joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4639cc
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x46376a
pop ebx
jmp 0x46399e
push edx
add edx, 0x6ca0
pop edx
push ebx
push ebx
add esp, 4
call 0x4639b7
add byte [eax + 0x4c], cl
xor eax, 0x8341364a
les eax, [ecx + eax*4]
mov eax, 0xe80000ac
pop es
add byte [eax], al
add byte [eax], al
xor eax, 0x463a5038
push eax
add esp, 4
pop ebx
mov dword [ebp - 0xa5c], 0
push esi
or esi, 0x13310
call 0x4639f0
add byte [edi], dh
inc ecx
xor eax, 0x413e4238
dec edx
add esp, 4
pop esi
push edi
push ebx
add esp, 4
and edi, 0x13b1c
or edi, 0xc16d
add edi, 0x7ce2
pop edi
mov byte [ebp - 0x804], 0x45
mov byte [ebp - 0x803], 0x78
mov byte [ebp - 0x802], 0x69
mov byte [ebp - 0x801], 0x74
mov byte [ebp - 0x800], 0x50
mov byte [ebp - 0x7ff], 0x72
mov byte [ebp - 0x7fe], 0x6f
mov byte [ebp - 0x7fd], 0x63
mov byte [ebp - 0x7fc], 0x65
mov byte [ebp - 0x7fb], 0x73
mov byte [ebp - 0x7fa], 0x73
mov byte [ebp - 0x7f9], 0
push ecx
jmp 0x463a66
jmp 0x463a6d
jmp 0x463a73
or ecx, 0x36d0
pop ecx
push edi
push ecx
add esp, 4
and edi, 0xe7f2
out 0xf2, eax
out 0, eax
add byte [ecx + 0xfe14ef], al
add byte [ecx + 0xbe84e7], al
add byte [edi - 0x47], bl
imul eax, dword [eax], 0
add byte [esi - 0x77], ah
invalid
fsubr st(1)
invalid
invalid
mov edx, 0x65
mov word [ebp - 0x1626], dx
mov eax, 0x72
mov word [ebp - 0x1624], ax
mov ecx, 0x6e
mov word [ebp - 0x1622], cx
mov edx, 0x65
mov word [ebp - 0x1620], dx
mov eax, 0x6c
mov word [ebp - 0x161e], ax
mov ecx, 0x33
mov word [ebp - 0x161c], cx
mov edx, 0x32
mov word [ebp - 0x161a], dx
mov eax, 0x2e
mov word [ebp - 0x1618], ax
mov ecx, 0x64
mov word [ebp - 0x1616], cx
mov edx, 0x6c
mov word [ebp - 0x1614], dx
mov eax, 0x6c
mov word [ebp - 0x1612], ax
invalid
push dword [ebx]
leave
mov word [ebp - 0x1610], cx
push edi
push ecx
add esp, 4
call 0x463b3c
add byte [edx], dh
xor al, 0x3f
xor al, 0x4b
inc ecx
add esp, 4
pop edi
push esi
sub esi, 0x1804e
jmp 0x463b50
add esi, 0xd335
xor esi, 0x4df
pop esi
push edx
push ebx
add esp, 4
add edx, 0xa07f
add edx, 0x1368b
sub edx, 0x5211
add edx, 0x111ef
pop edx
push ecx
and ecx, 0x105dc
or ecx, 0x4607
xor ecx, 0x40d2
pop ecx
mov edx, dword fs:[0x18]
mov edx, dword [0x18]
mov dword [ebp - 0x1890], edx
mov eax, dword [ebp - 0x1890]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x1894], ecx
mov edx, dword [ebp - 0x1894]
mov dword [ebp - 0x14d4], edx
push ecx
or ecx, 0xe9d
xor ecx, 0x61a9
or ecx, 0x14e29
pop ecx
push esi
push ecx
add esp, 4
sub esi, 0x4c8d
add esi, 0x13bb3
sub esi, 0x150d3
add esi, 0xf825
pop esi
cmp dword [ebp - 0x14d4], 0
jne 0x463c01
mov dword [ebp - 0x2e0], 0
jmp 0x463ebd
invalid
mov eax, dword [ebp - 0x14d4]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xc20], edx
push edx
sub edx, 0xdd86
jmp 0x463c22
xor edx, 0xebc0
pop edx
push edx
xor edx, 0xa346
or edx, 0x8d5b
add edx, 0xce96
pop edx
push eax
or eax, 0x12ae0
pop eax
cmp dword [ebp - 0xc20], 0
jne 0x463c5d
mov dword [ebp - 0x2e0], 0
jmp 0x463ebd
mov eax, dword [ebp - 0xc20]
mov dword [ebp - 0x4d4], eax
Function at 0x4639f0
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x46376a
pop ebx
jmp 0x46399e
push edx
add edx, 0x6ca0
pop edx
push ebx
push ebx
add esp, 4
call 0x4639b7
add byte [eax + 0x4c], cl
xor eax, 0x8341364a
les eax, [ecx + eax*4]
mov eax, 0xe80000ac
pop es
add byte [eax], al
add byte [eax], al
xor eax, 0x463a5038
push eax
add esp, 4
pop ebx
mov dword [ebp - 0xa5c], 0
push esi
or esi, 0x13310
call 0x4639f0
add byte [edi], dh
inc ecx
xor eax, 0x413e4238
dec edx
add esp, 4
pop esi
push edi
push ebx
add esp, 4
and edi, 0x13b1c
or edi, 0xc16d
add edi, 0x7ce2
pop edi
mov byte [ebp - 0x804], 0x45
mov byte [ebp - 0x803], 0x78
mov byte [ebp - 0x802], 0x69
mov byte [ebp - 0x801], 0x74
mov byte [ebp - 0x800], 0x50
mov byte [ebp - 0x7ff], 0x72
mov byte [ebp - 0x7fe], 0x6f
mov byte [ebp - 0x7fd], 0x63
mov byte [ebp - 0x7fc], 0x65
mov byte [ebp - 0x7fb], 0x73
mov byte [ebp - 0x7fa], 0x73
mov byte [ebp - 0x7f9], 0
push ecx
jmp 0x463a66
jmp 0x463a6d
jmp 0x463a73
or ecx, 0x36d0
pop ecx
push edi
push ecx
add esp, 4
and edi, 0xe7f2
out 0xf2, eax
out 0, eax
add byte [ecx + 0xfe14ef], al
add byte [ecx + 0xbe84e7], al
add byte [edi - 0x47], bl
imul eax, dword [eax], 0
add byte [esi - 0x77], ah
invalid
fsubr st(1)
invalid
invalid
mov edx, 0x65
mov word [ebp - 0x1626], dx
mov eax, 0x72
mov word [ebp - 0x1624], ax
mov ecx, 0x6e
mov word [ebp - 0x1622], cx
mov edx, 0x65
mov word [ebp - 0x1620], dx
mov eax, 0x6c
mov word [ebp - 0x161e], ax
mov ecx, 0x33
mov word [ebp - 0x161c], cx
mov edx, 0x32
mov word [ebp - 0x161a], dx
mov eax, 0x2e
mov word [ebp - 0x1618], ax
mov ecx, 0x64
mov word [ebp - 0x1616], cx
mov edx, 0x6c
mov word [ebp - 0x1614], dx
mov eax, 0x6c
mov word [ebp - 0x1612], ax
invalid
push dword [ebx]
leave
mov word [ebp - 0x1610], cx
push edi
push ecx
add esp, 4
call 0x463b3c
add byte [edx], dh
xor al, 0x3f
xor al, 0x4b
inc ecx
add esp, 4
pop edi
push esi
sub esi, 0x1804e
jmp 0x463b50
add esi, 0xd335
xor esi, 0x4df
pop esi
push edx
push ebx
add esp, 4
add edx, 0xa07f
add edx, 0x1368b
sub edx, 0x5211
add edx, 0x111ef
pop edx
push ecx
and ecx, 0x105dc
or ecx, 0x4607
xor ecx, 0x40d2
pop ecx
mov edx, dword fs:[0x18]
mov edx, dword [0x18]
mov dword [ebp - 0x1890], edx
mov eax, dword [ebp - 0x1890]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x1894], ecx
mov edx, dword [ebp - 0x1894]
mov dword [ebp - 0x14d4], edx
push ecx
or ecx, 0xe9d
xor ecx, 0x61a9
or ecx, 0x14e29
pop ecx
push esi
push ecx
add esp, 4
sub esi, 0x4c8d
add esi, 0x13bb3
sub esi, 0x150d3
add esi, 0xf825
pop esi
cmp dword [ebp - 0x14d4], 0
jne 0x463c01
mov dword [ebp - 0x2e0], 0
jmp 0x463ebd
invalid
mov eax, dword [ebp - 0x14d4]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xc20], edx
push edx
sub edx, 0xdd86
jmp 0x463c22
xor edx, 0xebc0
pop edx
push edx
xor edx, 0xa346
or edx, 0x8d5b
add edx, 0xce96
pop edx
push eax
or eax, 0x12ae0
pop eax
cmp dword [ebp - 0xc20], 0
jne 0x463c5d
mov dword [ebp - 0x2e0], 0
jmp 0x463ebd
mov eax, dword [ebp - 0xc20]
mov dword [ebp - 0x4d4], eax
Function at 0x463a80
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
out 0xf2, eax
out 0, eax
add byte [ecx + 0xfe14ef], al
add byte [ecx + 0xbe84e7], al
add byte [edi - 0x47], bl
imul eax, dword [eax], 0
add byte [esi - 0x77], ah
invalid
Function at 0x463b3c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x46376a
pop ebx
jmp 0x46399e
push edx
add edx, 0x6ca0
pop edx
push ebx
push ebx
add esp, 4
call 0x4639b7
add byte [eax + 0x4c], cl
xor eax, 0x8341364a
les eax, [ecx + eax*4]
mov eax, 0xe80000ac
pop es
add byte [eax], al
add byte [eax], al
xor eax, 0x463a5038
push eax
add esp, 4
pop ebx
mov dword [ebp - 0xa5c], 0
push esi
or esi, 0x13310
call 0x4639f0
add byte [edi], dh
inc ecx
xor eax, 0x413e4238
dec edx
add esp, 4
pop esi
push edi
push ebx
add esp, 4
and edi, 0x13b1c
or edi, 0xc16d
add edi, 0x7ce2
pop edi
mov byte [ebp - 0x804], 0x45
mov byte [ebp - 0x803], 0x78
mov byte [ebp - 0x802], 0x69
mov byte [ebp - 0x801], 0x74
mov byte [ebp - 0x800], 0x50
mov byte [ebp - 0x7ff], 0x72
mov byte [ebp - 0x7fe], 0x6f
mov byte [ebp - 0x7fd], 0x63
mov byte [ebp - 0x7fc], 0x65
mov byte [ebp - 0x7fb], 0x73
mov byte [ebp - 0x7fa], 0x73
mov byte [ebp - 0x7f9], 0
push ecx
jmp 0x463a66
jmp 0x463a6d
jmp 0x463a73
or ecx, 0x36d0
pop ecx
push edi
push ecx
add esp, 4
and edi, 0xe7f2
out 0xf2, eax
out 0, eax
add byte [ecx + 0xfe14ef], al
add byte [ecx + 0xbe84e7], al
add byte [edi - 0x47], bl
imul eax, dword [eax], 0
add byte [esi - 0x77], ah
invalid
fsubr st(1)
invalid
invalid
mov edx, 0x65
mov word [ebp - 0x1626], dx
mov eax, 0x72
mov word [ebp - 0x1624], ax
mov ecx, 0x6e
mov word [ebp - 0x1622], cx
mov edx, 0x65
mov word [ebp - 0x1620], dx
mov eax, 0x6c
mov word [ebp - 0x161e], ax
mov ecx, 0x33
mov word [ebp - 0x161c], cx
mov edx, 0x32
mov word [ebp - 0x161a], dx
mov eax, 0x2e
mov word [ebp - 0x1618], ax
mov ecx, 0x64
mov word [ebp - 0x1616], cx
mov edx, 0x6c
mov word [ebp - 0x1614], dx
mov eax, 0x6c
mov word [ebp - 0x1612], ax
invalid
push dword [ebx]
leave
mov word [ebp - 0x1610], cx
push edi
push ecx
add esp, 4
call 0x463b3c
add byte [edx], dh
xor al, 0x3f
xor al, 0x4b
inc ecx
add esp, 4
pop edi
push esi
sub esi, 0x1804e
jmp 0x463b50
add esi, 0xd335
xor esi, 0x4df
pop esi
push edx
push ebx
add esp, 4
add edx, 0xa07f
add edx, 0x1368b
sub edx, 0x5211
add edx, 0x111ef
pop edx
push ecx
and ecx, 0x105dc
or ecx, 0x4607
xor ecx, 0x40d2
pop ecx
mov edx, dword fs:[0x18]
mov edx, dword [0x18]
mov dword [ebp - 0x1890], edx
mov eax, dword [ebp - 0x1890]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x1894], ecx
mov edx, dword [ebp - 0x1894]
mov dword [ebp - 0x14d4], edx
push ecx
or ecx, 0xe9d
xor ecx, 0x61a9
or ecx, 0x14e29
pop ecx
push esi
push ecx
add esp, 4
sub esi, 0x4c8d
add esi, 0x13bb3
sub esi, 0x150d3
add esi, 0xf825
pop esi
cmp dword [ebp - 0x14d4], 0
jne 0x463c01
mov dword [ebp - 0x2e0], 0
jmp 0x463ebd
invalid
mov eax, dword [ebp - 0x14d4]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xc20], edx
push edx
sub edx, 0xdd86
jmp 0x463c22
xor edx, 0xebc0
pop edx
push edx
xor edx, 0xa346
or edx, 0x8d5b
add edx, 0xce96
pop edx
push eax
or eax, 0x12ae0
pop eax
cmp dword [ebp - 0xc20], 0
jne 0x463c5d
mov dword [ebp - 0x2e0], 0
jmp 0x463ebd
mov eax, dword [ebp - 0xc20]
mov dword [ebp - 0x4d4], eax
Function at 0x463e80
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
add esp, 4
xor edi, 0x14372
xor edi, 0x9fa4
pop edi
push esi
and esi, 0x164d9
pop esi
push ebx
push eax
add esp, 4
sub ebx, 0x9daf
pop ebx
push ecx
push eax
add esp, 4
and ecx, 0x285d
pop ecx
lea ecx, [ebp - 0x1628]
mov dword [ebp - 0xc1c], ecx
mov edx, dword [ebp - 0x4d4]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xc18], eax
xor ecx, ecx
mov word [ebp - 0x1f8], cx
xor edx, edx
mov word [ebp - 0x100], dx
push esi
push ebx
add esp, 4
xor esi, 0x8ead
xor esi, 0x8d29
pop esi
push ebx
push ebx
add esp, 4
xor ebx, 0x13c2b
jmp 0x463ced
and ebx, 0x2f4b
xor ebx, 0xaf11
pop ebx
mov eax, dword [ebp - 0xc18]
mov cx, word [eax]
mov word [ebp - 0xf7e], cx
mov edx, dword [ebp - 0xc18]
add edx, 2
mov dword [ebp - 0xc18], edx
mov ax, word [ebp - 0xf7e]
mov word [ebp - 0x1f8], ax
mov ecx, dword [ebp - 0xc1c]
mov dx, word [ecx]
mov word [ebp - 0xf80], dx
mov eax, dword [ebp - 0xc1c]
add eax, 2
mov dword [ebp - 0xc1c], eax
mov cx, word [ebp - 0xf80]
mov word [ebp - 0x100], cx
push eax
push ecx
add esp, 4
add eax, 0x4638
add eax, 0x15a0f
pop eax
push esi
jmp 0x463d6d
and esi, 0x6341
add esi, 0x10465
pop esi
push edx
push edx
add esp, 4
add edx, 0x12467
pop edx
movzx edx, word [ebp - 0x100]
test edx, edx
jne 0x463da9
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
sub eax, ecx
mov dword [ebp - 0x1498], eax
jmp 0x463e0c
movzx edx, word [ebp - 0x1f8]
movzx eax, word [ebp - 0x100]
cmp edx, eax
je 0x463cc8
movzx ecx, word [ebp - 0x1f8]
xor ecx, 0x20
movzx edx, word [ebp - 0x100]
cmp ecx, edx
je 0x463cc8
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
cmp eax, ecx
jge 0x463df6
mov dword [ebp - 0x14d8], 0xffffffff
jmp 0x463e00
mov dword [ebp - 0x14d8], 1
mov edx, dword [ebp - 0x14d8]
mov dword [ebp - 0x1498], edx
cmp dword [ebp - 0x1498], 0
jne 0x463e55
push esi
sub esi, 0xecf6
xor esi, 0xa000
or esi, 0xa05e
and esi, 0x9161
pop esi
push esi
push edi
add esp, 4
or esi, 0x7131
or esi, 0x26d2
sub esi, 0xaf64
pop esi
mov eax, dword [ebp - 0x4d4]
mov dword [ebp - 0x2e0], eax
jmp 0x463ebd
push ecx
push esi
add esp, 4
jmp 0x463e60
jmp 0x463e68
sub ecx, 0x14aef
pop ecx
push edx
xor edx, 0x3b33
call 0x463e83
add byte [edx + 0x3e], cl
xor al, 0x50
push eax
push eax
inc esp
inc esp
add esp, 4
pop edx
mov ecx, dword [ebp - 0x4d4]
mov edx, dword [ecx]
mov dword [ebp - 0x4d4], edx
mov eax, dword [ebp - 0x4d4]
cmp eax, dword [ebp - 0xc20]
je 0x463eb3
mov ecx, dword [ebp - 0x4d4]
cmp dword [ecx + 0x30], 0
jne 0x463c69
std
invalid
invalid
mov dword [ebp - 0x2e0], 0
push edx
sub edx, 0x10950
jmp 0x463eca
pop edx
push ebx
push edx
add esp, 4
and ebx, 0x11653
pop ebx
push edx
push eax
add esp, 4
add edx, 0x4d7b
or edx, 0xc82c
and edx, 0x15533
pop edx
cmp dword [ebp - 0x2e0], 0
jne 0x464808
invalid
imul eax, dword [eax], 0
Function at 0x463e83
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
add esp, 4
xor edi, 0x14372
xor edi, 0x9fa4
pop edi
push esi
and esi, 0x164d9
pop esi
push ebx
push eax
add esp, 4
sub ebx, 0x9daf
pop ebx
push ecx
push eax
add esp, 4
and ecx, 0x285d
pop ecx
lea ecx, [ebp - 0x1628]
mov dword [ebp - 0xc1c], ecx
mov edx, dword [ebp - 0x4d4]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xc18], eax
xor ecx, ecx
mov word [ebp - 0x1f8], cx
xor edx, edx
mov word [ebp - 0x100], dx
push esi
push ebx
add esp, 4
xor esi, 0x8ead
xor esi, 0x8d29
pop esi
push ebx
push ebx
add esp, 4
xor ebx, 0x13c2b
jmp 0x463ced
and ebx, 0x2f4b
xor ebx, 0xaf11
pop ebx
mov eax, dword [ebp - 0xc18]
mov cx, word [eax]
mov word [ebp - 0xf7e], cx
mov edx, dword [ebp - 0xc18]
add edx, 2
mov dword [ebp - 0xc18], edx
mov ax, word [ebp - 0xf7e]
mov word [ebp - 0x1f8], ax
mov ecx, dword [ebp - 0xc1c]
mov dx, word [ecx]
mov word [ebp - 0xf80], dx
mov eax, dword [ebp - 0xc1c]
add eax, 2
mov dword [ebp - 0xc1c], eax
mov cx, word [ebp - 0xf80]
mov word [ebp - 0x100], cx
push eax
push ecx
add esp, 4
add eax, 0x4638
add eax, 0x15a0f
pop eax
push esi
jmp 0x463d6d
and esi, 0x6341
add esi, 0x10465
pop esi
push edx
push edx
add esp, 4
add edx, 0x12467
pop edx
movzx edx, word [ebp - 0x100]
test edx, edx
jne 0x463da9
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
sub eax, ecx
mov dword [ebp - 0x1498], eax
jmp 0x463e0c
movzx edx, word [ebp - 0x1f8]
movzx eax, word [ebp - 0x100]
cmp edx, eax
je 0x463cc8
movzx ecx, word [ebp - 0x1f8]
xor ecx, 0x20
movzx edx, word [ebp - 0x100]
cmp ecx, edx
je 0x463cc8
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
cmp eax, ecx
jge 0x463df6
mov dword [ebp - 0x14d8], 0xffffffff
jmp 0x463e00
mov dword [ebp - 0x14d8], 1
mov edx, dword [ebp - 0x14d8]
mov dword [ebp - 0x1498], edx
cmp dword [ebp - 0x1498], 0
jne 0x463e55
push esi
sub esi, 0xecf6
xor esi, 0xa000
or esi, 0xa05e
and esi, 0x9161
pop esi
push esi
push edi
add esp, 4
or esi, 0x7131
or esi, 0x26d2
sub esi, 0xaf64
pop esi
mov eax, dword [ebp - 0x4d4]
mov dword [ebp - 0x2e0], eax
jmp 0x463ebd
push ecx
push esi
add esp, 4
jmp 0x463e60
jmp 0x463e68
sub ecx, 0x14aef
pop ecx
push edx
xor edx, 0x3b33
call 0x463e83
add byte [edx + 0x3e], cl
xor al, 0x50
push eax
push eax
inc esp
inc esp
add esp, 4
pop edx
mov ecx, dword [ebp - 0x4d4]
mov edx, dword [ecx]
mov dword [ebp - 0x4d4], edx
mov eax, dword [ebp - 0x4d4]
cmp eax, dword [ebp - 0xc20]
je 0x463eb3
mov ecx, dword [ebp - 0x4d4]
cmp dword [ecx + 0x30], 0
jne 0x463c69
std
invalid
invalid
mov dword [ebp - 0x2e0], 0
push edx
sub edx, 0x10950
jmp 0x463eca
pop edx
push ebx
push edx
add esp, 4
and ebx, 0x11653
pop ebx
push edx
push eax
add esp, 4
add edx, 0x4d7b
or edx, 0xc82c
and edx, 0x15533
pop edx
cmp dword [ebp - 0x2e0], 0
jne 0x464808
invalid
imul eax, dword [eax], 0
Function at 0x463f50
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x32
mov word [ebp - 0x16be], ax
mov ecx, 0x2e
mov word [ebp - 0x16bc], cx
mov edx, 0x64
mov word [ebp - 0x16ba], dx
mov eax, 0x6c
mov word [ebp - 0x16b8], ax
mov ecx, 0x6c
mov word [ebp - 0x16b6], cx
xor edx, edx
mov word [ebp - 0x16b4], dx
push edi
push edx
add esp, 4
xor edi, 0x7a3e
add edi, 0xcb0
call 0x463fb5
add byte [edx + esi], dh
dec edx
dec ebx
inc ebx
cmp bh, byte [edi + esi]
cmp al, 0x83
les eax, [edi + ebx*2]
push ebx
and ebx, 0x561b
xor ebx, 0xdd7c
pop ebx
mov byte [ebp - 0x820], 0x4c
mov byte [ebp - 0x81f], 0x6f
mov byte [ebp - 0x81e], 0x61
mov byte [ebp - 0x81d], 0x64
mov byte [ebp - 0x81c], 0x4c
mov byte [ebp - 0x81b], 0x69
mov byte [ebp - 0x81a], 0x62
mov byte [ebp - 0x819], 0x72
mov byte [ebp - 0x818], 0x61
mov byte [ebp - 0x817], 0x72
mov byte [ebp - 0x816], 0x79
mov byte [ebp - 0x815], 0x57
mov byte [ebp - 0x814], 0
mov eax, dword fs:[0x18]
mov dword [ebp - 0x1898], eax
mov ecx, dword [ebp - 0x1898]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x189c], edx
mov eax, dword [ebp - 0x189c]
mov dword [ebp - 0x14dc], eax
push ebx
and ebx, 0x12106
or ebx, 0x10e1
sub ebx, 0x44f
pop ebx
push esi
call 0x46406a
add byte [ecx + 0x4f], al
cmp byte [eax + ecx*2 + 0x40], cl
add esp, 4
pop esi
push edi
push eax
add esp, 4
jmp 0x46407a
pop edi
cmp dword [ebp - 0x14dc], 0
jne 0x464093
mov dword [ebp - 0x6ec], 0
jmp 0x46434f
mov ecx, dword [ebp - 0x14dc]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xc2c], eax
push ecx
or ecx, 0xee15
pop ecx
push ecx
push ecx
add esp, 4
jmp 0x4640b8
call 0x4640c4
add byte [edx], bh
dec ecx
dec esp
inc ebx
dec ebx
xor al, byte [ebx - 0x167efb3c]
mov cl, 0x24
add byte [eax], al
jmp 0x4640d6
pop ecx
cmp dword [ebp - 0xc2c], 0
jne 0x4640ef
mov dword [ebp - 0x6ec], 0
jmp 0x46434f
mov ecx, dword [ebp - 0xc2c]
mov dword [ebp - 0x4d8], ecx
Function at 0x463fb5
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x32
mov word [ebp - 0x16be], ax
mov ecx, 0x2e
mov word [ebp - 0x16bc], cx
mov edx, 0x64
mov word [ebp - 0x16ba], dx
mov eax, 0x6c
mov word [ebp - 0x16b8], ax
mov ecx, 0x6c
mov word [ebp - 0x16b6], cx
xor edx, edx
mov word [ebp - 0x16b4], dx
push edi
push edx
add esp, 4
xor edi, 0x7a3e
add edi, 0xcb0
call 0x463fb5
add byte [edx + esi], dh
dec edx
dec ebx
inc ebx
cmp bh, byte [edi + esi]
cmp al, 0x83
les eax, [edi + ebx*2]
push ebx
and ebx, 0x561b
xor ebx, 0xdd7c
pop ebx
mov byte [ebp - 0x820], 0x4c
mov byte [ebp - 0x81f], 0x6f
mov byte [ebp - 0x81e], 0x61
mov byte [ebp - 0x81d], 0x64
mov byte [ebp - 0x81c], 0x4c
mov byte [ebp - 0x81b], 0x69
mov byte [ebp - 0x81a], 0x62
mov byte [ebp - 0x819], 0x72
mov byte [ebp - 0x818], 0x61
mov byte [ebp - 0x817], 0x72
mov byte [ebp - 0x816], 0x79
mov byte [ebp - 0x815], 0x57
mov byte [ebp - 0x814], 0
mov eax, dword fs:[0x18]
mov dword [ebp - 0x1898], eax
mov ecx, dword [ebp - 0x1898]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x189c], edx
mov eax, dword [ebp - 0x189c]
mov dword [ebp - 0x14dc], eax
push ebx
and ebx, 0x12106
or ebx, 0x10e1
sub ebx, 0x44f
pop ebx
push esi
call 0x46406a
add byte [ecx + 0x4f], al
cmp byte [eax + ecx*2 + 0x40], cl
add esp, 4
pop esi
push edi
push eax
add esp, 4
jmp 0x46407a
pop edi
cmp dword [ebp - 0x14dc], 0
jne 0x464093
mov dword [ebp - 0x6ec], 0
jmp 0x46434f
mov ecx, dword [ebp - 0x14dc]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xc2c], eax
push ecx
or ecx, 0xee15
pop ecx
push ecx
push ecx
add esp, 4
jmp 0x4640b8
call 0x4640c4
add byte [edx], bh
dec ecx
dec esp
inc ebx
dec ebx
xor al, byte [ebx - 0x167efb3c]
mov cl, 0x24
add byte [eax], al
jmp 0x4640d6
pop ecx
cmp dword [ebp - 0xc2c], 0
jne 0x4640ef
mov dword [ebp - 0x6ec], 0
jmp 0x46434f
mov ecx, dword [ebp - 0xc2c]
mov dword [ebp - 0x4d8], ecx
Function at 0x46406a
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x32
mov word [ebp - 0x16be], ax
mov ecx, 0x2e
mov word [ebp - 0x16bc], cx
mov edx, 0x64
mov word [ebp - 0x16ba], dx
mov eax, 0x6c
mov word [ebp - 0x16b8], ax
mov ecx, 0x6c
mov word [ebp - 0x16b6], cx
xor edx, edx
mov word [ebp - 0x16b4], dx
push edi
push edx
add esp, 4
xor edi, 0x7a3e
add edi, 0xcb0
call 0x463fb5
add byte [edx + esi], dh
dec edx
dec ebx
inc ebx
cmp bh, byte [edi + esi]
cmp al, 0x83
les eax, [edi + ebx*2]
push ebx
and ebx, 0x561b
xor ebx, 0xdd7c
pop ebx
mov byte [ebp - 0x820], 0x4c
mov byte [ebp - 0x81f], 0x6f
mov byte [ebp - 0x81e], 0x61
mov byte [ebp - 0x81d], 0x64
mov byte [ebp - 0x81c], 0x4c
mov byte [ebp - 0x81b], 0x69
mov byte [ebp - 0x81a], 0x62
mov byte [ebp - 0x819], 0x72
mov byte [ebp - 0x818], 0x61
mov byte [ebp - 0x817], 0x72
mov byte [ebp - 0x816], 0x79
mov byte [ebp - 0x815], 0x57
mov byte [ebp - 0x814], 0
mov eax, dword fs:[0x18]
mov dword [ebp - 0x1898], eax
mov ecx, dword [ebp - 0x1898]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x189c], edx
mov eax, dword [ebp - 0x189c]
mov dword [ebp - 0x14dc], eax
push ebx
and ebx, 0x12106
or ebx, 0x10e1
sub ebx, 0x44f
pop ebx
push esi
call 0x46406a
add byte [ecx + 0x4f], al
cmp byte [eax + ecx*2 + 0x40], cl
add esp, 4
pop esi
push edi
push eax
add esp, 4
jmp 0x46407a
pop edi
cmp dword [ebp - 0x14dc], 0
jne 0x464093
mov dword [ebp - 0x6ec], 0
jmp 0x46434f
mov ecx, dword [ebp - 0x14dc]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xc2c], eax
push ecx
or ecx, 0xee15
pop ecx
push ecx
push ecx
add esp, 4
jmp 0x4640b8
call 0x4640c4
add byte [edx], bh
dec ecx
dec esp
inc ebx
dec ebx
xor al, byte [ebx - 0x167efb3c]
mov cl, 0x24
add byte [eax], al
jmp 0x4640d6
pop ecx
cmp dword [ebp - 0xc2c], 0
jne 0x4640ef
mov dword [ebp - 0x6ec], 0
jmp 0x46434f
mov ecx, dword [ebp - 0xc2c]
mov dword [ebp - 0x4d8], ecx
Function at 0x4640c4
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x32
mov word [ebp - 0x16be], ax
mov ecx, 0x2e
mov word [ebp - 0x16bc], cx
mov edx, 0x64
mov word [ebp - 0x16ba], dx
mov eax, 0x6c
mov word [ebp - 0x16b8], ax
mov ecx, 0x6c
mov word [ebp - 0x16b6], cx
xor edx, edx
mov word [ebp - 0x16b4], dx
push edi
push edx
add esp, 4
xor edi, 0x7a3e
add edi, 0xcb0
call 0x463fb5
add byte [edx + esi], dh
dec edx
dec ebx
inc ebx
cmp bh, byte [edi + esi]
cmp al, 0x83
les eax, [edi + ebx*2]
push ebx
and ebx, 0x561b
xor ebx, 0xdd7c
pop ebx
mov byte [ebp - 0x820], 0x4c
mov byte [ebp - 0x81f], 0x6f
mov byte [ebp - 0x81e], 0x61
mov byte [ebp - 0x81d], 0x64
mov byte [ebp - 0x81c], 0x4c
mov byte [ebp - 0x81b], 0x69
mov byte [ebp - 0x81a], 0x62
mov byte [ebp - 0x819], 0x72
mov byte [ebp - 0x818], 0x61
mov byte [ebp - 0x817], 0x72
mov byte [ebp - 0x816], 0x79
mov byte [ebp - 0x815], 0x57
mov byte [ebp - 0x814], 0
mov eax, dword fs:[0x18]
mov dword [ebp - 0x1898], eax
mov ecx, dword [ebp - 0x1898]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x189c], edx
mov eax, dword [ebp - 0x189c]
mov dword [ebp - 0x14dc], eax
push ebx
and ebx, 0x12106
or ebx, 0x10e1
sub ebx, 0x44f
pop ebx
push esi
call 0x46406a
add byte [ecx + 0x4f], al
cmp byte [eax + ecx*2 + 0x40], cl
add esp, 4
pop esi
push edi
push eax
add esp, 4
jmp 0x46407a
pop edi
cmp dword [ebp - 0x14dc], 0
jne 0x464093
mov dword [ebp - 0x6ec], 0
jmp 0x46434f
mov ecx, dword [ebp - 0x14dc]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xc2c], eax
push ecx
or ecx, 0xee15
pop ecx
push ecx
push ecx
add esp, 4
jmp 0x4640b8
call 0x4640c4
add byte [edx], bh
dec ecx
dec esp
inc ebx
dec ebx
xor al, byte [ebx - 0x167efb3c]
mov cl, 0x24
add byte [eax], al
jmp 0x4640d6
pop ecx
cmp dword [ebp - 0xc2c], 0
jne 0x4640ef
mov dword [ebp - 0x6ec], 0
jmp 0x46434f
mov ecx, dword [ebp - 0xc2c]
mov dword [ebp - 0x4d8], ecx
Function at 0x4647e0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
add esp, 4
call 0x4647f5
add byte [esi + 0x49], cl
cmp al, 0x36
cmp byte [eax + 0x46], dl
cmp eax, dword [ebp + 0x36]
add esp, 4
pop ebx
mov dword [ebp - 0x738], 0
jmp 0x464ef2

Function at 0x4647f5
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
add esp, 4
call 0x4647f5
add byte [esi + 0x49], cl
cmp al, 0x36
cmp byte [eax + 0x46], dl
cmp eax, dword [ebp + 0x36]
add esp, 4
pop ebx
mov dword [ebp - 0x738], 0
jmp 0x464ef2