joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405cc0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push eax
push esi
add esp, 4
or eax, 0x6cfa
call 0x405c25
add byte [eax + 0x3f], dl
cmp ecx, dword [esi + 0x3f]
inc ecx
inc ecx
add esp, 4
pop eax
push edi
jmp 0x405c30
and edi, 0x95bb
pop edi
push ecx
and ecx, 0x231
pop ecx
mov ecx, dword [ebp - 0xc9c]
mov dx, word [ecx]
mov word [ebp - 0x1036], dx
mov eax, dword [ebp - 0xc9c]
add eax, 2
mov dword [ebp - 0xc9c], eax
mov cx, word [ebp - 0x1036]
mov word [ebp - 0x214], cx
mov edx, dword [ebp - 0xca0]
mov ax, word [edx]
mov word [ebp - 0x1038], ax
mov ecx, dword [ebp - 0xca0]
invalid
inc dword [ebx - 0x7276fd3f]
pushal
invalid
invalid
jmp dword [esi - 0x75]
xchg ebp, eax
enter 0xffffffffffffffef, 0xffffffffffffffff
mov word [ebp - 0x110], dx
push ecx
push ecx
add esp, 4
sub ecx, 0x165aa
jmp 0x405cac
call 0x405cbb
add byte [ebx], bh
dec eax
cmp dword [eax + 0x4c], eax
inc eax
inc esi
xor eax, 0x5904c483
push esi
push edx
add esp, 4
and esi, 0xb65e
pop esi
movzx eax, word [ebp - 0x110]
test eax, eax
jne 0x405cee
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
sub ecx, edx
mov dword [ebp - 0x15ec], ecx
jmp 0x405d51
movzx eax, word [ebp - 0x214]
movzx ecx, word [ebp - 0x110]
cmp eax, ecx
je 0x405c0d
movzx edx, word [ebp - 0x214]
xor edx, 0x20
movzx eax, word [ebp - 0x110]
test eax, esi
invalid
invalid
invalid
cmp edx, eax
je 0x405c0d
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
cmp ecx, edx
jge 0x405d3b
mov dword [ebp - 0x15e8], 0xffffffff
jmp 0x405d45
mov dword [ebp - 0x15e8], 1
mov eax, dword [ebp - 0x15e8]
mov dword [ebp - 0x15ec], eax
cmp dword [ebp - 0x15ec], 0
jne 0x405d9a
push esi
jmp 0x405d62
sub esi, 0x6fe7
or esi, 0xc4b7
add esi, 0x1cae
pop esi
push ebx
push esi
add esp, 4
jmp 0x405d7f
pop ebx
push edx
push ebx
add esp, 4
xor edx, 0x15d18
pop edx
push edx
call 0x405db5
add byte [esi + 0x43], cl
dec ebx
xor al, 0x36
cmp eax, 0xc4833a4b
add al, 0xeb
add eax, 0x35374b35
cmp byte [edx + 0x51], bl
push edx
add esp, 4
or ecx, 0x289f
pop ecx
mov edx, dword [ebp - 0x508]
mov eax, dword [edx]
mov dword [ebp - 0x508], eax
mov ecx, dword [ebp - 0x508]
cmp ecx, dword [ebp - 0xca4]
je 0x405df8
mov edx, dword [ebp - 0x508]
cmp dword [edx + 0x30], 0
jne 0x405bae
mov dword [ebp - 0x750], 0

Function at 0x405d80
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
add esp, 4
xor ebx, 0x7a0f
pop ebx
mov ecx, dword [ebp - 0x508]
mov dword [ebp - 0x750], ecx
jmp 0x405e02
push esi
push edi
add esp, 4
add esi, 0x10e21
sub esi, 0xb76e
call fcn.00405e22
add byte [eax + 0x46], dl
dec esp
xor edi, dword [esi]
cmp bh, byte [ecx]
Function at 0x405db5
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push eax
push esi
add esp, 4
or eax, 0x6cfa
call 0x405c25
add byte [eax + 0x3f], dl
cmp ecx, dword [esi + 0x3f]
inc ecx
inc ecx
add esp, 4
pop eax
push edi
jmp 0x405c30
and edi, 0x95bb
pop edi
push ecx
and ecx, 0x231
pop ecx
mov ecx, dword [ebp - 0xc9c]
mov dx, word [ecx]
mov word [ebp - 0x1036], dx
mov eax, dword [ebp - 0xc9c]
add eax, 2
mov dword [ebp - 0xc9c], eax
mov cx, word [ebp - 0x1036]
mov word [ebp - 0x214], cx
mov edx, dword [ebp - 0xca0]
mov ax, word [edx]
mov word [ebp - 0x1038], ax
mov ecx, dword [ebp - 0xca0]
invalid
inc dword [ebx - 0x7276fd3f]
pushal
invalid
invalid
jmp dword [esi - 0x75]
xchg ebp, eax
enter 0xffffffffffffffef, 0xffffffffffffffff
mov word [ebp - 0x110], dx
push ecx
push ecx
add esp, 4
sub ecx, 0x165aa
jmp 0x405cac
call 0x405cbb
add byte [ebx], bh
dec eax
cmp dword [eax + 0x4c], eax
inc eax
inc esi
xor eax, 0x5904c483
push esi
push edx
add esp, 4
and esi, 0xb65e
pop esi
movzx eax, word [ebp - 0x110]
test eax, eax
jne 0x405cee
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
sub ecx, edx
mov dword [ebp - 0x15ec], ecx
jmp 0x405d51
movzx eax, word [ebp - 0x214]
movzx ecx, word [ebp - 0x110]
cmp eax, ecx
je 0x405c0d
movzx edx, word [ebp - 0x214]
xor edx, 0x20
movzx eax, word [ebp - 0x110]
test eax, esi
invalid
invalid
invalid
cmp edx, eax
je 0x405c0d
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
cmp ecx, edx
jge 0x405d3b
mov dword [ebp - 0x15e8], 0xffffffff
jmp 0x405d45
mov dword [ebp - 0x15e8], 1
mov eax, dword [ebp - 0x15e8]
mov dword [ebp - 0x15ec], eax
cmp dword [ebp - 0x15ec], 0
jne 0x405d9a
push esi
jmp 0x405d62
sub esi, 0x6fe7
or esi, 0xc4b7
add esi, 0x1cae
pop esi
push ebx
push esi
add esp, 4
jmp 0x405d7f
pop ebx
push edx
push ebx
add esp, 4
xor edx, 0x15d18
pop edx
push edx
call 0x405db5
add byte [esi + 0x43], cl
dec ebx
xor al, 0x36
cmp eax, 0xc4833a4b
add al, 0xeb
add eax, 0x35374b35
cmp byte [edx + 0x51], bl
push edx
add esp, 4
or ecx, 0x289f
pop ecx
mov edx, dword [ebp - 0x508]
mov eax, dword [edx]
mov dword [ebp - 0x508], eax
mov ecx, dword [ebp - 0x508]
cmp ecx, dword [ebp - 0xca4]
je 0x405df8
mov edx, dword [ebp - 0x508]
cmp dword [edx + 0x30], 0
jne 0x405bae
mov dword [ebp - 0x750], 0
Function at 0x4068b4
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x768]
add edx, 1
mov dword [ebp - 0x768], edx
mov eax, dword [ebp - 0x764]
mov ecx, dword [ebp - 0x768]
cmp ecx, dword [eax + 0x18]
jae 0x40698d
mov edx, dword [ebp - 0x768]
mov eax, dword [ebp - 0x1984]
mov ecx, dword [ebp - 0x324]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x76c], ecx
mov edx, dword [ebp - 0x768]
mov eax, dword [ebp - 0x1988]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x1d10]
mov eax, dword [ebp - 0x324]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x198c], eax
mov dword [ebp - 0x19c], 0
jmp 0x4067f1
mov ecx, dword [ebp - 0x19c]
add ecx, 1
mov dword [ebp - 0x19c], ecx
mov edx, dword [ebp - 0x76c]
add edx, dword [ebp - 0x19c]
movsx eax, byte [edx]
test eax, eax
je 0x4068a3
mov ecx, dword [ebp - 0x19c]
movsx edx, byte [ebp + ecx - 0x878]
test edx, edx
je 0x4068a3
push esi
push ebx
add esp, 4
or esi, 0x9029
pop esi
push ebx
push ebx
add esp, 4
xor ebx, 0x17632
and ebx, 0x15004
and ebx, 0x6103
pop ebx
push esi
sub esi, 0x3036
add esi, 0xf38b
pop esi
mov eax, dword [ebp - 0x76c]
add eax, dword [ebp - 0x19c]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x19c]
movsx eax, byte [ebp + edx - 0x878]
cmp ecx, eax
je 0x406895
mov ecx, dword [ebp - 0x76c]
add ecx, dword [ebp - 0x19c]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x19c]
movsx ecx, byte [ebp + eax - 0x878]
cmp edx, ecx
jne 0x40689c
jmp 0x4067e2
jmp 0x4068a3
push ebx
call fcn.004068b4
add byte [esi + 0x41], cl
cmp esi, dword [esp + eax*2]
dec edx
inc esp
dec esi
push eax
cmp al, byte [ebx + 0x9e804c4]
add esp, 4
call 0x4068c5
add byte [edi + 0x33], al
cmp eax, 0x4d354d4e
add esp, 4
call 0x4068c5
add byte [edi + 0x33], al
cmp eax, 0x4d354d4e
dec eax
add esp, 4
xor ebx, 0x5535
sub ebx, 0x105f
pop ebx
mov edx, dword [ebp - 0x76c]
add edx, dword [ebp - 0x19c]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x19c]
movsx edx, byte [ebp + ecx - 0x878]
cmp eax, edx
jne 0x406902
mov dword [ebp - 0xcb8], 0
jmp 0x406971
push edx
push esi
add esp, 4
sub edx, 0xbaed
or edx, 0xcaff
pop edx
push esi
sub esi, 0x1728
pop esi
push esi
push ebx
add esp, 4
sub esi, 0x11aa0
and esi, 0x12604
and esi, 0xeb7c
pop esi
mov eax, dword [ebp - 0x76c]
add eax, dword [ebp - 0x19c]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x19c]
movsx eax, byte [ebp + edx - 0x878]
or eax, 0x20
cmp ecx, eax
jge 0x406967
mov dword [ebp - 0xcb8], 0xffffffff
jmp 0x406971
mov dword [ebp - 0xcb8], 1
cmp dword [ebp - 0xcb8], 0
jne 0x406988
mov ecx, dword [ebp - 0x198c]
mov dword [ebp - 0x510], ecx
jmp 0x406999
jmp 0x406772
mov edx, dword [ebp - 0x770]
mov dword [ebp - 0x510], edx
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0x79c], eax
Function at 0x4068c5
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x768]
add edx, 1
mov dword [ebp - 0x768], edx
mov eax, dword [ebp - 0x764]
mov ecx, dword [ebp - 0x768]
cmp ecx, dword [eax + 0x18]
jae 0x40698d
mov edx, dword [ebp - 0x768]
mov eax, dword [ebp - 0x1984]
mov ecx, dword [ebp - 0x324]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x76c], ecx
mov edx, dword [ebp - 0x768]
mov eax, dword [ebp - 0x1988]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x1d10]
mov eax, dword [ebp - 0x324]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x198c], eax
mov dword [ebp - 0x19c], 0
jmp 0x4067f1
mov ecx, dword [ebp - 0x19c]
add ecx, 1
mov dword [ebp - 0x19c], ecx
mov edx, dword [ebp - 0x76c]
add edx, dword [ebp - 0x19c]
movsx eax, byte [edx]
test eax, eax
je 0x4068a3
mov ecx, dword [ebp - 0x19c]
movsx edx, byte [ebp + ecx - 0x878]
test edx, edx
je 0x4068a3
push esi
push ebx
add esp, 4
or esi, 0x9029
pop esi
push ebx
push ebx
add esp, 4
xor ebx, 0x17632
and ebx, 0x15004
and ebx, 0x6103
pop ebx
push esi
sub esi, 0x3036
add esi, 0xf38b
pop esi
mov eax, dword [ebp - 0x76c]
add eax, dword [ebp - 0x19c]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x19c]
movsx eax, byte [ebp + edx - 0x878]
cmp ecx, eax
je 0x406895
mov ecx, dword [ebp - 0x76c]
add ecx, dword [ebp - 0x19c]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x19c]
movsx ecx, byte [ebp + eax - 0x878]
cmp edx, ecx
jne 0x40689c
jmp 0x4067e2
jmp 0x4068a3
push ebx
call fcn.004068b4
add byte [esi + 0x41], cl
cmp esi, dword [esp + eax*2]
dec edx
inc esp
dec esi
push eax
cmp al, byte [ebx + 0x9e804c4]
add esp, 4
call 0x4068c5
add byte [edi + 0x33], al
cmp eax, 0x4d354d4e
add esp, 4
call 0x4068c5
add byte [edi + 0x33], al
cmp eax, 0x4d354d4e
dec eax
add esp, 4
xor ebx, 0x5535
sub ebx, 0x105f
pop ebx
mov edx, dword [ebp - 0x76c]
add edx, dword [ebp - 0x19c]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x19c]
movsx edx, byte [ebp + ecx - 0x878]
cmp eax, edx
jne 0x406902
mov dword [ebp - 0xcb8], 0
jmp 0x406971
push edx
push esi
add esp, 4
sub edx, 0xbaed
or edx, 0xcaff
pop edx
push esi
sub esi, 0x1728
pop esi
push esi
push ebx
add esp, 4
sub esi, 0x11aa0
and esi, 0x12604
and esi, 0xeb7c
pop esi
mov eax, dword [ebp - 0x76c]
add eax, dword [ebp - 0x19c]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x19c]
movsx eax, byte [ebp + edx - 0x878]
or eax, 0x20
cmp ecx, eax
jge 0x406967
mov dword [ebp - 0xcb8], 0xffffffff
jmp 0x406971
mov dword [ebp - 0xcb8], 1
cmp dword [ebp - 0xcb8], 0
jne 0x406988
mov ecx, dword [ebp - 0x198c]
mov dword [ebp - 0x510], ecx
jmp 0x406999
jmp 0x406772
mov edx, dword [ebp - 0x770]
mov dword [ebp - 0x510], edx
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0x79c], eax
Function at 0x406cab
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ecx
push edi
add esp, 4
jmp 0x406c8a
pop ecx
push edx
push eax
add esp, 4
sub edx, 0x109a1
or edx, 0x623c
call fcn.00406cab
add byte [ebx + 0x4d], al
inc eax
cmp byte [ebp + 0x4c], al
dec esp
dec ebx
add esp, 4
pop edx
lea edx, [ebp - 0x1738]
mov dword [ebp - 0xcc0], edx
mov eax, dword [ebp - 0x514]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcbc], ecx
xor edx, edx
mov word [ebp - 0x21c], dx
xor eax, eax
mov word [ebp - 0x38], ax
push ecx
or ecx, 0x184f3
sub ecx, 0xa32c
xor ecx, 0x14e9b
pop ecx
push ebx
push eax
add esp, 4
add ebx, 0xf940
and ebx, 0x7cb4
add ebx, 0x123c8
xor ebx, 0xb70
pop ebx
mov ecx, dword [ebp - 0xcbc]
mov dx, word [ecx]
mov word [ebp - 0x103e], dx
mov eax, dword [ebp - 0xcbc]
add eax, 2
mov dword [ebp - 0xcbc], eax
mov cx, word [ebp - 0x103e]
mov word [ebp - 0x21c], cx
mov edx, dword [ebp - 0xcc0]
mov ax, word [edx]
mov word [ebp - 0x1040], ax
mov ecx, dword [ebp - 0xcc0]
add ecx, 2
mov dword [ebp - 0xcc0], ecx
mov dx, word [ebp - 0x1040]
mov word [ebp - 0x38], dx
push edx
sub edx, 0x3f7f
call 0x406d78
add byte [esi], dh
inc edi
inc edi
dec ecx
cmp dword [ecx + 0x37], ecx
xor eax, 0x4c48336
xor edx, 0x178a7
add edx, 0x3c34
pop edx
push ecx
push edi
add esp, 4
xor ecx, 0x13ffe
pop ecx
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x406db1
movzx ecx, word [ebp - 0x21c]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x161c], ecx
jmp 0x406e0b
movzx eax, word [ebp - 0x21c]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x406cd9
movzx edx, word [ebp - 0x21c]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x406cd9
movzx ecx, word [ebp - 0x21c]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x406df5
mov dword [ebp - 0x1618], 0xffffffff
jmp 0x406dff
mov dword [ebp - 0x1618], 1
mov eax, dword [ebp - 0x1618]
mov dword [ebp - 0x161c], eax
cmp dword [ebp - 0x161c], 0
jne 0x406e54
push eax
jmp 0x406e1b
and eax, 0x120e1
pop eax
push esi
call 0x406e31
add byte [edi], bh
dec edi
xor bh, byte [edx]
dec ebx
dec ecx
inc edx
add esp, 4
pop esi
push esi
push esi
add esp, 4
jmp 0x406e3f
add esi, 0xec7e
pop esi
mov ecx, dword [ebp - 0x514]
mov dword [ebp - 0x2fc], ecx
jmp 0x406ebc
push ecx
push ecx
add esp, 4
jmp 0x406e61
xor ecx, 0x99ff
or ecx, 0x5416
xor ecx, 0x219f
pop ecx
push ecx
push edi
add esp, 4
sub ecx, 0x501d
or ecx, 0x67e7
pop ecx
mov edx, dword [ebp - 0x514]
mov eax, dword [edx]
mov dword [ebp - 0x514], eax
mov ecx, dword [ebp - 0x514]
cmp ecx, dword [ebp - 0xcc4]
je 0x406eb2
mov edx, dword [ebp - 0x514]
cmp dword [edx + 0x30], 0
jne 0x406c7d
mov dword [ebp - 0x2fc], 0
Function at 0x406d78
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ecx
push edi
add esp, 4
jmp 0x406c8a
pop ecx
push edx
push eax
add esp, 4
sub edx, 0x109a1
or edx, 0x623c
call fcn.00406cab
add byte [ebx + 0x4d], al
inc eax
cmp byte [ebp + 0x4c], al
dec esp
dec ebx
add esp, 4
pop edx
lea edx, [ebp - 0x1738]
mov dword [ebp - 0xcc0], edx
mov eax, dword [ebp - 0x514]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcbc], ecx
xor edx, edx
mov word [ebp - 0x21c], dx
xor eax, eax
mov word [ebp - 0x38], ax
push ecx
or ecx, 0x184f3
sub ecx, 0xa32c
xor ecx, 0x14e9b
pop ecx
push ebx
push eax
add esp, 4
add ebx, 0xf940
and ebx, 0x7cb4
add ebx, 0x123c8
xor ebx, 0xb70
pop ebx
mov ecx, dword [ebp - 0xcbc]
mov dx, word [ecx]
mov word [ebp - 0x103e], dx
mov eax, dword [ebp - 0xcbc]
add eax, 2
mov dword [ebp - 0xcbc], eax
mov cx, word [ebp - 0x103e]
mov word [ebp - 0x21c], cx
mov edx, dword [ebp - 0xcc0]
mov ax, word [edx]
mov word [ebp - 0x1040], ax
mov ecx, dword [ebp - 0xcc0]
add ecx, 2
mov dword [ebp - 0xcc0], ecx
mov dx, word [ebp - 0x1040]
mov word [ebp - 0x38], dx
push edx
sub edx, 0x3f7f
call 0x406d78
add byte [esi], dh
inc edi
inc edi
dec ecx
cmp dword [ecx + 0x37], ecx
xor eax, 0x4c48336
xor edx, 0x178a7
add edx, 0x3c34
pop edx
push ecx
push edi
add esp, 4
xor ecx, 0x13ffe
pop ecx
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x406db1
movzx ecx, word [ebp - 0x21c]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x161c], ecx
jmp 0x406e0b
movzx eax, word [ebp - 0x21c]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x406cd9
movzx edx, word [ebp - 0x21c]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x406cd9
movzx ecx, word [ebp - 0x21c]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x406df5
mov dword [ebp - 0x1618], 0xffffffff
jmp 0x406dff
mov dword [ebp - 0x1618], 1
mov eax, dword [ebp - 0x1618]
mov dword [ebp - 0x161c], eax
cmp dword [ebp - 0x161c], 0
jne 0x406e54
push eax
jmp 0x406e1b
and eax, 0x120e1
pop eax
push esi
call 0x406e31
add byte [edi], bh
dec edi
xor bh, byte [edx]
dec ebx
dec ecx
inc edx
add esp, 4
pop esi
push esi
push esi
add esp, 4
jmp 0x406e3f
add esi, 0xec7e
pop esi
mov ecx, dword [ebp - 0x514]
mov dword [ebp - 0x2fc], ecx
jmp 0x406ebc
push ecx
push ecx
add esp, 4
jmp 0x406e61
xor ecx, 0x99ff
or ecx, 0x5416
xor ecx, 0x219f
pop ecx
push ecx
push edi
add esp, 4
sub ecx, 0x501d
or ecx, 0x67e7
pop ecx
mov edx, dword [ebp - 0x514]
mov eax, dword [edx]
mov dword [ebp - 0x514], eax
mov ecx, dword [ebp - 0x514]
cmp ecx, dword [ebp - 0xcc4]
je 0x406eb2
mov edx, dword [ebp - 0x514]
cmp dword [edx + 0x30], 0
jne 0x406c7d
mov dword [ebp - 0x2fc], 0
Function at 0x406e31
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ecx
push edi
add esp, 4
jmp 0x406c8a
pop ecx
push edx
push eax
add esp, 4
sub edx, 0x109a1
or edx, 0x623c
call fcn.00406cab
add byte [ebx + 0x4d], al
inc eax
cmp byte [ebp + 0x4c], al
dec esp
dec ebx
add esp, 4
pop edx
lea edx, [ebp - 0x1738]
mov dword [ebp - 0xcc0], edx
mov eax, dword [ebp - 0x514]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcbc], ecx
xor edx, edx
mov word [ebp - 0x21c], dx
xor eax, eax
mov word [ebp - 0x38], ax
push ecx
or ecx, 0x184f3
sub ecx, 0xa32c
xor ecx, 0x14e9b
pop ecx
push ebx
push eax
add esp, 4
add ebx, 0xf940
and ebx, 0x7cb4
add ebx, 0x123c8
xor ebx, 0xb70
pop ebx
mov ecx, dword [ebp - 0xcbc]
mov dx, word [ecx]
mov word [ebp - 0x103e], dx
mov eax, dword [ebp - 0xcbc]
add eax, 2
mov dword [ebp - 0xcbc], eax
mov cx, word [ebp - 0x103e]
mov word [ebp - 0x21c], cx
mov edx, dword [ebp - 0xcc0]
mov ax, word [edx]
mov word [ebp - 0x1040], ax
mov ecx, dword [ebp - 0xcc0]
add ecx, 2
mov dword [ebp - 0xcc0], ecx
mov dx, word [ebp - 0x1040]
mov word [ebp - 0x38], dx
push edx
sub edx, 0x3f7f
call 0x406d78
add byte [esi], dh
inc edi
inc edi
dec ecx
cmp dword [ecx + 0x37], ecx
xor eax, 0x4c48336
xor edx, 0x178a7
add edx, 0x3c34
pop edx
push ecx
push edi
add esp, 4
xor ecx, 0x13ffe
pop ecx
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x406db1
movzx ecx, word [ebp - 0x21c]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x161c], ecx
jmp 0x406e0b
movzx eax, word [ebp - 0x21c]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x406cd9
movzx edx, word [ebp - 0x21c]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x406cd9
movzx ecx, word [ebp - 0x21c]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x406df5
mov dword [ebp - 0x1618], 0xffffffff
jmp 0x406dff
mov dword [ebp - 0x1618], 1
mov eax, dword [ebp - 0x1618]
mov dword [ebp - 0x161c], eax
cmp dword [ebp - 0x161c], 0
jne 0x406e54
push eax
jmp 0x406e1b
and eax, 0x120e1
pop eax
push esi
call 0x406e31
add byte [edi], bh
dec edi
xor bh, byte [edx]
dec ebx
dec ecx
inc edx
add esp, 4
pop esi
push esi
push esi
add esp, 4
jmp 0x406e3f
add esi, 0xec7e
pop esi
mov ecx, dword [ebp - 0x514]
mov dword [ebp - 0x2fc], ecx
jmp 0x406ebc
push ecx
push ecx
add esp, 4
jmp 0x406e61
xor ecx, 0x99ff
or ecx, 0x5416
xor ecx, 0x219f
pop ecx
push ecx
push edi
add esp, 4
sub ecx, 0x501d
or ecx, 0x67e7
pop ecx
mov edx, dword [ebp - 0x514]
mov eax, dword [edx]
mov dword [ebp - 0x514], eax
mov ecx, dword [ebp - 0x514]
cmp ecx, dword [ebp - 0xcc4]
je 0x406eb2
mov edx, dword [ebp - 0x514]
cmp dword [edx + 0x30], 0
jne 0x406c7d
mov dword [ebp - 0x2fc], 0
Function at 0x428d00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.0043379d
push 5
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x428d37
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.00428d58
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x42b51c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x42b52e
add ecx, 0xc
pop ebp
jmp fcn.00405d10
call fcn.00424fca
int3

Function at 0x42e39c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x42e3e1
call fcn.0043379d
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x42e3e1
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x42e3fd
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00433cd3
mov ebx, eax
test edi, edi
je 0x42e3fb
test esi, esi
je 0x42e3fb
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4524fb
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.00464dff
call fcn.004337f1
cmp dword [eax + 0x14], 0
jne 0x452516
mov ecx, esi
pop esi
jmp fcn.004518fc
pop esi
ret

Function at 0x457879
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
jne 0x457891
add ecx, 0x778
call fcn.00402380
pop ebp
ret 4
add ecx, 0x778
pop ebp
jmp fcn.00405d10

Function at 0x45789d
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x4578b2
add ecx, 0x77c
pop ebp
jmp fcn.00405d10
call fcn.00424fca
int3

Function at 0x45998e
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x4599a3
add ecx, 0x84
pop ebp
jmp fcn.00405d10
add ecx, 0x84
call fcn.00402380
pop ebp
ret 4

Function at 0x45fd5c
Capabilities:
Get common file path
Get file system object information

Disassembly:
push esi
mov esi, ecx
call fcn.004bce91
call fcn.004337f1
cmp dword [eax + 0x14], 0
jne 0x45fd77
mov ecx, esi
pop esi
jmp fcn.0045f645
pop esi
ret
Function at 0x4f129d
Capabilities:
Get file system object information

Disassembly:
push 0x4c8
mov eax, 0x573741
call fcn.0054d354
mov ebx, ecx
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.004028a0
pop ecx
lea esi, [eax + 0x10]
mov dword [ebp - 0x4d0], esi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x4d0]
push 0
push 0x57a7d8
call fcn.004264cc
cmp eax, 0xffffffff
jne 0x4f1351
push 0
push 0x5842f8
lea ecx, [ebp - 0x4d0]
call fcn.004264cc
cmp eax, 0xffffffff
jne 0x4f1351
push 0
push 0x57a5bc
lea ecx, [ebp - 0x4d0]
call fcn.004264cc
cmp eax, 0xffffffff
jne 0x4f1351
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.004028a0
pop ecx
lea edi, [eax + 0x10]
mov dword [ebp - 0x4d4], edi
xor ecx, ecx
mov byte [ebp - 4], 1
push ecx
lea eax, [ebp - 0x218]
push eax
push 0x104
push ecx
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x4f132d
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x14]
lea ecx, [edi - 0x10]
mov ebx, eax
call fcn.00402b20
jmp 0x4f1380
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x4d0]
call fcn.00405d10
lea ecx, [edi - 0x10]
mov byte [ebp - 4], 0
call fcn.00402b20
mov esi, dword [ebp - 0x4d0]
push 0x105
push 0x2b4
lea eax, [ebp - 0x4cc]
push eax
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x4f1377
mov ebx, dword [ebp - 0x4cc]
jmp 0x4f1380
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x14]
mov ebx, eax
lea ecx, [esi - 0x10]
call fcn.00402b20
mov eax, ebx
call fcn.0054d303
ret

Function at 0x53da2a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x53da3f
add ecx, 0x500
pop ebp
jmp fcn.00405d10
call fcn.00424fca
int3