joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417bf0
Capabilities:
Encode data using xor

Disassembly:
add al, 3
inc eax
or ebp, ebp
rol dword [esp + esi*4], 0xc0
add al, byte [ecx + 0x100c400]
adc byte [ecx], 0xc2
push cs
salc
int3
dec ebp
popal
jo 0x417b94
stosd dword es:[edi], eax
stosd dword es:[edi], eax
jo 0x417b43
add al, 0
or al, 0xc0
pop es
inc eax
push ecx
or dword [eax], 0
xor byte [ecx + ebp*2 + 0x66], ah
add word [esi], 0x5cd
insb byte es:[edi], dx
imul eax, dword [edx], 0x700ec374
jae 0x417c13
xor ebx, dword [edi + 0x30]
add byte [eax], al
dec ebp
imul esp, dword [ebx + 0x72], 0x6f736f
je 0x417be4
sub byte [edx + 0x29], dl
and byte [eax], cl
dec esp
push ebx
dec esp
and byte [ebx + 0x68], dl
cmp dword [eax + 0x332e3235], eax
xor dword [ecx], esi
xor ecx, eax
sbb al, byte [eax + 0x5000051]
push ecx
add byte [eax], al
add eax, 0x800f0003
invalid
inc eax
nop
invalid
add byte [eax], al
rol byte [ecx - 0x7d], 0x1c
sub ah, 0x3f
xor al, al
add eax, 0x80f05ec0
push esp
inc esp
and dword [ebx - 0x373c9aff], eax
add byte [eax - 0x3c6ffcb2], al
add al, cl
mov eax, 0x2c46d07
enter 0xffffffffffff8000, 0x4e
add edx, dword [eax - 0x473efd3d]
pop es
insd dword es:[edi], dx
les eax, [edx]
add eax, eax
je 0x417bea
add al, byte [ecx + eax*8]
rol esp, 1
add eax, 0xd1c16b05
les eax, [edx]
pop es
rcr byte [ebx + 0x4002c208], 0x14
nop
mov al, 0
or byte [edi], cl
mov al, byte [0x2c111c1]
add eax, eax
add cl, byte [0xc00368c0]
add eax, eax
pop ss
jmp dword [eax - 0x17fffb]
Function at 0x41c2a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x454
mov eax, dword [0x533a94]
xor eax, ebp
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x454], ecx
call fcn.0041bbf0
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x2c]
call fcn.0041edc0
mov eax, dword [ebp - 0x454]
push eax
lea ecx, [ebp - 0x18]
call fcn.0041c590
lea ecx, [ebp - 0x438]
call fcn.0041f200
push 0x400
mov ecx, dword [ebp + 8]
push ecx
call fcn.0041c040
add esp, 8
mov dword [ebp - 8], eax
push 2
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x41c31e
call fcn.0041bc70
mov dword [ebp - 0x444], eax
jmp 0x41c473
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x440], eax
cmp dword [ebp - 0x440], 0
jne 0x41c34f
call fcn.0041bc70
mov dword [ebp - 0x444], eax
jmp 0x41c473
mov eax, dword [ebp - 0x440]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x448], eax
cmp dword [ebp - 0x448], 0
jne 0x41c37f
call fcn.0041bc70
mov dword [ebp - 0x444], eax
jmp 0x41c473
mov edx, dword [ebp - 0x440]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x448]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x1c]
add edx, 1
cmp edx, dword [ebp - 0x1c]
jae 0x41c3cf
mov dword [ebp - 0x44c], 0x8007000e
lea ecx, [ebp - 0x438]
call fcn.0041f220
lea ecx, [ebp - 0x2c]
call fcn.0041ede0
mov eax, dword [ebp - 0x44c]
jmp 0x41c4a8
mov eax, dword [ebp - 0x1c]
add eax, 1
push eax
lea ecx, [ebp - 0x438]
call fcn.0041f250
lea ecx, [ebp - 0x438]
call fcn.0041f240
test eax, eax
jne 0x41c3fc
mov dword [ebp - 0x444], 0x8007000e
jmp 0x41c473
mov ecx, dword [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x438]
call fcn.0041f240
push eax
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0xc]
push eax
push 0
call fcn.0041bbf0
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x43c], eax
cmp dword [ebp - 0x43c], 0
jne 0x41c43e
call fcn.0041bc70
mov dword [ebp - 0x444], eax
jmp 0x41c473
lea ecx, [ebp - 0x438]
call fcn.0041f240
xor ecx, ecx
mov edx, dword [ebp - 0x43c]
mov word [eax + edx*2], cx
mov eax, dword [ebp + 0x14]
push eax
lea ecx, [ebp - 0x438]
call fcn.0041f240
push eax
lea ecx, [ebp - 0x18]
call fcn.0041c5c0
mov dword [ebp - 0x444], eax
cmp dword [ebp - 0x10], 0
je 0x41c483
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, dword [ebp - 0x444]
mov dword [ebp - 0x450], edx
lea ecx, [ebp - 0x438]
call fcn.0041f220
lea ecx, [ebp - 0x2c]
call fcn.0041ede0
mov eax, dword [ebp - 0x450]
mov ecx, dword [ebp - 0x30]
xor ecx, ebp
call fcn.004c1753
mov esp, ebp
pop ebp
ret 0x10
Function at 0x41de70
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x533a94]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x230], ecx
lea ecx, [ebp - 0x14]
call fcn.0041dbb0
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax + 4]
or ecx, 0x2001f
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x14]
call fcn.0041de00
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x41dedb
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x224], edx
lea ecx, [ebp - 0x14]
call fcn.0041dbe0
mov eax, dword [ebp - 0x224]
jmp 0x41df6c
mov dword [ebp - 4], pe_nt_image_headers32
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x220]
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x41df41
lea ecx, [ebp - 0x220]
push ecx
lea ecx, [ebp - 0x14]
call fcn.0041de70
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x41df38
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x228], edx
lea ecx, [ebp - 0x14]
call fcn.0041dbe0
mov eax, dword [ebp - 0x228]
jmp 0x41df6c
mov dword [ebp - 4], pe_nt_image_headers32
jmp 0x41dee2
lea ecx, [ebp - 0x14]
call fcn.0041dd30
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x230]
call fcn.0041dc70
mov dword [ebp - 0x22c], eax
lea ecx, [ebp - 0x14]
call fcn.0041dbe0
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004c1753
mov esp, ebp
pop ebp
ret 4
Function at 0x41e4d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
xor eax, eax
jne 0x41e4d9
xor ecx, ecx
jne 0x41e4d9
xor edx, edx
cmp dword [ebp + 0xc], 0
setne dl
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0
jne 0x41e4fa
mov eax, 0xd
jmp 0x41e555
xor eax, eax
jne 0x41e4e1
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax*2]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2]
mov dword [ebp - 4], edx
cmp dword [ebp - 0xc], 1
jne 0x41e50b
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 7
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esp, ebp
pop ebp
ret 8

Function at 0x422a00
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x3bc], 0
je 0x422a18
jmp 0x422aa1
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x30]
push edx
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x422a38
push 9
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x30]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x30
call fcn.00427d60
push 1
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x30]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x30]
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x30]
push ecx
call dword [sym.imp.USER32.dll_BringWindowToTop]
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov ecx, dword [ebp - 4]
add ecx, 0x30
call fcn.004133a0
push 0
push 0x3e8
push pe_nt_image_headers32
mov ecx, dword [ebp - 4]
add ecx, 0x30
call fcn.00413570
mov esp, ebp
pop ebp
ret
Function at 0x448310
Capabilities:
Encode data using xor

Disassembly:
je 0x448331
pop es
mov al, 0
xor esp, dword [eax]
or dword [edi], edi
and byte [edx], al
push es
jmp 0x44834e
push esi
mov al, 0xc
aas
and byte [ecx], dh
add al, 0x39
and byte [edi], al
cmc
jb 0x448344
add byte [eax + 0x1b72ff12], dh
mov cl, 9
xor dword [edx], ebx
mov cl, 0x2d
push es
xor byte [esi], al
sub eax, 0x6300666
xor dword [edx], edx
add eax, 0x71197100
inc esi
stosb byte es:[edi], al
jne 0x448349
or dword [eax], eax
mov dl, 0x1e
or eax, esi
xor byte [ecx + 0x91c711d], dh
out dx, eax
lock add dword [eax], esi
inc ecx
jb 0x44836d
jno 0x4483c5
push edi
or al, dh
pop ss
jno 0x448376
xor byte [ebx - 0xe64f2b], bl
xor byte [esi], ah
in al, 0x30
mov al, 0x19
push dword [eax]
in al, 0x30
adc esp, edx
xor bl, byte [0xf1670d71]
sub esi, ebp
xor byte [ebx], dh
and bh, bh
cmp byte [ecx], 0x20
mov al, 0x7e
sub edi, 0x203a1370
xor byte [edx], bl
xor al, 0x20
add dword [eax + 0xd], esi
aas
and cl, dh
add bh, byte [edi + 0x203f39f0]
mov al, byte [0x3e203325]
and bh, byte [eax]
add byte [edi], bh
and bl, al
cmp al, 0x20
int1
or al, 4
add dh, ch
xor byte [ecx], 0x20
xor dword [edi], ebx
sti
invalid
Function at 0x44afa0
Capabilities:
Encode data using xor

Disassembly:
xchg dword [eax], eax
add byte [ecx], al
loopne 0x44af70
add byte [eax], ah
jg 0x44afd6
add byte [edx], ah
test dword [eax], eax
mov byte [0x802001e2], al
in al, 1
scasb al, byte es:[edi]
add al, 0xe2
add dword [eax], esp
jg 0x44af6c
add dword [eax], ecx
loop 0x44af8d
add esp, dword [edx]
cdq
pop esp
add byte [edx], al
xor eax, 0x234c6184
test byte [edi], ah
test byte es:[edi + 0x77], ah
and bl, byte [ecx + 0x3502005c]
test byte [ecx + 0x4c], ah
and eax, dword [edi + 0x77678426]
inc ecx
cmp al, 0xa0
xchg byte [ecx], ch
test byte [eax + 0x60], ah
add ch, byte [0x5766c184]
and byte [ecx + 0x72], ch
jb 0x44af72
jb 0x44b014
jb 0x44af72
test byte [ebx + 0x6f], al
mov esi, 0xe0d4616c
or al, 0x2a
test al, al
xor ah, byte [eax + 0x6680c5]
aas
aas
xchg bl, dh
inc esi
movsd dword es:[edi], dword [esi]
jg 0x44afad
pop ds
lodsd eax, dword [esi]
jg 0x44b02f
jnp 0x44afd1
invalid
invalid
nop
cmp eax, dword [ecx + 2]
scasd eax, dword es:[edi]
cmp eax, 0x2153da9
imul ecx, dword [edi], 0xffffffe1
inc ecx
out dx, eax
cmp dword [edi], 0x3fcf1371
sub eax, dword [eax + ecx*4 + 0x3fc21551]
sub eax, 0xfffedc59
mov eax, dword [0xb2592f01]
insb byte es:[edi], dx
mov byte [ecx + 0x15], dl
ret 0x2d3f
jmp dword [ecx - 0x4da6d0ff]
add dword [edi], ebp
pop ecx
mov dl, 0x6c
add byte [ebp + 8], dl
or eax, 0xef03be7e
jge 0x44aff6
jge 0x44aff8
jge 0x44affa
jge 0x44afed
jge 0x44b013
loop 0x44b08e
inc ecx
sbb dl, byte [ecx + 0x2100330c]
xchg ecx, eax
or al, 0x33
add byte [ecx], ah
pop ecx
nop
add byte [eax], ah
pop ecx
out dx, eax
jge 0x44b065
aaa
aaa
bound edi, qword [edi + 0x34]
add ah, byte [esp + edi*2]
pushal
pop edx
out dx, eax
jge 0x44b034
add byte [edi - 0x1d], dl
jge 0x44b044
and byte ss:[eax], al
wrmsr
add eax, 0x40786024
inc eax
mov al, 0xa0
add al, 0
adc eax, 0x71ef2b42
add dh, byte [eax]
add bl, byte [edi - 0x11]
sub ebp, edi
jno 0x44b04a
xor byte [edx], al
pop edi
out dx, eax
jno 0x44b093
add esi, dword cs:[esi]
out dx, eax
jno 0x44b0c4
adc al, 2
out dx, eax
jno 0x44b03d
jg 0x44b04a
jno 0x44b09d
or ebp, edi
jno 0x44b0a1
add esp, ecx
das
sub dword [esi], 0xfb0071ef
out dx, eax
jno 0x44b069
sti
out dx, eax
jno 0x44b01d
sbb byte [ecx], al
test al, 0x96
iretd
sub dword [ebx], ebp
inc ebp
sub eax, 0x11f16d1f
test dword [ecx + 0x4b2d4f2d], 0x2b91642d
dec edi
insd dword es:[edi], dx
int1
adc edi, esi
sub dword [0x2d4b2d4f], 0x4f2b9164
xchg ecx, eax
sub ecx, dword [edi + 0x2d]
adc byte [edi - 0x7a04d2b1], cl
adc al, 0x10
sub eax, 0x2d4f8f10
sti
test dword [eax + edx], edx
and byte [eax], al
dec edi
sub eax, 0x2d4fab53
aas
stosd dword es:[edi], eax
aas
stosd dword es:[edi], eax
invalid
sub eax, 0xf7e2d4f
dec edi
sub eax, 0xc3066d4
and byte [eax], al
invalid
Function at 0x45b2f0
Capabilities:
Encode data using xor

Disassembly:
add byte [eax + 0x3f], dh
aaa
aas
aaa
and edi, dword [edi]
aaa
xor dh, byte [edi]
add eax, dword [eax]
wrmsr
aaa
nop
rcl dword [eax + 0x41c00000], 0xa3
or byte [eax - 0x6994fc1], al
push eax
pop ss
invalid
pop es
jno 0x45b31b
jo 0x45b27d
in al, 0x91
jno 0x45b2fb
xor byte [0xe46806f0], ch
sbb byte [ebx - 0x10], 3
add esi, dword [eax - 0x49]
lock sub byte [eax + 0xb25c4a], dl
or al, 0x70
add al, byte [eax + edx*4 + 0x33]
cmp dword [ecx], eax
mov edi, 0xb7b00870
mov al, 0x8f
ror byte [0x2db11ea0], 0
jo 0x45b328
invalid
pop eax
or eax, 0x2db11ea0
add byte [eax + 3], dh
scasb al, byte es:[edi]
add ah, dh
invalid

Function at 0x45c010
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
xor eax, eax
jne 0x45c019
xor ecx, ecx
jne 0x45c019
mov dword [ebp - 4], 0
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x45c052
call fcn.0041bc70
jmp 0x45c068
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
je 0x45c066
push 0x26
call fcn.0041bbb0
add esp, 4
jmp 0x45c068
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x4627f0
Capabilities:
Encrypt data using xtea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 4]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
jle 0x46288a
mov ecx, dword [ebp + 0x10]
imul ecx, ecx, 0x9e3779b9
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 0x10]
je 0x462888
mov eax, dword [ebp - 0xc]
shl eax, 4
mov ecx, dword [ebp - 0xc]
shr ecx, 5
xor eax, ecx
mov edx, dword [ebp - 0xc]
xor edx, dword [ebp - 8]
add eax, edx
mov ecx, dword [ebp - 8]
and ecx, 3
mov edx, dword [ebp + 8]
add eax, dword [edx + ecx*4]
add eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
sub eax, 0x61c88647
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
shl ecx, 4
mov edx, dword [ebp - 4]
shr edx, 5
xor ecx, edx
mov eax, dword [ebp - 4]
xor eax, dword [ebp - 8]
add ecx, eax
mov edx, dword [ebp - 8]
shr edx, 0xb
and edx, 3
mov eax, dword [ebp + 8]
add ecx, dword [eax + edx*4]
add ecx, dword [ebp - 0xc]
mov dword [ebp - 0xc], ecx
jmp 0x462820
jmp 0x462903
mov ecx, dword [ebp + 0x10]
neg ecx
imul ecx, ecx, 0x9e3779b9
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x462903
mov edx, dword [ebp - 4]
shl edx, 4
mov eax, dword [ebp - 4]
shr eax, 5
xor edx, eax
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp - 8]
add edx, ecx
mov eax, dword [ebp - 8]
shr eax, 0xb
and eax, 3
mov ecx, dword [ebp + 8]
add edx, dword [ecx + eax*4]
mov eax, dword [ebp - 0xc]
sub eax, edx
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
add ecx, 0x61c88647
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0xc]
shl edx, 4
mov eax, dword [ebp - 0xc]
shr eax, 5
xor edx, eax
mov ecx, dword [ebp - 0xc]
xor ecx, dword [ebp - 8]
add edx, ecx
mov eax, dword [ebp - 8]
and eax, 3
mov ecx, dword [ebp + 8]
add edx, dword [ecx + eax*4]
mov eax, dword [ebp - 4]
sub eax, edx
mov dword [ebp - 4], eax
jmp 0x462898
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov dword [ecx], edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword [eax + 4], ecx
mov esp, ebp
pop ebp
ret

Function at 0x465440
Capabilities:
Encode data using xor

Disassembly:
mov al, 2
and byte ss:[edi], al
jb 0x46544d
add byte [ebp + 0x72ff12b0], bh
sbb esi, dword [ecx - 0x4ee5cef7]
sub eax, 0x59063006
xor dword [edx], edx
add eax, 0x71197100
inc esi
stosb byte es:[edi], al
lock or dword [eax], eax
mov ch, 0xb2
push ds
or dword [eax], esi
push ebp
or byte [eax + 0x929b10e], dh
invalid
Function at 0x467800
Capabilities:
Encode data using xor

Disassembly:
push es
add ah, ah
add byte [edi], 0x43
add byte [esi], al
or dword [esi], ebx
add dword [eax], eax
add byte [eax - 0x78fdfa00], ah
add dword [esi + 0x16019601], esp
add eax, 0x1800100
outsd dx, dword [esi]
mov dword [0x7f010b01], eax
add eax, 0x2302aa00
add al, byte [eax]
mov edx, dword [ecx + 5]
or ecx, dword [eax]
add byte [edi], al
add byte [ebx], ah
cli
add dl, byte [edi]
or dword [ecx + 0x261704], edx
add byte [eax], al
xor ah, ah
lock add dword [edi], esi
or byte [0x43010400], al
sub byte [0x25c0300], 9
add bl, dl
add byte [edi], dh
add byte [edi + 0x1bb0200], bl
inc ecx
add byte [edi], cl
add al, 0
inc esp
add dword [eax + eax], 0x505d8b
add byte [0x1bb040a], al
add byte [ebx + 0x9809103], ch
add eax, dword [eax]
out dx, al
add byte [ecx + 0x21810300], 0x2b
adc byte [0x82008580], 7
push es
xor byte [ebx], 0xa
add dl, dl
add byte [eax - 0x7a7f55f9], al
lea eax, [esi]
and byte [0x815f8b81], 0x2f
or dword [ecx], 0x9815181
and byte [ecx - 0x7fea7f80], 0xc1
add dword [ebp + 9], 0x8800300
sub byte [ebx], 0x83
add eax, 0xb860462
add eax, 0xb800200
and dword [0x41808b08], 0xffffff81
sbb ecx, dword [ecx]
adc byte [ebx], 5
add ah, dl
xor byte [edi], 0x1d
sub dword [ebx + 8], 0x85852f80
or dword [ebx + 0x502780aa], 0
add byte [eax], al
add al, byte [eax + 0x718004a9]
or al, ah
add byte [ebp - 0x7f], dl
or byte [eax], al
or dword [edi - 0x7f], 0x3d
add dword [ebp - 0x55], 0xf83df81
or byte [eax + 0x7380ff23], al
stosb byte es:[edi], al
add byte [ebp - 0x7f7bff81], 0x5f
or dword [ebx - 0x7f], 0x81e38117
lodsd eax, dword [esi]
adc dword [edi], 0xaa00f404
adc byte [ebx], 6
add byte [ebx], ch
and dword [ecx], 0x4ac27bc0
inc ebp
stosd dword es:[edi], eax
sbb edi, 0x80080f83
and edi, edi
xor byte [ebx - 0x56], 0x80
test dword [edi], edi
test byte [eax - 0x7eb47ea1], al
pop ss
and ebx, 0x1781ad81
add al, 0xf4
add byte [edx + 0x61382], ch
sub eax, dword [ecx - 0x3d843fdf]
dec edx
mov edi, 0x13c107c5
shl dword [eax], 0xc5
cmp al, 0xe1
add ecx, 0x33
add al, 0xc0
push ecx
jnp 0x4678ed
add ecx, 0x7b
add eax, 0x7ec16bc0
rol dword [ecx - 0x3b], 3
add eax, 0x5544c2f5
ret 0x770
Function at 0x46efd0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
mov ecx, dword [ebp + 8]
call fcn.00417910
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x46f005
or eax, 0xffffffff
jmp 0x46f021
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x46f030
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov dword [ebp - 0x14], 0
jmp 0x46f048
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 8]
call fcn.00432200
cmp dword [ebp - 0x14], eax
jae 0x46f143
mov ecx, dword [ebp - 0x14]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0044f5b0
mov ecx, eax
call fcn.00417910
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x46f0ce
push 0x506d4c
mov edx, dword [ebp - 0x14]
push edx
mov ecx, dword [ebp + 8]
call fcn.0044f5b0
push eax
push 0x506d6c
lea eax, [ebp - 0x20]
push eax
call fcn.0046f2c0
add esp, 0xc
push eax
lea ecx, [ebp - 0x24]
push ecx
call fcn.004178b0
add esp, 0xc
mov ecx, eax
call fcn.00417910
push eax
call fcn.0045a7c0
add esp, 4
lea ecx, [ebp - 0x24]
call fcn.00417470
lea ecx, [ebp - 0x20]
call fcn.00417470
xor eax, eax
jmp 0x46f22e
mov edx, dword [ebp - 0x14]
push edx
mov ecx, dword [ebp + 8]
call fcn.0044f5b0
push eax
call fcn.0046ef80
add esp, 4
test eax, eax
jne 0x46f13e
push str._Ka
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
call fcn.0044f5b0
push eax
push 0x506da4
lea ecx, [ebp - 0x28]
push ecx
call fcn.0046f2c0
add esp, 0xc
push eax
lea edx, [ebp - 0x2c]
push edx
call fcn.004178b0
add esp, 0xc
mov ecx, eax
call fcn.00417910
push eax
call fcn.0045a7c0
add esp, 4
lea ecx, [ebp - 0x2c]
call fcn.00417470
lea ecx, [ebp - 0x28]
call fcn.00417470
xor eax, eax
jmp 0x46f22e
jmp 0x46f03f
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x18], 0
jmp 0x46f163
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 8]
call fcn.00432200
cmp dword [ebp - 0x18], eax
jae 0x46f197
mov ecx, dword [ebp - 0x18]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0044f5b0
push eax
call fcn.0046efd0
add esp, 4
xor edx, edx
add eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
adc ecx, edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ecx
jmp 0x46f15a
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x3c], ecx
and dword [ebp - 0x34], 0x7fffffff
fild qword [ebp - 0x38]
and dword [ebp - 0x3c], 0x80000000
mov dword [ebp - 0x40], 0
fild qword [ebp - 0x40]
fchs
faddp st(1)
fdiv qword [0x506e28]
fdiv qword [0x506e28]
fnstcw word [ebp - 0x42]
movzx eax, word [ebp - 0x42]
or eax, 0xc00
mov dword [ebp - 0x48], eax
fldcw word [ebp - 0x48]
fistp qword [ebp - 0x50]
fldcw word [ebp - 0x42]
mov edx, dword [ebp - 0x50]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 5
jbe 0x46f229
lea ecx, [ebp - 0x1c]
call fcn.004173f0
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 0x506db8
call fcn.0045a7c0
add esp, 0xc
mov dword [ebp - 0x30], 0
lea ecx, [ebp - 0x1c]
call fcn.00417470
mov eax, dword [ebp - 0x30]
jmp 0x46f22e
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x477030
Capabilities:
Get number of processors

Disassembly:
add byte [edi], cl
add dword [edi + 0x13a0e158], eax
add dl, byte [edi + 0x2e40f01]
xchg edi, eax
add dword [edx + 0x555b0108], ecx
add byte [ebx], cl
stosb byte es:[edi], al
mov eax, dword [0x41ab0000]
add byte [edi + 0x8080002], cl
add byte [ecx], 0x93
inc dword [eax + 0x540000ff]
push ebx
dec esi
inc ebx
invalid

Function at 0x477080
Capabilities:
Get number of processors

Disassembly:
add eax, 0x81e01
or ebp, dword [ecx + ebp*2 + 0x74]
push eax
popal
jo 0x4770ff
popal
insd dword es:[edi], dx
adc byte [ebx + ecx + 0xd850381], al
push eax
mov ah, 0x4f
dec ebp
mov cl, byte [0x81118020]
Function at 0x47f260
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x533a94]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x25c], ecx
lea ecx, [ebp - 0x258]
call fcn.0047f420
push 0
call fcn.0047f400
add esp, 4
mov dword [ebp - 0x248], eax
mov dword [ebp - 0x244], edx
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.004c1bc0
add esp, 0xc
push 1
push 0x1a
lea edx, [ebp - 0x210]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x47f2e0
lea ecx, [ebp - 0x258]
call fcn.0047fa10
jmp 0x47f399
push 0x507dd8
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x22c]
call fcn.0047f590
lea ecx, [ebp - 0x210]
push ecx
lea ecx, [ebp - 0x22c]
call fcn.0047f5e0
test eax, eax
jne 0x47f320
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 0
je 0x47f33d
cmp dword [ebp - 0x260], 1
je 0x47f34f
jmp 0x47f35f
push 0x81
lea ecx, [ebp - 0x238]
call fcn.00417870
jmp 0x47f35f
push 0x82
lea ecx, [ebp - 0x238]
call fcn.00417870
lea ecx, [ebp - 0x258]
push ecx
lea ecx, [ebp - 0x22c]
call fcn.0047f9f0
lea edx, [ebp - 0x210]
push edx
lea ecx, [ebp - 0x22c]
call fcn.0047f780
lea ecx, [ebp - 0x22c]
call fcn.0047f5c0
lea ecx, [ebp - 0x258]
call fcn.0047fa10
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c1753
mov esp, ebp
pop ebp
ret 4