joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5cbdb6
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [esi + 4]
sub esp, 0x14
test eax, eax
je 0x5cbdec
push 0
push eax
call dword [0x100320a8]
test eax, eax
je 0x5cbddb
mov eax, 0xffffffea
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 4]
push eax
call dword [0x10032060]
mov dword [esi + 4], 0
push edi
push 0
push 0
push 1
push 0
call dword [0x100320ac]
mov ecx, dword [ebp + 8]
push 0
push 0
lea edx, [ebp - 0x14]
push edx
push 0x1000b9c0
mov edi, eax
push 0
push 0
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], ecx
call fcn.005de049
add esp, 0x18
mov dword [esi + 4], eax
test eax, eax
jne 0x5cbe3c
push edi
call dword [0x10032060]
mov eax, 0xffffffeb
pop edi
mov esp, ebp
pop ebp
ret 4
push ebx
push 0xffffffffffffffff
mov dword [ebp - 8], eax
push 0
lea eax, [ebp - 8]
push eax
push 2
mov dword [ebp - 4], edi
call dword [0x10032064]
push edi
mov edi, dword [0x10032060]
mov ebx, eax
call edi
test ebx, ebx
jne 0x5cbe76
mov ecx, dword [esi + 4]
push ecx
call edi
mov dword [esi + 4], ebx
lea eax, [ebx - 0x17]
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 4
cmp ebx, 1
je 0x5cbe95
mov edx, dword [esi + 4]
push edx
call edi
pop ebx
mov dword [esi + 4], 0
mov eax, 0xffffffe8
pop edi
mov esp, ebp
pop ebp
ret 4
pop ebx
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 4

Function at 0x5cc3d6
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10030738
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x1003c050]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebx + 0x28]
xor edi, edi
push eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], edi
call dword [0x10032090]
mov dword [ebp - 4], edi
call dword [0x10032098]
mov ecx, dword [ebx + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
lea esi, [ebx + 0x10]
xor edx, edx
div ecx
mov eax, dword [esi]
mov dword [ebp - 0x10], edx
cmp eax, edi
je 0x5cc448
mov eax, dword [eax + edx*4]
cmp eax, edi
je 0x5cc44f
mov ecx, dword [ebp + 8]
cmp dword [eax + 4], ecx
je 0x5cc469
mov eax, dword [eax]
cmp eax, edi
jne 0x5cc438
jmp 0x5cc44f
mov eax, ecx
call fcn.005db8d6
call fcn.005db986
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
mov dword [eax + 4], edx
mov edx, dword [esi]
mov edx, dword [edx + ecx*4]
mov dword [eax], edx
mov edx, dword [esi]
mov dword [edx + ecx*4], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebp - 0x14]
mov dword [eax + 0x18], ecx
dec ecx
mov dword [eax + 0x1c], ecx
mov ecx, 1
mov dword [eax + 0x10], edi
mov dword [eax + 0x14], edi
mov dword [eax + 0xc], edx
mov dword [eax + 0x20], edi
mov dword [eax + 0x24], edi
mov dword [eax + 0x28], edi
mov dword [eax + 0x2c], edi
mov dword [eax + 0x30], ecx
mov eax, dword [ebp - 0x1c]
add dword [ebx + 4], ecx
push eax
call dword [0x10032094]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5d2ab6
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100307cb
mov eax, dword fs:[0]
push eax
sub esp, 0xbc
mov eax, dword [0x1003c050]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 0xa8
mov esi, ecx
lea ecx, [ebp - 0xbc]
push 0
push ecx
mov edi, edx
mov dword [ebp - 0xc0], eax
call fcn.005e0266
mov edx, dword [esi]
mov eax, dword [edx + 0x30]
add esp, 0xc
mov ecx, esi
call eax
mov edx, dword [esi]
mov dword [ebp - 0xbc], eax
mov eax, dword [edx + 0xf8]
mov ecx, esi
call eax
mov ecx, dword [eax]
mov dword [ebp - 0x37], ecx
mov edx, dword [eax + 4]
mov dword [ebp - 0x33], edx
mov ecx, dword [eax + 8]
mov dword [ebp - 0x2f], ecx
mov edx, dword [eax + 0xc]
mov dword [ebp - 0x2b], edx
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x27], ecx
mov edx, dword [eax + 0x14]
mov dword [ebp - 0x23], edx
mov ecx, dword [eax + 0x20]
mov dword [ebp - 0x1f], ecx
mov edx, dword [eax + 0x24]
mov eax, edi
mov dword [ebp - 0x1b], edx
lea esi, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5d2b56
sub eax, esi
cmp eax, 0x20
jbe 0x5d2b69
mov eax, 0x20
push eax
lea eax, [ebp - 0x69]
push edi
push eax
call fcn.005e87c6
mov esi, dword [ebp - 0xc0]
mov eax, esi
add esp, 0xc
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5d2b86
sub eax, edx
cmp eax, 0x10
jbe 0x5d2b99
mov eax, 0x10
push eax
lea ecx, [ebp - 0x48]
push esi
push ecx
call fcn.005e87c6
add esp, 0xc
lea esi, [ebx + 0x3c0]
xor edi, edi
push esi
mov dword [ebp - 0xc4], esi
mov dword [ebp - 0xc0], edi
call dword [0x10032090]
mov dword [ebp - 4], edi
mov edx, dword [ebx + 4]
mov eax, dword [edx + 0x14]
mov edx, dword [eax + ebx + 4]
mov edx, dword [edx + 4]
lea ecx, [eax + ebx + 4]
lea eax, [ebp - 0xbc]
push eax
call edx
mov eax, dword [ebp - 0xbc]
push esi
mov dword [ebx + 0x3bc], eax
call dword [0x10032094]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005dd577
mov esp, ebp
pop ebp
ret 4
Function at 0x90ddbc
Capabilities:
Encode data using xor

Disassembly:
fist dword [edx - 0x6c066cd1]
das
xchg ebx, eax
stc
xchg ebx, eax
pop ebp
xchg esp, eax
pop ebx
xchg esp, eax
dec esp
xchg esp, eax
pop eax
xchg esp, eax
pushal
xchg esp, eax
push ebx
xchg esp, eax
push eax
xchg esp, eax
pop es
xchg ebp, eax
or byte [ebp - 0x6b096b0c], dl
add al, 0x95
std
xchg esp, eax
add eax, 0x56962895
xchg esi, eax
inc edx
xchg esi, eax
pop esp
xchg esi, eax
cmp eax, 0x2b962f96
xchg esi, eax
pop eax
xchg esi, eax
popal
xchg esi, eax
sub al, 0x96
push ecx
xchg esi, eax
push eax
xchg esi, eax
cmp al, 0x96
xchg esi, eax
not byte [edx]
pushal
xchg esi, eax
pop ebx
xchg esi, eax
xchg esi, eax
inc eax
xchg esi, eax
pop edi
xchg esi, eax
xchg esi, eax
sub eax, 0x3b965e96
xchg esi, eax
out dx, eax
xchg edi, eax
xchg edi, eax
out dx, al
xchg edi, eax
in eax, dx
xchg edi, eax
pop edx
cwde
bound ebx, qword [eax - 0x67a067a5]
pop esi
cwde
cwde
loopne 0x90dd62
loope 0x90dd64
in eax, 0x98
movsd dword es:[edi], dword [esi]
cdq
wait
cdq
lahf
cdq
pushfd
cdq
jp 0x90ddeb
stosb byte es:[edi], al
cdq
movsb byte es:[edi], byte [esi]
cdq
mov dword [0x269a6799], eax
wait
sbb bl, byte [ebx - 0x64e3ec48]
adc eax, 0x189b1b9b
wait
push ds
wait
and eax, 0x7bc4dc9b
pushfd
wait
sbb byte [ebx - 0x64da64e2], bl
fadd st(4), st(0)
jnp 0x90dd92
jne 0x90dd94
xchg ebx, eax
pushfd
invalid
Function at 0x91b9b7
Capabilities:
Get number of processors

Disassembly:
add dword [ebp + 0x39], eax
add ah, byte [ecx]
push esi
add dword [esi + 0x47], eax
add esp, dword [ebx]
push esp
add dword [edx + 0x22], ecx
add dword [edx + 0x21], ecx
add dword [ecx + 0x7d], ecx
add dword [ecx + 0x7e], ecx
add ah, byte [esi]
cmp al, byte [ecx]
dec ebp
and al, byte [ecx]
dec ebp
and eax, dword [edx]
cmp eax, dword es:[ecx]
dec ebp
and dword [ebx], eax
sub byte [ebx + eax + 0x28], dl
push ebp
add dword [eax + 0x70], edx
add ch, byte [ecx]
jns 0x91b9ec
push eax
outsd dx, dword [esi]
add dword [eax + 0x6d], edx
add dword [eax + 0x6e], edx
add dword [ebp + 0x2e], edx
add dword [ebp + 0x2c], edx
add esi, dword [eax]
pop edx
add esi, dword [eax]
pop ebx
add ch, byte [esi]
insd dword es:[edi], dx
add dword [ebp + 0x2d], edx
add ch, byte [esi]
insb byte es:[edi], dx
add esp, dword [ebx + ebp*2 + 1]
push ebp
and al, byte [edx]
xor al, 0x76
add al, 0x31
xor eax, 0x1433503
pop ecx
je 0x91ba1c
pop ecx
jne 0x91ba21
cmp esp, dword [esi]
add edi, dword [ebx]
and eax, 0x3735901
cmp esp, dword [0x3735901]
xor eax, 0x58680144
add cl, byte [ecx + 0x67]
add dword [edx + edx*2 + 1], ebp
insb byte es:[edi], dx
push ebx
add dl, byte [eax + 0x2a]
add dword [ebx + 0x54], esi
add ah, byte [ecx + 0x4e]
add ah, byte [ecx + 0x4f]
add ebx, dword [edx + 0x38]
add dword [edx + 0x68], edi
add dh, byte [eax + 0x36]
add ah, byte [ecx]
sub eax, dword [ecx]
inc ebp
cmp al, byte [edx]
pop edi
add dword [esp + edx*2 + 2], eax
and dword [eax + 2], ebx
and dword [edi + 4], edx
and dword [esi + 3], esi
insb byte es:[edi], dx
add esp, dword [ebx]
push ebp
add dword [edi + 0x7b], eax
add ah, byte [edx]
aaa
add ah, byte [edx]
cmp byte [edx], al
and dh, byte [esi]
add al, 0x22
pushal
add ah, byte [edx]
cmp dword [ebx], eax
and ebx, dword [edx + 0xf]
and al, byte [edi + 3]
and eax, 0x66250361
add ah, byte [ebx]
add al, 0x23
jp 0x91ba8c
and esp, dword [edx + 2]
and esp, dword [edx + eax + 0x23]
add ah, byte [ebx]
add ah, byte fs:[ebx]
add ah, byte [ebx]
arpl word [ecx], ax
dec edx
add ah, byte es:[ebx]
pushal
add esp, dword [0x61230262]
add dword [edx + 0x23], ecx
add dword [edx + 0x24], ecx
add ah, byte [ebx]
Function at 0x91baa9
Capabilities:
Get number of processors

Disassembly:
add ah, byte gs:[ebx]
push 0x2254a01
and ebp, dword [ecx + 0xf]
and edi, dword [edi + ecx + 0x23]
js 0x91babd
and eax, 0x49260263
dec ecx
add ebp, dword [eax]
pop ebp
add ah, byte [esi]
inc ebx
add ah, byte [esi]
add dword ds:[ebp + 0x25], ecx
add ah, byte [esi]
inc esi
add ah, byte [esi]
inc esp
add ah, byte [esi]
cmp eax, 0x24a2602
dec ebp
add ah, byte [esi]
dec eax
add ah, byte [esi]
inc ecx
add dword [ebp + 0x27], ecx
add ah, byte [esi]
inc edi
add dword [ebp + 0x28], ecx
add ah, byte [esi]
inc edx
add ah, byte [esi]
inc ebp
add ah, byte [esi]
cmp al, 2
inc eax
add ah, byte [esi]
dec esp
add dword [ebp + 0x29], ecx
add al, 0x26
das
add dword [ebp + 0x2a], ecx
add ebp, dword [eax]
pop esi
add ah, byte [esi]
aas
add ah, byte [esi]
dec ebx
add dword [ebp + 0x24], ecx
add dword [ebp + 0x26], ecx
add ebp, dword [eax]
pop esp
add ebp, dword [eax]
pop edi
add ebp, dword [eax]
push edi
add al, 0x26
xor al, 3
sub byte [eax + 2], bl
sub ch, byte [edx + eax]
sub ah, byte [0x22b2a02]
sub ah, byte [edx + eax]
sub ah, byte [esi]
add ch, byte [ecx]
jle 0x91bb34
sub dword [ebx + eax + 0x2c], edi
aas
add ebp, dword [edi + edi]
add ch, byte [edx]
sub eax, 0x22a2a02
sub dword [edx + 3], edi
sub al, 0x3b
add dword [eax + 0x72], edx
add ch, byte [edx]
sub byte [edx], al
sub ch, byte [ecx]
add esp, dword [ebp + ebp*2 + 2]
sub ah, byte [edi]
add ch, byte [ecx]
jge 0x91bb58
sub dword [ebx + 1], edi
push eax
jno 0x91bb5e
add dword [eax + 0x71], edx
add ch, byte [edx]
and eax, dword [edx]
sub ah, byte [ecx]
add ebp, dword [esp + edi]
sub ah, byte [ebx]
add ch, byte [edx]
and dword [ebx], eax
sub al, 0x3c
add ebp, dword [edx + eax*2]
add ch, byte [edx]
and al, byte [edx]
sub ch, byte [esi]
add ebp, dword [esi + edi]
add ebp, dword [ecx + eax*2]
add ebp, dword [ebx + eax*2]
add ebp, dword [edi + 0x3335501]
xor byte [ebx + 1], ah
push ebp
xor al, byte [ebx]
xor byte [edi + 2], bl
outsb dx, byte cs:[esi]
add dword [ebp + 0x2f], edx
add ch, byte [esi]
jo 0x91bb92
xor byte [ecx + eax + 0x55], ah
push ebp
xor al, 2
jno fcn.0091bb9c
sub al, 0x60
add esi, dword [eax]
Function at 0x9249cf
Capabilities:
Check for vm using instruction vpcext
Get number of processors

Disassembly:
add ch, byte [esp + ecx*2 + 1]
jnp 0x924a09
add ebx, dword [esi + 0x68]
add ch, byte [edi + 0x57]
add dh, byte [eax + 0x56]
add dh, byte [eax + 0x55]
add esp, dword [eax + 0x7e]
add dword [esi + ebp*2 + 1], edi
jge 0x924a14
add dh, byte [eax + 0x57]
add dh, byte [ecx + 0x60]
add esp, dword [ecx + 0x6d]
add dword [ebp + 0x3c], edi
add dword [ebx + 0x5d], ecx
add dword [edi + 0x59], ecx
add dword [edi + 0x3e], esp
add dword [edx + 0x4b], edi
add dword [ebx + 0x5e], ecx
add dword [ebx + 0x6c], edx
add dword [ebp + 0x69], ebx
add dword [edx + 0x58], esp
add dword [edi + 0x52], esi
pop ebp
imul eax, dword [ecx], 0x77015862
push edx
add dword [edi + 0x5a], ecx
add ch, byte [0x612d0262]
add dh, byte [ebx]
inc ebp
add esi, dword [eax + esi]
add dword [eax + 0x5d], ebx
add dword [eax + 0x5b], ebx
add dword [eax + 0x5f], ebx
add dh, byte [ebx]
inc edi
add esi, dword [ebp + 0x15e5801]
pop eax
pop esp
add esi, dword [edi + ebp]
add esi, dword [esi + ebp]
add esi, dword [ecx + esi]
add dh, byte [ebx]
inc esi
add dword [ebp + 0x6c], ebx
add bh, byte [edx]
and dword [ebx], eax
cmp dword [eax + 1], ebx
pop ebp
imul eax, dword [ecx], 0x5d
insd dword es:[edi], dx
add bh, byte [edx]
add dword es:[ebp + 0x6f], ebx
add bh, byte [edx]
and eax, dword [edx]
cmp ah, byte [edx + eax]
cmp dword [edx + 1], edi
pop ebp
Function at 0x925f1d
Capabilities:
Check for peb beingdebugged flag

Disassembly:
jbe 0x925e5f
outsd dx, dword [esi]
jle 0x925e62
jae 0x925e93
xor byte [edx], al
pop ebx
jbe 0x925e6b
add bl, byte [ebx + 0x76]
add al, 0x55
push ebp
xor dword [edx], eax
pop ebx
jns 0x925e6e
jae 0x925ea0
xor dword [ebx], eax
push edi
cmp al, byte [edx]
pushal
jo 0x925e78
add edx, dword [edi + 0x3a]
add ah, byte [eax + 0x70]
add bl, byte [ebx + 0x77]
pop ebx
ja 0x925e7b
add ah, byte [ebx + 1]
arpl word fs:[ecx], ax
add dword [edi + 0x78], esi
ja 0x925ef6
add ch, byte [eax + 0x2e]
add al, 0x62
dec ecx
add ebx, dword [ebp + 0x61]
add ch, byte [edx + 0x74]
add ch, byte [edx + 0x72]
add ebx, dword [ebp + 0x60]
add ebx, dword [ebp + 0x5e]
add ch, byte [edx + 0x73]
add ch, byte [esi + ebp*2 + 3]
pop edi
and eax, 0x2487b01
outsb dx, byte [esi]
push ecx
add dword [esi + edx*2 + 1], edi
jl 0x925ed0
add dword [esp + edx*2 + 1], edi
jl 0x925f03
add dh, byte [eax + 0x62]
add dword [ebp + 0x2f], edi
add esp, dword [ecx + 0x74]
add dword [eax + 0x6d], ebx
add al, 0x36
sub eax, 0x46e4a03
dec esi
jns 0x925ec6
add ebx, dword fs:[edi + 0x7b]
add ebx, dword [edi + 0x7b]
add esp, dword [eax + 0x63]
add dh, byte [ebx]
dec esp
add eax, dword [eax + 0x32]
add dword [edi + 0x6c], esp
inc eax
xor al, byte [ecx]
insb byte es:[di], dx
add eax, dword [ebp + 0x61]
add cl, byte [edi + 0x43]
add ecx, dword [edx + 0x6f]
add ecx, dword [edx + 0x73]
add dword [ebx + 0x75], ebp
add cl, byte [edi + 0x44]
add ecx, dword [edx + 0x71]
add ecx, dword [edx + 0x70]
add ecx, dword [edx + 0x72]
add dl, byte [ebp + 0x7d]
add dl, byte [ebp + 0x7c]
add dword [ebx + 0x33], esi
add dword [eax + 0x21], esi
add dword [eax + 0x22], esi
add al, 0x4f
and dword [edx], eax
push esi
and al, byte [edx]
push esi
and dword [edx], eax
push ebp
jle 0x925f0f
dec edi
jns 0x925f12
push ebx
jne 0x925f14
pop ebx
jp 0x925f17
add bl, byte [ebx + 0x7d]
pop ebx
jge 0x925f1b
add edx, dword [ebx + 0x74]
add bl, byte [ebx + 0x7c]
push ebx
je fcn.00925f1d
pop ebx
jl 0x925f20
invalid
pop ebx
jnp 0x925f22
jae 0x925f55
xor al, byte [edx]
pushal
je 0x925f29
pushal
jb 0x925f2c
pushal
jno 0x925f31
pop edx
cmp eax, dword [edx]
pushal
jae 0x925f39
push edi
cmp al, 1
ja 0x925fb4
xor al, byte [ecx]
jns 0x925fac
insd dword es:[edi], dx
Function at 0x932424
Capabilities:
Execute anti-debugging instructions

Disassembly:
punpckhwd mm3, qword [esi + 0xf]
push 0x68
pop es
popal
sub ecx, dword [edi]
and eax, 0x4b270526
push es
sub eax, 0x4d270550
add eax, 0x2a054c27
jl 0x932445
sub bh, byte [ebp + 5]
sub bh, byte [ebx + 6]
push es
xor ebx, dword [edi + 6]
xor ebx, dword [esi + 5]
sub bh, byte [esi + 0xf]
sub al, 0x79
cvttps2pi mm7, qword [edx + 0xf]
sub al, 0x7b
cvttps2pi mm7, qword [edi + ecx + 0x2c]
jge 0x93246d
sub dword [eax + 0x2f054e2f], esp
dec ecx
add al, 0x2e
je 0x93246f
das
dec edx
add eax, 0x2f054c2f
dec ebp
push es
cmp dl, byte [eax + 5]
das
push ecx
add eax, 0x2f054f2f
dec ebx
push es
cmp cl, byte [edi + 6]
das
dec esp
add eax, 0x3a064d2f
push eax
add eax, 0x2f05512f
dec edi
add eax, 0x3a064b2f
dec edi
push es
cmp dl, byte [ecx + 5]
das
push eax
add eax, 0x310f522f
arpl word [edi], cx
xor dword [edi + ecx + 0x31], esp
rdtsc
rdtsc
rdtsc
push 0xf69310f
xor dword [edx + 4], ebp
jbe 0x9324ac
inc edx
je 0x9324af
inc edx
jp 0x9324b1
xor al, 0x4a
add al, 0x33
jns 0x9324b7
xor edi, dword [ecx + 5]
add eax, 0x42064d34
xor al, 0x4d
push es
inc edx
ja 0x9324bd
add eax, 0x42064c34
xor al, 0x4c
push es
inc edx
jl 0x9324c2
add al, 0x33
jne 0x9324c6
xor esi, dword [ebp + 5]
xor al, 0x4e
dec esi
push es
inc edx
jne 0x9324cc
add eax, 0x3405532f
dec ecx
das
push ebx
add eax, 0x42064934
push es
inc edx
jns 0x9324d6
inc edx
jnp 0x9324d8
xor al, 0x50
add eax, 0x42065134
xor al, 0x51
push es
inc edx
js 0x9324eb
aaa
dec ecx
getsec
dec edx
getsec
dec ebx
getsec
dec esp
getsec
dec esi
getsec
aaa
dec edi
add eax, 0x3b057c3a
and al, byte [0x3a057b3a]
jle 0x9324fe
cmp dword [esp + eax + 0x39], ebp
outsb dx, byte [esi]
push es
dec esp
pop edx
add eax, 0x39044b34
jae 0x93250e
cmp esp, dword [ecx]
add eax, 0x39047a3a
add al, 0x39
jns 0x932516
cmp dword [edi + 4], esi
cmp dword [eax + 6], esi
jo 0x93251e
dec esp
pop ebp
add al, 0x39
js 0x932524
dec esp
push edi
add eax, 0x4c06253b
dec esp
pop ecx
push es
dec esp
pop esp
Function at 0x932711
Capabilities:
Execute anti-debugging instructions

Disassembly:
jnp 0x932722
push eax
jl 0x932725
push eax
jge 0x932728
push eax
jle 0x93272b
push ecx
and cl, byte [edi]
push ecx
and al, 0xf
push ecx
sub dword [edi], ecx
push ecx
and eax, 0xf26510f
push ecx
sqrtps xmm4, xmmword es:[edi]
push ecx
daa
sqrtps xmm5, xmmword [edx]
add eax, 0x52046456
inc ecx
add al, 0x52
add eax, 0x56055856
pop esi
add eax, 0x31076656
sub al, byte [0x52045c56]
add eax, 0x52045d56
sub al, 5
push esi
push 0x7412607
xor dword [0x5325204], esp
push esi
add al, 0x52
xor dword [edi], eax
xor dword [ecx], ebp
add al, 0x52
cmp al, 7
xor byte [esi + 7], bh
xor dword [esi], esp
add al, 0x52
xor byte [0x30076056], al
jnp 0x93277d
push edx
aas
add eax, 0x56055f56
pop ecx
pop es
xor byte [edx + 7], bh
pop edi
add eax, 0x30075956
jp 0x93278c
xor dword [eax], ebp
add al, 0x52
sub al, byte [0x31075756]
and al, 4
push edi
pop es
xor dword [esp + eax], esp
push edx
xor eax, 0x7655605
xor byte [ebp + 5], bh
push esi
bound eax, qword [edx + edx*2]
xor eax, dword [edi]
xor dword [ebx], ebp
pop es
xor byte [ebp + 7], dh
xor dword [edi], esp
add eax, 0x5605304f
arpl word [0x30075a56], ax
js 0x9327bc
xor dword [ebx], esp
pop es
xor byte [esi + 5], dh
push esi
popal
orps xmm6, xmmword [edx + 5]
push esi
pop ebx
pop es
xor byte [edi + eax + 0x30], bh
ja 0x9327d1
xor dword [edx], esp
orps xmm3, xmmword [ebp + 0xf]
push esi
pop esi
orps xmm4, xmmword [eax + 0xf]
push esi
popal
orps xmm4, xmmword [edx + 0xf]
push esi
arpl word [edi], cx
push esi
orps xmm4, xmmword fs:[ebp + 0xf]
push esi
orpd xmm4, xmmword [edi + 0xf]
push esi
push 0xf69560f
push esi
push 0xf
push esi
imul ecx, dword [edi], 0x56
insb byte es:[edi], dx
orps xmm5, xmmword [ebp + 0xf]
push esi
outsb dx, byte [esi]
orps xmm5, xmmword [edi + 0xf]
push esi
jo 0x932815
push esi
jno 0x932818
push esi
jae 0x932813
xor byte [ecx + 0xf], bh
push eax
jns 0x932817
pop ebp
and al, 5
pop ebp
and dword [edi + edx*2], eax
add al, 0x57
push edi
pop ebp
add eax, 0x5d05755c
sub eax, 0x4795c05
push edi
pop esp
add al, 0x57
arpl word [edi + edx*2], ax
pop es
cmp ch, byte [eax + 0x57042b5d]
pushal
add eax, 0x5c05225d
jo 0x932841
pop ebp
and eax, dword [0x5d05725c]
xor dword [0x5d057b5c], eax
add eax, 0x5c05315d
jnp 0x93284d
pop ebp
sub al, byte [0x5d05775c]
xor al, 7
cmp ah, byte [eax + 0x5c05765c]
add eax, 0x3a07345d
and al, 5
pop esp
jbe 0x93285c
pop esp
jl 0x93285f
pop ebp
add al, 0x57
add al, 0x57
add eax, 0x3a07275d
add eax, 0x3a07275d
sub dword [0x5d054263], eax
sub al, 5
pop esp
jp 0x932876
outsd dx, dword [esi]
add eax, 0x5d05325d
sub dword [0x3a07735c], eax
sub eax, dword [0x5c052e5d]
Function at 0x9449c0
Capabilities:
Get number of processors

Disassembly:
mov byte ss:[ecx], bh
mov byte [edx - 0x78], ah
xchg ebx, eax
mov edx, dword [edx + 0x778b968b]
sbb byte [ebx], 0x8d
cmp dword [eax - 0x746c779e], ecx
xchg edx, eax
mov edx, dword [esi + 0x1b82778b]
invalid
bound ecx, qword [eax - 0x746d746d]
xchg esi, eax
mov esi, dword [edi - 0x7e]
sbb ecx, dword [ebp - 0x6b956e40]
rcl byte [ecx - 0x68bd6b96], 0x48
lcall 0x6297, 0xc994778b
lcall 0x8b9c, 0x7e9c9a65
stosb byte es:[edi], al
mov es, ebp
xchg ecx, eax
jge 0x9449ac
jle 0x9449ae
jl 0x9449b0
ja 0x9449ba
js 0x9449bc
neg dword [esi - 0x6b8073ac]
sbb bl, byte [esi - 0x65958dd8]
xor dword [ebx - 0x61e161e5], ebx
jb 0x944ab0
invalid
jnp 0x944ae2
jl 0x944ae4
jge 0x944ae6
jle 0x944ae8
jg 0x944aea
xor byte [eax], 0x81
xor byte [edx - 0x7bcf7cd0], al
xor byte [ebp - 0x78cf79d0], al
xor byte [eax - 0x75cf76d0], cl
invalid

Function at 0x944a04
Capabilities:
Get number of processors

Disassembly:
mov byte ss:[ecx], bh
mov byte [edx - 0x78], ah
xchg ebx, eax
mov edx, dword [edx + 0x778b968b]
sbb byte [ebx], 0x8d
cmp dword [eax - 0x746c779e], ecx
xchg edx, eax
mov edx, dword [esi + 0x1b82778b]
invalid
bound ecx, qword [eax - 0x746d746d]
xchg esi, eax
mov esi, dword [edi - 0x7e]
sbb ecx, dword [ebp - 0x6b956e40]
rcl byte [ecx - 0x68bd6b96], 0x48
lcall 0x6297, 0xc994778b
lcall 0x8b9c, 0x7e9c9a65
stosb byte es:[edi], al
mov es, ebp
xchg ecx, eax
jge 0x9449ac
jle 0x9449ae
jl 0x9449b0
ja 0x9449ba
js 0x9449bc
neg dword [esi - 0x6b8073ac]
sbb bl, byte [esi - 0x65958dd8]
xor dword [ebx - 0x61e161e5], ebx
jb 0x944ab0
invalid
jnp 0x944ae2
jl 0x944ae4
jge 0x944ae6
jle 0x944ae8
jg 0x944aea
xor byte [eax], 0x81
xor byte [edx - 0x7bcf7cd0], al
xor byte [ebp - 0x78cf79d0], al
xor byte [eax - 0x75cf76d0], cl
invalid
Function at 0x405175
Capabilities:
Check mutex on windows

Disassembly:
mov eax, 0x46c3c0
call fcn.0042dfbc
push ecx
push esi
push edi
xor esi, esi
push str.ImageDrive_C9397B2D_6628_4637_86B8_9AE5126F4813
push esi
mov edi, ecx
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, esi
mov dword [edi + 0xc8], eax
je 0x4051a9
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4051ad
mov al, 1
jmp 0x4051e7
lea eax, [ebp - 0x10]
mov ecx, edi
push eax
call fcn.00405212
push dword [eax]
mov dword [ebp - 4], esi
push esi
call dword [sym.imp.USER32.dll_FindWindowA]
push eax
call fcn.004593de
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
mov edi, eax
call fcn.0045d2d0
cmp edi, esi
je 0x4051e5
push dword [edi + 0x1c]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x4056d9
Capabilities:
Resume thread

Disassembly:
push esi
push 0
push 4
push 0
push 0
push dword [esp + 0x18]
push 0x405709
call fcn.0045dd05
mov esi, eax
test esi, esi
je 0x405703
push dword [esi + 0x28]
and dword [esi + 0x24], 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, esi
pop esi
ret 4

Function at 0x4071d2
Capabilities:
Check if file exists
Copy file

Disassembly:
mov eax, 0x46c614
call fcn.0042dfbc
sub esp, 0x10
push ebx
push esi
mov ebx, str.Copying_control_panel_applet
push edi
mov esi, ecx
push ebx
call fcn.004077e3
mov edi, str.ImageDrive.cpl
lea eax, [esi + 4]
push edi
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0045d565
and dword [ebp - 4], 0
lea eax, [esi + 8]
push edi
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0045d565
push dword [ebp - 0x10]
mov byte [ebp - 4], 1
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x40723b
push ecx
lea eax, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.0045d045
mov ecx, esi
call fcn.004078ce
push 0
push dword [ebp - 0x10]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
setne byte [ebp - 0x1c]
cmp byte [ebp - 0x1c], 0
jne 0x407296
mov eax, dword [0x493ec4]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 2
push dword [ebp - 0x18]
push str.CopyFile___s_______s_
push eax
call fcn.00453df1
mov edi, dword [ebp - 0x14]
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
mov ecx, esi
call fcn.00407856
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.0045d2d0
push dword [ebp - 0x1c]
mov ecx, esi
push ebx
call fcn.004077fc
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0045d2d0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0045d2d0
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp - 0x1c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret