joyce8/EMBER2024-capa huggingface dataset:
Function at 0x447769
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp byte [eax + 0x3b], dl
inc ecx
inc eax
dec edx
push eax
and eax, 0x1bd8
pop eax
mov eax, dword [ebp - 0x4d0]
sub eax, dword [ebp - 0x3c0]
cmp eax, 0xffffffff
jb 0x447780
push ecx
call 0x447759
add byte [0x374d444d], bh
cmp eax, 0x834b3c3a
les eax, [eax + ebp*8]
or byte [eax], al
add byte [eax], al
add byte [0x35353432], bh
dec edi
cmp eax, 0x8104c483
loope 0x447719
sbb al, byte [ecx]
add byte [ecx + 0x51], bl
sub ecx, 0xd95f
pop ecx
jmp 0x4479ae
mov dword [ebp - 0xc10], 7
mov ecx, dword [ebp - 0x4d0]
mov dword [ebp - 0xa60], ecx
push esi
push esi
add esp, 4
call 0x4477aa
add byte [edi], dh
dec ebp
push eax
xor al, 0x34
cmp cl, byte [eax + 0x4d]
add esp, 4
xor esi, 0x58eb
jmp 0x4477b9
or esi, 0x461c
pop esi
push edx
jmp 0x4477c7
pop edx
mov edx, dword [ebp - 0x14c8]
mov dword [ebp - 0x9f0], edx
mov dword [ebp - 0xc14], 0
mov eax, dword [ebp - 0x4d0]
cmp eax, dword [ebp - 0x14c8]
jne 0x44782f
push eax
push ebx
add esp, 4
sub eax, 0x13b75
add eax, 0x2138
sub eax, 0x11f3c
or eax, 0xb659
pop eax
push edx
and edx, 0x124b7
xor edx, 0x9e15
sub edx, 0x5d2a
pop edx
mov ecx, dword [ebp - 0xc14]
mov dword [ebp - 0x14d0], ecx
jmp fcn.00447960

Function at 0x447870
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp dword [ebp - 0xc10], 0
jle 0x447954
push esi
push edi
add esp, 4
sub esi, 0x13940
add esi, 0xc9db
pop esi
push esi
add esi, 0x86f2
jmp 0x44785e
call 0x44786a
add byte [eax + 0x45], dl
dec ebx
push eax
dec ecx
aas
add esp, 4
pop esi
mov edx, dword [ebp - 0xa60]
mov al, byte [0xffffff5]
mov dh, 2
mov ecx, dword [ebp - 0x9f0]
movzx edx, byte [ecx]
cmp eax, edx
je 0x4478f0
push ebx
push ebx
add esp, 4
call 0x447897
add byte [edx + 0x36], cl
cmp eax, 0x3f493d4b
dec esi
add esp, 4
jmp 0x44789f
xor ebx, 0x10e2c
pop ebx
push edx
and edx, 0x6f27
pop edx
push eax
sub eax, 0xd01b
pop eax
mov eax, dword [ebp - 0xa60]
movzx ecx, byte [eax]
invalid

Function at 0x447880
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp dword [ebp - 0xc10], 0
jle 0x447954
push esi
push edi
add esp, 4
sub esi, 0x13940
add esi, 0xc9db
pop esi
push esi
add esi, 0x86f2
jmp 0x44785e
call 0x44786a
add byte [eax + 0x45], dl
dec ebx
push eax
dec ecx
aas
add esp, 4
pop esi
mov edx, dword [ebp - 0xa60]
mov al, byte [0xffffff5]
mov dh, 2
mov ecx, dword [ebp - 0x9f0]
movzx edx, byte [ecx]
cmp eax, edx
je 0x4478f0
push ebx
push ebx
add esp, 4
call 0x447897
add byte [edx + 0x36], cl
cmp eax, 0x3f493d4b
dec esi
add esp, 4
jmp 0x44789f
xor ebx, 0x10e2c
pop ebx
push edx
and edx, 0x6f27
pop edx
push eax
sub eax, 0xd01b
pop eax
mov eax, dword [ebp - 0xa60]
movzx ecx, byte [eax]
invalid
Function at 0x4478a0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp dword [ebp - 0xc10], 0
jle 0x447954
push esi
push edi
add esp, 4
sub esi, 0x13940
add esi, 0xc9db
pop esi
push esi
add esi, 0x86f2
jmp 0x44785e
call 0x44786a
add byte [eax + 0x45], dl
dec ebx
push eax
dec ecx
aas
add esp, 4
pop esi
mov edx, dword [ebp - 0xa60]
mov al, byte [0xffffff5]
mov dh, 2
mov ecx, dword [ebp - 0x9f0]
movzx edx, byte [ecx]
cmp eax, edx
je 0x4478f0
push ebx
push ebx
add esp, 4
call 0x447897
add byte [edx + 0x36], cl
cmp eax, 0x3f493d4b
dec esi
add esp, 4
jmp 0x44789f
xor ebx, 0x10e2c
pop ebx
push edx
and edx, 0x6f27
pop edx
push eax
sub eax, 0xd01b
pop eax
mov eax, dword [ebp - 0xa60]
movzx ecx, byte [eax]
invalid

Function at 0x447900
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
dec ebp
add byte [eax], al
sub edi, 0x135dd
pop edi
push esi
push esi
add esp, 4
and esi, 0x7a86
out 0x86, al
jp 0x447914
add byte [ecx + 0x11f92ce], al
add byte [ecx + 0xa6a9e6], al
add byte [esi - 0x75], bl
xchg ebp, eax
invalid
invalid
invalid
inc dword [ebx - 0x6a76fe16]
invalid
invalid
invalid
dec dword [ebx - 0xa5f7b]
inc dword [ebx - 0x7a76fe40]
mov al, byte [0x8bfffff5]
lea edx, [eax]
idiv bh
inc dword [ebx - 0x7276fe3f]
adc dh, dh
invalid
invalid
jmp 0x44782f
invalid
invalid
invalid

Function at 0x447910
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
out 0x86, al
jp 0x447914
add byte [ecx + 0x11f92ce], al
add byte [ecx + 0xa6a9e6], al
add byte [esi - 0x75], bl
xchg ebp, eax
invalid

Function at 0x447960
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
dec dword [ebx - 0xc136b]
dec dword [ecx - 0x14cf6b]
inc dword [ebx - 0x14cf43]
cmp dword [ebp - 0x14d0], 0

Function at 0x447997
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or edi, 0x15e4
sub edi, 0x144fb
call 0x447997
add byte [edi], dh
inc esp
dec ecx
cmp al, 0x50
inc edi
inc ebx
cmp eax, dword [ebx - 0x74a0fb3c]
test dword [eax], esi
sti
invalid
Function at 0x4479be
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x4479ca
or edx, 0x17077
pop edx
push edi
push eax
add esp, 4
jmp 0x4479df
pop edi
mov dword [ebp - 0xa5c], 0
push ecx
sub ecx, 0x4383
call 0x4479ff
add byte [eax + 0x35], cl
dec esi
xor eax, 0x3b393b3f
add esp, 4
add ecx, 0xf8a1
pop ecx
push edx
jmp 0x447a0f
and edx, 0x6ff0
xor edx, 0x12ade
pop edx
mov byte [ebp - 0x804], 0x45
mov byte [ebp - 0x803], 0x78
mov byte [ebp - 0x802], 0x69
mov byte [ebp - 0x801], 0x74
mov byte [ebp - 0x800], 0x50
mov byte [ebp - 0x7ff], 0x72
mov byte [ebp - 0x7fe], 0x6f
mov byte [ebp - 0x7fd], 0x63
mov byte [ebp - 0x7fc], 0x65
mov byte [ebp - 0x7fb], 0x73
mov byte [ebp - 0x7fa], 0x73
mov byte [ebp - 0x7f9], 0
push edx
push edx
add esp, 4
add edx, 0x7e35
sub edx, 0x6f6f
add byte [ecx + 0x15e68ca], al
add byte [ecx + 0xbe58e2], al
add byte [edx + 0x52], bl
or edx, 0x65d
sub edx, 0xe0
or edx, 0x166ef
pop edx
mov ecx, 0x6b
mov word [ebp - 0x1628], cx
mov edx, 0x65
mov word [ebp - 0x1626], dx
mov eax, 0x72
mov word [ebp - 0x1624], ax
mov ecx, 0x6e
mov word [ebp - 0x1622], cx
mov edx, 0x65
mov word [ebp - 0x1620], dx
mov eax, 0x6c
mov word [ebp - 0x161e], ax
mov ecx, 0x33
mov word [ebp - 0x161c], cx
mov edx, 0x32
mov word [ebp - 0x161a], dx
mov eax, 0x2e
mov word [ebp - 0x1618], ax
invalid
invalid

Function at 0x4479ff
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x4479ca
or edx, 0x17077
pop edx
push edi
push eax
add esp, 4
jmp 0x4479df
pop edi
mov dword [ebp - 0xa5c], 0
push ecx
sub ecx, 0x4383
call 0x4479ff
add byte [eax + 0x35], cl
dec esi
xor eax, 0x3b393b3f
add esp, 4
add ecx, 0xf8a1
pop ecx
push edx
jmp 0x447a0f
and edx, 0x6ff0
xor edx, 0x12ade
pop edx
mov byte [ebp - 0x804], 0x45
mov byte [ebp - 0x803], 0x78
mov byte [ebp - 0x802], 0x69
mov byte [ebp - 0x801], 0x74
mov byte [ebp - 0x800], 0x50
mov byte [ebp - 0x7ff], 0x72
mov byte [ebp - 0x7fe], 0x6f
mov byte [ebp - 0x7fd], 0x63
mov byte [ebp - 0x7fc], 0x65
mov byte [ebp - 0x7fb], 0x73
mov byte [ebp - 0x7fa], 0x73
mov byte [ebp - 0x7f9], 0
push edx
push edx
add esp, 4
add edx, 0x7e35
sub edx, 0x6f6f
add byte [ecx + 0x15e68ca], al
add byte [ecx + 0xbe58e2], al
add byte [edx + 0x52], bl
or edx, 0x65d
sub edx, 0xe0
or edx, 0x166ef
pop edx
mov ecx, 0x6b
mov word [ebp - 0x1628], cx
mov edx, 0x65
mov word [ebp - 0x1626], dx
mov eax, 0x72
mov word [ebp - 0x1624], ax
mov ecx, 0x6e
mov word [ebp - 0x1622], cx
mov edx, 0x65
mov word [ebp - 0x1620], dx
mov eax, 0x6c
mov word [ebp - 0x161e], ax
mov ecx, 0x33
mov word [ebp - 0x161c], cx
mov edx, 0x32
mov word [ebp - 0x161a], dx
mov eax, 0x2e
mov word [ebp - 0x1618], ax
invalid
invalid
Function at 0x447c90
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
xor edi, dword [ecx*2 - 0x7efb3b7d]
call fcn.0044ed0c
pop eax
push ebx
sub ebx, 0x2402
add ebx, 0x3d0c
pop ebx
lea ecx, [ebp - 0x1628]
mov dword [ebp - 0xc1c], ecx
mov edx, dword [ebp - 0x4d4]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xc18], eax
xor ecx, ecx
mov word [ebp - 0x1f8], cx
xor edx, edx
shl byte [esi - 0x77], cl
xchg ebp, eax
add bh, bh
invalid
invalid
push esi
add esi, 0xb5d5
or esi, 0x25b6
into
mov dh, 0x25
add byte [eax], al
and esi, 0x3ff1
pop esi
push esi
push eax
add esp, 4
call 0x447d00
add byte [ecx + 0x49], al
dec ecx
cmp dword [ebp + 0x3e], ecx
cmp ecx, dword [ebp - 0x7d]
les eax, [ecx + eax*4]
out dx, al
test al, 0xb
add dword [eax], eax
pop esi
mov eax, dword [ebp - 0xc18]
mov cx, word [eax]
mov word [ebp - 0xf7e], cx
mov edx, dword [ebp - 0xc18]
add edx, 2
mov dword [ebp - 0xc18], edx
mov ax, word [ebp - 0xf7e]
mov word [ebp - 0x1f8], ax
mov ecx, dword [ebp - 0xc1c]
mov dx, word [ecx]
mov word [ebp - 0xf80], dx
mov eax, dword [ebp - 0xc1c]
add eax, 2
mov dword [ebp - 0xc1c], eax
mov cx, word [ebp - 0xf80]
mov word [ebp - 0x100], cx
add bh, bh
invalid
call dword [edx - 0x7f]
test al, 0x67
add dword [eax], eax
jmp 0x447d71
xor edx, 0x140c7
pop edx
push edx
push ebx
add esp, 4
add edx, 0x10788
xor edx, 0xdad1
pop edx
push edx
push eax
add esp, 4
xor edx, 0x16ee1
pop edx
movzx edx, word [ebp - 0x100]
test edx, edx
jne 0x447db9
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
sub eax, ecx
mov dword [ebp - 0x1498], eax
jmp 0x447e1c
movzx edx, word [ebp - 0x1f8]
movzx eax, word [ebp - 0x100]
cmp edx, eax
je 0x447cd8
movzx ecx, word [ebp - 0x1f8]
xor ecx, 0x20
movzx edx, word [ebp - 0x100]
cmp ecx, edx
je 0x447cd8
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
cmp eax, ecx
jge 0x447e06
mov dword [ebp - 0x14d8], 0xffffffff
jmp 0x447e10
mov dword [ebp - 0x14d8], 1
mov edx, dword [ebp - 0x14d8]
mov dword [ebp - 0x1498], edx
cmp dword [ebp - 0x1498], 0
jne 0x447e65
push eax
push esi
add esp, 4
sub eax, 0x41a2
pop eax
push edx
or edx, 0x7dbb
add edx, 0x13d49
call 0x447e4d
add byte [eax + 0x38], dl
cmp cl, byte [eax + 0x4c]
dec esp
xor eax, 0xc4834c4b
add al, 0x81
ljmp 0x8b5a
push edx
push ebx
add esp, 4
or edx, 0x1097
pop edx
push ecx
push esi
add esp, 4
add ecx, 0x1588c
jmp 0x447e84
call 0x447e93
add byte [ecx + 0x4c], al
aas
xor eax, dword [ecx + 0x3c]
inc ecx
inc ebx
cmp byte [ebx - 0x74a6fb3c], al
lea ebp, [ebx + edi*8]
invalid
Function at 0x447c93
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
xor edi, dword [ecx*2 - 0x7efb3b7d]
call fcn.0044ed0c
pop eax
push ebx
sub ebx, 0x2402
add ebx, 0x3d0c
pop ebx
lea ecx, [ebp - 0x1628]
mov dword [ebp - 0xc1c], ecx
mov edx, dword [ebp - 0x4d4]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xc18], eax
xor ecx, ecx
mov word [ebp - 0x1f8], cx
xor edx, edx
shl byte [esi - 0x77], cl
xchg ebp, eax
add bh, bh
invalid
invalid
push esi
add esi, 0xb5d5
or esi, 0x25b6
into
mov dh, 0x25
add byte [eax], al
and esi, 0x3ff1
pop esi
push esi
push eax
add esp, 4
call 0x447d00
add byte [ecx + 0x49], al
dec ecx
cmp dword [ebp + 0x3e], ecx
cmp ecx, dword [ebp - 0x7d]
les eax, [ecx + eax*4]
out dx, al
test al, 0xb
add dword [eax], eax
pop esi
mov eax, dword [ebp - 0xc18]
mov cx, word [eax]
mov word [ebp - 0xf7e], cx
mov edx, dword [ebp - 0xc18]
add edx, 2
mov dword [ebp - 0xc18], edx
mov ax, word [ebp - 0xf7e]
mov word [ebp - 0x1f8], ax
mov ecx, dword [ebp - 0xc1c]
mov dx, word [ecx]
mov word [ebp - 0xf80], dx
mov eax, dword [ebp - 0xc1c]
add eax, 2
mov dword [ebp - 0xc1c], eax
mov cx, word [ebp - 0xf80]
mov word [ebp - 0x100], cx
add bh, bh
invalid
call dword [edx - 0x7f]
test al, 0x67
add dword [eax], eax
jmp 0x447d71
xor edx, 0x140c7
pop edx
push edx
push ebx
add esp, 4
add edx, 0x10788
xor edx, 0xdad1
pop edx
push edx
push eax
add esp, 4
xor edx, 0x16ee1
pop edx
movzx edx, word [ebp - 0x100]
test edx, edx
jne 0x447db9
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
sub eax, ecx
mov dword [ebp - 0x1498], eax
jmp 0x447e1c
movzx edx, word [ebp - 0x1f8]
movzx eax, word [ebp - 0x100]
cmp edx, eax
je 0x447cd8
movzx ecx, word [ebp - 0x1f8]
xor ecx, 0x20
movzx edx, word [ebp - 0x100]
cmp ecx, edx
je 0x447cd8
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
cmp eax, ecx
jge 0x447e06
mov dword [ebp - 0x14d8], 0xffffffff
jmp 0x447e10
mov dword [ebp - 0x14d8], 1
mov edx, dword [ebp - 0x14d8]
mov dword [ebp - 0x1498], edx
cmp dword [ebp - 0x1498], 0
jne 0x447e65
push eax
push esi
add esp, 4
sub eax, 0x41a2
pop eax
push edx
or edx, 0x7dbb
add edx, 0x13d49
call 0x447e4d
add byte [eax + 0x38], dl
cmp cl, byte [eax + 0x4c]
dec esp
xor eax, 0xc4834c4b
add al, 0x81
ljmp 0x8b5a
push edx
push ebx
add esp, 4
or edx, 0x1097
pop edx
push ecx
push esi
add esp, 4
add ecx, 0x1588c
jmp 0x447e84
call 0x447e93
add byte [ecx + 0x4c], al
aas
xor eax, dword [ecx + 0x3c]
inc ecx
inc ebx
cmp byte [ebx - 0x74a6fb3c], al
lea ebp, [ebx + edi*8]
invalid
Function at 0x447d00
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
xor edi, dword [ecx*2 - 0x7efb3b7d]
call fcn.0044ed0c
pop eax
push ebx
sub ebx, 0x2402
add ebx, 0x3d0c
pop ebx
lea ecx, [ebp - 0x1628]
mov dword [ebp - 0xc1c], ecx
mov edx, dword [ebp - 0x4d4]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xc18], eax
xor ecx, ecx
mov word [ebp - 0x1f8], cx
xor edx, edx
shl byte [esi - 0x77], cl
xchg ebp, eax
add bh, bh
invalid
invalid
push esi
add esi, 0xb5d5
or esi, 0x25b6
into
mov dh, 0x25
add byte [eax], al
and esi, 0x3ff1
pop esi
push esi
push eax
add esp, 4
call 0x447d00
add byte [ecx + 0x49], al
dec ecx
cmp dword [ebp + 0x3e], ecx
cmp ecx, dword [ebp - 0x7d]
les eax, [ecx + eax*4]
out dx, al
test al, 0xb
add dword [eax], eax
pop esi
mov eax, dword [ebp - 0xc18]
mov cx, word [eax]
mov word [ebp - 0xf7e], cx
mov edx, dword [ebp - 0xc18]
add edx, 2
mov dword [ebp - 0xc18], edx
mov ax, word [ebp - 0xf7e]
mov word [ebp - 0x1f8], ax
mov ecx, dword [ebp - 0xc1c]
mov dx, word [ecx]
mov word [ebp - 0xf80], dx
mov eax, dword [ebp - 0xc1c]
add eax, 2
mov dword [ebp - 0xc1c], eax
mov cx, word [ebp - 0xf80]
mov word [ebp - 0x100], cx
add bh, bh
invalid
call dword [edx - 0x7f]
test al, 0x67
add dword [eax], eax
jmp 0x447d71
xor edx, 0x140c7
pop edx
push edx
push ebx
add esp, 4
add edx, 0x10788
xor edx, 0xdad1
pop edx
push edx
push eax
add esp, 4
xor edx, 0x16ee1
pop edx
movzx edx, word [ebp - 0x100]
test edx, edx
jne 0x447db9
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
sub eax, ecx
mov dword [ebp - 0x1498], eax
jmp 0x447e1c
movzx edx, word [ebp - 0x1f8]
movzx eax, word [ebp - 0x100]
cmp edx, eax
je 0x447cd8
movzx ecx, word [ebp - 0x1f8]
xor ecx, 0x20
movzx edx, word [ebp - 0x100]
cmp ecx, edx
je 0x447cd8
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
cmp eax, ecx
jge 0x447e06
mov dword [ebp - 0x14d8], 0xffffffff
jmp 0x447e10
mov dword [ebp - 0x14d8], 1
mov edx, dword [ebp - 0x14d8]
mov dword [ebp - 0x1498], edx
cmp dword [ebp - 0x1498], 0
jne 0x447e65
push eax
push esi
add esp, 4
sub eax, 0x41a2
pop eax
push edx
or edx, 0x7dbb
add edx, 0x13d49
call 0x447e4d
add byte [eax + 0x38], dl
cmp cl, byte [eax + 0x4c]
dec esp
xor eax, 0xc4834c4b
add al, 0x81
ljmp 0x8b5a
push edx
push ebx
add esp, 4
or edx, 0x1097
pop edx
push ecx
push esi
add esp, 4
add ecx, 0x1588c
jmp 0x447e84
call 0x447e93
add byte [ecx + 0x4c], al
aas
xor eax, dword [ecx + 0x3c]
inc ecx
inc ebx
cmp byte [ebx - 0x74a6fb3c], al
lea ebp, [ebx + edi*8]
invalid
Function at 0x447e4d
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
xor edi, dword [ecx*2 - 0x7efb3b7d]
call fcn.0044ed0c
pop eax
push ebx
sub ebx, 0x2402
add ebx, 0x3d0c
pop ebx
lea ecx, [ebp - 0x1628]
mov dword [ebp - 0xc1c], ecx
mov edx, dword [ebp - 0x4d4]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xc18], eax
xor ecx, ecx
mov word [ebp - 0x1f8], cx
xor edx, edx
shl byte [esi - 0x77], cl
xchg ebp, eax
add bh, bh
invalid
invalid
push esi
add esi, 0xb5d5
or esi, 0x25b6
into
mov dh, 0x25
add byte [eax], al
and esi, 0x3ff1
pop esi
push esi
push eax
add esp, 4
call 0x447d00
add byte [ecx + 0x49], al
dec ecx
cmp dword [ebp + 0x3e], ecx
cmp ecx, dword [ebp - 0x7d]
les eax, [ecx + eax*4]
out dx, al
test al, 0xb
add dword [eax], eax
pop esi
mov eax, dword [ebp - 0xc18]
mov cx, word [eax]
mov word [ebp - 0xf7e], cx
mov edx, dword [ebp - 0xc18]
add edx, 2
mov dword [ebp - 0xc18], edx
mov ax, word [ebp - 0xf7e]
mov word [ebp - 0x1f8], ax
mov ecx, dword [ebp - 0xc1c]
mov dx, word [ecx]
mov word [ebp - 0xf80], dx
mov eax, dword [ebp - 0xc1c]
add eax, 2
mov dword [ebp - 0xc1c], eax
mov cx, word [ebp - 0xf80]
mov word [ebp - 0x100], cx
add bh, bh
invalid
call dword [edx - 0x7f]
test al, 0x67
add dword [eax], eax
jmp 0x447d71
xor edx, 0x140c7
pop edx
push edx
push ebx
add esp, 4
add edx, 0x10788
xor edx, 0xdad1
pop edx
push edx
push eax
add esp, 4
xor edx, 0x16ee1
pop edx
movzx edx, word [ebp - 0x100]
test edx, edx
jne 0x447db9
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
sub eax, ecx
mov dword [ebp - 0x1498], eax
jmp 0x447e1c
movzx edx, word [ebp - 0x1f8]
movzx eax, word [ebp - 0x100]
cmp edx, eax
je 0x447cd8
movzx ecx, word [ebp - 0x1f8]
xor ecx, 0x20
movzx edx, word [ebp - 0x100]
cmp ecx, edx
je 0x447cd8
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
cmp eax, ecx
jge 0x447e06
mov dword [ebp - 0x14d8], 0xffffffff
jmp 0x447e10
mov dword [ebp - 0x14d8], 1
mov edx, dword [ebp - 0x14d8]
mov dword [ebp - 0x1498], edx
cmp dword [ebp - 0x1498], 0
jne 0x447e65
push eax
push esi
add esp, 4
sub eax, 0x41a2
pop eax
push edx
or edx, 0x7dbb
add edx, 0x13d49
call 0x447e4d
add byte [eax + 0x38], dl
cmp cl, byte [eax + 0x4c]
dec esp
xor eax, 0xc4834c4b
add al, 0x81
ljmp 0x8b5a
push edx
push ebx
add esp, 4
or edx, 0x1097
pop edx
push ecx
push esi
add esp, 4
add ecx, 0x1588c
jmp 0x447e84
call 0x447e93
add byte [ecx + 0x4c], al
aas
xor eax, dword [ecx + 0x3c]
inc ecx
inc ebx
cmp byte [ebx - 0x74a6fb3c], al
lea ebp, [ebx + edi*8]
invalid
Function at 0x447e93
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
xor edi, dword [ecx*2 - 0x7efb3b7d]
call fcn.0044ed0c
pop eax
push ebx
sub ebx, 0x2402
add ebx, 0x3d0c
pop ebx
lea ecx, [ebp - 0x1628]
mov dword [ebp - 0xc1c], ecx
mov edx, dword [ebp - 0x4d4]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xc18], eax
xor ecx, ecx
mov word [ebp - 0x1f8], cx
xor edx, edx
shl byte [esi - 0x77], cl
xchg ebp, eax
add bh, bh
invalid
invalid
push esi
add esi, 0xb5d5
or esi, 0x25b6
into
mov dh, 0x25
add byte [eax], al
and esi, 0x3ff1
pop esi
push esi
push eax
add esp, 4
call 0x447d00
add byte [ecx + 0x49], al
dec ecx
cmp dword [ebp + 0x3e], ecx
cmp ecx, dword [ebp - 0x7d]
les eax, [ecx + eax*4]
out dx, al
test al, 0xb
add dword [eax], eax
pop esi
mov eax, dword [ebp - 0xc18]
mov cx, word [eax]
mov word [ebp - 0xf7e], cx
mov edx, dword [ebp - 0xc18]
add edx, 2
mov dword [ebp - 0xc18], edx
mov ax, word [ebp - 0xf7e]
mov word [ebp - 0x1f8], ax
mov ecx, dword [ebp - 0xc1c]
mov dx, word [ecx]
mov word [ebp - 0xf80], dx
mov eax, dword [ebp - 0xc1c]
add eax, 2
mov dword [ebp - 0xc1c], eax
mov cx, word [ebp - 0xf80]
mov word [ebp - 0x100], cx
add bh, bh
invalid
call dword [edx - 0x7f]
test al, 0x67
add dword [eax], eax
jmp 0x447d71
xor edx, 0x140c7
pop edx
push edx
push ebx
add esp, 4
add edx, 0x10788
xor edx, 0xdad1
pop edx
push edx
push eax
add esp, 4
xor edx, 0x16ee1
pop edx
movzx edx, word [ebp - 0x100]
test edx, edx
jne 0x447db9
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
sub eax, ecx
mov dword [ebp - 0x1498], eax
jmp 0x447e1c
movzx edx, word [ebp - 0x1f8]
movzx eax, word [ebp - 0x100]
cmp edx, eax
je 0x447cd8
movzx ecx, word [ebp - 0x1f8]
xor ecx, 0x20
movzx edx, word [ebp - 0x100]
cmp ecx, edx
je 0x447cd8
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
cmp eax, ecx
jge 0x447e06
mov dword [ebp - 0x14d8], 0xffffffff
jmp 0x447e10
mov dword [ebp - 0x14d8], 1
mov edx, dword [ebp - 0x14d8]
mov dword [ebp - 0x1498], edx
cmp dword [ebp - 0x1498], 0
jne 0x447e65
push eax
push esi
add esp, 4
sub eax, 0x41a2
pop eax
push edx
or edx, 0x7dbb
add edx, 0x13d49
call 0x447e4d
add byte [eax + 0x38], dl
cmp cl, byte [eax + 0x4c]
dec esp
xor eax, 0xc4834c4b
add al, 0x81
ljmp 0x8b5a
push edx
push ebx
add esp, 4
or edx, 0x1097
pop edx
push ecx
push esi
add esp, 4
add ecx, 0x1588c
jmp 0x447e84
call 0x447e93
add byte [ecx + 0x4c], al
aas
xor eax, dword [ecx + 0x3c]
inc ecx
inc ebx
cmp byte [ebx - 0x74a6fb3c], al
lea ebp, [ebx + edi*8]
invalid

Function at 0x448932
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ecx
call fcn.00448932
add byte [ecx + 0x44], al
inc edi
dec ecx
cmp byte [edi + edi], bh
cmp eax, dword [ebx + 0x505904c4]
add esp, 4
pop ecx
push eax
add esp, 4
pop ecx
push eax
xor eax, 0x2dc4
sub eax, 0x37b4
call 0x448951
add byte [ebx + edi + 0x49], cl
dec eax
cmp dword [esi], edi
dec esi
add esp, 4
pop eax
lea edx, [ebp - 0x1628]
mov dword [ebp - 0xc38], edx
mov eax, dword [ebp - 0x4dc]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc34], ecx
xor edx, edx
mov word [ebp - 0x200], dx
xor eax, eax
mov word [ebp - 0x34], ax
Function at 0x448951
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ecx
call fcn.00448932
add byte [ecx + 0x44], al
inc edi
dec ecx
cmp byte [edi + edi], bh
cmp eax, dword [ebx + 0x505904c4]
add esp, 4
pop ecx
push eax
add esp, 4
pop ecx
push eax
xor eax, 0x2dc4
sub eax, 0x37b4
call 0x448951
add byte [ebx + edi + 0x49], cl
dec eax
cmp dword [esi], edi
dec esi
add esp, 4
pop eax
lea edx, [ebp - 0x1628]
mov dword [ebp - 0xc38], edx
mov eax, dword [ebp - 0x4dc]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc34], ecx
xor edx, edx
mov word [ebp - 0x200], dx
xor eax, eax
mov word [ebp - 0x34], ax

Function at 0x448990
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ecx
push edi
add esp, 4
add ecx, 0x13660
xor ecx, 0x12bc3
xor ecx, 0x12992
pop ecx
push esi
and esi, 0xd96
and esi, 0x13646
or esi, 0x22b2
xor esi, 0x7cdd
pop esi
mov ecx, dword [ebp - 0xc34]
mov dx, word [ecx]
mov word [ebp - 0xf86], dx
mov eax, dword [ebp - 0xc34]
add eax, 2
mov dword [ebp - 0xc34], eax
mov cx, word [ebp - 0xf86]
mov word [ebp - 0x200], cx
mov edx, dword [ebp - 0xc38]
mov ax, word [edx]
mov word [ebp - 0xf88], ax
mov ecx, dword [ebp - 0xc38]
add ecx, 2
mov dword [ebp - 0xc38], ecx
mov dx, word [ebp - 0xf88]
mov word [ebp - 0x34], dx
push eax
push eax
add esp, 4
sub eax, 0x3df1
and eax, 0x109e4
call 0x448a28
add byte [ecx + 0x3e], al
dec eax
cmp al, byte [ecx + 0x47]
inc edi
dec esp
dec esi
add esp, 4
pop eax
push esi
xor esi, 0x8d17
or esi, 0x2251
pop esi
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x448a57
movzx ecx, word [ebp - 0x200]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x14fc], ecx
jmp 0x448ab1
movzx eax, word [ebp - 0x200]
invalid
invalid

Function at 0x448a28
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ecx
push edi
add esp, 4
add ecx, 0x13660
xor ecx, 0x12bc3
xor ecx, 0x12992
pop ecx
push esi
and esi, 0xd96
and esi, 0x13646
or esi, 0x22b2
xor esi, 0x7cdd
pop esi
mov ecx, dword [ebp - 0xc34]
mov dx, word [ecx]
mov word [ebp - 0xf86], dx
mov eax, dword [ebp - 0xc34]
add eax, 2
mov dword [ebp - 0xc34], eax
mov cx, word [ebp - 0xf86]
mov word [ebp - 0x200], cx
mov edx, dword [ebp - 0xc38]
mov ax, word [edx]
mov word [ebp - 0xf88], ax
mov ecx, dword [ebp - 0xc38]
add ecx, 2
mov dword [ebp - 0xc38], ecx
mov dx, word [ebp - 0xf88]
mov word [ebp - 0x34], dx
push eax
push eax
add esp, 4
sub eax, 0x3df1
and eax, 0x109e4
call 0x448a28
add byte [ecx + 0x3e], al
dec eax
cmp al, byte [ecx + 0x47]
inc edi
dec esp
dec esi
add esp, 4
pop eax
push esi
xor esi, 0x8d17
or esi, 0x2251
pop esi
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x448a57
movzx ecx, word [ebp - 0x200]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x14fc], ecx
jmp 0x448ab1
movzx eax, word [ebp - 0x200]
invalid
invalid

Function at 0x448c10
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
inc dword [ebx]
push ecx
cmp al, 0x89
xchg ebp, eax
cld
ljmp 0x858b