joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
je 0x432072
nop
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x6ecb6570
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x432060
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4320d2
mov ebx, 0x42f314
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x25e42e06
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
popal
jmp 0x431219

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x287a2703
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
mov ecx, 0x4c143802
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x431072
nop
nop
mov ebx, 0x40915c
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x3f263387
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x431060
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
je 0x4310d2
nop
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x57da0d20
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x401a48
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x401a76
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x401a6d
cmp edi, 0x6a4abc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x401a65
mov eax, ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x401a97
mov esp, ebp
pop ebp
ret

Function at 0x401a9b
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
add esp, 0xffffffec
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 0x10]
xor edx, edx
xchg edx, eax
mov esi, 0x3c
add esi, dword [ebp + 0xc]
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
mov esi, dword [eax + 0x78]
add esi, 0x18
add esi, dword [ebp + 0xc]
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
add esi, 4
lea edi, [ebp - 8]
lodsd eax, dword [esi]
add eax, dword [ebp + 0xc]
stosd dword es:[edi], eax
mov dword [ebp - 8], eax
lodsd eax, dword [esi]
add eax, dword [ebp + 0xc]
push eax
stosd dword es:[edi], eax
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
pop esi
mov dword [ebp - 4], 0
push esi
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
xchg edi, eax
mov ebx, edi
push edi
xor al, al
scasb al, byte es:[edi]
jne 0x401b07
pop esi
sub edi, ebx
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x401b34
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x401b23
xor ecx, eax
xor edx, ebx
dec edi
jne 0x401b14
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop edx
cmp edx, eax
je 0x401b5a
pop esi
add esi, 4
add dword [ebp - 4], 1
jmp 0x401afb
pop esi
mov eax, dword [ebp - 4]
shl eax, 1
add eax, dword [ebp - 0x10]
xor esi, esi
xchg esi, eax
mov ax, word [esi]
shl ax, 2
add eax, dword [ebp - 8]
xchg esi, eax
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
pop ecx
pop edx
pop edi
pop ebx
pop esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x401b86
mov esp, ebp
pop ebp
ret 0xc
Function at 0x401440
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x713f30
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push 0x73d5d8
lea ecx, [esp + 4]
call fcn.005e5a90
lea eax, [esp]
push eax
lea ecx, [esp + 0x14]
push ecx
mov ecx, 0x7a3cdc
mov dword [esp + 0x30], 0
call fcn.005e5d10
push 0x7a3ccc
lea edx, [esp + 0x1c]
push edx
mov ecx, eax
mov byte [esp + 0x30], 1
call fcn.005e5d10
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 4
call fcn.005e5c20
lea ecx, [esp]
mov byte [esp + 0x28], 3
call fcn.005e5c20
push 0x7a3ccc
lea ecx, [esp + 0xc]
call fcn.005e5b00
lea ecx, [esp + 8]
mov byte [esp + 0x28], 5
call fcn.005e5670
push eax
mov eax, dword [0x7a39d4]
push eax
call dword [sym.imp.user32.dll_SetWindowTextA]
lea ecx, [esp + 8]
mov byte [esp + 0x28], 3
call fcn.005e5c20
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], 0xffffffff
call fcn.005e5c20
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret

Function at 0x405020
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor ebx, 0x63e0
pop ebx
mov ecx, dword [ebp - 0x3f0]
mov dword [ebp - 0x4fc], ecx
jmp 0x405047
mov edx, dword [ebp - 0x4fc]
add edx, 1
add dword [ecx - 0x4fb6b], ecx
invalid
push esi
push ecx
add esp, 4
call 0x40505a
add byte [eax + 0x3e], dl
inc esp
cmp al, byte [edx + 0x38]
inc ebp
aaa
add esp, 4
jmp 0x405064
add esi, 0x14430
and esi, 0x1f9e
pop esi
push esi
or esi, 0x12148
pop esi
mov eax, dword [ebp - 0x4fc]
invalid

Function at 0x405040
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor ebx, 0x63e0
pop ebx
mov ecx, dword [ebp - 0x3f0]
mov dword [ebp - 0x4fc], ecx
jmp 0x405047
mov edx, dword [ebp - 0x4fc]
add edx, 1
add dword [ecx - 0x4fb6b], ecx
invalid
push esi
push ecx
add esp, 4
call 0x40505a
add byte [eax + 0x3e], dl
inc esp
cmp al, byte [edx + 0x38]
inc ebp
aaa
add esp, 4
jmp 0x405064
add esi, 0x14430
and esi, 0x1f9e
pop esi
push esi
or esi, 0x12148
pop esi
mov eax, dword [ebp - 0x4fc]
invalid

Function at 0x40505a
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor ebx, 0x63e0
pop ebx
mov ecx, dword [ebp - 0x3f0]
mov dword [ebp - 0x4fc], ecx
jmp 0x405047
mov edx, dword [ebp - 0x4fc]
add edx, 1
add dword [ecx - 0x4fb6b], ecx
invalid
push esi
push ecx
add esp, 4
call 0x40505a
add byte [eax + 0x3e], dl
inc esp
cmp al, byte [edx + 0x38]
inc ebp
aaa
add esp, 4
jmp 0x405064
add esi, 0x14430
and esi, 0x1f9e
pop esi
push esi
or esi, 0x12148
pop esi
mov eax, dword [ebp - 0x4fc]
invalid
Function at 0x405950
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add al, 0x81
mul edx
rol dword [eax], cl
add byte [ecx + 0xa33af7], al
add byte [ecx + 0x13c23f7], al
add byte [ecx + 0x7d57ef], al
add byte [edi + 0x51], bl

Function at 0x405c24
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [edi - 0x7d], bl
mov ebp, 0xffffea28
add byte [ebp + 0xf], dh
push ecx
push edx
add esp, 4
and ecx, 0x8e2a
jmp 0x405c08
pop ecx
push ebx
sub ebx, 0x11642
sub ebx, 0x6be3
call 0x405c24
add byte [eax + 0x3a], al
dec eax
xor eax, 0x4b373f4a
add esp, 4
pop ebx
cmp dword [ebp - 0x31c], 0
jne 0x406541
mov edx, 0x6b
mov word [ebp - 0x1754], dx
mov eax, 0x65
mov word [ebp - 0x1752], ax
mov ecx, 0x72
mov word [ebp - 0x1750], cx
mov edx, 0x6e
mov word [ebp - 0x174e], dx
mov eax, 0x65
mov word [ebp - 0x174c], ax
mov ecx, 0x6c
mov word [ebp - 0x174a], cx
mov edx, 0x33
mov word [ebp - 0x1748], dx
mov eax, 0x32
mov word [ebp - 0x1746], ax
mov ecx, 0x2e
mov word [ebp - 0x1744], cx
mov edx, 0x64
mov word [ebp - 0x1742], dx
mov eax, 0x6c
mov word [ebp - 0x1740], ax
mov ecx, 0x6c
mov word [ebp - 0x173e], cx
xor edx, edx
mov word [ebp - 0x173c], dx
push ebx
and ebx, 0x3a1b
pop ebx
push esi
push edi
add esp, 4
sub esi, 0x74f
call 0x405cf0
add byte [edx], bh
cmp al, byte [eax + 0x40]
inc ebp
dec ecx
inc esi
cmp cl, byte [ecx - 0x7d]
les eax, [ecx + eax*4]
invalid

Function at 0x405cf0
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [edi - 0x7d], bl
mov ebp, 0xffffea28
add byte [ebp + 0xf], dh
push ecx
push edx
add esp, 4
and ecx, 0x8e2a
jmp 0x405c08
pop ecx
push ebx
sub ebx, 0x11642
sub ebx, 0x6be3
call 0x405c24
add byte [eax + 0x3a], al
dec eax
xor eax, 0x4b373f4a
add esp, 4
pop ebx
cmp dword [ebp - 0x31c], 0
jne 0x406541
mov edx, 0x6b
mov word [ebp - 0x1754], dx
mov eax, 0x65
mov word [ebp - 0x1752], ax
mov ecx, 0x72
mov word [ebp - 0x1750], cx
mov edx, 0x6e
mov word [ebp - 0x174e], dx
mov eax, 0x65
mov word [ebp - 0x174c], ax
mov ecx, 0x6c
mov word [ebp - 0x174a], cx
mov edx, 0x33
mov word [ebp - 0x1748], dx
mov eax, 0x32
mov word [ebp - 0x1746], ax
mov ecx, 0x2e
mov word [ebp - 0x1744], cx
mov edx, 0x64
mov word [ebp - 0x1742], dx
mov eax, 0x6c
mov word [ebp - 0x1740], ax
mov ecx, 0x6c
mov word [ebp - 0x173e], cx
xor edx, edx
mov word [ebp - 0x173c], dx
push ebx
and ebx, 0x3a1b
pop ebx
push esi
push edi
add esp, 4
sub esi, 0x74f
call 0x405cf0
add byte [edx], bh
cmp al, byte [eax + 0x40]
inc ebp
dec ecx
inc esi
cmp cl, byte [ecx - 0x7d]
les eax, [ecx + eax*4]
invalid
Function at 0x405d70
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 0x19b0], edx
mov eax, dword [ebp - 0x19b0]
mov dword [ebp - 0x15e4], eax
push edx
push ecx
add esp, 4
sub edx, 0x13b5f
xor edx, 0x643f
xor edx, 0x8b20
pop edx
push esi
push eax
add esp, 4
xor esi, 0x10db3
sub esi, 0x10520
pop esi
push eax
and eax, 0x6f7f
pop eax
cmp dword [ebp - 0x15e4], 0
jne 0x405dcc
mov dword [ebp - 0x750], 0
jmp 0x406088
mov ecx, dword [ebp - 0x15e4]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xca4], eax
push eax
call fcn.00405dee
add byte [esp + esi], dh
dec ebx
inc ebp
cmp bh, byte [esp + edi]
cmp ecx, dword [ebx + eax*4 - 0x3c]
add esp, 4
pop eax

Function at 0x405dee
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop eax
push ecx
push edx
add esp, 4
jmp 0x405dfc
or ecx, 0x9168
sub ecx, 0x4b33
jmp 0x405e0f
pop ecx
cmp dword [ebp - 0xca4], 0
jne 0x405e28
mov dword [ebp - 0x750], 0
jmp 0x406088
mov ecx, dword [ebp - 0xca4]
mov dword [ebp - 0x508], ecx

Function at 0x405ebb
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push esi
push eax
add esp, 4
and esi, 0x15a32
or esi, 0x7fa4
or esi, 0x39e8
add esi, 0xa5c1
pop esi
push edx
push esi
add esp, 4
add edx, 0x4871
jmp 0x405e65
pop edx
lea edx, [ebp - 0x1754]
mov dword [ebp - 0xca0], edx
mov eax, dword [ebp - 0x508]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc9c], ecx
xor edx, edx
mov word [ebp - 0x214], dx
xor eax, eax
mov word [ebp - 0x110], ax
push esi
and esi, 0x1103
pop esi
push eax
push edi
add esp, 4
xor eax, 0x15ba5
pop eax
push edx
push ebx
add esp, 4
call 0x405ebb
add byte [0x324e4942], dh
xor eax, 0x83493c50
les eax, [ecx + eax*4]
ljmp 0x8b5a
mov ecx, dword [ebp - 0x508]
cmp ecx, dword [ebp - 0xca4]
je 0x40607e
mov edx, dword [ebp - 0x508]
cmp dword [edx + 0x30], 0
jne 0x405e34
mov dword [ebp - 0x750], 0

Function at 0x405f33
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop eax
push ebx
push esi
add esp, 4
add ebx, 0x8cee
pop ebx
push edi
add edi, 0x96d9
add edi, 0x13965
pop edi
movzx eax, word [ebp - 0x110]
test eax, eax
jne 0x405f74
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
sub ecx, edx
invalid
lea edx, [edx + ebp*8]

Function at 0x405fe0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push eax
xor eax, 0x126ba
pop eax
push ecx
push ebx
add esp, 4
and ecx, 0x257d
sub ecx, 0x8de3
or ecx, 0x17c17
add ecx, 0x7d9e
pop ecx
push edx
push edx
add esp, 4
or edx, 0x216b
pop edx
mov ecx, dword [ebp - 0x508]
mov dword [ebp - 0x750], ecx
jmp 0x406088
push edi
or edi, 0x2c4a
xor edi, 0x139f9
and edi, 0xd6a1
pop edi
push ebx
push edi
add esp, 4
sub ebx, 0x16e69
call 0x4060b6
add byte [ecx + 0x46], cl
inc edx

Function at 0x406030
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
jmp 0x406035
or ecx, 0x495e
pop ecx
push edi
jmp 0x406045
or edi, 0x12b8f
sub edi, 0x2028
pop edi
mov edx, dword [ebp - 0x508]
mov eax, dword [edx]
mov dword [ebp - 0x508], eax
Function at 0x406060
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push esi
push eax
add esp, 4
and esi, 0x15a32
or esi, 0x7fa4
or esi, 0x39e8
add esi, 0xa5c1
pop esi
push edx
push esi
add esp, 4
add edx, 0x4871
jmp 0x405e65
pop edx
lea edx, [ebp - 0x1754]
mov dword [ebp - 0xca0], edx
mov eax, dword [ebp - 0x508]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc9c], ecx
xor edx, edx
mov word [ebp - 0x214], dx
xor eax, eax
mov word [ebp - 0x110], ax
push esi
and esi, 0x1103
pop esi
push eax
push edi
add esp, 4
xor eax, 0x15ba5
pop eax
push edx
push ebx
add esp, 4
call 0x405ebb
add byte [0x324e4942], dh
xor eax, 0x83493c50
les eax, [ecx + eax*4]
ljmp 0x8b5a
mov ecx, dword [ebp - 0x508]
cmp ecx, dword [ebp - 0xca4]
je 0x40607e
mov edx, dword [ebp - 0x508]
cmp dword [edx + 0x30], 0
jne 0x405e34
mov dword [ebp - 0x750], 0

Function at 0x4060b0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
xor al, byte [edx + 0x4f]
inc ecx
dec edx
dec edi
add esp, 4
pop ebx
cmp dword [ebp - 0x750], 0
jne 0x406104
push esi
push edx
add esp, 4
call 0x4060d6
add byte [ebx + edi], bh
push edx
push ebx
add esp, 4
jmp 0x40610e
call 0x40611c
add byte [eax + edx*2 + 0x3a], cl
dec ebx
inc eax
inc edx
xor al, 0x83
les eax, [ecx + eax*4]

Function at 0x4060b6
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
xor al, byte [edx + 0x4f]
inc ecx
dec edx
dec edi
add esp, 4
pop ebx
cmp dword [ebp - 0x750], 0
jne 0x406104
push esi
push edx
add esp, 4
call 0x4060d6
add byte [ebx + edi], bh
push edx
push ebx
add esp, 4
jmp 0x40610e
call 0x40611c
add byte [eax + edx*2 + 0x3a], cl
dec ebx
inc eax
inc edx
xor al, 0x83
les eax, [ecx + eax*4]

Function at 0x4060d0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
inc ebp
dec esp
inc esi
dec edi
dec esp
inc eax
add esp, 4
or esi, 0x2ad
xor esi, 0x950c
call 0x4060f1
add byte [eax], bh
dec edx
cmp al, 0x48
cmp eax, 0x4c4833c
pop esi
mov dword [ebp - 0x79c], 0
jmp 0x406c2b
push ebx
and ebx, 0x36ab
add ebx, 0x92de
sub ebx, 0x2890
pop ebx
push edi
push ecx
add esp, 4
or edi, 0x9164
or edi, 0x9363
pop edi
push esi
push esi
add esp, 4
jmp 0x406c5c
pop esi
invalid
lea ebx, [eax]

Function at 0x4060d6
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
inc ebp
dec esp
inc esi
dec edi
dec esp
inc eax
add esp, 4
or esi, 0x2ad
xor esi, 0x950c
call 0x4060f1
add byte [eax], bh
dec edx
cmp al, 0x48
cmp eax, 0x4c4833c
pop esi
mov dword [ebp - 0x79c], 0
jmp 0x406c2b
push ebx
and ebx, 0x36ab
add ebx, 0x92de
sub ebx, 0x2890
pop ebx
push edi
push ecx
add esp, 4
or edi, 0x9164
or edi, 0x9363
pop edi
push esi
push esi
add esp, 4
jmp 0x406c5c
pop esi
invalid
lea ebx, [eax]
Function at 0x4060f1
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
inc ebp
dec esp
inc esi
dec edi
dec esp
inc eax
add esp, 4
or esi, 0x2ad
xor esi, 0x950c
call 0x4060f1
add byte [eax], bh
dec edx
cmp al, 0x48
cmp eax, 0x4c4833c
pop esi
mov dword [ebp - 0x79c], 0
jmp 0x406c2b
push ebx
and ebx, 0x36ab
add ebx, 0x92de
sub ebx, 0x2890
pop ebx
push edi
push ecx
add esp, 4
or edi, 0x9164
or edi, 0x9363
pop edi
push esi
push esi
add esp, 4
jmp 0x406c5c
pop esi
invalid
lea ebx, [eax]

Function at 0x40611c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
xor al, byte [edx + 0x4f]
inc ecx
dec edx
dec edi
add esp, 4
pop ebx
cmp dword [ebp - 0x750], 0
jne 0x406104
push esi
push edx
add esp, 4
call 0x4060d6
add byte [ebx + edi], bh
push edx
push ebx
add esp, 4
jmp 0x40610e
call 0x40611c
add byte [eax + edx*2 + 0x3a], cl
dec ebx
inc eax
inc edx
xor al, 0x83
les eax, [ecx + eax*4]
Function at 0x406460
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 0x3f4], edx
cmp dword [ebp - 0x3f4], 0
je 0x406541
push edi
call 0x406481
add byte [esi], dh
dec ecx
inc edx
dec ebx
xor eax, 0x4c48346
xor edi, 0x6ce
pop edi
push ebx
sub ebx, 0xbf93
add ebx, 0xdd75
xor ebx, 0x35b2
invalid
ret

Function at 0x406481
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 0x3f4], edx
cmp dword [ebp - 0x3f4], 0
je 0x406541
push edi
call 0x406481
add byte [esi], dh
dec ecx
inc edx
dec ebx
xor eax, 0x4c48346
xor edi, 0x6ce
pop edi
push ebx
sub ebx, 0xbf93
add ebx, 0xdd75
xor ebx, 0x35b2
invalid
ret

Function at 0x4064b0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
call dword [edi - 0x7f]
out 0xff, eax
test dword [eax], eax
add al, ch
or al, byte [eax]
add byte [eax], al
add byte [edi + 0x45], al

Function at 0x4064c0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
inc ecx
inc esi
inc edi
aas
aaa
inc edi
xor al, 0x83
les eax, [ecx + eax*4]
iretd

Function at 0x4064c7
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
inc ecx
inc esi
inc edi
aas
aaa
inc edi
xor al, 0x83
les eax, [ecx + eax*4]
iretd
Function at 0x406da0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
idiv bh
push dword [edx - 0x3a]
test dword [edi], ebp
idiv bh
push dword [esi + eax*8 - 0x7b]
xor dh, dh
invalid

Function at 0x406dc0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov byte [ebp - 0x9cd], 0x50
mov byte [ebp - 0x9cc], 0x72
mov byte [ebp - 0x9cb], 0x6f
mov byte [ebp - 0x9ca], 0x74
invalid
test dword [edi], esi
invalid
Function at 0x44a900
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x716296
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0xc], esi
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x30], ebx
mov dword [esp + 0x18], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x3c], ebx
mov eax, dword [esp + 0x20]
mov dl, 1
lea edi, [esi + 8]
mov byte [esp + 0x18], dl
sub edi, eax
mov cl, byte [eax]
mov byte [edi + eax], cl
inc eax
cmp cl, bl
jne 0x44a946
mov dword [esi + 0x28], ebx
mov byte [esi + 0x4c], dl
mov dword [esi + 0x48], ebx
mov dword [esi + 0x2c], ebx
mov eax, dword [esi + 0x3c]
cmp eax, ebx
je 0x44a96f
push eax
call fcn.006fa390
add esp, 4
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x40], ebx
mov eax, dword [esi + 0x30]
cmp eax, ebx
je 0x44a988
push eax
call fcn.006fa390
add esp, 4
mov dword [esi + 0x30], ebx
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x38], ebx
mov dword [esi + 0x34], ebx
pop edi
mov dword [esi], 0x44a8e0
mov dword [esi + 4], 0x43e190
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x44ed90
Capabilities:
Get memory capacity

Disassembly:
fld dword [0x7b9270]
sub esp, 0x24
fcomp dword [0x73d700]
fnstsw ax
test ah, 0x44
jnp 0x44edcf
fld dword [0x7b9270]
push esi
fmul dword [0x73d6fc]
push edi
call fcn.006fae8c
mov edi, eax
call fcn.006fc546
mov esi, eax
add esi, edi
call fcn.006fc546
cmp esi, eax
jg 0x44edc4
pop edi
pop esi
lea eax, [esp + 4]
push eax
call dword [sym.imp.kernel32.dll_GlobalMemoryStatus]
fild dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
test ecx, ecx
jge 0x44edec
fadd dword [0x73d770]
fmul dword [0x741548]
fstp dword [0x7b9274]
add esp, 0x24
jmp fcn.00421ee0

Function at 0x4578f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x7167a6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
xor eax, eax
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 8], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esp + 0x10], eax
mov dword [esi + 0x38], eax
mov edx, dword [esp + 0x18]
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi], edx
mov edx, dword [esp + 0x1c]
mov cl, 1
mov dword [esi + 4], edx
mov edx, dword [esp + 0x20]
mov byte [esp + 0x10], cl
mov byte [esi + 0x5d], cl
mov ecx, esi
mov dword [esi + 0x14], edx
mov dword [esi + 0xc], eax
mov dword [esi + 0x58], eax
mov byte [esi + 0x5c], al
mov byte [esi + 0x5e], al
mov byte [esi + 0x5f], al
mov byte [esi + 0x60], al
call fcn.00456a60
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc