joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405aae
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 0x18]
push esi
push eax
mov eax, dword [ebp + 0x18]
xor ebx, ebx
neg eax
sbb eax, eax
mov esi, dword [ebp + 0x14]
and eax, 0x100
or eax, 0x20019
mov byte [esi], bl
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405b1f
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0x400
push eax
lea eax, [ebp + 0x14]
push esi
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405b0e
cmp dword [ebp + 0x14], 1
je 0x405b10
cmp dword [ebp + 0x14], 2
je 0x405b10
mov byte [esi], bl
push dword [ebp + 0x18]
mov byte [esi + 0x3ff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x405ee9
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, 0x104
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
pop esi
jbe 0x405f0d
xor eax, eax
test eax, eax
je 0x405f1f
cmp byte [ebp + eax - 0x121], 0x5c
je 0x405f1f
xor ecx, ecx
jmp 0x405f22
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx + 0x409010]
lea eax, [ebp + eax - 0x120]
push ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
leave
ret 4

Function at 0x405fc6
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42c634], 0
push esi
jne 0x405ffd
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405fd7
mov dword [ecx*4 + 0x42c630], eax
inc ecx
cmp ecx, 0x100
jl 0x405fd2
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40602e
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42c630]
xor eax, esi
inc ecx
dec edx
jne 0x406010
pop edi
not eax
pop esi
ret 0xc
Function at 0x401658
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x49e92c]
sub esp, 0x800
push esi
mov esi, eax
shr esi, 3
push edi
mov edi, dword [0x49e884]
test esi, esi
je 0x4016a6
cmp eax, 0x959
jne 0x401692
push 0
lea eax, [ebp - 0x800]
push eax
push str.Subasosu_nigukole_padisekadapoyi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ecx, edi
call fcn.0040146e
add edi, 8
dec esi
je 0x4016a6
mov eax, dword [0x49e92c]
jmp 0x401677
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x40d80f
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41b470]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004051b5
mov dword [ebp - 0x14], eax
cmp dword [0x4358a4], esi
jne 0x40d902
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d88f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d9e2
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d9e2
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d9e2
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4358a4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4358a8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4358ac], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4358b4], eax
test eax, eax
je 0x40d8ff
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4358b0], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d927
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d91a
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d93c
push 4
pop eax
jmp 0x40d9e4
cmp dword [ebp - 0x14], esi
je 0x40d93c
push dword [0x4358a4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d921
mov eax, dword [0x4358b0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d99a
cmp dword [0x4358b4], edi
je 0x40d99a
push eax
call ebx
push dword [0x4358b4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d99a
test eax, eax
je 0x40d99a
call ecx
test eax, eax
je 0x40d98f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d98f
test byte [ebp - 8], 1
jne 0x40d99a
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d9ca
mov eax, dword [0x4358a8]
cmp eax, edi
je 0x40d9c7
push eax
call ebx
test eax, eax
je 0x40d9c7
call eax
mov esi, eax
test esi, esi
je 0x40d9c7
mov eax, dword [0x4358ac]
cmp eax, edi
je 0x40d9c7
push eax
call ebx
test eax, eax
je 0x40d9c7
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4358a4]
call ebx
test eax, eax
je 0x40d9e2
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d9e4
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040448f
mov esp, ebp
pop ebp
ret
Function at 0x401554
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebx
push edx
add esp, 4
and ebx, 0x4e3c
pop ebx
push edi
sub edi, 0x154c1
xor edi, 0xe94d
add edi, 0x18503
pop edi
push eax
push edi
add esp, 4
sub eax, 0x16d64
add eax, 0x112ac
pop eax
lea edx, [ebp - 0x1894]
mov dword [ebp - 0xd58], edx
mov eax, dword [ebp - 0x538]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xd54], ecx
xor edx, edx
mov word [ebp - 0x228], dx
xor eax, eax
mov word [ebp - 0x118], ax
push esi
sub esi, 0x8ae9
pop esi
push eax
jmp 0x401545
pop eax
push ecx
call fcn.00401554
add byte [ecx + eax*2], dh
cmp eax, 0x393a4c33
add esp, 4
call 0x401565
add byte [ecx], bh
inc ecx
inc esi
inc eax
inc ebp
inc eax
inc esi
cmp eax, 0x5904c483
mov ecx, dword [ebp - 0xd54]
mov dx, word [ecx]
mov word [ebp - 0x1132], dx
mov eax, dword [ebp - 0xd54]
add eax, 2
mov dword [ebp - 0xd54], eax
mov cx, word [ebp - 0x1132]
mov word [ebp - 0x228], cx
mov edx, dword [ebp - 0xd58]
mov ax, word [edx]
mov word [ebp - 0x1134], ax
mov ecx, dword [ebp - 0xd58]
add ecx, 2
mov dword [ebp - 0xd58], ecx
mov dx, word [ebp - 0x1134]
mov word [ebp - 0x118], dx
push edx
jmp 0x4015cc
pop edx
push ecx
call 0x4015de
add byte [ecx + 0x40], cl
inc esi
dec edi
xor eax, 0x4f443d4a
dec edi
add esp, 4
xor ecx, 0xa584
and ecx, 0x132dc
jmp 0x4015f4
pop ecx
movzx eax, word [ebp - 0x118]
test eax, eax
jne 0x401618
movzx ecx, word [ebp - 0x228]
movzx edx, word [ebp - 0x118]
sub ecx, edx
mov dword [ebp - 0x16dc], ecx
jmp 0x40167b
movzx eax, word [ebp - 0x228]
movzx ecx, word [ebp - 0x118]
cmp eax, ecx
je 0x401537
movzx edx, word [ebp - 0x228]
xor edx, 0x20
movzx eax, word [ebp - 0x118]
cmp edx, eax
je 0x401537
movzx ecx, word [ebp - 0x228]
movzx edx, word [ebp - 0x118]
cmp ecx, edx
jge 0x401665
mov dword [ebp - 0x16d8], 0xffffffff
jmp 0x40166f
mov dword [ebp - 0x16d8], 1
mov eax, dword [ebp - 0x16d8]
mov dword [ebp - 0x16dc], eax
cmp dword [ebp - 0x16dc], 0
jne 0x4016c4
push eax
push edx
add esp, 4
call 0x401698
add byte [esi + 0x40], al
inc esp
inc esi
cmp al, 0x36
xor dh, byte [0x4c48335]
pop eax
push ecx
and ecx, 0x174f4
or ecx, 0x25b2
jmp 0x4016ae
jmp 0x4016b5
pop ecx
mov ecx, dword [ebp - 0x538]
mov dword [ebp - 0x33c], ecx
jmp 0x40172c
push ebx
add ebx, 0x15af9
call 0x4016d8
add byte [esi + 0x36], cl
cmp eax, 0x3f443d3a
add esp, 4
pop ebx
push esi
xor esi, 0x14901
sub esi, 0x36fd
and esi, 0x1831b
and esi, 0x12698
pop esi
mov edx, dword [ebp - 0x538]
mov eax, dword [edx]
mov dword [ebp - 0x538], eax
mov ecx, dword [ebp - 0x538]
cmp ecx, dword [ebp - 0xd5c]
je 0x401722
mov edx, dword [ebp - 0x538]
cmp dword [edx + 0x30], 0
jne 0x4014d8
mov dword [ebp - 0x33c], 0
Function at 0x401565
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebx
push edx
add esp, 4
and ebx, 0x4e3c
pop ebx
push edi
sub edi, 0x154c1
xor edi, 0xe94d
add edi, 0x18503
pop edi
push eax
push edi
add esp, 4
sub eax, 0x16d64
add eax, 0x112ac
pop eax
lea edx, [ebp - 0x1894]
mov dword [ebp - 0xd58], edx
mov eax, dword [ebp - 0x538]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xd54], ecx
xor edx, edx
mov word [ebp - 0x228], dx
xor eax, eax
mov word [ebp - 0x118], ax
push esi
sub esi, 0x8ae9
pop esi
push eax
jmp 0x401545
pop eax
push ecx
call fcn.00401554
add byte [ecx + eax*2], dh
cmp eax, 0x393a4c33
add esp, 4
call 0x401565
add byte [ecx], bh
inc ecx
inc esi
inc eax
inc ebp
inc eax
inc esi
cmp eax, 0x5904c483
mov ecx, dword [ebp - 0xd54]
mov dx, word [ecx]
mov word [ebp - 0x1132], dx
mov eax, dword [ebp - 0xd54]
add eax, 2
mov dword [ebp - 0xd54], eax
mov cx, word [ebp - 0x1132]
mov word [ebp - 0x228], cx
mov edx, dword [ebp - 0xd58]
mov ax, word [edx]
mov word [ebp - 0x1134], ax
mov ecx, dword [ebp - 0xd58]
add ecx, 2
mov dword [ebp - 0xd58], ecx
mov dx, word [ebp - 0x1134]
mov word [ebp - 0x118], dx
push edx
jmp 0x4015cc
pop edx
push ecx
call 0x4015de
add byte [ecx + 0x40], cl
inc esi
dec edi
xor eax, 0x4f443d4a
dec edi
add esp, 4
xor ecx, 0xa584
and ecx, 0x132dc
jmp 0x4015f4
pop ecx
movzx eax, word [ebp - 0x118]
test eax, eax
jne 0x401618
movzx ecx, word [ebp - 0x228]
movzx edx, word [ebp - 0x118]
sub ecx, edx
mov dword [ebp - 0x16dc], ecx
jmp 0x40167b
movzx eax, word [ebp - 0x228]
movzx ecx, word [ebp - 0x118]
cmp eax, ecx
je 0x401537
movzx edx, word [ebp - 0x228]
xor edx, 0x20
movzx eax, word [ebp - 0x118]
cmp edx, eax
je 0x401537
movzx ecx, word [ebp - 0x228]
movzx edx, word [ebp - 0x118]
cmp ecx, edx
jge 0x401665
mov dword [ebp - 0x16d8], 0xffffffff
jmp 0x40166f
mov dword [ebp - 0x16d8], 1
mov eax, dword [ebp - 0x16d8]
mov dword [ebp - 0x16dc], eax
cmp dword [ebp - 0x16dc], 0
jne 0x4016c4
push eax
push edx
add esp, 4
call 0x401698
add byte [esi + 0x40], al
inc esp
inc esi
cmp al, 0x36
xor dh, byte [0x4c48335]
pop eax
push ecx
and ecx, 0x174f4
or ecx, 0x25b2
jmp 0x4016ae
jmp 0x4016b5
pop ecx
mov ecx, dword [ebp - 0x538]
mov dword [ebp - 0x33c], ecx
jmp 0x40172c
push ebx
add ebx, 0x15af9
call 0x4016d8
add byte [esi + 0x36], cl
cmp eax, 0x3f443d3a
add esp, 4
pop ebx
push esi
xor esi, 0x14901
sub esi, 0x36fd
and esi, 0x1831b
and esi, 0x12698
pop esi
mov edx, dword [ebp - 0x538]
mov eax, dword [edx]
mov dword [ebp - 0x538], eax
mov ecx, dword [ebp - 0x538]
cmp ecx, dword [ebp - 0xd5c]
je 0x401722
mov edx, dword [ebp - 0x538]
cmp dword [edx + 0x30], 0
jne 0x4014d8
mov dword [ebp - 0x33c], 0
Function at 0x4015de
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebx
push edx
add esp, 4
and ebx, 0x4e3c
pop ebx
push edi
sub edi, 0x154c1
xor edi, 0xe94d
add edi, 0x18503
pop edi
push eax
push edi
add esp, 4
sub eax, 0x16d64
add eax, 0x112ac
pop eax
lea edx, [ebp - 0x1894]
mov dword [ebp - 0xd58], edx
mov eax, dword [ebp - 0x538]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xd54], ecx
xor edx, edx
mov word [ebp - 0x228], dx
xor eax, eax
mov word [ebp - 0x118], ax
push esi
sub esi, 0x8ae9
pop esi
push eax
jmp 0x401545
pop eax
push ecx
call fcn.00401554
add byte [ecx + eax*2], dh
cmp eax, 0x393a4c33
add esp, 4
call 0x401565
add byte [ecx], bh
inc ecx
inc esi
inc eax
inc ebp
inc eax
inc esi
cmp eax, 0x5904c483
mov ecx, dword [ebp - 0xd54]
mov dx, word [ecx]
mov word [ebp - 0x1132], dx
mov eax, dword [ebp - 0xd54]
add eax, 2
mov dword [ebp - 0xd54], eax
mov cx, word [ebp - 0x1132]
mov word [ebp - 0x228], cx
mov edx, dword [ebp - 0xd58]
mov ax, word [edx]
mov word [ebp - 0x1134], ax
mov ecx, dword [ebp - 0xd58]
add ecx, 2
mov dword [ebp - 0xd58], ecx
mov dx, word [ebp - 0x1134]
mov word [ebp - 0x118], dx
push edx
jmp 0x4015cc
pop edx
push ecx
call 0x4015de
add byte [ecx + 0x40], cl
inc esi
dec edi
xor eax, 0x4f443d4a
dec edi
add esp, 4
xor ecx, 0xa584
and ecx, 0x132dc
jmp 0x4015f4
pop ecx
movzx eax, word [ebp - 0x118]
test eax, eax
jne 0x401618
movzx ecx, word [ebp - 0x228]
movzx edx, word [ebp - 0x118]
sub ecx, edx
mov dword [ebp - 0x16dc], ecx
jmp 0x40167b
movzx eax, word [ebp - 0x228]
movzx ecx, word [ebp - 0x118]
cmp eax, ecx
je 0x401537
movzx edx, word [ebp - 0x228]
xor edx, 0x20
movzx eax, word [ebp - 0x118]
cmp edx, eax
je 0x401537
movzx ecx, word [ebp - 0x228]
movzx edx, word [ebp - 0x118]
cmp ecx, edx
jge 0x401665
mov dword [ebp - 0x16d8], 0xffffffff
jmp 0x40166f
mov dword [ebp - 0x16d8], 1
mov eax, dword [ebp - 0x16d8]
mov dword [ebp - 0x16dc], eax
cmp dword [ebp - 0x16dc], 0
jne 0x4016c4
push eax
push edx
add esp, 4
call 0x401698
add byte [esi + 0x40], al
inc esp
inc esi
cmp al, 0x36
xor dh, byte [0x4c48335]
pop eax
push ecx
and ecx, 0x174f4
or ecx, 0x25b2
jmp 0x4016ae
jmp 0x4016b5
pop ecx
mov ecx, dword [ebp - 0x538]
mov dword [ebp - 0x33c], ecx
jmp 0x40172c
push ebx
add ebx, 0x15af9
call 0x4016d8
add byte [esi + 0x36], cl
cmp eax, 0x3f443d3a
add esp, 4
pop ebx
push esi
xor esi, 0x14901
sub esi, 0x36fd
and esi, 0x1831b
and esi, 0x12698
pop esi
mov edx, dword [ebp - 0x538]
mov eax, dword [edx]
mov dword [ebp - 0x538], eax
mov ecx, dword [ebp - 0x538]
cmp ecx, dword [ebp - 0xd5c]
je 0x401722
mov edx, dword [ebp - 0x538]
cmp dword [edx + 0x30], 0
jne 0x4014d8
mov dword [ebp - 0x33c], 0
Function at 0x401698
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebx
push edx
add esp, 4
and ebx, 0x4e3c
pop ebx
push edi
sub edi, 0x154c1
xor edi, 0xe94d
add edi, 0x18503
pop edi
push eax
push edi
add esp, 4
sub eax, 0x16d64
add eax, 0x112ac
pop eax
lea edx, [ebp - 0x1894]
mov dword [ebp - 0xd58], edx
mov eax, dword [ebp - 0x538]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xd54], ecx
xor edx, edx
mov word [ebp - 0x228], dx
xor eax, eax
mov word [ebp - 0x118], ax
push esi
sub esi, 0x8ae9
pop esi
push eax
jmp 0x401545
pop eax
push ecx
call fcn.00401554
add byte [ecx + eax*2], dh
cmp eax, 0x393a4c33
add esp, 4
call 0x401565
add byte [ecx], bh
inc ecx
inc esi
inc eax
inc ebp
inc eax
inc esi
cmp eax, 0x5904c483
mov ecx, dword [ebp - 0xd54]
mov dx, word [ecx]
mov word [ebp - 0x1132], dx
mov eax, dword [ebp - 0xd54]
add eax, 2
mov dword [ebp - 0xd54], eax
mov cx, word [ebp - 0x1132]
mov word [ebp - 0x228], cx
mov edx, dword [ebp - 0xd58]
mov ax, word [edx]
mov word [ebp - 0x1134], ax
mov ecx, dword [ebp - 0xd58]
add ecx, 2
mov dword [ebp - 0xd58], ecx
mov dx, word [ebp - 0x1134]
mov word [ebp - 0x118], dx
push edx
jmp 0x4015cc
pop edx
push ecx
call 0x4015de
add byte [ecx + 0x40], cl
inc esi
dec edi
xor eax, 0x4f443d4a
dec edi
add esp, 4
xor ecx, 0xa584
and ecx, 0x132dc
jmp 0x4015f4
pop ecx
movzx eax, word [ebp - 0x118]
test eax, eax
jne 0x401618
movzx ecx, word [ebp - 0x228]
movzx edx, word [ebp - 0x118]
sub ecx, edx
mov dword [ebp - 0x16dc], ecx
jmp 0x40167b
movzx eax, word [ebp - 0x228]
movzx ecx, word [ebp - 0x118]
cmp eax, ecx
je 0x401537
movzx edx, word [ebp - 0x228]
xor edx, 0x20
movzx eax, word [ebp - 0x118]
cmp edx, eax
je 0x401537
movzx ecx, word [ebp - 0x228]
movzx edx, word [ebp - 0x118]
cmp ecx, edx
jge 0x401665
mov dword [ebp - 0x16d8], 0xffffffff
jmp 0x40166f
mov dword [ebp - 0x16d8], 1
mov eax, dword [ebp - 0x16d8]
mov dword [ebp - 0x16dc], eax
cmp dword [ebp - 0x16dc], 0
jne 0x4016c4
push eax
push edx
add esp, 4
call 0x401698
add byte [esi + 0x40], al
inc esp
inc esi
cmp al, 0x36
xor dh, byte [0x4c48335]
pop eax
push ecx
and ecx, 0x174f4
or ecx, 0x25b2
jmp 0x4016ae
jmp 0x4016b5
pop ecx
mov ecx, dword [ebp - 0x538]
mov dword [ebp - 0x33c], ecx
jmp 0x40172c
push ebx
add ebx, 0x15af9
call 0x4016d8
add byte [esi + 0x36], cl
cmp eax, 0x3f443d3a
add esp, 4
pop ebx
push esi
xor esi, 0x14901
sub esi, 0x36fd
and esi, 0x1831b
and esi, 0x12698
pop esi
mov edx, dword [ebp - 0x538]
mov eax, dword [edx]
mov dword [ebp - 0x538], eax
mov ecx, dword [ebp - 0x538]
cmp ecx, dword [ebp - 0xd5c]
je 0x401722
mov edx, dword [ebp - 0x538]
cmp dword [edx + 0x30], 0
jne 0x4014d8
mov dword [ebp - 0x33c], 0
Function at 0x4016d8
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebx
push edx
add esp, 4
and ebx, 0x4e3c
pop ebx
push edi
sub edi, 0x154c1
xor edi, 0xe94d
add edi, 0x18503
pop edi
push eax
push edi
add esp, 4
sub eax, 0x16d64
add eax, 0x112ac
pop eax
lea edx, [ebp - 0x1894]
mov dword [ebp - 0xd58], edx
mov eax, dword [ebp - 0x538]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xd54], ecx
xor edx, edx
mov word [ebp - 0x228], dx
xor eax, eax
mov word [ebp - 0x118], ax
push esi
sub esi, 0x8ae9
pop esi
push eax
jmp 0x401545
pop eax
push ecx
call fcn.00401554
add byte [ecx + eax*2], dh
cmp eax, 0x393a4c33
add esp, 4
call 0x401565
add byte [ecx], bh
inc ecx
inc esi
inc eax
inc ebp
inc eax
inc esi
cmp eax, 0x5904c483
mov ecx, dword [ebp - 0xd54]
mov dx, word [ecx]
mov word [ebp - 0x1132], dx
mov eax, dword [ebp - 0xd54]
add eax, 2
mov dword [ebp - 0xd54], eax
mov cx, word [ebp - 0x1132]
mov word [ebp - 0x228], cx
mov edx, dword [ebp - 0xd58]
mov ax, word [edx]
mov word [ebp - 0x1134], ax
mov ecx, dword [ebp - 0xd58]
add ecx, 2
mov dword [ebp - 0xd58], ecx
mov dx, word [ebp - 0x1134]
mov word [ebp - 0x118], dx
push edx
jmp 0x4015cc
pop edx
push ecx
call 0x4015de
add byte [ecx + 0x40], cl
inc esi
dec edi
xor eax, 0x4f443d4a
dec edi
add esp, 4
xor ecx, 0xa584
and ecx, 0x132dc
jmp 0x4015f4
pop ecx
movzx eax, word [ebp - 0x118]
test eax, eax
jne 0x401618
movzx ecx, word [ebp - 0x228]
movzx edx, word [ebp - 0x118]
sub ecx, edx
mov dword [ebp - 0x16dc], ecx
jmp 0x40167b
movzx eax, word [ebp - 0x228]
movzx ecx, word [ebp - 0x118]
cmp eax, ecx
je 0x401537
movzx edx, word [ebp - 0x228]
xor edx, 0x20
movzx eax, word [ebp - 0x118]
cmp edx, eax
je 0x401537
movzx ecx, word [ebp - 0x228]
movzx edx, word [ebp - 0x118]
cmp ecx, edx
jge 0x401665
mov dword [ebp - 0x16d8], 0xffffffff
jmp 0x40166f
mov dword [ebp - 0x16d8], 1
mov eax, dword [ebp - 0x16d8]
mov dword [ebp - 0x16dc], eax
cmp dword [ebp - 0x16dc], 0
jne 0x4016c4
push eax
push edx
add esp, 4
call 0x401698
add byte [esi + 0x40], al
inc esp
inc esi
cmp al, 0x36
xor dh, byte [0x4c48335]
pop eax
push ecx
and ecx, 0x174f4
or ecx, 0x25b2
jmp 0x4016ae
jmp 0x4016b5
pop ecx
mov ecx, dword [ebp - 0x538]
mov dword [ebp - 0x33c], ecx
jmp 0x40172c
push ebx
add ebx, 0x15af9
call 0x4016d8
add byte [esi + 0x36], cl
cmp eax, 0x3f443d3a
add esp, 4
pop ebx
push esi
xor esi, 0x14901
sub esi, 0x36fd
and esi, 0x1831b
and esi, 0x12698
pop esi
mov edx, dword [ebp - 0x538]
mov eax, dword [edx]
mov dword [ebp - 0x538], eax
mov ecx, dword [ebp - 0x538]
cmp ecx, dword [ebp - 0xd5c]
je 0x401722
mov edx, dword [ebp - 0x538]
cmp dword [edx + 0x30], 0
jne 0x4014d8
mov dword [ebp - 0x33c], 0
Function at 0x401b00
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
mov ecx, dword [ebp - 0x16e4]
mov dword [ebp - 0x16e8], ecx
cmp dword [ebp - 0x16e8], 0
jne 0x401b57
push ebx
push ebx
add esp, 4
and ebx, 0x64d1
pop ebx
push edx
add edx, 0x1027f
add edx, 0x1070d
pop edx
push eax
push eax
add esp, 4
add eax, 0x10df9
xor eax, 0x1863c
add dword [eax], eax
xor eax, 0x74ce
pop eax
mov edx, dword [ebp - 0x53c]
mov dword [ebp - 0x7a8], edx
jmp 0x401bbf
push ecx
push eax
add esp, 4
xor ecx, 0xdf4d
jmp 0x401b6a
add ecx, 0x5779
add ecx, 0x11c8a
pop ecx
push ecx
push esi
add esp, 4
xor ecx, 0x117fe
jmp 0x401b88
pop ecx
mov eax, dword [ebp - 0x53c]
mov ecx, dword [eax]
mov dword [ebp - 0x53c], ecx
mov edx, dword [ebp - 0x53c]
cmp edx, dword [ebp - 0xd68]
je 0x401bb5
mov eax, dword [ebp - 0x53c]
cmp dword [eax + 0x30], 0
jne 0x40196b
mov dword [ebp - 0x7a8], 0
push ecx
push esi
add esp, 4
add ecx, 0x693c
xor ecx, 0x15d9d
pop ecx
push eax
push esi
add esp, 4
xor eax, 0x17023
add eax, 0xaf42
or eax, 0xb900
pop eax
push ebx
xor ebx, 0xdee1
pop ebx
cmp dword [ebp - 0x7a8], 0
jne 0x401c3b
push eax
sub eax, 0x17d83
jmp 0x401c09
and eax, 0x16a4
add eax, 0x1633b
pop eax
push esi
call 0x401c23
add byte [esi], dh
inc esp
cmp dword [edi + 0x50], ecx
cmp al, byte [ebx + 0x3eb04c4]
dec ecx
cmp byte [ebx + 0x5e], al
mov dword [ebp - 0xb50], 0
invalid
inc dword [eax]
add byte [eax], al
add cl, ch
sub byte [ebx], cl
add byte [eax], al
push esi
push ecx
add esp, 4
sub esi, 0x122b8
sub esi, 0xf900
pop esi
push edi
and edi, 0xdfd2
and edi, 0x17001
pop edi
push edx
push eax
add esp, 4
sub edx, 0x116c4
sub edx, 0x13d6a
pop edx
mov ecx, dword [ebp - 0x7a8]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x344], edx
mov dword [ebp - 0x7b8], 0
mov eax, dword [ebp - 0x344]
mov dword [ebp - 0x16ec], eax
cmp dword [ebp - 0x16ec], 0
jne 0x401cac
invalid
lea ecx, [eax - 8]
invalid
Function at 0x401c23
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
mov ecx, dword [ebp - 0x16e4]
mov dword [ebp - 0x16e8], ecx
cmp dword [ebp - 0x16e8], 0
jne 0x401b57
push ebx
push ebx
add esp, 4
and ebx, 0x64d1
pop ebx
push edx
add edx, 0x1027f
add edx, 0x1070d
pop edx
push eax
push eax
add esp, 4
add eax, 0x10df9
xor eax, 0x1863c
add dword [eax], eax
xor eax, 0x74ce
pop eax
mov edx, dword [ebp - 0x53c]
mov dword [ebp - 0x7a8], edx
jmp 0x401bbf
push ecx
push eax
add esp, 4
xor ecx, 0xdf4d
jmp 0x401b6a
add ecx, 0x5779
add ecx, 0x11c8a
pop ecx
push ecx
push esi
add esp, 4
xor ecx, 0x117fe
jmp 0x401b88
pop ecx
mov eax, dword [ebp - 0x53c]
mov ecx, dword [eax]
mov dword [ebp - 0x53c], ecx
mov edx, dword [ebp - 0x53c]
cmp edx, dword [ebp - 0xd68]
je 0x401bb5
mov eax, dword [ebp - 0x53c]
cmp dword [eax + 0x30], 0
jne 0x40196b
mov dword [ebp - 0x7a8], 0
push ecx
push esi
add esp, 4
add ecx, 0x693c
xor ecx, 0x15d9d
pop ecx
push eax
push esi
add esp, 4
xor eax, 0x17023
add eax, 0xaf42
or eax, 0xb900
pop eax
push ebx
xor ebx, 0xdee1
pop ebx
cmp dword [ebp - 0x7a8], 0
jne 0x401c3b
push eax
sub eax, 0x17d83
jmp 0x401c09
and eax, 0x16a4
add eax, 0x1633b
pop eax
push esi
call 0x401c23
add byte [esi], dh
inc esp
cmp dword [edi + 0x50], ecx
cmp al, byte [ebx + 0x3eb04c4]
dec ecx
cmp byte [ebx + 0x5e], al
mov dword [ebp - 0xb50], 0
invalid
inc dword [eax]
add byte [eax], al
add cl, ch
sub byte [ebx], cl
add byte [eax], al
push esi
push ecx
add esp, 4
sub esi, 0x122b8
sub esi, 0xf900
pop esi
push edi
and edi, 0xdfd2
and edi, 0x17001
pop edi
push edx
push eax
add esp, 4
sub edx, 0x116c4
sub edx, 0x13d6a
pop edx
mov ecx, dword [ebp - 0x7a8]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x344], edx
mov dword [ebp - 0x7b8], 0
mov eax, dword [ebp - 0x344]
mov dword [ebp - 0x16ec], eax
cmp dword [ebp - 0x16ec], 0
jne 0x401cac
invalid
lea ecx, [eax - 8]
invalid