joyce8/EMBER2024-capa huggingface dataset:
Function at 0x472a4a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push ecx
push edx
push edi
push 0x20
lea edx, [ebp - 0x20]
push edx
call fcn.0046c00c
mov edi, dword [ebp + 8]
mov dword [ebp - 0x18], edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0x240
mov dword [ebp - 0xc], 0x472abb
mov ebx, dword [0x404f74]
mov word [ebx], 0
mov dword [ebp - 8], ebx
push ebx
push 0x104
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.shell32_SHBrowseForFolderW]
cmp eax, 0
je 0x472ab3
push edi
push eax
call dword [sym.imp.shell32_SHGetPathFromIDListW]
push edi
call dword [sym.imp.shlwapi.dll_PathQuoteSpacesW]
mov eax, edi
pop edi
pop edx
pop ecx
pop ebx
leave
ret 8

Function at 0x472d07
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
push edx
push edi
mov edi, dword [ebp + 8]
push 0
push edi
push 0
call dword [sym.imp.urlmon.dll_IsValidURL]
cmp eax, 0
jne 0x472d92
push 4
call 0x472d32
push 0x74007400
add byte [eax], dh
add byte [eax], al
push edi
call dword [sym.imp.shlwapi.dll_StrCmpNIW]
cmp eax, 0
jne 0x472d92
mov ebx, dword [0x404f70]
push ebx
push 0x104
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
push edi
call dword [sym.imp.shlwapi.dll_PathFindFileNameW]
mov edx, dword [0x404f68]
push eax
push ebx
call 0x472d70
and eax, 0x5c007300
add byte [0x7300], ah
add byte [edx - 1], dl
adc eax, sym.imp.user32.dll_wsprintfW
add esp, 0x10
push dword [0x404f68]
push edi
call fcn.00473029
cmp eax, 0xffffffff
je 0x472d94
mov eax, dword [0x404f68]
jmp 0x472d94
mov eax, edi
pop edi
pop edx
pop ecx
pop ebx
leave
ret 4

Function at 0x472d32
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
push edx
push edi
mov edi, dword [ebp + 8]
push 0
push edi
push 0
call dword [sym.imp.urlmon.dll_IsValidURL]
cmp eax, 0
jne 0x472d92
push 4
call 0x472d32
push 0x74007400
add byte [eax], dh
add byte [eax], al
push edi
call dword [sym.imp.shlwapi.dll_StrCmpNIW]
cmp eax, 0
jne 0x472d92
mov ebx, dword [0x404f70]
push ebx
push 0x104
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
push edi
call dword [sym.imp.shlwapi.dll_PathFindFileNameW]
mov edx, dword [0x404f68]
push eax
push ebx
call 0x472d70
and eax, 0x5c007300
add byte [0x7300], ah
add byte [edx - 1], dl
adc eax, sym.imp.user32.dll_wsprintfW
add esp, 0x10
push dword [0x404f68]
push edi
call fcn.00473029
cmp eax, 0xffffffff
je 0x472d94
mov eax, dword [0x404f68]
jmp 0x472d94
mov eax, edi
pop edi
pop edx
pop ecx
pop ebx
leave
ret 4
Function at 0x472ed4
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push ecx
push edx
push esi
push edi
call 0x472eee
or dword [eax], eax
and byte [eax], al
and al, byte [eax]
daa
add byte [eax], al
add bh, bh
jne 0x472ef9
call dword [sym.imp.shlwapi.dll_StrTrimW]
push dword [ebp + 8]
call fcn.00472d07
cmp eax, 0xffffffff
je 0x473020
or al, ch
or dh, bh
invalid
mov dword [ebp + 8], eax
push 0
push pe_nt_image_headers32
push 3
push 0
push 0
push 0x80000000
push eax
call dword [sym.imp.kernel32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x473020
mov dword [ebp - 0x18], eax
push 0
push eax
call dword [sym.imp.kernel32.dll_GetFileSize]
cmp eax, 0xffffffff
jne 0x472f51
push dword [ebp - 0x18]
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, 0xffffffff
jmp 0x473020
mov dword [ebp - 0x10], eax
mov ecx, eax
add eax, 0x104
push eax
call fcn.0046bf84
mov dword [ebp - 8], eax
add ecx, ecx
add ecx, 0x10000
push ecx
call fcn.0046bf84
mov dword [ebp - 4], eax
push ecx
call fcn.0046bf84
mov dword [ebp - 0x14], eax
push 0
lea edx, [ebp - 0xc]
push edx
push dword [ebp - 0x10]
push dword [ebp - 8]
push dword [ebp - 0x18]
call dword [sym.imp.kernel32.dll_ReadFile]
push dword [ebp - 0x18]
call dword [sym.imp.kernel32.dll_CloseHandle]
mov esi, dword [ebp - 8]
cmp byte [esi], 0xef
jne 0x472fb3
cmp byte [esi + 1], 0xbb
jne 0x472fb3
cmp byte [esi + 2], 0xbf
jne 0x472fb3
add esi, 3
mov edi, dword [ebp - 0x14]
cmp byte [esi], 0
je 0x472fe2
cmp byte [esi], 0xa
jne 0x472fc6
cmp byte [esi - 1], 0xd
jne 0x472fd1
cmp byte [esi], 0xd
jne 0x472fde
cmp byte [esi + 1], 0xa
je 0x472fde
mov word [edi], 0xa0d
add edi, 2
add esi, 1
jmp 0x472fe0
lodsb al, byte [esi]
stosb byte es:[edi], al
jmp 0x472fb6
mov byte [edi], 0
push 0
push 0
push 0xffffffffffffffff
push dword [ebp - 0x14]
push 0
push dword [ebp + 0xc]
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
push eax
push dword [ebp - 4]
push 0xffffffffffffffff
push dword [ebp - 0x14]
push 0
push dword [ebp + 0xc]
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
push dword [ebp - 0x14]
call fcn.0046bff1
push dword [ebp - 8]
call fcn.0046bff1
mov eax, dword [ebp - 4]
pop edi
pop esi
pop edx
pop ecx
pop ebx
leave
ret 8
Function at 0x472eee
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push ecx
push edx
push esi
push edi
call 0x472eee
or dword [eax], eax
and byte [eax], al
and al, byte [eax]
daa
add byte [eax], al
add bh, bh
jne 0x472ef9
call dword [sym.imp.shlwapi.dll_StrTrimW]
push dword [ebp + 8]
call fcn.00472d07
cmp eax, 0xffffffff
je 0x473020
or al, ch
or dh, bh
invalid
mov dword [ebp + 8], eax
push 0
push pe_nt_image_headers32
push 3
push 0
push 0
push 0x80000000
push eax
call dword [sym.imp.kernel32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x473020
mov dword [ebp - 0x18], eax
push 0
push eax
call dword [sym.imp.kernel32.dll_GetFileSize]
cmp eax, 0xffffffff
jne 0x472f51
push dword [ebp - 0x18]
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, 0xffffffff
jmp 0x473020
mov dword [ebp - 0x10], eax
mov ecx, eax
add eax, 0x104
push eax
call fcn.0046bf84
mov dword [ebp - 8], eax
add ecx, ecx
add ecx, 0x10000
push ecx
call fcn.0046bf84
mov dword [ebp - 4], eax
push ecx
call fcn.0046bf84
mov dword [ebp - 0x14], eax
push 0
lea edx, [ebp - 0xc]
push edx
push dword [ebp - 0x10]
push dword [ebp - 8]
push dword [ebp - 0x18]
call dword [sym.imp.kernel32.dll_ReadFile]
push dword [ebp - 0x18]
call dword [sym.imp.kernel32.dll_CloseHandle]
mov esi, dword [ebp - 8]
cmp byte [esi], 0xef
jne 0x472fb3
cmp byte [esi + 1], 0xbb
jne 0x472fb3
cmp byte [esi + 2], 0xbf
jne 0x472fb3
add esi, 3
mov edi, dword [ebp - 0x14]
cmp byte [esi], 0
je 0x472fe2
cmp byte [esi], 0xa
jne 0x472fc6
cmp byte [esi - 1], 0xd
jne 0x472fd1
cmp byte [esi], 0xd
jne 0x472fde
cmp byte [esi + 1], 0xa
je 0x472fde
mov word [edi], 0xa0d
add edi, 2
add esi, 1
jmp 0x472fe0
lodsb al, byte [esi]
stosb byte es:[edi], al
jmp 0x472fb6
mov byte [edi], 0
push 0
push 0
push 0xffffffffffffffff
push dword [ebp - 0x14]
push 0
push dword [ebp + 0xc]
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
push eax
push dword [ebp - 4]
push 0xffffffffffffffff
push dword [ebp - 0x14]
push 0
push dword [ebp + 0xc]
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
push dword [ebp - 0x14]
call fcn.0046bff1
push dword [ebp - 8]
call fcn.0046bff1
mov eax, dword [ebp - 4]
pop edi
pop esi
pop edx
pop ecx
pop ebx
leave
ret 8
Function at 0x476cec
Capabilities:
Packed with generic packer
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push ecx
push edx
push edi
mov ebx, dword [ebp + 8]
call fcn.00472bfb
cmp word [esi], 0x5d
jne 0x476d0f
mov dword [ebp - 4], 0
xor eax, eax
jmp 0x476d1b
lea edx, [ebp - 4]
push edx
call fcn.004759ae
mov eax, dword [ebp - 4]
cmp eax, 0
jl 0x476d25
cmp eax, dword [ebx + 0x4c]
jl 0x476d2a
jmp 0x40479b
cmp dword [ebx + 0x50], 0x100000
jle 0x476d53
push 0x1010
push 0x40417a
push 0x404040
push dword [0x4012e8]
call dword [sym.imp.user32.dll_MessageBoxW]
jmp fcn.0047414d
push 0x5d
call fcn.004767b2
lodsw ax, word [esi]
cmp ax, 0x2e
jne 0x404ecb
call fcn.00472bdc
test eax, eax
je 0x404ecb
call fcn.00474395
cmp dword [0x404f6c], 5
je 0x476d98
cmp dword [0x404f6c], 0xb
je 0x476d98
cmp dword [0x404f6c], 6
je 0x476d98
jmp 0x40468c
mov edi, dword [ebx + 0x44]
mov ecx, dword [ebx + 0x48]
push ecx
push edi
push 0x466fe4
call dword [sym.imp.kernel32.dll_lstrcmpW]
pop ecx
cmp eax, 0
jne 0x476dbf
mov eax, dword [ebp - 4]
imul eax, dword [ebx + 0x48]
imul eax, eax, 0x58
add eax, edi
jmp 0x476dcc
add edi, 0x58
sub ecx, 1
jne 0x476d9e
jmp 0x404e99
pop edi
pop edx
pop ecx
pop ebx
leave
ret 4
Function at 0x4023a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl260.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x402472
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call sub.rtl260.bpl__System__FillChar_qqrpvic
mov dword [ebp - 0x4c], 0x44
mov dword [ebp - 0x20], 1
mov word [ebp - 0x1c], 5
mov eax, dword [ebp - 4]
call sub.rtl260.bpl__System__UStrLen_qqrx20System_UnicodeString
mov edx, eax
lea eax, [ebp - 4]
call sub.rtl260.bpl__System__UStrSetLength_qqrr20System_UnicodeStringi
lea eax, [ebp - 4]
call sub.rtl260.bpl__System_UniqueString_qqrr20System_UnicodeString
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 0x30
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call sub.rtl260.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x402432
mov dword [ebp - 8], 0xffffffff
jmp 0x40245c
push 0xffffffffffffffff
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402479
lea eax, [ebp - 4]
call sub.rtl260.bpl__System__UStrClr_qqrpv
ret
Function at 0x402480
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl260.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x4025df
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
call sub.rtl260.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x4025bc
mov eax, dword [ebp - 0xc]
call sub.rtl260.bpl__System__GetMem_qqri
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 4]
call sub.rtl260.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.version.dll_GetFileVersionInfoW
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x4025ec
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 8]
shr eax, 0x10
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 8]
call sub.rtl260.bpl__System_Sysutils_IntToStr_qqrj
mov eax, dword [ebp - 8]
push dword [eax]
push 0x4025fc
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 8]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x24]
call sub.rtl260.bpl__System_Sysutils_IntToStr_qqrj
push dword [ebp - 0x24]
mov eax, dword [ebp - 8]
mov edx, 3
call sub.rtl260.bpl__System__UStrCatN_qqrv
mov eax, dword [ebp - 8]
push dword [eax]
push 0x4025fc
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0xc]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x28]
call sub.rtl260.bpl__System_Sysutils_IntToStr_qqrj
push dword [ebp - 0x28]
mov eax, dword [ebp - 8]
mov edx, 3
call sub.rtl260.bpl__System__UStrCatN_qqrv
mov eax, dword [ebp - 8]
push dword [eax]
push 0x4025fc
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0xc]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x2c]
call sub.rtl260.bpl__System_Sysutils_IntToStr_qqrj
push dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
mov edx, 3
call sub.rtl260.bpl__System__UStrCatN_qqrv
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call sub.rtl260.bpl__System__FreeMem_qqrpv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4025e6
lea eax, [ebp - 0x2c]
mov edx, 3
call sub.rtl260.bpl__System__UStrArrayClr_qqrpvi
lea eax, [ebp - 4]
call sub.rtl260.bpl__System__UStrClr_qqrpv
ret
Function at 0x40e118
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
mov dl, 1
mov eax, dword [sym.imp.rtl260.bpl__System_Win_Registry_TRegistry_]
call sub.rtl260.bpl__System_Win_Registry_TRegistry__bctr_qqrv
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x40e19a
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call sub.rtl260.bpl__System_Win_Registry_TRegistry_SetRootKey_qqrp6HKEY__
xor ecx, ecx
mov edx, 0x40e1b4
mov eax, dword [ebp - 0xc]
call sub.rtl260.bpl__System_Win_Registry_TRegistry_OpenKey_qqrx20System_UnicodeStringo
test al, al
je 0x40e17d
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call sub.rtl260.bpl__System_Win_Registry_TRegistry_ValueExists_qqrx20System_UnicodeString
test al, al
je 0x40e176
mov dword [ebp - 8], 0xffffffff
jmp 0x40e184
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x40e184
mov dword [ebp - 8], 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e1a1
mov eax, dword [ebp - 0xc]
call sub.rtl260.bpl__System_TObject_Free_qqrv
ret
Function at 0x4103f8
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov eax, 0x40f304
call fcn.00401664
xor eax, eax
push ebp
push 0x41047b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [sym.imp.vcl260.bpl__Vcl_Forms_Application]
mov eax, dword [eax]
call sub.vcl260.bpl__Vcl_Forms_TApplication_Initialize_qqrv
push 0x410488
call sub.kernel32.dll_SetCurrentDirectoryW
lea edx, [ebp - 0x18]
mov eax, 1
call sub.rtl260.bpl__System_ParamStr_qqri
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call sub.rtl260.bpl__System_Sysutils_Trim_qqrx20System_UnicodeString
mov eax, dword [ebp - 0x14]
call fcn.00402600
mov eax, dword [sym.imp.vcl260.bpl__Vcl_Forms_Application]
mov eax, dword [eax]
call sub.vcl260.bpl__Vcl_Forms_TApplication_Run_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x410482
lea eax, [ebp - 0x18]
mov edx, 2
call sub.rtl260.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x1002a7a0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
mov ecx, dword [esi + 8]
push edi
push ebx
add ecx, 0xec
call dword [0x1006a19c]
push str.JSINCLUDE
call dword [sym.imp.msvcr100.dll_getenv]
mov edi, eax
add esp, 4
test edi, edi
je 0x1002a801
cmp byte [edi], 0
je 0x1002a801
mov ecx, ebx
call dword [sym.imp.ScCore.dll_public:_int___thiscall_ScCore::String::length_void_const]
test eax, eax
je 0x1002a7f1
mov ecx, dword [esi + 8]
push 0x3a
add ecx, 0xec
call dword [0x1006a2a4]
mov ecx, dword [esi + 8]
push edi
add ecx, 0xec
call dword [0x1006a2c4]
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x1002d7f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x1002d7ff
pop dword [ebp - 0x30]
mov eax, 0xfcd07337
sub eax, 0xeccd9b38
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x4610635c
add dword [ebp - 0x40], 0x841e1ef
mov dword [ebp - 0x3c], 0x43c6b276
sub dword [ebp - 0x3c], 0x11936631
mov dword [ebp - 0x38], 0x43aa8c06
add dword [ebp - 0x38], 0x8a1b828
mov dword [ebp - 0x34], 0x2df32a0e
add dword [ebp - 0x34], 0xd20cd5f2
lea eax, [ebp - 0x40]
push eax
mov eax, 0x2986b620
add eax, 0xe67fea18
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x436113a4
add dword [ebp - 0x40], 0x311155b2
mov dword [ebp - 0x3c], 0x3dba84e1
sub dword [ebp - 0x3c], 0xfc4e236c
mov dword [ebp - 0x38], 0x3dd40a3a
add dword [ebp - 0x38], 0x259b6232
mov dword [ebp - 0x34], 0xd0dd05aa
sub dword [ebp - 0x34], 0xd0dd05aa
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x42ddb
push 0
call eax
mov ecx, 0x3e88
mov edi, eax
mov edx, 0x8b17a0f0
sub edx, 0x7b0d6cf0
add edx, dword [ebp - 0x30]
mov esi, 0x3a240177
add esi, 0x1d1147db
sub dword [ebp - 0xc], edx
mov ebx, dword [edx]
add dword [ebp - 0x1c], edi
xor ebx, esi
sub dword [ebp - 8], edx
mov dword [edi], ebx
add edi, 0x784b68e9
sub edi, 0x784b68e5
add edx, 0x43c7e917
sub edx, 0x43c7e913
loop 0x1002d916
add eax, 0x5365de4d
add eax, 0xac9b0ea6
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x10033280
Capabilities:
Get number of processors

Disassembly:
mov dword [ecx], vtable.jsEngine.0
jmp fcn.10018120
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x403e59
pop dword [ebp - 0x38]
mov eax, 0xe97974a6
sub eax, 0xe939364d
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xed4be6eb
add dword [ebp - 0x48], 0x61065e60
mov dword [ebp - 0x44], 0x83e7281b
sub dword [ebp - 0x44], 0x51b3dbd6
mov dword [ebp - 0x40], 0x3d8370c2
add dword [ebp - 0x40], 0xec8d36c
mov dword [ebp - 0x3c], 0x14c5eb30
sub dword [ebp - 0x3c], 0x14c5eb30
lea eax, [ebp - 0x48]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x74b88b4c
add dword [ebp - 0x48], 0xffb9de0a
mov dword [ebp - 0x44], 0xc3eab25b
sub dword [ebp - 0x44], 0x827e50e6
mov dword [ebp - 0x40], 0xdbd5833d
add dword [ebp - 0x40], 0x8799e92f
mov dword [ebp - 0x3c], 0x67a2699b
sub dword [ebp - 0x3c], 0x67a2699b
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x82563c3
add eax, 0xf81b1d11
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x36b09
push 0
call eax
mov ecx, 0x64126221
sub ecx, 0x64121a5c
xor edx, edx
add edx, eax
mov edi, 0x411000
add edi, dword [ebp - 0x38]
mov esi, 0x4c5f9829
sub esi, 0xcc76b9b2
add dword [ebp - 0x18], ecx
mov ebx, dword [edi]
add dword [ebp - 0x2c], ebx
add ebx, esi
xor dword [ebp - 0x18], 0x6f39897a
mov dword [edx], ebx
add dword [ebp - 8], eax
add edx, 4
add edi, 0xfe6b81b4
add edi, 0x1947e50
loop 0x403f72
add eax, 0x111e7
xor ebx, ebx
add ebx, eax
add eax, 0x94aa3594
sub eax, 0x94aa358f
mov ecx, 0x45d9cf13
sub ecx, 0x4599cf13
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x419760
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40f015
lea edi, [esi - 0xe015]
push edi
or ebp, 0xffffffff
jmp 0x419782
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419789
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419778
nop
push 1
nop
pop eax
add ebx, ebx
jne 0x41979b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419790
jne 0x4197ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419790
sub ecx, ecx
sub eax, 3
jb 0x4197c0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x419832
mov ebp, eax
add ebx, ebx
jne 0x4197cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4197d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4197fc
inc ecx
add ebx, ebx
jne 0x4197e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4197dd
jne 0x4197f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4197dd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41981c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41980d
jmp 0x41977e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41981c
add edi, ecx
jmp 0x41977e
pop esi
push esi
pop edi
mov ecx, 0x2b3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41983a
cmp byte [edi], 5
jne 0x41983a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41983f
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x4198b7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1908c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41986c
push edi
pop ecx
jns 0x41989b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19090]
or eax, eax
je 0x4198b1
mov dword [ebx], eax
add ebx, 4
jmp 0x419889
call dword [esi + 0x190a0]
mov ebp, dword [esi + 0x19094]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4198eb
sub esp, 0xffffff80
jmp 0x404c20

Function at 0x433002
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00431219
Function at 0x404ae9
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
cmp eax, 0x50
ja 0x404b05
movzx ecx, byte [eax + 0x404d54]
jmp dword [ecx*4 + 0x404d44]
jmp 0x43b611
inc esi
shl byte [esi], 0x90
out 0xcb, al
xchg dword [esi], ebp
popal
jo 0x43b66c
sbb bh, byte [esi - 0x37da2b35]
popal
mov ebp, 0x44303b6
mov dword [0x73133ffb], eax
and esp, dword [edi + 0x48]
add eax, 0x7ce452e6
jno 0x43b63c
invalid
nop
into
popal
cli
dec ebp
ljmp 0x2c83
jg 0x43b600
push ebp
pop edx
test dword [eax - 0x13], ecx
add eax, dword [esi + 0x7a]
movsd dword es:[edi], dword [esi]
into
jecxz 0x43b629
sbb ebx, dword [eax - 0x29]
psubw mm0, qword [eax + 6]
das
scasb al, byte es:[edi]
pushal
add dword [eax + 0x4c6139f0], edi
in eax, 0x7b
adc al, 0xa
cmc
jmp [edi + 0x29]
in al, 0xa9
loopne 0x43b5fa
or al, 0xd1
xor al, 0xf3
cmp eax, 0xef1306e7
jmp 0x43b6e9
push es
jecxz 0x43b72c
test ah, dh
add eax, 0x43290a5b
fdiv dword [bx + 0x6ff1]
and dword [ebx + 0x34e049b1], edx
jecxz 0x43b728
mov eax, dword [0x1c16779e]
invalid
pop edx
xlatb
jmp 0x43b6b2
lea esp, [ebx]
int3
popfd
call 0x80bfaeec
dec ebx
mov bl, 0x9b
or eax, 0xf8d747a1
ja 0x43b74e
fstp qword [eax - 0x596a8681]
sbb edi, dword [edi - 0x2c]
jg 0x43b6f4
xor ah, ch
and al, byte [esi - 0x5b388f00]
movsb byte es:[edi], byte [esi]
popal
inc esi
jl 0x43b71e
int1
xchg ecx, eax
pop edx
inc ebx
xchg al, al
pop ss
scasd eax, dword es:[edi]
mov dl, 0x37
mov bh, 0x53
mov dword [0xf45fa211], eax
adc al, 0xc1
mov bh, 0x5f
add dword [edx], ebx
push eax
test ebp, ecx
popal
adc dword [ebx], edx
outsd dx, dword [esi]
xlatb
les esi, [esi + 0x169d57eb]
push edi
popfd
push ss
lahf
xchg ecx, eax
mov byte [0x1ec8c45c], al
xchg esi, eax
push ds
lodsd eax, dword [esi]
jl 0x43b707
cmp ebp, 0xb0f3d774
or byte [ebx - 0x26], dl
fld dword [edx - 0x2a]
and byte [edi + 0x545be706], cl
pop edx
stc
invalid

Function at 0x43afe7
Capabilities:
Encode data using xor

Disassembly:
invalid
dec esi
stosb byte es:[edi], al
and bl, byte [edi + 0x7f]
out 0x42, eax
jno 0x43b00b
loope 0x43afb6
and al, byte [ecx - 0x46]
mul dword gs:[edx + 0x76b67a27]
mov al, byte [0x12697dfb]
mov byte [0x520e37e], al
jle 0x43afcc
and byte [0x1661daa0], al
xor byte [eax], ch
daa
jle 0x43afcc
and byte [0x1661daa0], al
xor byte [eax], ch
daa
aaa
or eax, 0x998d4176
jge 0x43afef
add al, 0x78
sbb dword [esi], ebp
fist dword [ecx - 0x37]
loope 0x43b01a
and cl, byte [edi - 0xd]
jns 0x43b05c
retf
shr byte [edx], cl
or edi, esp
call 0xff1adf3
add al, 0xc2
jmp 0x157f9277
adc eax, 0xc7e1f71b
xor esp, esi
sub eax, dword [edi + 0x2e]
xor eax, 0x5db16483
in al, 0xd7
ljmp 0x5e39
invalid