joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4071b0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50b2e4
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x574be0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea esi, [edi + 0x118]
mov dword [ebp - 4], 9
push dword [esi + 8]
mov ecx, esi
push 0
mov dword [esi], 0x54b948
call dword [0x54b94c]
push dword [esi + 0xc]
call fcn.004ea3bd
add esp, 4
lea ecx, [edi + 0xf0]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [ebp - 4], 8
call fcn.004073b0
lea ecx, [edi + 0xc8]
mov byte [ebp - 4], 7
call fcn.004073b0
lea ecx, [edi + 0xa0]
mov byte [ebp - 4], 6
call fcn.004073b0
lea ecx, [edi + 0x78]
mov byte [ebp - 4], 5
call fcn.004073b0
lea ecx, [edi + 0x64]
mov byte [ebp - 4], 4
call fcn.00409110
mov byte [ebp - 4], 3
push dword [edi + 0x58]
lea ecx, [edi + 0x50]
push 0
mov dword [edi + 0x50], 0x54b948
call dword [0x54b94c]
push dword [edi + 0x5c]
call fcn.004ea3bd
add esp, 4
lea ecx, [edi + 0x3c]
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov byte [ebp - 4], 2
call fcn.00408fd0
mov byte [ebp - 4], 1
push dword [edi + 0x30]
lea ecx, [edi + 0x28]
push 0
mov dword [edi + 0x28], 0x54b948
call dword [0x54b94c]
push dword [edi + 0x34]
call fcn.004ea3bd
add esp, 4
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov byte [ebp - 4], 0
push dword [edi + 0x1c]
lea ecx, [edi + 0x14]
push 0
mov dword [edi + 0x14], 0x54b948
call dword [0x54b94c]
push dword [edi + 0x20]
call fcn.004ea3bd
add esp, 4
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [ebp - 4], 0xffffffff
push dword [edi + 8]
mov dword [edi], 0x54b948
push 0
mov ecx, edi
call dword [0x54b94c]
push dword [edi + 0xc]
call fcn.004ea3bd
add esp, 4
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4116e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 0xc]
mov esi, ecx
push 0x411730
push 0
push 0
call fcn.004eb064
add esp, 0x18
mov dword [esi], eax
pop esi
test eax, eax
je 0x411710
xor eax, eax
mov esp, ebp
pop ebp
ret 8
call dword [0x51b0d4]
test eax, eax
mov ecx, 1
cmovne ecx, eax
mov eax, ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x412540
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x8c
mov eax, dword [0x574be0]
xor eax, esp
mov dword [esp + 0x88], eax
push ebx
push esi
mov esi, ecx
xor edx, edx
mov eax, dword [esi]
push edi
cmp eax, 0x3f
jne 0x4125da
cmp dword [esi + 4], edx
jbe 0x41257e
lea ecx, [ecx]
mov al, byte [esi + edx + 8]
mov byte [esi + edx + 0x24], al
inc edx
cmp edx, dword [esi + 4]
jb 0x412570
xor ecx, ecx
cmp dword [esi + 0x1c], ecx
jbe 0x4125a0
cmp edx, 0x20
jae 0x4126e5
mov eax, dword [esi + 0x20]
inc ecx
mov al, byte [ecx + eax - 1]
mov byte [esi + edx + 0x24], al
inc edx
cmp ecx, dword [esi + 0x1c]
jb 0x412585
cmp edx, 0x20
jae 0x4126e5
mov ecx, 0x20
sub ecx, edx
lea edi, [esi + 0x24]
add edi, edx
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x88]
xor ecx, esp
call fcn.004e9fca
mov esp, ebp
pop ebp
ret
xor ecx, ecx
bts ecx, eax
cmp eax, 0x20
xorps xmm0, xmm0
mov dword [esp + 0x20], 0x6a09e667
mov dword [esp + 0x24], 0xbb67ae85
mov dword [esp + 0x28], 0x3c6ef372
cmovae edx, ecx
xor ecx, edx
cmp eax, 0x40
cmovae edx, ecx
mov dword [esp + 0x2c], 0xa54ff53a
mov dword [esp + 0x30], 0x510e527f
mov dword [esp + 0x34], 0x9b05688c
mov dword [esp + 0x38], 0x1f83d9ab
mov dword [esp + 0x3c], 0x5be0cd19
movlpd qword [esp + 0x40], xmm0
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x8c], 0
mov dword [esp + 0x90], 0
movlpd qword [esp + 0x18], xmm0
test edx, edx
jb 0x4126d9
ja 0x412664
test ecx, ecx
je 0x4126d9
mov ebx, dword [esp + 0x1c]
mov edi, dword [esp + 0x18]
lea eax, [esi + 8]
nop
push dword [esi + 4]
mov edx, eax
lea ecx, [esp + 0x24]
call fcn.0041f860
mov edx, dword [esi + 0x20]
add esp, 4
push dword [esi + 0x1c]
lea ecx, [esp + 0x24]
call fcn.0041f860
add esp, 4
lea edx, [esp + 0x8c]
push 8
lea ecx, [esp + 0x24]
call fcn.0041f860
add esp, 4
xor eax, eax
lea ebx, [ebx]
inc byte [esp + eax + 0x8c]
jne 0x4126bf
inc eax
cmp eax, 8
jl 0x4126b0
add edi, 1
adc ebx, 0
lea eax, [esi + 8]
cmp ebx, dword [esp + 0x14]
jb 0x412670
ja 0x4126d9
lea eax, [esi + 8]
cmp edi, dword [esp + 0x10]
jb 0x412670
lea edx, [esi + 0x24]
lea ecx, [esp + 0x20]
call fcn.0041f900
mov ecx, dword [esp + 0x94]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004e9fca
mov esp, ebp
pop ebp
ret
Function at 0x41b040
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x50ccf8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x574be0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 4
mov dword [esp + 0xc], 0x54b8d0
mov ecx, dword [ebp + 0xc]
lea edx, [esp + 0xc]
mov dword [esp + 0x30], 0
call fcn.0041ad80
lea eax, [esp + 0xc]
push eax
push 1
mov ecx, esi
mov word [esp + 0x28], 0x100
mov byte [esp + 0x2a], 1
call fcn.0041af50
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.00402350
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4275a0
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50d692
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x574be0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], 0
mov dword [edi], 0x54d91c
mov dword [edi + 0x70], 0x54d938
mov dword [ebp - 4], 0
mov eax, dword [edi]
lea esi, [edi + 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], 1
mov dword [edi + eax], 0x54d928
mov eax, dword [edi]
mov ecx, dword [eax + 4]
push ecx
lea eax, [ecx - 0x18]
mov dword [ecx + edi - 4], eax
mov eax, dword [edi]
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov ecx, dword [eax + 4]
push esi
add ecx, edi
call fcn.00428160
mov dword [ebp - 4], 2
mov eax, dword [edi]
mov eax, dword [eax + 4]
mov dword [edi + eax], 0x54de00
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ecx + edi - 4], eax
mov ecx, esi
call fcn.00428830
lea eax, [esi + 4]
mov dword [esi + 0xc], eax
lea eax, [esi + 0x14]
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x24]
mov dword [esi + 0x2c], eax
mov dword [esi], 0x54d95c
mov byte [esi + 0x4c], 0
mov byte [esi + 0x45], 0
lea ecx, [esi + 8]
mov dword [esi + 0x10], ecx
lea eax, [esi + 0x28]
mov dword [esi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [0x57e528]
mov dword [esi + 0x50], 0
mov dword [esi + 0x48], eax
mov dword [esi + 0x40], 0
push ecx
push 1
push dword [ebp + 8]
mov ecx, esi
mov byte [ebp - 4], 3
call fcn.00428250
test eax, eax
jne 0x4276fa
mov eax, dword [edi]
mov ecx, dword [eax + 4]
mov eax, dword [ecx + edi + 0xc]
add ecx, edi
or eax, 2
cmp dword [ecx + 0x38], 0
jne 0x4276f2
or eax, 4
push 0
push eax
call fcn.00424ee0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x428480
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x50dbb8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x574be0]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov eax, dword [0x574be0]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x40], 0
je 0x4285d4
cmp byte [ebx + 0x45], 0
je 0x4285d4
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x4284e0
xor al, al
jmp 0x4285d6
mov ecx, 0xf
mov byte [esp + 0x18], 0
xorps xmm0, xmm0
movq qword [esp + 0x18], xmm0
lea eax, [esp + 0x18]
cmp ecx, 0x10
cmovae eax, dword [esp + 0x18]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], 8
mov byte [eax + 8], 0
mov dword [esp + 0x40], 0
jmp 0x428520
cmp dword [esp + 0x2c], 0x10
mov ecx, dword [ebx + 0x40]
lea eax, [esp + 0x14]
mov edx, dword [ecx]
push eax
mov eax, dword [esp + 0x2c]
lea edi, [esp + 0x1c]
cmovae edi, dword [esp + 0x1c]
lea esi, [esp + 0x1c]
cmovae esi, dword [esp + 0x1c]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x428561
dec eax
je 0x428565
sub eax, 2
je 0x4285bb
xor bl, bl
jmp 0x4285bd
mov byte [ebx + 0x45], 0
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
cmp ecx, 0x10
lea eax, [esp + 0x18]
cmovae eax, edx
sub esi, eax
je 0x42859c
push dword [ebx + 0x50]
cmp ecx, 0x10
push esi
lea eax, [esp + 0x20]
cmovae eax, edx
push 1
push eax
call fcn.004ecccd
add esp, 0x10
cmp esi, eax
jne 0x42855d
cmp byte [ebx + 0x45], 0
je 0x4285bb
test esi, esi
jne 0x428520
push esi
push 8
lea ecx, [esp + 0x20]
call fcn.004280b0
jmp 0x428520
mov bl, 1
cmp dword [esp + 0x2c], 0x10
jb 0x4285d0
push dword [esp + 0x18]
call fcn.004ea3bd
add esp, 4
mov al, bl
jmp 0x4285d6
mov al, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004e9fca
mov esp, ebp
pop ebp
ret
Function at 0x428ff0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50dd27
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x574be0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], 0
mov dword [edi], 0x54deb0
mov dword [edi + 0x60], 0x54d938
mov dword [ebp - 4], 0
mov eax, dword [edi]
lea esi, [edi + 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], 1
mov dword [edi + eax], 0x54de58
mov eax, dword [edi]
mov ecx, dword [eax + 4]
push ecx
lea eax, [ecx - 8]
mov dword [ecx + edi - 4], eax
mov eax, dword [edi]
push esi
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.00428160
mov dword [ebp - 4], 2
mov eax, dword [edi]
mov eax, dword [eax + 4]
mov dword [edi + eax], 0x54debc
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x60]
mov dword [ecx + edi - 4], eax
mov ecx, esi
call fcn.00428830
lea eax, [esi + 4]
mov dword [esi + 0xc], eax
lea eax, [esi + 0x14]
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x24]
mov dword [esi + 0x2c], eax
mov dword [esi], 0x54d95c
mov byte [esi + 0x4c], 0
mov byte [esi + 0x45], 0
lea ecx, [esi + 8]
mov dword [esi + 0x10], ecx
lea eax, [esi + 0x28]
mov dword [esi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [0x57e528]
mov dword [esi + 0x48], eax
mov dword [esi + 0x50], 0
mov dword [esi + 0x40], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4a5cb0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
xor esi, esi
test edx, edx
je 0x4a5cf7
mov al, byte [edx]
test al, al
je 0x4a5cf7
push edi
mov edi, 0x100
movsx eax, al
or eax, edi
mov ecx, eax
shr ecx, 2
xor ecx, eax
and ecx, 0xf
add edi, 0x100
rol esi, cl
mov ecx, eax
imul ecx, eax
mov al, byte [edx + 1]
inc edx
xor esi, ecx
test al, al
jne 0x4a5cc7
mov eax, esi
shr eax, 0x10
pop edi
xor eax, esi
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x4cc800
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
cmp ecx, dword [edi + 4]
jge 0x4cc819
mov esi, edi
mov edi, eax
jmp 0x4cc81b
mov esi, eax
mov eax, dword [esi + 4]
mov ebx, dword [esp + 0x10]
cmp eax, dword [ebx + 8]
jg 0x4cc82b
mov eax, ebx
jmp 0x4cc835
push eax
push ebx
call fcn.0049db00
add esp, 8
test eax, eax
jne 0x4cc83d
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [edi + 4], eax
jle 0x4cc859
mov edx, dword [esi]
mov ecx, dword [edi]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [edi + 4]
jl 0x4cc844
cmp eax, dword [esi + 4]
jge 0x4cc870
mov edi, edi
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [esi + 4]
jl 0x4cc860
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
test eax, eax
jle 0x4cc891
mov ecx, dword [ebx]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0x4cc88e
dec eax
test eax, eax
jg 0x4cc880
mov dword [ebx + 4], eax
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x417bf7
Capabilities:
Packed with generic packer

Disassembly:
add byte [edx + eax*2], bl
inc eax
add byte [eax], bh
inc edx
inc eax
add byte [edx + eax*2 + 0x40], dh
add byte [edi], al
inc ebp
push esp
push 0x64616572
adc byte [ecx + eax*2], bh
or cl, byte [esi]
push esp
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x417c87
outsb dx, byte [esi]
outsb dx, byte gs:[esi]
je 0x417c6b
popal
insd dword es:[edi], dx
and al, 0x7c
inc ecx
add byte [edi], cl
cmovns eax, dword [ebp + 0x73]
imul esp, dword [edi + 0x6e], 0x6f4e7265
je 0x417c9c
jns 0x417c66
adc dword [eax], eax
add dword [edi], eax
call 0xe3e835b1
rcl dword [ecx]
stosb byte es:[edi], al
mov cl, 0
ror byte [edi - 0x4f], 0x6f
mov esp, 0x616c4307
jae 0x417cc3
jae 0x417c55
add bh, bh
dec dword [ebx - 0x3f7c3340]
fsubr st(1)
mov al, byte [0x830001f9]
inc esp
and al, 4
fmul dword [ebx - 0x74fbdbbc]
mov eax, dword [esp + 4]
mov eax, dword [eax]
jmp dword [eax + 0x28]
add bh, bh
pushal
sub byte [ebx - 0x27fbdbbc], al
jmp 0x4375d9
aam 0x8b
inc esp
and al, 4
mov eax, dword [eax]
jmp dword [eax + 0x28]
inc esp
and al, 4
aam 0xe9
cmp cl, 1
add byte [ecx + 0x7c], ah
inc ecx
add byte [edi + 0x7c], ch
inc ecx
add byte [ecx + 0x7c], bh
inc ecx
add byte [ecx + 0x7c], bl
inc ecx
add byte [ebx - 0x6effbe84], al
jl 0x417cfd
add byte [ebx + 0x200417c], bl
add byte [eax], al
add byte [eax + 0x18], bl
mov esp, edx
xchg ah, ch
pop ecx
add byte [eax], al
pop eax
sbb byte [ebx + 0x59ec86e2], cl
inc ebp
invalid
mov esi, dword [ebx + 0x48]
mov edi, dword [ebx + 0x4c]
mov eax, ebx
call 0x49b472
push 0x14
push edi
push esi
mov eax, dword [ebx + 0x44]
push eax
mov eax, dword [ebx + 0x40]
push eax
push 0
mov eax, ebx
call 0x49f30b
push eax
call fcn.0043e861
cmp dword [ebx + 0x284], 0
je 0x437625
lea eax, [ebx + 0x284]
push eax
push 1
push 0x192
mov eax, ebx
call 0x49f32f
push eax
call fcn.0043e7d5
mov eax, ebx
call fcn.0046d928
mov eax, dword [ebx + 0x294]
test eax, eax
je 0x43763f
mov edx, eax
mov eax, ebx
call fcn.0046ee0b
mov eax, dword [ebx + 0x27c]
cmp eax, 0xffffffff
jne 0x437653
cmp dword [ebx + 0x288], 0
je 0x4376b3
movzx edx, byte [ebx + 0x280]
add dl, 0xfd
sub dl, 2
jae 0x43766b
mov edx, eax
mov eax, ebx
call fcn.0046eccb
mov eax, dword [ebx + 0x288]
test eax, eax
je 0x43768c
mov edx, eax
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x110]
lea eax, [ebx + 0x288]
call fcn.00446060
mov edx, dword [ebx + 0x28c]
mov eax, ebx
call fcn.0046de99
invalid
xchg ebx, eax
nop
invalid

Function at 0x41adfd
Capabilities:
Access peb ldr_data

Disassembly:
inc ecx
add byte [edi + edi*8 + 0x30], ah
mov dword fs:[eax], esp
lea ecx, [ebp - 4]
mov edx, ebx
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, ebx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov edi, eax
mov edx, ebx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x48]
push edi
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x64]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41ae53
mov eax, dword [ebp - 8]
call fcn.00434977
ret
Function at 0x424f0f
Capabilities:
Encode data using xor

Disassembly:
dec ebp
jb 0x424e9e
ror byte [ecx + 0x31c289d1], 0xc0
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x424f1a
ret

Function at 0x42cc97
Capabilities:
Access peb ldr_data

Disassembly:
dec esp
inc edx
add al, ch
push eax
add byte ss:[eax], al
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x42ccb4
add byte [edi + edi*8 + 0x30], ah
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov dword [eax + 8], esi
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], edi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x42cccb
mov eax, dword [ebp - 4]
call fcn.0045654f
mov eax, dword [ebx + 0x28]
call fcn.0045655b
mov eax, dword [ebp - 4]
mov dword [ebx + 0x28], eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x42dce5
Capabilities:
Get number of processors

Disassembly:
call fcn.00434651
mov dword [0x494b14], eax
push 0x42e060
mov eax, dword [ebx]
push eax
call fcn.00434663
mov dword [0x494b18], eax
push 0x42e07c
mov eax, dword [ebx]
push eax
call fcn.00434675
add byte [eax], al
mov dword [0x494b1c], eax
push 0x42e094
inc edx
add byte [ebx - 0x6717affd], cl
imul eax, dword [eax], 0x4b20a300
dec ecx
add byte [eax - 0x54], ch
loopne 0x42dd3a
add byte [ebx - 0x6717affd], cl
imul eax, dword [eax], 0x4b24a300
dec ecx
add byte [eax - 0x40], ch
loopne 0x42dd4c
add byte [ebx - 0x6717affd], cl
imul eax, dword [eax], 0x4b28a300
dec ecx
add byte [eax - 0x20], ch
invalid

Function at 0x42dd6a
Capabilities:
Get number of processors

Disassembly:
add byte [eax], al
jne 0x42dde6
je 0x42ddd8
insd dword es:[edi], dx
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [edi + 0x70], cl
jo 0x42dde0
outsb dx, byte [esi]
je 0x42ddda
add byte [eax], al
inc edi
je 0x42de34
Function at 0x42dd79
Capabilities:
Get number of processors

Disassembly:
jo 0x42dde0
outsb dx, byte [esi]
push esp
push 0x44656d65
popal
je 0x42dde6
add byte [eax], al
add byte [ebx + 0x6c], al
outsd dx, dword [esi]
jae 0x42ddf2
push esp
push 0x44656d65
popal
je 0x42ddf7
add byte [eax], al
inc esp
jb 0x42ddfc
ja 0x42ddf1
push 0x42656d65
popal
arpl word [ebx + 0x67], bp
jb 0x42de17
jne 0x42de18
add byte fs:[edx + esi*2 + 0x61], al
ja 0x42de05
push 0x54656d65
js 0x42de2d
add byte [eax], al
add byte [edi + 0x65], al
je 0x42de14
push 0x42656d65
popal
arpl word [ebx + 0x67], bp
jb 0x42de3a
jne 0x42de3b
inc ebx
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x42de38
outsb dx, byte [esi]
je 0x42de28
arpl word gs:[eax + eax], si
add byte [edi + 0x65], al
je 0x42de34
push 0x50656d65
popal
jb 0x42de5c
push ebx
imul edi, dword [edx + 0x65], 0
inc edi
je 0x42de48
je 0x42de48
push 0x54656d65
push esp
js 0x42de70
inc ebp
js 0x42de73
outsb dx, byte gs:[esi]
je 0x42de03
add byte [edi + 0x65], al
je 0x42de5c
je 0x42de5c
push 0x54656d65
js 0x42de84
dec ebp
je 0x42de86
imul esp, dword [ebx + 0x73], 0x74654700
push esp
add byte [edi + 0x65], al
je 0x42de70
inc edi
je 0x42de70
push 0x42656d65
popal
arpl word [ebx + 0x67], bp
jb 0x42de96
jne 0x42de97
outsb dx, byte [esi]
push edx
imul ebp, dword gs:[bx + 0x6e], 0
imul ebp, dword [edi + 0x6e], 0
dec eax
imul esi, dword [esp + edx*2 + 0x65], 0x68547473
insd dword es:[edi], dx
inc edx
jae 0x42deaf
je 0x42de90
push esp
push 0x42656d65
popal
arpl word [ebx + 0x67], bp
jb 0x42deb6
jne 0x42deb7
outsb dx, byte [esi]
add byte fs:[eax], al
inc esp
jb 0x42deb0
ja 0x42dea5
push 0x45656d65
add byte gs:[bx + si], al
add byte [edx + esi*2 + 0x61], al
inc esp
jb fcn.0042dec0
ja 0x42deb5
push 0x49656d65
arpl word [edi + 0x6e], bp
add byte [eax], al
add byte [ecx + 0x73], cl
push esp
push 0x50656d65
insd dword es:[edi], dx
push eax
push eax
popal
jb 0x42deeb
inc esp
imul bp, word gs:[esi + 0x65], 0x64
add byte [ecx + 0x73], cl
push esp
push 0x42656d65
insd dword es:[edi], dx
inc edx
popal
arpl word [ebx + 0x67], bp
jb 0x42defd
jne 0x42defe
push eax
popal
jb 0x42df09
imul esp, dword [ecx + 0x6c], 0x7254796c
popal
popal
insb byte es:[edi], dx
insb byte es:[edi], dx
jns fcn.0042deef
jb 0x42defe
add byte [eax], al
add byte [edi + 0x65], al
je 0x42df00
inc ebx
inc ebx
add byte [eax], al
add byte [edi + 0x65], al
je 0x42df10
push esp

Function at 0x430921
Capabilities:
Encode data using xor

Disassembly:
inc ebx
add byte [ebx + esi + 0x54050043], bh
inc ebp
imul esi, dword fs:[ebx + ecx*4 - 0x40], 0x430928
je 0x4308ae
shr byte [eax], 9
inc ebx
invalid

Function at 0x439934
Capabilities:
Packed with generic packer

Disassembly:
push es
push esp
push esp
imul ebp, dword [ebp + 0x65], 0x99409072
inc ebx
add byte [edi], al
push es
push esp
push esp
imul ebp, dword [ebp + 0x65], 0x4398fc72
add ah, bh
Function at 0x43994d
Capabilities:
Packed with generic packer

Disassembly:
jge 0x439990
add byte [0x78450800], al
je 0x43999a
je 0x4399cb
insb byte es:[edi], dx
jae fcn.0043995f
add byte [eax], al
adc byte [eax], al
inc eax
add byte [eax], al
add bh, bh
inc eax
mov byte [0x10043], al
add byte [eax], al
add byte [eax], al
add byte [eax + 1], al
add al, byte [eax]
pop es
inc ebp
dec ecx
outsb dx, byte [esi]
sal byte [eax + ecx - 0x7d], cl
invalid

Function at 0x43995f
Capabilities:
Packed with generic packer

Disassembly:
jge 0x439990
add byte [0x78450800], al
je 0x43999a
je 0x4399cb
insb byte es:[edi], dx
jae fcn.0043995f
add byte [eax], al
adc byte [eax], al
inc eax
add byte [eax], al
add bh, bh
inc eax
mov byte [0x10043], al
add byte [eax], al
add byte [eax], al
add byte [eax + 1], al
add al, byte [eax]
pop es
inc ebp
dec ecx
outsb dx, byte [esi]
sal byte [eax + ecx - 0x7d], cl
invalid

Function at 0x439979
Capabilities:
Packed with generic packer

Disassembly:
outsb dx, byte [esi]
popal
bound ebp, qword [ebp + 0x64]
jl 0x439991
inc eax
add byte [eax], dh
add byte [eax], al
call dword [eax - 0x5e]
inc ebx
add byte [ecx], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
sub al, 3
add byte [eax], al
add byte [eax + 0x3e8], al
add eax, dword [eax]
or byte [ecx + 0x6e], cl
je 0x439a03
jb 0x439a16
popal
insb byte es:[edi], dx
pushfd
imul eax, dword [ecx], 0xff000038
pushal
mov byte [0x10043], al
add byte [eax], al
add byte [eax], al
add byte [eax - 0x80000000], al
add al, 0
pop es
dec edi
outsb dx, byte [esi]
push esp
add byte [ecx + 0x46c7145e], cl
adc byte [edi + ebx*4], ah
inc ebx
add byte [ecx - 0x3c74dba2], cl
mov dx, 0xffc6
call fcn.0043d2b0
mov dword [esi + 0x20], eax
mov edx, 0x69
mov eax, ebx
call 0x498d07
mov edx, 0x69
mov eax, ebx
call 0x498cdf
mov eax, ebx
cmp byte [ebp - 1], 0
invalid
invalid

Function at 0x43b659
Capabilities:
Packed with generic packer

Disassembly:
add byte [eax], 0
add byte [eax + 0x5405000c], al
imul esi, dword [esp + ebp*2 + 0x65], 0x41699c

Function at 0x43b6b8
Capabilities:
Packed with generic packer

Disassembly:
inc esi
imul ebp, dword [ebp + 0x4f], 0x696c436b
arpl word [ebx - 0x64], bp
imul eax, dword [ecx], 0xff000080
add bh, bh
add byte [eax], 0
inc dword [ecx]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], 0
add byte [eax + 0x4f0e000f], al
outsb dx, byte [esi]
inc esi

Function at 0x43b6d0
Capabilities:
Packed with generic packer

Disassembly:
outsd dx, dword [esi]
insb byte es:[edi], dx
jb fcn.0043b719
push 0x65676e61
les ebp, [ebx + eax*2 + 0x8800]
dec dword [eax + 0x1ff0000]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], 0
add byte [eax + 0x4f100010], al
adc byte [eax], 0
adc byte [edi + 0x6e], cl