joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424c00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
mov eax, dword [0x471090]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov byte [ebp - 0x118], 0
push 0x103
push 0
lea eax, [ebp - 0x117]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov byte [ebp - 0x129], 0
mov dword [ebp - 0x27c], 0
jmp 0x424c52
mov ecx, dword [ebp - 0x27c]
add ecx, 1
mov dword [ebp - 0x27c], ecx
cmp dword [ebp - 0x27c], 0x19
jge 0x424c7b
call dword [sym.imp.MSVCR90.dll_rand]
cdq
mov ecx, 0xc9
idiv ecx
add edx, 0x67
mov eax, dword [ebp - 0x27c]
mov byte [ebp + eax - 0x118], dl
jmp 0x424c43
push 0x10
push 0
lea ecx, [ebp - 0x128]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
lea edx, [ebp - 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 0xffffffff
jne 0x424cac
jmp 0x424d1d
lea eax, [ebp - 0x270]
push eax
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0xffffffff
jne 0x424cd1
jmp 0x424d1d
mov edx, dword [ebp - 0x274]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x258]
mov dword [ebp - 4], ecx
movzx edx, byte [ebp - 0x129]
test edx, edx
je 0x424d0c
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x25c]
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea edx, [ebp - 0x128]
push edx
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0045ae26
mov esp, ebp
pop ebp
ret
Function at 0x424e90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
mov eax, dword [0x471090]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov byte [ebp - 0x118], 0
push 0x103
push 0
lea eax, [ebp - 0x117]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov byte [ebp - 0x129], 0
mov dword [ebp - 0x27c], 0
jmp 0x424ee2
mov ecx, dword [ebp - 0x27c]
add ecx, 1
mov dword [ebp - 0x27c], ecx
cmp dword [ebp - 0x27c], 0x19
jge 0x424f0e
call dword [sym.imp.MSVCR90.dll_rand]
cdq
mov ecx, 0x3d
idiv ecx
add edx, 0x8a
mov eax, dword [ebp - 0x27c]
mov byte [ebp + eax - 0x118], dl
jmp 0x424ed3
push 0x10
push 0
lea ecx, [ebp - 0x128]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
lea edx, [ebp - 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 0xffffffff
jne 0x424f3f
jmp 0x424fb0
lea eax, [ebp - 0x270]
push eax
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0xffffffff
jne 0x424f64
jmp 0x424fb0
mov edx, dword [ebp - 0x274]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x258]
mov dword [ebp - 4], ecx
movzx edx, byte [ebp - 0x129]
test edx, edx
je 0x424f9f
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x25c]
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea edx, [ebp - 0x128]
push edx
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0045ae26
mov esp, ebp
pop ebp
ret

Function at 0x424fc0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push str.0b4963235b0773e3ab11761d619b5e
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 4], eax
push 0
push str.0c1549cb4b219999b121f2
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_FindWindowExA]
mov dword [ebp - 4], eax
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 5
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov esp, ebp
pop ebp
ret
Function at 0x425140
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
mov eax, dword [0x471090]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov byte [ebp - 0x118], 0
push 0x103
push 0
lea eax, [ebp - 0x117]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov byte [ebp - 0x129], 0
mov dword [ebp - 0x27c], 0
jmp 0x425192
mov ecx, dword [ebp - 0x27c]
add ecx, 1
mov dword [ebp - 0x27c], ecx
cmp dword [ebp - 0x27c], 0x19
jge 0x4251bb
call dword [sym.imp.MSVCR90.dll_rand]
cdq
mov ecx, 0xa5
idiv ecx
add edx, 0xe
mov eax, dword [ebp - 0x27c]
mov byte [ebp + eax - 0x118], dl
jmp 0x425183
push 0x10
push 0
lea ecx, [ebp - 0x128]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
lea edx, [ebp - 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 0xffffffff
jne 0x4251ec
jmp 0x42525d
lea eax, [ebp - 0x270]
push eax
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0xffffffff
jne 0x425211
jmp 0x42525d
mov edx, dword [ebp - 0x274]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x258]
mov dword [ebp - 4], ecx
movzx edx, byte [ebp - 0x129]
test edx, edx
je 0x42524c
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x25c]
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea edx, [ebp - 0x128]
push edx
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0045ae26
mov esp, ebp
pop ebp
ret
Function at 0x425d50
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push str.bed507e58ffd46bb4ad5057b410b8ab
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 4], eax
push 0
push str.0c39abd75b11af0bea7dfce
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_FindWindowExA]
mov dword [ebp - 4], eax
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 5
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov esp, ebp
pop ebp
ret

Function at 0x425da0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push str.1a2142d9f0358bfbfe05c535cf9de
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 4], eax
push 0
push str.26952ef993a7956d848fce354
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_FindWindowExA]
mov dword [ebp - 4], eax
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 5
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov esp, ebp
pop ebp
ret

Function at 0x425df0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push str.166b2e5f89e731ff9
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 4], eax
push 0
push str.0dcf55a3b661e5d9f341c4ef7a1714
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_FindWindowExA]
mov dword [ebp - 4], eax
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 5
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov esp, ebp
pop ebp
ret
Function at 0x426b20
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push str.afad587b70df7831562bb045d63f16
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 4], eax
push 0
push str.e7c51aa9a63332d5ab91605bf46572
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_FindWindowExA]
mov dword [ebp - 4], eax
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 5
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov esp, ebp
pop ebp
ret
Function at 0x43b6b0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45f3d9
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x471090]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
call fcn.00406ee0
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
je 0x43b6f3
jmp 0x43b6fd
call fcn.00422ea0
call fcn.00422ea0
lea ecx, [ebp + 8]
call dword [sym.imp.MSVCP90.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x14], eax
push 0x66
push 0xa8
call fcn.00403d00
add esp, 8
cmp eax, 0x33
jne 0x43b732
call fcn.00406320
test eax, eax
je 0x43b732
call fcn.004161c0
cmp dword [ebp - 0x14], 0xffffffff
jne 0x43b754
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, dword [ebp - 0x18]
jmp 0x43b7b3
mov eax, dword [ebp - 0x14]
and eax, 0x10
je 0x43b778
mov dword [ebp - 0x1c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, dword [ebp - 0x1c]
jmp 0x43b7b3
mov dword [ebp - 0x20], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, dword [ebp - 0x20]
jmp 0x43b7b3
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x43b7d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.0045af10
mov eax, dword [0x471090]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x100c], 0
mov al, byte [0x463ae7]
mov byte [ebp - 0x1008], al
push 0xfff
push 0
lea ecx, [ebp - 0x1007]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0xe5
push 0x87
call fcn.004037c0
add esp, 8
cmp eax, 0x78c3
jne 0x43b839
call fcn.00406e80
test eax, eax
je 0x43b839
call fcn.004161c0
mov ecx, dword [ebp + 8]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::clear_void_]
call fcn.00406e00
test eax, eax
je 0x43b868
push 0xa3
push 0x45
call fcn.004037c0
add esp, 8
cmp eax, 0x2bef
jge 0x43b868
call fcn.00424d30
jmp 0x43b886
push 0xb4
push 0xbd
call fcn.00403d00
add esp, 8
cmp eax, 0x5a
jne 0x43b881
jmp 0x43b886
call fcn.0040e480
lea edx, [ebp - 0x1008]
push edx
push 0x1000
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov dword [ebp - 0x100c], eax
call fcn.00404850
test eax, eax
je 0x43b8ac
call fcn.00425e40
push 0x6d
push 1
call fcn.004037c0
add esp, 8
mov dword [ebp - 0x1010], eax
cmp dword [ebp - 0x1010], 0x6d
je 0x43b8c9
jmp 0x43b8cb
jmp 0x43b8d5
call fcn.0040e480
call fcn.00422ea0
cmp dword [ebp - 0x100c], 0
jne 0x43b8f5
xor eax, eax
jmp 0x43b951
cmp dword [ebp - 0x100c], 0x1000
jb 0x43b905
xor eax, eax
jmp 0x43b951
lea eax, [ebp - 0x1008]
push eax
mov ecx, dword [ebp + 8]
call dword [0x46317c]
push 0x7a
push 0xf7
call fcn.00403d00
add esp, 8
cmp eax, 0x3d
jne 0x43b937
call fcn.00406da0
test eax, eax
je 0x43b937
call fcn.00425e40
mov eax, 1
jmp 0x43b951
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045ae26
mov esp, ebp
pop ebp
ret
Function at 0x43b960
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45f409
mov eax, dword fs:[0]
push eax
mov eax, 0x1024
call fcn.0045af10
mov eax, dword [0x471090]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x1018], 0
mov al, byte [0x463b06]
mov byte [ebp - 0x1014], al
push 0xfff
push 0
lea ecx, [ebp - 0x1013]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
call fcn.00406d40
test eax, eax
je 0x43b9d4
call fcn.004161c0
call fcn.0040e770
mov ecx, dword [ebp + 0x24]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::clear_void_]
push 0x14
push 0xcf
call fcn.004037c0
add esp, 8
mov dword [ebp - 0x1028], eax
cmp dword [ebp - 0x1028], 0x102c
je 0x43ba00
jmp 0x43ba02
jmp 0x43ba0c
call fcn.00413c30
call fcn.0040e8a0
push 0x1000
lea edx, [ebp - 0x1014]
push edx
lea ecx, [ebp + 8]
call dword [sym.imp.MSVCP90.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [ebp - 0x1018], eax
push 0x24
call fcn.00404d40
add esp, 4
mov dword [ebp - 0x102c], eax
cmp dword [ebp - 0x102c], 0x38
je 0x43ba49
jmp 0x43ba4b
jmp 0x43ba55
call fcn.004013c0
call fcn.00422ea0
cmp dword [ebp - 0x1018], 0
jne 0x43ba83
mov dword [ebp - 0x101c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, dword [ebp - 0x101c]
jmp 0x43bb21
cmp dword [ebp - 0x1018], 0x1000
jb 0x43bab1
mov dword [ebp - 0x1020], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, dword [ebp - 0x1020]
jmp 0x43bb21
lea eax, [ebp - 0x1014]
push eax
mov ecx, dword [ebp + 0x24]
call dword [0x46317c]
call fcn.00404120
test eax, eax
je 0x43bacf
call fcn.004161c0
mov dword [ebp - 0x1024], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, dword [ebp - 0x1024]
jmp 0x43bb21
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045ae26
mov esp, ebp
pop ebp
ret
Function at 0x440b30
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
call fcn.0043ee70
test eax, eax
je 0x440b46
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.0043efa0
push 0x78
push 0xde
call fcn.00403d00
add esp, 8
cmp eax, 0x3c
jne 0x440b6d
call fcn.00405bc0
test eax, eax
je 0x440b6d
call fcn.004013c0
pop ebp
ret
Function at 0x452780
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x461d31
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x471090]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [sym.imp.MSVCR90.dll___argc]
cmp dword [eax], 3
je 0x4527da
jmp 0x452908
push 2
lea ecx, [ebp - 0x58]
push ecx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x3c], esp
push 2
push 0x467514
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___unsigned_int_]
mov dword [ebp - 0x64], eax
lea ecx, [ebp - 0x38]
call fcn.00401fe0
mov dword [ebp - 0x68], eax
mov edx, dword [ebp - 0x68]
mov dword [ebp - 0x6c], edx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x6c]
call fcn.004023f0
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x74], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x74]
call dword [sym.imp.MSVCP90.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
mov ecx, dword [sym.imp.MSVCR90.dll___argv]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.MSVCR90.dll__strnicmp]
add esp, 0xc
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x15], al
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x58]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.00444890
movzx ecx, byte [ebp - 0x15]
test ecx, ecx
je 0x452876
jmp 0x452908
mov edx, dword [sym.imp.MSVCR90.dll___argv]
mov eax, dword [edx]
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x5c], esp
mov edx, dword [eax + 8]
push edx
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
mov dword [ebp - 0x78], eax
call fcn.00426ca0
add esp, 0x1c
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4528b0
cmp dword [ebp - 0x10], 0
jne 0x4528b2
jmp 0x452908
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 3
mov edx, dword [ebp - 0x10]
lea eax, [ecx + edx*2 + 0x15]
mov dword [ebp - 0x14], eax
push 0x71
push 0x86
call fcn.00403d00
add esp, 8
cmp eax, 0x38
jne 0x4528e4
call fcn.00402850
test eax, eax
je 0x4528e4
call fcn.004013c0
call fcn.00406320
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 1
je 0x4528f4
jmp 0x4528fe
call fcn.00413c30
call fcn.00425e40
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.MSVCR90.dll_exit]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x45ae26
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x471090]
jne 0x45ae30
repz ret
jmp fcn.0045b35d
Function at 0x46d080
Capabilities:
Encode data using xor

Disassembly:
inc eax
push ebx
dec ecx
mov ebx, ecx
inc ebp
xor edx, edx
dec esp
mov ebx, edx
dec ecx
cmp ebx, edx
dec esp
mov ecx, ecx
je 0x46d0c4
dec esp
sub ecx, edx
dec esp
sub eax, edx
inc ebx
mov ecx, dword [ecx + ebx]
inc ecx
mov edx, dword [ebx]
lea eax, [edx + ecx]
inc esp
add edx, eax
mov eax, edx
or edx, ecx
inc edi
mov dword [eax + ebx], edx
xor eax, ecx
dec ecx
add ebx, 4
inc esp
and edx, eax
inc esp
xor edx, edx
inc ecx
shr edx, 0x1f
dec eax
sub ebx, 1
jne 0x46d099
inc ecx
mov eax, edx
pop ebx
ret

Function at 0x46d0d0
Capabilities:
Encode data using xor

Disassembly:
inc eax
push ebx
push ebp
push esi
push edi
inc ecx
push esp
dec esp
mov esp, dword [esp + 0x50]
xor eax, eax
dec ecx
mov edi, ecx
dec esp
cmp esp, eax
dec ecx
mov esi, eax
dec esp
mov ebx, edx
dec eax
mov ebp, ecx
mov ebx, eax
je 0x46d148
dec eax
sub ebp, edx
dec eax
sub esi, edx
dec eax
sub edi, edx
inc ebp
mov eax, dword [ebx + ebp]
inc ecx
mov edx, dword [ebx]
inc esi
mov ecx, dword [esi + ebx]
inc esi
lea edx, [edx + eax]
inc esp
add edx, eax
inc ecx
mov eax, edx
inc ecx
mov ecx, edx
inc ecx
sub eax, ecx
xor ecx, edx
sub eax, ebx
mov ebx, eax
inc edx
mov dword [edi + ebx], eax
inc ecx
mov eax, edx
inc ecx
xor eax, eax
inc ecx
xor ebx, edx
dec ecx
add ebx, 4
or eax, ecx
inc ecx
mov ecx, edx
inc ecx
xor ecx, ecx
inc ecx
xor eax, edx
or ebx, ecx
shr eax, 0x1f
inc ecx
xor ebx, edx
shr ebx, 0x1f
dec ecx
sub esp, 1
jne 0x46d0fa
sub eax, ebx
inc ecx
pop esp
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x46d220
Capabilities:
Encode data using xor

Disassembly:
inc eax
push ebx
dec ecx
mov ebx, ecx
inc ebp
xor edx, edx
dec esp
mov ebx, edx
dec ecx
cmp ebx, edx
dec esp
mov ecx, ecx
je 0x46d263
dec esp
sub ecx, edx
dec esp
sub eax, edx
inc ebx
mov ecx, dword [ecx + ebx]
inc ecx
mov eax, dword [ebx]
mov edx, ecx
sub edx, eax
xor eax, ecx
inc ecx
sub edx, edx
inc ebx
mov dword [eax + ebx], edx
xor edx, ecx
dec ecx
add ebx, 4
or edx, eax
xor edx, ecx
shr edx, 0x1f
dec eax
sub ebx, 1
inc esp
mov edx, edx
jne 0x46d239
inc ecx
mov eax, edx
pop ebx
ret

Function at 0x48e654
Capabilities:
Encode data using xor

Disassembly:
mul ebp
ficomp word [edx - 0x5abc52]
push esp
push eax
mov ebx, 0xdb88af59
mov dh, 0x4d
pop eax
salc
loop 0x48e602
invalid
Function at 0x10010c50
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [fcn.10010c50]
mov dword [ebp - 4], eax
jmp 0x10010c83
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov ecx, dword [ebp - 4]
cmp dword [ecx + eax], 0x4550
je 0x10010c92
jmp 0x10010c9a
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
add esp, 0xc
pop ebp
ret
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x10010c61
jmp 0x10010c9c
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
jmp 0x10010c75
jmp 0x10010c9c
mov eax, dword [ebp - 4]
sub eax, 0x1000
and eax, 0xfffff000
mov dword [ebp - 4], eax
mov eax, dword [0x100483b4]
sub eax, 0x362
mov dword [0x100483b4], eax
mov al, 1
test al, 1
jne 0x10010c83
jmp 0x10010cc3
mov dword [ebp - 8], 0
jmp 0x10010c75

Function at 0x10010cd0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 8], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [0x100483b4], 0x252d
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x3c]
mov dword [ebp - 0xc], ecx
mov ecx, dword [0x100483b8]
add ecx, 0x253
mov dword [0x100483b4], ecx
mov dword [ebp - 0x10], 0
jmp 0x10010d79
jmp 0x10010e68
jmp 0x10010e63
mov dword [ebp - 4], 0
jmp 0x10010e6d
mov dword [0x100483b8], 0xc8
mov dword [ebp - 4], 1
jmp 0x10010e6d
mov dword [0x100483b4], 0x23b8
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov dx, word [eax + ecx*2 - 0xe]
mov word [ebp - 0x16], dx
mov ax, word [ebp - 0x16]
movzx ecx, ax
cmp ecx, 0x6c
je 0x10010d36
jmp 0x10010e5c
cmp dword [ebp - 0x10], 0x104
jge 0x10010dac
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2]
cmp eax, 0
jne 0x10010d95
jmp 0x10010dac
mov dword [0x100483b4], 0xbea
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x10010d79
mov dword [0x100483b8], 0x1ac
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x1a]
cmp eax, 0x6c
jne 0x10010d2a
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
shl ecx, 1
add eax, ecx
add eax, 0xffffffe8
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx ecx, word [eax]
cmp ecx, 0x6f
jne 0x10010e68
mov dword [0x100483b8], 0x198f
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x16]
cmp eax, 0x61
jne 0x10010d20
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x14]
cmp eax, 0x64
jne 0x10010e63
mov eax, dword [0x100483b4]
sub eax, 0x1325
mov dword [0x100483b4], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x12]
cmp eax, 0x64
jne 0x10010d25
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
movzx eax, word [ecx + eax*2 - 0x10]
cmp eax, 0x6c
je 0x10010d4c
jmp 0x10010e5e
jmp 0x10010e5e
jmp 0x10010d25
jmp 0x10010d20
jmp 0x10010d2a
mov eax, dword [ebp - 4]
add esp, 0x1c
pop ebp
ret