joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43c584
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov edi, ecx
call fcn.0043a7ff
mov esi, str.kernel32
mov edx, str.TryEnterCriticalSection
mov ecx, esi
call fcn.004a3fa7
mov edx, str.SetFileValidData
mov ecx, esi
mov dword [0x547ed0], eax
call fcn.004a3fa7
xor esi, esi
mov dword [0x547dd8], eax
cmp eax, esi
je 0x43c5d2
push 2
pop edx
mov ecx, str.SeManageVolumePrivilege
call fcn.004a464d
mov byte [0x547d70], al
push esi
push esi
push esi
push esi
mov dword [0x547ddc], esi
mov dword [0x547de0], 0x547ddc
mov dword [0x547d74], esi
mov dword [0x547d78], 0x547d74
mov dword [0x547ecc], esi
call dword [sym.imp.KERNEL32.DLL_CreateEventA]
mov edx, 0x4f88d0
mov ecx, 0x547de4
mov dword [0x547d7c], eax
call fcn.0043ed5f
mov edx, 0x4f88cc
mov ecx, 0x549330
call fcn.0043ed5f
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.DLL_GlobalMemoryStatus]
cmp dword [ebp - 0x18], 0x8000000
jae 0x43c63f
mov eax, 0x800000
jmp 0x43c650
mov eax, dword [ebp - 0x18]
shr eax, 4
mov ecx, 0x2000000
cmp eax, ecx
jb 0x43c650
mov eax, ecx
push esi
push eax
push esi
push dword [ebp - 0x18]
mov dword [0x547d80], eax
push str.total_physical_memory__Ld_max_disk_cache__Ld
call fcn.0041ff85
add esp, 0x14
push 0x547ee4
push edi
push 0x43c55b
mov ecx, edi
call fcn.0048f20e
pop edi
pop esi
leave
ret

Function at 0x43cb0d
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x18]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x1c]
and dword [edi], 0
push dword [ebp + 8]
mov byte [eax], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebx, eax
test ebx, ebx
je 0x43cb86
cmp word [ebx + 8], 2
jne 0x43cb63
cmp word [ebx + 0xa], 4
jne 0x43cb63
mov esi, dword [ebx + 0xc]
jmp 0x43cb5d
push dword [eax]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0043caa6
mov dword [edi], eax
test eax, eax
je 0x43cb81
lea edi, [eax + 0x1c]
add esi, 4
mov eax, dword [esi]
test eax, eax
jne 0x43cb41
mov esi, dword [ebp + 0x18]
push 0x400
push dword [ebx]
push esi
call sub.MSVCRT.dll_strncpy
add esp, 0xc
mov byte [esi + 0x400], 0
xor eax, eax
jmp 0x43cbac
push 8
pop eax
jmp 0x43cbac
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
mov eax, 0x2af9
sub ecx, eax
je 0x43cbac
dec ecx
je 0x43cba7
dec ecx
je 0x43cba0
dec ecx
jmp 0x43cbac
mov eax, 0x2afb
jmp 0x43cbac
mov eax, 0x2afa
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
Function at 0x43d18a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
cmp dword [0x5481cc], 0
mov dword [ebp - 0x18], str.getaddrinfo
mov dword [ebp - 0x14], 0x43cd48
mov dword [ebp - 0x10], str.getnameinfo
mov dword [ebp - 0xc], 0x43cfd2
mov dword [ebp - 8], str.freeaddrinfo
mov dword [ebp - 4], fcn.0043cd0f
jne 0x43d2e6
push 0x104
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
test eax, eax
je 0x43d2dc
xor eax, eax
mov cl, byte [ebp + eax - 0x22c]
mov byte [ebp + eax - 0x124], cl
inc eax
test cl, cl
jne 0x43d1e6
push edi
lea edi, [ebp - 0x124]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x43d201
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
push esi
mov esi, str.ws2_32
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x124]
push eax
movsd dword es:[edi], dword [esi]
call ebx
mov esi, eax
test esi, esi
je 0x43d244
push str.getaddrinfo
push esi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
jne 0x43d240
push esi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
xor esi, esi
test esi, esi
jne 0x43d29b
xor eax, eax
mov cl, byte [ebp + eax - 0x22c]
mov byte [ebp + eax - 0x124], cl
inc eax
test cl, cl
jne 0x43d246
lea edi, [ebp - 0x124]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x43d260
mov esi, str.wship6
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x124]
push eax
movsd dword es:[edi], dword [esi]
call ebx
mov esi, eax
test esi, esi
je 0x43d2d9
push str.getaddrinfo
push esi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
jne 0x43d297
push esi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
xor esi, esi
test esi, esi
je 0x43d2d9
xor edi, edi
push dword [ebp + edi*8 - 0x18]
push esi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [ebp + edi*8 - 0x14], eax
test eax, eax
je 0x43d2b8
inc edi
cmp edi, 3
jl 0x43d29d
jmp 0x43d2c1
push esi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
xor esi, esi
test esi, esi
je 0x43d2d9
xor eax, eax
mov ecx, dword [ebp + eax - 0x14]
mov dword [eax + 0x532898], ecx
add eax, 8
cmp eax, 0x18
jl 0x43d2c7
pop esi
pop ebx
pop edi
mov dword [0x5481cc], 1
movzx eax, word [ebp + 8]
mov eax, dword [eax*8 + 0x532898]
leave
ret 4

Function at 0x43edad
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
push esi
mov esi, dword [ebp + 0x20]
push edi
test esi, esi
jne 0x43edc3
lea esi, [ebp - 4]
push esi
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov edi, eax
mov eax, dword [esi]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov esi, 0x5481f8
mov ecx, esi
mov dword [ebp - 8], eax
call fcn.0043eb66
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x548218
call fcn.0043eca1
mov ecx, esi
call fcn.0043ebe4
mov eax, edi
pop edi
pop esi
leave
ret 0x1c
Function at 0x440ceb
Capabilities:
Delete file

Disassembly:
push ebx
push esi
mov bl, dl
mov esi, ecx
call fcn.00472429
test al, al
je 0x440d25
test bl, bl
je 0x440d1e
mov ecx, esi
call fcn.0047283d
test eax, eax
je 0x440d25
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push esi
push str.Warning:_Delete_to_trash_failed_for__s._Error:__d._Deleting_permanently.
call fcn.0041ffc1
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
pop esi
pop ebx
ret
Function at 0x441a5a
Capabilities:
Delete directory
Delete file

Disassembly:
push ecx
push ecx
push ebp
xor eax, eax
mov ebp, ecx
mov dword [esp + 8], eax
cmp dword [ebp + 8], eax
je 0x441b6d
push ebx
push esi
mov dword [esp + 0xc], eax
push edi
mov esi, dword [ebp]
add esi, dword [esp + 0x10]
mov ecx, dword [ebp + 0x1c]
mov edx, dword [esi + 0x1c]
push 0
call fcn.004a3284
mov edi, eax
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x441a8e
sub eax, ecx
sar eax, 1
mov ecx, eax
mov eax, dword [esi + 0x1c]
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
test si, si
jne 0x441aa4
sub eax, edx
sar eax, 1
sub ecx, eax
lea esi, [edi + ecx*2 - 2]
jmp 0x441b39
xor ecx, ecx
push edi
mov word [eax], cx
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
test eax, eax
jne 0x441b39
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x91
jne 0x441b39
push 0
mov edx, str.thumbs.db
mov ecx, edi
call fcn.004a3284
mov ecx, eax
call fcn.0048c329
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
test eax, eax
push 0
mov edx, str..DS_Store
mov ecx, edi
setne bl
call fcn.004a3284
mov ecx, eax
call fcn.0048c329
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
test eax, eax
setne al
test bl, bl
jne 0x441b21
test al, al
je 0x441b4b
push edi
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
test eax, eax
jne 0x441b39
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x91
je 0x441b4b
push 0x5c
push edi
call sub.MSVCRT.dll_wcsrchr
pop ecx
pop ecx
cmp eax, esi
jae 0x441aba
mov dl, 1
mov ecx, edi
call fcn.0046b3e9
inc dword [esp + 0x14]
mov eax, dword [esp + 0x14]
add dword [esp + 0x10], 0x70
cmp eax, dword [ebp + 8]
jne 0x441a75
pop edi
pop esi
pop ebx
pop ebp
pop ecx
pop ecx
ret

Function at 0x441cda
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
push ebx
mov edi, ecx
call fcn.00441748
mov esi, dword [ebp + 8]
mov eax, dword [edi]
imul esi, esi, 0x70
add eax, esi
push eax
mov ecx, edi
call fcn.00440ed3
lea ecx, [ebp - 4]
mov dword [ebp - 4], eax
call fcn.0048ea50
mov ecx, eax
call fcn.00472429
test al, al
je 0x441d33
push dword [ebp + 0xc]
lea ecx, [ebp - 4]
call fcn.0048ea50
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileW]
test eax, eax
jne 0x441d33
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov ebx, eax
jmp 0x441d48
mov ecx, dword [ebp + 0xc]
call fcn.004221f4
push eax
mov eax, dword [edi]
add eax, esi
push eax
mov ecx, edi
call fcn.00441929
lea ecx, [ebp - 4]
call fcn.0048e75f
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x441d59
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov ecx, dword [esi + 0x1c]
xor ebx, ebx
call fcn.004a3b17
mov ecx, dword [esi + 0x1c]
test al, al
je 0x441d7b
call fcn.004221f4
jmp 0x441d80
call fcn.00488a27
lea ecx, [ebp - 4]
mov dword [ebp - 4], eax
call fcn.0048ea5c
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 4]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
call fcn.0048ea50
push eax
mov ecx, esi
call fcn.004411e3
xor esi, esi
cmp dword [ebp - 8], ebx
jbe 0x441e03
mov eax, dword [ebp - 0x10]
lea eax, [eax + esi*4]
push dword [eax]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
mov ecx, dword [ebp - 8]
cmp eax, 0xffffffff
je 0x441dde
test al, 0x10
jne 0x441de5
lea edx, [ecx - 1]
cmp esi, edx
je 0x441de9
test eax, 0x1000
jne 0x441e03
test eax, 0x400
jne 0x441e03
inc esi
cmp esi, ecx
jb 0x441daf
jmp 0x441e03
mov bl, 1
jmp 0x441e03
mov eax, dword [ebp - 0x10]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [eax + esi*4]
push ebx
push dword [eax]
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationW]
test eax, eax
setne bl
lea ecx, [ebp - 0x10]
call fcn.00402810
lea ecx, [ebp - 4]
call fcn.0048e75f
pop esi
mov al, bl
pop ebx
leave
ret

Function at 0x44258f
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor edi, edi
push edi
mov esi, ecx
call fcn.00441748
cmp byte [esi + 0x28], 0
mov ecx, esi
jne 0x4425fd
call fcn.00441d59
mov ebx, 0x70000001
test al, al
je 0x4425db
mov eax, dword [esi]
mov cl, byte [eax + 0x26]
shr cl, 3
push 1
and cl, 1
movzx ecx, cl
push ecx
push dword [ebp + 8]
push dword [esi + 0x1c]
push dword [eax + 0x1c]
push dword [ebp + 0xc]
call fcn.00440f3d
mov edi, eax
jmp 0x4425dd
mov edi, ebx
test edi, edi
je 0x4425e9
cmp edi, ebx
jne 0x442697
mov ecx, dword [ebp + 0xc]
call fcn.004221f4
push eax
push dword [esi]
mov ecx, esi
call fcn.00441929
jmp 0x44267b
call fcn.00441d59
test al, al
je 0x442676
lea ecx, [ebp + 0xc]
call fcn.0048ea4a
push dword [ebp + 8]
push dword [esi + 0x1c]
push str.Moving_files_from__s_to__s
call fcn.0041ffc1
mov ebx, dword [sym.imp.KERNEL32.DLL_MoveFileW]
add esp, 0xc
push dword [ebp + 8]
push dword [esi + 0x1c]
call ebx
test eax, eax
jne 0x44266c
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
jne 0x442658
push dword [ebp + 8]
mov ecx, esi
call fcn.00441c17
mov edi, eax
test edi, edi
je 0x44266c
lea ecx, [ebp + 0xc]
call fcn.0048e75f
jmp 0x442697
mov ecx, dword [ebp + 8]
call fcn.004a4bf3
push dword [ebp + 8]
push dword [esi + 0x1c]
call ebx
test eax, eax
je 0x44263e
lea ecx, [ebp + 0xc]
call fcn.0048e75f
jmp 0x44267b
mov edi, 0x70000001
call fcn.0046e5c1
mov edx, dword [ebp + 8]
lea ecx, [esi + 0x1c]
call fcn.0048d9fe
mov ecx, esi
call fcn.004418e1
call fcn.0046e5dd
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x449eea
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add esp, 4
or eax, 0xfd93
pop eax
mov byte [ebp - 0x9d4], 0x56
mov byte [ebp - 0x9d3], 0x69
mov byte [ebp - 0x9d2], 0x72
mov byte [ebp - 0x9d1], 0x74
mov byte [ebp - 0x9d0], 0x75
mov byte [ebp - 0x9cf], 0x61
mov byte [ebp - 0x9ce], 0x6c
mov byte [ebp - 0x9cd], 0x50
mov byte [ebp - 0x9cc], 0x72
mov byte [ebp - 0x9cb], 0x6f
mov byte [ebp - 0x9ca], 0x74
mov byte [ebp - 0x9c9], 0x65
mov byte [ebp - 0x9c8], 0x63
mov byte [ebp - 0x9c7], 0x74
mov byte [ebp - 0x9c6], 0
push edi
add edi, 0x10cb0
jmp 0x449f6c
pop edi
push esi
push edx
add esp, 4
xor esi, 0x161cf
call 0x449f85
add byte [0x3b3a4736], bh
dec eax
dec ecx
add esp, 4
add esi, 0xec7
pop esi
mov eax, dword fs:[0x18]
mov dword [ebp - 0x1994], eax
mov ecx, dword [ebp - 0x1994]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x1998], edx
mov eax, dword [ebp - 0x1998]
mov dword [ebp - 0x1614], eax
push edi
push ecx
add esp, 4
and edi, 0x13643
xor edi, 0x103d2
xor edi, 0x17b38
pop edi
push esi
add esi, 0xbb2b
pop esi
push ecx
push ebx
add esp, 4
add ecx, 0x675d
or ecx, 0xb25a
pop ecx
cmp dword [ebp - 0x1614], 0
jne 0x44a000
mov dword [ebp - 0x2fc], 0
jmp 0x44a2a7
mov ecx, dword [ebp - 0x1614]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xcc4], eax
push eax
push edi
add esp, 4
sub eax, 0xbd32
pop eax
push ebx
or ebx, 0x1196e
jmp 0x44a02d
pop ebx
push eax
sub eax, 0x89d7
pop eax
push ecx
xor ecx, 0xd739

Function at 0x449f85
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or eax, 0xfd93
pop eax
mov byte [ebp - 0x9d4], 0x56
mov byte [ebp - 0x9d3], 0x69
mov byte [ebp - 0x9d2], 0x72
mov byte [ebp - 0x9d1], 0x74
mov byte [ebp - 0x9d0], 0x75
mov byte [ebp - 0x9cf], 0x61
mov byte [ebp - 0x9ce], 0x6c
mov byte [ebp - 0x9cd], 0x50
mov byte [ebp - 0x9cc], 0x72
mov byte [ebp - 0x9cb], 0x6f
mov byte [ebp - 0x9ca], 0x74
mov byte [ebp - 0x9c9], 0x65
mov byte [ebp - 0x9c8], 0x63
mov byte [ebp - 0x9c7], 0x74
mov byte [ebp - 0x9c6], 0
push edi
add edi, 0x10cb0
jmp 0x449f6c
pop edi
push esi
push edx
add esp, 4
xor esi, 0x161cf
call 0x449f85
add byte [0x3b3a4736], bh
dec eax
dec ecx
add esp, 4
add esi, 0xec7
pop esi
mov eax, dword fs:[0x18]
mov dword [ebp - 0x1994], eax
mov ecx, dword [ebp - 0x1994]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x1998], edx
mov eax, dword [ebp - 0x1998]
mov dword [ebp - 0x1614], eax
push edi
push ecx
add esp, 4
and edi, 0x13643
xor edi, 0x103d2
xor edi, 0x17b38
pop edi
push esi
add esi, 0xbb2b
pop esi
push ecx
push ebx
add esp, 4
add ecx, 0x675d
or ecx, 0xb25a
pop ecx
cmp dword [ebp - 0x1614], 0
jne 0x44a000
mov dword [ebp - 0x2fc], 0
jmp 0x44a2a7
mov ecx, dword [ebp - 0x1614]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xcc4], eax
push eax
push edi
add esp, 4
sub eax, 0xbd32
pop eax
push ebx
or ebx, 0x1196e
jmp 0x44a02d
pop ebx
push eax
sub eax, 0x89d7
pop eax
push ecx
xor ecx, 0xd739
Function at 0x44a03d
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
or ecx, 0x5152
pop ecx
cmp dword [ebp - 0xcc4], 0
jne 0x44a05c
mov dword [ebp - 0x2fc], 0
jmp 0x44a2a7
mov ecx, dword [ebp - 0xcc4]
mov dword [ebp - 0x514], ecx
push ecx
push edx
add esp, 4
add ecx, 0x5aea
or ecx, 0x10348
add ecx, 0x84fc
pop ecx
push esi
add esi, 0xea9
or esi, 0x14fb6
pop esi
push esi
push ebx
add esp, 4
xor esi, 0x12997
pop esi
lea edx, [ebp - 0x1738]
mov dword [ebp - 0xcc0], edx
mov eax, dword [ebp - 0x514]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcbc], ecx
xor edx, edx
mov word [ebp - 0x21c], dx
xor eax, eax
mov word [ebp - 0x38], ax
push ebx
push esi
add esp, 4
sub ebx, 0x17da8
jmp 0x44a0d6
pop ebx
push ecx
push edi
add esp, 4
xor ecx, 0x1623a
jmp 0x44a0e9
pop ecx
push edi
push ecx
add esp, 4
and edi, 0xdcfd
pop edi
mov ecx, dword [ebp - 0xcbc]
mov dx, word [ecx]
mov word [ebp - 0x103e], dx
mov eax, dword [ebp - 0xcbc]
add eax, 2
mov dword [ebp - 0xcbc], eax
mov cx, word [ebp - 0x103e]
mov word [ebp - 0x21c], cx
mov edx, dword [ebp - 0xcc0]
mov ax, word [edx]
mov word [ebp - 0x1040], ax
mov ecx, dword [ebp - 0xcc0]
add ecx, 2
mov dword [ebp - 0xcc0], ecx
mov dx, word [ebp - 0x1040]
mov word [ebp - 0x38], dx
push edi
sub edi, 0xb04d
and edi, 0xda5d
add edi, 0x47c8
pop edi
push esi
push ecx
add esp, 4
sub esi, 0x11650
add esi, 0x13b9f
xor esi, 0x1348d
sub esi, 0x1811e
pop esi
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x44a19c
movzx ecx, word [ebp - 0x21c]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x161c], ecx
jmp 0x44a1f6
movzx eax, word [ebp - 0x21c]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x44a0c4
movzx edx, word [ebp - 0x21c]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x44a0c4
movzx ecx, word [ebp - 0x21c]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x44a1e0
mov dword [ebp - 0x1618], 0xffffffff
jmp 0x44a1ea
mov dword [ebp - 0x1618], 1
mov eax, dword [ebp - 0x1618]
mov dword [ebp - 0x161c], eax
cmp dword [ebp - 0x161c], 0
jne 0x44a23f
inc eax
push ecx
sub ecx, 0xd2a3
pop ecx
push edx
jmp 0x44a210
sub edx, 0xe940
sub edx, 0x7ffe
pop edx
push ecx
call 0x44a22d
add byte [ebx + 0x3a], cl
cmp cl, byte [esi + 0x36]
inc esp
cmp bh, byte ss:[esi]
add esp, 4
pop ecx
mov ecx, dword [ebp - 0x514]
mov dword [ebp - 0x2fc], ecx
jmp 0x44a2a7
push edx
push ebx
add esp, 4
sub edx, 0x4372
add edx, 0x1030c
jmp 0x44a258
xor edx, 0x3f93
pop edx
push eax
push ebx
add esp, 4
invalid
enter 0xffffffffffffb977, 0
Function at 0x44a22d
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
or ecx, 0x5152
pop ecx
cmp dword [ebp - 0xcc4], 0
jne 0x44a05c
mov dword [ebp - 0x2fc], 0
jmp 0x44a2a7
mov ecx, dword [ebp - 0xcc4]
mov dword [ebp - 0x514], ecx
push ecx
push edx
add esp, 4
add ecx, 0x5aea
or ecx, 0x10348
add ecx, 0x84fc
pop ecx
push esi
add esi, 0xea9
or esi, 0x14fb6
pop esi
push esi
push ebx
add esp, 4
xor esi, 0x12997
pop esi
lea edx, [ebp - 0x1738]
mov dword [ebp - 0xcc0], edx
mov eax, dword [ebp - 0x514]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcbc], ecx
xor edx, edx
mov word [ebp - 0x21c], dx
xor eax, eax
mov word [ebp - 0x38], ax
push ebx
push esi
add esp, 4
sub ebx, 0x17da8
jmp 0x44a0d6
pop ebx
push ecx
push edi
add esp, 4
xor ecx, 0x1623a
jmp 0x44a0e9
pop ecx
push edi
push ecx
add esp, 4
and edi, 0xdcfd
pop edi
mov ecx, dword [ebp - 0xcbc]
mov dx, word [ecx]
mov word [ebp - 0x103e], dx
mov eax, dword [ebp - 0xcbc]
add eax, 2
mov dword [ebp - 0xcbc], eax
mov cx, word [ebp - 0x103e]
mov word [ebp - 0x21c], cx
mov edx, dword [ebp - 0xcc0]
mov ax, word [edx]
mov word [ebp - 0x1040], ax
mov ecx, dword [ebp - 0xcc0]
add ecx, 2
mov dword [ebp - 0xcc0], ecx
mov dx, word [ebp - 0x1040]
mov word [ebp - 0x38], dx
push edi
sub edi, 0xb04d
and edi, 0xda5d
add edi, 0x47c8
pop edi
push esi
push ecx
add esp, 4
sub esi, 0x11650
add esi, 0x13b9f
xor esi, 0x1348d
sub esi, 0x1811e
pop esi
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x44a19c
movzx ecx, word [ebp - 0x21c]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x161c], ecx
jmp 0x44a1f6
movzx eax, word [ebp - 0x21c]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x44a0c4
movzx edx, word [ebp - 0x21c]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x44a0c4
movzx ecx, word [ebp - 0x21c]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x44a1e0
mov dword [ebp - 0x1618], 0xffffffff
jmp 0x44a1ea
mov dword [ebp - 0x1618], 1
mov eax, dword [ebp - 0x1618]
mov dword [ebp - 0x161c], eax
cmp dword [ebp - 0x161c], 0
jne 0x44a23f
inc eax
push ecx
sub ecx, 0xd2a3
pop ecx
push edx
jmp 0x44a210
sub edx, 0xe940
sub edx, 0x7ffe
pop edx
push ecx
call 0x44a22d
add byte [ebx + 0x3a], cl
cmp cl, byte [esi + 0x36]
inc esp
cmp bh, byte ss:[esi]
add esp, 4
pop ecx
mov ecx, dword [ebp - 0x514]
mov dword [ebp - 0x2fc], ecx
jmp 0x44a2a7
push edx
push ebx
add esp, 4
sub edx, 0x4372
add edx, 0x1030c
jmp 0x44a258
xor edx, 0x3f93
pop edx
push eax
push ebx
add esp, 4
invalid
enter 0xffffffffffffb977, 0
Function at 0x44a334
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
mov dword [ebp - 0x1784], eax
mov ecx, 0x32
mov word [ebp - 0x1782], cx
mov edx, 0x2e
mov word [ebp - 0x1780], dx
mov eax, 0x64
mov word [ebp - 0x177e], ax
mov ecx, 0x6c
mov word [ebp - 0x177c], cx
mov edx, 0x6c
mov word [ebp - 0x177a], dx
xor eax, eax
mov word [ebp - 0x1778], ax
push eax
push ecx
add esp, 4
and eax, 0x18390
or eax, 0x248f
and eax, 0x6676
pop eax
push esi
sub esi, 0x10d5b
add esi, 0x52a1
add esi, 0xd98c
or esi, 0xe828
pop esi
mov byte [ebp - 0x8a4], 0x4c
mov byte [ebp - 0x8a3], 0x6f
mov byte [ebp - 0x8a2], 0x61
mov byte [ebp - 0x8a1], 0x64
mov byte [ebp - 0x8a0], 0x4c
mov byte [ebp - 0x89f], 0x69
mov byte [ebp - 0x89e], 0x62
mov byte [ebp - 0x89d], 0x72
mov byte [ebp - 0x89c], 0x61
mov byte [ebp - 0x89b], 0x72
mov byte [ebp - 0x89a], 0x79
mov byte [ebp - 0x899], 0x57
mov byte [ebp - 0x898], 0
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x199c], ecx
mov edx, dword [ebp - 0x199c]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x19a0], eax
mov ecx, dword [ebp - 0x19a0]
mov dword [ebp - 0x1620], ecx
push edx
push esi
add esp, 4
xor edx, 0xbc19
sub edx, 0xfce7
or edx, 0xb955
pop edx
push esi
jmp 0x44a455
call fcn.0044a462
add byte [ebx], dh
inc edi
xor al, 0x3a
inc ebx
inc edi
xor eax, dword [ebx - 0x7ca1fb3c]
add esp, 4
pop esi
cmp dword [ebp - 0x1620], 0
jne 0x44a47e
mov dword [ebp - 0x774], 0
jmp 0x44a725
Function at 0x44a7b5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
and esi, 0x10ae5
pop esi
push ecx
push ebx
add esp, 4
sub ecx, 0x142fa
or ecx, 0x176ee
and ecx, 0xac1d
or ecx, 0x9863
pop ecx
push ecx
push ebx
add esp, 4
sub ecx, 0x17db3
pop ecx
lea eax, [ebp - 0x1790]
mov dword [ebp - 0xccc], eax
mov ecx, dword [ebp - 0x518]
sub ecx, 0xabd4
or ecx, 0x161cd
sub ecx, 0x621c
call 0x44a6dd
add byte [edx], bh
cmp dh, byte [edi + edi]
dec ebx
xor cl, byte [eax - 0x7d]
les eax, [ecx + ebx*2]
push edx
or edx, 0x1403e
sub edx, 0x6c9b
pop edx
mov eax, dword [ebp - 0x518]
mov ecx, dword [eax]
mov dword [ebp - 0x518], ecx
mov edx, dword [ebp - 0x518]
cmp edx, dword [ebp - 0xcd0]
je 0x44a71b
mov eax, dword [ebp - 0x518]
cmp dword [eax + 0x30], 0
jne 0x44a4e6
mov dword [ebp - 0x774], 0
push edi
push eax
add esp, 4
sub edi, 0x5b61
or edi, 0x13125
pop edi
push ecx
and ecx, 0xf47f
pop ecx
push edi
push esi
add esp, 4
sub edi, 0x2ab7
sub edi, 0x13315
xor edi, 0xa63f
pop edi
cmp dword [ebp - 0x774], 0
jne 0x44a7a1
push esi
add esi, 0x12018
add esi, 0xcb9
or esi, 0x88c3
pop esi
push eax
push ebx
add esp, 4
sub eax, 0xcacd
xor eax, 0x6d7f
pop eax
push eax
push ecx
add esp, 4
xor eax, 0xc8b3
pop eax
mov dword [ebp - 0xab4], 0
jmp 0x44b2c9
push eax
or eax, 0x136ad
call 0x44a7b5
add byte [esi], bh
inc ebx
dec esi
cmp ecx, dword [edi + 0x49]
dec ebp
add esp, 4
add eax, 0xe135
pop eax
push edx
add edx, 0xdef0
xor edx, 0x1336e
or edx, 0x6bb2
pop edx
mov ecx, dword [ebp - 0x774]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x3a4], edx
mov dword [ebp - 0x784], 0
mov eax, dword [ebp - 0x3a4]
mov dword [ebp - 0x166c], eax
cmp dword [ebp - 0x166c], 0
jne fcn.0044a812
mov ecx, dword [ebp - 0x784]
mov dword [ebp - 0x3f8], ecx
jmp 0x44ab03
Function at 0x44adeb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edx
push esi
add esp, 4
or edx, 0x6aee
pop edx
push edi
push eax
add esp, 4
or edi, 0x82a9
sub edi, 0xb323
pop edi
push eax
add eax, 0x9bef
sub eax, 0x7132
xor eax, 0xe67
pop eax
mov edx, dword [ebp - 0xcd8]
mov ax, word [edx]
mov word [ebp - 0x1046], ax
mov ecx, dword [ebp - 0xcd8]
add ecx, 2
mov dword [ebp - 0xcd8], ecx
mov dx, word [ebp - 0x1046]
mov word [ebp - 0x224], dx
mov eax, dword [ebp - 0xcdc]
mov cx, word [eax]
mov word [ebp - 0x1048], cx
mov edx, dword [ebp - 0xcdc]
add edx, 2
mov dword [ebp - 0xcdc], edx
mov ax, word [ebp - 0x1048]
mov word [ebp - 0x40], ax
push esi
or esi, 0x1a36
pop esi
push eax
push ebx
add esp, 4
call 0x44adeb
add byte [edx], dh
inc ecx
inc ebp
dec esi
push eax
dec esi
cmp dword [ebx], esi
dec eax
add esp, 4
sub eax, 0x184a0
and eax, 0xf16e
add eax, 0x11e0e
pop eax
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x44ae1e
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x1684], edx
jmp 0x44ae78
movzx ecx, word [ebp - 0x224]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x44ad46
movzx eax, word [ebp - 0x224]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x44ad46
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x44ae62
mov dword [ebp - 0x1680], 0xffffffff
jmp 0x44ae6c
mov dword [ebp - 0x1680], 1
mov ecx, dword [ebp - 0x1680]
mov dword [ebp - 0x1684], ecx
cmp dword [ebp - 0x1684], 0
jne 0x44aec1
push edx
push ecx
add esp, 4
xor edx, 0xfe6d
sub edx, 0x6903
xor edx, 0x13da4
and edx, 0x6f2e
pop edx
push ebx
xor ebx, 0x14768
add ebx, 0x8b33
jmp 0x44aeb2
pop ebx
invalid