joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40101f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10eb110]
jne 0x401029
repz ret
jmp fcn.004012ab

Function at 0x404e11
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10eb110]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004013b1
and dword [ebp - 0x14], 0
cmp dword [0x10ee224], 0
mov dword [ebp - 0x18], eax
jne 0x404ec4
push str.USER32.DLL
call dword [sym.imp.kernel32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x404f6c
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x404f6c
mov esi, dword [sym.imp.kernel32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x10ee224], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x10ee228], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x10ee22c], eax
call edi
push eax
call esi
mov dword [0x10ee234], eax
test eax, eax
je 0x404ec4
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x10ee230], eax
mov eax, dword [0x10ee230]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.kernel32.dll_DecodePointer]
cmp eax, ecx
je 0x404f1d
cmp dword [0x10ee234], ecx
je 0x404f1d
push eax
call esi
push dword [0x10ee234]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x404f1d
test ebx, ebx
je 0x404f1d
call edi
test eax, eax
je 0x404f14
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x404f14
test byte [ebp - 8], 1
jne 0x404f1d
or dword [ebp + 0x10], 0x200000
jmp 0x404f50
mov eax, dword [0x10ee228]
cmp eax, dword [ebp - 0x18]
je 0x404f50
push eax
call esi
test eax, eax
je 0x404f50
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x404f50
mov eax, dword [0x10ee22c]
cmp eax, dword [ebp - 0x18]
je 0x404f50
push eax
call esi
test eax, eax
je 0x404f50
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x10ee224]
call esi
test eax, eax
je 0x404f6c
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x404f6e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040101f
leave
ret
Function at 0x401707
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
push edi
mov ecx, dword [esi + 0x3c]
mov eax, dword [ecx + esi + 0x78]
lea edi, [eax + esi]
mov ecx, dword [ecx + esi + 0x7c]
mov dword [ebp - 4], ecx
mov eax, dword [edi + 0x20]
lea eax, [eax + ebx*4]
mov eax, dword [eax + esi]
add eax, esi
push eax
push dword [ebp + 0xc]
call fcn.004016da
pop ecx
test eax, eax
pop ecx
jne 0x40176e
xor ebx, ebx
cmp dword [edi + 0x18], ebx
jbe 0x401767
mov eax, dword [edi + 0x20]
lea eax, [eax + ebx*4]
mov eax, dword [eax + esi]
add eax, esi
push eax
push dword [ebp + 0xc]
call fcn.004016da
pop ecx
test eax, eax
pop ecx
jne 0x40176e
inc ebx
cmp ebx, dword [edi + 0x18]
jb 0x401747
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [edi + 0x24]
mov ecx, dword [edi + 0x1c]
lea eax, [eax + ebx*2]
movzx eax, word [eax + esi]
lea eax, [ecx + eax*4]
mov eax, dword [eax + esi]
add eax, esi
jmp 0x401769
Function at 0x40657c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4065a0
xor eax, eax
test eax, eax
je 0x4065b3
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4065b3
xor ecx, ecx
jmp 0x4065b6
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x40669d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dcc], 0
push esi
jne 0x4066d4
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4066ae
mov dword [ecx*4 + 0x427dc8], eax
inc ecx
cmp ecx, 0x100
jl 0x4066a9
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406705
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427dc8]
xor eax, esi
inc ecx
dec edx
jne 0x4066e7
pop edi
not eax
pop esi
ret 0xc

Function at 0x408945
Capabilities:
Encode data using xor

Disassembly:
push 0x4085d8
mov eax, dword [esp]
add esp, 4
and edi, ecx
call fcn.0040896d
add edi, ecx
xor dword [ebx], eax
or edi, ecx
inc ebx
sub ecx, edi
and ecx, edi
cmp ebx, edx
jne fcn.00408945
add ecx, 1
ret
Function at 0x4068c4
Capabilities:
Encode data using xor

Disassembly:
call fcn.00406761
xor ecx, ecx
sub cx, 0xff72
call 0x4068c4
rcr byte [esi - 0x7f], 0x76
push cs
cld
invalid

Function at 0x40a3c0
Capabilities:
Terminate process

Disassembly:
xor edi, dword [esi + ebx*2 + 0x5d]
ret 0x8e
inc ecx
or byte [eax - 1], dl
adc eax, 0x2cc030
jmp 0x40a37f
add bl, ch
jae 0xefb5a66d
push ecx
dec ecx
popfd
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
jne 0x40a358
mov eax, dword [edi]
cwde
rol byte [eax], 0xcc
add ah, cl
salc
test eax, eax
je 0x40a358
call esi
add eax, 0xafc80
pop esi
pop ebp
std
add al, 0x95
imul edx, dword [eax + 0x5590901c], 0xfffffff6
in al, dx
mov eax, dword [edx - 0x5d6b97f8]
inc eax
add byte [eax - 0x75], dl
add byte [edi], al
jp 0x40a365
invalid
mov edx, 0x37e7c202
nop
nop
nop
or byte [eax - 0x336f6bdd], dl
xchg ebx, eax
nop
push ebp
jp 0x40a36d
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
test eax, eax
stosd dword es:[edi], eax
xor ecx, dword [ebx + 0x50519607]
shr byte [ebx - 0x69f874cd], 0x51
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dl, 0xc0
jne 0x40a3da
push esi
mov edi, esp
cwde
rol byte [eax], 0xff
salc
test eax, eax
jo 0x40a388
pop esi
pop ebp
ret 0x9708

Function at 0x40ae50
Capabilities:
Encode data using xor

Disassembly:
jns 0x40ae2a
jmp [esi - 0x8666900]
scasb al, byte es:[edi]
add byte [edi + 0x49af799], dl
xor byte [eax - 0x3d7509ff], cl
add al, 0x30
mov byte [ecx], al
inc ecx
mov byte [ecx], 0x2e
inc ecx
cmp dh, byte [ebp - 0x4b]
mov eax, dword [ebp + 0xc]
mov al, byte [0xff41c65e]
add byte [ebx + 0x5d], bl
ret
cld
mov ebp, dword [edx + 0x530c3683]
xor dword [esi], 0xc
push ebx
cmp byte [ebx - 0x72a8ef8b], cl
or esi, dword ds:[edi + 0x44]
push cs
push esi
add byte [eax], al
push ebx
mov edi, 0xc0335e5f
pop ebx
jno 0x40ae53
adc eax, 0x8b3064c2
pop ebp
mov cl, byte [ebx - 0x3b27e7bd]
add ah, byte [edx + 0xc43ab65]
test eax, eax
jne 0x40aee2
mov eax, dword [ebx]
in al, 0x14
push eax
xor edi, edi
sahf
ja 0x40ae29
jmp edi
mov ecx, dword [ecx + 0x34]
or edi, 0xffffffff
cmp edi, dword [edx]
mov eax, dword [ebp + 0x77]
je 0x40af17
mov cl, byte [ebx + 0x30]
mov byte [eax], cl
jecxz 0x40af0c
inc eax
dec edx
mov dword [esi], edx
mov dword [eax + esi], ebx
mov ecx, dword [esi]
mov dword [ebp + 0x35], eax
test ecx, ecx
jne 0x40af17
mov dword [esi], 0xd101
pop edi
pop esi
xchg al, al
insb byte es:[edi], dx
adc ah, ch
pop ebp
ret 0x8e0c
mov cl, byte [ebx + 0x2c]
test cl, cl
pshufw mm3, qword [0x8b00004e], 0xf6
mov edi, dword cs:[esi]
popfd
invalid
Function at 0x401000
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ebx, esi
xor ebx, ebx
mov ebx, eax
xor ebx, eax
mov eax, eax
mov ebx, esi
xor eax, eax
xor ebx, ebx
mov ebx, ebx
or esi, 0x20
not ebx
or ebx, 0x5b
rcr esi, 0xda
ror ebx, 0xa2
rol esi, 0xd0
add edi, 0x22
bswap eax
mov ebx, 0x7e
rcr edx, 0x28
sub esi, 0x55
neg edi
neg ebx
mov esi, 0xcd
add eax, 0x40
bswap eax
or esi, 9
rcl ebx, 0xa3
sbb esi, 0xd8
inc edx
not edx
bswap edi
sbb eax, 0x7a
not eax
neg edi
ror eax, 0x20
and edi, 0xd2
neg ebx
or edi, 0x7e
rol esi, 0x70
sub edx, 0xf3
and edi, 0x32
ror eax, 0x73
imul eax
bswap ebx
and esi, 0xe3
dec eax
rol eax, 0x21
mov edi, 0x5d
inc ebx
neg esi
add edi, 0x71
dec edi
rcl edx, 0x62
sbb edi, 0xc4
sbb edi, 0x4f
add esi, 0x9a
bswap ebx
dec ebx
sub eax, 0x49
xor ecx, ecx
xor edi, edi
xor eax, esi
mov eax, eax
xor esi, esi
mov esi, eax
mov eax, eax
mov eax, eax
or edi, 0xdb
neg ebx
rcr esi, 0x38
or edx, 0xbf
imul ebx
imul eax
sub esi, 0xa
imul ebx
dec esi
imul eax
rol eax, 0xf6
mov esi, 0x9a
rol eax, 0x38
bswap esi
not edx
rcr esi, 0xa6
not esi
not esi
dec edx
imul ebx
rcl esi, 0x52
ror edi, 0x47
dec eax
imul ebx
imul edi
mov esi, 0xd7
neg edx
inc eax
add edi, 0x60
not edi
inc eax
neg esi
not eax
imul edx
neg edi
dec esi
imul esi
rcr ebx, 0x67
not esi
neg edx
or esi, 0xa8
add eax, 0x74
not esi
sbb ebx, 9
dec edi
and esi, 0x34
dec edx
sbb ebx, 0x51
add edx, 0x4f
or edi, 0x9a
xor eax, eax
mov ebx, eax
xor ebx, eax
mov ebx, esi
xor eax, esi
mov eax, ebx
mov ebx, ebx
xor eax, ebx
xor eax, eax
mov ecx, dword [ebp + 0xc]
sub edi, 0xf4
sbb esi, 0xd8
and edi, 0xb3
sbb edx, 0x24
bswap edi
neg edi
imul eax
rol edi, 0x66
add eax, 0xd9
sbb ebx, 0x90
add edi, 0xda
and ebx, 0x5a
and ebx, 0x69
bswap edi
sbb esi, 0xe1
imul esi
not edx
mov esi, 0x9d
inc edx
ror eax, 0x94
neg ebx
sbb edi, 0xf5
add esi, 0xa3
dec esi
dec edx
imul ebx
neg edi
sbb esi, 0x5f
sbb edx, 7
sbb eax, 0x69
sbb ebx, 0xa8
ror eax, 0x8f
and edi, 0x2d
sub ebx, 0x37
imul edx
dec esi
not edx
rol edi, 5
ror edx, 0x25
imul eax
sbb edx, 0x22
dec edx
rcl edi, 0x58
and ebx, 0x6f
ror esi, 0x24
ror eax, 0x75
or edi, 0x7a
sub esi, 0x10
sub edi, 0x9a
or edx, 0x42
mov edi, dword [ebp + 8]
xor eax, eax
mov ebx, eax
xor ebx, ebx
xor eax, esi
mov ebx, ebx
mov esi, esi
mov eax, ebx
xor eax, ebx
xor ebx, eax
not byte [edi]
xor ebx, esi
mov ebx, ebx
xor eax, eax
xor esi, esi
xor eax, ebx
xor ebx, ebx
xor ebx, eax
mov ebx, eax
mov ebx, eax
mov esi, esi
xor eax, ebx
xor eax, eax
sub byte [edi], 0x1d
add byte [edi], 0x40
xor ebx, esi
mov ebx, eax
mov ebx, esi
xor ebx, eax
xor ebx, eax
xor ebx, eax
xor ebx, eax
mov eax, ebx
xor esi, esi
imul byte [edi]
inc edi
loop 0x401204
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x404818
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x404857
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x404857
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x404857
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x404857
cmp dword [ecx + 0x74], 0xe
jbe 0x404857
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x40a548
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40a5e5
push ebx
push esi
call fcn.0040a511
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040a4a5
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40a592
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40a5e4
push edi
push eax
call fcn.00408eab
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40a5b2
call fcn.00408ef9
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40a5e3
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040a4a5
add esp, 0x20
test eax, eax
jne 0x40a5d1
push edi
call fcn.00408ef9
jmp 0x40a5d9
push ebx
call fcn.00408ef9
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x40b7f4
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x464be0
push 0x464bd8
push str.FlsAlloc
push 0x1f
call fcn.0040b6b3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40b828
push dword [ebp + 8]
mov ecx, esi
call dword [0x412130]
call esi
jmp 0x40b82e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40b872
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x464bf0
push 0x464be8
push str.FlsGetValue
push 0x21
call fcn.0040b6b3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40b8a9
push dword [ebp + 8]
mov ecx, esi
call dword [0x412130]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40b8b1
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x464bf8
push 0x464bf0
push str.FlsSetValue
push 0x22
call fcn.0040b6b3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40b8eb
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x412130]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x410cb0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x410cdd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x410cdd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x430391
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x48d0b8]
jne 0x43039b
repz ret
jmp fcn.00433a5f

Function at 0x4391bb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x48d0b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00433107
and dword [ebp - 0x14], 0
cmp dword [0x48ee0c], 0
mov dword [ebp - 0x18], eax
jne 0x43926e
push 0x402b78
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x439316
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402b6c
push ebx
call edi
test eax, eax
je 0x439316
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x402b5c
push ebx
mov dword [0x48ee0c], eax
call edi
push eax
call esi
push 0x402b48
push ebx
mov dword [0x48ee10], eax
call edi
push eax
call esi
push 0x402b2c
push ebx
mov dword [0x48ee14], eax
call edi
push eax
call esi
mov dword [0x48ee1c], eax
test eax, eax
je 0x43926e
push 0x402b14
push ebx
call edi
push eax
call esi
mov dword [0x48ee18], eax
mov eax, dword [0x48ee18]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4392c7
cmp dword [0x48ee1c], ecx
je 0x4392c7
push eax
call esi
push dword [0x48ee1c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4392c7
test ebx, ebx
je 0x4392c7
call edi
test eax, eax
je 0x4392be
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4392be
test byte [ebp - 8], 1
jne 0x4392c7
or dword [ebp + 0x10], 0x200000
jmp 0x4392fa
mov eax, dword [0x48ee10]
cmp eax, dword [ebp - 0x18]
je 0x4392fa
push eax
call esi
test eax, eax
je 0x4392fa
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4392fa
mov eax, dword [0x48ee14]
cmp eax, dword [ebp - 0x18]
je 0x4392fa
push eax
call esi
test eax, eax
je 0x4392fa
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x48ee0c]
call esi
test eax, eax
je 0x439316
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x439318
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00430391
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4048b2
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00437da2
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x4049d5
push ecx
lea ecx, [esi + 0x18]
call fcn.004240d2
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4049ec
push ecx
lea ecx, [esi + 0x24]
call fcn.00423fe2
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x44a210
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0xc]
push edi
xor ebp, ebp
push str.Kernel32
mov dword [esi], ebp
mov dword [esi + 4], ebp
mov dword [esi + 8], ebp
mov dword [esi + 0xc], ebp
mov dword [esi + 0x10], ebp
mov dword [esi + 0x14], ebp
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
cmp edi, ebp
je 0x44a2b0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CreateToolhelp32Snapshot
push edi
call ebx
push str.Thread32First
push edi
mov dword [esi + 4], eax
call ebx
push str.Thread32Next
push edi
mov dword [esi + 8], eax
call ebx
push str.Module32FirstW
push edi
mov dword [esi + 0xc], eax
call ebx
push str.Module32NextW
push edi
mov dword [esi + 0x10], eax
call ebx
mov ecx, dword [esi + 4]
mov dword [esi + 0x14], eax
cmp ecx, ebp
pop ebx
je 0x44a2a7
cmp dword [esi + 8], ebp
je 0x44a2a7
cmp dword [esi + 0xc], ebp
je 0x44a2a7
cmp dword [esi + 0x10], ebp
je 0x44a2a7
cmp eax, ebp
je 0x44a2a7
push edi
mov dword [esi], 1
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
pop edi
pop esi
pop ebp
ret
push edi
mov dword [esi], ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
pop edi
pop esi
pop ebp
ret
Function at 0x44dc52
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00481142
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x44dd75
push ecx
lea ecx, [esi + 0x18]
call fcn.0046d472
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x44dd8c
push ecx
lea ecx, [esi + 0x24]
call fcn.0046d382
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x46d252
Capabilities:
Check for vm using instruction vpcext

Disassembly:
adc eax, 0x57558015
xor al, 0x9b
push ebp
cmp esp, dword [edi]
daa
in eax, dx
ja 0x46d20e
jne 0x46d226
loopne 0x46d1f0
retf 0xae16
mov al, 0xef
cmp ecx, dword [edi + 8]
push 0xffffffffffffffd1
dec esi
sub ebp, dword [0xb17239d5]
arpl word [edi + esi*2], bp
push ebx
nop
push es
invalid
mov eax, 0x628ac3ad
add ch, ch
mov bl, 0x5d
stosb byte es:[edi], al
lodsd eax, dword [esi]
push 0x4c316d16
mov al, byte [0xc7412bc6]
mov edx, 0x7f852eb7
xchg esi, eax
rol dword [edi + 0x53df856e], 1
ja 0x46d2ae
push esp
test al, 0xea
jnp 0x46d2a7
in eax, 0xd1
pop esi
std
rcr dword [esi - 3], 1
and eax, dword [esi - 0xe7133db]
inc ebx
jg 0x46d291
and al, 0x3b
aam 0xc2
add al, 0x49
syscall
dec edi
jnp 0x46d1f9
sub eax, 0x1eacae10
invalid
invalid
fisubr word [ebp + 0xe]
in al, dx
sal dword [ecx + 0x27af1c87], 0x54
sbb al, 0xaf
daa
push esp
xchg edi, eax
add dword [esi + 0x2b], 0xfa44886
inc ecx
fcom qword [eax + 0x6e]
test eax, 0x86539d17
pushal
sti
mov ecx, 0x9cc5f3f7
pop edx
movsd dword es:[edi], dword [esi]
pushfd
mov bh, 0x25
pop ebx
cmp edi, edx
mov esp, 0xca1aeb0a
invalid