joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10042bd7
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10054040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp eax, 0x1a
jbe 0x10042c1a
call fcn.1002f5f6
mov dword [eax], 0xf
call fcn.1002f609
mov dword [eax], 0xd
call fcn.10028aba
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100229ab
leave
ret
test eax, eax
jne 0x10042c21
inc eax
jmp 0x10042c0e
add eax, 0x40
push 0x3a
mov word [ebp - 0xc], ax
pop eax
mov word [ebp - 0xa], ax
push 0x5c
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, eax
test ecx, ecx
je 0x10042c0c
xor eax, eax
cmp ecx, 1
setne al
jmp 0x10042c0e
Function at 0x10044171
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.100440ed
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x100442e0
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x100442e0
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x10044295
jg 0x100441cd
test eax, eax
je 0x1004428b
push 1
push 0x1000
call fcn.10035fd3
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x100441f0
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x10044282
push 0x8000
push ebx
call fcn.1004401e
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x10044219
jg 0x10044214
cmp ecx, 0x1000
jb 0x10044219
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.100370ac
add esp, 0x10
cmp eax, 0xffffffff
je 0x1004425e
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x10044214
jl 0x10044245
test ecx, ecx
jne 0x10044206
push dword [ebp - 0xc]
push ebx
call fcn.1004401e
push esi
call fcn.10032dd2
add esp, 0xc
xor ebx, ebx
jmp 0x100442ee
cmp byte [edi + 0x24], 0
je 0x10044275
cmp dword [edi + 0x20], 5
jne 0x10044275
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x10044280
mov ebx, dword [edi + 0x18]
jmp 0x10044282
xor ebx, ebx
push esi
call fcn.10032dd2
pop ecx
jmp 0x100442ee
test ecx, ecx
jg 0x10044257
jl 0x10044295
test eax, eax
jae 0x10044257
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1003a903
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x100442b5
cmp byte [edi + 0x1c], 0
je 0x10044257
jmp 0x100442e6
push ebx
call fcn.10038818
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x10044257
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x100442ee
cmp byte [edi + 0x1c], 0
je 0x100442eb
mov ebx, dword [edi + 0x18]
jmp 0x100442ee
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.1003a903
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10045bd0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10045bfd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10045bfd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4153cb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00411916
and dword [ebp - 4], 0
cmp dword [0x4785b8], 0
mov ebx, eax
jne 0x41547c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41552d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x41552d
push eax
call fcn.004118a4
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4785b8], eax
call esi
push eax
call fcn.004118a4
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4785bc], eax
call esi
push eax
call fcn.004118a4
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4785c0], eax
call esi
push eax
call fcn.004118a4
pop ecx
mov dword [0x4785c8], eax
test eax, eax
je 0x41547c
push 0x425e84
push edi
call esi
push eax
call fcn.004118a4
pop ecx
mov dword [0x4785c4], eax
mov eax, dword [0x4785c4]
cmp eax, ebx
je 0x4154d4
cmp dword [0x4785c8], ebx
je 0x4154d4
push eax
call fcn.0041191f
push dword [0x4785c8]
mov esi, eax
call fcn.0041191f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4154d4
test edi, edi
je 0x4154d4
call esi
test eax, eax
je 0x4154cb
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4154cb
test byte [ebp - 0xc], 1
jne 0x4154d4
or dword [ebp + 0x10], 0x200000
jmp 0x41550d
mov eax, dword [0x4785bc]
cmp eax, ebx
je 0x41550d
push eax
call fcn.0041191f
pop ecx
test eax, eax
je 0x41550d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41550d
mov eax, dword [0x4785c0]
cmp eax, ebx
je 0x41550d
push eax
call fcn.0041191f
pop ecx
test eax, eax
je 0x41550d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4785b8]
call fcn.0041191f
pop ecx
test eax, eax
je 0x41552d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41552f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x415a35
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x476f28]
jne 0x415a3f
repz ret
jmp fcn.0041e01f
Function at 0x421e49
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0xa0
mov eax, dword [0x476554]
add eax, 0xffffda07
mov dword [0x476554], eax
call fcn.00401070
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x2c], ecx
je 0x421ef4
jmp 0x421fcb
lea eax, [esp + 0x30]
mov dword [esp], eax
call fcn.0042207a
lea ecx, [0x42339e]
mov dword [0x476558], 0xb1d
mov edx, dword [esp + 0x30]
mov dword [esp + 0x48], edx
mov dword [esp + 0x5c], 0x142200
mov edx, dword [0x476540]
mov dword [esp + 0x64], edx
mov edx, dword [0x476544]
mov dword [esp + 0x4c], edx
mov edx, dword [0x476548]
mov dword [esp + 0x8c], edx
mov edx, dword [0x47654c]
mov dword [esp + 0x40], edx
mov dword [0x476554], 0x135a
mov edx, dword [0x476550]
mov dword [esp + 0x90], edx
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], ecx
jmp 0x421f2a
lea eax, [esp + 0x40]
mov dword [0x476554], 0xbdc
mov dword [esp + 0x20], eax
call fcn.004230fb
mov dword [esp + 0x1c], eax
xor eax, eax
mov ecx, dword [esp + 0x1c]
cmp ecx, 0
mov dword [esp + 0x18], eax
je 0x421e7c
jmp 0x421fc3
mov eax, dword [esp + 0x24]
cmp word [eax], 0x5a4d
mov dword [esp + 0x14], eax
jne 0x421f4d
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0x10], ecx
je 0x421f61
mov eax, dword [esp + 0x14]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x24], eax
jmp 0x421f2a
lea eax, [esp + 0x40]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x68], ecx
mov edx, dword [esp + 0x10]
mov esi, dword [ecx + edx + 0x50]
mov dword [esp + 0x7c], esi
mov dword [0x476554], 0x111c
mov esi, dword [esp + 0x38]
mov dword [esp], eax
mov dword [esp + 4], esi
call fcn.00422341
mov dword [esp + 0xc], eax
mov eax, esp
lea ecx, [esp + 0x40]
mov dword [eax], ecx
mov eax, dword [esp + 0xc]
call eax
sub esp, 4
mov eax, 1
mov ecx, dword [0x476554]
add ecx, 0xfffff0fe
mov dword [0x476554], ecx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
Function at 0x422341
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
lea edx, [0x42560b]
mov esi, 0xe
lea edi, [ebp - 0x28]
mov dword [0x476554], 0x90d
mov dword [0x476558], 0xb59
mov dword [esp], edi
mov dword [esp + 4], edx
mov dword [esp + 8], 0xe
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], esi
call fcn.00422a47
mov eax, dword [0x476554]
add eax, 0x1da2
mov dword [0x476558], eax
call fcn.004225ed
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
call fcn.00422839
xor ecx, ecx
cmp eax, 0
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], ecx
je 0x422485
mov eax, dword [ebp - 0x3c]
mov dword [0x476558], 0xc01
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [0x476554], 0x1a95
mov dword [esp], eax
mov ecx, dword [ebp - 0x2c]
mov dword [esp + 4], ecx
mov dword [ebp - 0x44], eax
call fcn.0042268e
xor eax, eax
mov ecx, dword [ebp - 0x44]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xc0
mov dword [ecx + 0xc0], 0x4550
mov dword [0x476558], 0x539
add ecx, 0xffc00000
mov edx, dword [ebp - 0x30]
mov dword [edx + 0x54], ecx
mov ecx, dword [0x476558]
add ecx, 0xffffeed3
mov dword [0x476558], ecx
mov ecx, dword [ebp - 0x44]
mov dword [edx + 0x38], ecx
mov dword [0x476554], 0x147
cmp ecx, 0
mov dword [ebp - 0x40], eax
je 0x422485
mov eax, dword [ebp - 0x44]
add eax, 0x168b
mov dword [0x476558], 0x1479
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
add esp, 0x4c
pop esi
pop edi
pop ebp
ret
Function at 0x422bab
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x47655c], 0
mov dword [0x476560], 0
mov dword [0x47656c], 0
mov ebx, dword [0x476554]
add ebx, 0x5f1
mov dword [0x476554], ebx
cmp eax, 0
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov eax, edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], edi
je 0x422d2c
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x14]
mov edi, 0x100
mov ebx, edx
add ebx, 1
add eax, 1
add ecx, 0x214e
mov dword [0x476554], ecx
mov dword [ebp - 0x30], edx
cdq
idiv edi
mov dword [0x47655c], edx
mov dword [0x476558], 0xe94
mov ecx, dword [ebp - 0x24]
movzx ecx, byte [ecx + edx]
add ecx, esi
mov eax, ecx
mov dword [ebp - 0x34], edx
cdq
idiv edi
mov dword [0x476560], edx
mov ecx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x476564], cl
mov edi, dword [ebp - 0x24]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov dword [0x476554], 0x20fe
mov cl, byte [0x476564]
mov edx, dword [0x476560]
mov byte [edi + edx], cl
mov edx, dword [0x47655c]
movzx edx, byte [edi + edx]
mov ecx, dword [0x476560]
movzx ecx, byte [edi + ecx]
add ecx, edx
and ecx, 0xff
mov dword [0x47656c], ecx
mov dword [0x476554], 0x211
mov cl, byte [edi + ecx]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x30]
mov ch, byte [edx + esi]
mov byte [0x476571], ch
mov byte [0x476572], cl
mov dword [0x476554], 0x1106
xor ch, cl
mov byte [0x476570], ch
mov edx, dword [ebp - 0x20]
mov byte [edx + esi], ch
mov edx, dword [ebp - 0x10]
cmp ebx, edx
mov dword [ebp - 0x38], ebx
je 0x422d2c
mov eax, dword [0x476554]
mov ecx, dword [0x47655c]
mov edx, dword [0x476560]
mov esi, dword [ebp - 0x38]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x2c], ecx
jmp 0x422c19
mov eax, dword [0x476558]
add eax, 0x221
mov dword [0x476558], eax
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x422dea
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x476560], 0
mov byte [0x476564], 0
mov dword [0x476554], 0x9b7
mov dword [0x47655c], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x422e42
xor eax, eax
mov dword [0x47655c], 0
mov dword [ebp - 0x20], eax
jmp 0x422e74
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x476554], 0x1a34
mov eax, dword [0x47655c]
add eax, 1
mov dword [0x47655c], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x422e42
jmp 0x422e31
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [0x476568], 0
mov dword [ebp - 0x24], eax
xor edx, edx
mov esi, dword [ebp - 0x10]
div esi
mov dword [0x476558], 0xa70
mov edi, dword [0x476560]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x24]
movzx esi, byte [ebx + esi]
add esi, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add esi, edx
mov dword [0x476568], esi
mov dword [0x476554], 0x2605
mov eax, esi
cdq
idiv ecx
mov dword [0x476560], edx
mov ecx, dword [ebp - 0x24]
mov cl, byte [ebx + ecx]
mov byte [0x476564], cl
mov dword [0x476558], 0x1d7f
mov cl, byte [ebx + edx]
mov edx, dword [ebp - 0x24]
mov byte [ebx + edx], cl
mov dword [0x476554], 0x14bd
mov cl, byte [0x476564]
mov esi, dword [0x476560]
mov byte [ebx + esi], cl
mov esi, dword [0x47655c]
add esi, 1
mov dword [0x47655c], esi
cmp esi, 0x100
mov dword [ebp - 0x20], esi
jl 0x422e74
mov dword [0x476554], 0x20f6
mov dword [0x476558], 0xbda
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x422f45
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x50
mov eax, dword [ebp + 8]
mov ecx, dword [0x476554]
add ecx, 0x89f
mov dword [0x476554], ecx
mov dword [0x476558], 0x1fa4
mov dword [ebp - 0x10], eax
call fcn.00421cf3
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov edi, edx
add edi, esi
mov esi, dword [eax + esi]
cmp esi, 0x4550
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edi
je 0x422f9d
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x78]
mov dword [0x476554], 0xfffff354
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add ecx, dword [edx + eax + 0x20]
mov esi, dword [edx + eax + 0x24]
mov dword [0x476558], 0x1e93
mov edi, dword [edx + eax + 0x18]
cmp edi, 0
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], ebx
je 0x423010
jmp 0x42301b
mov eax, dword [ebp - 0x38]
mov ecx, eax
mov edx, dword [ebp - 0x3c]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x41], bh
mov byte [ebp - 0x42], cl
je 0x42308d
jmp 0x423061
mov eax, dword [ebp - 0x34]
add esp, 0x50
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, 0xfffff354
xor ecx, ecx
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x2c]
add edx, esi
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x50], ecx
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x48]
xor esi, esi
mov edi, dword [ebp - 0x28]
mov ebx, dword [edi + eax*4]
add edx, 0x89f
mov dword [0x476554], edx
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x5c], edx
mov dword [ebp - 0x38], esi
jmp 0x422fe5
mov eax, dword [ebp - 0x40]
add eax, 1
mov cl, byte [ebp - 0x41]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x42]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x38], eax
jne 0x422fe5
mov al, byte [ebp - 0x42]
test al, 1
jne 0x4230c9
jmp 0x423096
xor eax, eax
mov ecx, dword [ebp - 0x58]
add ecx, 2
mov edx, dword [ebp - 0x54]
add edx, 1
mov esi, dword [ebp - 0x30]
cmp edx, esi
mov edi, dword [ebp - 0x5c]
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x50], edx
jb 0x423033
jmp 0x423010
mov eax, dword [ebp - 0x58]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x24]
add edx, dword [edx + esi + 0x1c]
mov dword [0x476554], 0x5ea
mov edi, dword [ebp - 0x1c]
add edi, dword [edx + ecx*4]
mov dword [0x476558], 0x19e
mov dword [ebp - 0x34], edi
jmp 0x423010
Function at 0x4230fb
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x3c
mov eax, dword [0x476554]
add eax, 0xfffff2a7
mov dword [0x476554], eax
mov dword [ebp - 0x10], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 0x10], eax
mov dword [0x476558], 0x1944
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
xor eax, eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x476554], 0x2173
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], edx
je 0x4231ac
jmp 0x423181
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x2c]
cmp word [eax + ecx*2 - 0x10], 0x6c
je 0x423242
jmp 0x42328e
mov eax, dword [ebp - 0x24]
add eax, 1
cmp eax, 0x104
setl cl
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x31], cl
mov al, byte [ebp - 0x31]
test al, 1
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x28], edx
jne 0x423151
jmp 0x4231ac
mov eax, dword [ebp - 0x28]
mov dword [0x476558], 0x1341
mov dword [0x476554], 0x356f
mov ecx, dword [ebp - 0x1c]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x2c], eax
jne 0x42328e
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x2c]
cmp word [eax + ecx*2 - 0x18], 0x6f
jne 0x42328e
mov eax, dword [ebp - 0x2c]
add eax, 0xfffffff5
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x38]
cmp word [eax + ecx*2], 0x61
jne 0x42328e
mov eax, dword [ebp - 0x2c]
add eax, 0xfffffff6
shl eax, 1
mov ecx, dword [ebp - 0x1c]
add ecx, eax
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
cmp word [eax], 0x64
jne 0x42328e
mov dword [0x476554], 0x8c1
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x2c]
cmp word [eax + ecx*2 - 0x12], 0x64
je 0x423169
jmp 0x42328e
mov eax, 0xb8a
mov ecx, 0x23bc
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x2c]
mov di, word [edx + esi*2 - 0xe]
cmp di, 0x6c
sete bl
cmp di, 0x6c
mov byte [ebp - 0x3d], bl
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x48], eax
je 0x423275
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [0x476554], eax
mov cl, byte [ebp - 0x3d]
and cl, 1
movzx eax, cl
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x710c89
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x7109ec
sub edi, 0xcefcec41
call fcn.00710cd0
mov esi, 0xe7dfdff
push 0xc19e7d24
pop esi
or edi, edi
xor dword [ecx], edx
inc edi
add edi, esi
add ecx, 1
dec esi
sub edi, esi
mov esi, 0x5e4b6e07
cmp ecx, eax
jne fcn.00710c89
sub edi, edi
mov esi, 0xad666ef5
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x330770c
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x4c4577c1
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x408f40
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0xc
mov esi, dword [ebp + 8]
mov dword [ebp - 0x14], 0xc707d16a
jmp 0x408f60
mov dword [ebp - 0x14], 0x9fdf8e75
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x14]
cmp eax, 0x9fdf8e74
jg 0x408f80
cmp eax, 0x818f3a48
jne 0x408f60
jmp 0x408f54
cmp eax, 0xae694cbc
jg 0x408fb0
cmp eax, 0x9fdf8e75
jne 0x408f60
mov ecx, dword [ebp - 0x10]
mov eax, 0x5a72f1a1
cmp dword [ecx], 0
jne 0x408fa0
mov eax, 0xae694cbd
mov dword [ebp - 0x14], eax
jmp 0x408f60
cmp eax, 0xc707d169
jg 0x408fc3
cmp eax, 0xae694cbd
jne 0x408f60
jmp 0x409159
cmp eax, 0x1b9d16dc
jg 0x408fda
cmp eax, 0xc707d16a
jne 0x408f60
mov dword [ebp - 0x14], 0x73a5a57c
jmp 0x408f60
cmp eax, 0x73a5a57b
jg 0x40901b
cmp eax, 0x65b4a98b
jg 0x40909c
cmp eax, 0x1b9d16dd
je 0x40910c
cmp eax, 0x1d36ba19
jne 0x409131
mov al, byte [ebp - 9]
test al, al
mov eax, 0x818f3a48
jne 0x409013
mov eax, 0x1b9d16dd
mov dword [ebp - 0x14], eax
jmp 0x408f60
cmp eax, 0x73a5a57c
jne 0x408f60
mov eax, 4
call fcn.00413310
mov ecx, esp
mov eax, 4
call fcn.00413310
mov dword [ebp - 0x10], esp
mov dword [ecx], esi
mov eax, dword [ebp - 0x10]
mov dword [eax], 0
mov eax, dword [ecx]
lea ecx, [eax + 0x2c]
sub esp, 0x18
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0x408d00
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.004141f5
add esp, 0x18
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0
sete byte [ebp - 9]
mov dword [ebp - 0x14], 0x1d36ba19
jmp 0x408f60
cmp eax, 0x65b4a98c
jne 0x408f60
mov eax, 4
call fcn.00413310
mov ecx, esp
mov eax, 4
call fcn.00413310
mov edi, esp
mov dword [ecx], esi
mov dword [edi], 0
mov eax, dword [ecx]
lea ecx, [eax + 0x2c]
sub esp, 0x18
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0x408d00
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.004141f5
add esp, 0x18
mov dword [edi], eax
mov dword [ebp - 0x14], 0x73a5a57c
jmp 0x408f60
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x14], 0x9fdf8e75
jmp 0x408f60
cmp eax, 0x5a72f1a1
jne 0x408f60
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x14], 0xae694cbd
jmp 0x408f60
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret