joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d653
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x500]
add edx, 1
mov dword [ebp - 0x500], edx
add esp, 4
and edi, 0x6c49
sub edi, 0x58cd
pop edi
push edi
push ecx
add esp, 4
xor edi, 0x65ec
or edi, 0x8cf2
pop edi
mov edx, dword [ebp - 0xac0]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0xabc]
movzx edx, byte [ecx]
cmp eax, edx
je 0x41d625
push eax
and eax, 0xec73
sub eax, 0x16b84
xor eax, 0xdf7a
pop eax
push ecx
push ecx
add esp, 4
add ecx, 0x147b
xor ecx, 0x1513
xor ecx, 0xf607
or ecx, 0x8d7b
pop ecx
mov eax, dword [ebp - 0xac0]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0xabc]
movzx eax, byte [edx]
cmp ecx, eax
jle 0x41d60d
mov dword [ebp - 0x15a0], 1
jmp 0x41d617
mov dword [ebp - 0x15a0], 0xffffffff
mov ecx, dword [ebp - 0x15a0]
mov dword [ebp - 0xc8c], ecx
jmp 0x41d689
push ebx
and ebx, 0x12f73
jmp 0x41d632
pop ebx
push eax
push ebx
add esp, 4
add eax, 0x492e
xor eax, 0x1e75
call 0x41d653
add byte [ebx], dh
inc ebx
aaa
cmp byte [edx], bh
inc esi
cmp bh, byte [esi]
inc esi
inc ebp
xor al, byte [ebx - 0x74a7fb3c]
xchg ebp, eax
js 0x41d64e
invalid
mov edx, dword [ebp - 0xc8c]
mov dword [ebp - 0x15d4], edx
cmp dword [ebp - 0x15d4], 0
jne 0x41d6de
push edi
push edx
add esp, 4
xor edi, 0x93fc
pop edi
push eax
and eax, 0xbe10
or eax, 0xc3ec
pop eax
push edx
push esi
add esp, 4
and edx, 0x1802b
or edx, 0x10777
and edx, 0x67cf
pop edx
mov eax, dword [ebp - 0x500]
mov dword [ebp - 0xab8], eax
jmp 0x41d71f
jmp 0x41d42c
Function at 0x41ead0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp cl, byte [esi + 0x39]
dec ebx
aas
mov ecx, dword [ebp - 0x76c]
add ecx, dword [ebp - 0x19c]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x19c]
movsx ecx, byte [ebp + eax - 0x878]
cmp edx, ecx
jne 0x41eb2e
jmp 0x41ea74
jmp 0x41eb35
push eax
push eax
add esp, 4
xor eax, 0x559c
add eax, 0x17055
call 0x41eb54
add byte [ecx + 0x46], al
dec esi
cmp al, 0x3d
cmp byte [esi + 0x41], cl
add esp, 4
call 0x41eb63
add byte [0x42324838], bh
dec ebp
add esp, 4
pop eax
mov edx, dword [ebp - 0x76c]
add edx, dword [ebp - 0x19c]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x19c]
movsx edx, byte [ebp + ecx - 0x878]
cmp eax, edx
jne 0x41eb94
mov dword [ebp - 0xcb8], 0
jmp 0x41ec03
push ecx
push ebx
add esp, 4
xor ecx, 0xefcc
add ecx, 0x168f4
or ecx, 0x1698f
pop ecx
push ebx
sub ebx, 0x5408
or ebx, 0x247b
sub ebx, 0x15d03
add ebx, 0x10899
pop ebx
mov eax, dword [ebp - 0x76c]
add eax, dword [ebp - 0x19c]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x19c]
movsx eax, byte [ebp + edx - 0x878]
or eax, 0x20
cmp ecx, eax
jge 0x41ebf9
mov dword [ebp - 0xcb8], 0xffffffff
jmp 0x41ec03
mov dword [ebp - 0xcb8], 1
cmp dword [ebp - 0xcb8], 0
jne 0x41ec1a
mov ecx, dword [ebp - 0x198c]
mov dword [ebp - 0x510], ecx
jmp 0x41ec2b
jmp 0x41ea04
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0x79c], eax
push ecx
push ecx
add esp, 4
xor ecx, 0x17411
pop ecx
push ebx
push eax
add esp, 4
call 0x41ec57
add byte [ecx + 0x4a], al
xor cl, byte [ebp + 0x4c]
cmp byte [edx + 0x33], cl
add esp, 4
and ebx, 0x36ac
pop ebx
push edx
or edx, 0x137a7
pop edx
mov ecx, dword [ebp - 0x3e8]
add ecx, 0xe
mov dword [ebp - 0x19dc], ecx
push edx
push ecx
add esp, 4
jmp 0x41ec84
jmp 0x41ec8d
call 0x41ec9a
add byte [ecx + 0x3e], cl
inc edi
cmp dh, byte [0xc483423a]
add al, 0x5a
push esi
push edi
add esp, 4
xor esi, 0xb1e3
pop esi
cmp dword [ebp - 0x3e8], 0
je 0x41ecbc
cmp dword [ebp - 0xab8], 0
jne 0x41ed02
push ebx
add ebx, 0x6371
pop ebx
push ebx
xor ebx, 0xe5cd
call 0x41ecd8
add byte [ebx], bh
inc ebx
xor eax, 0x4b463448
add esp, 4
pop ebx
push esi
push esi
add esp, 4
sub esi, 0x789b
and esi, 0x182e3
pop esi
mov edx, dword [ebp - 0x79c]
mov dword [ebp - 0x1990], edx
push 0
call dword [ebp - 0x1990]
mov dword [ebp - 0x20a8], 0xa
push edi
xor edi, 0x11fd0
pop edi
push eax
push edx
add esp, 4
xor eax, 0x36bf
xor eax, 0x817c
call 0x41ed34
add byte [eax], bh
inc esi
cmp dword [edi + eax*2 + 0x47], ecx
aaa
dec esi
cmp eax, dword [ebx - 0x377efb3c]
lea esp, [0x8b580001]
test dword [eax], ebx
cld
invalid
Function at 0x41eb54
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp cl, byte [esi + 0x39]
dec ebx
aas
mov ecx, dword [ebp - 0x76c]
add ecx, dword [ebp - 0x19c]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x19c]
movsx ecx, byte [ebp + eax - 0x878]
cmp edx, ecx
jne 0x41eb2e
jmp 0x41ea74
jmp 0x41eb35
push eax
push eax
add esp, 4
xor eax, 0x559c
add eax, 0x17055
call 0x41eb54
add byte [ecx + 0x46], al
dec esi
cmp al, 0x3d
cmp byte [esi + 0x41], cl
add esp, 4
call 0x41eb63
add byte [0x42324838], bh
dec ebp
add esp, 4
pop eax
mov edx, dword [ebp - 0x76c]
add edx, dword [ebp - 0x19c]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x19c]
movsx edx, byte [ebp + ecx - 0x878]
cmp eax, edx
jne 0x41eb94
mov dword [ebp - 0xcb8], 0
jmp 0x41ec03
push ecx
push ebx
add esp, 4
xor ecx, 0xefcc
add ecx, 0x168f4
or ecx, 0x1698f
pop ecx
push ebx
sub ebx, 0x5408
or ebx, 0x247b
sub ebx, 0x15d03
add ebx, 0x10899
pop ebx
mov eax, dword [ebp - 0x76c]
add eax, dword [ebp - 0x19c]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x19c]
movsx eax, byte [ebp + edx - 0x878]
or eax, 0x20
cmp ecx, eax
jge 0x41ebf9
mov dword [ebp - 0xcb8], 0xffffffff
jmp 0x41ec03
mov dword [ebp - 0xcb8], 1
cmp dword [ebp - 0xcb8], 0
jne 0x41ec1a
mov ecx, dword [ebp - 0x198c]
mov dword [ebp - 0x510], ecx
jmp 0x41ec2b
jmp 0x41ea04
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0x79c], eax
push ecx
push ecx
add esp, 4
xor ecx, 0x17411
pop ecx
push ebx
push eax
add esp, 4
call 0x41ec57
add byte [ecx + 0x4a], al
xor cl, byte [ebp + 0x4c]
cmp byte [edx + 0x33], cl
add esp, 4
and ebx, 0x36ac
pop ebx
push edx
or edx, 0x137a7
pop edx
mov ecx, dword [ebp - 0x3e8]
add ecx, 0xe
mov dword [ebp - 0x19dc], ecx
push edx
push ecx
add esp, 4
jmp 0x41ec84
jmp 0x41ec8d
call 0x41ec9a
add byte [ecx + 0x3e], cl
inc edi
cmp dh, byte [0xc483423a]
add al, 0x5a
push esi
push edi
add esp, 4
xor esi, 0xb1e3
pop esi
cmp dword [ebp - 0x3e8], 0
je 0x41ecbc
cmp dword [ebp - 0xab8], 0
jne 0x41ed02
push ebx
add ebx, 0x6371
pop ebx
push ebx
xor ebx, 0xe5cd
call 0x41ecd8
add byte [ebx], bh
inc ebx
xor eax, 0x4b463448
add esp, 4
pop ebx
push esi
push esi
add esp, 4
sub esi, 0x789b
and esi, 0x182e3
pop esi
mov edx, dword [ebp - 0x79c]
mov dword [ebp - 0x1990], edx
push 0
call dword [ebp - 0x1990]
mov dword [ebp - 0x20a8], 0xa
push edi
xor edi, 0x11fd0
pop edi
push eax
push edx
add esp, 4
xor eax, 0x36bf
xor eax, 0x817c
call 0x41ed34
add byte [eax], bh
inc esi
cmp dword [edi + eax*2 + 0x47], ecx
aaa
dec esi
cmp eax, dword [ebx - 0x377efb3c]
lea esp, [0x8b580001]
test dword [eax], ebx
cld
invalid
Function at 0x41eb63
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp cl, byte [esi + 0x39]
dec ebx
aas
mov ecx, dword [ebp - 0x76c]
add ecx, dword [ebp - 0x19c]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x19c]
movsx ecx, byte [ebp + eax - 0x878]
cmp edx, ecx
jne 0x41eb2e
jmp 0x41ea74
jmp 0x41eb35
push eax
push eax
add esp, 4
xor eax, 0x559c
add eax, 0x17055
call 0x41eb54
add byte [ecx + 0x46], al
dec esi
cmp al, 0x3d
cmp byte [esi + 0x41], cl
add esp, 4
call 0x41eb63
add byte [0x42324838], bh
dec ebp
add esp, 4
pop eax
mov edx, dword [ebp - 0x76c]
add edx, dword [ebp - 0x19c]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x19c]
movsx edx, byte [ebp + ecx - 0x878]
cmp eax, edx
jne 0x41eb94
mov dword [ebp - 0xcb8], 0
jmp 0x41ec03
push ecx
push ebx
add esp, 4
xor ecx, 0xefcc
add ecx, 0x168f4
or ecx, 0x1698f
pop ecx
push ebx
sub ebx, 0x5408
or ebx, 0x247b
sub ebx, 0x15d03
add ebx, 0x10899
pop ebx
mov eax, dword [ebp - 0x76c]
add eax, dword [ebp - 0x19c]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x19c]
movsx eax, byte [ebp + edx - 0x878]
or eax, 0x20
cmp ecx, eax
jge 0x41ebf9
mov dword [ebp - 0xcb8], 0xffffffff
jmp 0x41ec03
mov dword [ebp - 0xcb8], 1
cmp dword [ebp - 0xcb8], 0
jne 0x41ec1a
mov ecx, dword [ebp - 0x198c]
mov dword [ebp - 0x510], ecx
jmp 0x41ec2b
jmp 0x41ea04
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0x79c], eax
push ecx
push ecx
add esp, 4
xor ecx, 0x17411
pop ecx
push ebx
push eax
add esp, 4
call 0x41ec57
add byte [ecx + 0x4a], al
xor cl, byte [ebp + 0x4c]
cmp byte [edx + 0x33], cl
add esp, 4
and ebx, 0x36ac
pop ebx
push edx
or edx, 0x137a7
pop edx
mov ecx, dword [ebp - 0x3e8]
add ecx, 0xe
mov dword [ebp - 0x19dc], ecx
push edx
push ecx
add esp, 4
jmp 0x41ec84
jmp 0x41ec8d
call 0x41ec9a
add byte [ecx + 0x3e], cl
inc edi
cmp dh, byte [0xc483423a]
add al, 0x5a
push esi
push edi
add esp, 4
xor esi, 0xb1e3
pop esi
cmp dword [ebp - 0x3e8], 0
je 0x41ecbc
cmp dword [ebp - 0xab8], 0
jne 0x41ed02
push ebx
add ebx, 0x6371
pop ebx
push ebx
xor ebx, 0xe5cd
call 0x41ecd8
add byte [ebx], bh
inc ebx
xor eax, 0x4b463448
add esp, 4
pop ebx
push esi
push esi
add esp, 4
sub esi, 0x789b
and esi, 0x182e3
pop esi
mov edx, dword [ebp - 0x79c]
mov dword [ebp - 0x1990], edx
push 0
call dword [ebp - 0x1990]
mov dword [ebp - 0x20a8], 0xa
push edi
xor edi, 0x11fd0
pop edi
push eax
push edx
add esp, 4
xor eax, 0x36bf
xor eax, 0x817c
call 0x41ed34
add byte [eax], bh
inc esi
cmp dword [edi + eax*2 + 0x47], ecx
aaa
dec esi
cmp eax, dword [ebx - 0x377efb3c]
lea esp, [0x8b580001]
test dword [eax], ebx
cld
invalid
Function at 0x41ec57
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp cl, byte [esi + 0x39]
dec ebx
aas
mov ecx, dword [ebp - 0x76c]
add ecx, dword [ebp - 0x19c]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x19c]
movsx ecx, byte [ebp + eax - 0x878]
cmp edx, ecx
jne 0x41eb2e
jmp 0x41ea74
jmp 0x41eb35
push eax
push eax
add esp, 4
xor eax, 0x559c
add eax, 0x17055
call 0x41eb54
add byte [ecx + 0x46], al
dec esi
cmp al, 0x3d
cmp byte [esi + 0x41], cl
add esp, 4
call 0x41eb63
add byte [0x42324838], bh
dec ebp
add esp, 4
pop eax
mov edx, dword [ebp - 0x76c]
add edx, dword [ebp - 0x19c]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x19c]
movsx edx, byte [ebp + ecx - 0x878]
cmp eax, edx
jne 0x41eb94
mov dword [ebp - 0xcb8], 0
jmp 0x41ec03
push ecx
push ebx
add esp, 4
xor ecx, 0xefcc
add ecx, 0x168f4
or ecx, 0x1698f
pop ecx
push ebx
sub ebx, 0x5408
or ebx, 0x247b
sub ebx, 0x15d03
add ebx, 0x10899
pop ebx
mov eax, dword [ebp - 0x76c]
add eax, dword [ebp - 0x19c]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x19c]
movsx eax, byte [ebp + edx - 0x878]
or eax, 0x20
cmp ecx, eax
jge 0x41ebf9
mov dword [ebp - 0xcb8], 0xffffffff
jmp 0x41ec03
mov dword [ebp - 0xcb8], 1
cmp dword [ebp - 0xcb8], 0
jne 0x41ec1a
mov ecx, dword [ebp - 0x198c]
mov dword [ebp - 0x510], ecx
jmp 0x41ec2b
jmp 0x41ea04
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0x79c], eax
push ecx
push ecx
add esp, 4
xor ecx, 0x17411
pop ecx
push ebx
push eax
add esp, 4
call 0x41ec57
add byte [ecx + 0x4a], al
xor cl, byte [ebp + 0x4c]
cmp byte [edx + 0x33], cl
add esp, 4
and ebx, 0x36ac
pop ebx
push edx
or edx, 0x137a7
pop edx
mov ecx, dword [ebp - 0x3e8]
add ecx, 0xe
mov dword [ebp - 0x19dc], ecx
push edx
push ecx
add esp, 4
jmp 0x41ec84
jmp 0x41ec8d
call 0x41ec9a
add byte [ecx + 0x3e], cl
inc edi
cmp dh, byte [0xc483423a]
add al, 0x5a
push esi
push edi
add esp, 4
xor esi, 0xb1e3
pop esi
cmp dword [ebp - 0x3e8], 0
je 0x41ecbc
cmp dword [ebp - 0xab8], 0
jne 0x41ed02
push ebx
add ebx, 0x6371
pop ebx
push ebx
xor ebx, 0xe5cd
call 0x41ecd8
add byte [ebx], bh
inc ebx
xor eax, 0x4b463448
add esp, 4
pop ebx
push esi
push esi
add esp, 4
sub esi, 0x789b
and esi, 0x182e3
pop esi
mov edx, dword [ebp - 0x79c]
mov dword [ebp - 0x1990], edx
push 0
call dword [ebp - 0x1990]
mov dword [ebp - 0x20a8], 0xa
push edi
xor edi, 0x11fd0
pop edi
push eax
push edx
add esp, 4
xor eax, 0x36bf
xor eax, 0x817c
call 0x41ed34
add byte [eax], bh
inc esi
cmp dword [edi + eax*2 + 0x47], ecx
aaa
dec esi
cmp eax, dword [ebx - 0x377efb3c]
lea esp, [0x8b580001]
test dword [eax], ebx
cld
invalid
Function at 0x41ec9a
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp cl, byte [esi + 0x39]
dec ebx
aas
mov ecx, dword [ebp - 0x76c]
add ecx, dword [ebp - 0x19c]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x19c]
movsx ecx, byte [ebp + eax - 0x878]
cmp edx, ecx
jne 0x41eb2e
jmp 0x41ea74
jmp 0x41eb35
push eax
push eax
add esp, 4
xor eax, 0x559c
add eax, 0x17055
call 0x41eb54
add byte [ecx + 0x46], al
dec esi
cmp al, 0x3d
cmp byte [esi + 0x41], cl
add esp, 4
call 0x41eb63
add byte [0x42324838], bh
dec ebp
add esp, 4
pop eax
mov edx, dword [ebp - 0x76c]
add edx, dword [ebp - 0x19c]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x19c]
movsx edx, byte [ebp + ecx - 0x878]
cmp eax, edx
jne 0x41eb94
mov dword [ebp - 0xcb8], 0
jmp 0x41ec03
push ecx
push ebx
add esp, 4
xor ecx, 0xefcc
add ecx, 0x168f4
or ecx, 0x1698f
pop ecx
push ebx
sub ebx, 0x5408
or ebx, 0x247b
sub ebx, 0x15d03
add ebx, 0x10899
pop ebx
mov eax, dword [ebp - 0x76c]
add eax, dword [ebp - 0x19c]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x19c]
movsx eax, byte [ebp + edx - 0x878]
or eax, 0x20
cmp ecx, eax
jge 0x41ebf9
mov dword [ebp - 0xcb8], 0xffffffff
jmp 0x41ec03
mov dword [ebp - 0xcb8], 1
cmp dword [ebp - 0xcb8], 0
jne 0x41ec1a
mov ecx, dword [ebp - 0x198c]
mov dword [ebp - 0x510], ecx
jmp 0x41ec2b
jmp 0x41ea04
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0x79c], eax
push ecx
push ecx
add esp, 4
xor ecx, 0x17411
pop ecx
push ebx
push eax
add esp, 4
call 0x41ec57
add byte [ecx + 0x4a], al
xor cl, byte [ebp + 0x4c]
cmp byte [edx + 0x33], cl
add esp, 4
and ebx, 0x36ac
pop ebx
push edx
or edx, 0x137a7
pop edx
mov ecx, dword [ebp - 0x3e8]
add ecx, 0xe
mov dword [ebp - 0x19dc], ecx
push edx
push ecx
add esp, 4
jmp 0x41ec84
jmp 0x41ec8d
call 0x41ec9a
add byte [ecx + 0x3e], cl
inc edi
cmp dh, byte [0xc483423a]
add al, 0x5a
push esi
push edi
add esp, 4
xor esi, 0xb1e3
pop esi
cmp dword [ebp - 0x3e8], 0
je 0x41ecbc
cmp dword [ebp - 0xab8], 0
jne 0x41ed02
push ebx
add ebx, 0x6371
pop ebx
push ebx
xor ebx, 0xe5cd
call 0x41ecd8
add byte [ebx], bh
inc ebx
xor eax, 0x4b463448
add esp, 4
pop ebx
push esi
push esi
add esp, 4
sub esi, 0x789b
and esi, 0x182e3
pop esi
mov edx, dword [ebp - 0x79c]
mov dword [ebp - 0x1990], edx
push 0
call dword [ebp - 0x1990]
mov dword [ebp - 0x20a8], 0xa
push edi
xor edi, 0x11fd0
pop edi
push eax
push edx
add esp, 4
xor eax, 0x36bf
xor eax, 0x817c
call 0x41ed34
add byte [eax], bh
inc esi
cmp dword [edi + eax*2 + 0x47], ecx
aaa
dec esi
cmp eax, dword [ebx - 0x377efb3c]
lea esp, [0x8b580001]
test dword [eax], ebx
cld
invalid
Function at 0x41ecd8
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp cl, byte [esi + 0x39]
dec ebx
aas
mov ecx, dword [ebp - 0x76c]
add ecx, dword [ebp - 0x19c]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x19c]
movsx ecx, byte [ebp + eax - 0x878]
cmp edx, ecx
jne 0x41eb2e
jmp 0x41ea74
jmp 0x41eb35
push eax
push eax
add esp, 4
xor eax, 0x559c
add eax, 0x17055
call 0x41eb54
add byte [ecx + 0x46], al
dec esi
cmp al, 0x3d
cmp byte [esi + 0x41], cl
add esp, 4
call 0x41eb63
add byte [0x42324838], bh
dec ebp
add esp, 4
pop eax
mov edx, dword [ebp - 0x76c]
add edx, dword [ebp - 0x19c]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x19c]
movsx edx, byte [ebp + ecx - 0x878]
cmp eax, edx
jne 0x41eb94
mov dword [ebp - 0xcb8], 0
jmp 0x41ec03
push ecx
push ebx
add esp, 4
xor ecx, 0xefcc
add ecx, 0x168f4
or ecx, 0x1698f
pop ecx
push ebx
sub ebx, 0x5408
or ebx, 0x247b
sub ebx, 0x15d03
add ebx, 0x10899
pop ebx
mov eax, dword [ebp - 0x76c]
add eax, dword [ebp - 0x19c]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x19c]
movsx eax, byte [ebp + edx - 0x878]
or eax, 0x20
cmp ecx, eax
jge 0x41ebf9
mov dword [ebp - 0xcb8], 0xffffffff
jmp 0x41ec03
mov dword [ebp - 0xcb8], 1
cmp dword [ebp - 0xcb8], 0
jne 0x41ec1a
mov ecx, dword [ebp - 0x198c]
mov dword [ebp - 0x510], ecx
jmp 0x41ec2b
jmp 0x41ea04
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0x79c], eax
push ecx
push ecx
add esp, 4
xor ecx, 0x17411
pop ecx
push ebx
push eax
add esp, 4
call 0x41ec57
add byte [ecx + 0x4a], al
xor cl, byte [ebp + 0x4c]
cmp byte [edx + 0x33], cl
add esp, 4
and ebx, 0x36ac
pop ebx
push edx
or edx, 0x137a7
pop edx
mov ecx, dword [ebp - 0x3e8]
add ecx, 0xe
mov dword [ebp - 0x19dc], ecx
push edx
push ecx
add esp, 4
jmp 0x41ec84
jmp 0x41ec8d
call 0x41ec9a
add byte [ecx + 0x3e], cl
inc edi
cmp dh, byte [0xc483423a]
add al, 0x5a
push esi
push edi
add esp, 4
xor esi, 0xb1e3
pop esi
cmp dword [ebp - 0x3e8], 0
je 0x41ecbc
cmp dword [ebp - 0xab8], 0
jne 0x41ed02
push ebx
add ebx, 0x6371
pop ebx
push ebx
xor ebx, 0xe5cd
call 0x41ecd8
add byte [ebx], bh
inc ebx
xor eax, 0x4b463448
add esp, 4
pop ebx
push esi
push esi
add esp, 4
sub esi, 0x789b
and esi, 0x182e3
pop esi
mov edx, dword [ebp - 0x79c]
mov dword [ebp - 0x1990], edx
push 0
call dword [ebp - 0x1990]
mov dword [ebp - 0x20a8], 0xa
push edi
xor edi, 0x11fd0
pop edi
push eax
push edx
add esp, 4
xor eax, 0x36bf
xor eax, 0x817c
call 0x41ed34
add byte [eax], bh
inc esi
cmp dword [edi + eax*2 + 0x47], ecx
aaa
dec esi
cmp eax, dword [ebx - 0x377efb3c]
lea esp, [0x8b580001]
test dword [eax], ebx
cld
invalid
Function at 0x41ed34
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp cl, byte [esi + 0x39]
dec ebx
aas
mov ecx, dword [ebp - 0x76c]
add ecx, dword [ebp - 0x19c]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x19c]
movsx ecx, byte [ebp + eax - 0x878]
cmp edx, ecx
jne 0x41eb2e
jmp 0x41ea74
jmp 0x41eb35
push eax
push eax
add esp, 4
xor eax, 0x559c
add eax, 0x17055
call 0x41eb54
add byte [ecx + 0x46], al
dec esi
cmp al, 0x3d
cmp byte [esi + 0x41], cl
add esp, 4
call 0x41eb63
add byte [0x42324838], bh
dec ebp
add esp, 4
pop eax
mov edx, dword [ebp - 0x76c]
add edx, dword [ebp - 0x19c]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x19c]
movsx edx, byte [ebp + ecx - 0x878]
cmp eax, edx
jne 0x41eb94
mov dword [ebp - 0xcb8], 0
jmp 0x41ec03
push ecx
push ebx
add esp, 4
xor ecx, 0xefcc
add ecx, 0x168f4
or ecx, 0x1698f
pop ecx
push ebx
sub ebx, 0x5408
or ebx, 0x247b
sub ebx, 0x15d03
add ebx, 0x10899
pop ebx
mov eax, dword [ebp - 0x76c]
add eax, dword [ebp - 0x19c]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x19c]
movsx eax, byte [ebp + edx - 0x878]
or eax, 0x20
cmp ecx, eax
jge 0x41ebf9
mov dword [ebp - 0xcb8], 0xffffffff
jmp 0x41ec03
mov dword [ebp - 0xcb8], 1
cmp dword [ebp - 0xcb8], 0
jne 0x41ec1a
mov ecx, dword [ebp - 0x198c]
mov dword [ebp - 0x510], ecx
jmp 0x41ec2b
jmp 0x41ea04
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0x79c], eax
push ecx
push ecx
add esp, 4
xor ecx, 0x17411
pop ecx
push ebx
push eax
add esp, 4
call 0x41ec57
add byte [ecx + 0x4a], al
xor cl, byte [ebp + 0x4c]
cmp byte [edx + 0x33], cl
add esp, 4
and ebx, 0x36ac
pop ebx
push edx
or edx, 0x137a7
pop edx
mov ecx, dword [ebp - 0x3e8]
add ecx, 0xe
mov dword [ebp - 0x19dc], ecx
push edx
push ecx
add esp, 4
jmp 0x41ec84
jmp 0x41ec8d
call 0x41ec9a
add byte [ecx + 0x3e], cl
inc edi
cmp dh, byte [0xc483423a]
add al, 0x5a
push esi
push edi
add esp, 4
xor esi, 0xb1e3
pop esi
cmp dword [ebp - 0x3e8], 0
je 0x41ecbc
cmp dword [ebp - 0xab8], 0
jne 0x41ed02
push ebx
add ebx, 0x6371
pop ebx
push ebx
xor ebx, 0xe5cd
call 0x41ecd8
add byte [ebx], bh
inc ebx
xor eax, 0x4b463448
add esp, 4
pop ebx
push esi
push esi
add esp, 4
sub esi, 0x789b
and esi, 0x182e3
pop esi
mov edx, dword [ebp - 0x79c]
mov dword [ebp - 0x1990], edx
push 0
call dword [ebp - 0x1990]
mov dword [ebp - 0x20a8], 0xa
push edi
xor edi, 0x11fd0
pop edi
push eax
push edx
add esp, 4
xor eax, 0x36bf
xor eax, 0x817c
call 0x41ed34
add byte [eax], bh
inc esi
cmp dword [edi + eax*2 + 0x47], ecx
aaa
dec esi
cmp eax, dword [ebx - 0x377efb3c]
lea esp, [0x8b580001]
test dword [eax], ebx
cld
invalid
Function at 0x42f820
Capabilities:
Encode data using xor

Disassembly:
adc byte [ebp + 0x101019c], al
mov word [esi + 0xffc5], ss
add dword [esi + edx*4 + 0xffc5], ecx
adc byte [edi - 0x842e97b], bh
add byte [eax], al
xchg cl, al
adc byte [ebp + 0x1010186], al
push esp
pop eax
test ch, al
add eax, 0xd83f482
add dword [ecx], eax
xor ah, 0xd3
mov esi, 0xe4820101
jl 0x42f825
add dword [ecx], eax
sub ah, 0x54
dec esi
add al, byte [ecx]
pop esp
push ecx
sub cl, 0xaa
test byte [edx], al
add dword [edx + 0x1d280f1], eax
add esp, ebp
add eax, 0x36364c40
pop ecx
mov word [esi + 0xfb49], cs
add al, 0x8e
invalid

Function at 0x438e20
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3a8
mov eax, dword [0x594ccc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
xor ecx, ecx
push 0x18e
push ecx
lea edx, [ebp - 0x3a2]
push edx
mov dword [ebp - 0x3a8], eax
mov word [ebp - 0x3a4], cx
call fcn.0051d250
add esp, 0xc
lea eax, [ebp - 0x3a4]
push eax
push 0xc7
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
jne 0x438e83
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051d23b
mov esp, ebp
pop ebp
ret
push edi
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x212]
push edx
mov word [ebp - 0x214], cx
call fcn.0051d250
mov eax, dword [0x561044]
mov cx, word [0x561048]
add esp, 0xc
mov dword [ebp - 0xc], eax
mov word [ebp - 8], cx
lea edi, [ebp - 0x3a4]
push esi
lea esp, [esp]
mov dx, word [edi]
push 0x104
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0xc]
push ecx
mov word [ebp - 0xc], dx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x438f30
lea eax, [ebp - 0x214]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x438ef0
sub eax, edx
sar eax, 1
mov esi, eax
mov edx, 0x5c
mov word [ebp + esi*2 - 0x214], dx
inc esi
push esi
lea ecx, [ebp - 0x214]
push ecx
xor eax, eax
push ebx
mov word [ebp + esi*2 - 0x214], ax
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
je 0x438f53
lea esp, [esp]
mov dx, word [edi]
add edi, 2
test dx, dx
jne 0x438f30
cmp word [edi], dx
jne 0x438ec0
pop esi
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051d23b
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0x10]
lea eax, [ebx + esi*2]
push eax
mov eax, dword [ebp - 0x3a8]
lea ecx, [ebp - 0xc]
push ecx
push 0x561038
push edx
push eax
call fcn.00436ed0
mov ecx, dword [ebp - 4]
add esp, 0x14
pop esi
pop edi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0051d23b
mov esp, ebp
pop ebp
ret