joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6e011a
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + esi*8 - 0x29410], edx
mov dword [esp + esi - 0x5282], ecx
lea esi, [esi + edx*2 + 0x34b79794]
push ebx
push esi
pushfd
pop eax
mov dword [esp], eax
mov edx, 0
mov dword [esp + 8], edx
lea eax, [esi + esi*8 - 0x5b66924a]
lea ebp, [esi + esi + 0x2c3a359f]
mov esi, dword [esp + eax*2 - 0x3570eb20]
lea ebx, [ebp + eax*8 - 0xd4f84dc]
btr bp, ax
rol esi, 1
not ebx
lea esi, [esi + eax*8 + 0x166ee732]
xor bl, al
lea ebx, [ebx + 0x690ae4ad]
sub al, 0xbb
neg esi
xor esi, 0x6a103406
bt ebp, ebp
bswap esi
bts ebp, 0x17
add esi, edx
mov dword [esp + eax*4 - 0x6ae1d778], ecx
shl ebx, 0xc1
xchg ebx, ebp
neg ebx
mov dword [esp + eax - 0x1ab875c5], edi
setg al
mov ebp, esp
lea ecx, [ebx*8 - 0x56dfedc9]
jbe 0xb21da5
lea ebx, [ebp + eax - 0x1ab875d1]
push ecx
mov esp, ebx

Function at 0x9aaa32
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0xe89e2b2c
neg dword [esp]
sbb esi, 3
call fcn.006e46a6

Function at 0x9f78cc
Capabilities:
Encode data using base64

Disassembly:
jb 0x6de1bf
jg 0x9f9ae1
stc
adc ebp, 4
shld ax, si, cl
jmp 0xa77e7f
mov word [ebp], ax
jmp 0xa398c8

Function at 0xa4a3e4
Capabilities:
Encode data using base64

Disassembly:
xor dl, 0xa7
jmp 0xb33da8
add byte [ebp - 0x16f3db9c], cl
push es
jmp dword [ebx + ecx*4 + 0x2c]
not dl
xor bl, dl
push 0x5207b3ad
call fcn.009a8371
pushfd
out 0x46, eax
adc eax, 0xc1f6c9f2
mov esi, 0x15abdcd1
jb 0xa931d5
invalid
dec dl
not byte [esp + 6]
shr dword [esp + 4], 0xee
jns 0xa93205

Function at 0xa6e069
Capabilities:
Encode data using base64

Disassembly:
rol dword [esp + 0x15], 0x9b
lea ecx, [esp + ecx + 0x20]
mov dword [esp], 0xf12ddf2b
push 0x9d87e400
jae 0xad1778
mov word [ecx], ax
lea esp, [esp + 0x24]
jae fcn.006f11b6
mov esp, edi
mov ebp, 0xa7965fb7
mov edi, 0xfda5122f
pop ebp
bswap edi
movzx ecx, di
pop ebx
ror edi, cl
call fcn.00a68ee2
push 0x9fa0f2bf
not byte [esp + 2]
mov ecx, dword [esp]
mov ebp, dword [esi]
movsx eax, cx
add esi, 4
mov edi, ebp
movzx edx, cx
pop ebp
jmp 0x997bda

Function at 0xa80e22
Capabilities:
Encode data using base64

Disassembly:
shr ecx, 8
xor ecx, ebx
push 0x7619740e
inc eax
sar dword [esp + 3], 0xac
jbe 0xa806fd
mov dword [edi + 8], ebx
call fcn.00b503d0
sbb al, 0x70
push ebp
sbb ebx, dword [ecx + eax*2 + 0x7c]
push eax
sub dword [ebx + 0x78], edx
inc ebp
sbb byte [eax - 0x3b], cl
iretd
jb 0xa5e162
push 0xa792fc0d
lea esp, [esp + 0x14]
jne 0xb2703c
mov ebx, 0x67bf440a
call fcn.009a181a
adc ebp, 2
call fcn.00a555be
ror edx, 1
call fcn.00b06cba
not al
inc word [esp]
sar byte [esp + 2], 0xc6
jae 0xb0f100
xor ebx, ecx
push 0xf303f290
shr dword [esp + 1], 0x34
and ebx, 0xff
shl dword [esp + 2], 0x4e
call 0xa80e22
xor ecx, 0x340f211d
shr dword [esp + 4], 0x83
sal byte [esp + 7], 0x22
dec edx
jmp 0xa4f57f
shl byte [esp + 1], 0x27
jbe 0xa57a99
mov dword [esp], 0x5a1800bc
mov ebx, dword [ebx*4 + 0xa0f4f8]
jns 0x992d10
xor al, 0x8e
inc al
ror al, 1
jmp 0xa80e17
movzx ebx, byte [eax]
push 0x8b040806
jmp 0xa64129
Function at 0xaa4d42
Capabilities:
Encode data using base64

Disassembly:
adc ebp, 1
imul dl
mov word [ebp], ax
jmp fcn.00ae0819
pop eax
mov eax, 0x96a49f27
mov dl, byte [ebp]
shl eax, 0xff
not eax
movzx ax, byte [ebp + eax - 0x7ffffffd]
jne 0x6ef002

Function at 0xacd6eb
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0xc5dcea32
call fcn.009d9b94

Function at 0xad0825
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0xa035ab83
lea esp, [esp + 0x10]
jmp dword [ecx*4 + 0x9aab3c]

Function at 0xae4312
Capabilities:
Encode data using base64

Disassembly:
call fcn.00b83ad7
xor eax, edi
sar word [esp + 4], 0xc7
inc ebp
sar byte [esp + 9], 0x83
xor eax, 0x623a38a0
jmp 0xb7ef5b
mov dword [esp + 4], 0xac863c18
mov edi, dword [edi*4 + 0x99412c]
shr eax, 8
shr word [esp + 7], 0xab
xor dword [esp + 8], 0x2f0aa101
jnp 0xa471b1
push 0xe40a8a19
dec ecx
push 0x3394e69b
jmp 0x6e8011

Function at 0xae5462
Capabilities:
Encode data using base64

Disassembly:
not word [esp + 8]
inc cx
rol word [esp + 0x10], 0x4f
jae 0x9f1748
test cx, si

Function at 0xb0808c
Capabilities:
Encode data using base64

Disassembly:
dec bl
jmp 0xb12cf0
sbb edi, 2
jmp 0xb4252a
jp 0x9edd01
lea edx, [edx + edx*2 + 0x379695b9]
lea esi, [esi + edx - 0xc2b825f]
movzx ecx, byte [esi + edx*8 - 0x615c12f0]
shl edx, 0xc4
xor cl, bl
not dx
not edx
inc cl
btc edx, edx
sal dx, 0x4e
rol cl, 1
sal dx, 0x82
rol dx, 0x8b
sbb edx, edx
dec cl
dec edx
and edx, edx
xor cl, 0x2d
ror cl, 1
and dx, 0x3121
shr dl, 0x81
inc cl
xor bl, cl
add ecx, esp
and edx, edx
movzx dx, byte [ecx]
ja 0xb3f1d9
call fcn.006e53ad
push 0x37c5ba
jle 0xa5b4ab
call fcn.009aa309

Function at 0xb13dc7
Capabilities:
Encode data using base64

Disassembly:
sbb ebp, 4
not dword [esp]
mov dword [ebp], ecx
push 0x248a9526
jmp 0xa0c1c0
lea esp, [esp + 0xc]
jmp fcn.009ff36d
lea edx, [esp + edx + 4]
mov ecx, dword [edx + ecx*2 - 0x57a17f06]
push 0x7eb23495
jae 0x700a96

Function at 0xb1556a
Capabilities:
Encode data using base64

Disassembly:
dec ecx
jg 0xa9a42a
xor al, 0xb5
xlatb
arpl di, cx
cmp al, 0x44
push 0xdb81ef91
xchg byte [esp + edx*2], al
add al, 0xff
lahf
pop ebx
out 0x28, eax
js 0xb15545
mov byte [esi + 0x11], cl
cmp eax, 0xc1e9c842
invalid

Function at 0xb2994c
Capabilities:
Encode data using base64

Disassembly:
sar dword [esp + 8], 0x7f
jns 0x99b410

Function at 0xb44f25
Capabilities:
Encode data using base64

Disassembly:
mov word [edi], ax
push 0x5a99b081
call fcn.00aceb9b

Function at 0xb4a5e0
Capabilities:
Encode data using base64

Disassembly:
xor bl, cl
sub ebp, 2
mov word [ebp], cx
lea esp, [esp + 8]
jmp fcn.00a8d2ef
add cl, 0xa9
mov dword [esp], 0xae203b29
neg word [esp + 1]
rol word [esp + 1], 0xef
ror cl, 1
shr dword [esp + 4], 0xa
inc byte [esp + 3]
neg cl
xor cl, 0x14
rol dword [esp], 0x5e
jae 0xb3d53d
test di, 0x7e16
Function at 0xb528d4
Capabilities:
Encode data using xor

Disassembly:
mov word [edi], dx
push 0x52210eac
lea esp, [esp + 8]
jmp fcn.00aa98f1
call fcn.00af9ba9
jl 0xa179b3
sbb dword [esp + eax - 0x32228102], eax
movzx eax, byte [edi + eax - 0x32228106]
sbb dword [esp + 4], 0x4498568c
adc edi, 1
xor al, bl
add al, 0xb5
sub dword [esp + 4], 0x6be2626
not al
ja 0xa78efa
add dl, al
push 0x614eaae
jmp 0x99c088

Function at 0xb624ab
Capabilities:
Encode data using base64

Disassembly:
push 0xc6277f32
lea esp, [esp + 0x14]
jmp fcn.00ae0819
mov dword [edx], ecx
jae 0xb6c27c
jmp 0x9a5a0a
jae 0xad22ac
jecxz 0xb624db
xor dword [ecx + 0x3c7d264c], esi
aad 0x91
adc byte [edx + 1], cl
and byte [ecx - 0x63], ch
int3
int 5
push 0xf4baee43
hlt

Function at 0xb67bb1
Capabilities:
Encode data using base64

Disassembly:
dec eax
mov dword [esp], 0x5d97e5d6
call int.006ef967

Function at 0xb67bbf
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0x78961ab2
mov dword [esp], ebx
jmp 0xb27030
Function at 0x401000
Capabilities:
Extract resource via kernel32 functions
Get file size
Set file attributes
Write file on windows

Disassembly:
push esi
push edi
push 0x4030c4
push 0xaa
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push 0
mov dword [0x404338], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [0x405398], eax
mov eax, dword [0x404338]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
mov dword [0x404350], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0
push 4
push 0
push 0
push 0x10000000
push str.APP.bin
mov dword [0x404354], eax
call esi
mov ecx, dword [0x405398]
mov edx, dword [0x404354]
push 0
push 0x405398
push ecx
push edx
push eax
mov dword [0x40435c], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [0x40435c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
push 2
push str.APP_bin
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
push 0
push 3
push 0
push 0
push 0x80000000
push str.APP.bin
call esi
push 0
push eax
mov dword [0x40435c], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [0x404f60], eax
test eax, eax
jne 0x4010d9
mov ecx, dword [0x40435c]
push ecx
call edi
pop edi
xor eax, eax
pop esi
ret
pop edi
mov eax, 1
pop esi
ret

Function at 0x401230
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
xor ecx, ecx
mov dword [ebp - 4], eax
cmp cx, dx
jae 0x401263
push esi
mov si, word [ebp - 4]
push edi
mov eax, 0x404760
movzx ecx, dx
mov edi, edi
movzx edi, byte [eax]
add si, di
inc eax
dec ecx
jne 0x401250
mov word [ebp - 4], si
mov eax, dword [ebp - 4]
pop edi
pop esi
not eax
movzx ecx, ax
movzx eax, dx
mov dl, cl
mov dword [ebp - 4], ecx
mov byte [eax + 0x404760], dl
mov edx, dword [0x404348]
shr ecx, 8
push 0
mov byte [eax + 0x404761], cl
lea ecx, [ebp - 4]
push ecx
add eax, 2
push eax
push 0x404760
push edx
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esp, ebp
pop ebp
ret
Function at 0x4012b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor esi, esi
push edi
lea edx, [esi + 3]
mov dword [ebp - 0x14], 0xea60
mov dword [ebp - 0x18], esi
mov word [0x404760], 5
mov byte [0x404762], 0xc0
call fcn.00401230
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
lea ecx, [ecx]
mov ecx, dword [0x404348]
lea eax, [ebp - 0x10]
push eax
push 0x404340
push ecx
call dword [sym.imp.KERNEL32.dll_ClearCommError]
mov eax, dword [ebp - 0xc]
mov edi, eax
test eax, eax
je 0x4013b1
mov edx, dword [0x404348]
push 0x40536c
push 0x404008
push eax
push 0x404f68
push edx
call ebx
xor ecx, ecx
test edi, edi
je 0x4013b1
mov edx, dword [0x404358]
lea esp, [esp]
mov al, byte [ecx + 0x404f68]
mov byte [edx + 0x404360], al
cmp al, 0x55
jne 0x401357
mov esi, 1
jmp 0x401382
cmp esi, 2
jne 0x401373
cmp al, 0xf
je 0x401382
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401dc2
mov esp, ebp
pop ebp
ret
cmp esi, 4
jne 0x40137e
cmp al, 0xc0
jne 0x401360
jmp 0x401382
test esi, esi
je 0x40138f
inc esi
cmp esi, 0xf
jb 0x40138f
mov dword [ebp - 0x18], 1
inc edx
mov dword [0x404358], edx
cmp edx, 0x400
jbe 0x4013a6
xor edx, edx
mov dword [0x404358], edx
inc ecx
cmp ecx, edi
jb 0x401340
cmp dword [ebp - 0x18], 0
jne 0x4013d5
mov eax, dword [ebp - 0x14]
mov ecx, eax
dec eax
mov dword [ebp - 0x14], eax
test ecx, ecx
jne 0x4012f0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401dc2
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.00401dc2
mov esp, ebp
pop ebp
ret
Function at 0x4013f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x405368]
push ebx
xor ebx, ebx
mov ecx, eax
push esi
mov byte [0x404763], al
shr ecx, 8
shr eax, 0x10
push edi
lea edx, [ebx + 0xf]
mov dword [ebp - 0x14], 0xea60
xor esi, esi
mov dword [ebp - 0x18], ebx
mov word [0x404760], 0x11
mov byte [0x404762], 0xc2
mov byte [0x404764], cl
mov byte [0x404765], al
mov dword [0x404766], 9
mov dword [0x40476a], ebx
mov byte [0x40476e], bl
call fcn.00401230
lea esp, [esp]
mov eax, dword [0x404348]
lea edx, [ebp - 0x10]
push edx
push 0x404340
push eax
call dword [sym.imp.KERNEL32.dll_ClearCommError]
mov eax, dword [ebp - 0xc]
mov edi, eax
cmp eax, ebx
jbe 0x401520
mov ecx, dword [0x404348]
push 0x40536c
push 0x404008
push eax
push 0x404f68
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor ecx, ecx
cmp edi, ebx
jbe 0x401520
mov edx, dword [0x404358]
jmp 0x4014b0
mov al, byte [ecx + 0x404f68]
mov byte [edx + 0x404360], al
cmp al, 0x55
jne 0x4014c7
mov esi, 1
jmp 0x4014f2
cmp esi, 2
jne 0x4014e3
cmp al, 0x13
je 0x4014f2
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401dc2
mov esp, ebp
pop ebp
ret
cmp esi, 4
jne 0x4014ee
cmp al, 0xc2
jne 0x4014d0
jmp 0x4014f2
cmp esi, ebx
je 0x4014ff
inc esi
cmp esi, 0x13
jb 0x4014ff
mov dword [ebp - 0x18], 1
inc edx
mov dword [0x404358], edx
cmp edx, 0x400
jbe 0x401516
xor edx, edx
mov dword [0x404358], edx
inc ecx
cmp ecx, edi
jb 0x4014b0
cmp dword [ebp - 0x18], ebx
jne 0x401544
mov eax, dword [ebp - 0x14]
mov edx, eax
dec eax
mov dword [ebp - 0x14], eax
test edx, edx
jne 0x401460
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401dc2
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.00401dc2
mov esp, ebp
pop ebp
ret
Function at 0x401560
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x40434c]
push ebx
lea edx, [ecx + 0xb]
movzx ebx, dx
mov edx, ebx
shr edx, 8
mov byte [0x404761], dl
mov edx, eax
shr edx, 8
mov byte [0x404763], al
mov byte [0x404764], dl
mov edx, eax
shr eax, 0x18
mov byte [0x404766], al
push esi
xor esi, esi
mov eax, ecx
shr edx, 0x10
shr eax, 8
push edi
mov dword [ebp - 0x1c], 0xea60
mov dword [ebp - 0x18], esi
mov byte [0x404760], bl
mov byte [0x404762], 0xc3
mov byte [0x404765], dl
mov byte [0x404767], cl
mov byte [0x404768], al
cmp ecx, esi
jbe 0x4015ec
push ecx
push 0x404b60
push 0x404769
call fcn.00401ee0
add esp, 0xc
add ebx, 0xfffe
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x14], eax
cmp cx, bx
jae 0x401621
mov dx, word [ebp - 0x14]
mov eax, 0x404760
movzx ecx, bx
lea ebx, [ebx]
movzx edi, byte [eax]
add dx, di
inc eax
dec ecx
jne 0x401610
mov word [ebp - 0x14], dx
mov eax, dword [ebp - 0x14]
not eax
movzx ecx, ax
movzx eax, bx
mov dl, cl
mov dword [ebp - 0x14], ecx
mov byte [eax + 0x404760], dl
mov edx, dword [0x404348]
shr ecx, 8
push esi
mov byte [eax + 0x404761], cl
lea ecx, [ebp - 0x14]
push ecx
add eax, 2
push eax
push 0x404760
push edx
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [0x404348]
lea eax, [ebp - 0x10]
push eax
push 0x404340
push ecx
call dword [sym.imp.KERNEL32.dll_ClearCommError]
mov eax, dword [ebp - 0xc]
mov ebx, eax
test eax, eax
je 0x401721
mov edx, dword [0x404348]
push 0x40536c
push 0x404008
push eax
push 0x404f68
push edx
call edi
xor ecx, ecx
test ebx, ebx
je 0x401721
mov edx, dword [0x404358]
lea ecx, [ecx]
mov al, byte [ecx + 0x404f68]
mov byte [edx + 0x404360], al
cmp al, 0x55
jne 0x4016c7
mov esi, 1
jmp 0x4016f2
cmp esi, 2
jne 0x4016e3
cmp al, 0xa
je 0x4016f2
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401dc2
mov esp, ebp
pop ebp
ret
cmp esi, 4
jne 0x4016ee
cmp al, 0xc3
jne 0x4016d0
jmp 0x4016f2
test esi, esi
je 0x4016ff
inc esi
cmp esi, 0xa
jb 0x4016ff
mov dword [ebp - 0x18], 1
inc edx
mov dword [0x404358], edx
cmp edx, 0x400
jbe 0x401716
xor edx, edx
mov dword [0x404358], edx
inc ecx
cmp ecx, ebx
jb 0x4016b0
cmp dword [ebp - 0x18], 0
jne 0x401745
mov eax, dword [ebp - 0x1c]
mov ecx, eax
dec eax
mov dword [ebp - 0x1c], eax
test ecx, ecx
jne 0x401661
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401dc2
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.00401dc2
mov esp, ebp
pop ebp
ret
Function at 0x401760
Capabilities:
Delete file
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [0x40435c]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x401776
push eax
call edi
mov eax, dword [0x404348]
test eax, eax
je 0x401782
push eax
call edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x3e9
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
test ebx, ebx
jne 0x4017a4
push str.Update_was_successful
jmp 0x4017a5
push ebx
push 0x3ec
push esi
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push str.APP.bin
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0x3e9
push esi
call edi
mov ebx, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call ebx
push 1
push 1
push esi
call edi
push eax
call ebx
push 1
push 0x3ea
push esi
call edi
push eax
call ebx
push 1
push 2
push esi
call edi
push eax
call ebx
pop edi
pop ebx
ret

Function at 0x401dc2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x401dcc
repz ret
jmp fcn.00401dd1

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x4031b0
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x1b8
mov eax, dword [0x4d7340]
xor eax, esp
mov dword [esp + 0x1b4], eax
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
test ecx, ecx
je fcn.00403386
add dword [esi + 0xa8], 1
lea eax, [ecx - 1]
adc dword [esi + 0xac], 0
cmp eax, 7
ja 0x4032a5
jmp dword [eax*4 + 0x403468]
xorps xmm0, xmm0
lea edx, [esp + 0x180]
movaps xmmword [esp + 0x180], xmm0
movaps xmmword [esp + 0x190], xmm0
movaps xmmword [esp + 0x1a0], xmm0
call fcn.00404ce0
push 0x10
lea eax, [esp + 0x194]
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x18c]
push eax
push 0
push 0xfde9

Function at 0x4032e7
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1fbc
push ebx
push esi
push edi
push esi
push esi
add esp, 4
jmp 0x4032ff
call fcn.0040330d
add byte [ebx], dh
dec edi
xor bh, byte ds:[eax]
dec eax
aaa
cmp al, 0x83
add esp, 4
sub esi, 0xd8f7
Function at 0x40330d
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add esp, 4
sub esi, 0xd8f7
add esi, 0x596e
pop esi
push ebx
and ebx, 0x19a8
pop ebx
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
add byte gs:[eax], al
add byte [esi - 0x77], ah
xchg ebp, eax
sbb al, 0xe1
invalid
invalid
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push edx
push edx
add esp, 4
add edx, 0x14e36
and edx, 0xd0aa
xor edx, 0x10cc
pop edx
push edx
add edx, 0x15ef4
add edx, 0x1391f
add edx, 0x11a2f
xor edx, 0x5fa8
pop edx
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push ecx
add ecx, 0x17606
call 0x403455
add byte [ecx], bh
inc edx
inc edx
inc edi
dec eax
xor cl, byte [edi - 0x7d]
les eax, [ecx + ebx*2]
push esi
add esi, 0x15f99
and esi, 0x148f9
pop esi
push eax
push edi
add esp, 4
xor eax, 0x47bb
pop eax
mov dword [ebp - 0x10], 1
push eax
call 0x40348a
add byte [eax + 0x44], al
dec eax
inc esp
inc esp
dec ebx
dec ebp
cmp byte [edi - 0x7d], al
les eax, [eax + ebx*2]
push esi
push edi
add esp, 4
or esi, 0x13238
xor esi, 0x73d1
pop esi
push ecx
push ebx
add esp, 4
xor ecx, 0xbc9f
pop ecx
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push ecx
push edx
add esp, 4
and ecx, 0xe8a9
sub ecx, 0x986f
and ecx, 0x12f9f
pop ecx
push eax
push edx
add esp, 4
or eax, 0x14766
pop eax
push edx
xor edx, 0x7a8c
add edx, 0x11919
pop edx
push ebx
call 0x403518
add byte [eax + ecx*2], bh
aas
dec edx
dec ebp
aas
inc ecx
add esp, 4
pop ebx
push edx
xor edx, 0x7d39
jmp 0x40352b
call 0x403538
add byte [esi + 0x3b], cl
dec ebp
aas
cmp eax, 0x4c48340
pop edx
mov dword [ebp - 0x2c], 1
push ecx
push ecx
add esp, 4
sub ecx, 0xb0a6
xor ecx, 0x81d3
xor ecx, 0x80da
sub ecx, 0x13c
pop ecx
push esi
or esi, 0x60e0
add esi, 0x2fef
and esi, 0xb089
pop esi
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
push ebp
aam 0x69
dec ebp
aam 0x38
add dword [eax], eax
add byte [ebx], ch
ror dword [ecx - 0x4c162fab], 1
add dword [eax], eax
invalid
Function at 0x403455
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add esp, 4
sub esi, 0xd8f7
add esi, 0x596e
pop esi
push ebx
and ebx, 0x19a8
pop ebx
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
add byte gs:[eax], al
add byte [esi - 0x77], ah
xchg ebp, eax
sbb al, 0xe1
invalid
invalid
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push edx
push edx
add esp, 4
add edx, 0x14e36
and edx, 0xd0aa
xor edx, 0x10cc
pop edx
push edx
add edx, 0x15ef4
add edx, 0x1391f
add edx, 0x11a2f
xor edx, 0x5fa8
pop edx
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push ecx
add ecx, 0x17606
call 0x403455
add byte [ecx], bh
inc edx
inc edx
inc edi
dec eax
xor cl, byte [edi - 0x7d]
les eax, [ecx + ebx*2]
push esi
add esi, 0x15f99
and esi, 0x148f9
pop esi
push eax
push edi
add esp, 4
xor eax, 0x47bb
pop eax
mov dword [ebp - 0x10], 1
push eax
call 0x40348a
add byte [eax + 0x44], al
dec eax
inc esp
inc esp
dec ebx
dec ebp
cmp byte [edi - 0x7d], al
les eax, [eax + ebx*2]
push esi
push edi
add esp, 4
or esi, 0x13238
xor esi, 0x73d1
pop esi
push ecx
push ebx
add esp, 4
xor ecx, 0xbc9f
pop ecx
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push ecx
push edx
add esp, 4
and ecx, 0xe8a9
sub ecx, 0x986f
and ecx, 0x12f9f
pop ecx
push eax
push edx
add esp, 4
or eax, 0x14766
pop eax
push edx
xor edx, 0x7a8c
add edx, 0x11919
pop edx
push ebx
call 0x403518
add byte [eax + ecx*2], bh
aas
dec edx
dec ebp
aas
inc ecx
add esp, 4
pop ebx
push edx
xor edx, 0x7d39
jmp 0x40352b
call 0x403538
add byte [esi + 0x3b], cl
dec ebp
aas
cmp eax, 0x4c48340
pop edx
mov dword [ebp - 0x2c], 1
push ecx
push ecx
add esp, 4
sub ecx, 0xb0a6
xor ecx, 0x81d3
xor ecx, 0x80da
sub ecx, 0x13c
pop ecx
push esi
or esi, 0x60e0
add esi, 0x2fef
and esi, 0xb089
pop esi
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
push ebp
aam 0x69
dec ebp
aam 0x38
add dword [eax], eax
add byte [ebx], ch
ror dword [ecx - 0x4c162fab], 1
add dword [eax], eax
invalid