0x4c]
push edx
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x3c]
call fcn.20007040
push 0xa
push 1
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x44]
push edx
lea ecx, [ebp - 0x3c]
call fcn.20007040
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.20006e10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.2000e122
mov esp, ebp
pop ebp
ret
Function at 0x20006000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x2000ed58
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x20001284]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x30]
call fcn.20006db0
mov dword [ebp - 4], 0
mov byte [ebp - 0x28], 0x64
mov byte [ebp - 0x27], 0x3a
mov byte [ebp - 0x26], 0x5c
mov byte [ebp - 0x25], 0x44
mov byte [ebp - 0x24], 0x46
mov byte [ebp - 0x23], 0x4f
mov byte [ebp - 0x22], 0x2e
mov byte [ebp - 0x21], 0x49
mov byte [ebp - 0x20], 0x4e
mov byte [ebp - 0x1f], 0x49
mov byte [ebp - 0x1e], 0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x30]
call fcn.20006e50
mov byte [ebp - 0x38], 0xd0
mov byte [ebp - 0x37], 0xc5
mov byte [ebp - 0x36], 0xcf
mov byte [ebp - 0x35], 0xa2
mov byte [ebp - 0x34], 0
mov byte [ebp - 0x1c], 0xb1
mov byte [ebp - 0x1b], 0xb6
mov byte [ebp - 0x1a], 0xca
mov byte [ebp - 0x19], 0xfd
mov byte [ebp - 0x18], 0
push 0xa
push 0
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x38]
push edx
lea ecx, [ebp - 0x30]
call fcn.20006fb0
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.20006e10
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.2000e122
mov esp, ebp
pop ebp
ret

Function at 0x200061f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x2000ecf8
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x20001284]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x30]
call fcn.20006db0
mov dword [ebp - 4], 0
mov byte [ebp - 0x28], 0x64
mov byte [ebp - 0x27], 0x3a
mov byte [ebp - 0x26], 0x5c
mov byte [ebp - 0x25], 0x44
mov byte [ebp - 0x24], 0x46
mov byte [ebp - 0x23], 0x4f
mov byte [ebp - 0x22], 0x2e
mov byte [ebp - 0x21], 0x49
mov byte [ebp - 0x20], 0x4e
mov byte [ebp - 0x1f], 0x49
mov byte [ebp - 0x1e], 0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x30]
call fcn.20006e50
mov byte [ebp - 0x38], 0xd0
mov byte [ebp - 0x37], 0xc5
mov byte [ebp - 0x36], 0xcf
mov byte [ebp - 0x35], 0xa2
mov byte [ebp - 0x34], 0
mov byte [ebp - 0x1c], 0xce
mov byte [ebp - 0x1b], 0xfc
mov byte [ebp - 0x1a], 0xb9
mov byte [ebp - 0x19], 0xd6
mov byte [ebp - 0x18], 0
push 0xa
push 1
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x38]
push edx
lea ecx, [ebp - 0x30]
call fcn.20006fb0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x200062bf
mov dword [ebp - 0x3c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.20006e10
mov eax, dword [ebp - 0x3c]
jmp 0x200062d8
mov dword [ebp - 0x40], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.20006e10
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.2000e122
mov esp, ebp
pop ebp
ret