joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003cb20
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1005e424]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call fcn.1001f5e0
mov edi, eax
xorps xmm0, xmm0
lea eax, [ebp - 0x14]
push eax
push dword [0x1005edd0]
movups xmmword [ebp - 0x14], xmm0
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x14]
movd xmm0, eax
lea eax, [ebp - 0x24]
cvtdq2ps xmm0, xmm0
push eax
movd xmm1, ecx
cvtdq2ps xmm1, xmm1
movss dword [edi + 0xc], xmm0
xorps xmm0, xmm0
movss dword [edi + 8], xmm1
movlpd qword [ebp - 0x24], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 0x24]
sub ecx, dword [0x1005edd8]
mov edx, dword [ebp - 0x20]
sbb edx, dword [0x1005eddc]
call fcn.1004db40
mov edx, dword [0x1005ede4]
mov ecx, dword [0x1005ede0]
cvtsd2ss xmm0, xmm0
movss dword [ebp - 0x18], xmm0
call fcn.1004db40
movss xmm1, dword [ebp - 0x18]
cvtsd2ss xmm0, xmm0
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
divss xmm1, xmm0
movss dword [edi + 0x10], xmm1
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov dword [0x1005edd8], eax
mov dword [0x1005eddc], ecx
call esi
shr eax, 0xf
and al, 1
push 0x10
mov byte [edi + 0xf4], al
call esi
shr eax, 0xf
and al, 1
push 0x12
mov byte [edi + 0xf5], al
call esi
shr eax, 0xf
and al, 1
mov byte [edi + 0xf7], 0
mov byte [edi + 0xf6], al
call fcn.1001f5e0
mov esi, eax
cmp byte [esi + 0x34f], 0
je 0x1003cc5a
cvttss2si ecx, dword [esi + 0xdc]
lea eax, [ebp - 0x1c]
push eax
push dword [0x1005edd0]
mov dword [ebp - 0x1c], ecx
cvttss2si ecx, dword [esi + 0xe0]
mov dword [ebp - 0x18], ecx
call dword [sym.imp.USER32.dll_ClientToScreen]
test eax, eax
je 0x1003cc5a
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call dword [sym.imp.USER32.dll_SetCursorPos]
mov dword [esi + 0xdc], 0xff7fffff
mov dword [esi + 0xe0], 0xff7fffff
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x1003ccd0
mov ecx, dword [0x1005edd0]
cmp eax, ecx
je 0x1003cc8e
push ecx
push eax
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x1003ccd0
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x1003ccd0
lea eax, [ebp - 0x2c]
push eax
push dword [0x1005edd0]
call dword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x1003ccd0
movd xmm0, dword [ebp - 0x2c]
movd xmm1, dword [ebp - 0x28]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [esi + 0xdc], xmm0
movss dword [esi + 0xe0], xmm1
cmp byte [edi + 0xa8], 0
pop edi
pop esi
je 0x1003cce0
or eax, 0xffffffff
jmp 0x1003cce5
call fcn.1001f680
cmp dword [0x1005e33c], eax
je 0x1003ccf7
mov dword [0x1005e33c], eax
call fcn.1003d040
call fcn.1003cd80
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004cf19
mov esp, ebp
pop ebp
ret
Function at 0x1003feb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100503b0
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x1005e424]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x4c], ebx
jle 0x1003ff0d
xor edi, edi
mov eax, dword [esi + 0x54]
mov ecx, dword [edi + eax]
test ecx, ecx
je 0x1003ff04
cmp byte [edi + eax + 8], 0
je 0x1003ff04
push ecx
call fcn.10021bc0
mov eax, dword [esi + 0x54]
add esp, 4
mov dword [edi + eax], 0
inc ebx
add edi, 0x78
cmp ebx, dword [esi + 0x4c]
jl 0x1003fee0
xor edx, edx
cmp dword [esi + 0x34], edx
jle 0x1003ff4d
mov eax, dword [esi + 0x3c]
mov edi, dword [eax + edx*4]
mov eax, dword [esi + 0x54]
mov ebx, dword [edi + 0x34]
cmp ebx, eax
jb 0x1003ff47
mov ecx, dword [esi + 0x4c]
shl ecx, 4
sub ecx, dword [esi + 0x4c]
lea eax, [eax + ecx*8]
cmp ebx, eax
jae 0x1003ff47
mov dword [edi + 0x34], 0
xor ecx, ecx
mov eax, dword [esi + 0x3c]
mov eax, dword [eax + edx*4]
mov word [eax + 0x38], cx
inc edx
cmp edx, dword [esi + 0x34]
jl 0x1003ff14
mov eax, dword [esi + 0x54]
test eax, eax
je 0x1003ff72
push eax
mov dword [esi + 0x50], 0
mov dword [esi + 0x4c], 0
call fcn.10021bc0
add esp, 4
mov dword [esi + 0x54], 0
mov eax, dword [esi + 0x48]
test eax, eax
je 0x1003ff97
push eax
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
call fcn.10021bc0
add esp, 4
mov dword [esi + 0x48], 0
mov eax, dword [esi + 0x14]
mov dword [esi + 0x464], 0xffffffff
mov dword [esi + 0x460], 0xffffffff
test eax, eax
je 0x1003ffbb
push eax
call fcn.10021bc0
add esp, 4
mov eax, dword [esi + 0x18]
test eax, eax
je 0x1003ffcb
push eax
call fcn.10021bc0
add esp, 4
xor ebx, ebx
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
cmp dword [esi + 0x34], ebx
jle 0x1004004a
mov eax, dword [esi + 0x3c]
mov edi, dword [eax + ebx*4]
test edi, edi
je 0x10040044
mov ecx, edi
mov dword [ebp - 4], 0
call fcn.10040170
mov eax, dword [edi + 0x28]
mov byte [ebp - 4], 1
test eax, eax
je 0x1004000c
push eax
call fcn.10021bc0
add esp, 4
mov eax, dword [edi + 0x1c]
mov byte [ebp - 4], 2
test eax, eax
je 0x10040020
push eax
call fcn.10021bc0
add esp, 4
mov eax, dword [edi + 8]
mov byte [ebp - 4], 3
test eax, eax
je 0x10040034
push eax
call fcn.10021bc0
add esp, 4
push edi
mov dword [ebp - 4], 0xffffffff
call fcn.10021bc0
add esp, 4
inc ebx
cmp ebx, dword [esi + 0x34]
jl 0x1003ffe0
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x1004006f
push eax
mov dword [esi + 0x38], 0
mov dword [esi + 0x34], 0
call fcn.10021bc0
add esp, 4
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100442b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
je 0x100442d7
push eax
mov dword [esi + 4], 0
mov dword [esi], 0
call fcn.10021bc0
add esp, 4
mov dword [esi + 8], 0
mov eax, dword [esi + 0x14]
test eax, eax
je 0x100442fc
push eax
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
call fcn.10021bc0
add esp, 4
mov dword [esi + 0x14], 0
mov eax, dword [esi + 0x20]
test eax, eax
je 0x10044321
push eax
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
call fcn.10021bc0
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov eax, dword [esi + 0x44]
test eax, eax
je 0x10044362
push eax
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
call fcn.10021bc0
add esp, 4
mov dword [esi + 0x44], 0
mov eax, dword [esi + 0x50]
test eax, eax
je 0x10044387
push eax
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
call fcn.10021bc0
add esp, 4
mov dword [esi + 0x50], 0
mov eax, dword [esi + 0x5c]
test eax, eax
je 0x100443ac
push eax
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
call fcn.10021bc0
add esp, 4
mov dword [esi + 0x5c], 0
lea ecx, [esi + 0x78]
pop esi
jmp fcn.10040090
Function at 0x6aa011c0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
xor esi, esi
push ebx
sub esp, 0x3c
test eax, eax
je 0x6aa01268
mov edx, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov dword [esp + 8], eax
mov ebx, eax
mov dword [esp + 0x14], 0
mov dword [ebp - 0x1c], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 4], 0
mov dword [esp], 0
call edx
mov edi, eax
sub esp, 0x18
lea ecx, [edi + edi]
mov dword [esp + 4], 0
mov dword [esp + 8], ecx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x6aa01268
mov dword [esp + 0x14], edi
mov edx, dword [ebp - 0x1c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0
call edx
sub esp, 0x18
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x6aa015d0
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
mov ebx, dword [ecx]
mov esi, dword [ecx + 4]
mov edi, dword [ecx + 8]
test ebx, ebx
je 0x6aa01601
mov eax, ebx
call fcn.6aa011c0
mov ebx, eax
test eax, eax
je 0x6aa016c0
test esi, esi
je 0x6aa01616
mov eax, esi
call fcn.6aa011c0
mov esi, eax
test eax, eax
je 0x6aa016d0
test byte [0x6aa03018], 1
jne 0x6aa01670
mov dword [esp + 8], ebx
mov ebx, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esp + 4], 0
mov edi, dword fs:[0x18]
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ebx
sub esp, 0xc
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ebx
xor eax, eax
sub esp, 0xc
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov eax, esi
call fcn.6aa012e0
mov dword [ebp - 0x1c], eax
mov eax, ebx
call fcn.6aa012e0
mov edx, dword [ebp - 0x1c]
mov dword [esp + 0x18], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], str.__s___s___Ix__n
mov dword [esp + 8], 0x6aa05084
mov dword [esp + 4], 0x6aa03018
mov dword [esp], 0
call fcn.6aa01570
jmp 0x6aa0161f
mov eax, 0xe
jmp 0x6aa01662
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, 0xe
sub esp, 0xc
jmp 0x6aa01662
Function at 0x6aa01770
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x2c
mov ebx, dword [ecx]
mov esi, dword [ecx + 4]
test ebx, ebx
je 0x6aa01799
mov eax, ebx
call fcn.6aa011c0
mov ebx, eax
test eax, eax
je 0x6aa01810
test byte [0x6aa03018], 1
jne 0x6aa017d8
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
xor eax, eax
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 8
mov eax, ebx
call fcn.6aa012e0
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.__s___d_:_stub_n
mov dword [esp + 8], str.LoadPerfCounterTextStringsW
mov dword [esp + 4], 0x6aa03018
mov dword [esp], 0
call fcn.6aa01570
jmp 0x6aa017a2
mov eax, 0xe
jmp 0x6aa017c8

Function at 0x6aa01880
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x2c
mov ebx, dword [ecx]
mov esi, dword [ecx + 4]
test ebx, ebx
je 0x6aa018a9
mov eax, ebx
call fcn.6aa011c0
mov ebx, eax
test eax, eax
je 0x6aa01920
test byte [0x6aa03018], 1
jne 0x6aa018e8
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
xor eax, eax
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 8
mov eax, ebx
call fcn.6aa012e0
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.__s___d_:_stub_n
mov dword [esp + 8], str.UnloadPerfCounterTextStringsW
mov dword [esp + 4], 0x6aa03018
mov dword [esp], 0
call fcn.6aa01570
jmp 0x6aa018b2
mov eax, 0xe
jmp 0x6aa018d8
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x771b6a51
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0xdc473cb
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x4066f2
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [edx], bh
inc eax
dec edx
cmp al, 0x46
dec ebp
cmp eax, dword [ebx - 0xd7efb3c]
add esp, 4
invalid
bnd jge 0x40674b
add byte [eax], al
pop edx
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x100], eax
jmp 0x406719

Function at 0x406741
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor edx, 0x527d
mov edx, dword [ebp - 0x100]
sub edx, dword [ebp - 0x190]
cmp edx, 0xffffffff
jb 0x406761
push eax
or eax, 0x18b0
call 0x406741
add byte [ecx + 0x44], al
inc ecx
xor eax, dword [edi + 0x3e]
aas
aaa
dec edi
dec edx
add esp, 4
pop eax
push ebx
jmp 0x40674d
mov dword [ebp - 0x2c4], 7
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x260], eax
push edx
add edx, 0x17686
jmp 0x406784
pop edx
push edi
or edi, 0xd3d4
add edi, 0x16597
add edi, 0x7e45
call 0x4067a5
add byte [0x4d3a3247], bh
dec eax
cmp al, 0x83
les eax, [edi + ebx*2]
mov ecx, dword [ebp - 0x4a8]
mov dword [ebp - 0x264], ecx
mov dword [ebp - 0x2c8], 0
mov edx, dword [ebp - 0x100]
cmp edx, dword [ebp - 0x4a8]
jne 0x4067de
mov eax, dword [ebp - 0x2c8]
mov dword [ebp - 0x4b0], eax
jmp 0x40690f

Function at 0x4067a5
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor edx, 0x527d
mov edx, dword [ebp - 0x100]
sub edx, dword [ebp - 0x190]
cmp edx, 0xffffffff
jb 0x406761
push eax
or eax, 0x18b0
call 0x406741
add byte [ecx + 0x44], al
inc ecx
xor eax, dword [edi + 0x3e]
aas
aaa
dec edi
dec edx
add esp, 4
pop eax
push ebx
jmp 0x40674d
mov dword [ebp - 0x2c4], 7
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x260], eax
push edx
add edx, 0x17686
jmp 0x406784
pop edx
push edi
or edi, 0xd3d4
add edi, 0x16597
add edi, 0x7e45
call 0x4067a5
add byte [0x4d3a3247], bh
dec eax
cmp al, 0x83
les eax, [edi + ebx*2]
mov ecx, dword [ebp - 0x4a8]
mov dword [ebp - 0x264], ecx
mov dword [ebp - 0x2c8], 0
mov edx, dword [ebp - 0x100]
cmp edx, dword [ebp - 0x4a8]
jne 0x4067de
mov eax, dword [ebp - 0x2c8]
mov dword [ebp - 0x4b0], eax
jmp 0x40690f
Function at 0x406819
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ebp - 0x100]
add ecx, 1
invalid
invalid
cmp dword [ebp - 0x2c4], 0
jle 0x406903
push edi
and edi, 0x2148
or edi, 0x38f5
and edi, 0x7a3d
pop edi
push edi
push eax
add esp, 4
sub edi, 0x4f22
call 0x406819
add byte [0x43474e35], dh
cmp ecx, dword [edi + 0x37]
aaa
add esp, 4
pop edi
mov ecx, dword [ebp - 0x260]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0x264]
movzx ecx, byte [eax]
cmp edx, ecx
invalid
je 0x40689f
push eax
call 0x406841
add byte [ebx + ecx*2 + 0x37], cl
inc edx
inc edx
inc esi
inc ebp
add esp, 4
and eax, 0xfa03
sub eax, 0x9b3c
pop eax
push ecx
jmp 0x406858
sub ecx, 0x254c
or ecx, 0xe68d
pop ecx
mov edx, dword [ebp - 0x260]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x264]
movzx edx, byte [ecx]
cmp eax, edx
jle 0x406887
mov dword [ebp - 0x4ac], 1
jmp 0x406891
mov dword [ebp - 0x4ac], 0xffffffff
mov eax, dword [ebp - 0x4ac]
mov dword [ebp - 0x2c8], eax
jmp 0x406903
push edx
call 0x4068b0
add byte [ecx + 0x39], cl
inc edi
aaa
cmp byte [esi + 0x40], cl
aas
inc ebx
cmp al, byte [ebx - 0x357efb3c]
xor byte [ecx], al
add byte [edx + 0x56], bl
jmp 0x4068c4
xor esi, 0xbf24
sub esi, 0x18359
pop esi
mov ecx, dword [ebp - 0x2c4]
sub ecx, 1
mov dword [ebp - 0x2c4], ecx
mov edx, dword [ebp - 0x260]
add edx, 1
mov dword [ebp - 0x260], edx
mov eax, dword [ebp - 0x264]
add eax, 1
mov dword [ebp - 0x264], eax
jmp 0x4067de
mov ecx, dword [ebp - 0x2c8]
mov dword [ebp - 0x4b0], ecx
cmp dword [ebp - 0x4b0], 0
jne 0x406958
push ebx
sub ebx, 0x154a5
and ebx, 0xc273
xor ebx, 0x463e
pop ebx
push ecx
push esi
add esp, 4
sub ecx, 0x18478
xor ecx, 0x10f44
sub ecx, 0x89a1
or ecx, 0x1357f
pop ecx
mov edx, dword [ebp - 0x100]
mov dword [ebp - 0x268], edx
jmp 0x406967
jmp 0x40670a
push edi
call 0x406975
add byte [eax + 0x3d], dl
dec ebx
dec edi
cmp byte [ebx + eax*4 - 0x3c], cl
add al, 0x81
invalid
Function at 0x406830
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ebp - 0x100]
add ecx, 1
invalid
invalid
cmp dword [ebp - 0x2c4], 0
jle 0x406903
push edi
and edi, 0x2148
or edi, 0x38f5
and edi, 0x7a3d
pop edi
push edi
push eax
add esp, 4
sub edi, 0x4f22
call 0x406819
add byte [0x43474e35], dh
cmp ecx, dword [edi + 0x37]
aaa
add esp, 4
pop edi
mov ecx, dword [ebp - 0x260]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0x264]
movzx ecx, byte [eax]
cmp edx, ecx
invalid
je 0x40689f
push eax
call 0x406841
add byte [ebx + ecx*2 + 0x37], cl
inc edx
inc edx
inc esi
inc ebp
add esp, 4
and eax, 0xfa03
sub eax, 0x9b3c
pop eax
push ecx
jmp 0x406858
sub ecx, 0x254c
or ecx, 0xe68d
pop ecx
mov edx, dword [ebp - 0x260]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x264]
movzx edx, byte [ecx]
cmp eax, edx
jle 0x406887
mov dword [ebp - 0x4ac], 1
jmp 0x406891
mov dword [ebp - 0x4ac], 0xffffffff
mov eax, dword [ebp - 0x4ac]
mov dword [ebp - 0x2c8], eax
jmp 0x406903
push edx
call 0x4068b0
add byte [ecx + 0x39], cl
inc edi
aaa
cmp byte [esi + 0x40], cl
aas
inc ebx
cmp al, byte [ebx - 0x357efb3c]
xor byte [ecx], al
add byte [edx + 0x56], bl
jmp 0x4068c4
xor esi, 0xbf24
sub esi, 0x18359
pop esi
mov ecx, dword [ebp - 0x2c4]
sub ecx, 1
mov dword [ebp - 0x2c4], ecx
mov edx, dword [ebp - 0x260]
add edx, 1
mov dword [ebp - 0x260], edx
mov eax, dword [ebp - 0x264]
add eax, 1
mov dword [ebp - 0x264], eax
jmp 0x4067de
mov ecx, dword [ebp - 0x2c8]
mov dword [ebp - 0x4b0], ecx
cmp dword [ebp - 0x4b0], 0
jne 0x406958
push ebx
sub ebx, 0x154a5
and ebx, 0xc273
xor ebx, 0x463e
pop ebx
push ecx
push esi
add esp, 4
sub ecx, 0x18478
xor ecx, 0x10f44
sub ecx, 0x89a1
or ecx, 0x1357f
pop ecx
mov edx, dword [ebp - 0x100]
mov dword [ebp - 0x268], edx
jmp 0x406967
jmp 0x40670a
push edi
call 0x406975
add byte [eax + 0x3d], dl
dec ebx
dec edi
cmp byte [ebx + eax*4 - 0x3c], cl
add al, 0x81
invalid
Function at 0x406841
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ebp - 0x100]
add ecx, 1
invalid
invalid
cmp dword [ebp - 0x2c4], 0
jle 0x406903
push edi
and edi, 0x2148
or edi, 0x38f5
and edi, 0x7a3d
pop edi
push edi
push eax
add esp, 4
sub edi, 0x4f22
call 0x406819
add byte [0x43474e35], dh
cmp ecx, dword [edi + 0x37]
aaa
add esp, 4
pop edi
mov ecx, dword [ebp - 0x260]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0x264]
movzx ecx, byte [eax]
cmp edx, ecx
invalid
je 0x40689f
push eax
call 0x406841
add byte [ebx + ecx*2 + 0x37], cl
inc edx
inc edx
inc esi
inc ebp
add esp, 4
and eax, 0xfa03
sub eax, 0x9b3c
pop eax
push ecx
jmp 0x406858
sub ecx, 0x254c
or ecx, 0xe68d
pop ecx
mov edx, dword [ebp - 0x260]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x264]
movzx edx, byte [ecx]
cmp eax, edx
jle 0x406887
mov dword [ebp - 0x4ac], 1
jmp 0x406891
mov dword [ebp - 0x4ac], 0xffffffff
mov eax, dword [ebp - 0x4ac]
mov dword [ebp - 0x2c8], eax
jmp 0x406903
push edx
call 0x4068b0
add byte [ecx + 0x39], cl
inc edi
aaa
cmp byte [esi + 0x40], cl
aas
inc ebx
cmp al, byte [ebx - 0x357efb3c]
xor byte [ecx], al
add byte [edx + 0x56], bl
jmp 0x4068c4
xor esi, 0xbf24
sub esi, 0x18359
pop esi
mov ecx, dword [ebp - 0x2c4]
sub ecx, 1
mov dword [ebp - 0x2c4], ecx
mov edx, dword [ebp - 0x260]
add edx, 1
mov dword [ebp - 0x260], edx
mov eax, dword [ebp - 0x264]
add eax, 1
mov dword [ebp - 0x264], eax
jmp 0x4067de
mov ecx, dword [ebp - 0x2c8]
mov dword [ebp - 0x4b0], ecx
cmp dword [ebp - 0x4b0], 0
jne 0x406958
push ebx
sub ebx, 0x154a5
and ebx, 0xc273
xor ebx, 0x463e
pop ebx
push ecx
push esi
add esp, 4
sub ecx, 0x18478
xor ecx, 0x10f44
sub ecx, 0x89a1
or ecx, 0x1357f
pop ecx
mov edx, dword [ebp - 0x100]
mov dword [ebp - 0x268], edx
jmp 0x406967
jmp 0x40670a
push edi
call 0x406975
add byte [eax + 0x3d], dl
dec ebx
dec edi
cmp byte [ebx + eax*4 - 0x3c], cl
add al, 0x81
invalid
Function at 0x4068b0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ebp - 0x100]
add ecx, 1
invalid
invalid
cmp dword [ebp - 0x2c4], 0
jle 0x406903
push edi
and edi, 0x2148
or edi, 0x38f5
and edi, 0x7a3d
pop edi
push edi
push eax
add esp, 4
sub edi, 0x4f22
call 0x406819
add byte [0x43474e35], dh
cmp ecx, dword [edi + 0x37]
aaa
add esp, 4
pop edi
mov ecx, dword [ebp - 0x260]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0x264]
movzx ecx, byte [eax]
cmp edx, ecx
invalid
je 0x40689f
push eax
call 0x406841
add byte [ebx + ecx*2 + 0x37], cl
inc edx
inc edx
inc esi
inc ebp
add esp, 4
and eax, 0xfa03
sub eax, 0x9b3c
pop eax
push ecx
jmp 0x406858
sub ecx, 0x254c
or ecx, 0xe68d
pop ecx
mov edx, dword [ebp - 0x260]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x264]
movzx edx, byte [ecx]
cmp eax, edx
jle 0x406887
mov dword [ebp - 0x4ac], 1
jmp 0x406891
mov dword [ebp - 0x4ac], 0xffffffff
mov eax, dword [ebp - 0x4ac]
mov dword [ebp - 0x2c8], eax
jmp 0x406903
push edx
call 0x4068b0
add byte [ecx + 0x39], cl
inc edi
aaa
cmp byte [esi + 0x40], cl
aas
inc ebx
cmp al, byte [ebx - 0x357efb3c]
xor byte [ecx], al
add byte [edx + 0x56], bl
jmp 0x4068c4
xor esi, 0xbf24
sub esi, 0x18359
pop esi
mov ecx, dword [ebp - 0x2c4]
sub ecx, 1
mov dword [ebp - 0x2c4], ecx
mov edx, dword [ebp - 0x260]
add edx, 1
mov dword [ebp - 0x260], edx
mov eax, dword [ebp - 0x264]
add eax, 1
mov dword [ebp - 0x264], eax
jmp 0x4067de
mov ecx, dword [ebp - 0x2c8]
mov dword [ebp - 0x4b0], ecx
cmp dword [ebp - 0x4b0], 0
jne 0x406958
push ebx
sub ebx, 0x154a5
and ebx, 0xc273
xor ebx, 0x463e
pop ebx
push ecx
push esi
add esp, 4
sub ecx, 0x18478
xor ecx, 0x10f44
sub ecx, 0x89a1
or ecx, 0x1357f
pop ecx
mov edx, dword [ebp - 0x100]
mov dword [ebp - 0x268], edx
jmp 0x406967
jmp 0x40670a
push edi
call 0x406975
add byte [eax + 0x3d], dl
dec ebx
dec edi
cmp byte [ebx + eax*4 - 0x3c], cl
add al, 0x81
invalid
Function at 0x4068d0
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ebp - 0x100]
add ecx, 1
invalid
invalid
cmp dword [ebp - 0x2c4], 0
jle 0x406903
push edi
and edi, 0x2148
or edi, 0x38f5
and edi, 0x7a3d
pop edi
push edi
push eax
add esp, 4
sub edi, 0x4f22
call 0x406819
add byte [0x43474e35], dh
cmp ecx, dword [edi + 0x37]
aaa
add esp, 4
pop edi
mov ecx, dword [ebp - 0x260]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0x264]
movzx ecx, byte [eax]
cmp edx, ecx
invalid
je 0x40689f
push eax
call 0x406841
add byte [ebx + ecx*2 + 0x37], cl
inc edx
inc edx
inc esi
inc ebp
add esp, 4
and eax, 0xfa03
sub eax, 0x9b3c
pop eax
push ecx
jmp 0x406858
sub ecx, 0x254c
or ecx, 0xe68d
pop ecx
mov edx, dword [ebp - 0x260]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x264]
movzx edx, byte [ecx]
cmp eax, edx
jle 0x406887
mov dword [ebp - 0x4ac], 1
jmp 0x406891
mov dword [ebp - 0x4ac], 0xffffffff
mov eax, dword [ebp - 0x4ac]
mov dword [ebp - 0x2c8], eax
jmp 0x406903
push edx
call 0x4068b0
add byte [ecx + 0x39], cl
inc edi
aaa
cmp byte [esi + 0x40], cl
aas
inc ebx
cmp al, byte [ebx - 0x357efb3c]
xor byte [ecx], al
add byte [edx + 0x56], bl
jmp 0x4068c4
xor esi, 0xbf24
sub esi, 0x18359
pop esi
mov ecx, dword [ebp - 0x2c4]
sub ecx, 1
mov dword [ebp - 0x2c4], ecx
mov edx, dword [ebp - 0x260]
add edx, 1
mov dword [ebp - 0x260], edx
mov eax, dword [ebp - 0x264]
add eax, 1
mov dword [ebp - 0x264], eax
jmp 0x4067de
mov ecx, dword [ebp - 0x2c8]
mov dword [ebp - 0x4b0], ecx
cmp dword [ebp - 0x4b0], 0
jne 0x406958
push ebx
sub ebx, 0x154a5
and ebx, 0xc273
xor ebx, 0x463e
pop ebx
push ecx
push esi
add esp, 4
sub ecx, 0x18478
xor ecx, 0x10f44
sub ecx, 0x89a1
or ecx, 0x1357f
pop ecx
mov edx, dword [ebp - 0x100]
mov dword [ebp - 0x268], edx
jmp 0x406967
jmp 0x40670a
push edi
call 0x406975
add byte [eax + 0x3d], dl
dec ebx
dec edi
cmp byte [ebx + eax*4 - 0x3c], cl
add al, 0x81
invalid