joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c1def
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
sub edi, 0xfa80
add edi, 0xa5c8
pop edi
push ebx
push eax
add esp, 4
xor ebx, 0x16715
pop ebx
cmp dword [ebp - 0xc2c], 0
jne 0x4c1c1e
mov dword [ebp - 0x6ec], 0
jmp 0x4c1e7e
mov ecx, dword [ebp - 0xc2c]
mov dword [ebp - 0x4d8], ecx
push esi
sub esi, 0x7df3
xor esi, 0x176fe
jmp 0x4c1c3c
pop esi
push edi
push ebx
add esp, 4
xor edi, 0x17ec5
pop edi
push ecx
call 0x4c1c58
add byte [eax], bh
dec esp
cmp eax, 0x453e4646
inc esi
add esp, 4
pop ecx
lea edx, [ebp - 0x16cc]
mov dword [ebp - 0xc28], edx
mov eax, dword [ebp - 0x4d8]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc24], ecx
xor edx, edx
mov word [ebp - 0x1fc], dx
xor eax, eax
mov word [ebp - 0x104], ax
push eax
push edi
add esp, 4
add eax, 0x11fe6
pop eax
push edx
push edx
add esp, 4
and edx, 0x3ee3
add edx, 0xb0
pop edx
push esi
and esi, 0x49ec
jmp 0x4c1cb4
sub esi, 0x682
pop esi
mov ecx, dword [ebp - 0xc24]
mov dx, word [ecx]
mov word [ebp - 0xf82], dx
mov eax, dword [ebp - 0xc24]
add eax, 2
mov dword [ebp - 0xc24], eax
mov cx, word [ebp - 0xf82]
mov word [ebp - 0x1fc], cx
mov edx, dword [ebp - 0xc28]
mov ax, word [edx]
mov word [ebp - 0xf84], ax
mov ecx, dword [ebp - 0xc28]
add ecx, 2
mov dword [ebp - 0xc28], ecx
mov dx, word [ebp - 0xf84]
mov word [ebp - 0x104], dx
push edi
jmp 0x4c1d1c
sub edi, 0xc046
or edi, 0x10f88
pop edi
push edx
push esi
add esp, 4
and edx, 0x18644
or edx, 0x90b9
add edx, 0x6ac5
sub edx, 0x131df
pop edx
movzx eax, word [ebp - 0x104]
test eax, eax
jne 0x4c1d6a
movzx ecx, word [ebp - 0x1fc]
movzx edx, word [ebp - 0x104]
sub ecx, edx
mov dword [ebp - 0x14e4], ecx
jmp 0x4c1dcd
movzx eax, word [ebp - 0x1fc]
movzx ecx, word [ebp - 0x104]
cmp eax, ecx
je 0x4c1c89
movzx edx, word [ebp - 0x1fc]
xor edx, 0x20
movzx eax, word [ebp - 0x104]
cmp edx, eax
je 0x4c1c89
movzx ecx, word [ebp - 0x1fc]
movzx edx, word [ebp - 0x104]
cmp ecx, edx
jge 0x4c1db7
mov dword [ebp - 0x14e0], 0xffffffff
jmp 0x4c1dc1
mov dword [ebp - 0x14e0], 1
mov eax, dword [ebp - 0x14e0]
mov dword [ebp - 0x14e4], eax
cmp dword [ebp - 0x14e4], 0
jne 0x4c1e16
push ebx
push esi
add esp, 4
sub ebx, 0x16def
call 0x4c1def
add byte [esp + eax*2], dh
cmp dword [eax + 0x4d], eax
dec ecx
cmp dword ss:[ebx + 0x525b04c4], eax
call 0x4c1e04
add byte [edx], dh
cmp eax, 0x49464e3e
dec esi
dec ebx
inc edi
add esp, 4
pop edx
mov ecx, dword [ebp - 0x4d8]
mov dword [ebp - 0x6ec], ecx
jmp 0x4c1e7e
push esi
sub esi, 0x7b82
call 0x4c1e29
add byte [ecx], bh
cmp dword ds:[ecx], edi
cmp eax, 0x4c4834f
call 0x4c1e3c
add byte [edi + 0x40], cl
cmp al, 0x3e
cmp ecx, dword [ebx + 0x44]
cmp al, 0x36
cmp dword [ebx + 0x525e04c4], eax
xor edx, 0x25a2
pop edx
mov edx, dword [ebp - 0x4d8]
mov eax, dword [edx]
mov dword [ebp - 0x4d8], eax
mov ecx, dword [ebp - 0x4d8]
cmp ecx, dword [ebp - 0xc2c]
je 0x4c1e74
mov edx, dword [ebp - 0x4d8]
cmp dword [edx + 0x30], 0
jne 0x4c1c2a
mov dword [ebp - 0x6ec], 0
Function at 0x4c1e04
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
sub edi, 0xfa80
add edi, 0xa5c8
pop edi
push ebx
push eax
add esp, 4
xor ebx, 0x16715
pop ebx
cmp dword [ebp - 0xc2c], 0
jne 0x4c1c1e
mov dword [ebp - 0x6ec], 0
jmp 0x4c1e7e
mov ecx, dword [ebp - 0xc2c]
mov dword [ebp - 0x4d8], ecx
push esi
sub esi, 0x7df3
xor esi, 0x176fe
jmp 0x4c1c3c
pop esi
push edi
push ebx
add esp, 4
xor edi, 0x17ec5
pop edi
push ecx
call 0x4c1c58
add byte [eax], bh
dec esp
cmp eax, 0x453e4646
inc esi
add esp, 4
pop ecx
lea edx, [ebp - 0x16cc]
mov dword [ebp - 0xc28], edx
mov eax, dword [ebp - 0x4d8]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc24], ecx
xor edx, edx
mov word [ebp - 0x1fc], dx
xor eax, eax
mov word [ebp - 0x104], ax
push eax
push edi
add esp, 4
add eax, 0x11fe6
pop eax
push edx
push edx
add esp, 4
and edx, 0x3ee3
add edx, 0xb0
pop edx
push esi
and esi, 0x49ec
jmp 0x4c1cb4
sub esi, 0x682
pop esi
mov ecx, dword [ebp - 0xc24]
mov dx, word [ecx]
mov word [ebp - 0xf82], dx
mov eax, dword [ebp - 0xc24]
add eax, 2
mov dword [ebp - 0xc24], eax
mov cx, word [ebp - 0xf82]
mov word [ebp - 0x1fc], cx
mov edx, dword [ebp - 0xc28]
mov ax, word [edx]
mov word [ebp - 0xf84], ax
mov ecx, dword [ebp - 0xc28]
add ecx, 2
mov dword [ebp - 0xc28], ecx
mov dx, word [ebp - 0xf84]
mov word [ebp - 0x104], dx
push edi
jmp 0x4c1d1c
sub edi, 0xc046
or edi, 0x10f88
pop edi
push edx
push esi
add esp, 4
and edx, 0x18644
or edx, 0x90b9
add edx, 0x6ac5
sub edx, 0x131df
pop edx
movzx eax, word [ebp - 0x104]
test eax, eax
jne 0x4c1d6a
movzx ecx, word [ebp - 0x1fc]
movzx edx, word [ebp - 0x104]
sub ecx, edx
mov dword [ebp - 0x14e4], ecx
jmp 0x4c1dcd
movzx eax, word [ebp - 0x1fc]
movzx ecx, word [ebp - 0x104]
cmp eax, ecx
je 0x4c1c89
movzx edx, word [ebp - 0x1fc]
xor edx, 0x20
movzx eax, word [ebp - 0x104]
cmp edx, eax
je 0x4c1c89
movzx ecx, word [ebp - 0x1fc]
movzx edx, word [ebp - 0x104]
cmp ecx, edx
jge 0x4c1db7
mov dword [ebp - 0x14e0], 0xffffffff
jmp 0x4c1dc1
mov dword [ebp - 0x14e0], 1
mov eax, dword [ebp - 0x14e0]
mov dword [ebp - 0x14e4], eax
cmp dword [ebp - 0x14e4], 0
jne 0x4c1e16
push ebx
push esi
add esp, 4
sub ebx, 0x16def
call 0x4c1def
add byte [esp + eax*2], dh
cmp dword [eax + 0x4d], eax
dec ecx
cmp dword ss:[ebx + 0x525b04c4], eax
call 0x4c1e04
add byte [edx], dh
cmp eax, 0x49464e3e
dec esi
dec ebx
inc edi
add esp, 4
pop edx
mov ecx, dword [ebp - 0x4d8]
mov dword [ebp - 0x6ec], ecx
jmp 0x4c1e7e
push esi
sub esi, 0x7b82
call 0x4c1e29
add byte [ecx], bh
cmp dword ds:[ecx], edi
cmp eax, 0x4c4834f
call 0x4c1e3c
add byte [edi + 0x40], cl
cmp al, 0x3e
cmp ecx, dword [ebx + 0x44]
cmp al, 0x36
cmp dword [ebx + 0x525e04c4], eax
xor edx, 0x25a2
pop edx
mov edx, dword [ebp - 0x4d8]
mov eax, dword [edx]
mov dword [ebp - 0x4d8], eax
mov ecx, dword [ebp - 0x4d8]
cmp ecx, dword [ebp - 0xc2c]
je 0x4c1e74
mov edx, dword [ebp - 0x4d8]
cmp dword [edx + 0x30], 0
jne 0x4c1c2a
mov dword [ebp - 0x6ec], 0
Function at 0x4c1e29
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
sub edi, 0xfa80
add edi, 0xa5c8
pop edi
push ebx
push eax
add esp, 4
xor ebx, 0x16715
pop ebx
cmp dword [ebp - 0xc2c], 0
jne 0x4c1c1e
mov dword [ebp - 0x6ec], 0
jmp 0x4c1e7e
mov ecx, dword [ebp - 0xc2c]
mov dword [ebp - 0x4d8], ecx
push esi
sub esi, 0x7df3
xor esi, 0x176fe
jmp 0x4c1c3c
pop esi
push edi
push ebx
add esp, 4
xor edi, 0x17ec5
pop edi
push ecx
call 0x4c1c58
add byte [eax], bh
dec esp
cmp eax, 0x453e4646
inc esi
add esp, 4
pop ecx
lea edx, [ebp - 0x16cc]
mov dword [ebp - 0xc28], edx
mov eax, dword [ebp - 0x4d8]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc24], ecx
xor edx, edx
mov word [ebp - 0x1fc], dx
xor eax, eax
mov word [ebp - 0x104], ax
push eax
push edi
add esp, 4
add eax, 0x11fe6
pop eax
push edx
push edx
add esp, 4
and edx, 0x3ee3
add edx, 0xb0
pop edx
push esi
and esi, 0x49ec
jmp 0x4c1cb4
sub esi, 0x682
pop esi
mov ecx, dword [ebp - 0xc24]
mov dx, word [ecx]
mov word [ebp - 0xf82], dx
mov eax, dword [ebp - 0xc24]
add eax, 2
mov dword [ebp - 0xc24], eax
mov cx, word [ebp - 0xf82]
mov word [ebp - 0x1fc], cx
mov edx, dword [ebp - 0xc28]
mov ax, word [edx]
mov word [ebp - 0xf84], ax
mov ecx, dword [ebp - 0xc28]
add ecx, 2
mov dword [ebp - 0xc28], ecx
mov dx, word [ebp - 0xf84]
mov word [ebp - 0x104], dx
push edi
jmp 0x4c1d1c
sub edi, 0xc046
or edi, 0x10f88
pop edi
push edx
push esi
add esp, 4
and edx, 0x18644
or edx, 0x90b9
add edx, 0x6ac5
sub edx, 0x131df
pop edx
movzx eax, word [ebp - 0x104]
test eax, eax
jne 0x4c1d6a
movzx ecx, word [ebp - 0x1fc]
movzx edx, word [ebp - 0x104]
sub ecx, edx
mov dword [ebp - 0x14e4], ecx
jmp 0x4c1dcd
movzx eax, word [ebp - 0x1fc]
movzx ecx, word [ebp - 0x104]
cmp eax, ecx
je 0x4c1c89
movzx edx, word [ebp - 0x1fc]
xor edx, 0x20
movzx eax, word [ebp - 0x104]
cmp edx, eax
je 0x4c1c89
movzx ecx, word [ebp - 0x1fc]
movzx edx, word [ebp - 0x104]
cmp ecx, edx
jge 0x4c1db7
mov dword [ebp - 0x14e0], 0xffffffff
jmp 0x4c1dc1
mov dword [ebp - 0x14e0], 1
mov eax, dword [ebp - 0x14e0]
mov dword [ebp - 0x14e4], eax
cmp dword [ebp - 0x14e4], 0
jne 0x4c1e16
push ebx
push esi
add esp, 4
sub ebx, 0x16def
call 0x4c1def
add byte [esp + eax*2], dh
cmp dword [eax + 0x4d], eax
dec ecx
cmp dword ss:[ebx + 0x525b04c4], eax
call 0x4c1e04
add byte [edx], dh
cmp eax, 0x49464e3e
dec esi
dec ebx
inc edi
add esp, 4
pop edx
mov ecx, dword [ebp - 0x4d8]
mov dword [ebp - 0x6ec], ecx
jmp 0x4c1e7e
push esi
sub esi, 0x7b82
call 0x4c1e29
add byte [ecx], bh
cmp dword ds:[ecx], edi
cmp eax, 0x4c4834f
call 0x4c1e3c
add byte [edi + 0x40], cl
cmp al, 0x3e
cmp ecx, dword [ebx + 0x44]
cmp al, 0x36
cmp dword [ebx + 0x525e04c4], eax
xor edx, 0x25a2
pop edx
mov edx, dword [ebp - 0x4d8]
mov eax, dword [edx]
mov dword [ebp - 0x4d8], eax
mov ecx, dword [ebp - 0x4d8]
cmp ecx, dword [ebp - 0xc2c]
je 0x4c1e74
mov edx, dword [ebp - 0x4d8]
cmp dword [edx + 0x30], 0
jne 0x4c1c2a
mov dword [ebp - 0x6ec], 0
Function at 0x4c1e3c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
sub edi, 0xfa80
add edi, 0xa5c8
pop edi
push ebx
push eax
add esp, 4
xor ebx, 0x16715
pop ebx
cmp dword [ebp - 0xc2c], 0
jne 0x4c1c1e
mov dword [ebp - 0x6ec], 0
jmp 0x4c1e7e
mov ecx, dword [ebp - 0xc2c]
mov dword [ebp - 0x4d8], ecx
push esi
sub esi, 0x7df3
xor esi, 0x176fe
jmp 0x4c1c3c
pop esi
push edi
push ebx
add esp, 4
xor edi, 0x17ec5
pop edi
push ecx
call 0x4c1c58
add byte [eax], bh
dec esp
cmp eax, 0x453e4646
inc esi
add esp, 4
pop ecx
lea edx, [ebp - 0x16cc]
mov dword [ebp - 0xc28], edx
mov eax, dword [ebp - 0x4d8]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc24], ecx
xor edx, edx
mov word [ebp - 0x1fc], dx
xor eax, eax
mov word [ebp - 0x104], ax
push eax
push edi
add esp, 4
add eax, 0x11fe6
pop eax
push edx
push edx
add esp, 4
and edx, 0x3ee3
add edx, 0xb0
pop edx
push esi
and esi, 0x49ec
jmp 0x4c1cb4
sub esi, 0x682
pop esi
mov ecx, dword [ebp - 0xc24]
mov dx, word [ecx]
mov word [ebp - 0xf82], dx
mov eax, dword [ebp - 0xc24]
add eax, 2
mov dword [ebp - 0xc24], eax
mov cx, word [ebp - 0xf82]
mov word [ebp - 0x1fc], cx
mov edx, dword [ebp - 0xc28]
mov ax, word [edx]
mov word [ebp - 0xf84], ax
mov ecx, dword [ebp - 0xc28]
add ecx, 2
mov dword [ebp - 0xc28], ecx
mov dx, word [ebp - 0xf84]
mov word [ebp - 0x104], dx
push edi
jmp 0x4c1d1c
sub edi, 0xc046
or edi, 0x10f88
pop edi
push edx
push esi
add esp, 4
and edx, 0x18644
or edx, 0x90b9
add edx, 0x6ac5
sub edx, 0x131df
pop edx
movzx eax, word [ebp - 0x104]
test eax, eax
jne 0x4c1d6a
movzx ecx, word [ebp - 0x1fc]
movzx edx, word [ebp - 0x104]
sub ecx, edx
mov dword [ebp - 0x14e4], ecx
jmp 0x4c1dcd
movzx eax, word [ebp - 0x1fc]
movzx ecx, word [ebp - 0x104]
cmp eax, ecx
je 0x4c1c89
movzx edx, word [ebp - 0x1fc]
xor edx, 0x20
movzx eax, word [ebp - 0x104]
cmp edx, eax
je 0x4c1c89
movzx ecx, word [ebp - 0x1fc]
movzx edx, word [ebp - 0x104]
cmp ecx, edx
jge 0x4c1db7
mov dword [ebp - 0x14e0], 0xffffffff
jmp 0x4c1dc1
mov dword [ebp - 0x14e0], 1
mov eax, dword [ebp - 0x14e0]
mov dword [ebp - 0x14e4], eax
cmp dword [ebp - 0x14e4], 0
jne 0x4c1e16
push ebx
push esi
add esp, 4
sub ebx, 0x16def
call 0x4c1def
add byte [esp + eax*2], dh
cmp dword [eax + 0x4d], eax
dec ecx
cmp dword ss:[ebx + 0x525b04c4], eax
call 0x4c1e04
add byte [edx], dh
cmp eax, 0x49464e3e
dec esi
dec ebx
inc edi
add esp, 4
pop edx
mov ecx, dword [ebp - 0x4d8]
mov dword [ebp - 0x6ec], ecx
jmp 0x4c1e7e
push esi
sub esi, 0x7b82
call 0x4c1e29
add byte [ecx], bh
cmp dword ds:[ecx], edi
cmp eax, 0x4c4834f
call 0x4c1e3c
add byte [edi + 0x40], cl
cmp al, 0x3e
cmp ecx, dword [ebx + 0x44]
cmp al, 0x36
cmp dword [ebx + 0x525e04c4], eax
xor edx, 0x25a2
pop edx
mov edx, dword [ebp - 0x4d8]
mov eax, dword [edx]
mov dword [ebp - 0x4d8], eax
mov ecx, dword [ebp - 0x4d8]
cmp ecx, dword [ebp - 0xc2c]
je 0x4c1e74
mov edx, dword [ebp - 0x4d8]
cmp dword [edx + 0x30], 0
jne 0x4c1c2a
mov dword [ebp - 0x6ec], 0
Function at 0x4c3134
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
and edi, 0x36d0
pop edi
push ebx
push ebx
add esp, 4
xor ebx, 0xfee5
jmp 0x4c3152
pop ebx
cmp dword [ebp - 0xc58], 0
jne 0x4c316b
mov dword [ebp - 0x710], 0
jmp 0x4c33b6
mov edx, dword [ebp - 0xc58]
mov dword [ebp - 0x4e8], edx
push ecx
and ecx, 0x59bb
or ecx, 0x15dbe
pop ecx
push eax
push edx
add esp, 4
jmp 0x4c3190
or eax, 0x15755
and eax, 0xee91
pop eax
push ecx
push edi
add esp, 4
xor ecx, 0xdb33
pop ecx
lea eax, [ebp - 0x16e8]
mov dword [ebp - 0xc54], eax
mov ecx, dword [ebp - 0x4e8]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc50], edx
xor eax, eax
mov word [ebp - 0x208], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
push ebx
push edi
add esp, 4
sub ebx, 0x2207
xor ebx, 0x1ddd
pop ebx
push ecx
push ebx
add esp, 4
and ecx, 0xba39
jmp 0x4c31f6
jmp 0x4c31fe
xor ecx, 0x16e98
pop ecx
mov edx, dword [ebp - 0xc50]
mov ax, word [edx]
mov word [ebp - 0xf8e], ax
mov ecx, dword [ebp - 0xc50]
add ecx, 2
mov dword [ebp - 0xc50], ecx
mov dx, word [ebp - 0xf8e]
mov word [ebp - 0x208], dx
mov eax, dword [ebp - 0xc54]
mov cx, word [eax]
mov word [ebp - 0xf90], cx
mov edx, dword [ebp - 0xc54]
add edx, 2
mov dword [ebp - 0xc54], edx
mov ax, word [ebp - 0xf90]
mov word [ebp - 0x3c], ax
push edi
push edx
add esp, 4
add edi, 0x264f
jmp 0x4c326c
pop edi
push ecx
call 0x4c327e
add byte [0x44325045], bh
inc edi
cmp eax, 0x834f3a4a
les eax, [ecx + eax*4]
jmp 0x4ca767
leave
mov ch, ch
test dword [edx], 0x88c96f02
out dx, al
test dword [edx], 0x88c94602
out dx, eax
test dword [edx], 0x88c97502
invalid
Function at 0x4c327e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
and edi, 0x36d0
pop edi
push ebx
push ebx
add esp, 4
xor ebx, 0xfee5
jmp 0x4c3152
pop ebx
cmp dword [ebp - 0xc58], 0
jne 0x4c316b
mov dword [ebp - 0x710], 0
jmp 0x4c33b6
mov edx, dword [ebp - 0xc58]
mov dword [ebp - 0x4e8], edx
push ecx
and ecx, 0x59bb
or ecx, 0x15dbe
pop ecx
push eax
push edx
add esp, 4
jmp 0x4c3190
or eax, 0x15755
and eax, 0xee91
pop eax
push ecx
push edi
add esp, 4
xor ecx, 0xdb33
pop ecx
lea eax, [ebp - 0x16e8]
mov dword [ebp - 0xc54], eax
mov ecx, dword [ebp - 0x4e8]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc50], edx
xor eax, eax
mov word [ebp - 0x208], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
push ebx
push edi
add esp, 4
sub ebx, 0x2207
xor ebx, 0x1ddd
pop ebx
push ecx
push ebx
add esp, 4
and ecx, 0xba39
jmp 0x4c31f6
jmp 0x4c31fe
xor ecx, 0x16e98
pop ecx
mov edx, dword [ebp - 0xc50]
mov ax, word [edx]
mov word [ebp - 0xf8e], ax
mov ecx, dword [ebp - 0xc50]
add ecx, 2
mov dword [ebp - 0xc50], ecx
mov dx, word [ebp - 0xf8e]
mov word [ebp - 0x208], dx
mov eax, dword [ebp - 0xc54]
mov cx, word [eax]
mov word [ebp - 0xf90], cx
mov edx, dword [ebp - 0xc54]
add edx, 2
mov dword [ebp - 0xc54], edx
mov ax, word [ebp - 0xf90]
mov word [ebp - 0x3c], ax
push edi
push edx
add esp, 4
add edi, 0x264f
jmp 0x4c326c
pop edi
push ecx
call 0x4c327e
add byte [0x44325045], bh
inc edi
cmp eax, 0x834f3a4a
les eax, [ecx + eax*4]
jmp 0x4ca767
leave
mov ch, ch
test dword [edx], 0x88c96f02
out dx, al
test dword [edx], 0x88c94602
out dx, eax
test dword [edx], 0x88c97502
invalid

Function at 0x4c3368
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ecx
push ebx
or ebx, 0xbedc
sub ebx, 0x2dc5
xor ebx, 0xe985
pop ebx
mov eax, dword [ebp - 0x4e8]
mov ecx, dword [eax]
mov dword [ebp - 0x4e8], ecx
mov edx, dword [ebp - 0x4e8]
cmp edx, dword [ebp - 0xc58]
je 0x4c33ac
mov eax, dword [ebp - 0x4e8]
cmp dword [eax + 0x30], 0
jne 0x4c3177
mov dword [ebp - 0x710], 0
Function at 0x4e62b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.0040b278
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov edx, eax
mov eax, ebx
call fcn.004e5d84
test al, al
jne 0x4e6311
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x6ce1d4]
mov dl, 1
mov eax, dword [0x4e4ab8]
call fcn.00429100
call fcn.004098c4
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.004e5cec
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4ed6cc
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4ed6d2
ret
Function at 0x1000e150
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x10091600]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x18], 0x231dc347
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
sub eax, 0x86f80d0a
je 0x1000e2f7
jmp 0x1000e18b
mov eax, dword [ebp - 0x24]
sub eax, 0xa70b9fcf
je 0x1000e2a3
jmp 0x1000e19e
mov eax, dword [ebp - 0x24]
sub eax, 0x36be5b4
je 0x1000e2af
jmp 0x1000e1b1
mov eax, dword [ebp - 0x24]
sub eax, 0x231dc347
je 0x1000e1dc
jmp 0x1000e1c4
mov eax, dword [ebp - 0x24]
sub eax, 0x3c5efd8b
je 0x1000e24f
jmp 0x1000e1d7
jmp 0x1000e304
mov ecx, dword [0x10092ad4]
mov eax, dword [0x10092ad0]
mov edx, ecx
sub edx, 0x3ec0326e
sub edx, 1
add edx, 0x3ec0326e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x86f80d0a
mov ecx, 0x3c5efd8b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x18], eax
jmp 0x1000e304
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [0x10092ad4]
mov ecx, dword [0x10092ad0]
mov edx, eax
add edx, 0x7c290715
sub edx, 1
sub edx, 0x7c290715
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x86f80d0a
mov ecx, 0xa70b9fcf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x18], eax
jmp 0x1000e304
mov dword [ebp - 0x18], 0x36be5b4
jmp 0x1000e304
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
pop eax
push eax
mov eax, eax
xor eax, 0x85
nop
mov ecx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x14]
not byte [edi]
pop eax
push eax
mov eax, eax
xor eax, 0x85
nop
add byte [edi], 0x63
sub byte [edi], 0x27
pop eax
push eax
mov eax, eax
xor eax, 0x85
nop
imul byte [edi]
inc edi
loop 0x1000e2c5
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1002a130
add esp, 0x1c
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], 0x3c5efd8b
jmp 0x1000e175
Function at 0x1002f14a
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1002f189
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1002f189
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002f189
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1002f189
cmp dword [ecx + 0x74], 0xe
jbe 0x1002f189
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10031b14
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10031bb1
push ebx
push esi
call fcn.10031add
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10031a71
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10031b5e
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10031bb0
push edi
push eax
call fcn.10030412
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10031b7e
call fcn.10030460
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10031baf
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10031a71
add esp, 0x20
test eax, eax
jne 0x10031b9d
push edi
call fcn.10030460
jmp 0x10031ba5
push ebx
call fcn.10030460
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10031e1e
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1003a3e0
push 0x1003a3d8
push str.FlsAlloc
push 0x1f
call fcn.10031d3a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10031e52
push dword [ebp + 8]
mov ecx, esi
call dword [0x10038150]
call esi
jmp 0x10031e58
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10031e9c
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1003a3f0
push 0x1003a3e8
push str.FlsGetValue
push 0x21
call fcn.10031d3a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10031ed3
push dword [ebp + 8]
mov ecx, esi
call dword [0x10038150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10031edb
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1003a3f8
push 0x1003a3f0
push str.FlsSetValue
push 0x22
call fcn.10031d3a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10031f15
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10038150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10037420
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1003744d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1003744d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret