joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a0ef
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor esi, 0x7219
pop esi
xor eax, eax
mov word [ebp - 0x60], ax
xor ecx, ecx
mov word [ebp - 0x14], cx
push esi
push ebx
add esp, 4
jmp 0x40a01a
pop esi
push ecx
push esi
add esp, 4
and ecx, 0xa6a1
add ecx, 0x15529
pop ecx
push eax
xor eax, 0x16ae9
pop eax
push edx
push ebx
add esp, 4
or edx, 0xda1c
pop edx
mov edx, dword [ebp - 0x230]
mov ax, word [edx]
mov word [ebp - 0x1ca], ax
mov ecx, dword [ebp - 0x230]
add ecx, 2
mov dword [ebp - 0x230], ecx
mov dx, word [ebp - 0x1ca]
mov word [ebp - 0x60], dx
push esi
or esi, 0xc561
pop esi
push edx
add edx, 0x2ff2
pop edx
push edi
push ebx
add esp, 4
or edi, 0x28ad
jmp 0x40a08f
and edi, 0xb266
jmp 0x40a09c
pop edi
mov eax, dword [ebp - 0x234]
mov cx, word [eax]
mov word [ebp - 0x1cc], cx
mov edx, dword [ebp - 0x234]
add edx, 2
mov dword [ebp - 0x234], edx
mov ax, word [ebp - 0x1cc]
mov word [ebp - 0x14], ax
push ecx
push ebx
add esp, 4
sub ecx, 0xaf3d
or ecx, 0x8425
pop ecx
push edi
jmp 0x40a0e3
call 0x40a0ef
add byte [ebx], bh
inc esp
aaa
dec ebp
xor eax, 0x4c48340
add edi, 0x3c92
pop edi
movzx ecx, word [ebp - 0x14]
test ecx, ecx
jne 0x40a116
movzx edx, word [ebp - 0x60]
movzx eax, word [ebp - 0x14]
sub edx, eax
mov dword [ebp - 0x2f4], edx
jmp 0x40a199
movzx ecx, word [ebp - 0x60]
movzx edx, word [ebp - 0x14]
cmp ecx, edx
je 0x40a00f
movzx eax, word [ebp - 0x60]
xor eax, 0x20
movzx ecx, word [ebp - 0x14]
cmp eax, ecx
je 0x40a00f
push esi
jmp 0x40a143
jmp 0x40a14b
pop esi
push esi
push esi
add esp, 4
add esi, 0xc59a
sub esi, 0x14021
pop esi
push ecx
sub ecx, 0x109a7
jmp 0x40a16a
pop ecx
movzx edx, word [ebp - 0x60]
movzx eax, word [ebp - 0x14]
cmp edx, eax
jge 0x40a183
mov dword [ebp - 0x2f0], 0xffffffff
jmp 0x40a18d
mov dword [ebp - 0x2f0], 1
mov ecx, dword [ebp - 0x2f0]
mov dword [ebp - 0x2f4], ecx
cmp dword [ebp - 0x2f4], 0
jne 0x40a1e2
push edx
push ecx
add esp, 4
call 0x40a1b6
add byte [edi], dh
dec edi
inc ebp
xor cl, byte [edi + 0x32]
cmp dh, byte [ecx + edi]
add esp, 4
pop edx
push edx
or edx, 0x8618
call 0x40a1d0
add byte [esi], bh
inc ebp
cmp al, 0x34
inc esp
cmp byte [esp + esi + 0x3f], cl
add esp, 4
pop edx
mov edx, dword [ebp - 0xa0]
mov dword [ebp - 0x70], edx
jmp 0x40a279
mov eax, dword [ebp - 0xa0]
mov ecx, dword [eax]
mov dword [ebp - 0xa0], ecx
push edx
push ebx
add esp, 4
and edx, 0x131dd
pop edx
push edi
push esi
add esp, 4
call 0x40a20f
add byte [edi], bh
inc ebp
inc ebp
dec ecx
xor al, 0x4b
inc esp
dec edx
add esp, 4
call 0x40a21e
add byte [ecx], bh
xor al, 0x35
aas
dec eax
xor eax, dword [ebx - 0x74a0fb3c]
xchg ebp, eax
pushal
invalid
Function at 0x40a1b6
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor esi, 0x7219
pop esi
xor eax, eax
mov word [ebp - 0x60], ax
xor ecx, ecx
mov word [ebp - 0x14], cx
push esi
push ebx
add esp, 4
jmp 0x40a01a
pop esi
push ecx
push esi
add esp, 4
and ecx, 0xa6a1
add ecx, 0x15529
pop ecx
push eax
xor eax, 0x16ae9
pop eax
push edx
push ebx
add esp, 4
or edx, 0xda1c
pop edx
mov edx, dword [ebp - 0x230]
mov ax, word [edx]
mov word [ebp - 0x1ca], ax
mov ecx, dword [ebp - 0x230]
add ecx, 2
mov dword [ebp - 0x230], ecx
mov dx, word [ebp - 0x1ca]
mov word [ebp - 0x60], dx
push esi
or esi, 0xc561
pop esi
push edx
add edx, 0x2ff2
pop edx
push edi
push ebx
add esp, 4
or edi, 0x28ad
jmp 0x40a08f
and edi, 0xb266
jmp 0x40a09c
pop edi
mov eax, dword [ebp - 0x234]
mov cx, word [eax]
mov word [ebp - 0x1cc], cx
mov edx, dword [ebp - 0x234]
add edx, 2
mov dword [ebp - 0x234], edx
mov ax, word [ebp - 0x1cc]
mov word [ebp - 0x14], ax
push ecx
push ebx
add esp, 4
sub ecx, 0xaf3d
or ecx, 0x8425
pop ecx
push edi
jmp 0x40a0e3
call 0x40a0ef
add byte [ebx], bh
inc esp
aaa
dec ebp
xor eax, 0x4c48340
add edi, 0x3c92
pop edi
movzx ecx, word [ebp - 0x14]
test ecx, ecx
jne 0x40a116
movzx edx, word [ebp - 0x60]
movzx eax, word [ebp - 0x14]
sub edx, eax
mov dword [ebp - 0x2f4], edx
jmp 0x40a199
movzx ecx, word [ebp - 0x60]
movzx edx, word [ebp - 0x14]
cmp ecx, edx
je 0x40a00f
movzx eax, word [ebp - 0x60]
xor eax, 0x20
movzx ecx, word [ebp - 0x14]
cmp eax, ecx
je 0x40a00f
push esi
jmp 0x40a143
jmp 0x40a14b
pop esi
push esi
push esi
add esp, 4
add esi, 0xc59a
sub esi, 0x14021
pop esi
push ecx
sub ecx, 0x109a7
jmp 0x40a16a
pop ecx
movzx edx, word [ebp - 0x60]
movzx eax, word [ebp - 0x14]
cmp edx, eax
jge 0x40a183
mov dword [ebp - 0x2f0], 0xffffffff
jmp 0x40a18d
mov dword [ebp - 0x2f0], 1
mov ecx, dword [ebp - 0x2f0]
mov dword [ebp - 0x2f4], ecx
cmp dword [ebp - 0x2f4], 0
jne 0x40a1e2
push edx
push ecx
add esp, 4
call 0x40a1b6
add byte [edi], dh
dec edi
inc ebp
xor cl, byte [edi + 0x32]
cmp dh, byte [ecx + edi]
add esp, 4
pop edx
push edx
or edx, 0x8618
call 0x40a1d0
add byte [esi], bh
inc ebp
cmp al, 0x34
inc esp
cmp byte [esp + esi + 0x3f], cl
add esp, 4
pop edx
mov edx, dword [ebp - 0xa0]
mov dword [ebp - 0x70], edx
jmp 0x40a279
mov eax, dword [ebp - 0xa0]
mov ecx, dword [eax]
mov dword [ebp - 0xa0], ecx
push edx
push ebx
add esp, 4
and edx, 0x131dd
pop edx
push edi
push esi
add esp, 4
call 0x40a20f
add byte [edi], bh
inc ebp
inc ebp
dec ecx
xor al, 0x4b
inc esp
dec edx
add esp, 4
call 0x40a21e
add byte [ecx], bh
xor al, 0x35
aas
dec eax
xor eax, dword [ebx - 0x74a0fb3c]
xchg ebp, eax
pushal
invalid
Function at 0x40a1d0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor esi, 0x7219
pop esi
xor eax, eax
mov word [ebp - 0x60], ax
xor ecx, ecx
mov word [ebp - 0x14], cx
push esi
push ebx
add esp, 4
jmp 0x40a01a
pop esi
push ecx
push esi
add esp, 4
and ecx, 0xa6a1
add ecx, 0x15529
pop ecx
push eax
xor eax, 0x16ae9
pop eax
push edx
push ebx
add esp, 4
or edx, 0xda1c
pop edx
mov edx, dword [ebp - 0x230]
mov ax, word [edx]
mov word [ebp - 0x1ca], ax
mov ecx, dword [ebp - 0x230]
add ecx, 2
mov dword [ebp - 0x230], ecx
mov dx, word [ebp - 0x1ca]
mov word [ebp - 0x60], dx
push esi
or esi, 0xc561
pop esi
push edx
add edx, 0x2ff2
pop edx
push edi
push ebx
add esp, 4
or edi, 0x28ad
jmp 0x40a08f
and edi, 0xb266
jmp 0x40a09c
pop edi
mov eax, dword [ebp - 0x234]
mov cx, word [eax]
mov word [ebp - 0x1cc], cx
mov edx, dword [ebp - 0x234]
add edx, 2
mov dword [ebp - 0x234], edx
mov ax, word [ebp - 0x1cc]
mov word [ebp - 0x14], ax
push ecx
push ebx
add esp, 4
sub ecx, 0xaf3d
or ecx, 0x8425
pop ecx
push edi
jmp 0x40a0e3
call 0x40a0ef
add byte [ebx], bh
inc esp
aaa
dec ebp
xor eax, 0x4c48340
add edi, 0x3c92
pop edi
movzx ecx, word [ebp - 0x14]
test ecx, ecx
jne 0x40a116
movzx edx, word [ebp - 0x60]
movzx eax, word [ebp - 0x14]
sub edx, eax
mov dword [ebp - 0x2f4], edx
jmp 0x40a199
movzx ecx, word [ebp - 0x60]
movzx edx, word [ebp - 0x14]
cmp ecx, edx
je 0x40a00f
movzx eax, word [ebp - 0x60]
xor eax, 0x20
movzx ecx, word [ebp - 0x14]
cmp eax, ecx
je 0x40a00f
push esi
jmp 0x40a143
jmp 0x40a14b
pop esi
push esi
push esi
add esp, 4
add esi, 0xc59a
sub esi, 0x14021
pop esi
push ecx
sub ecx, 0x109a7
jmp 0x40a16a
pop ecx
movzx edx, word [ebp - 0x60]
movzx eax, word [ebp - 0x14]
cmp edx, eax
jge 0x40a183
mov dword [ebp - 0x2f0], 0xffffffff
jmp 0x40a18d
mov dword [ebp - 0x2f0], 1
mov ecx, dword [ebp - 0x2f0]
mov dword [ebp - 0x2f4], ecx
cmp dword [ebp - 0x2f4], 0
jne 0x40a1e2
push edx
push ecx
add esp, 4
call 0x40a1b6
add byte [edi], dh
dec edi
inc ebp
xor cl, byte [edi + 0x32]
cmp dh, byte [ecx + edi]
add esp, 4
pop edx
push edx
or edx, 0x8618
call 0x40a1d0
add byte [esi], bh
inc ebp
cmp al, 0x34
inc esp
cmp byte [esp + esi + 0x3f], cl
add esp, 4
pop edx
mov edx, dword [ebp - 0xa0]
mov dword [ebp - 0x70], edx
jmp 0x40a279
mov eax, dword [ebp - 0xa0]
mov ecx, dword [eax]
mov dword [ebp - 0xa0], ecx
push edx
push ebx
add esp, 4
and edx, 0x131dd
pop edx
push edi
push esi
add esp, 4
call 0x40a20f
add byte [edi], bh
inc ebp
inc ebp
dec ecx
xor al, 0x4b
inc esp
dec edx
add esp, 4
call 0x40a21e
add byte [ecx], bh
xor al, 0x35
aas
dec eax
xor eax, dword [ebx - 0x74a0fb3c]
xchg ebp, eax
pushal
invalid
Function at 0x40a20f
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor esi, 0x7219
pop esi
xor eax, eax
mov word [ebp - 0x60], ax
xor ecx, ecx
mov word [ebp - 0x14], cx
push esi
push ebx
add esp, 4
jmp 0x40a01a
pop esi
push ecx
push esi
add esp, 4
and ecx, 0xa6a1
add ecx, 0x15529
pop ecx
push eax
xor eax, 0x16ae9
pop eax
push edx
push ebx
add esp, 4
or edx, 0xda1c
pop edx
mov edx, dword [ebp - 0x230]
mov ax, word [edx]
mov word [ebp - 0x1ca], ax
mov ecx, dword [ebp - 0x230]
add ecx, 2
mov dword [ebp - 0x230], ecx
mov dx, word [ebp - 0x1ca]
mov word [ebp - 0x60], dx
push esi
or esi, 0xc561
pop esi
push edx
add edx, 0x2ff2
pop edx
push edi
push ebx
add esp, 4
or edi, 0x28ad
jmp 0x40a08f
and edi, 0xb266
jmp 0x40a09c
pop edi
mov eax, dword [ebp - 0x234]
mov cx, word [eax]
mov word [ebp - 0x1cc], cx
mov edx, dword [ebp - 0x234]
add edx, 2
mov dword [ebp - 0x234], edx
mov ax, word [ebp - 0x1cc]
mov word [ebp - 0x14], ax
push ecx
push ebx
add esp, 4
sub ecx, 0xaf3d
or ecx, 0x8425
pop ecx
push edi
jmp 0x40a0e3
call 0x40a0ef
add byte [ebx], bh
inc esp
aaa
dec ebp
xor eax, 0x4c48340
add edi, 0x3c92
pop edi
movzx ecx, word [ebp - 0x14]
test ecx, ecx
jne 0x40a116
movzx edx, word [ebp - 0x60]
movzx eax, word [ebp - 0x14]
sub edx, eax
mov dword [ebp - 0x2f4], edx
jmp 0x40a199
movzx ecx, word [ebp - 0x60]
movzx edx, word [ebp - 0x14]
cmp ecx, edx
je 0x40a00f
movzx eax, word [ebp - 0x60]
xor eax, 0x20
movzx ecx, word [ebp - 0x14]
cmp eax, ecx
je 0x40a00f
push esi
jmp 0x40a143
jmp 0x40a14b
pop esi
push esi
push esi
add esp, 4
add esi, 0xc59a
sub esi, 0x14021
pop esi
push ecx
sub ecx, 0x109a7
jmp 0x40a16a
pop ecx
movzx edx, word [ebp - 0x60]
movzx eax, word [ebp - 0x14]
cmp edx, eax
jge 0x40a183
mov dword [ebp - 0x2f0], 0xffffffff
jmp 0x40a18d
mov dword [ebp - 0x2f0], 1
mov ecx, dword [ebp - 0x2f0]
mov dword [ebp - 0x2f4], ecx
cmp dword [ebp - 0x2f4], 0
jne 0x40a1e2
push edx
push ecx
add esp, 4
call 0x40a1b6
add byte [edi], dh
dec edi
inc ebp
xor cl, byte [edi + 0x32]
cmp dh, byte [ecx + edi]
add esp, 4
pop edx
push edx
or edx, 0x8618
call 0x40a1d0
add byte [esi], bh
inc ebp
cmp al, 0x34
inc esp
cmp byte [esp + esi + 0x3f], cl
add esp, 4
pop edx
mov edx, dword [ebp - 0xa0]
mov dword [ebp - 0x70], edx
jmp 0x40a279
mov eax, dword [ebp - 0xa0]
mov ecx, dword [eax]
mov dword [ebp - 0xa0], ecx
push edx
push ebx
add esp, 4
and edx, 0x131dd
pop edx
push edi
push esi
add esp, 4
call 0x40a20f
add byte [edi], bh
inc ebp
inc ebp
dec ecx
xor al, 0x4b
inc esp
dec edx
add esp, 4
call 0x40a21e
add byte [ecx], bh
xor al, 0x35
aas
dec eax
xor eax, dword [ebx - 0x74a0fb3c]
xchg ebp, eax
pushal
invalid
Function at 0x40a21e
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor esi, 0x7219
pop esi
xor eax, eax
mov word [ebp - 0x60], ax
xor ecx, ecx
mov word [ebp - 0x14], cx
push esi
push ebx
add esp, 4
jmp 0x40a01a
pop esi
push ecx
push esi
add esp, 4
and ecx, 0xa6a1
add ecx, 0x15529
pop ecx
push eax
xor eax, 0x16ae9
pop eax
push edx
push ebx
add esp, 4
or edx, 0xda1c
pop edx
mov edx, dword [ebp - 0x230]
mov ax, word [edx]
mov word [ebp - 0x1ca], ax
mov ecx, dword [ebp - 0x230]
add ecx, 2
mov dword [ebp - 0x230], ecx
mov dx, word [ebp - 0x1ca]
mov word [ebp - 0x60], dx
push esi
or esi, 0xc561
pop esi
push edx
add edx, 0x2ff2
pop edx
push edi
push ebx
add esp, 4
or edi, 0x28ad
jmp 0x40a08f
and edi, 0xb266
jmp 0x40a09c
pop edi
mov eax, dword [ebp - 0x234]
mov cx, word [eax]
mov word [ebp - 0x1cc], cx
mov edx, dword [ebp - 0x234]
add edx, 2
mov dword [ebp - 0x234], edx
mov ax, word [ebp - 0x1cc]
mov word [ebp - 0x14], ax
push ecx
push ebx
add esp, 4
sub ecx, 0xaf3d
or ecx, 0x8425
pop ecx
push edi
jmp 0x40a0e3
call 0x40a0ef
add byte [ebx], bh
inc esp
aaa
dec ebp
xor eax, 0x4c48340
add edi, 0x3c92
pop edi
movzx ecx, word [ebp - 0x14]
test ecx, ecx
jne 0x40a116
movzx edx, word [ebp - 0x60]
movzx eax, word [ebp - 0x14]
sub edx, eax
mov dword [ebp - 0x2f4], edx
jmp 0x40a199
movzx ecx, word [ebp - 0x60]
movzx edx, word [ebp - 0x14]
cmp ecx, edx
je 0x40a00f
movzx eax, word [ebp - 0x60]
xor eax, 0x20
movzx ecx, word [ebp - 0x14]
cmp eax, ecx
je 0x40a00f
push esi
jmp 0x40a143
jmp 0x40a14b
pop esi
push esi
push esi
add esp, 4
add esi, 0xc59a
sub esi, 0x14021
pop esi
push ecx
sub ecx, 0x109a7
jmp 0x40a16a
pop ecx
movzx edx, word [ebp - 0x60]
movzx eax, word [ebp - 0x14]
cmp edx, eax
jge 0x40a183
mov dword [ebp - 0x2f0], 0xffffffff
jmp 0x40a18d
mov dword [ebp - 0x2f0], 1
mov ecx, dword [ebp - 0x2f0]
mov dword [ebp - 0x2f4], ecx
cmp dword [ebp - 0x2f4], 0
jne 0x40a1e2
push edx
push ecx
add esp, 4
call 0x40a1b6
add byte [edi], dh
dec edi
inc ebp
xor cl, byte [edi + 0x32]
cmp dh, byte [ecx + edi]
add esp, 4
pop edx
push edx
or edx, 0x8618
call 0x40a1d0
add byte [esi], bh
inc ebp
cmp al, 0x34
inc esp
cmp byte [esp + esi + 0x3f], cl
add esp, 4
pop edx
mov edx, dword [ebp - 0xa0]
mov dword [ebp - 0x70], edx
jmp 0x40a279
mov eax, dword [ebp - 0xa0]
mov ecx, dword [eax]
mov dword [ebp - 0xa0], ecx
push edx
push ebx
add esp, 4
and edx, 0x131dd
pop edx
push edi
push esi
add esp, 4
call 0x40a20f
add byte [edi], bh
inc ebp
inc ebp
dec ecx
xor al, 0x4b
inc esp
dec edx
add esp, 4
call 0x40a21e
add byte [ecx], bh
xor al, 0x35
aas
dec eax
xor eax, dword [ebx - 0x74a0fb3c]
xchg ebp, eax
pushal
invalid
Function at 0x40a7e9
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x40a7fb
add byte [edx + 0x3f], al
xor eax, 0x3e33443c
dec edx
add esp, 4
pop eax
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0xec], eax
jmp 0x40a8aa

Function at 0x40a7fb
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x40a7fb
add byte [edx + 0x3f], al
xor eax, 0x3e33443c
dec edx
add esp, 4
pop eax
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0xec], eax
jmp 0x40a8aa

Function at 0x40a84c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ebx
mov eax, dword [ebp - 0xa4]
cmp eax, dword [ebp - 0x244]
je 0x40a86e
mov ecx, dword [ebp - 0xa4]
cmp dword [ecx + 0x30], 0
jne 0x40a5af
push edx
push ecx
add esp, 4
add edx, 0xcbff
sub edx, 0x185a
jmp 0x40a885
call 0x40a894
add byte [edx + 0x40], cl
cmp dword [esi + 0x3b], eax
dec ecx
dec edx
cmp dword [eax - 0x7d], eax
les eax, [edx + ebx*2]
push esi
sub esi, 0xf4a9
pop esi
mov dword [ebp - 0xec], 0

Function at 0x40a894
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ebx
mov eax, dword [ebp - 0xa4]
cmp eax, dword [ebp - 0x244]
je 0x40a86e
mov ecx, dword [ebp - 0xa4]
cmp dword [ecx + 0x30], 0
jne 0x40a5af
push edx
push ecx
add esp, 4
add edx, 0xcbff
sub edx, 0x185a
jmp 0x40a885
call 0x40a894
add byte [edx + 0x40], cl
cmp dword [esi + 0x3b], eax
dec ecx
dec edx
cmp dword [eax - 0x7d], eax
les eax, [edx + ebx*2]
push esi
sub esi, 0xf4a9
pop esi
mov dword [ebp - 0xec], 0
Function at 0x40c6a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop edi
mov dword [ebp - 0xd0], 0
cmp dword [ebp - 0xd0], 0
jne 0x40c6f5
push ecx
push edi
add esp, 4
xor ecx, 0x14d8a
pop ecx
push eax
push ebx
add esp, 4
add eax, 0x167a7
or eax, 0x7e5
pop eax
push edx
xor edx, 0x5bd6
and edx, 0x3d
sub edx, 0x183e5
pop edx
mov dword [ebp - 0x1b8], 0
jmp 0x40d7bc
mov ecx, dword [ebp - 0xd0]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x7c], edx
mov dword [ebp - 0xe0], 0
push edx
push edi
add esp, 4
add edx, 0xa9b4
sub edx, 0x39ab
pop edx
push ebx
push ebx
add esp, 4
jmp 0x40c72b
add ebx, 0x106b2
jmp 0x40c736
add ebx, 0x16d89
pop ebx
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x344], eax
cmp dword [ebp - 0x344], 0
jne 0x40c792
push eax
push eax
add esp, 4
add eax, 0x9d3
add eax, 0xfb6c
add eax, 0x10c45
pop eax
push edi
add edi, 0x1813e
call 0x40c77d
add byte [ecx], bh
inc ecx
dec esp
inc ebp
aas
inc ecx
aaa
cmp eax, dword [ebx - 0x74a0fb3c]
lea esp, [eax]
invalid
mov edx, dword [ebp - 0x344]
mov eax, dword [ebp - 0x7c]
add eax, dword [edx + 0x3c]
invalid
invalid

Function at 0x40c730
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop edi
mov dword [ebp - 0xd0], 0
cmp dword [ebp - 0xd0], 0
jne 0x40c6f5
push ecx
push edi
add esp, 4
xor ecx, 0x14d8a
pop ecx
push eax
push ebx
add esp, 4
add eax, 0x167a7
or eax, 0x7e5
pop eax
push edx
xor edx, 0x5bd6
and edx, 0x3d
sub edx, 0x183e5
pop edx
mov dword [ebp - 0x1b8], 0
jmp 0x40d7bc
mov ecx, dword [ebp - 0xd0]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x7c], edx
mov dword [ebp - 0xe0], 0
push edx
push edi
add esp, 4
add edx, 0xa9b4
sub edx, 0x39ab
pop edx
push ebx
push ebx
add esp, 4
jmp 0x40c72b
add ebx, 0x106b2
jmp 0x40c736
add ebx, 0x16d89
pop ebx
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x344], eax
cmp dword [ebp - 0x344], 0
jne 0x40c792
push eax
push eax
add esp, 4
add eax, 0x9d3
add eax, 0xfb6c
add eax, 0x10c45
pop eax
push edi
add edi, 0x1813e
call 0x40c77d
add byte [ecx], bh
inc ecx
dec esp
inc ebp
aas
inc ecx
aaa
cmp eax, dword [ebx - 0x74a0fb3c]
lea esp, [eax]
invalid
mov edx, dword [ebp - 0x344]
mov eax, dword [ebp - 0x7c]
add eax, dword [edx + 0x3c]
invalid
invalid
Function at 0x40c77d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop edi
mov dword [ebp - 0xd0], 0
cmp dword [ebp - 0xd0], 0
jne 0x40c6f5
push ecx
push edi
add esp, 4
xor ecx, 0x14d8a
pop ecx
push eax
push ebx
add esp, 4
add eax, 0x167a7
or eax, 0x7e5
pop eax
push edx
xor edx, 0x5bd6
and edx, 0x3d
sub edx, 0x183e5
pop edx
mov dword [ebp - 0x1b8], 0
jmp 0x40d7bc
mov ecx, dword [ebp - 0xd0]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x7c], edx
mov dword [ebp - 0xe0], 0
push edx
push edi
add esp, 4
add edx, 0xa9b4
sub edx, 0x39ab
pop edx
push ebx
push ebx
add esp, 4
jmp 0x40c72b
add ebx, 0x106b2
jmp 0x40c736
add ebx, 0x16d89
pop ebx
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x344], eax
cmp dword [ebp - 0x344], 0
jne 0x40c792
push eax
push eax
add esp, 4
add eax, 0x9d3
add eax, 0xfb6c
add eax, 0x10c45
pop eax
push edi
add edi, 0x1813e
call 0x40c77d
add byte [ecx], bh
inc ecx
dec esp
inc ebp
aas
inc ecx
aaa
cmp eax, dword [ebx - 0x74a0fb3c]
lea esp, [eax]
invalid
mov edx, dword [ebp - 0x344]
mov eax, dword [ebp - 0x7c]
add eax, dword [edx + 0x3c]
invalid
invalid

Function at 0x40c7a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x75fffffc
adc dword [ebx - 0xdf73], ecx
dec dword [ecx - 0x8f73]
invalid

Function at 0x40c880
Capabilities:
Resolve function by parsing pe exports

Disassembly:
dec ebp
test byte [ebx], al
lea esi, [esp + edi*8 - 0x72760001]
sub al, 0xff
invalid

Function at 0x40ca90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
add byte [ebx - 0x41f03fab], cl
test byte [0xfffffe8c], dl

Function at 0x40cc30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
add esp, 4
add ecx, 0x1264c
add ecx, 0x155c
and ecx, 0xe654
xor ecx, 0x166ea
pop ecx
mov edx, dword [ebp - 0x458]
mov dword [ebp - 0x90], edx
jmp 0x40cc6c
Function at 0x40b2d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
outsb dx, byte [esi]
jne 0x40b2e0
mov al, byte [esi + 0x2c]
test al, al
je 0x40b3a1
add byte [eax], al
add byte [ebx - 0x3fccb7b2], cl
mov ecx, dword [esi + 0x48]
xor eax, eax
push ebx
push esp
stc
call dword [edi - 0x77]
inc ebp
cld
dec esi
inc ebp
or byte [edi], cl
test dword [eax + eax + 0x7e8b814f], ebx
cmp edi, eax
je 0xb5b378
mov ebx, dword [esi + 0x38]
cmp edi, 0xffffffff
jbe 0x40b311
and dword [esi - 1], 0xffffffeb
add dl, byte [edi - 0x39]
mov edx, dword [esi + 4]
lea ecx, [ebp - 0x7d]
push 0
push ecx
push eax
push ebx
and eax, 0xc0eb1599
clc
add byte [ebp - 0x74d08b40], al
inc ebp
ror byte [ebx + 0x4e8b5056], 1
rol dword [ebx], 1
rol byte [ebx - 0x7d4d42f], 1
add esp, ebp
mov dword [esi + 0x50], edx
test edi, edi
mov dword [esi + 0x54], ecx
ja 0x40b307
push edi
invalid
xor byte [ebp + 8], al
pop edi
mov dword [esi + 0x3c], 0xae0000
pop ebx
pop esi
mov ebx, dword [esi + 0x4c25d]
sahf
pop ebp
ret 4
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
call edi
test eax, eax
popfd
add eax, 0x4e08d589
or bh, bh
xlatb
add eax, 0xa9080
mov byte [ebp + 0x5a], 0x8b
inc ebp
cld
mov edx, dword [esi + 0x50]
shl byte [esi + 0x54], 3
ror byte [ebx - 0x6c764aa9], 1
push eax
adc ecx, 0
wait
push esi
mov esi, ecx
push esp
jne 0x40b395
mov dword [esi + 0x3c], 0x96de000f
mov ecx, dword [ebx + 0x5e5b5f08]
mov esp, ebp
pop ebp
ret 4
loopne 0x40b3c6
pop esi
mov esp, ebp
ret 0x5904
shr esp, 1
call dword [ebp + 1]

Function at 0x40b590
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
push ebx
jnp 0x40b594
dec dword [ebx + 0xb142444]
sar byte [ebp + 4], 0x71
invalid
mov eax, dword [esp + 0x14]
or eax, eax
jge 0x40b5a1
adc bh, dh
fdiv st(7)
fiadd dword [ebx + 0x448900d8]
and al, 0x14
Function at 0x1000633e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cdq
sub dh, al
inc ebp
lcall 0xc635, 0x9b45c633
inc ebp
pushfd
xor al, 0xc6
inc ebp
popfd
and dh, al
inc ebp
sahf
sub eax, 0x119f45c6
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.10005f7d
push eax
push esi
push dword [ebp + 8]
call fcn.10005f32
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.10005f7d
push eax
push esi
push dword [ebp + 8]
call fcn.10005f32
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.10005f6d
xchg ebx, eax
inc edi
jle 0x1000641b
invalid
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.10005f6d
cwde
jo 0x100064a0
jns 0x100063e3
inc ebp
test dword [edx - 0x3a], esi
inc ebp
xchg byte [ebx - 0x3a], ah
inc ebp
xchg dword [edx - 0x3a], edi
inc ebp
mov byte [ebx - 0x3a], dh
inc ebp
mov dword [esi - 0x3a], ebx
inc ebp
mov dh, byte [edi - 0x3a]
inc ebp
mov edi, dword [eax - 0x3a]
inc ebp
invalid
sbb byte [ebp - 0x837b], cl
call dword [eax - 0x18]
sbb al, 0xfb
invalid
or al, 0x66
cmp dword [edi + 6], ebx
mov dword [ebp + 0xc], ebx
jbe 0x100064dd
movzx eax, word [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
lea eax, [eax + eax*4]
push dword [ecx + eax*8 + 0x10]
lea eax, [ecx + eax*8]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add ecx, dword [ebp + 0x10]
add eax, esi
push ecx
push eax
call fcn.10005ede
add esp, 0xc
inc dword [ebp + 0xc]
mov ax, word [ebp + 0xc]
cmp ax, word [edi + 6]
jb 0x100064aa
call fcn.10005f6d
inc esp
retf