joyce8/EMBER2024-capa huggingface dataset:
Function at 0x58278a
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
dec eax
adc bl, byte [ecx]
ror cl, 1
std
dec edi
ljmp 0x4a00
rcr dword [edi + edi*2], cl
pushfd
rcr dword [esi], 1
jnp 0x5827cf
bound edi, qword [esi]
loope 0x58279d
or byte [ebp + edi*2 + 0x3c], ah
inc ebx
cdq
push ecx
dec edx
jnp 0x5826f2
cmpsb byte [esi], byte es:[edi]
cmovle ebx, dword [eax - 0x10405022]
daa
jg 0x5827ad
mov al, byte [ebx - 0xbe44555]
add dword [esi], edx
clc
popal
invalid
mov byte [0x16cad6ff], al
adc ah, byte [ebp - 0x32]
sbb ch, byte [edi + 0x17]
pop ebx
push 0xffffffffffffffd2
jbe 0x58274a
and bl, byte [ecx - 0x36]
das
loop 0x5827f1
scasb al, byte es:[edi]
out dx, al
imul ecx, dword [esi + 0x41e2ba9d], 0xa2d294f1
xor dh, ah
dec ecx
adc dword [ecx], ebx
out dx, eax
add ebp, dword [esi + 0x6e436eb1]
or byte gs:[esi - 0x4e], al
inc esi
outsb dx, byte [esi]
cli
stosd dword es:[edi], eax
xchg ebx, eax
cli
xchg al, bh
push ebp
scasb al, byte es:[edi]
jae 0x5827a2
hlt
popal
mov byte [0xdbff4e9e], al
add al, 0x6e
outsb dx, byte [esi]
or dl, ch
mov ah, 0x40
pop edx
push ds
cdq
pop esi
stosb byte es:[edi], al
pop ds
inc eax
or al, 0x1e
out dx, al
adc bh, byte [edi + esi*8 - 0x285cbc05]
mov fs, word [edi + 0x49772126]
adc dl, byte [edx - 2]
and bh, byte [ecx]
mov dl, byte [ecx]
sub eax, dword [edi - 0x79539ce4]
popal
push eax
adc dword [ebx], ebp
xchg dword [ebx], ebx
lodsb al, byte [esi]
xchg byte [ecx + 0x50], ah
jb 0x5827fb
jmp edi
out 9, eax
out dx, al
jnp 0x5827da
jo 0x582846
xchg ecx, eax
test byte [edx + 0x739639d5], 0x36
rcr byte [esi + 0x68], cl
cli
rol byte [0x73208601], 1
mov ebp, dword [eax - 0x38]
pushal
jae 0x582890
add al, 0xa1
cli
sahf
pushfd
pop ebp
dec edx
dec esi
out 0xaf, eax
mov bh, 0x8c
inc ecx
int3
xchg edx, eax
sar byte [ecx + 0x18], cl
sub ebx, esi
test byte [ecx], al
add ebp, esp
xor eax, esp
adc al, 0x31
pop ecx
sahf
pushfd
aam 0x56
xchg esi, eax
push edi
lea edx, [edi + 0x5c]
mov al, 3
fisub word [ecx]
mov ah, 0xcb
out dx, al
pop ecx
cmpsd dword [esi], dword es:[edi]
or dword [edx + 0x2c], 0x10
xchg esi, eax
mov al, 0x60
adc al, 0xa2
xchg dword [edx - 0x6ccfee3b], edi
sub bh, byte [edx + ecx - 0x37]
or cl, cl
into
push esi
push cs
into
in al, dx
dec edi
scasb al, byte es:[edi]
je 0x5828db
invalid
js 0x5828cc
push es
dec edi
js 0x58286c
dec ebp
add eax, 0x6644240
or al, 0x3d
salc
jg 0x582855
and cl, ah
imul ebx, esi, 0x5d
xor ebp, esp
test eax, 0xe68b43ff
loopne 0x582879
salc
adc dword [esi], ecx
push es
mov esi, 0xe9d4b97
push cs
jo 0x5828b7
jp 0x5828be
cmp ecx, ebx
mov gs, word [esi - 0x735dd148]
lahf
invalid
hlt
mov esi, 0x9198f59
pop esi
fst dword [0x1ea6feac]
xchg byte [esi], dh
adc esp, edi
and ebx, dword ds:[ecx - 0x6933d0eb]
mov esp, dword [edx]
cdq
mov dword [0xaa1b6a7a], eax
cmp eax, 0xaa449055
lodsd eax, dword gs:[esi]
add dword [ebx + 0x6d], edx
cmpsb byte [esi], byte es:[edi]
pushal
fadd qword [edi + 0x5d8f4a8e]
mov fs, ebx
jno 0x5828d6
or eax, 0xbe32b8d3
cmpsb byte [esi], byte es:[edi]
mov esi, 0x8132c5db
sbb bh, 0x2d
mov al, 0xa2
pop esi
pop ebp
iretd
Function at 0x582db7
Capabilities:
Encode data using xor

Disassembly:
mov bl, 1
push 0x4cf32182
dec esp
and byte [ecx - 0x600e41df], bl
mov ebp, 0xd7dbb525
nop
xor ecx, ebx
cmp eax, 0x52c2ac1c
sal ah, 1
adc dword fs:[ebp + 0x61c5536a], ebp
pop esi
pop es
loopne 0x582dbc
ljmp 0x168e:0x974955f0

Function at 0x5cb223
Capabilities:
Encode data using xor

Disassembly:
add eax, 0xc0e0af50
pop ecx
test al, 0x1c
inc ebx
xor al, byte [ebp + 0x72]
in al, dx
add byte [edx + eax*8 + 0x60945de9], cl
mov bl, 0x34
pop esp
mov byte [eax - 0xd], al
sbb eax, 0x9af440f6
sub al, 0x5d
pop ds
invalid

Function at 0x5d3c88
Capabilities:
Check for peb beingdebugged flag

Disassembly:
scasd eax, dword es:[edi]
salc
xor eax, 0xf9c7c492
cmp eax, 0x230b3c01
jbe 0x5d3c97
mov cl, 0x58
push ebp
inc eax
jne 0x5d3c7a
xchg edx, eax
enter 0x7c95, 0x42
and eax, dword [ebp + 0x4e]

Function at 0x60c316
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5193a8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push edi
mov eax, dword [0x5624e0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [esp + 0xc]
call fcn.00615325
mov dword [esp + 0x28], 0
test esi, esi
jne 0x60c35c
xor eax, eax
jmp 0x60c35f
mov eax, dword [esi + 4]
push eax
call dword [0x51b1ac]
push eax
lea ecx, [esp + 0x10]
call int.0061595a
lea eax, [edi + 0x7c]
test eax, eax
je 0x60c37a
mov eax, dword [eax + 4]
push eax
mov eax, dword [esp + 0x14]
push eax
call fcn.00615cbf
mov edx, dword [esp + 0x10]
mov ecx, dword [edi + 0xbc]
push 0xcc0020
push 0
push 0
push edx
mov ebx, eax
mov eax, dword [edi + 0xc0]
push eax
mov eax, dword [esi + 4]
push ecx
push 0
push 0
push eax
call dword [0x51b194]
test ebx, ebx
je 0x60c3b8
mov ebx, dword [ebx + 4]
mov ecx, dword [esp + 0x10]
push ebx
push ecx
call fcn.00615cbf
mov edx, dword [esi]
mov edx, dword [edx + 0x28]
lea eax, [edi + 0x84]
push eax
mov ecx, esi
call edx
push 1
mov ecx, esi
call fcn.0061503f
mov ecx, dword [edi + 0xb8]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xb4]
mov eax, dword [edi + 0xa0]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
lea ecx, [edi + 0xa4]
push ecx
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
lea ecx, [edi + 0x8c]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe4]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe0]
mov eax, dword [edi + 0xcc]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
add edi, 0xd0
push edi
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call int.006159db
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x617219
Capabilities:
Encode data using xor

Disassembly:
sub dh, al
sub al, 0x22
daa
push ebx
cwde
dec ebp
lodsd eax, dword [esi]
push edx
sub dl, dl
cmp eax, 0x7d833f3
cmpsd dword [esi], dword es:[edi]
rcr byte [esi - 0x6c6d895d], 1
rol esi, 0xd7
leave
xchg edx, eax
xchg edx, eax
invalid
push 0xffffffffffffffab
or dword [edi + 0x5fd55517], ebp
and eax, 0x96e383e2
xchg esi, eax
nop
pop esi
inc ecx
cmp al, 0xfa
push ss
lea esp, [eax]
fidiv dword [edi]
cmpsd dword [esi], dword es:[edi]
sbb dword [ebx - 0xd], eax
xor eax, 0x23e115f6
insb byte es:[edi], dx
adc dword [esi - 0x74ca66aa], edx
push ecx
popfd
bound edi, qword [ecx + 0x41]
sbb edi, esp
jb 0x61715f
adc edx, dword [esi + 0x776d95d6]
arpl word [edi + 0x4b578738], cx
mov eax, 0xae463a33
and eax, 0x33fa0d12
loopne 0x6171ac
into
test byte [ebp + ebx*4 - 0x68], ah
out 0x57, eax
mov cl, 0x94
fist dword [edx]
xchg edi, eax
push edi
int3
arpl dx, bx
push esp
movsd dword es:[edi], dword [esi]
stosd dword es:[edi], eax
xchg dword [edx + 5], edx
xor edx, dword [ebx + edx + 0x6b]
push 0x2a
mov edx, ss
movsb byte es:[edi], byte [esi]
mov esp, dword [edx - 0x336b79b]
dec edx
in al, 0x58
movsb byte es:[edi], byte [esi]
jecxz 0x6171b8
inc ebx
aam 0xd
cmp dword [ebx], edi
inc edi
lds ecx, [eax + 0x1476f1f0]
push edx
iretd

Function at 0x618b0a
Capabilities:
Encode data using xor

Disassembly:
and byte [ebx + 0x6b], ch
inc ebx
loop 0x618b44
or ecx, dword [esi - 0x27]
dec ecx
imul ebp, dword [ebp - 0xe], 0x4932046d
mov dl, 0xe1
pop ss
push es
fcmove st(0), st(4)
sub al, 0x83
invalid
dec edx
mov bh, 0xf0
xor dword [edi + 0x36359d42], esp
pop ss
bound eax, qword [edx + 0x535d030d]
invalid
or eax, 0xc6535d03
mov eax, dword [0xc4239633]
cwde
pushfd
pop ss
lodsb al, byte [esi]
movsd dword es:[edi], dword [esi]
jp 0x618b38
salc
or dword [edx - 0x3c], esp
outsd dx, dword [esi]
fisubr dword [eax - 0x25ac0a49]
out 0xab, eax
inc edi
and dword [esi], ebp
mov eax, dword [0xbffd2d17]
xchg ebp, eax
ror dl, 1
push ecx
mov edx, 0x6a30283
cmp al, 0x7e
outsb dx, byte [esi]
push esp
xor dh, byte [esi + 0x20b6d8a]
inc edi
xchg edx, eax
adc dl, dh
clc
sub eax, 0x2f1de6f
add dword [edi + 4], 0x6a484818
push edx
mov dword [0x8233da79], eax
hlt
Function at 0x4037c4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0xf66008], 0x8088405
inc edx
mov dword [ebx + 0xf66008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x425738
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push ebp
mov edi, ecx
mov ecx, dword [ebp + 8]
mov esi, ecx
shr esi, 2
je 0x425765
lea edi, [edi + esi*4]
lea edx, [edx + esi*4]
lea eax, [eax + esi*4]
neg esi
mov ebx, dword [eax + esi*4]
mov ebp, dword [edx + esi*4]
mov dword [edi + esi*4], ebx
xor dword [eax + esi*4], ebp
inc esi
jne 0x425756
and ecx, 3
je 0x42577d
mov bl, byte [ecx + eax - 1]
mov bh, byte [ecx + edx - 1]
mov byte [ecx + edi - 1], bl
xor byte [ecx + eax - 1], bh
dec ecx
jne 0x42576a
pop ebp
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x425788
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push ebp
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push esi
shr esi, 2
je 0x4257c1
lea ecx, [ecx + esi*4]
lea edi, [edi + esi*4]
lea edx, [edx + esi*4]
lea eax, [eax + esi*4]
neg esi
mov ebp, dword [eax + esi*4]
mov ebx, dword [edi + esi*4]
xor ebx, dword [edx + esi*4]
mov dword [edx + esi*4], ebx
xor ebx, dword [ecx + esi*4]
mov dword [edi + esi*4], ebp
mov dword [eax + esi*4], ebx
inc esi
jne 0x4257a9
pop esi
and esi, 3
je 0x4257e6
mov bl, byte [esi + eax - 1]
mov bh, byte [esi + edx - 1]
xor bh, byte [esi + edi - 1]
mov byte [esi + edx - 1], bh
xor bh, byte [esi + ecx - 1]
mov byte [esi + edi - 1], bl
mov byte [esi + eax - 1], bh
dec esi
jne 0x4257c7
pop ebp
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x4257f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov esi, ecx
shr esi, 2
je 0x42581c
lea edi, [edi + esi*4]
lea edx, [edx + esi*4]
lea eax, [eax + esi*4]
neg esi
mov ebx, dword [edx + esi*4]
xor ebx, dword [eax + esi*4]
mov dword [edi + esi*4], ebx
mov dword [eax + esi*4], ebx
inc esi
jne 0x42580d
and ecx, 3
je 0x425834
mov bl, byte [ecx + edx - 1]
xor bl, byte [ecx + eax - 1]
mov byte [ecx + edi - 1], bl
mov byte [ecx + eax - 1], bl
dec ecx
jne 0x425821
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x42583c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
shr ecx, 1
lea edi, [eax + ecx*8]
lea edx, [edx + ecx*8]
neg ecx
mov ebx, dword [edx + ecx*8]
mov eax, dword [edx + ecx*8 + 4]
xor dword [edi + ecx*8], ebx
xor dword [edi + ecx*8 + 4], eax
inc ecx
jne 0x425848
pop edi
pop ebx
ret
Function at 0x426164
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call dword [eax + 0x20]
mov esi, eax
mov eax, esi
shr eax, 2
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
call fcn.00425dbc
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0xeb16a3
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, esi
add eax, eax
push eax
mov eax, dword [ebp - 8]
pop edx
mov ecx, edx
cdq
idiv ecx
mov edi, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [ebp - 0x14], eax
dec edi
test edi, edi
jl 0x426212
inc edi
mov edx, dword [ebp - 0x10]
mov eax, ebx
mov ecx, esi
call fcn.00403510
mov edx, ebx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
call fcn.0042583c
lea eax, [ebx + esi]
mov ebx, eax
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, esi
call fcn.00403510
mov edx, ebx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov edx, dword [ebp - 0x10]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
call fcn.0042583c
lea eax, [ebx + esi]
mov ebx, eax
dec edi
jne 0x4261bf
mov eax, esi
add eax, eax
push eax
mov eax, dword [ebp - 8]
pop edx
mov ecx, edx
cdq
idiv ecx
mov edi, edx
cmp esi, edi
jg 0x426260
mov edx, dword [ebp - 0x10]
mov eax, ebx
mov ecx, esi
call fcn.00403510
mov edx, ebx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
call fcn.0042583c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x10]
mov ecx, esi
call fcn.00403510
lea eax, [ebx + esi]
mov ebx, eax
sub edi, esi
test edi, edi
jle 0x42628a
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
dec edi
test edi, edi
jl 0x42628a
inc edi
xor eax, eax
mov edx, dword [ebp - 4]
mov edx, dword [edx + 8]
mov dl, byte [edx + eax]
xor byte [ebx + eax], dl
inc eax
dec edi
jne 0x42627a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xeb16aa
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00425f58
ret

Function at 0x434a6c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
xor ebx, ebx
mov bl, dl
dec ebx
test ebx, ebx
jl 0x434ac0
inc ebx
xor edx, edx
mov ecx, edx
shl ecx, 2
movzx esi, byte [eax + ecx]
lea esi, [esi*4 + 0xf66780]
mov esi, dword [esi]
movzx edi, byte [eax + ecx + 1]
lea edi, [edi*4 + 0xf66b80]
xor esi, dword [edi]
movzx edi, byte [eax + ecx + 2]
lea edi, [edi*4 + 0xf66f80]
xor esi, dword [edi]
movzx edi, byte [eax + ecx + 3]
lea edi, [edi*4 + 0xf67380]
xor esi, dword [edi]
lea ecx, [eax + ecx]
mov dword [ecx], esi
inc edx
dec ebx
jne 0x434a7b
pop edi
pop esi
pop ebx
ret
Function at 0x454c20
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x454c26
ret

Function at 0x45f15c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0xeea70d
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.004053b8
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0xeea724
call fcn.00405014
mov eax, ebx
call fcn.00424050
mov edi, eax
dec edi
test edi, edi
jl 0x45f214
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.00424024
mov edx, dword [0xefe874]
call fcn.00403f90
test al, al
je 0x45f210
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.00424024
lea edx, [ebp - 0x14]
call fcn.00493338
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.004053b8
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405088
inc esi
dec edi
jne 0x45f1c2
mov al, byte [0xeea728]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0xeea734
mov eax, dword [ebp - 0xc]
call fcn.0040f27c
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.00404d74
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.00493338
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0xeea724
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f8]
call fcn.00493338
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0xeea724
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0xeea724
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0xeea740
call fcn.0040aedc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xeea714
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.00404d00
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00404d00
lea eax, [ebp - 0x14]
call fcn.00404cdc
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404d00
ret
Function at 0x49b198
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, ecx
mov dword [ebp - 4], eax
mov esi, dword [0xf7831c]
mov eax, dword [ebp - 4]
mov byte [eax + 0x210], 1
xor eax, eax
push ebp
push 0xf26771
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00493368
add dword [ebp - 0xc], 4
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00494590
mov eax, dword [esi]
call fcn.00481e78
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x4c]
add edx, dword [ebp - 0x14]
cmp eax, edx
jge 0x49b20a
mov eax, dword [esi]
call fcn.00481e78
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x4c]
mov dword [ebp - 0x14], eax
mov eax, dword [esi]
call fcn.00481e84
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x48]
add edx, dword [ebp - 0x18]
cmp eax, edx
jge 0x49b22e
mov eax, dword [esi]
call fcn.00481e84
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x48]
mov dword [ebp - 0x18], eax
mov eax, dword [esi]
call fcn.00481e6c
insb byte es:[edi], dx
invalid
invalid
cmp eax, dword [ebp - 0x18]
jle 0x49b244
mov eax, dword [esi]
call fcn.00481e6c
mov dword [ebp - 0x18], eax
mov eax, dword [esi]
call fcn.00481e60
cmp eax, dword [ebp - 0xc]
jle 0x49b25a
mov eax, dword [esi]
call fcn.00481e60
mov dword [ebp - 0xc], eax
push 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
call fcn.00499b20
push eax
call fcn.004083d8
call fcn.00407938
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x214]
cmp eax, 0xfa
jbe 0x49b321
mov eax, ebx
call fcn.00404fc8
cmp eax, 0x64
jge 0x49b321
cmp dword [0xf733a4], 0
je 0x49b321
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x1016
call fcn.00408428
cmp dword [ebp - 8], 0
je 0x49b321
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x1018
call fcn.00408428
cmp dword [ebp - 8], 0
je 0x49b2e4
mov bl, 2
jmp 0x49b2ff
lea edx, [ebp - 0x20]
mov eax, dword [0xf805d4]
call fcn.0049e430
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x14]
jle 0x49b2fd
xor ebx, ebx
jmp 0x49b2ff
mov bl, 1
xor eax, eax
mov al, bl
mov eax, dword [eax*4 + 0xf734ac]
or eax, 0x40000
push eax
push 0x64
mov eax, dword [ebp - 4]
call fcn.00499b20
push eax
call dword [0xf733a4]
mov eax, dword [0xf7814c]
mov eax, dword [eax]
mov edx, dword [eax + 0x30]
mov eax, dword [ebp - 4]
call fcn.00497254
push 4
mov eax, dword [ebp - 4]
call fcn.00499b20
push eax
call fcn.00408420
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x7c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xf26778
call fcn.00407938
mov edx, dword [ebp - 4]
mov dword [edx + 0x214], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x210], 0
ret
Function at 0x4032a0
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x405076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x405258], eax
mov dword [0x4051e0], 0x402b80
mov dword [0x4051dc], 2
jmp 0x4032d0
mov dword [0x4051e4], 0
mov dword [0x4051e8], 0
mov dword [0x4051d8], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x4051ec], eax
mov dword [0x405200], 0x404080
mov dword [0x4051f8], 0xf
mov dword [0x40506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x4051f0], eax
mov dword [0x405204], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x4051f4], eax
push 0x4051d8
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x40506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x405250], eax
push 5
push dword [0x405250]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x405250]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x4033a3
push 0
push 0
push 0
push 0x405208
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x4033d0
push 0x405208
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x405208
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x4033a3
mov eax, dword [0x405210]
jmp 0x4033dd
call 0x402474
ret

Function at 0x429703
Capabilities:
Resolve function by parsing pe exports

Disassembly:
not edx
not edx
mov eax, 0
cld
clc
nop
cld
not ebp
not ebp
cld
dec esp
inc esp
cld
push eax
nop
sahf
wait
mov ch, ch
not dh
not dh
imul eax, eax, 0x10
stc
xchg dword [esp], eax
jmp 0x4295b6
add al, dl
lea edx, [edx + ebx]
sub cl, 0x31
push dword [edx + 0x20]
pop esi
lea esi, [ebx + esi]
jmp 0x42972c
cmp dh, 0x94
add esi, ebx
clc
ret 4
sahf
cmc
sub dword [esp], eax
cld
movzx eax, byte [edi]
sub edi, 0xffffffff
jmp 0x4297b3
mov edi, dword [edx + 0x1c]
cmp eax, 0xffffffa2
not eax
adc eax, 0xe68ae329
mov eax, 0x334a8761
cmp ah, 2
mov esi, dword [edx + 0x24]
dec dh
cld
add esi, ebx
xchg edx, edx
movzx eax, word [esi + ecx*2]
jmp 0x429671
mov dl, dh
add edi, ebx
mov esi, dword [edi + eax*4]
jmp 0x4295ad
lea ecx, [ecx]
not esi
not esi
not bl
not bl
jne 0x4250d3
xchg edx, edx
xchg edx, edx
lea ecx, [ecx]
xor eax, 0x69521502
jmp 0x4298e8
ret
push dword [ebx + 0x3c]
mov edx, ecx
cmp cl, 0xb8
xchg ecx, edi
xchg ecx, esi
nop
lahf
cld
sbb al, bl
pop eax
mov edi, ecx
mov edx, dword [eax + ebx + 0x78]
jmp 0x4294cc
add ecx, 1
cmp edi, 0xffffffa9
lodsd eax, dword [esi]
jmp 0x42979e
push 0xffffffffffffffff
xchg ah, al
cmp ah, dl
xchg edi, edi
not al
mov edi, esi
and al, dh
pop ecx
jmp 0x429720
lea edi, [eax + ebx]
xchg edx, ebp
xchg edx, ebp
cmp ecx, dword [edx + 0x18]
je 0x429700
jmp 0x4250be
sub dword [esp], eax
pop eax
test byte [edi], 0xff
jmp 0x429697
nop
sub eax, dword [esp + 4]
jne 0x429720
jmp 0x429617