joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409cbd
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
lea eax, [ebp - 4]
push esi
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x409cfa
push eax
push dword [ebp + 0xc]
push str.GPC_RegSetValue:_RegCreateKeyEx__s_Failed__Error___d
call fcn.0040ea07
add esp, 0xc
xor eax, eax
jmp 0x409d46
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 0x14]
push 1
push esi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x409d3a
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push str.GPC_RegSetValue:_RegSetValueEx___s___s___s_Failed__Error___d
call fcn.0040ea07
add esp, 0x14
jmp 0x409cf6
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop esi
leave
ret

Function at 0x409d49
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
lea eax, [ebp - 4]
push esi
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x409d86
push eax
push dword [ebp + 0xc]
push str.GPC_RegSetValue:_RegCreateKeyEx__s_Failed__Error___d
call fcn.0040ea07
add esp, 0xc
xor eax, eax
jmp 0x409dc4
push 4
lea eax, [ebp + 0x14]
push eax
push 4
push esi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x409db8
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push str.GPC_RegSetValue:_RegSetValueEx___s___s___d_Failed__Error___d
call fcn.0040ea07
add esp, 0x14
jmp 0x409d82
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop esi
leave
ret

Function at 0x40c5bc
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4be3b8]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x4be0bc], 0
je 0x40c5e0
xor eax, eax
inc eax
jmp 0x40c676
push esi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00465e50
add esp, 0xc
mov eax, 0x4be034
cmp dword [0x4be048], 8
mov esi, 0x104
cmovae eax, dword [0x4be034]
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
push 0x4948f0
push str.CAN_USE_MSI_PACKAGE_PATH
push 0x494870
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0046954d
pop ecx
pop ecx
test eax, eax
jg 0x40c644
xor eax, eax
jmp 0x40c675
lea eax, [ebp - 0x20c]
mov esi, 0x4be0ac
push eax
mov ecx, esi
call fcn.0040f8cf
cmp dword [0x4be0c0], 8
cmovae esi, dword [0x4be0ac]
push esi
push str.atinst.exe__GetCanUserMsiPath_path_s
call fcn.0040ea07
pop ecx
xor eax, eax
pop ecx
inc eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044c567
leave
ret
Function at 0x40cb22
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48a7f2
mov eax, dword fs:[0]
push eax
mov eax, 0x1050
call fcn.0044ca80
mov eax, dword [0x4be3b8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x14]
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
push 0x1000
mov dword [ebp - 0x105c], eax
lea eax, [ebp - 0x1010]
push 0
push eax
call fcn.00465e50
add esp, 0xc
mov eax, 0x4be034
cmp dword [0x4be048], 8
cmovae eax, dword [0x4be034]
push eax
push 0x800
lea eax, [ebp - 0x1010]
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp dword [ebp + 0x18], 0
je 0x40cbb9
cmp word [ebp - 0x1010], 0
je 0x40ccaf
mov esi, dword [ebp - 0x105c]
lea eax, [ebp - 0x1040]
xor ebx, ebx
push ebx
push esi
push eax
call fcn.0041944d
push ebx
lea eax, [ebp - 0x1010]
mov dword [ebp - 4], ebx
push eax
lea eax, [ebp - 0x1028]
push eax
call fcn.0041944d
add esp, 0x18
push esi
lea ecx, [ebp - 0x1058]
mov byte [ebp - 4], 1
call fcn.00407faf
lea eax, [ebp - 0x1058]
mov byte [ebp - 4], 2
push eax
call fcn.00427ff5
pop ecx
lea ecx, [ebp - 0x1058]
mov byte [ebp - 4], 1
mov esi, eax
call fcn.00406a00
test esi, esi
je 0x40cc5b
lea eax, [ebp - 0x1028]
push eax
lea eax, [ebp - 0x1058]
push eax
call fcn.00415ac8
pop ecx
pop ecx
lea ecx, [ebp - 0x1028]
cmp ecx, eax
je 0x40cc50
mov byte [ebp - 0x105c], bl
push dword [ebp - 0x105c]
push eax
call fcn.00404db0
lea ecx, [ebp - 0x1058]
call fcn.00403060
mov esi, dword [0x4c1220]
test esi, esi
je 0x40cc99
cmp dword [ebp - 0x1014], 0x10
lea ecx, [ebp - 0x1028]
lea eax, [ebp - 0x1040]
cmovae ecx, dword [ebp - 0x1028]
cmp dword [ebp - 0x102c], 0x10
push ecx
cmovae eax, dword [ebp - 0x1040]
mov ecx, esi
push eax
call dword [0x49356c]
call esi
lea ecx, [ebp - 0x1028]
call fcn.00403060
lea ecx, [ebp - 0x1040]
call fcn.00403060
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044c567
leave
ret
Function at 0x416468
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x4164c8
push ebx
mov edx, 0x10000000
cmp eax, 0x7c
je 0x4164c7
cmp eax, 0x29
jne 0x4164cc
cmp dword [esi + 0x10], 0
jne 0x4164c7
test dword [esi + 0x50], edx
je 0x4165c4
cmp eax, 0x5d
jne 0x4164a2
test dword [esi + 0x50], edx
je 0x4165b8
movzx eax, byte [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.00415df4
mov ecx, esi
call fcn.00417738
mov ecx, esi
call fcn.00417776
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x416476
pop ebx
mov al, cl
pop esi
ret
cmp eax, 0x2e
jne 0x4164dd
push 5
lea ecx, [esi + 0x24]
call fcn.004176fa
jmp 0x4164af
cmp eax, 0x5c
jne 0x416529
mov ecx, esi
call fcn.00417738
test byte [esi + 0x50], 0x80
je 0x416520
mov al, byte [esi + 0x48]
cmp al, 0x62
jne 0x416509
push 4
lea ecx, [esi + 0x24]
call fcn.004176fa
mov ecx, esi
call fcn.00417738
jmp 0x4164bd
cmp al, 0x42
jne 0x416520
push 4
lea ecx, [esi + 0x24]
call fcn.004176fa
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x416500
mov ecx, esi
call fcn.004165ce
jmp 0x4164b6
cmp eax, 0x5b
jne 0x41654c
mov ecx, esi
call fcn.00417738
mov ecx, esi
call fcn.00416a62
push 4
push 0x5d
mov ecx, esi
call fcn.00417353
jmp 0x4164b6
cmp eax, 0x28
jne 0x416579
mov ecx, esi
call fcn.00417738
mov ecx, esi
call fcn.00417a8d
push 5
push 0x29
mov ecx, esi
mov bl, al
call fcn.00417353
test bl, bl
je 0x4164bd
jmp 0x4164b6
cmp eax, 0x5e
jne 0x416585
push 2
jmp 0x4164f8
cmp eax, 0x24
jne 0x416591
push 3
jmp 0x4164f8
cmp eax, 0x2a
je 0x4165bc
cmp eax, 0x2b
je 0x4165bc
cmp eax, 0x3f
je 0x4165bc
cmp eax, 0x7b
je 0x4165bc
cmp eax, 0x7d
jne 0x416494
test dword [esi + 0x50], edx
je 0x4165c0
jmp 0x4164a2
push 4
jmp 0x4165c6
push 0xa
jmp 0x4165c6
push 6
jmp 0x4165c6
push 5
mov ecx, esi
call fcn.0041731d
int3

Function at 0x41dc10
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041aed3
Function at 0x429b61
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
xor eax, eax
push esi
push eax
push esi
push 0x429ef0
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
test eax, eax
jne 0x429b94
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x499c98
call fcn.004141d6
pop ecx
pop ecx
xor eax, eax
pop esi
ret
mov eax, dword [esi]
pop esi
ret

Function at 0x429ba0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push esi
push str.JMT__CAsyncUrlCall::Destroy___begin...316
mov esi, ecx
call fcn.004141d6
pop ecx
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x429c47
cmp dword [ebp + 8], 0
push edi
mov edi, 0x2710
je 0x429bda
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 0x10]
je 0x429bda
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esi + 4]
push dword [ecx + 0xc]
mov dword [ecx + 0x14], 1
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi + 4]
push edi
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x429c0c
mov eax, dword [esi + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 4]
call fcn.00429a38
and dword [esi + 8], 0
mov edi, dword [esi + 4]
test edi, edi
je 0x429c30
mov ecx, edi
call fcn.00429a38
push 0x18
push edi
call fcn.0044c6c2
pop ecx
pop ecx
and dword [esi + 4], 0
mov ecx, esi
call fcn.0042994d
push str.JMT__CAsyncUrlCall::Destroy___end...
call fcn.004141d6
pop ecx
pop edi
pop esi
pop ebp
ret 4
Function at 0x43568e
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
xor edi, edi
mov dword [ebp - 8], ecx
cmp dword [ecx + 0x50], edi
je 0x4356a6
xor eax, eax
inc eax
jmp 0x43585f
push ebx
lea ebx, [ecx + 4]
cmp dword [ebx + 0x14], 8
mov eax, ebx
push esi
jb 0x4356b5
mov eax, dword [ebx]
push eax
push edi
mov esi, 0xf001f
push esi
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [ebp - 4], eax
test eax, eax
je 0x4356fa
push edi
push edi
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jne 0x4357b6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.jmtLog__init_shared_memory_failed_err_d
call fcn.004141bc
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
jmp 0x435845
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x43584e
cmp dword [ebx + 0x14], 8
mov eax, ebx
jb 0x435713
mov eax, dword [ebx]
push eax
push 0x8011c
push edi
push 4
push edi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 4], eax
test eax, eax
je 0x43585b
push edi
push edi
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
je 0x4356df
xor ecx, ecx
mov dword [esi + 8], 0x80000
mov eax, 0x11c
mov dword [esi + 0x114], edi
inc ecx
mov dword [esi], eax
mov dword [esi + 0x110], eax
mov eax, ebx
mov dword [esi + 0x118], ecx
mov dword [esi + 4], ecx
cmp dword [ebx + 0x14], 8
jb 0x435771
mov eax, dword [ebx]
push eax
push str._s_1
lea eax, [esi + 0x90]
push 0x80
push eax
call fcn.00406984
add esp, 0x10
cmp dword [ebx + 0x14], 8
jb 0x435793
mov ebx, dword [ebx]
push ebx
push str._s_2
lea eax, [esi + 0x10]
push 0x80
push eax
call fcn.00406984
mov ebx, dword [ebp - 8]
add esp, 0x10
mov dword [ebx + 0x68], 1
jmp 0x4357b9
mov ebx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov eax, 0x11c
cmp dword [esi], eax
jb 0x43581f
mov dword [ebx + 0x54], esi
mov eax, dword [esi + 0x110]
add eax, esi
mov dword [ebx + 0x50], ecx
mov dword [ebx + 0x58], eax
lea ecx, [ebx + 0x1c]
mov eax, dword [esi + 8]
mov dword [ebx + 0x64], eax
lea eax, [esi + 0x90]
push eax
call fcn.0040f8cf
lea eax, [esi + 0x10]
push eax
lea ecx, [ebx + 0x34]
call fcn.0040f8cf
cmp dword [ebx + 0x68], edi
jne 0x43581a
mov eax, 0x11c
cmp dword [esi], eax
je 0x43581a
push dword [esi + 4]
push 1
push dword [esi]
push eax
push str.jmtLog__compatible_mode_cbSize_d__d_version_d__d
call fcn.004141d6
add esp, 0x14
xor edi, edi
inc edi
jmp 0x43585b
push dword [esi]
push eax
push str.jmtLog__init_shared_memory_incompatible_expected_d_but_d
call fcn.004141bc
mov ebx, dword [ebp - 4]
add esp, 0xc
mov ecx, ebx
test esi, esi
je 0x435841
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, ebx
test ecx, ecx
je 0x43585b
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x43585b
push eax
push str.jmtLog__init_shared_memory_failed_err_d
call fcn.004141bc
pop ecx
pop ecx
pop esi
mov eax, edi
pop ebx
pop edi
leave
ret
Function at 0x43e449
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x43e456
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.0043e45c

Function at 0x43f95d
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
add esp, 4
and ebx, 0x5cbd
pop ebx
push esi
push ecx
add esp, 4
or esi, 0x6603
xor esi, 0x9f4b
pop esi
push eax
add eax, 0xd915
pop eax
mov dword [ebp - 0x10], 1
push eax
push edx
add esp, 4
and eax, 0xce4e
or eax, 0xc0a0
xor eax, 0x14ed0
add eax, 0xa6ce
pop eax
push edx
or edx, 0x101ca
pop edx
push ebx
push eax
add esp, 4
and ebx, 0x1593d
pop ebx
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push eax
push esi
add esp, 4
call 0x43f8f1
add byte [esi + 0x34], cl
cmp edi, dword ds:[eax]
dec ebp
inc ecx
dec ebp
add esp, 4
xor eax, 0x45e4
and eax, 0x206b
or eax, 0xd382
pop eax
push eax
jmp 0x43f90f
pop eax
push edx
push ebx
add esp, 4
and edx, 0x153b0
sub edx, 0x13579
sub edx, 0x14ad9
pop edx
push ebx
sub ebx, 0xebe7
pop ebx
push ebx
jmp 0x43f939
pop ebx
push esi
sub esi, 0xe3a8
pop esi
mov dword [ebp - 0x2c], 1
add byte [eax], al
add byte [edx - 0x7f], dl
ljmp 0x8e8
add byte [eax], al
add byte [eax], al
inc ecx
inc eax
dec edi
dec ebp
dec esp
cmp dword [esi], edi
add esp, 4
pop edx
push eax
push ebx
add esp, 4
sub eax, 0xc4ff
pop eax
push eax
sub eax, 0x1743e
sub eax, 0x7999
pop eax
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x138
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x43fb5c
mov ecx, dword [ebp - 0xfb0]
mov edx, dword [ebp - 0xfac]
mov dword [ebp - 0x152c], ecx
mov dword [ebp - 0x1528], edx
push esi
call 0x43fb84
add byte [0x38473f48], dh
dec edx
xor al, 0x83
les eax, [ecx + eax*4]
into
pop edx
daa
add dword [eax], eax
sub esi, 0x1680b
pop esi
push esi
push esi
add esp, 4
add esi, 0xbd26
sub esi, 0x17945
pop esi
push esi
jmp 0x43fbaf
or esi, 0x885a
sub esi, 0x13706
xor esi, 0x176fa
pop esi
push eax
push eax
add esp, 4
call 0x43fbd4
add byte [0x3f354d43], dh
dec ecx
cmp dword [ebx - 0x74a7fb3c], eax
inc ebp
rol byte [0x138], 1
Function at 0x43fb84
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
add esp, 4
and ebx, 0x5cbd
pop ebx
push esi
push ecx
add esp, 4
or esi, 0x6603
xor esi, 0x9f4b
pop esi
push eax
add eax, 0xd915
pop eax
mov dword [ebp - 0x10], 1
push eax
push edx
add esp, 4
and eax, 0xce4e
or eax, 0xc0a0
xor eax, 0x14ed0
add eax, 0xa6ce
pop eax
push edx
or edx, 0x101ca
pop edx
push ebx
push eax
add esp, 4
and ebx, 0x1593d
pop ebx
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push eax
push esi
add esp, 4
call 0x43f8f1
add byte [esi + 0x34], cl
cmp edi, dword ds:[eax]
dec ebp
inc ecx
dec ebp
add esp, 4
xor eax, 0x45e4
and eax, 0x206b
or eax, 0xd382
pop eax
push eax
jmp 0x43f90f
pop eax
push edx
push ebx
add esp, 4
and edx, 0x153b0
sub edx, 0x13579
sub edx, 0x14ad9
pop edx
push ebx
sub ebx, 0xebe7
pop ebx
push ebx
jmp 0x43f939
pop ebx
push esi
sub esi, 0xe3a8
pop esi
mov dword [ebp - 0x2c], 1
add byte [eax], al
add byte [edx - 0x7f], dl
ljmp 0x8e8
add byte [eax], al
add byte [eax], al
inc ecx
inc eax
dec edi
dec ebp
dec esp
cmp dword [esi], edi
add esp, 4
pop edx
push eax
push ebx
add esp, 4
sub eax, 0xc4ff
pop eax
push eax
sub eax, 0x1743e
sub eax, 0x7999
pop eax
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x138
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x43fb5c
mov ecx, dword [ebp - 0xfb0]
mov edx, dword [ebp - 0xfac]
mov dword [ebp - 0x152c], ecx
mov dword [ebp - 0x1528], edx
push esi
call 0x43fb84
add byte [0x38473f48], dh
dec edx
xor al, 0x83
les eax, [ecx + eax*4]
into
pop edx
daa
add dword [eax], eax
sub esi, 0x1680b
pop esi
push esi
push esi
add esp, 4
add esi, 0xbd26
sub esi, 0x17945
pop esi
push esi
jmp 0x43fbaf
or esi, 0x885a
sub esi, 0x13706
xor esi, 0x176fa
pop esi
push eax
push eax
add esp, 4
call 0x43fbd4
add byte [0x3f354d43], dh
dec ecx
cmp dword [ebx - 0x74a7fb3c], eax
inc ebp
rol byte [0x138], 1
Function at 0x43fbd4
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
add esp, 4
and ebx, 0x5cbd
pop ebx
push esi
push ecx
add esp, 4
or esi, 0x6603
xor esi, 0x9f4b
pop esi
push eax
add eax, 0xd915
pop eax
mov dword [ebp - 0x10], 1
push eax
push edx
add esp, 4
and eax, 0xce4e
or eax, 0xc0a0
xor eax, 0x14ed0
add eax, 0xa6ce
pop eax
push edx
or edx, 0x101ca
pop edx
push ebx
push eax
add esp, 4
and ebx, 0x1593d
pop ebx
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push eax
push esi
add esp, 4
call 0x43f8f1
add byte [esi + 0x34], cl
cmp edi, dword ds:[eax]
dec ebp
inc ecx
dec ebp
add esp, 4
xor eax, 0x45e4
and eax, 0x206b
or eax, 0xd382
pop eax
push eax
jmp 0x43f90f
pop eax
push edx
push ebx
add esp, 4
and edx, 0x153b0
sub edx, 0x13579
sub edx, 0x14ad9
pop edx
push ebx
sub ebx, 0xebe7
pop ebx
push ebx
jmp 0x43f939
pop ebx
push esi
sub esi, 0xe3a8
pop esi
mov dword [ebp - 0x2c], 1
add byte [eax], al
add byte [edx - 0x7f], dl
ljmp 0x8e8
add byte [eax], al
add byte [eax], al
inc ecx
inc eax
dec edi
dec ebp
dec esp
cmp dword [esi], edi
add esp, 4
pop edx
push eax
push ebx
add esp, 4
sub eax, 0xc4ff
pop eax
push eax
sub eax, 0x1743e
sub eax, 0x7999
pop eax
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x138
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x43fb5c
mov ecx, dword [ebp - 0xfb0]
mov edx, dword [ebp - 0xfac]
mov dword [ebp - 0x152c], ecx
mov dword [ebp - 0x1528], edx
push esi
call 0x43fb84
add byte [0x38473f48], dh
dec edx
xor al, 0x83
les eax, [ecx + eax*4]
into
pop edx
daa
add dword [eax], eax
sub esi, 0x1680b
pop esi
push esi
push esi
add esp, 4
add esi, 0xbd26
sub esi, 0x17945
pop esi
push esi
jmp 0x43fbaf
or esi, 0x885a
sub esi, 0x13706
xor esi, 0x176fa
pop esi
push eax
push eax
add esp, 4
call 0x43fbd4
add byte [0x3f354d43], dh
dec ecx
cmp dword [ebx - 0x74a7fb3c], eax
inc ebp
rol byte [0x138], 1
Function at 0x44331f
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
jecxz 0x443321
add byte [ecx + 0xc83ac1], al
add byte [ecx + 0x51], bl
Function at 0x444867
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [eax], al
add byte [eax - 0x7d], bl
mov ebp, 0xfffff3c4
add byte [ebp + 0xf], dh
mov dword [ebp - 0x2e0], 0
push eax
jmp 0x444802
jmp 0x444809
or eax, 0xcf33
pop eax
push edi
add edi, 0x906
sub edi, 0xf9b0
pop edi
push eax
push edi
add esp, 4
sub eax, 0x455b
pop eax
mov eax, dword [ebp - 0x2e0]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x2fc], ecx
push ecx
or ecx, 0xc23a
call 0x44484c
add byte [edx + 0x40], cl
xor al, 0x49
cmp dword [edi], edi
add esp, 4
or ecx, 0x13b1c
pop ecx
push eax
push esi
add esp, 4
call 0x444867
add byte [ebp + 0x48], cl
inc edx
aaa
inc esp
xor eax, dword [ebx - 0x38a7fb3c]
test esp, esi
clc
invalid

Function at 0x4813ff
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00480f52

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43000c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x404e64
Capabilities:
Hash data using murmur3

Disassembly:
xor dword [0x40b8a2], 0x719a8a08
neg eax
xor edi, 0x6e7dfcd
mov dword [0x40b24d], ecx
add ecx, 0xb2cdee2f
dec eax
add ebx, dword [0x40ba20]
ror esi, 3
add ebx, dword [0x40bf13]
rol ecx, 0x10
call fcn.00406608
ror ecx, 0x10
rol esi, 3
inc eax
sub ecx, 0xb2cdee2f
or dword [0x40b7f9], ebx
xor edi, 0x6e7dfcd
neg eax
mov dword [0x40b6a2], 0xcb4db9f6
not edi
xor edi, 0xcb60c035
mov edi, 0xd60836d6
xor edx, esi
invalid
loopne 0x404ed1

Function at 0x404fa9
Capabilities:
Get disk size
Hash data using murmur3

Disassembly:
add al, ch
insb byte es:[edi], dx
sar bh, cl
push dword [ebx]
les esi, [ebx]
std
rol ebx, 0x11
xor dword [0x40b6fe], edi
inc ecx
inc esi
xor ebx, 0x90753a5c
neg edx
sub eax, ebp
add eax, ebp
neg edx
xor ebx, 0x90753a5c
dec esi
dec ecx
xor dword [0x40b668], ecx
ror ebx, 0x11
adc dword [ebx], esi
std

Function at 0x404fdc
Capabilities:
Get disk size
Hash data using murmur3

Disassembly:
adc dword [ebx], esi
std
xor eax, esp
mov dword [0x40b697], ebx
xchg edx, eax
or dword [0x40b7e7], edx
xchg ecx, eax
neg esi
rol ebx, 0xc
add ebx, eax
dec ebx
push edi
not esi
rol edi, 0x1d
xor edi, dword [0x40be99]
or dword [0x40b408], ebx
not esi
call fcn.00408420
mov dword [0x40b58d], 0x1bfbfac8
sub dword [0x40b6a0], ecx
sub eax, dword [0x40bd11]
add edx, dword [0x40bb45]
ror edx, 0xc
not esi
call fcn.00407c9d
dec edx
xor edx, dword [0x40bd5d]
sub edi, 0x83c14515
add edi, 0x83c14515
inc edx
call fcn.00406608
not esi
rol edx, 0xc
mov dword [0x40b7aa], eax
call fcn.00406608

Function at 0x405061
Capabilities:
Get disk size
Hash data using murmur3

Disassembly:
not esi
and dword [0x40b6f0], edi
ror edi, 0x1d
not esi
mov ebx, 0x2c0ed01f
dec ecx
xor edi, 0xe5e403dd
add ecx, ebx
call fcn.00406608
xor eax, dword [0x40ba43]
or dword [0x40b203], ecx
call fcn.00407386
invalid

Function at 0x4050ce
Capabilities:
Hash data using murmur3

Disassembly:
dec edx
xchg ebx, edx
ror edi, 0x1c
dec edi
sub ebx, 0x3f2b41e8
or dword [0x40b302], ecx
xchg eax, esi
inc ebx
ror edx, 0x1d
call fcn.0040773d
call fcn.00406608
sub ecx, ebx
xor edi, 0xe5e403dd
inc ecx
add ebx, 0x499e8f95
neg esi
xor eax, 0x89fc6875
xor edx, dword [0x40be03]
add byte [ecx], al
or eax, 0x40b881
xor eax, dword [0x40b967]
sub dword [0x40b66e], edx
call fcn.00403c27
inc edi
xor ecx, 0x448b4c13
invalid
invalid