joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3be35ce
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, 0x5a4d
push ebx
push esi
mov esi, edx
push edi
mov edi, ecx
cmp word [esi], ax
jne 0x3be3731
mov ebx, dword [esi + 0x3c]
add ebx, esi
cmp dword [ebx], 0x4550
jne 0x3be3731
mov eax, dword [edi + 0x684]
test eax, eax
je 0x3be3731
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 8]
push ecx
push 0xffffffffffffffff
call eax
test eax, eax
je 0x3be3731
mov eax, 0x1c0
cmp word [ebp - 4], ax
je 0x3be3636
mov eax, 0xaa64
cmp word [ebp - 4], ax
jne 0x3be3731
cmp dword [ebx + 8], 0x27debf2c
jne 0x3be3661
push 0x4b2e8f83
push 0x4b2e8de3
push 0x4b280000
mov edx, esi
mov ecx, edi
call fcn.03be3548
add esp, 0xc
xor eax, eax
jmp 0x3be3736
cmp dword [ebx + 8], 0x88330560
jne 0x3be3676
push 0x4b3fabde
push 0x4b3fa92b
jmp 0x3be3649
cmp dword [ebx + 8], 0xe892dd44
jne 0x3be368b
push 0x4b406b8e
push 0x4b4068db
jmp 0x3be3649
and dword [ebp - 0xc], 0
lea edx, [ebp - 0xc]
push 0
push 1
push ecx
push 0x2bcd03a7
push esi
mov ecx, edi
call fcn.03be3fd9
test eax, eax
js 0x3be3736
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x3be3731
lea eax, [ebx - 0x140]
mov dword [ebp - 0x1c], 0x3f3f3fe8
push 8
lea ecx, [ebp - 0x1c]
mov word [ebp - 0x18], 0x843f
push ecx
mov edx, 0x140
mov byte [ebp - 0x16], 0xc0
mov ecx, eax
mov dword [ebp - 0x24], 0x1b8
mov word [ebp - 0x20], 0x8400
mov byte [ebp - 0x1e], 0xc0
mov dword [ebp - 0x10], eax
call fcn.03be4571
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x3be3701
mov ecx, dword [ebp - 0x10]
mov edx, 0x140
jmp 0x3be371e
push 7
lea eax, [ebp - 0x1c]
mov edx, 0x200
push eax
mov ecx, ebx
call fcn.03be4571
test eax, eax
jne 0x3be373b
mov edx, 0x200
mov ecx, ebx
push 8
lea eax, [ebp - 0x24]
push eax
call fcn.03be4571
test eax, eax
jne 0x3be365a
mov eax, 0xe0010001
pop edi
pop esi
pop ebx
leave
ret
push eax
push dword [ebp - 0x14]
push esi
jmp 0x3be364e

Function at 0x3be43f9
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x3be4417
mov eax, dword [ecx + 0x3c]
cmp eax, 0x400
jg 0x3be4417
add eax, ecx
cmp dword [eax], 0x4550
je 0x3be4419
xor eax, eax
ret
Function at 0x3be77e0
Capabilities:
Encode data using xor
Manually build aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov edx, 1
push ebx
push esi
push edi
xor esi, esi
mov eax, edx
mov dword [ebp + esi*4 - 0x808], edx
and al, 0x80
mov dword [ebp + edx*4 - 0x408], esi
movzx ecx, al
lea eax, [edx + edx]
neg ecx
sbb ecx, ecx
inc esi
and ecx, 0x1b
xor ecx, eax
xor ecx, edx
movzx edx, cl
cmp esi, 0x100
jl 0x3be77f3
mov esi, 1
mov edx, 0x3beec78
nop dword [eax]
mov eax, esi
mov dword [edx], esi
and al, 0x80
movzx ecx, al
lea eax, [esi + esi]
neg ecx
sbb ecx, ecx
add edx, 4
and ecx, 0x1b
xor ecx, eax
movzx esi, cl
cmp edx, 0x3beeca0
jl 0x3be7830
mov eax, 1
mov byte [0x3beca78], 0x63
mov byte [0x3bedbdb], 0
mov dword [ebp - 4], eax
nop dword [eax]
mov ecx, dword [ebp + eax*4 - 0x408]
lea eax, [ebp - 0x40c]
shl ecx, 2
sub eax, ecx
mov ebx, dword [eax]
mov ecx, ebx
sar ecx, 7
lea eax, [ebx + ebx]
or ecx, eax
movzx eax, cl
xor ebx, eax
mov ecx, eax
shr ecx, 7
add eax, eax
or ecx, eax
movzx eax, cl
xor ebx, eax
mov ecx, eax
add eax, eax
shr ecx, 7
or ecx, eax
movzx edx, cl
mov ecx, edx
shr ecx, 7
lea eax, [edx + edx]
or ecx, eax
xor ecx, 0x63
movzx eax, cl
xor eax, edx
xor ebx, eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x3beca78], bl
mov byte [ebx + 0x3bedb78], al
inc eax
mov dword [ebp - 4], eax
cmp eax, 0x100
jl 0x3be7870
mov ebx, 0xff
xor esi, esi
mov dword [ebp - 8], ebx
movzx edx, byte [esi + 0x3beca78]
mov eax, edx
and al, 0x80
movzx ecx, al
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x1b
xor ecx, eax
movzx eax, cl
mov ecx, eax
xor ecx, edx
shl ecx, 8
xor ecx, edx
shl ecx, 8
xor ecx, edx
shl ecx, 8
xor ecx, eax
mov dword [esi*4 + 0x3becb78], ecx
rol ecx, 8
mov dword [esi*4 + 0x3becf78], ecx
rol ecx, 8
mov dword [esi*4 + 0x3bed378], ecx
rol ecx, 8
mov dword [esi*4 + 0x3bed778], ecx
movzx ecx, byte [esi + 0x3bedb78]
test ecx, ecx
je 0x3be799f
mov ecx, dword [ebp + ecx*4 - 0x408]
mov eax, dword [ebp - 0x3d0]
add eax, ecx
cdq
idiv ebx
mov eax, dword [ebp - 0x3e4]
add eax, ecx
mov edi, dword [ebp + edx*4 - 0x808]
cdq
idiv ebx
mov eax, dword [ebp - 0x3d4]
add eax, ecx
mov ebx, dword [ebp + edx*4 - 0x808]
cdq
idiv dword [ebp - 8]
mov eax, dword [ebp + edx*4 - 0x808]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x3dc]
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
mov eax, dword [ebp + edx*4 - 0x808]
jmp 0x3be79a8
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ebx
xor eax, eax
shl eax, 8
xor eax, dword [ebp - 4]
shl eax, 8
xor eax, ebx
mov ebx, 0xff
shl eax, 8
xor eax, edi
mov dword [esi*4 + 0x3bedc78], eax
rol eax, 8
mov dword [esi*4 + 0x3bee078], eax
rol eax, 8
mov dword [esi*4 + 0x3bee478], eax
rol eax, 8
mov dword [esi*4 + 0x3bee878], eax
inc esi
cmp esi, 0x100
jl 0x3be78e5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x3be7a00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub esp, 0x18
test al, 0xf
je 0x3be7a16
mov eax, 0xffffffde
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x3be7b6a
cmp dword [ebp + 0xc], 0
mov ecx, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 0x1c]
push edi
jne 0x3be7ab2
mov ebx, dword [ebp + 0x18]
lea edx, [ecx + 0xf]
dec eax
mov dword [ebp - 8], edx
mov edi, ecx
shr eax, 4
sub edi, esi
inc eax
mov dword [ebp + 0x10], eax
movups xmm0, xmmword [ebx]
push esi
push ebx
push dword [ebp + 8]
movups xmmword [ebp - 0x18], xmm0
call fcn.03be8d30
add esp, 0xc
cmp esi, dword [ebp - 8]
ja 0x3be7a83
lea eax, [esi + 0xf]
cmp eax, dword [ebp + 0x14]
jb 0x3be7a83
mov ecx, esi
mov edx, 0x10
nop
mov al, byte [edi + ecx]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub edx, 1
jne 0x3be7a70
mov eax, dword [ebp + 0x14]
jmp 0x3be7a93
mov eax, dword [ebp + 0x14]
movups xmm0, xmmword [esi]
movups xmm1, xmmword [eax]
pxor xmm1, xmm0
movups xmmword [esi], xmm1
movups xmm0, xmmword [ebp - 0x18]
add esi, 0x10
add ebx, 0x10
sub edi, 0x10
sub dword [ebp + 0x10], 1
movups xmmword [eax], xmm0
jne 0x3be7a46
pop edi
pop esi
pop ebx
xor eax, eax
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp + 0x18]
lea edx, [eax - 1]
mov ebx, ecx
shr edx, 4
sub ebx, edi
mov dword [ebp - 4], esi
inc edx
mov dword [ebp + 0x10], ebx
mov dword [ebp - 8], edx
mov edx, dword [ebp + 8]
nop dword [eax]
lea eax, [edi + 0xf]
cmp esi, eax
ja 0x3be7ade
lea eax, [esi + 0xf]
cmp eax, edi
jae 0x3be7aec
lea eax, [ecx + 0xf]
cmp esi, eax
ja 0x3be7b1d
lea eax, [esi + 0xf]
cmp eax, ecx
jb 0x3be7b1d
mov ebx, esi
mov ecx, edi
mov esi, dword [ebp + 0x10]
sub ebx, edi
mov edx, 0x10
nop word [eax + eax]
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [ebx + ecx - 1], al
sub edx, 1
jne 0x3be7b00
mov esi, dword [ebp - 4]
mov ebx, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
jmp 0x3be7b2a
movups xmm1, xmmword [ecx]
movups xmm0, xmmword [edi]
pxor xmm1, xmm0
movups xmmword [esi], xmm1
cmp dword [ebp + 0xc], 1
push esi
push esi
push edx
jne 0x3be7b3a
call fcn.03be92c0
jmp 0x3be7b3f
call fcn.03be8d30
movups xmm0, xmmword [esi]
mov ecx, dword [ebp + 0x14]
sub ebx, 0x10
mov edx, dword [ebp + 8]
add esi, 0x10
add esp, 0xc
mov dword [ebp + 0x10], ebx
add edi, 0x10
mov dword [ebp - 4], esi
sub dword [ebp - 8], 1
movups xmmword [ecx], xmm0
jne 0x3be7ad0
pop edi
pop esi
pop ebx
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x3be7bb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push esi
push edi
push dword [ebp + 0x10]
xor eax, eax
lea edi, [ebp - 0x118]
push dword [ebp + 0xc]
mov ecx, 0x46
rep stosd dword es:[edi], eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x118]
push eax
lea esi, [edi + 8]
mov dword [edi + 4], esi
call fcn.03be7db0
add esp, 0xc
mov dword [ebp + 8], eax
test eax, eax
jne 0x3be7da4
mov ecx, dword [ebp - 0x118]
mov dword [edi], ecx
shl ecx, 4
add ecx, dword [ebp - 0x114]
mov eax, dword [ecx]
mov dword [esi], eax
mov eax, dword [ecx + 4]
mov dword [esi + 4], eax
mov eax, dword [ecx + 8]
mov dword [esi + 8], eax
mov eax, dword [ecx + 0xc]
sub ecx, 0x10
mov dword [esi + 0xc], eax
add esi, 0x10
mov edi, dword [edi]
dec edi
test edi, edi
jle 0x3be7d8b
push ebx
nop dword [eax]
movzx eax, byte [ecx + 3]
dec edi
movzx edx, byte [eax + 0x3beca78]
movzx eax, byte [ecx + 2]
mov edx, dword [edx*4 + 0x3bee878]
movzx eax, byte [eax + 0x3beca78]
xor edx, dword [eax*4 + 0x3bee478]
movzx eax, byte [ecx + 1]
movzx eax, byte [eax + 0x3beca78]
xor edx, dword [eax*4 + 0x3bee078]
movzx eax, byte [ecx]
movzx eax, byte [eax + 0x3beca78]
xor edx, dword [eax*4 + 0x3bedc78]
mov dword [esi], edx
mov ebx, dword [ecx + 4]
mov eax, ebx
shr eax, 0x10
movzx eax, al
movzx edx, byte [eax + 0x3beca78]
mov eax, ebx
shr eax, 8
movzx eax, al
mov edx, dword [edx*4 + 0x3bee478]
movzx eax, byte [eax + 0x3beca78]
xor edx, dword [eax*4 + 0x3bee078]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + 0x3beca78]
xor edx, dword [eax*4 + 0x3bee878]
movzx eax, bl
movzx eax, byte [eax + 0x3beca78]
xor edx, dword [eax*4 + 0x3bedc78]
mov dword [esi + 4], edx
mov ebx, dword [ecx + 8]
mov eax, ebx
shr eax, 0x10
movzx eax, al
movzx edx, byte [eax + 0x3beca78]
mov eax, ebx
shr eax, 8
movzx eax, al
mov edx, dword [edx*4 + 0x3bee478]
movzx eax, byte [eax + 0x3beca78]
xor edx, dword [eax*4 + 0x3bee078]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + 0x3beca78]
xor edx, dword [eax*4 + 0x3bee878]
movzx eax, bl
movzx eax, byte [eax + 0x3beca78]
xor edx, dword [eax*4 + 0x3bedc78]
mov dword [esi + 8], edx
mov ebx, dword [ecx + 0xc]
mov eax, ebx
shr eax, 0x10
sub ecx, 0x10
movzx eax, al
movzx edx, byte [eax + 0x3beca78]
mov eax, ebx
shr eax, 8
movzx eax, al
mov edx, dword [edx*4 + 0x3bee478]
movzx eax, byte [eax + 0x3beca78]
xor edx, dword [eax*4 + 0x3bee078]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + 0x3beca78]
xor edx, dword [eax*4 + 0x3bee878]
movzx eax, bl
movzx eax, byte [eax + 0x3beca78]
xor edx, dword [eax*4 + 0x3bedc78]
mov dword [esi + 0xc], edx
add esi, 0x10
test edi, edi
jg 0x3be7c30
pop ebx
mov eax, dword [ecx]
mov dword [esi], eax
mov eax, dword [ecx + 4]
mov dword [esi + 4], eax
mov eax, dword [ecx + 8]
mov dword [esi + 8], eax
mov eax, dword [ecx + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x3be9bd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x34], 0xb12
mov eax, dword [ebp - 0x34]
xor eax, 0x64
mov word [ebp - 0x30], ax
mov eax, dword [ebp - 0x34]
inc eax
xor eax, 0x62
mov word [ebp - 0x2e], ax
mov eax, dword [ebp - 0x34]
add eax, 2
xor eax, 0x67
mov word [ebp - 0x2c], ax
mov eax, dword [ebp - 0x34]
add eax, 3
xor eax, 0x68
mov word [ebp - 0x2a], ax
mov eax, dword [ebp - 0x34]
add eax, 4
xor eax, 0x65
mov word [ebp - 0x28], ax
mov eax, dword [ebp - 0x34]
add eax, 5
xor eax, 0x6c
mov word [ebp - 0x26], ax
mov eax, dword [ebp - 0x34]
add eax, 6
xor eax, 0x70
mov word [ebp - 0x24], ax
mov eax, dword [ebp - 0x34]
add eax, 7
xor eax, 0x2e
mov word [ebp - 0x22], ax
mov eax, dword [ebp - 0x34]
add eax, 8
xor eax, 0x64
mov word [ebp - 0x20], ax
mov eax, dword [ebp - 0x34]
add eax, 9
xor eax, 0x6c
mov word [ebp - 0x1e], ax
mov eax, dword [ebp - 0x34]
add eax, 0xa
xor eax, 0x6c
mov word [ebp - 0x1c], ax
xor eax, eax
mov word [ebp - 0x1a], ax
xor edx, edx
mov ax, word [ebp - 0x30]
mov ax, word [ebp + edx*2 - 0x30]
mov ecx, dword [ebp - 0x34]
add ecx, edx
movzx eax, ax
xor ecx, eax
mov word [ebp + edx*2 - 0x30], cx
inc edx
cmp edx, 0xb
jb 0x3be9c73
push esi
xor eax, eax
push edi
mov edi, dword [ebp + 8]
mov word [ebp - 0x1a], ax
lea eax, [ebp - 0x30]
push eax
mov eax, dword [edi + 0x69c]
call eax
mov esi, eax
test esi, esi
jne 0x3be9cb5
pop edi
mov eax, 0xe0d00721
pop esi
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x18], 0x69
xor edx, edx
mov byte [ebp - 0x14], 0x24
mov byte [ebp - 0x13], 0
mov byte [ebp - 0x12], 7
mov byte [ebp - 0x11], 0
mov byte [ebp - 0x10], 0x2d
mov byte [ebp - 0xf], 0x1c
mov byte [ebp - 0xe], 4
mov byte [ebp - 0xd], 0x19
mov byte [ebp - 0xc], 0x3e
mov byte [ebp - 0xb], 0x1b
mov byte [ebp - 0xa], 0
mov byte [ebp - 9], 0x1d
mov byte [ebp - 8], 0xc
mov byte [ebp - 7], 0x2d
mov byte [ebp - 6], 0x1c
mov byte [ebp - 5], 4
mov byte [ebp - 4], 0x19
mov al, byte [ebp - 0x14]
mov byte [ebp - 3], 0
nop dword [eax]
mov al, byte [ebp + edx - 0x14]
movsx ecx, byte [ebp - 0x18]
movsx eax, al
xor eax, ecx
mov byte [ebp + edx - 0x14], al
inc edx
cmp edx, 0x11
jb 0x3be9d10
lea eax, [ebp - 0x14]
mov byte [ebp - 3], 0
push eax
mov eax, dword [edi + 0x6a4]
push esi
call eax
mov ecx, eax
test ecx, ecx
jne 0x3be9d49
pop edi
mov eax, 0xe0d00728
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
pop edi
mov dword [eax], esi
mov eax, dword [ebp + 0x10]
pop esi
mov dword [eax], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x3bebc30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x450
xor ecx, ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov eax, dword [esi + 0x20]
mov word [edi], cx
test eax, eax
je 0x3bebe3d
push ebx
mov ebx, dword [esi + 0x20]
test ebx, ebx
je 0x3bebe3c
mov ecx, 0xc120
mov edx, 0xc135
nop word [eax + eax]
Function at 0x40689a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4068be
xor eax, eax
test eax, eax
je 0x4068d1
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4068d1
xor ecx, ecx
jmp 0x4068d4
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x4069f7
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43190c], 0
push esi
jne 0x406a2e
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406a08
mov dword [ecx*4 + 0x431908], eax
inc ecx
cmp ecx, 0x100
jl 0x406a03
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406a5f
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431908]
xor eax, esi
inc ecx
dec edx
jne 0x406a41
pop edi
not eax
pop esi
ret 0xc

Function at 0x431002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x431072
mov ebx, 0x40915c
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x5b211846
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
loop 0x431060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4310d2
nop
nop
mov ebx, 0x42f3f8
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x1a553556
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x403721
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4de23a
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x52472c]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
push esi
push edi
mov eax, dword [0x52472c]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov edi, edx
cmp dword [edi + 0x14], 0
mov ebx, ecx
mov dword [esp + 0x18], ebx
je 0x4038ed
mov esi, ebx
call fcn.004036cd
lea eax, [esp + 0x54]
push eax
call int.0041a5d3
pop ecx
and dword [esp + 0x80], 0
cmp dword [esp + 0x6c], 8
mov eax, dword [esp + 0x58]
jae 0x403793
lea eax, [esp + 0x58]
push eax
call fcn.00403965
mov esi, eax
pop ecx
mov dword [esp + 0x14], esi
call fcn.00402552
mov edi, eax
call fcn.00402532
and dword [esp + 0x2c], 0
and dword [esp + 0x30], 0
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], eax
lea esi, [esp + 0x2c]
lea edi, [esp + 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x1c]
call fcn.004cff17
cmp byte [ebp + 0xc], 0
je 0x403896
mov eax, edi
push eax
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.USER32.dll_EqualRect]
test eax, eax
jne 0x403896
mov edi, dword [esp + 0x28]
mov ebx, dword [esp + 0x24]
mov esi, dword [esp + 0x14]
sub edi, dword [esp + 0x20]
sub ebx, dword [esp + 0x1c]
call fcn.0040230d
push eax
push edi
push ebx
lea eax, [esp + 0x50]
push eax
call fcn.0040249a
mov byte [esp + 0x80], 1
lea eax, [esp + 0x44]
lea esi, [esp + 0x3c]
call fcn.004023b9
mov byte [esp + 0x80], 2
mov eax, dword [esp + 0x28]
sub eax, dword [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
sub eax, dword [esp + 0x20]
push eax
mov eax, dword [esp + 0x1c]
push 0
push 0
call fcn.00402572
mov esi, dword [esp + 0x18]
add esi, 4
push esi
push dword [ebp + 8]
lea eax, [esp + 0x4c]
push eax
call fcn.004d07ef
add esp, 0xc
mov byte [esp + 0x80], 1
push dword [esp + 0x3c]
call sub.gdiplus.dll_GdipDeleteGraphics
mov byte [esp + 0x80], 0
lea eax, [esp + 0x44]
push eax
call fcn.004023dd
mov ebx, dword [esp + 0x18]
jmp 0x4038a9
lea esi, [ebx + 4]
push esi
push dword [ebp + 8]
push dword [esp + 0x1c]
call fcn.004d07ef
add esp, 0xc
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x4038b7
mov eax, dword [ecx]
push 1
call dword [eax]
xor edi, edi
cmp dword [ebx + 8], edi
jle 0x4038db
test edi, edi
jl 0x40390d
cmp edi, dword [esi + 4]
jge 0x40390d
mov eax, dword [esi]
mov edx, dword [ebx]
lea eax, [eax + edi*4]
push dword [eax]
mov ecx, ebx
push edi
call dword [edx]
inc edi
cmp edi, dword [ebx + 8]
jl 0x4038be
or dword [esp + 0x80], 0xffffffff
lea eax, [esp + 0x54]
push eax
call fcn.00403669
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.004b1fae
mov esp, ebp
pop ebp
ret 8
push 0
push 0
push 1
push 0xc000008c
call dword [sym.imp.KERNEL32.dll_RaiseException]
Function at 0x414d60
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
add ebx, 0x12753
jmp 0x414d72
or ebx, 0x29bc
pop ebx
mov ecx, dword [ebp - 0x2040]
mov dword [ebp - 0x15dc], ecx
push edi
call 0x414d93
add byte [eax + 0x4a], dl
inc eax
aas
inc edi
push eax
aaa
add esp, 4
xor edi, 0x3bc9
pop edi
push ecx
push ecx
add esp, 4
sub ecx, 0x16b60
add ecx, 0x10885
pop ecx
push esi
sub esi, 0x5715
pop esi
mov edx, dword [ebp - 0x10c]
add edx, 0xfe
imul eax, dword [ebp - 0x108], 0xfe
add eax, 0x56f3663b
imul ecx, dword [ebp - 0x108], 0xfe
sub eax, ecx
xor edx, eax
imul edx, dword [ebp - 0x108]
mov dword [ebp - 0x15dc], edx
mov edx, dword [ebp - 0x414]
mov dword [ebp - 0x202c], edx
mov eax, dword [ebp - 0x202c]
add eax, dword [ebp - 0x15dc]
mov dword [ebp - 0x414], eax
push esi
or esi, 0x1f8
or esi, 0xdbb3
call 0x414e27
add byte [esi + 0x4c], cl
cmp eax, 0x4f473543
cmp dh, byte [esi]
add esp, 4
pop esi
push ebx
push edi
add esp, 4
sub ebx, 0xba21
sub ebx, 0x619c
pop ebx
push eax
push ebx
add esp, 4
add eax, 0xb228
sub eax, 0xada5
pop eax
push ebx
or ebx, 0x8d9a
or ebx, 0x235
call 0x414e6b
add byte [0x3d37483b], dh
dec ecx
inc eax
inc esi
cmp eax, 0x5b04c483
mov byte [ebp - 0xc08], 0x51
mov byte [ebp - 0xc07], 0xb9
mov byte [ebp - 0xc06], 0x10
mov byte [ebp - 0xc05], 0x10
mov byte [ebp - 0xc04], 0x10
mov byte [ebp - 0xc03], 0x10
mov byte [ebp - 0xc02], 0x59
push esi
push ebx
add esp, 4
sub esi, 0x504f
sub esi, 0x12a7f
pop esi
push esi
push eax
add esp, 4
jmp 0x414ebd
xor esi, 0x12bd8
add esi, 0x180b0
pop esi
push esi
or esi, 0x5d09
pop esi
push edi
and edi, 0xd31e
xor edi, 0x13e3b
add edi, 0x319d
jmp 0x414eec
pop edi
push ecx
and ecx, 0x13857
call 0x414f00
add byte [edx], dh
aaa
dec ebp
xor al, byte [ebx + eax*4 - 0x3c]
add al, 0x59
mov byte [ebp - 0xc10], 0x51
mov byte [ebp - 0xc0f], 0xb9
mov byte [ebp - 0xc0e], 0x20
mov byte [ebp - 0xc0d], 0x20
mov byte [ebp - 0xc0c], 0x20
mov byte [ebp - 0xc0b], 0x20
mov byte [ebp - 0xc0a], 0x59
push edi
or edi, 0xa165
and edi, 0xdfe9
or edi, 0xa5c6
or edi, 0x1a38
pop edi
push ebx
push esi
add esp, 4
add ebx, 0x9258
xor ebx, 0x11a33
add ebx, 0xbf7
pop ebx
push esi
call 0x414f75
add byte [edx], dh
inc ebx
inc esp
xor eax, 0x833b3a4e
les eax, [ecx + eax*4]
mul al
sbb dword [eax], eax
add byte [ecx + 0x11ec5c6], al
add byte [esi + 0x50], bl
or eax, 0xb3d1
add byte [ecx + 0x1040f0], al
add byte [ecx + 0xfcc5c0], al
add byte [eax - 0x39], bl
test dword [edi + ebx*8 + 0xeffff], edi
add byte [eax], al
Function at 0x414d93
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
add ebx, 0x12753
jmp 0x414d72
or ebx, 0x29bc
pop ebx
mov ecx, dword [ebp - 0x2040]
mov dword [ebp - 0x15dc], ecx
push edi
call 0x414d93
add byte [eax + 0x4a], dl
inc eax
aas
inc edi
push eax
aaa
add esp, 4
xor edi, 0x3bc9
pop edi
push ecx
push ecx
add esp, 4
sub ecx, 0x16b60
add ecx, 0x10885
pop ecx
push esi
sub esi, 0x5715
pop esi
mov edx, dword [ebp - 0x10c]
add edx, 0xfe
imul eax, dword [ebp - 0x108], 0xfe
add eax, 0x56f3663b
imul ecx, dword [ebp - 0x108], 0xfe
sub eax, ecx
xor edx, eax
imul edx, dword [ebp - 0x108]
mov dword [ebp - 0x15dc], edx
mov edx, dword [ebp - 0x414]
mov dword [ebp - 0x202c], edx
mov eax, dword [ebp - 0x202c]
add eax, dword [ebp - 0x15dc]
mov dword [ebp - 0x414], eax
push esi
or esi, 0x1f8
or esi, 0xdbb3
call 0x414e27
add byte [esi + 0x4c], cl
cmp eax, 0x4f473543
cmp dh, byte [esi]
add esp, 4
pop esi
push ebx
push edi
add esp, 4
sub ebx, 0xba21
sub ebx, 0x619c
pop ebx
push eax
push ebx
add esp, 4
add eax, 0xb228
sub eax, 0xada5
pop eax
push ebx
or ebx, 0x8d9a
or ebx, 0x235
call 0x414e6b
add byte [0x3d37483b], dh
dec ecx
inc eax
inc esi
cmp eax, 0x5b04c483
mov byte [ebp - 0xc08], 0x51
mov byte [ebp - 0xc07], 0xb9
mov byte [ebp - 0xc06], 0x10
mov byte [ebp - 0xc05], 0x10
mov byte [ebp - 0xc04], 0x10
mov byte [ebp - 0xc03], 0x10
mov byte [ebp - 0xc02], 0x59
push esi
push ebx
add esp, 4
sub esi, 0x504f
sub esi, 0x12a7f
pop esi
push esi
push eax
add esp, 4
jmp 0x414ebd
xor esi, 0x12bd8
add esi, 0x180b0
pop esi
push esi
or esi, 0x5d09
pop esi
push edi
and edi, 0xd31e
xor edi, 0x13e3b
add edi, 0x319d
jmp 0x414eec
pop edi
push ecx
and ecx, 0x13857
call 0x414f00
add byte [edx], dh
aaa
dec ebp
xor al, byte [ebx + eax*4 - 0x3c]
add al, 0x59
mov byte [ebp - 0xc10], 0x51
mov byte [ebp - 0xc0f], 0xb9
mov byte [ebp - 0xc0e], 0x20
mov byte [ebp - 0xc0d], 0x20
mov byte [ebp - 0xc0c], 0x20
mov byte [ebp - 0xc0b], 0x20
mov byte [ebp - 0xc0a], 0x59
push edi
or edi, 0xa165
and edi, 0xdfe9
or edi, 0xa5c6
or edi, 0x1a38
pop edi
push ebx
push esi
add esp, 4
add ebx, 0x9258
xor ebx, 0x11a33
add ebx, 0xbf7
pop ebx
push esi
call 0x414f75
add byte [edx], dh
inc ebx
inc esp
xor eax, 0x833b3a4e
les eax, [ecx + eax*4]
mul al
sbb dword [eax], eax
add byte [ecx + 0x11ec5c6], al
add byte [esi + 0x50], bl
or eax, 0xb3d1
add byte [ecx + 0x1040f0], al
add byte [ecx + 0xfcc5c0], al
add byte [eax - 0x39], bl
test dword [edi + ebx*8 + 0xeffff], edi
add byte [eax], al