joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40275e
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
pushal
push 0
push 0
push 3
push 0
push 0
push 0x80000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x4027de
mov dword [ebp - 4], eax
push 0
push 0
push 0
push 2
push 0
push eax
call sub.kernel32.dll_CreateFileMappingA
or eax, eax
je 0x4027d6
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 4
push eax
call sub.kernel32.dll_MapViewOfFile
or eax, eax
je 0x4027ce
mov dword [ebp - 0xc], eax
push 0
push dword [ebp - 4]
call sub.kernel32.dll_GetFileSize
push dword [ebp - 0xc]
push eax
call fcn.00401000
mov dword [ebp - 0x10], eax
push dword [ebp - 0xc]
call sub.kernel32.dll_UnmapViewOfFile
push dword [ebp - 8]
call sub.kernel32.dll_CloseHandle
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
popal
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x402974
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x40299f
xor eax, eax
leave
ret 0xc
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call sub.kernel32.dll_WriteFile
push dword [ebp - 4]
call sub.kernel32.dll_FlushFileBuffers
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 8]
leave
ret 0xc

Function at 0x402aa0
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff60
cmp dword [ebp + 0x18], 1
jne 0x402ae5
mov dword [ebp - 0xa0], 0x94
lea eax, [ebp - 0xa0]
push eax
call sub.kernel32.dll_GetVersionExA
cmp dword [ebp - 0x9c], 5
jb 0x402ade
cmp dword [ebp - 0x98], 1
jb 0x402ade
mov ecx, 0x101
jmp 0x402aea
mov ecx, 1
jmp 0x402aea
mov ecx, 1
lea eax, [ebp - 4]
push eax
push ecx
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyExA
or eax, eax
jne 0x402b31
mov eax, 1
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0x400
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0x14]
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA
push eax
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
pop eax
leave
ret 0x14

Function at 0x402b40
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
pushal
cmp dword [ebp + 8], 0
jne 0x402b80
push 0
call sub.kernel32.dll_GetModuleHandleA
lea esi, [ebp - 0x200]
push 0x200
push esi
push eax
call sub.kernel32.dll_GetModuleFileNameA
push esi
call sub.kernel32.dll_lstrlenA
push esi
add esi, eax
jmp 0x402b75
dec esi
cmp byte [esi], 0x5c
jne 0x402b74
mov byte [esi], 0
pop esi
jmp 0x402b83
mov esi, dword [ebp + 8]
push esi
call sub.kernel32.dll_SetCurrentDirectoryA
popal
leave
ret 4
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x413cc0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xe000]
push edi
jmp 0x413cda
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x413ce1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x413cd0
mov eax, 1
add ebx, ebx
jne 0x413cf3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x413ce8
jne 0x413d04
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x413ce8
xor ecx, ecx
sub eax, 3
jb 0x413d18
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x413d8a
mov ebp, eax
add ebx, ebx
jne 0x413d23
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x413d30
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x413d54
inc ecx
add ebx, ebx
jne 0x413d40
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x413d35
jne 0x413d51
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x413d35
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x413d74
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x413d65
jmp 0x413cd6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x413d74
add edi, ecx
jmp 0x413cd6
pop esi
mov edi, esi
mov ecx, 2
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x413d92
cmp byte [edi], 0
jne 0x413d92
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x413d97
lea edi, [esi + 0x11000]
mov eax, dword [edi]
or eax, eax
je 0x413e06
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x132f8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x13334]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x413dc4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x13338]
or eax, eax
je 0x413e00
mov dword [ebx], eax
add ebx, 4
jmp 0x413de1
call dword [esi + 0x13348]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x413e37
cmp al, 0xef
ja 0x413e2a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x413e0c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x413e19
mov ebp, dword [esi + 0x1333c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x413e6b
sub esp, 0xffffff80
jmp 0x401340
Function at 0x417e60
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0x4c7a60
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x4c7ce4
call fcn.00417e10
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.api_ms_win_core_synch_l1_2_0.dll
mov edi, eax
call ebx
mov esi, eax
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test esi, esi
mov ebp, eax
jne 0x417eaf
push str.kernel32.dll
call ebx
mov esi, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SleepConditionVariableCS
push esi
call ebx
test ebp, ebp
mov edi, eax
je 0x417ed5
mov ecx, dword [0x4c7b24]
push 0x4c780c
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
push str.WakeAllConditionVariable
push esi
call ebx
test edi, edi
je 0x417ef6
test eax, eax
je 0x417ef6
mov dword [0x4c7970], edi
pop edi
pop esi
pop ebp
mov dword [0x4c7978], eax
pop ebx
pop ecx
ret
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x428820
Capabilities:
Encode data using xor

Disassembly:
mov cl, 0x9b
inc ecx
shl dword [esi - 0x45], 0x16
adc eax, 0x9448da04
pop ss
leave
mov edx, 0x1f899dc6
jbe 0x428857
cmpsb byte [esi], byte es:[edi]
adc al, cl
movsb byte es:[edi], byte [esi]
push cs
xchg ebp, eax
iretd
sub esp, dword [edi + 0x7b9ad671]
pop ds
sbb bl, byte [ebx]
inc ebx
cmc
xchg bh, dl
out 0x4b, eax
fistp qword [eax - 0x11]
lahf
jge 0x4288de
das
adc byte [esi - 0x787523e4], ch
lahf
xchg edi, eax
iretd
and edi, edi
add al, 0x13
xor bh, bh
cmc
add bh, ch
mov ah, 0x5d
mov fs, edi
cmp eax, 0x993d612e
cdq
stosb byte es:[edi], al
pop ebx
jle 0x42888a
xor al, 0xdf
sub eax, 0x5ef71465
jnp 0x42888f
xor edi, ebx
pushal
push ss
xchg ebp, eax
xlatb
mov byte [ebx], dh
and byte [edi], ah
pop ebx
pop es
out dx, al
iretd
fidiv dword [ebx]
and eax, 0x265fd905
xor al, 0x6b
dec eax
in al, 0x4d
inc ebx
jns 0x428878
mov dword [0x1110d98d], eax
ret 0x8f38

Function at 0x42b8ca
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0xabc455fc
test bl, dh
out 0x7b, eax
test byte [edi + 0x17], 0xed
test dword [ebx + 0x4f], edi
mov esi, 0xee3afb33
sti
cmp ch, dh
sti
cmp ch, dh
cmp bh, byte [ebx - 0x16]
test byte [edi], al
out dx, eax
imul ebx, dword [edi], 0x60
lds esp, [esi - 0x3b]
push es
les ebx, [ebp + 0x7054a3b4]
sub dh, bl
push cs
fimul word [esi]
xor al, 0x1d
jo 0x42b8e1
mov ebp, esp
jg 0x42b8b8
aam 0x55
pop edx
sbb al, bl
les edx, [esi + 0x72859d03]
fisub dword [esi]
int3
Function at 0x438539
Capabilities:
Encode data using xor

Disassembly:
insd dword es:[edi], dx
enter 0xffffffffffff8f2f, 0xffffffffffffffe2
xor dword [ebx + 0x74], ecx
fnstcw word [esi - 0x46]
mov bh, 0x6d
and bl, byte [edi + eax*8 + 0x65]
aaa
mov edx, 0xdf1efa13
mov ecx, 0x2b116565
cmpsb byte [esi], byte es:[edi]
jle 0x43853c
invalid
mov esp, 0x3cc4dc93
das
inc edx
xor cl, byte [esi]
mov esp, 0x7f47f1b8
jp 0x438565
jg 0x4385e1
std
test al, 6
cmpsd dword [esi], dword es:[edi]
and dword [ebx + 0x42], esi
pop ecx
cmp dword [ebp - 0x616b70b6], ecx
out dx, eax
mov esi, 0x20093a06
jmp 0xdbb165aa
in al, 0x8a
aad 0x7a
ror byte [esi - 6], cl
xlatb
lcall 0xe4c7, 0x5e69056a
adc eax, 0xf51ae3a6
xchg esi, eax
out dx, al
invalid

Function at 0x4389e9
Capabilities:
Encode data using xor

Disassembly:
in al, 0x4f
outsd dx, dword [esi]
ljmp 0x8cfd
and eax, 0x53974e20
aad 0xa1
outsb dx, byte [esi]
test cl, ah
push 0x705ed4af
lodsd eax, dword [esi]
xor al, 0x72
in al, dx
push esp
sub eax, 0x7099d6f
mov word [ebx + esi*2 - 0x223beebd], ds
or bh, ah
adc eax, 0x2a2e443c
mov eax, dword [0xe67b88e4]
pushfd
jae 0x438a49
adc esp, eax
fisttp qword [eax]
out 0x15, eax
cmp al, 0x44
sub ah, byte cs:[ecx - 0x1984771c]
rol byte [eax + 3], 1
sahf
mov ah, 0xbf
movsb byte es:[edi], byte [esi]
jno 0x4389cd
sbb al, byte [edx]
mov ebp, 0xbc5c6dbe
sbb ch, al
adc byte [esi + eax*2 - 0x67], ch
sub eax, 0x9c46562c
sbb al, 0xd9
neg dword [ebp - 0x60]
cld
jbe 0x438a95
arpl word [ecx - 0x2c], si
movsd dword es:[edi], dword [esi]
lodsd eax, dword [esi]
fadd qword [ecx - 0x51]
stosb byte es:[edi], al
int 0x3a
enter 0x4fa8, 0xfffffffffffffff5
mov ebx, 0x254c00b6
mov ebx, 0x254c00b6
add byte [esp - 0x5e], 0x77
add al, 0x8d
pop ebp
push esp
inc esp
pop ebx
test byte [ecx], cl
or al, 0x75
sub al, 0xc8
je 0x438a03
cmp eax, 0xa80ee58b
mov byte [0xc0a5c74], al
add al, 0x53
push cs
or al, byte [edi + edx*4 - 0x4a]
nop
xor al, dl
add al, 0xc8
or dl, byte [edx + 0x38f3d2d]
xchg esp, eax
int3
mov byte [0x42392a7c], al
or al, 0x53
dec eax
scasd eax, dword es:[edi]
cmp esi, esi
fstp dword [edi - 0x7c]
pop esi
adc eax, 0x3e383c8c
mov eax, dword [0x9bc6e65]
push cs
mov edx, 0xeca6fc3c
cmp al, 0xc4
adc bl, ch
pop esi
retf 0xf5de
Function at 0x46d8f2
Capabilities:
Check for vm using instruction vpcext

Disassembly:
dec edx
pop ds
and dword [0x61f5b61d], 0xffffff9f
test al, 0x91
add dword [eax - 0x24b61a7a], edx
push eax
dec edi
cmc
jle 0x46d8ab
inc edi
add byte [esp + ebp*4 - 0x3b1fa635], bh
fsubr dword [edi + 0x1e]
xor al, al
movsd dword es:[edi], dword [esi]
fnstenv [esi]
imul dword [edi]
mov edx, 0xf06df30a
push cs
mov al, byte [0x1c313bae]
dec ecx
ffree st(7)
sub al, 9
mov al, 0x13
xor ch, byte [ecx + ecx*8]
jecxz 0x46d865
scasb al, byte es:[edi]
jmp 0x2eafc2e1
pop ecx
push cs
mov al, byte [0xa1d87cd5]
push esp
ror dl, 0x25
daa
mov ch, byte [esi]
int3
cmp byte [eax - 0x43], bl
xchg dword [edx + 0x29], eax
mov dl, 9
pop esi
in eax, dx
pop eax
loopne 0x46d95d
js 0x46d8ef
ja 0x46d89f
pushfd
nop
sub byte [edi], ch
dec esp
in al, dx
adc dword [edx + edi + 0x1d6d5a6], eax
xor esp, dword [esi - 0x21]
in eax, 0xac
psrad mm4, mm2
pushal
popal
stc
push 0xba8dff4b
fcomp qword [ecx]
fcomp st(2)
cmp dword [0xf2c9d923], 0x1f9033bb
push es
jle 0x46d9a0
push ebp
pop ebp
xchg ebx, eax
mov word [eax - 0x39915d4f], es
add dl, byte [0xbd353a7e]
cdq
mov ebx, 0x4cf06c26
jne 0x46d959
pop esp
cmpsb byte cs:[esi], byte es:[edi]
ljmp 0x4d77
stosb byte es:[edi], al
inc ebx
pop edi
push 0x4eeb0fe5
mov cl, 0x2a
int 0x3c
mov ch, 0x30
and dl, ah
push es
adc dword [ebx + 0x62], 0x3233d11b
pop eax
cmp dword [edx + 0x64f3abb2], edi
cmpsb byte [esi], byte es:[edi]
out dx, eax
invalid
in eax, 0xf
jmp 0x46d9af
xchg byte [edi - 0x50], dl
xor dword [edi], 0x10
test byte [edx], 0x4a
or eax, 0xdd65d0d9
loope 0x46d9eb
loope 0x46d9eb
push 0x47
xor byte [ebx + edi*8 - 4], cl
mov al, 0xee
invalid
Function at 0x493ee9
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
add byte [ebx + 0xce8fc4d], cl
add byte [eax], al
add byte [ebx - 0x333ca21b], cl
int3
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x414]
add ecx, 1
cmp ecx, 0x400
jl 0x493f0c
mov ecx, dword [ebp - 4]
call fcn.00493029
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x414]
add eax, 1
mov ecx, dword [ebp - 4]
add al, 0
add byte [ebx + 0x4d8b01c0], al
cld
mov dword [ecx + 0x414], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x414]
mov ecx, dword [ebp - 4]
mov dl, byte [ebp + 8]
mov ebp, 0xd0306020
add dword [ebx - 0x10ea208f], esi
pop esi
ror byte [esi - 0x71], 0x51
jo 0x493f12
lea esi, [edx]
je 0x493ed2
jg 0x493edc
fucomi st(1)
inc esp
add dl, byte [eax]
enter 0xffffffffffffc382, 0x50
and dword [eax], eax
or byte [edx + 0x4fd1dcac], dl
shl al, 0x76
out dx, al
cmp dword [ecx + 0x383815e4], esi
sbb byte [edi + 0x3d], 0x3e
enter 0xffffffffffffe303, 0xffffffffffffff97
mov cl, 0xe4
adc eax, 0x5f803838
cmp eax, 0xe303c83e
cmp byte [eax - 0x37c1c2a1], al
add esp, ebx
xchg edi, eax
in al, 0x10
xor al, byte [ebx]
sub ebp, ebp
rcr byte [esi + 0x36], 1
fcmove st(0), st(4)
insb byte es:[edi], dx
cdq
mov esp, 0x6c772b60
fisttp qword [0x63675328]
mov dword [0x9c7581be], eax
scasd eax, dword es:[edi]
or byte [ecx + 0x7ececde8], dl
dec edi
shl byte [eax], cl
psrlq mm6, qword gs:[ecx + 0x6293182a]
cld
jp 0x493f62
lahf
or dword [edx - 0xb], ebx
mov dword [0x88d938c1], eax
add ecx, ecx
enter 0xffffffffffffc7c1, 0x7b
adc byte [edx + 0x33265be8], ah
mul dword [edx]
fist word [eax]
shl dword [eax], 1
sti
jle 0x493f5e
xchg ebp, eax
push ecx
xchg edi, eax
ror byte [esi + 0x61], 1
mov byte [0xd1a7d553], al
adc ebx, dword [ebp + edx*8 - 0x6f]
invalid

Function at 0x494619
Capabilities:
Encode data using xor

Disassembly:
stc
xchg ebx, eax
jp 0x494512
insb byte es:[edi], dx
call 0x8066775d
adc dword [eax + 0x71], ebx
dec esp
sub dl, byte [edx]
invalid
std
mov ah, 0x5a
inc eax
xor dword [edx + 0x5a0171d7], esp
mov ecx, 0xc0713620
dec edi
rcl cl, 1
mov cl, 0xbf
and ecx, eax
jle 0x494556
pop esi
push eax
dec esi
sar eax, 0xc7
jge 0x4945e0
test eax, 0x74208030
aad 0x56
int3
dec edi
sbb al, 0xea
imul ch
push cs
and byte [esi], ch
and byte [eax], bl
popal
call 0xdc7e0ac1
or byte [ecx - 0x1d50d760], ch
nop
adc byte [ebp + ebx - 0x3bd97758], bh
add dword [eax], 0x1a7694a0
push ss
movsb byte es:[edi], byte [esi]
jo 0x4945b5
fmul st(5)
and al, 0x73
jecxz 0x4945ea
pushal
popfd
je 0x4945a1
cmc
scasb al, byte es:[edi]
cmp al, 0x89
or esi, dword [ebx]
movsb byte es:[edi], byte [esi]
jl 0x4945c0
add eax, 0x9f9b8797
ljmp 0x1c6b

Function at 0x49ea24
Capabilities:
Encode data using xor

Disassembly:
fsubr qword [ebx + ebp*2 + 0x23]
sbb eax, 0x933d3f72
outsd dx, dword [esi]
invalid

Function at 0x4adef9
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0xc71d7634
sbb dword [edx], esp
imul ecx, dword [eax + 0x44], 0xfd427be3
insd dword es:[edi], dx
sbb byte [edx - 0x5bdaf08], bh
test al, 0x52
sbb cl, byte [edi + 0x6d]
invalid
Function at 0x4bb63d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c43d0
cmp edx, dword [eax]
je 0x4bb65f
add eax, 8
inc ecx
cmp eax, 0x4c4460
jl 0x4bb650
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c43d0]
jne 0x4bb78d
mov eax, dword [0x4c8d64]
cmp eax, 1
je 0x4bb767
test eax, eax
jne 0x4bb690
cmp dword [0x4c42fc], 1
je 0x4bb767
cmp edx, 0xfc
je 0x4bb78d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bb6c7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bc020
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bc4b0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bb70a
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bc4b0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c0a24
push edi
call fcn.004be380
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bc020
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bc030
lea eax, [ebp - 0xa0]
push 0x4c0a04
push eax
call fcn.004bc030
push dword [esi + 0x4c43d4]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bc030
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004be2f4
add esp, 0x2c
pop edi
jmp 0x4bb78d
lea eax, [ebp + 8]
lea esi, [esi + 0x4c43d4]
push 0
push eax
push dword [esi]
call fcn.004bc4b0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x10001430
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10003020]
jne 0x1000143a
repz ret
jmp fcn.100017d0
Function at 0xdfd1d6
Capabilities:
Encode data using base64

Disassembly:
jae 0xe29b81
push 0x170c12a3
mov dword [ebx], eax
dec eax
mov dword [esp + 8], 0x47a57b1b
dec eax
lea esp, [esp + 0x18]
jmp fcn.00fb1919
dec eax
adc ebx, 2
shr eax, cl
jmp 0xe1cf22

Function at 0xe27785
Capabilities:
Encode data using base64

Disassembly:
call fcn.01052c18
call fcn.00e2cb69

Function at 0xfb2030
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ebp, dword [esi + ebp - 3]
mov cl, byte [esi + 8]
jne 0xfcb5ed
jae 0x1080201
mov dword [esi], eax
lea esp, [esp + 4]
jmp fcn.00a9c5e4
adc esi, 6
shld eax, ebp, cl
mov dword [esp], 0x4fbc6a2b
jmp 0xfcf423

Function at 0xfcd9c1
Capabilities:
Encode data using base64

Disassembly:
push esi
pushfd
mov esi, 0xa505a597
add esi, 0x1b21cad
lea esi, [esi + esi*2 - 0x34c0d9da]
neg esi
mov dword [esp + 8], 0x851d360a
mov esi, dword [esp + 4]
push dword [esp]
popfd
lea esp, [esp + 8]
call fcn.00a8ea68
inc sp
mov ebp, dword [ebx]
dec eax
add ebx, 2
inc ebp
movzx esi, word [eax]
call fcn.0109eebd
Function at 0x40482e
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00437d1e
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x404951
push ecx
lea ecx, [esi + 0x18]
call fcn.0042404e
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x404968
push ecx
lea ecx, [esi + 0x24]
call fcn.00423f5e
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x44dc0e
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.004810fe
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x44dd31
push ecx
lea ecx, [esi + 0x18]
call fcn.0046d42e
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x44dd48
push ecx
lea ecx, [esi + 0x24]
call fcn.0046d33e
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x496f1e
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call int.004ca40e
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x497041
push ecx
lea ecx, [esi + 0x18]
call int.004b673e
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x497058
push ecx
lea ecx, [esi + 0x24]
call fcn.004b664e
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret