joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412f79
Capabilities:
Get number of processors

Disassembly:
or esi, 0x1698
xor esi, 0xc438
xor esi, 0x84ca
pop esi
push eax
jmp 0x412f6c
call 0x412f79
add byte [edx], dh
cmp cl, byte [ebp + 0x44]
cmp byte [esi + 0x4d], cl
add esp, 4
pop eax
mov eax, dword [ebp - 0x30]
add eax, 0xfe
imul ecx, dword [ebp - 0x2c], 0xfe
add ecx, 0x56f3663b
imul edx, dword [ebp - 0x2c], 0xfe
sub ecx, edx
xor eax, ecx
imul eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1e28], eax
push ecx
call 0x412fb8
add byte [edx + 0x37], al
cmp eax, 0x4a463c3a
aaa
inc edi
dec ebx
add esp, 4
call fcn.00412fc9

Function at 0x412fb8
Capabilities:
Get number of processors

Disassembly:
or esi, 0x1698
xor esi, 0xc438
xor esi, 0x84ca
pop esi
push eax
jmp 0x412f6c
call 0x412f79
add byte [edx], dh
cmp cl, byte [ebp + 0x44]
cmp byte [esi + 0x4d], cl
add esp, 4
pop eax
mov eax, dword [ebp - 0x30]
add eax, 0xfe
imul ecx, dword [ebp - 0x2c], 0xfe
add ecx, 0x56f3663b
imul edx, dword [ebp - 0x2c], 0xfe
sub ecx, edx
xor eax, ecx
imul eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1e28], eax
push ecx
call 0x412fb8
add byte [edx + 0x37], al
cmp eax, 0x4a463c3a
aaa
inc edi
dec ebx
add esp, 4
call fcn.00412fc9

Function at 0x412fc9
Capabilities:
Get number of processors

Disassembly:
add esp, 4
xor ecx, 0x105d5
xor ecx, 0xf0a3
pop ecx
mov eax, dword [ebp - 0x1630]
add eax, 0xfe
imul ecx, dword [ebp - 0x162c], 0xfe
add ecx, 0x56f3663b
imul edx, dword [ebp - 0x162c], 0xfe
sub ecx, edx
xor eax, ecx
imul eax, dword [ebp - 0x162c]
mov dword [ebp - 0x1e24], eax
mov eax, dword [ebp - 0x1e24]
mov dword [ebp - 0x1e2c], eax
mov ecx, dword [ebp - 0x1e28]
cmp ecx, dword [ebp - 0x1e2c]
jae 0x413035
mov dword [ebp - 0x15a0], 1
jmp 0x41303f
mov dword [ebp - 0x15a0], 0
mov dl, byte [ebp - 0x15a0]
mov byte [ebp - 0x3ad], dl
movzx eax, byte [ebp - 0x3ad]
test eax, eax
je 0x4160b2
push ebx
push ebx
add esp, 4
or ebx, 0x15cd6
xor ebx, 0x59d7
pop ebx
push eax
call 0x41307a
add byte [ecx + 0x44], cl
dec ecx
xor dh, byte [ebx + edi]
inc esi
add esp, 4
pop eax
push esi
add esi, 0x11433
add esi, 0x8a48
pop esi
push edi
push ebx
add esp, 4
or edi, 0xeff6
or edi, 0x1285c
pop edi
push ebx
xor ebx, 0xa75c
call 0x4130b2
add byte [eax + edi + 0x3c], al
dec esp
inc eax
add esp, 4
pop ebx
push esi
sub esi, 0x28a5
pop esi
mov ecx, dword [ebp - 0x30]
add ecx, 0xfe
imul edx, dword [ebp - 0x2c], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x2c], 0xfe
sub edx, eax
xor ecx, edx
imul ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x1e30], ecx
mov ecx, dword [ebp - 0x1e30]
mov dword [ebp - 0x1e34], ecx
cmp dword [ebp - 0x1e34], 0x63c1
jne 0x413239
push esi
push eax
add esp, 4
and esi, 0x1329f
pop esi
push edi
and edi, 0x17e58
sub edi, 0x8b7d
pop edi
push edi
push edx
add esp, 4
xor edi, 0xc7d4
xor edi, 0xb615
jmp 0x413136
pop edi
mov edx, dword [ebp - 0x1c]
add edx, 0xfe
imul eax, dword [ebp - 0x18], 0xfe
add eax, 0x56f3663b
imul ecx, dword [ebp - 0x18], 0xfe
sub eax, ecx
xor edx, eax
imul edx, dword [ebp - 0x18]
mov dword [ebp - 0x1e38], edx
mov edx, dword [ebp - 0x1e38]
mov dword [ebp - 0x1e3c], edx
invalid
test esp, eax
Function at 0x4160d0
Capabilities:
Get number of processors

Disassembly:
xchg ebx, eax
or al, byte [eax]
add byte [ecx + 0x160dce9], al
add byte [ecx + 0x12f7e9], al
add byte [ecx + 0x52], bl

Function at 0x416220
Capabilities:
Get number of processors

Disassembly:
cmp al, 0x44
cmp eax, 0x37f6813e
pop ecx
add dword [eax], eax
pop esi
push ebx
or ebx, 0x10aea
pop ebx
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xbec]
mov dword [ebp - 0x15bc], eax
push ebx
push esi
add esp, 4
xor ebx, 0x37c3
add ebx, 0x1a24
pop ebx
push eax
push edx
add esp, 4
or eax, 0x5462
and eax, 0xac7c
add eax, 0x12c9f
pop eax
push esi
xor esi, 0xa8ed
pop esi
mov dword [ebp - 0x2088], 0xffffffff
push edx
or edx, 0x71ec
sub edx, 0x13b0
pop edx
push ebx
sub ebx, 0x93d6
or ebx, 0x2388
pop ebx
push edi
add edi, 0x1272c
pop edi
push edx
sub edx, 0xd4d7
add edx, 0x15ddb
pop edx
mov ecx, dword [ebp - 0x74c]
mov dword [ebp - 0x4fc], ecx
jmp 0x4162d3
Function at 0x416ba5
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
add eax, 0x20c0
pop eax
push eax
push edi
add esp, 4
sub eax, 0x12a9e
add eax, 0x9154
jmp 0x416b53
pop eax
mov edx, dword fs:[0x18]
mov dword [ebp - 0x1ff4], edx
mov eax, dword [ebp - 0x1ff4]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x1950], ecx
mov edx, dword [ebp - 0x1950]
mov dword [ebp - 0x159c], edx
push esi
sub esi, 0x161af
popal
add dword [eax], eax
xor esi, 0x113b2
or esi, 0x318
pop esi
push ebx
push ebx
add esp, 4
call 0x416ba5
add byte [edi], dh
inc esi
xor al, byte [esi + 0x46]
xor edi, dword [0x833e4833]
les eax, [ebx + ebp*8]
add eax, dword [ebp + 0x40]
cmp byte [ebx - 0x7d], bl
mov ebp, 0xffffea64
add byte [ebp + 0xf], dh
mov dword [ebp - 0x318], 0
jmp 0x416e82

Function at 0x416d2a
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
and ebx, 0xe73d
pop ebx
mov eax, dword [ebp - 0xc90]
mov cx, word [eax]
mov word [ebp - 0x1032], cx
mov edx, dword [ebp - 0xc90]
add edx, 2
mov dword [ebp - 0xc90], edx
mov ax, word [ebp - 0x1032]
mov word [ebp - 0x20c], ax
mov ecx, dword [ebp - 0xc94]
mov dx, word [ecx]
mov word [ebp - 0x1034], dx
mov eax, dword [ebp - 0xc94]
add eax, 2
mov dword [ebp - 0xc94], eax
mov cx, word [ebp - 0x1034]
mov word [ebp - 0x10c], cx
push ecx
call 0x416d2a
add byte [edi + 0x37], cl
cmp bh, byte [eax]
xor bh, byte [ebx]
xor eax, 0x83364d40
les eax, [ecx + eax*4]
int1
pop ds
Function at 0x4170e3
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edi
push eax
add esp, 4
call 0x4170d1
add byte [eax + 0x35], cl
inc edx
inc ecx
inc edi
dec ecx
add esp, 4
call 0x4170e3
add byte [ecx + 0x4e], cl
cmp edi, dword [eax]
cmp al, 0x38
dec ebx
cmp al, byte [ebx - 0x7d]
les eax, [ecx + eax*4]
iretd
push esi
xor esi, 0xebab
xor esi, 0xdae8
pop esi
push eax
and eax, 0x5cf1
call 0x417141
add byte [eax + 0x3b], al
inc ebx
cmp byte [eax + 0x47], dl
cmp dword [ebx - 0x377efb3c], eax
xor byte [eax], dl
add byte [eax], al
or eax, 0x158b8
pop eax
mov ecx, dword [ebp - 0xc9c]
mov dx, word [ecx]
mov word [ebp - 0x1036], dx
mov eax, dword [ebp - 0xc9c]
add eax, 2
mov dword [ebp - 0xc9c], eax
mov cx, word [ebp - 0x1036]
mov word [ebp - 0x210], cx
mov edx, dword [ebp - 0xca0]
mov ax, word [edx]
mov word [ebp - 0x1038], ax
mov ecx, dword [ebp - 0xca0]
add ecx, 2
mov dword [ebp - 0xca0], ecx
mov dx, word [ebp - 0x1038]
mov word [ebp - 0x110], dx
push eax
push eax
add esp, 4
jmp 0x4171b9
pop eax
push eax
push ecx
add esp, 4
call 0x4171cb
add byte [ecx + 0x49], cl
aaa
xor al, 0x4b
aaa
add esp, 4
pop eax
push ecx
and ecx, 0xbd2a
or ecx, 0x104c
pop ecx
movzx eax, word [ebp - 0x110]
test eax, eax
jne 0x417200
movzx ecx, word [ebp - 0x210]
movzx edx, word [ebp - 0x110]
sub ecx, edx
mov dword [ebp - 0x15e4], ecx
jmp 0x417263
movzx eax, word [ebp - 0x210]
movzx ecx, word [ebp - 0x110]
cmp eax, ecx
je 0x41711f
movzx edx, word [ebp - 0x210]
xor edx, 0x20
movzx eax, word [ebp - 0x110]
cmp edx, eax
je 0x41711f
invalid

Function at 0x417141
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edi
push eax
add esp, 4
call 0x4170d1
add byte [eax + 0x35], cl
inc edx
inc ecx
inc edi
dec ecx
add esp, 4
call 0x4170e3
add byte [ecx + 0x4e], cl
cmp edi, dword [eax]
cmp al, 0x38
dec ebx
cmp al, byte [ebx - 0x7d]
les eax, [ecx + eax*4]
iretd
push esi
xor esi, 0xebab
xor esi, 0xdae8
pop esi
push eax
and eax, 0x5cf1
call 0x417141
add byte [eax + 0x3b], al
inc ebx
cmp byte [eax + 0x47], dl
cmp dword [ebx - 0x377efb3c], eax
xor byte [eax], dl
add byte [eax], al
or eax, 0x158b8
pop eax
mov ecx, dword [ebp - 0xc9c]
mov dx, word [ecx]
mov word [ebp - 0x1036], dx
mov eax, dword [ebp - 0xc9c]
add eax, 2
mov dword [ebp - 0xc9c], eax
mov cx, word [ebp - 0x1036]
mov word [ebp - 0x210], cx
mov edx, dword [ebp - 0xca0]
mov ax, word [edx]
mov word [ebp - 0x1038], ax
mov ecx, dword [ebp - 0xca0]
add ecx, 2
mov dword [ebp - 0xca0], ecx
mov dx, word [ebp - 0x1038]
mov word [ebp - 0x110], dx
push eax
push eax
add esp, 4
jmp 0x4171b9
pop eax
push eax
push ecx
add esp, 4
call 0x4171cb
add byte [ecx + 0x49], cl
aaa
xor al, 0x4b
aaa
add esp, 4
pop eax
push ecx
and ecx, 0xbd2a
or ecx, 0x104c
pop ecx
movzx eax, word [ebp - 0x110]
test eax, eax
jne 0x417200
movzx ecx, word [ebp - 0x210]
movzx edx, word [ebp - 0x110]
sub ecx, edx
mov dword [ebp - 0x15e4], ecx
jmp 0x417263
movzx eax, word [ebp - 0x210]
movzx ecx, word [ebp - 0x110]
cmp eax, ecx
je 0x41711f
movzx edx, word [ebp - 0x210]
xor edx, 0x20
movzx eax, word [ebp - 0x110]
cmp edx, eax
je 0x41711f
invalid
Function at 0x4171cb
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edi
push eax
add esp, 4
call 0x4170d1
add byte [eax + 0x35], cl
inc edx
inc ecx
inc edi
dec ecx
add esp, 4
call 0x4170e3
add byte [ecx + 0x4e], cl
cmp edi, dword [eax]
cmp al, 0x38
dec ebx
cmp al, byte [ebx - 0x7d]
les eax, [ecx + eax*4]
iretd
push esi
xor esi, 0xebab
xor esi, 0xdae8
pop esi
push eax
and eax, 0x5cf1
call 0x417141
add byte [eax + 0x3b], al
inc ebx
cmp byte [eax + 0x47], dl
cmp dword [ebx - 0x377efb3c], eax
xor byte [eax], dl
add byte [eax], al
or eax, 0x158b8
pop eax
mov ecx, dword [ebp - 0xc9c]
mov dx, word [ecx]
mov word [ebp - 0x1036], dx
mov eax, dword [ebp - 0xc9c]
add eax, 2
mov dword [ebp - 0xc9c], eax
mov cx, word [ebp - 0x1036]
mov word [ebp - 0x210], cx
mov edx, dword [ebp - 0xca0]
mov ax, word [edx]
mov word [ebp - 0x1038], ax
mov ecx, dword [ebp - 0xca0]
add ecx, 2
mov dword [ebp - 0xca0], ecx
mov dx, word [ebp - 0x1038]
mov word [ebp - 0x110], dx
push eax
push eax
add esp, 4
jmp 0x4171b9
pop eax
push eax
push ecx
add esp, 4
call 0x4171cb
add byte [ecx + 0x49], cl
aaa
xor al, 0x4b
aaa
add esp, 4
pop eax
push ecx
and ecx, 0xbd2a
or ecx, 0x104c
pop ecx
movzx eax, word [ebp - 0x110]
test eax, eax
jne 0x417200
movzx ecx, word [ebp - 0x210]
movzx edx, word [ebp - 0x110]
sub ecx, edx
mov dword [ebp - 0x15e4], ecx
jmp 0x417263
movzx eax, word [ebp - 0x210]
movzx ecx, word [ebp - 0x110]
cmp eax, ecx
je 0x41711f
movzx edx, word [ebp - 0x210]
xor edx, 0x20
movzx eax, word [ebp - 0x110]
cmp edx, eax
je 0x41711f
invalid

Function at 0x417220
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edi
push eax
add esp, 4
call 0x4170d1
add byte [eax + 0x35], cl
inc edx
inc ecx
inc edi
dec ecx
add esp, 4
call 0x4170e3
add byte [ecx + 0x4e], cl
cmp edi, dword [eax]
cmp al, 0x38
dec ebx
cmp al, byte [ebx - 0x7d]
les eax, [ecx + eax*4]
iretd
push esi
xor esi, 0xebab
xor esi, 0xdae8
pop esi
push eax
and eax, 0x5cf1
call 0x417141
add byte [eax + 0x3b], al
inc ebx
cmp byte [eax + 0x47], dl
cmp dword [ebx - 0x377efb3c], eax
xor byte [eax], dl
add byte [eax], al
or eax, 0x158b8
pop eax
mov ecx, dword [ebp - 0xc9c]
mov dx, word [ecx]
mov word [ebp - 0x1036], dx
mov eax, dword [ebp - 0xc9c]
add eax, 2
mov dword [ebp - 0xc9c], eax
mov cx, word [ebp - 0x1036]
mov word [ebp - 0x210], cx
mov edx, dword [ebp - 0xca0]
mov ax, word [edx]
mov word [ebp - 0x1038], ax
mov ecx, dword [ebp - 0xca0]
add ecx, 2
mov dword [ebp - 0xca0], ecx
mov dx, word [ebp - 0x1038]
mov word [ebp - 0x110], dx
push eax
push eax
add esp, 4
jmp 0x4171b9
pop eax
push eax
push ecx
add esp, 4
call 0x4171cb
add byte [ecx + 0x49], cl
aaa
xor al, 0x4b
aaa
add esp, 4
pop eax
push ecx
and ecx, 0xbd2a
or ecx, 0x104c
pop ecx
movzx eax, word [ebp - 0x110]
test eax, eax
jne 0x417200
movzx ecx, word [ebp - 0x210]
movzx edx, word [ebp - 0x110]
sub ecx, edx
mov dword [ebp - 0x15e4], ecx
jmp 0x417263
movzx eax, word [ebp - 0x210]
movzx ecx, word [ebp - 0x110]
cmp eax, ecx
je 0x41711f
movzx edx, word [ebp - 0x210]
xor edx, 0x20
movzx eax, word [ebp - 0x110]
cmp edx, eax
je 0x41711f
invalid
Function at 0x417279
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop eax
push edx
and edx, 0x8d38
call 0x417293
add byte [edx], dh
cmp byte [0x3a33363c], bh
inc ebp
inc esp
add esp, 4
jmp 0x41729d
pop edx
mov ecx, dword [ebp - 0x508]
mov dword [ebp - 0x750], ecx
jmp 0x417314

Function at 0x417293
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop eax
push edx
and edx, 0x8d38
call 0x417293
add byte [edx], dh
cmp byte [0x3a33363c], bh
inc ebp
inc esp
add esp, 4
jmp 0x41729d
pop edx
mov ecx, dword [ebp - 0x508]
mov dword [ebp - 0x750], ecx
jmp 0x417314

Function at 0x4172c6
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop eax
push esi
push ebx
add esp, 4
or esi, 0x12448
into
dec eax
and al, 1
add bl, ch
push es
pop esi
mov edx, dword [ebp - 0x508]
mov eax, dword [edx]
mov dword [ebp - 0x508], eax
mov ecx, dword [ebp - 0x508]
cmp ecx, dword [ebp - 0xca4]
je 0x41730a
mov edx, dword [ebp - 0x508]
Function at 0x418480
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
test dword [esi - 0x46000018], eax
insb byte es:[edi], dx
add byte [eax], al
add byte [esi - 0x77], ah
lea ecx, [eax - 0x45000018]
insb byte es:[edi], dx
add byte [eax], al
add byte [esi - 0x77], ah
xchg ebp, eax
mov ch, al
invalid
Function at 0x4187d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
loope 0x418835
mov al, 0
add byte [ecx - 0x75], bl
xchg ebp, eax
call 0x8a4187d7
xchg ebp, eax
invalid
cli
invalid
Function at 0x418b49
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x1a4]
add edx, 1
mov dword [ebp - 0x1a4], edx
mov eax, dword [ebp - 0x780]
add eax, dword [ebp - 0x1a4]
movsx ecx, byte [eax]
test ecx, ecx
je 0x418b34
mov edx, dword [ebp - 0x1a4]
movsx eax, byte [ebp + edx - 0x8a4]
test eax, eax
je 0x418b34
push edi
push ebx
add esp, 4
jmp 0x418ab9
jmp 0x418ac0
pop edi
push ebx
sub ebx, 0x50fe
jmp 0x418ace
call fcn.00418add
add byte [eax], bh
dec esi
aaa
aas
dec ebx
cmp dh, byte [ecx*2 + 0x5b04c483]
add esp, 4
pop ebx
mov ecx, dword [ebp - 0x780]
add ecx, dword [ebp - 0x1a4]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x1a4]
movsx ecx, byte [ebp + eax - 0x8a4]
cmp edx, ecx
je 0x418b26
mov edx, dword [ebp - 0x780]
add edx, dword [ebp - 0x1a4]
movsx eax, byte [edx]
xor eax, 0x20
mov ecx, dword [ebp - 0x1a4]
movsx edx, byte [ebp + ecx - 0x8a4]
cmp eax, edx
jne 0x418b2d
jmp 0x418a73
jmp 0x418b34
push ebx
push ebx
add esp, 4
call 0x418b49
add byte [eax], bh
cmp ecx, dword [ebp + 0x3d]
xor edi, dword [edi - 0x7cc9ccb9]
les eax, [ebx + ebp*8]
add eax, dword [edx + 0x3b]
cmp al, 0x81
jmp 0x418b6b
inc dword [ebx]
invalid
pop esp
invalid

Function at 0x418bb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x77c]
add eax, 1
mov dword [ebp - 0x77c], eax
add esp, 4
xor eax, 0x17d02
add eax, 0x1777e
jmp 0x418bc4
pop eax
mov ecx, dword [ebp - 0x780]
add ecx, dword [ebp - 0x1a4]
movsx edx, byte [ecx]
or edx, 0x20
mov eax, dword [ebp - 0x1a4]
movsx ecx, byte [ebp + eax - 0x8a4]
or ecx, 0x20
cmp edx, ecx
jge 0x418bf8
mov dword [ebp - 0xcd4], 0xffffffff
jmp 0x418c02
mov dword [ebp - 0xcd4], 1
cmp dword [ebp - 0xcd4], 0
jne 0x418c19
mov edx, dword [ebp - 0x19a8]
mov dword [ebp - 0x3f4], edx
jmp 0x418c2a
jmp 0x418a03
Function at 0x41ce30
Capabilities:
Encode data using xor

Disassembly:
add eax, 0x57565d04
xchg eax, ecx
or byte [ebp + 0x45622f6], al
add al, 0x85
invalid
inc eax
add al, 4
pop esi
push edi
test edi, esi
push ds
mov byte [esp + eax], 0x85
add al, 4
test edi, ecx
jb 0x41ce01
add al, 0x85
iretd
add al, 4
test edi, eax
ja 0x41ce6e
add al, 4
test edi, esp
or eax, 0x5f0404f8
adc edi, dword [ebx - 0x1781fa7]
xor al, 0x80
push ecx
adc edi, dword [ebx - 0x3781fb7]
cmp eax, 0x855b4883
add al, 4
out dx, eax
or byte [ecx + 0x52], dl
push ecx
push edx
inc ecx
dec ecx
test ebx, edx
ja 0x41cdbe
add eax, 0x5b576304
xchg eax, ecx
or byte [ebp + 0x499c7e7], al
add al, 0x85
not dword [edx - 0x4e]
add al, 4
test edi, esi
xor al, 0x62
add al, 4
test edi, esi
fsubp st(4)
add al, 4
pop edi
adc edi, dword [ebx - 0x12781faf]
xor al, 0x8d
lea edx, [ecx + 0x303febc]
in eax, dx
lea edx, [ecx + 0x303febc]
in eax, dx
mov ah, 4
add al, 4
adc edi, dword [ebx - 0x1781fa7]
inc ebp
or byte [esi + 0x13], 0xbb
dec ecx
loopne 0x41ce00
loopne 0x41cdf7
inc byte [ebp - 0x80]
dec esi
adc edi, dword [ebx - 0x3781fb7]
cld
pop esi
add dword [ebp + 0x57], 0x54
xchg eax, ecx
or byte [ebp + 0x50d38ef], al
add al, 0x85
out dx, eax
add dword [ecx], edx
add al, 4
test edi, esi
invalid
Function at 0x4443ba
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x6a6b0c]
push esi
push edi
test eax, eax
jne 0x4443d1
push str.devices.dll
call fcn.0041c9d0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x6a6b0c], eax
test eax, eax
jne 0x4443d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
call int.00414680
push 0x501b6c
mov esi, eax
call fcn.0041c8c0
push esi
push edi
push eax
push str.Failure_to_load__s_n_nWindows_Error__d:__s
push 0x10
push str.Fatal_Error
call fcn.004154f0
add esp, 0x20
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
ret

Function at 0x445900
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
xor ecx, ecx
push edi
xor edi, edi
mov dword [ebp - 4], ecx
test ebx, ebx
jne 0x44591c
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push esi
cmp dword [ebp + 0xc], ecx
jle 0x44597a
mov al, byte [ebx]
mov esi, dword [ebp - 4]
shr al, cl
inc esi
and al, 1
lea ecx, [edi + edi]
movzx edx, al
or dx, cx
mov ecx, dword [ebp + 0xc]
cmp esi, 7
lea eax, [ecx - 1]
cmovle eax, ecx
mov dword [ebp + 0xc], eax
mov eax, edx
xor eax, 0x8005
movzx ecx, ax
movzx eax, dx
mov edx, 0x8000
cmp di, dx
cmovb ecx, eax
lea eax, [ebx + 1]
movzx edx, cx
xor ecx, ecx
cmp esi, 7
mov edi, edx
cmovle ecx, esi
cmovle eax, ebx
cmp dword [ebp + 0xc], 0
mov ebx, eax
mov dword [ebp - 4], ecx
jg 0x445922
mov esi, 0x10
nop
lea edx, [edi + edi]
mov eax, edx
xor eax, 0x8005
movzx ecx, ax
movzx eax, dx
mov edx, 0x8000
cmp di, dx
cmovb ecx, eax
movzx eax, cx
mov ecx, eax
mov edi, eax
sub esi, 1
jne 0x445980
mov eax, edx
lea edx, [esi + 1]
nop dword [eax]
test eax, ecx
je 0x4459b6
or esi, edx
add edx, edx
sar eax, 1
jne 0x4459b0
movzx eax, si
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44db20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x52de04]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0
push 0
push esi
call fcn.004c3c02
push esi
push 1
lea eax, [ebp - 0x8c]
push 8
push eax
call fcn.004c37de
push esi
push 1
lea eax, [ebp - 0x84]
push 0x40
push eax
call fcn.004c37de
push esi
push 1
lea eax, [ebp - 0x44]
push 0x40
push eax
call fcn.004c37de
push esi
call fcn.004d245c
add esp, 0x40
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x40], 0
push 0
push 0
push esi
call fcn.004c3c02
push esi
push 1
lea eax, [ebp - 0x8c]
push 8
push eax
call fcn.004c3f01
push esi
push 1
lea eax, [ebp - 0x84]
push 0x40
push eax
call fcn.004c3f01
push esi
push 1
lea eax, [ebp - 0x44]
push 0x40
push eax
call fcn.004c3f01
push esi
call fcn.004d245c
mov ecx, dword [ebp - 4]
add esp, 0x40
xor ecx, ebp
pop esi
call fcn.004b3f28
mov esp, ebp
pop ebp
ret
Function at 0x4eab4d
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x52de04]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp eax, 0x1a
jbe 0x4eab90
call fcn.004cee06
mov dword [eax], 0xf
call fcn.004cee19
mov dword [eax], 0xd
call fcn.004c341f
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b3f28
leave
ret
test eax, eax
jne 0x4eab97
inc eax
jmp 0x4eab84
add eax, 0x40
push 0x3a
mov word [ebp - 0xc], ax
pop eax
mov word [ebp - 0xa], ax
push 0x5c
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, eax
test ecx, ecx
je 0x4eab82
xor eax, eax
cmp ecx, 1
setne al
jmp 0x4eab84

Function at 0x4f2fd0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4f2ffd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4f2ffd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401a70
Capabilities:
Contain obfuscated stackstrings
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x4220c0]
xor eax, ebp
mov dword [ebp - 0x20], eax
push 0x41f160
movzx eax, word [ebp + 0xc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x401aa2
xor al, al
jmp 0x401c0f
mov ecx, dword [ebp - 0x1c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x401abe
xor al, al
jmp 0x401c0f
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x401ad8
xor al, al
jmp 0x401c0f
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x401b04
xor al, al
jmp 0x401c0f
mov ecx, dword [ebp - 0x1c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
push edx
call fcn.0040d252
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0040d3aa
add esp, 0x10
mov byte [ebp - 0x3c], 0x62
mov byte [ebp - 0x2f], 0x31
mov byte [ebp - 0x44], 0x34
mov byte [ebp - 0x3a], 0x30
mov byte [ebp - 0x2b], 0x31
mov byte [ebp - 0x32], 0x32
mov byte [ebp - 0x42], 0x32
mov byte [ebp - 0x29], 0x66
mov byte [ebp - 0x38], 0x33
mov byte [ebp - 0x3e], 0x64
mov byte [ebp - 0x2e], 0x62
mov byte [ebp - 0x43], 0x35
mov byte [ebp - 0x35], 0x36
mov byte [ebp - 0x2d], 0x64
mov byte [ebp - 0x39], 0x65
mov byte [ebp - 0x37], 0x64
mov byte [ebp - 0x27], 0x37
mov byte [ebp - 0x25], 0x64
mov byte [ebp - 0x36], 0x64
mov byte [ebp - 0x2a], 0x31
mov byte [ebp - 0x30], 0x66
mov byte [ebp - 0x34], 0x35
mov byte [ebp - 0x31], 0x62
mov byte [ebp - 0x3d], 0x38
mov byte [ebp - 0x41], 0x32
mov byte [ebp - 0x28], 0x32
mov byte [ebp - 0x2c], 0x61
mov byte [ebp - 0x33], 0x38
mov byte [ebp - 0x40], 0x39
mov byte [ebp - 0x24], 0
mov byte [ebp - 0x3f], 0x38
mov byte [ebp - 0x3b], 0x36
mov byte [ebp - 0x26], 0x61
lea ecx, [ebp - 0x44]
push ecx
call fcn.00406180
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.004062f0
movzx ecx, al
test ecx, ecx
jne 0x401bdf
xor al, al
jmp 0x401c0f
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
push ecx
call fcn.0040d31c
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.0040d024
mov esp, ebp
pop ebp
ret 8