joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000319d
Capabilities:
Get common file path

Disassembly:
push 0x14
mov eax, 0x1001843d
call fcn.10005580
mov esi, dword [ebp + 8]
xor eax, eax
xor edi, edi
xor ebx, ebx
mov word [esi], ax
mov dword [ebp - 4], edi
call fcn.10018137
test eax, eax
je 0x100031c8
call fcn.1000318e
mov ebx, eax
push 0x104
push esi
push ebx
push edi
push 0x1001a0a8
call dword [sym.imp.SHELL32.dll_SHGetFolderPathEx]
mov esi, eax
cmp esi, edi
jge 0x10003223
push esi
push str.Error:_08x_in_SHGetFolderPathEx_FOLDERID_LocalAppDataLow__0__hToken__pPath__MAX_PATH_
call fcn.10003e12
pop ecx
pop ecx
push edi
push esi
call fcn.10018137
mov ecx, dword [ebp - 0x18]
mov esi, dword [ecx + 4]
mov dword [ebp - 0x14], esi
call fcn.10003873
push eax
push esi
push 0x10019474
call fcn.10003e12
or dword [ebp - 4], 0xffffffff
add esp, 0xc
mov eax, 0x1000321c
ret
cmp ebx, edi
je 0x1000322e
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
cmp esi, edi
jge 0x100032df
push dword [ebp + 8]
mov dword [ebp - 4], 2
push edi
push edi
push 0x1a
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
cmp esi, edi
jge 0x1000328b
push esi
push str.Error:_08x_in_SHGetFolderPathW_NULL__CSIDL_APPDATA__NULL__0__pPath_
jmp 0x100031e7
or dword [ebp - 4], 0xffffffff
cmp esi, edi
jge 0x100032df
push 1
push 0x1a
push dword [ebp + 8]
mov dword [ebp - 4], 4
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, eax
cmp esi, edi
jge 0x100032df
push esi
push str.Error:_08x_in_SHGetSpecialFolderPathW_NULL__pPath__CSIDL_APPDATA__TRUE_
jmp 0x100031e7
mov eax, esi
call fcn.100055b6
ret

Function at 0x10003623
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x1001e08c]
xor eax, ebp
mov dword [ebp + 0x9c], eax
mov eax, dword [ebp + 0xa8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
call fcn.10018137
mov ebx, eax
cmp ebx, esi
je 0x10003696
lea ecx, [ebp - 0x74]
call fcn.10001115
mov eax, ebx
mov ecx, dword [ebp + 0x9c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10004d10
add ebp, 0xa0
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x100036ae
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x74]
call fcn.10003623
cmp eax, esi
jne 0x100036e0
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x64]
push eax
push esi
push dword [ebp - 0x74]
mov dword [ebp - 0x68], 0x100
call ebx
test eax, eax
je 0x1000369e
lea ecx, [ebp - 0x74]
call fcn.10001115
push dword [ebp - 0x78]
mov ecx, edi
call fcn.100010a6
lea ecx, [ebp - 0x74]
mov esi, eax
call fcn.10001115
mov eax, esi
jmp 0x1000367c

Function at 0x10004d10
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1001e08c]
jne 0x10004d1a
repz ret
jmp fcn.1000a8a3
Function at 0x10018137
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x10018146
pop dword [ebp - 0x38]
mov eax, 0x10018146
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x80a00b62
sub dword [ebp - 0x48], 0x324dc617
mov dword [ebp - 0x44], 0xe7637aff
add dword [ebp - 0x44], 0x4acfd146
mov dword [ebp - 0x40], 0x1f7849c1
add dword [ebp - 0x40], 0x2cd3fa6d
mov dword [ebp - 0x3c], 0x657cde3
add dword [ebp - 0x3c], 0xf9a8321d
lea eax, [ebp - 0x48]
push eax
mov eax, 0x1caf9179
sub eax, 0xcae0161
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x8e861d21
add dword [ebp - 0x48], 0xe5ec4c35
mov dword [ebp - 0x44], 0xe7c0d77d
add dword [ebp - 0x44], 0x59ab89f8
mov dword [ebp - 0x40], 0x7ab0e4af
add dword [ebp - 0x40], 0xe8be87bd
mov dword [ebp - 0x3c], 0x7297096
sub dword [ebp - 0x3c], 0x7297096
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0xc7c50772
add eax, 0x483c88a2
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x3dbb4
push 0
call eax
mov ecx, 0x514f
mov edi, eax
mov ebx, 0x6a74f8cf
add ebx, 0xa58dc531
add ebx, dword [ebp - 0x38]
mov esi, 0x1bc92b8d
sub dword [ebp - 0x2c], 0x52b673fd
mov edx, dword [ebx]
sub dword [ebp - 0x34], 0x43e5d525
xor edx, esi
add dword [ebp - 0x34], 0xd5431f57
mov dword [edi], edx
xor dword [ebp - 4], edx
add edi, 0xf147c270
sub edi, 0xf147c26c
add ebx, 0x2941d69b
add ebx, 0xd6be2969
loop 0x10018257
add eax, 0x769b94bb
sub eax, 0x769a5cac
xor ebx, ebx
add ebx, eax
add eax, 0x2769e829
add eax, 0xd89617dc
mov ecx, 0x6f232f92
sub ecx, 0x5f232f92
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x4014f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 0x800
mov dword [ebp - 0x234], ebx
call dword [sym.imp.KERNEL32.dll_SetDefaultDllDirectories]
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004029f0
mov edi, dword [ebp + 8]
mov esi, 1
add esp, 0xc
cmp edi, esi
jle 0x40157c
nop dword [eax]
mov ecx, dword [ebx + esi*4]
mov eax, 0x41d070
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x40156e
test dx, dx
je 0x40156a
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x40156e
add ecx, 4
add eax, 4
test dx, dx
jne 0x401548
xor eax, eax
jmp 0x401573
sbb eax, eax
or eax, 1
test eax, eax
je 0x40157c
inc esi
cmp esi, edi
jl 0x401540
xor bl, bl
cmp esi, edi
jne 0x401617
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0
push 0
call esi
cmp eax, 0x104
jae 0x401601
lea eax, [ebp - 0x20c]
push eax
push 0x104
call esi
dec edi
xor ecx, ecx
mov edx, 4
lea eax, [edi + 2]
mov dword [ebp - 0x238], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00405347
mov esi, eax
add esp, 4
test esi, esi
je 0x401601
xor ecx, ecx
mov bl, 1
test edi, edi
jle 0x4015ee
mov edx, dword [ebp - 0x234]
add edx, 4
mov eax, dword [edx]
lea edx, [edx + 4]
mov dword [esi + ecx*4], eax
inc ecx
cmp ecx, edi
jl 0x4015e1
lea eax, [ebp - 0x20c]
mov dword [esi + edi*4], 0x41d070
mov dword [esi + edi*4 + 4], eax
jmp 0x401629
pop edi
pop esi
mov eax, 0xb
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401cda
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x234]
lea eax, [edi - 1]
mov dword [ebp - 0x238], eax
add esi, 4
push 0x41dbe4
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x234]
mov dword [ebp - 0x234], 0
push eax
mov edi, 0xb
mov word [ebp - 0x230], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x401740
mov eax, dword [0x41dbe4]
push 0x41dbe0
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x22c]
push 0
push eax
push 1
mov dword [ebp - 0x22c], 0xf003f
mov dword [ebp - 0x228], 2
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x214], 2
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
test eax, eax
jne 0x401740
push 1
push 0x41dbcc
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x401740
push 0
push dword [0x41dbe0]
push 1
push 0x41dbcc
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x401740
mov ecx, dword [ebp - 0x238]
mov edx, esi
mov dword [0x41dbc0], 0xc
mov dword [0x41dbc4], 0x41dbcc
mov dword [0x41dbc8], 0
call section..text
mov ecx, dword [0x41dbe4]
mov edi, eax
test ecx, ecx
je 0x40172f
push ecx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [0x41dbe0]
test ecx, ecx
je 0x401740
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
test bl, bl
je 0x40174d
push esi
call fcn.00405352
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401cda
mov esp, ebp
pop ebp
Function at 0x40a341
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00409fb7

Function at 0x40ec08
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor eax, eax
cmp byte [ecx], al
je 0x40ec22
cmp eax, dword [ebp + 0xc]
je 0x40ec22
inc eax
cmp byte [eax + ecx], 0
jne 0x40ec16
pop ebp
shl esi, 0xd
out 0xd, al
dec edi
test ebx, edx
jns 0x40ec31
sub ecx, 0x16a24819
cmp ebx, 0xb4a78acf
ja 0x40ec3e
mov ecx, 0x59374731
test dword [0x419adf], ebp
je 0x40ec4c
and ecx, dword [0x41d036]
mov ecx, 0xbdaca9d9
test dword [0x41976e], 0xcdb07794
jbe 0x40ec60
shr ecx, 2
xor esi, 0xe03fbe03
xor edx, dword [0x419d79]
ror edi, 9
sub eax, ebp
or ecx, ebx
shr eax, 0x1c
ror edi, 0xe
dec edx
sub edi, edi
xor edx, 0x7e1b9423
rol ebx, 0x19
sub edx, dword [0x41cb5e]
cmp dword [0x41b057], 0x4a3611e6
mov al, 0x41
add dh, ah
adc dword [esi], esi
dec edx
jns 0x40ec99
mov edi, ebp
and esi, 0xabf776ed
dec edi
ror ebx, 0xf
inc eax
mov edi, edi
and esi, 0x4402e3d1
mov ecx, 0x58420b34

Function at 0x40ec24
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor eax, eax
cmp byte [ecx], al
je 0x40ec22
cmp eax, dword [ebp + 0xc]
je 0x40ec22
inc eax
cmp byte [eax + ecx], 0
jne 0x40ec16
pop ebp
shl esi, 0xd
out 0xd, al
dec edi
test ebx, edx
jns 0x40ec31
sub ecx, 0x16a24819
cmp ebx, 0xb4a78acf
ja 0x40ec3e
mov ecx, 0x59374731
test dword [0x419adf], ebp
je 0x40ec4c
and ecx, dword [0x41d036]
mov ecx, 0xbdaca9d9
test dword [0x41976e], 0xcdb07794
jbe 0x40ec60
shr ecx, 2
xor esi, 0xe03fbe03
xor edx, dword [0x419d79]
ror edi, 9
sub eax, ebp
or ecx, ebx
shr eax, 0x1c
ror edi, 0xe
dec edx
sub edi, edi
xor edx, 0x7e1b9423
rol ebx, 0x19
sub edx, dword [0x41cb5e]
cmp dword [0x41b057], 0x4a3611e6
mov al, 0x41
add dh, ah
adc dword [esi], esi
dec edx
jns 0x40ec99
mov edi, ebp
and esi, 0xabf776ed
dec edi
ror ebx, 0xf
inc eax
mov edi, edi
and esi, 0x4402e3d1
mov ecx, 0x58420b34

Function at 0x40ec41
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor eax, eax
cmp byte [ecx], al
je 0x40ec22
cmp eax, dword [ebp + 0xc]
je 0x40ec22
inc eax
cmp byte [eax + ecx], 0
jne 0x40ec16
pop ebp
shl esi, 0xd
out 0xd, al
dec edi
test ebx, edx
jns 0x40ec31
sub ecx, 0x16a24819
cmp ebx, 0xb4a78acf
ja 0x40ec3e
mov ecx, 0x59374731
test dword [0x419adf], ebp
je 0x40ec4c
and ecx, dword [0x41d036]
mov ecx, 0xbdaca9d9
test dword [0x41976e], 0xcdb07794
jbe 0x40ec60
shr ecx, 2
xor esi, 0xe03fbe03
xor edx, dword [0x419d79]
ror edi, 9
sub eax, ebp
or ecx, ebx
shr eax, 0x1c
ror edi, 0xe
dec edx
sub edi, edi
xor edx, 0x7e1b9423
rol ebx, 0x19
sub edx, dword [0x41cb5e]
cmp dword [0x41b057], 0x4a3611e6
mov al, 0x41
add dh, ah
adc dword [esi], esi
dec edx
jns 0x40ec99
mov edi, ebp
and esi, 0xabf776ed
dec edi
ror ebx, 0xf
inc eax
mov edi, edi
and esi, 0x4402e3d1
mov ecx, 0x58420b34
Function at 0x40ec8e
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor eax, eax
cmp byte [ecx], al
je 0x40ec22
cmp eax, dword [ebp + 0xc]
je 0x40ec22
inc eax
cmp byte [eax + ecx], 0
jne 0x40ec16
pop ebp
shl esi, 0xd
out 0xd, al
dec edi
test ebx, edx
jns 0x40ec31
sub ecx, 0x16a24819
cmp ebx, 0xb4a78acf
ja 0x40ec3e
mov ecx, 0x59374731
test dword [0x419adf], ebp
je 0x40ec4c
and ecx, dword [0x41d036]
mov ecx, 0xbdaca9d9
test dword [0x41976e], 0xcdb07794
jbe 0x40ec60
shr ecx, 2
xor esi, 0xe03fbe03
xor edx, dword [0x419d79]
ror edi, 9
sub eax, ebp
or ecx, ebx
shr eax, 0x1c
ror edi, 0xe
dec edx
sub edi, edi
xor edx, 0x7e1b9423
rol ebx, 0x19
sub edx, dword [0x41cb5e]
cmp dword [0x41b057], 0x4a3611e6
mov al, 0x41
add dh, ah
adc dword [esi], esi
dec edx
jns 0x40ec99
mov edi, ebp
and esi, 0xabf776ed
dec edi
ror ebx, 0xf
inc eax
mov edi, edi
and esi, 0x4402e3d1
mov ecx, 0x58420b34

Function at 0x40ece0
Capabilities:
Encode data using xor
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
xor dword [0x41dcb6], 0xc0447e83
and edi, esp
and dword [0x41dd2e], ebx
or edx, esp
mov edi, dword [0x41a4ff]
and eax, 0xb8c3ecdc
shl eax, 0x16
mov eax, edi
add edx, ebp
neg ebx
add eax, dword [0x41a9ae]
inc edi
mov edi, 0xb2c34fbd
ror ebx, 4
dec ecx
jne 0x40ecb1
ror esi, 0xd
shr edx, 0x12
call fcn.0040ba53
xchg ebx, eax
xor edx, 0x846fd993
mov ecx, 0x4da8aca5
or dword [0x41dcac], edi
xchg edi, esi
rol ebx, 0x19
test dword [0x41aa5e], ebp
jno 0x40ed1a
mov eax, ebp
and esi, dword [0x419097]
dec edi
test ecx, 0xae8f48dd
jge 0x40ed2f
mov edx, dword [0x41ae27]
sub edx, esi
and ebx, 0xad4ca213
or edi, esp
mov eax, 0xdcf9ba17
shl edx, 1
neg esi
or dword [0x41dd27], ecx
inc edx
shl eax, 5
dec ecx
jne 0x40ed05
xor ebx, dword [0x41931e]
mov ecx, 0x4e0d0e07
and edi, 0x9878e267
inc esi
test edi, ecx
jbe 0x40ed6a
shr esi, 0x15
mov edx, 0x42c4ab75
add eax, 0x5796ba38
sub ebx, ebp
or edx, 0xd1f60b7f
mov edi, 0xa78780cb
dec edi
xchg edi, esi
inc edx
ror eax, 0xd
not esi
or dword [0x41dc2f], ebx
inc edi
xor edi, ecx
mov dword [0x41dcfb], ebx
xor dword [0x41dc73], esi
dec ecx
jne 0x40ed5c
ror edx, 0x16
cmp dword [0x41a46d], edx
jne 0x40edb1
neg ebx
cmp ebp, 0xba68e621
jo 0x40edbb
mov esi, ebx
inc edx
cmp dword [0x41d009], edx
je 0x40edc6
mov ebx, eax
add ecx, 0x24673fb4
call fcn.004074bc
xor ecx, 0xd2b0dc01
add ecx, 0x9a861489
mov eax, 0xf139b501
not esi
call fcn.0040920f
dec ecx
or esi, dword [0x41de30]
Function at 0x403ba0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0x6c90ac]
test eax, eax
je 0x403bae
jmp fcn.004464e0
ret

Function at 0x403ea0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0x6c90b8]
test eax, eax
je 0x403eae
jmp fcn.004464e0
ret

Function at 0x404160
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0x6c90c0]
test eax, eax
je 0x40416e
jmp fcn.004464e0
ret
Function at 0x441e25
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20bc
push ebx
push esi
push edi
push edx
push eax
add esp, 4
xor edx, 0x9609
and edx, 0x30f7
pop edx
push ecx
push eax
add esp, 4
sub ecx, 0x438
jmp 0x441e56
xor ecx, 0x11d02
and ecx, 0x117cb
pop ecx
mov eax, 0x4d
mov word [ebp - 0x1ff8], ax
mov ecx, 0x42
mov word [ebp - 0x1ff6], cx
mov edx, 0x53
mov word [ebp - 0x1ff4], dx
mov eax, 0x65
mov word [ebp - 0x1ff2], ax
mov ecx, 0x72
mov word [ebp - 0x1ff0], cx
mov edx, 0x76
mov word [ebp - 0x1fee], dx
mov eax, 0x69
mov word [ebp - 0x1fec], ax
mov ecx, 0x63
mov word [ebp - 0x1fea], cx
mov edx, 0x65
mov word [ebp - 0x1fe8], dx
mov eax, 0x2e
mov word [ebp - 0x1fe6], ax
mov ecx, 0x65
mov word [ebp - 0x1fe4], cx
mov edx, 0x78
mov word [ebp - 0x1fe2], dx
mov eax, 0x65
mov word [ebp - 0x1fe0], ax
xor ecx, ecx
mov word [ebp - 0x1fde], cx
mov dword [ebp - 0x1060], 1
add byte [eax], al

Function at 0x441f20
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
pop ecx
push eax
add eax, 0x15948
xor eax, 0x8be2
call 0x441f3a
add byte [0x44434540], bh
dec esp
add esp, 4
sub eax, 0x182a4
pop eax
imul edx, dword [ebp - 0x1060], 0x70
add edx, 0x44f3663b
imul eax, dword [ebp - 0x1060], 0x70
sub edx, eax
xor edx, 0xaa6272
imul edx, dword [ebp - 0x1060]
imul ecx, dword [ebp - 0x1060], 0x70
sub edx, ecx

Function at 0x441f3a
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
pop ecx
push eax
add eax, 0x15948
xor eax, 0x8be2
call 0x441f3a
add byte [0x44434540], bh
dec esp
add esp, 4
sub eax, 0x182a4
pop eax
imul edx, dword [ebp - 0x1060], 0x70
add edx, 0x44f3663b
imul eax, dword [ebp - 0x1060], 0x70
sub edx, eax
xor edx, 0xaa6272
imul edx, dword [ebp - 0x1060]
imul ecx, dword [ebp - 0x1060], 0x70
sub edx, ecx

Function at 0x441fe0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
pop edx
imul edx, dword [ebp - 0x10], 0x70
add edx, 0x44f3663b
imul eax, dword [ebp - 0x10], 0x70
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x70
sub edx, ecx
ror dword [ecx + 0x5753ec55], 1

Function at 0x442000
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
ror dword [ecx + 0x5753ec55], 1
add esp, 4
sub ebx, 0x84cd
or ebx, 0xc533
pop ebx
push edx
add edx, 0xe18
pop edx
push edx
push edi

Function at 0x442020
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
and edx, 0x538b
or edx, 0xfc8b
and edx, 0x1443e
loop 0x442070
inc esp
add dword [eax], eax
Function at 0x442030
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
loop 0x442070
inc esp
add dword [eax], eax
pop edx
push edx
xor edx, 0xcc8d
and edx, 0x14795
xor edx, 0x118b7
pop edx
push edi
push edx
add esp, 4
and edi, 0x1636b
out 0x6b, eax
arpl word [ecx], ax
add byte [ecx + 0x13ff9c7], al
add byte [ecx + 0x174b4ef], al
add byte [ecx + 0x1cfdc7], al
add byte [edi - 0x39], bl
inc ebp
aam 1
add byte [eax], al
invalid
push edx
sub edx, 0xed35
sub edx, 0xe7dd
pop edx
push edi
push ebx
add esp, 4
call fcn.00442091
add byte [eax + 0x45], dl
xor cl, byte [ebx + 0x33]
xor eax, 0x833d4c3c
cmp eax, 0x8104c483

Function at 0x442050
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
out 0x6b, eax
arpl word [ecx], ax
add byte [ecx + 0x13ff9c7], al
add byte [ecx + 0x174b4ef], al

Function at 0x442060
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [ecx + 0x1cfdc7], al
add byte [edi - 0x39], bl
inc ebp
aam 1
add byte [eax], al
add byte [edx - 0x7f], dl
ljmp 0xea81

Function at 0x442091
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
loop 0x442070
inc esp
add dword [eax], eax
pop edx
push edx
xor edx, 0xcc8d
and edx, 0x14795
xor edx, 0x118b7
pop edx
push edi
push edx
add esp, 4
and edi, 0x1636b
out 0x6b, eax
arpl word [ecx], ax
add byte [ecx + 0x13ff9c7], al
add byte [ecx + 0x174b4ef], al
add byte [ecx + 0x1cfdc7], al
add byte [edi - 0x39], bl
inc ebp
aam 1
add byte [eax], al
invalid
push edx
sub edx, 0xed35
sub edx, 0xe7dd
pop edx
push edi
push ebx
add esp, 4
call fcn.00442091
add byte [eax + 0x45], dl
xor cl, byte [ebx + 0x33]
xor eax, 0x833d4c3c
cmp eax, 0x8104c483

Function at 0x4420a0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
pop edi
imul edx, dword [ebp - 0x2c], 0x70
add edx, 0x44f3663b
imul eax, dword [ebp - 0x2c], 0x70
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x70
sub edx, ecx
invalid
push ebp
Function at 0x4422a0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edi
and edi, 0xf34a
pop edi
push ebx
jmp fcn.004422b0

Function at 0x4422b0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
call 0x4422bd
add byte [edi], dh
aas
dec edx
aas
dec edx
dec ebp
cmp byte [ebx - 0xc7efb3c], al
out dx, al
sldt word [eax]
pop ebx
push edi
or edi, 0x10d62
jmp 0x4422d3
add edi, 0x136b7
pop edi
mov eax, dword [ebp - 0x30]
add eax, 0x70
imul ecx, dword [ebp - 0x2c], 0x70
add ecx, 0x44f3663b
imul edx, dword [ebp - 0x2c], 0x70
sub ecx, edx
xor eax, ecx
imul eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1e30], eax
push edx
or edx, 0x432f
inc ebx
add byte [eax], al
pop edx
push esi
push esi
add esp, 4
sub esi, 0x1403c
pop esi
push eax
push ebx
add esp, 4
xor eax, 0x1031e
invalid
shl byte [ecx], 1
invalid

Function at 0x4422bd
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
call 0x4422bd
add byte [edi], dh
aas
dec edx
aas
dec edx
dec ebp
cmp byte [ebx - 0xc7efb3c], al
out dx, al
sldt word [eax]
pop ebx
push edi
or edi, 0x10d62
jmp 0x4422d3
add edi, 0x136b7
pop edi
mov eax, dword [ebp - 0x30]
add eax, 0x70
imul ecx, dword [ebp - 0x2c], 0x70
add ecx, 0x44f3663b
imul edx, dword [ebp - 0x2c], 0x70
sub ecx, edx
xor eax, ecx
imul eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1e30], eax
push edx
or edx, 0x432f
inc ebx
add byte [eax], al
pop edx
push esi
push esi
add esp, 4
sub esi, 0x1403c
pop esi
push eax
push ebx
add esp, 4
xor eax, 0x1031e
invalid
shl byte [ecx], 1
invalid

Function at 0x442300
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
call 0x4422bd
add byte [edi], dh
aas
dec edx
aas
dec edx
dec ebp
cmp byte [ebx - 0xc7efb3c], al
out dx, al
sldt word [eax]
pop ebx
push edi
or edi, 0x10d62
jmp 0x4422d3
add edi, 0x136b7
pop edi
mov eax, dword [ebp - 0x30]
add eax, 0x70
imul ecx, dword [ebp - 0x2c], 0x70
add ecx, 0x44f3663b
imul edx, dword [ebp - 0x2c], 0x70
sub ecx, edx
xor eax, ecx
imul eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1e30], eax
push edx
or edx, 0x432f
inc ebx
add byte [eax], al
pop edx
push esi
push esi
add esp, 4
sub esi, 0x1403c
pop esi
push eax
push ebx
add esp, 4
xor eax, 0x1031e
invalid
shl byte [ecx], 1
invalid
Function at 0x4451b4
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x13379797
pop eax
mov dword [ebp - 0x3f0], eax
push esi
xor esi, 0x459a
jmp 0x445193
or esi, 0xb632
pop esi
push ecx
and ecx, 0xc1fd
pop ecx
push ebx
push edx
add esp, 4
call 0x4451b4
add byte [edx], bh
dec ecx
xor al, 0x32
xor ecx, dword [edx - 0x7d]
les eax, [ebx + ebx*2]
mov ecx, dword [ebp - 0x2098]
mov dword [ebp - 0x15c0], ecx
push esi
push ebx
add esp, 4
and esi, 0x103f
pop esi
push esi
call 0x4451e0
add byte [eax + 0x4c], al
inc ecx
cmp dword [ecx], edi
inc edi
xor al, 0x47
inc eax
add esp, 4
xor esi, 0x11095
xor esi, 0x19af
or esi, 0x12214
pop esi
mov edx, dword [ebp - 0x14]
add edx, 0x70
imul eax, dword [ebp - 0x10], 0x70
add eax, 0x44f3663b
imul ecx, dword [ebp - 0x10], 0x70
sub eax, ecx
xor edx, eax
imul edx, dword [ebp - 0x10]
mov dword [ebp - 0x15c0], edx
mov edx, dword [ebp - 0x3f0]
mov dword [ebp - 0x1ffc], edx
mov eax, dword [ebp - 0x1ffc]
add eax, dword [ebp - 0x15c0]
mov dword [ebp - 0x3f0], eax
test dword [eax], edx
cld
invalid
call dword [eax + 0x50]
add esp, 4
xor eax, 0xbc2f
add eax, 0x15668
pop eax
push ebx
push edi
add esp, 4
or ebx, 0x31c
add byte [eax], al
jmp 0x445257
call 0x445263
add byte [ebx + 0x50], cl
inc esi
cmp dword [edx], esi
cmp al, byte [ebx - 0x39a4fb3c]
test dword [esp + esi*8], edx
invalid

Function at 0x4451e0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x13379797
pop eax
mov dword [ebp - 0x3f0], eax
push esi
xor esi, 0x459a
jmp 0x445193
or esi, 0xb632
pop esi
push ecx
and ecx, 0xc1fd
pop ecx
push ebx
push edx
add esp, 4
call 0x4451b4
add byte [edx], bh
dec ecx
xor al, 0x32
xor ecx, dword [edx - 0x7d]
les eax, [ebx + ebx*2]
mov ecx, dword [ebp - 0x2098]
mov dword [ebp - 0x15c0], ecx
push esi
push ebx
add esp, 4
and esi, 0x103f
pop esi
push esi
call 0x4451e0
add byte [eax + 0x4c], al
inc ecx
cmp dword [ecx], edi
inc edi
xor al, 0x47
inc eax
add esp, 4
xor esi, 0x11095
xor esi, 0x19af
or esi, 0x12214
pop esi
mov edx, dword [ebp - 0x14]
add edx, 0x70
imul eax, dword [ebp - 0x10], 0x70
add eax, 0x44f3663b
imul ecx, dword [ebp - 0x10], 0x70
sub eax, ecx
xor edx, eax
imul edx, dword [ebp - 0x10]
mov dword [ebp - 0x15c0], edx
mov edx, dword [ebp - 0x3f0]
mov dword [ebp - 0x1ffc], edx
mov eax, dword [ebp - 0x1ffc]
add eax, dword [ebp - 0x15c0]
mov dword [ebp - 0x3f0], eax
test dword [eax], edx
cld
invalid
call dword [eax + 0x50]
add esp, 4
xor eax, 0xbc2f
add eax, 0x15668
pop eax
push ebx
push edi
add esp, 4
or ebx, 0x31c
add byte [eax], al
jmp 0x445257
call 0x445263
add byte [ebx + 0x50], cl
inc esi
cmp dword [edx], esi
cmp al, byte [ebx - 0x39a4fb3c]
test dword [esp + esi*8], edx
invalid