joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42101a
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor ebx, 0x130a6
pop ebx
mov dword [ebp - 0x1fac], 0xffffffff
push esi
push ecx
add esp, 4
sub esi, 0x15c7c
xor esi, 0xe407
xor esi, 0x11f27
pop esi
push ecx
xor ecx, 0x8072
and ecx, 0x1376c
and ecx, 0xd462
and ecx, 0x182ca
pop ecx
mov ecx, dword [ebp - 0x3c0]
mov dword [ebp - 0x4d0], ecx
jmp 0x420e87
mov edx, dword [ebp - 0x4d0]
add edx, 1
mov dword [ebp - 0x4d0], edx
push edi
or edi, 0x83d5
and edi, 0x139f5
add edi, 0x17955
and edi, 0x12c2b
pop edi
push edx
push edi
add esp, 4
sub edx, 0x14177
or edx, 0x1343c
and edx, 0x11fd4
pop edx
mov eax, dword [ebp - 0x4d0]
sub eax, dword [ebp - 0x3c0]
cmp eax, 0xffffffff
jb 0x420f01
push esi
sub esi, 0x1665f
jmp 0x420eda
xor esi, 0x13ef9
sub esi, 0x11f07
pop esi
push edx
push ebx
add esp, 4
jmp 0x420ef5
sub edx, 0x120c0
pop edx
jmp 0x42112f
mov dword [ebp - 0xc10], 7
mov ecx, dword [ebp - 0x4d0]
mov dword [ebp - 0xa60], ecx
push ecx
sub ecx, 0x111c2
and ecx, 0x132cc
and ecx, 0xbb5f
pop ecx
push eax
push eax
add esp, 4
or eax, 0x18233
xor eax, 0xb74
pop eax
push edx
push eax
add esp, 4
or edx, 0x3fe8
pop edx
mov edx, dword [ebp - 0x14c8]
mov dword [ebp - 0x9f0], edx
mov dword [ebp - 0xc14], 0
mov eax, dword [ebp - 0x4d0]
cmp eax, dword [ebp - 0x14c8]
jne 0x420fb0
push ecx
xor ecx, 0x1337d
or ecx, 0x1d64
pop ecx
push ebx
and ebx, 0x7f5
jmp 0x420f8a
pop ebx
push edx
sub edx, 0x2519
add edx, 0x8deb
sub edx, 0xaffa
pop edx
mov ecx, dword [ebp - 0xc14]
mov dword [ebp - 0x14d0], ecx
jmp 0x4210e1
cmp dword [ebp - 0xc10], 0
jle 0x4210d5
push ecx
call 0x420fcd
add byte [edi], bh
xor al, 0x48
push eax
cmp al, 0x45
inc edi
dec esi
aaa
add esp, 4
or ecx, 0xbe05
or ecx, 0xc36f
call 0x420feb
add byte [edi], bh
xor eax, 0x48354f4f
xor dh, byte [ebx]
cmp eax, dword [ebx - 0x74a6fb3c]
xchg ebp, eax
mov al, byte [0xffffff5]
mov dh, 2
mov ecx, dword [ebp - 0x9f0]
movzx edx, byte [ecx]
cmp eax, edx
je 0x421071
push eax
push esi
add esp, 4
call 0x42101a
add byte [ebx + 0x4c], cl
xor edi, dword [ecx]
inc ecx
inc esp
cmp dword [ebx + 0x42], ecx
dec edx
add esp, 4
or eax, 0xe1f3
jmp 0x421028
pop eax
push edi
or edi, 0x166a5
and edi, 0x15bb6
pop edi
mov eax, dword [ebp - 0xa60]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x9f0]
movzx eax, byte [edx]
cmp ecx, eax
jle 0x421059
mov dword [ebp - 0x14cc], 1
jmp 0x421063
mov dword [ebp - 0x14cc], 0xffffffff
invalid
lea esi, [ebx + ebp*8]
invalid
Function at 0x421481
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
add esp, 4
sub ebx, 0x9454
and ebx, 0x17b8e
xor ebx, 0x85cd
and ebx, 0x121c6
pop ebx
push edx
and edx, 0x2f05
jmp 0x421425
xor edx, 0x16ab4
pop edx
lea ecx, [ebp - 0x1628]
mov dword [ebp - 0xc1c], ecx
mov edx, dword [ebp - 0x4d4]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xc18], eax
xor ecx, ecx
mov word [ebp - 0x1f8], cx
xor edx, edx
mov word [ebp - 0x100], dx
push eax
push edi
add esp, 4
sub eax, 0x4d55
pop eax
push ecx
xor ecx, 0x11ce9
pop ecx
push ecx
and ecx, 0xa5b5
call fcn.00421481
add byte [ebx + eax*2 + 0x42], al
cmp byte [edi], dh
dec esi
dec esp
add esp, 4
xor ecx, 0x81e1
pop ecx
mov eax, dword [ebp - 0xc18]
mov cx, word [eax]
mov word [ebp - 0xf7e], cx
mov edx, dword [ebp - 0xc18]
add edx, 2
mov dword [ebp - 0xc18], edx
mov ax, word [ebp - 0xf7e]
mov word [ebp - 0x1f8], ax
mov ecx, dword [ebp - 0xc1c]
mov dx, word [ecx]
mov word [ebp - 0xf80], dx
mov eax, dword [ebp - 0xc1c]
add eax, 2
mov dword [ebp - 0xc1c], eax
mov cx, word [ebp - 0xf80]
mov word [ebp - 0x100], cx
push edi
push eax
add esp, 4
sub edi, 0x34a6
add edi, 0x28f8
add edi, 0x11491
pop edi
push edi
push edi
add esp, 4
jmp 0x42150a
and edi, 0x1825e
xor edi, 0x9237
pop edi
movzx edx, word [ebp - 0x100]
test edx, edx
jne 0x42153a
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
sub eax, ecx
mov dword [ebp - 0x1498], eax
jmp 0x42159d
movzx edx, word [ebp - 0x1f8]
movzx eax, word [ebp - 0x100]
cmp edx, eax
je 0x421459
movzx ecx, word [ebp - 0x1f8]
xor ecx, 0x20
movzx edx, word [ebp - 0x100]
cmp ecx, edx
je 0x421459
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
cmp eax, ecx
jge 0x421587
mov dword [ebp - 0x14d8], 0xffffffff
jmp 0x421591
mov dword [ebp - 0x14d8], 1
mov edx, dword [ebp - 0x14d8]
mov dword [ebp - 0x1498], edx
cmp dword [ebp - 0x1498], 0
jne 0x4215e6
push edi
push edi
add esp, 4
sub edi, 0xeade
call 0x4215bd
add byte [esp + ecx*2 + 0x3e], al
xor dl, byte [eax + 0x4e]
add esp, 4
add edi, 0x8034
call 0x4215d4
add byte [eax + 0x4a], al
dec esi
inc edx
xor ecx, dword ds:[ecx + 0x50]
add esp, 4
pop edi
mov eax, dword [ebp - 0x4d4]
mov dword [ebp - 0x2e0], eax
jmp 0x42164e
push esi
push eax
add esp, 4
add esi, 0x4249
and esi, 0x945a
or esi, 0x7b3e
pop esi
push eax
or eax, 0xd916
and eax, 0x1288
add eax, 0x168b4
sub eax, 0x96e9
pop eax
mov ecx, dword [ebp - 0x4d4]
mov edx, dword [ecx]
mov dword [ebp - 0x4d4], edx
mov eax, dword [ebp - 0x4d4]
cmp eax, dword [ebp - 0xc20]
je 0x421644
mov ecx, dword [ebp - 0x4d4]
cmp dword [ecx + 0x30], 0
jne 0x4213fa
mov dword [ebp - 0x2e0], 0
Function at 0x4215bd
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
add esp, 4
sub ebx, 0x9454
and ebx, 0x17b8e
xor ebx, 0x85cd
and ebx, 0x121c6
pop ebx
push edx
and edx, 0x2f05
jmp 0x421425
xor edx, 0x16ab4
pop edx
lea ecx, [ebp - 0x1628]
mov dword [ebp - 0xc1c], ecx
mov edx, dword [ebp - 0x4d4]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xc18], eax
xor ecx, ecx
mov word [ebp - 0x1f8], cx
xor edx, edx
mov word [ebp - 0x100], dx
push eax
push edi
add esp, 4
sub eax, 0x4d55
pop eax
push ecx
xor ecx, 0x11ce9
pop ecx
push ecx
and ecx, 0xa5b5
call fcn.00421481
add byte [ebx + eax*2 + 0x42], al
cmp byte [edi], dh
dec esi
dec esp
add esp, 4
xor ecx, 0x81e1
pop ecx
mov eax, dword [ebp - 0xc18]
mov cx, word [eax]
mov word [ebp - 0xf7e], cx
mov edx, dword [ebp - 0xc18]
add edx, 2
mov dword [ebp - 0xc18], edx
mov ax, word [ebp - 0xf7e]
mov word [ebp - 0x1f8], ax
mov ecx, dword [ebp - 0xc1c]
mov dx, word [ecx]
mov word [ebp - 0xf80], dx
mov eax, dword [ebp - 0xc1c]
add eax, 2
mov dword [ebp - 0xc1c], eax
mov cx, word [ebp - 0xf80]
mov word [ebp - 0x100], cx
push edi
push eax
add esp, 4
sub edi, 0x34a6
add edi, 0x28f8
add edi, 0x11491
pop edi
push edi
push edi
add esp, 4
jmp 0x42150a
and edi, 0x1825e
xor edi, 0x9237
pop edi
movzx edx, word [ebp - 0x100]
test edx, edx
jne 0x42153a
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
sub eax, ecx
mov dword [ebp - 0x1498], eax
jmp 0x42159d
movzx edx, word [ebp - 0x1f8]
movzx eax, word [ebp - 0x100]
cmp edx, eax
je 0x421459
movzx ecx, word [ebp - 0x1f8]
xor ecx, 0x20
movzx edx, word [ebp - 0x100]
cmp ecx, edx
je 0x421459
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
cmp eax, ecx
jge 0x421587
mov dword [ebp - 0x14d8], 0xffffffff
jmp 0x421591
mov dword [ebp - 0x14d8], 1
mov edx, dword [ebp - 0x14d8]
mov dword [ebp - 0x1498], edx
cmp dword [ebp - 0x1498], 0
jne 0x4215e6
push edi
push edi
add esp, 4
sub edi, 0xeade
call 0x4215bd
add byte [esp + ecx*2 + 0x3e], al
xor dl, byte [eax + 0x4e]
add esp, 4
add edi, 0x8034
call 0x4215d4
add byte [eax + 0x4a], al
dec esi
inc edx
xor ecx, dword ds:[ecx + 0x50]
add esp, 4
pop edi
mov eax, dword [ebp - 0x4d4]
mov dword [ebp - 0x2e0], eax
jmp 0x42164e
push esi
push eax
add esp, 4
add esi, 0x4249
and esi, 0x945a
or esi, 0x7b3e
pop esi
push eax
or eax, 0xd916
and eax, 0x1288
add eax, 0x168b4
sub eax, 0x96e9
pop eax
mov ecx, dword [ebp - 0x4d4]
mov edx, dword [ecx]
mov dword [ebp - 0x4d4], edx
mov eax, dword [ebp - 0x4d4]
cmp eax, dword [ebp - 0xc20]
je 0x421644
mov ecx, dword [ebp - 0x4d4]
cmp dword [ecx + 0x30], 0
jne 0x4213fa
mov dword [ebp - 0x2e0], 0
Function at 0x4215d4
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
add esp, 4
sub ebx, 0x9454
and ebx, 0x17b8e
xor ebx, 0x85cd
and ebx, 0x121c6
pop ebx
push edx
and edx, 0x2f05
jmp 0x421425
xor edx, 0x16ab4
pop edx
lea ecx, [ebp - 0x1628]
mov dword [ebp - 0xc1c], ecx
mov edx, dword [ebp - 0x4d4]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xc18], eax
xor ecx, ecx
mov word [ebp - 0x1f8], cx
xor edx, edx
mov word [ebp - 0x100], dx
push eax
push edi
add esp, 4
sub eax, 0x4d55
pop eax
push ecx
xor ecx, 0x11ce9
pop ecx
push ecx
and ecx, 0xa5b5
call fcn.00421481
add byte [ebx + eax*2 + 0x42], al
cmp byte [edi], dh
dec esi
dec esp
add esp, 4
xor ecx, 0x81e1
pop ecx
mov eax, dword [ebp - 0xc18]
mov cx, word [eax]
mov word [ebp - 0xf7e], cx
mov edx, dword [ebp - 0xc18]
add edx, 2
mov dword [ebp - 0xc18], edx
mov ax, word [ebp - 0xf7e]
mov word [ebp - 0x1f8], ax
mov ecx, dword [ebp - 0xc1c]
mov dx, word [ecx]
mov word [ebp - 0xf80], dx
mov eax, dword [ebp - 0xc1c]
add eax, 2
mov dword [ebp - 0xc1c], eax
mov cx, word [ebp - 0xf80]
mov word [ebp - 0x100], cx
push edi
push eax
add esp, 4
sub edi, 0x34a6
add edi, 0x28f8
add edi, 0x11491
pop edi
push edi
push edi
add esp, 4
jmp 0x42150a
and edi, 0x1825e
xor edi, 0x9237
pop edi
movzx edx, word [ebp - 0x100]
test edx, edx
jne 0x42153a
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
sub eax, ecx
mov dword [ebp - 0x1498], eax
jmp 0x42159d
movzx edx, word [ebp - 0x1f8]
movzx eax, word [ebp - 0x100]
cmp edx, eax
je 0x421459
movzx ecx, word [ebp - 0x1f8]
xor ecx, 0x20
movzx edx, word [ebp - 0x100]
cmp ecx, edx
je 0x421459
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
cmp eax, ecx
jge 0x421587
mov dword [ebp - 0x14d8], 0xffffffff
jmp 0x421591
mov dword [ebp - 0x14d8], 1
mov edx, dword [ebp - 0x14d8]
mov dword [ebp - 0x1498], edx
cmp dword [ebp - 0x1498], 0
jne 0x4215e6
push edi
push edi
add esp, 4
sub edi, 0xeade
call 0x4215bd
add byte [esp + ecx*2 + 0x3e], al
xor dl, byte [eax + 0x4e]
add esp, 4
add edi, 0x8034
call 0x4215d4
add byte [eax + 0x4a], al
dec esi
inc edx
xor ecx, dword ds:[ecx + 0x50]
add esp, 4
pop edi
mov eax, dword [ebp - 0x4d4]
mov dword [ebp - 0x2e0], eax
jmp 0x42164e
push esi
push eax
add esp, 4
add esi, 0x4249
and esi, 0x945a
or esi, 0x7b3e
pop esi
push eax
or eax, 0xd916
and eax, 0x1288
add eax, 0x168b4
sub eax, 0x96e9
pop eax
mov ecx, dword [ebp - 0x4d4]
mov edx, dword [ecx]
mov dword [ebp - 0x4d4], edx
mov eax, dword [ebp - 0x4d4]
cmp eax, dword [ebp - 0xc20]
je 0x421644
mov ecx, dword [ebp - 0x4d4]
cmp dword [ecx + 0x30], 0
jne 0x4213fa
mov dword [ebp - 0x2e0], 0
Function at 0x421bba
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
jne 0x421bcd
mov eax, dword [ebp - 0x6fc]
mov dword [ebp - 0x3c4], eax
jmp 0x421ebe
mov ecx, dword [ebp - 0x14e8]
mov edx, dword [ebp - 0x2f8]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x14ec], edx
jne 0x421bf5
mov eax, dword [ebp - 0x6fc]
mov dword [ebp - 0x3c4], eax
jmp 0x421ebe
mov ecx, 8
imul edx, ecx, 0
mov eax, dword [ebp - 0x14ec]
mov ecx, dword [eax + edx + 0x78]
mov dword [ebp - 0x14f0], ecx
cmp dword [ebp - 0x14f0], 0
jne 0x421c27
mov edx, dword [ebp - 0x6fc]
mov dword [ebp - 0x3c4], edx
jmp 0x421ebe
mov eax, dword [ebp - 0x2f8]
add eax, dword [ebp - 0x14f0]
mov dword [ebp - 0x6f0], eax
jne 0x421c4c
mov ecx, dword [ebp - 0x6fc]
mov dword [ebp - 0x3c4], ecx
jmp 0x421ebe
mov edx, dword [ebp - 0x6f0]
mov eax, dword [ebp - 0x2f8]
add eax, dword [edx + 0x20]
mov dword [ebp - 0x18a0], eax
mov ecx, dword [ebp - 0x6f0]
mov edx, dword [ebp - 0x2f8]
add edx, dword [ecx + 0x24]
mov dword [ebp - 0x18a4], edx
mov eax, dword [ebp - 0x6f0]
mov ecx, dword [ebp - 0x2f8]
add ecx, dword [eax + 0x1c]
mov dword [ebp - 0x18a8], ecx
mov dword [ebp - 0x6f4], 0
jmp 0x421ca6
mov edx, dword [ebp - 0x6f4]
add edx, 1
mov dword [ebp - 0x6f4], edx
mov eax, dword [ebp - 0x6f0]
mov ecx, dword [ebp - 0x6f4]
cmp ecx, dword [eax + 0x18]
jae 0x421eb2
mov edx, dword [ebp - 0x6f4]
mov eax, dword [ebp - 0x18a0]
mov ecx, dword [ebp - 0x2f8]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x6f8], ecx
mov edx, dword [ebp - 0x6f4]
mov eax, dword [ebp - 0x18a4]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x18a8]
mov eax, dword [ebp - 0x2f8]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x18ac], eax
mov dword [ebp - 0x180], 0
jmp 0x421d16
mov ecx, dword [ebp - 0x180]
add ecx, 1
mov dword [ebp - 0x180], ecx
mov edx, dword [ebp - 0x6f8]
add edx, dword [ebp - 0x180]
movsx eax, byte [edx]
test eax, eax
je 0x421dc8
mov ecx, dword [ebp - 0x180]
movsx edx, byte [ebp + ecx - 0x820]
test edx, edx
je 0x421dc8
push ecx
jmp 0x421d4d
add ecx, 0x95e3
sub ecx, 0x12dac
pop ecx
push esi
push edi
add esp, 4
xor esi, 0x457d
jmp 0x421d6e
add esi, 0x1b65
pop esi
mov eax, dword [ebp - 0x6f8]
add eax, dword [ebp - 0x180]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x180]
movsx eax, byte [ebp + edx - 0x820]
cmp ecx, eax
je 0x421dba
mov ecx, dword [ebp - 0x6f8]
add ecx, dword [ebp - 0x180]
movsx edx, byte [ecx]
xor edx, 0x20
and byte [ebx - 0x17f7b], cl
dec dword [edi]
mov esi, 0xf7e0058c
invalid
invalid
cmp edx, ecx
jne 0x421dc1
jmp 0x421d07
jmp 0x421dc8
push ecx
xor ecx, 0x22dc
add ecx, 0xc30b
pop ecx
push edx
push eax
add esp, 4
or edx, 0x8d64
xor edx, 0x149f9
and edx, 0x46a
pop edx
push edi
push eax
add esp, 4
xor edi, 0xc00
pop edi
mov edx, dword [ebp - 0x6f8]
add edx, dword [ebp - 0x180]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x180]
movsx edx, byte [ebp + ecx - 0x820]
cmp eax, edx
jne 0x421e27
invalid
invalid
Function at 0x4222a1
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ebx
push ecx
xor ecx, 0x107f3
pop ecx
mov edx, dword [ebp - 0x4dc]
mov eax, dword [edx]
mov dword [ebp - 0x4dc], eax
mov ecx, dword [ebp - 0x4dc]
cmp ecx, dword [ebp - 0xc3c]
je 0x4222d9
mov edx, dword [ebp - 0x4dc]
cmp dword [edx + 0x30], 0
jne 0x4220a4
mov dword [ebp - 0x2e0], 0
Function at 0x42296a
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
pop es
test dword [eax], eax
add byte [ecx + 0xa96be6], al
add byte [esi + 0x57], bl
Function at 0x422aa2
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
movzx edx, word [ebp - 0x204]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x4229b7
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x422ad3
mov dword [ebp - 0x1510], 0xffffffff
jmp 0x422add
mov dword [ebp - 0x1510], 1
mov eax, dword [ebp - 0x1510]
mov dword [ebp - 0x1514], eax
Function at 0x423844
Capabilities:
Resolve function by parsing pe exports

Disassembly:
or al, 1
add byte [ecx + 0x17fd9f0], al
add byte [eax - 0x75], bl
lea ebx, [eax - 3]
invalid

Function at 0x42385e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
add esp, 4
xor eax, 0xe275
and eax, 0x3743
or eax, 0x117c9
pop eax
push edx
add edx, 0x9f16
call 0x42388b
add byte [edi], bh
dec edi
dec edi
aas
inc ecx
xor al, 0x4f
xor eax, 0x4c48334
pop edx
mov dword [ebp - 0x730], 0
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0x1580], eax
cmp dword [ebp - 0x1580], 0
jne 0x4238bf
mov ecx, dword [ebp - 0x730]
mov dword [ebp - 0x4f0], ecx
jmp 0x423bb0
mov edx, dword [ebp - 0x1580]
mov eax, dword [ebp - 0x304]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x1584], eax
jne 0x4238e7
mov ecx, dword [ebp - 0x730]
mov dword [ebp - 0x4f0], ecx
jmp 0x423bb0
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x1584]
mov edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x1588], edx
cmp dword [ebp - 0x1588], 0
jne 0x423919
mov eax, dword [ebp - 0x730]
mov dword [ebp - 0x4f0], eax
jmp 0x423bb0
mov ecx, dword [ebp - 0x304]
add ecx, dword [ebp - 0x1588]
mov dword [ebp - 0x724], ecx
jne 0x42393e
mov edx, dword [ebp - 0x730]
mov dword [ebp - 0x4f0], edx
jmp 0x423bb0
mov eax, dword [ebp - 0x724]
mov ecx, dword [ebp - 0x304]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x1900], ecx
mov edx, dword [ebp - 0x724]
mov eax, dword [ebp - 0x304]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x1904], eax
mov ecx, dword [ebp - 0x724]
mov edx, dword [ebp - 0x304]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0x1908], edx
mov dword [ebp - 0x728], 0
jmp 0x423998

Function at 0x42388b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
add esp, 4
xor eax, 0xe275
and eax, 0x3743
or eax, 0x117c9
pop eax
push edx
add edx, 0x9f16
call 0x42388b
add byte [edi], bh
dec edi
dec edi
aas
inc ecx
xor al, 0x4f
xor eax, 0x4c48334
pop edx
mov dword [ebp - 0x730], 0
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0x1580], eax
cmp dword [ebp - 0x1580], 0
jne 0x4238bf
mov ecx, dword [ebp - 0x730]
mov dword [ebp - 0x4f0], ecx
jmp 0x423bb0
mov edx, dword [ebp - 0x1580]
mov eax, dword [ebp - 0x304]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x1584], eax
jne 0x4238e7
mov ecx, dword [ebp - 0x730]
mov dword [ebp - 0x4f0], ecx
jmp 0x423bb0
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x1584]
mov edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x1588], edx
cmp dword [ebp - 0x1588], 0
jne 0x423919
mov eax, dword [ebp - 0x730]
mov dword [ebp - 0x4f0], eax
jmp 0x423bb0
mov ecx, dword [ebp - 0x304]
add ecx, dword [ebp - 0x1588]
mov dword [ebp - 0x724], ecx
jne 0x42393e
mov edx, dword [ebp - 0x730]
mov dword [ebp - 0x4f0], edx
jmp 0x423bb0
mov eax, dword [ebp - 0x724]
mov ecx, dword [ebp - 0x304]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x1900], ecx
mov edx, dword [ebp - 0x724]
mov eax, dword [ebp - 0x304]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x1904], eax
mov ecx, dword [ebp - 0x724]
mov edx, dword [ebp - 0x304]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0x1908], edx
mov dword [ebp - 0x728], 0
jmp 0x423998
Function at 0x436388
Capabilities:
Encode data using xor

Disassembly:
or byte [eax], cl
bound edx, qword [ebp + 0x7efd09d]
pop es
xchg ecx, eax
popfd
xor al, 0xf9
pop es
pop es
xchg ebx, eax
lea edi, [ebx + eax + 7]
pop es
xchg ebx, eax
push eax
cmp byte [ecx + 0x7f93895], dl
pop es
cmp ebx, edx
outsb dx, byte [esi]
xchg ecx, eax
popfd
inc esp
push es
pop es
pop es
cmp ecx, eax
outsb dx, byte [esi]
xchg ecx, eax
lea esi, [edi + eax]
pop es
pop es
pop edi
pop ecx
mov ecx, esp
or al, 0xf3
or al, 0x4b
aas
inc ecx
inc ecx
pop eax
pop eax
mov ecx, esp
or al, 0x89
enter 0x2675, 9
or byte [ecx + 0x8fa7cf0], cl
or byte [ecx + 0x87340f0], cl
or byte [eax + 0x5e], ah
mov esi, edx
xchg esi, eax
and dword [ecx], ecx
or byte [ecx + 0x89d93f6], cl
or byte [esi - 0x6d], ah
xchg ebp, eax
cmp cl, bh
pop es
pop es
outsb dx, byte [esi]
xchg ebx, eax
sbb dword [esi - 0x6f], ebp
popfd
cld
pop es
pop es
xchg ebx, eax
lea edi, [eax]
stc
pop es
pop es
mov ecx, eax
or dl, byte [ecx + 0x7f9388d]
pop es
outsb dx, byte [esi]
xchg ebx, eax
xchg ebp, eax
cld
pop es
pop es
outsb dx, byte [esi]
xchg ecx, eax
xchg ebp, eax
inc esp
push es
pop es
pop es
xchg ebx, eax
popfd
xor al, 0xf9
pop es
pop es
outsb dx, byte [esi]
xchg ebx, eax
or ch, byte [esi - 0x6f]
lea ebp, [esp + edi*8]
pop es
pop es
xchg ebx, eax
xchg ebp, eax
xor al, 0xf9
pop es
pop es
mov ecx, ecx
or dl, byte [ecx + 0x7f93495]
pop es
outsb dx, byte [esi]
xchg ebx, eax
popfd
sub al, 0xfc
pop es
pop es
outsb dx, byte [esi]
xchg ecx, eax
popfd
xor al, 7
pop es
pop es
pop esi
pop edx
mov ecx, esp
or al, 0x89
salc
jl 0x43643d
or byte [eax], cl
pop si
mov esi, ecx
dec esp
sbb byte [eax], cl
or byte [ecx + 0x97db3d6], cl
or bl, dh
or al, 0x3a
cmp al, 0x48
dec ebx
pop si
pop edx
mov ecx, esp
or al, 0x89
salc
mov ah, 0x84
or byte [eax], cl
mov esi, edi
add esi, dword [ebp + 9]
or byte [esi + 0x17], ah
mov edi, 0x707348d
pop es
invalid

Function at 0x43bda2
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
push edi
mov dword [esi], 0x47c3f0
call fcn.00443319
cmp dword [esi + 0x63c], 0
lea edi, [esi + 0x63c]
mov dword [esi + 0x670], 1
je 0x43bde2
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0xface
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
and dword [edi], 0
mov ecx, esi
call fcn.0042dc76
lea ecx, [esi + 0x3278]
call fcn.00444052
lea ecx, [esi + 0x3268]
call fcn.00443fb9
lea ecx, [esi + 0x630]
call fcn.0040139b
lea ecx, [esi + 0x620]
call fcn.004175db
lea ecx, [esi + 0x610]
call fcn.004175db
lea ecx, [esi + 0x600]
call fcn.004175db
lea ecx, [esi + 0x5e0]
call fcn.0040139b
lea ecx, [esi + 0xc0]
call fcn.0040139b
lea ecx, [esi + 0xbc]
call fcn.0040139b
mov ecx, esi
call int.0042cc96
pop edi
pop esi
ret
Function at 0x43cedb
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b8
push ebx
push esi
push edi
mov edi, ecx
xor ecx, ecx
mov dword [ebp - 4], edi
cmp dword [edi + 0x44], ecx
je 0x43cf08
push dword [ebp + 0x10]
mov ecx, edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0042cd16
jmp 0x43d05d
mov ebx, dword [ebp + 0xc]
cmp ebx, ecx
je 0x43d05b
add ebx, 0xc
cmp ebx, ecx
mov dword [ebp + 8], ebx
je 0x43d05b
mov edx, dword [ebx + 4]
mov esi, dword [edi + 0x84]
mov eax, dword [esi + edx*4]
cmp dword [eax + 0x14], ecx
je 0x43d05b
mov eax, dword [ebx]
test al, 1
je 0x43cf53
mov eax, dword [ebp + 0x10]
push 1
pop esi
mov ecx, edi
mov dword [eax], esi
mov eax, dword [edi]
push ebx
call dword [eax + 0x34]
mov eax, esi
jmp 0x43d05d
test al, 2
je 0x43d04e
mov dword [ebp - 0x2b8], ecx
mov ecx, 0xac
xor eax, eax
lea edi, [ebp - 0x2b4]
rep stosd dword es:[edi], eax
mov eax, dword [esi + edx*4]
xor ecx, ecx
mov edi, dword [eax + 0x14]
cmp dword [edi], ecx
jne 0x43d046
mov eax, dword [edi + 0x10]
cmp eax, ecx
je 0x43cfd4
mov esi, 0x2b4
push 0xc009
lea edx, [ebp - 0x2b8]
push esi
push edx
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x43cfad
mov eax, dword [ebp - 0x2b4]
mov dword [edi], eax
push 0xc00b
lea eax, [ebp - 0x2b8]
push esi
push eax
push 0
push dword [edi + 0x10]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x43d046
mov eax, dword [ebp - 0x2b4]
mov dword [edi + 4], eax
jmp 0x43d046
mov eax, dword [edi + 8]
mov dword [ebp + 0xc], ecx
cmp eax, ecx
je 0x43cfe1
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov ebx, 0xc001
test eax, eax
je 0x43cff6
cmp word [eax], 0x2a
jne 0x43cff6
add ebx, 0x10
mov esi, 0x2b4
push ebx
lea ecx, [ebp - 0x2b8]
push esi
push ecx
push 0x80
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x43d043
mov eax, dword [ebp - 0x2b4]
or ebx, 2
mov dword [edi], eax
push ebx
lea eax, [ebp - 0x2b8]
push esi
push eax
push 0x80
push dword [ebp + 0xc]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x43d043
mov eax, dword [ebp - 0x2b4]
mov dword [edi + 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [edi]
mov edi, dword [ebp - 4]
mov dword [ebx + 0x1c], eax
test byte [ebx], 0x10
je 0x43d05b
push ebx
mov ecx, edi
call fcn.0042d4c5
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc