joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4096d6
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov esi, esp
mov dword [esi + 0x30], ebp
lea ecx, [esi + 0x38]
mov edi, dword [ebp + 0x10]
mov dword [ecx - 4], esp
mov dword [ecx + 8], 0xffffffff
mov dword [ecx + 4], 0x416fb0
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
lea eax, [esi + 0x21]
xor ecx, ecx
mov dword [eax + 3], ecx
xor ecx, ecx
mov dword [eax - 1], 0x25
inc ecx
push dword [edi + 4]
push ecx
push 0x43e3a6
push eax
call fcn.00406702
add esp, 0x10
mov ebx, dword [edi + 4]
mov dword [esi + 0x14], esp
shr ebx, 9
and ebx, 1
lea eax, [ebx + 0x17]
mov dword [esi + 4], eax
sub esp, 0x18
mov edi, esp
lea eax, [esi + 0x28]
mov dword [esi + 0xc], edi
push eax
call fcn.00403d8c
add esp, 4
lea eax, [esi + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push eax
lea eax, [esi + 0x28]
push dword [eax + 4]
push dword [eax]
push dword [esi + 4]
push edi
call fcn.0041881f
add esp, 0x1c
mov edi, eax
mov eax, dword [esi + 0xc]
add edi, eax
push dword [ebp + 0x10]
push edi
push eax
call fcn.00406816
add esp, 0xc
mov dword [esi + 4], eax
lea eax, [ebx + ebx + 0x2e]
and eax, 0xfffffffc
call fcn.00419650
mov ecx, dword [ebp + 0x10]
lea eax, [esi + 8]
mov ebx, esp
push eax
call fcn.004024aa
lea edx, [esi + 8]
lea eax, [esi + 0x38]
xor ecx, ecx
mov dword [eax + 8], ecx
lea eax, [esi + 0x18]
lea ecx, [esi + 0x1c]
push edx
push eax
push ecx
mov dword [esi + 0x10], ebx
push ebx
push edi
push dword [esi + 4]
push dword [esi + 0xc]
call fcn.00411722
add esp, 0x1c
mov ecx, dword [esi + 8]
xor eax, eax
mov edi, dword [ebp + 8]
mov dl, byte [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
dec eax
lock xadd dword [ecx + 4], eax
test eax, eax
jne 0x4097ed
mov eax, dword [ecx]
call dword [eax + 4]
mov dl, byte [ebp + 0x14]
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
movsx edx, dl
mov dword [esi + 0x40], 0xffffffff
push edx
push dword [ebp + 0x10]
push eax
push ecx
push dword [esi + 0x10]
push ebx
push edi
call fcn.0041199d
add esp, 0x1c
mov esp, dword [esi + 0x14]
mov eax, dword [esi + 0x38]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x40a3c8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov esi, esp
mov dword [esi + 0x30], ebp
lea ecx, [esi + 0x38]
mov edx, dword [ebp + 0x10]
mov dword [ecx - 4], esp
mov dword [ecx + 8], 0xffffffff
mov dword [ecx + 4], 0x417010
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
lea eax, [esi + 0x21]
xor ecx, ecx
mov dword [eax + 3], ecx
mov dword [eax - 1], 0x25
push dword [edx + 4]
mov edi, edx
push ecx
push 0x43e3a6
push eax
call fcn.00406702
add esp, 0x10
mov ebx, dword [edi + 4]
mov dword [esi + 0x10], esp
shr ebx, 9
and ebx, 1
lea edi, [ebx + 0x16]
inc edi
sub esp, 0x18
lea eax, [esi + 0x28]
mov dword [esi + 8], esp
push eax
call fcn.00403d8c
add esp, 4
lea eax, [esi + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push eax
lea eax, [esi + 0x28]
push dword [eax + 4]
push dword [eax]
push edi
mov edi, dword [esi + 8]
push edi
call fcn.0041881f
add esp, 0x1c
mov ecx, edi
add eax, edi
push dword [ebp + 0x10]
push eax
mov edi, eax
push ecx
call fcn.00406816
add esp, 0xc
mov dword [esi + 0x14], eax
lea eax, [ebx*4 + 0x58]
call fcn.00419650
mov ecx, dword [ebp + 0x10]
lea eax, [esi + 4]
mov ebx, esp
push eax
call fcn.004024aa
lea edx, [esi + 4]
lea eax, [esi + 0x38]
xor ecx, ecx
mov dword [eax + 8], ecx
lea eax, [esi + 0x18]
lea ecx, [esi + 0x1c]
push edx
push eax
push ecx
mov dword [esi + 0xc], ebx
push ebx
push edi
push dword [esi + 0x14]
push dword [esi + 8]
call fcn.00411f30
add esp, 0x1c
mov ecx, dword [esi + 4]
xor eax, eax
mov edi, dword [ebp + 8]
movzx edx, word [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
dec eax
lock xadd dword [ecx + 4], eax
test eax, eax
jne 0x40a4dc
mov eax, dword [ecx]
call dword [eax + 4]
movzx edx, word [ebp + 0x14]
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
movzx edx, dx
mov dword [esi + 0x40], 0xffffffff
push edx
push dword [ebp + 0x10]
push eax
push ecx
push dword [esi + 0xc]
push ebx
push edi
call fcn.004121bb
add esp, 0x1c
mov esp, dword [esi + 0x10]
mov eax, dword [esi + 0x38]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x40a6a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov esi, esp
mov dword [esi + 0x30], ebp
lea ecx, [esi + 0x38]
mov edi, dword [ebp + 0x10]
mov dword [ecx - 4], esp
mov dword [ecx + 8], 0xffffffff
mov dword [ecx + 4], 0x417030
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
lea eax, [esi + 0x21]
xor ecx, ecx
mov dword [eax + 3], ecx
xor ecx, ecx
mov dword [eax - 1], 0x25
inc ecx
push dword [edi + 4]
push ecx
push 0x43e3a6
push eax
call fcn.00406702
add esp, 0x10
mov ebx, dword [edi + 4]
mov dword [esi + 0x14], esp
shr ebx, 9
and ebx, 1
lea eax, [ebx + 0x17]
mov dword [esi + 4], eax
sub esp, 0x18
mov edi, esp
lea eax, [esi + 0x28]
mov dword [esi + 0xc], edi
push eax
call fcn.00403d8c
add esp, 4
lea eax, [esi + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push eax
lea eax, [esi + 0x28]
push dword [eax + 4]
push dword [eax]
push dword [esi + 4]
push edi
call fcn.0041881f
add esp, 0x1c
mov edi, eax
mov eax, dword [esi + 0xc]
add edi, eax
push dword [ebp + 0x10]
push edi
push eax
call fcn.00406816
add esp, 0xc
mov dword [esi + 4], eax
lea eax, [ebx*4 + 0x58]
call fcn.00419650
mov ecx, dword [ebp + 0x10]
lea eax, [esi + 8]
mov ebx, esp
push eax
call fcn.004024aa
lea edx, [esi + 8]
lea eax, [esi + 0x38]
xor ecx, ecx
mov dword [eax + 8], ecx
lea eax, [esi + 0x18]
lea ecx, [esi + 0x1c]
push edx
push eax
push ecx
mov dword [esi + 0x10], ebx
push ebx
push edi
push dword [esi + 4]
push dword [esi + 0xc]
call fcn.00411f30
add esp, 0x1c
mov ecx, dword [esi + 8]
xor eax, eax
mov edi, dword [ebp + 8]
movzx edx, word [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
dec eax
lock xadd dword [ecx + 4], eax
test eax, eax
jne 0x40a7b9
mov eax, dword [ecx]
call dword [eax + 4]
movzx edx, word [ebp + 0x14]
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
movzx edx, dx
mov dword [esi + 0x40], 0xffffffff
push edx
push dword [ebp + 0x10]
push eax
push ecx
push dword [esi + 0x10]
push ebx
push edi
call fcn.004121bb
add esp, 0x1c
mov esp, dword [esi + 0x14]
mov eax, dword [esi + 0x38]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x4132f4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
jmp 0x413319
mov ecx, dword [edi]
mov eax, dword [ecx + 0xc]
cmp eax, dword [ecx + 0x10]
je 0x413314
add eax, 2
mov dword [ecx + 0xc], eax
jmp 0x413319
mov eax, dword [ecx]
call dword [eax + 0x24]
mov ecx, edi
call fcn.00416978
mov ebx, eax
test esi, esi
je 0x413346
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 0x10]
je 0x413333
movzx eax, word [eax]
jmp 0x41333a
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
cmp ax, 0xffff
je 0x413346
test bl, bl
jne 0x41334c
jmp 0x413390
xor esi, esi
test bl, bl
jne 0x413381
mov ecx, dword [edi]
mov eax, dword [ecx + 0xc]
cmp eax, dword [ecx + 0x10]
je 0x41335b
movzx eax, word [eax]
jmp 0x413360
mov eax, dword [ecx]
call dword [eax + 0x20]
mov ecx, dword [ebp + 0x14]
movzx eax, ax
mov edx, dword [ecx]
push eax
push 8
call dword [edx + 0xc]
test al, al
jne 0x413302
mov ecx, edi
call fcn.00416978
mov ebx, eax
test esi, esi
jne 0x413399
jmp 0x41338a
mov ecx, edi
call fcn.00416978
mov ebx, eax
test bl, bl
jne 0x4133b8
jmp 0x4133be
mov ecx, edi
call fcn.00416978
mov ebx, eax
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 0x10]
je 0x4133a6
movzx eax, word [eax]
jmp 0x4133ad
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
cmp ax, 0xffff
sete al
xor bl, al
jne 0x4133be
mov eax, dword [ebp + 0x10]
or byte [eax], 2
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x41a9a5
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x448258
call fcn.0041a620
push 1
call fcn.004197a9
pop ecx
test al, al
jne 0x41a85c
push 7
call fcn.0041a30c
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.00419757
mov byte [ebp - 0x24], al
mov eax, dword [0x44b718]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x41a855
test eax, eax
jne 0x41a8c6
mov dword [0x44b718], ecx
push 0x445c60
push 0x445c40
call fcn.004278fe
pop ecx
pop ecx
test eax, eax
je 0x41a8a9
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x41a99f
push 0x445c3c
push 0x445c2c
call fcn.004278b7
pop ecx
pop ecx
mov dword [0x44b718], 2
jmp 0x41a8cb
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.0041978c
pop ecx
call fcn.0041b027
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x41a8fb
push esi
call fcn.004196cd
pop ecx
test al, al
je 0x41a8fb
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.0041a469
call esi
call fcn.0041b02d
mov esi, eax
cmp dword [esi], edi
je 0x41a919
push esi
call fcn.004196cd
pop ecx
test al, al
je 0x41a919
push dword [esi]
call fcn.00425553
pop ecx
call fcn.0041a286
movzx eax, ax
push eax
call fcn.0042746d
push eax
push edi
push 0x400000
call main
mov esi, eax
call fcn.0041a2b9
test al, al
jne 0x41a944
push esi
call fcn.00425509
test bl, bl
jne 0x41a94d
call fcn.00425535
push edi
push 1
call fcn.004197e2
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x41a99f
call fcn.0041a666
ret
call fcn.0041af26
jmp 0x41a83d

Function at 0x41b69e
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x43efbc
push 0x43efb4
push 0x43efbc
push 0
call fcn.0041b901
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41b6d0
push dword [ebp + 8]
mov ecx, esi
call fcn.0041a469
call esi
pop esi
pop ebp
ret
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.DLL_TlsAlloc]

Function at 0x41b712
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x43efe0
push 0x43efd8
push 0x43efe0
push 2
call fcn.0041b901
add esp, 0x10
mov esi, eax
push dword [ebp + 8]
test esi, esi
je 0x41b743
mov ecx, esi
call fcn.0041a469
call esi
jmp 0x41b749
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
pop esi
pop ebp
ret

Function at 0x41b74c
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x43eff4
push 0x43efec
push 0x43eff4
push 3
call fcn.0041b901
add esp, 0x10
mov esi, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
test esi, esi
je 0x41b780
mov ecx, esi
call fcn.0041a469
call esi
jmp 0x41b786
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
pop esi
pop ebp
ret

Function at 0x435700
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043570b
Function at 0x405262
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x405279
pop esi
ret
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x4052ae
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x4052aa
cmp edi, eax
jae 0x4052ae
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x40529c
cmp edi, eax
jb 0x4052b2
xor eax, eax
jmp 0x4052bb
movzx eax, word [edi]
neg eax
sbb eax, eax
and eax, edi
pop edi
pop esi
ret
Function at 0x415b90
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor ecx, 0x1bcf
pop ecx
push esi
and esi, 0x8fc3
sub esi, 0x3d1f
or esi, 0x88af
pop esi
mov eax, dword [ebp - 0x458]
mov dword [ebp - 0x2f8], eax
jmp 0x415c24
Function at 0x416746
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov word [ebp - 0x30], dx
push edi
call 0x416759
add byte [edx], dh
aaa
cmp dword [ebx + edi + 0x40], ecx
dec ebp
add esp, 4
jmp 0x416761
and edi, 0x6614
pop edi
push ecx
sub ecx, 0xbce3
sub ecx, 0x13334
or ecx, 0x4ecb
pop ecx
movzx eax, word [ebp - 0x30]
test eax, eax
jne 0x416799
movzx ecx, word [ebp - 0x1c4]
movzx edx, word [ebp - 0x30]
sub ecx, edx
mov dword [ebp - 0x1624], ecx
jmp 0x4167f3
movzx eax, word [ebp - 0x1c4]
movzx ecx, word [ebp - 0x30]
cmp eax, ecx
je 0x4166c1
movzx edx, word [ebp - 0x1c4]
xor edx, 0x20
movzx eax, word [ebp - 0x30]

Function at 0x416759
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov word [ebp - 0x30], dx
push edi
call 0x416759
add byte [edx], dh
aaa
cmp dword [ebx + edi + 0x40], ecx
dec ebp
add esp, 4
jmp 0x416761
and edi, 0x6614
pop edi
push ecx
sub ecx, 0xbce3
sub ecx, 0x13334
or ecx, 0x4ecb
pop ecx
movzx eax, word [ebp - 0x30]
test eax, eax
jne 0x416799
movzx ecx, word [ebp - 0x1c4]
movzx edx, word [ebp - 0x30]
sub ecx, edx
mov dword [ebp - 0x1624], ecx
jmp 0x4167f3
movzx eax, word [ebp - 0x1c4]
movzx ecx, word [ebp - 0x30]
cmp eax, ecx
je 0x4166c1
movzx edx, word [ebp - 0x1c4]
xor edx, 0x20
movzx eax, word [ebp - 0x30]
Function at 0x416b73
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x778]
add edx, 1
mov dword [ebp - 0x778], edx
pop ecx
mov edx, dword [ebp - 0x77c]
add edx, dword [ebp - 0x120]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x120]
movsx edx, byte [ebp + ecx - 0x890]
cmp eax, edx
jne 0x416ba1
mov dword [ebp - 0xcd4], 0
jmp 0x416c10
push ebx
push edi
add esp, 4
sub ebx, 0x2d6
call 0x416bb8
add byte [ecx], bh
inc edx
cmp al, 0x35
cmp eax, 0x4c48336
xor ebx, 0x9f3a
jmp 0x416bc6
pop ebx
push eax
push ebx
add esp, 4
and eax, 0x12007
pop eax
mov eax, dword [ebp - 0x77c]
add eax, dword [ebp - 0x120]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x120]
movsx eax, byte [ebp + edx - 0x890]
or eax, 0x20
cmp dword [ebp - 0xcd4], 0
jne 0x416c27
mov ecx, dword [ebp - 0x19c4]
mov dword [ebp - 0x44c], ecx
jmp 0x416c38
jmp 0x416a11

Function at 0x416bb8
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x778]
add edx, 1
mov dword [ebp - 0x778], edx
pop ecx
mov edx, dword [ebp - 0x77c]
add edx, dword [ebp - 0x120]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x120]
movsx edx, byte [ebp + ecx - 0x890]
cmp eax, edx
jne 0x416ba1
mov dword [ebp - 0xcd4], 0
jmp 0x416c10
push ebx
push edi
add esp, 4
sub ebx, 0x2d6
call 0x416bb8
add byte [ecx], bh
inc edx
cmp al, 0x35
cmp eax, 0x4c48336
xor ebx, 0x9f3a
jmp 0x416bc6
pop ebx
push eax
push ebx
add esp, 4
and eax, 0x12007
pop eax
mov eax, dword [ebp - 0x77c]
add eax, dword [ebp - 0x120]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x120]
movsx eax, byte [ebp + edx - 0x890]
or eax, 0x20
cmp dword [ebp - 0xcd4], 0
jne 0x416c27
mov ecx, dword [ebp - 0x19c4]
mov dword [ebp - 0x44c], ecx
jmp 0x416c38
jmp 0x416a11

Function at 0x416bf6
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp ecx, eax
jge 0x416c06
mov dword [ebp - 0xcd4], 0xffffffff
jmp 0x416c10
mov dword [ebp - 0xcd4], 1
Function at 0x417012
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
pop eax
push esi
sub esi, 0x16337
add esi, 0x5abd
pop esi
push edi
push esi
add esp, 4
sub edi, 0x185e5
add edi, 0x11030
pop edi
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x417050
movzx ecx, word [ebp - 0x1c8]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x163c], ecx
jmp 0x4170aa
movzx eax, word [ebp - 0x1c8]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x416f78
movzx edx, word [ebp - 0x1c8]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x416f78
movzx ecx, word [ebp - 0x1c8]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x417094
mov dword [ebp - 0x1638], 0xffffffff
jmp 0x41709e
mov dword [ebp - 0x1638], 1
mov eax, dword [ebp - 0x1638]
mov dword [ebp - 0x163c], eax
cmp dword [ebp - 0x163c], 0
jne 0x4170f3
push edx
sub edx, 0x11924
xor edx, 0x2ccf
pop edx
push esi
push ebx
add esp, 4
call 0x4170d5
add byte [0x44424238], dh
cmp dword [ecx + 0x49], ecx
xor al, byte [ebx - 0x317efb3c]
in eax, 0x1d
add dword [eax], eax
add esi, 0x142b7
pop esi
mov ecx, dword [ebp - 0x448]
mov dword [ebp - 0x2fc], ecx
jmp 0x41715b
push ebx
jmp 0x4170fb
sub ebx, 0x13b13
sub ebx, 0x8284
pop ebx
push ecx
call 0x417115
add byte [ecx + 0x34], al
inc ecx
aaa
xor dh, byte [edx]
add esp, 4
and ecx, 0x13108
and ecx, 0xfe51
pop ecx
mov edx, dword [ebp - 0x448]
mov eax, dword [edx]
mov dword [ebp - 0x448], eax
mov ecx, dword [ebp - 0x448]
cmp ecx, dword [ebp - 0xce0]
je 0x417151
mov edx, dword [ebp - 0x448]
cmp dword [edx + 0x30], 0
jne 0x416f1c
mov dword [ebp - 0x2fc], 0
Function at 0x4170d5
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
pop eax
push esi
sub esi, 0x16337
add esi, 0x5abd
pop esi
push edi
push esi
add esp, 4
sub edi, 0x185e5
add edi, 0x11030
pop edi
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x417050
movzx ecx, word [ebp - 0x1c8]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x163c], ecx
jmp 0x4170aa
movzx eax, word [ebp - 0x1c8]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x416f78
movzx edx, word [ebp - 0x1c8]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x416f78
movzx ecx, word [ebp - 0x1c8]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x417094
mov dword [ebp - 0x1638], 0xffffffff
jmp 0x41709e
mov dword [ebp - 0x1638], 1
mov eax, dword [ebp - 0x1638]
mov dword [ebp - 0x163c], eax
cmp dword [ebp - 0x163c], 0
jne 0x4170f3
push edx
sub edx, 0x11924
xor edx, 0x2ccf
pop edx
push esi
push ebx
add esp, 4
call 0x4170d5
add byte [0x44424238], dh
cmp dword [ecx + 0x49], ecx
xor al, byte [ebx - 0x317efb3c]
in eax, 0x1d
add dword [eax], eax
add esi, 0x142b7
pop esi
mov ecx, dword [ebp - 0x448]
mov dword [ebp - 0x2fc], ecx
jmp 0x41715b
push ebx
jmp 0x4170fb
sub ebx, 0x13b13
sub ebx, 0x8284
pop ebx
push ecx
call 0x417115
add byte [ecx + 0x34], al
inc ecx
aaa
xor dh, byte [edx]
add esp, 4
and ecx, 0x13108
and ecx, 0xfe51
pop ecx
mov edx, dword [ebp - 0x448]
mov eax, dword [edx]
mov dword [ebp - 0x448], eax
mov ecx, dword [ebp - 0x448]
cmp ecx, dword [ebp - 0xce0]
je 0x417151
mov edx, dword [ebp - 0x448]
cmp dword [edx + 0x30], 0
jne 0x416f1c
mov dword [ebp - 0x2fc], 0
Function at 0x417115
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
pop eax
push esi
sub esi, 0x16337
add esi, 0x5abd
pop esi
push edi
push esi
add esp, 4
sub edi, 0x185e5
add edi, 0x11030
pop edi
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x417050
movzx ecx, word [ebp - 0x1c8]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x163c], ecx
jmp 0x4170aa
movzx eax, word [ebp - 0x1c8]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x416f78
movzx edx, word [ebp - 0x1c8]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x416f78
movzx ecx, word [ebp - 0x1c8]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x417094
mov dword [ebp - 0x1638], 0xffffffff
jmp 0x41709e
mov dword [ebp - 0x1638], 1
mov eax, dword [ebp - 0x1638]
mov dword [ebp - 0x163c], eax
cmp dword [ebp - 0x163c], 0
jne 0x4170f3
push edx
sub edx, 0x11924
xor edx, 0x2ccf
pop edx
push esi
push ebx
add esp, 4
call 0x4170d5
add byte [0x44424238], dh
cmp dword [ecx + 0x49], ecx
xor al, byte [ebx - 0x317efb3c]
in eax, 0x1d
add dword [eax], eax
add esi, 0x142b7
pop esi
mov ecx, dword [ebp - 0x448]
mov dword [ebp - 0x2fc], ecx
jmp 0x41715b
push ebx
jmp 0x4170fb
sub ebx, 0x13b13
sub ebx, 0x8284
pop ebx
push ecx
call 0x417115
add byte [ecx + 0x34], al
inc ecx
aaa
xor dh, byte [edx]
add esp, 4
and ecx, 0x13108
and ecx, 0xfe51
pop ecx
mov edx, dword [ebp - 0x448]
mov eax, dword [edx]
mov dword [ebp - 0x448], eax
mov ecx, dword [ebp - 0x448]
cmp ecx, dword [ebp - 0xce0]
je 0x417151
mov edx, dword [ebp - 0x448]
cmp dword [edx + 0x30], 0
jne 0x416f1c
mov dword [ebp - 0x2fc], 0
Function at 0x417189
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop esi
cmp dword [ebp - 0x2fc], 0
jne 0x417a92
mov eax, 0x6b
mov word [ebp - 0x17c8], ax
mov ecx, 0x65
mov word [ebp - 0x17c6], cx
mov edx, 0x72
mov word [ebp - 0x17c4], dx
mov eax, 0x6e
mov word [ebp - 0x17c2], ax
mov ecx, 0x65
mov word [ebp - 0x17c0], cx
mov edx, 0x6c
mov word [ebp - 0x17be], dx
mov eax, 0x33
mov word [ebp - 0x17bc], ax
mov ecx, 0x32
mov word [ebp - 0x17ba], cx
mov edx, 0x2e
mov word [ebp - 0x17b8], dx
mov eax, 0x64
mov word [ebp - 0x17b6], ax
mov ecx, 0x6c
mov word [ebp - 0x17b4], cx
mov edx, 0x6c
mov word [ebp - 0x17b2], dx
xor eax, eax
mov word [ebp - 0x17b0], ax
push ebx
push ecx
add esp, 4
xor ebx, 0xe7ea
jmp 0x417246
xor ebx, 0xabef
or ebx, 0x4035
pop ebx
push esi
push esi
add esp, 4
sub esi, 0x8b02
add esi, 0x5cb1
pop esi
mov byte [ebp - 0x8cc], 0x4c
mov byte [ebp - 0x8cb], 0x6f
mov byte [ebp - 0x8ca], 0x61
invalid
invalid

Function at 0x420caa
Capabilities:
Encode data using xor

Disassembly:
sti
add eax, dword [ebx]
add al, 4
add al, 4
push ebp
push ebp
xchg eax, ecx
or byte [ebp + 0x40239e5], al
add al, 0x85
lds esp, [esp + edi*4 + 4]
add al, 0x5d
pop edx
push edi
xchg eax, ecx
or byte [ebp + 0x484e6ca], al
add al, 0x62
push edi
test edi, esp
add al, 0xb
add eax, 0x78ef8504
push edi
add al, 4
test edi, esp
call 0x5f46119b
xchg ecx, eax
shl dword [eax + 0x40303fb], 0x79
inc ebp
shl dword [eax + 0x40303fb], 0x79
inc ebp
push esp
push esp
xchg eax, ecx
or byte [ebp + 0x47853e4], al
add al, 0xec
push cs
add al, 4
add al, 4
cmp byte [ebx + ecx*2 + 0x3d], dl
cmp ecx, dword [eax + 0x3c]
cmp dword [edx - 0x79], ecx
enter 0xffffffffffff8508, 0xffffffffffffffec
pop esp
xor byte [esp + eax], al
test esp, esi
ja 0x420c70
add al, 4
pop esp
push esp
test esp, esp
jb 0x420cff
add al, 4
pop esp
retf
or byte [ebp + 0x52a64e4], al
add al, 0x85
hlt
Function at 0x43ab72
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4d3a4e
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
mov eax, dword [0x52472c]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x18], 8
jb 0x43abab
mov eax, dword [eax + 4]
jmp 0x43abae
add eax, 4
push eax
lea esi, [esp + 0x30]
call fcn.0044054d
and dword [esp + 0x48], 0
push 3
pop eax
mov word [esp + 0x1c], ax
mov dword [esp + 0x24], 0xe
mov byte [esp + 0x48], 1
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [esp + 0x48], 2
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x1a4]
mov ecx, dword [eax]
lea edx, [esp + 0xc]
push edx
push edx
push edx
lea edx, [esp + 0x28]
push edx
mov edx, esi
push edx
push eax
call dword [ecx + 0xd0]
test eax, eax
setge bl
mov byte [esp + 0x48], 1
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [esp + 0xc]
push eax
call esi
mov byte [esp + 0x48], 0
lea eax, [esp + 0x1c]
push eax
call esi
or dword [esp + 0x48], 0xffffffff
lea eax, [esp + 0x2c]
push eax
call esi
mov al, bl
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8