joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f625
Capabilities:
Authenticate hmac
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edi
cmp dword [ebp - 0x210], 0
jne 0x42f54b
push ecx
push edx
add esp, 4
xor ecx, 0x2ce2
pop ecx
push edx
push edx
add esp, 4
sub edx, 0xd0ec
pop edx
push ebx
jmp 0x42f535
call 0x42f542
add byte [ebx], bh
dec ebp
xor eax, 0x344f404b
add esp, 4
pop ebx
jmp 0x431e29
push ebx
push ebx
add esp, 4
call 0x42f55e
add byte [edx], bh
dec ebx
dec eax
inc ecx
cmp byte [edi], bh
inc esi
xor eax, 0x5b04c483
push edi
call 0x42f571
add byte [esi + 0x37], al
dec eax
cmp al, 0x34
xor al, 0x40
cmp dword [ebx + 0x525f04c4], eax
sub edx, 0xdcb6
pop edx
mov ecx, dword [ebp - 0x210]
mov edx, dword [ebp - 0x210]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x2d0], edx
jne 0x42f5cb
push edi
push esi
add esp, 4
xor edi, 0x10ec6
jmp 0x42f5a5
pop edi
push ecx
push ebx
add esp, 4
and ecx, 0x5b7
xor ecx, 0x2ac3
and ecx, 0x6129
jmp 0x42f5c5
pop ecx
jmp 0x431e29
mov eax, dword [ebp - 0x2d0]
mov ecx, dword [eax + 0x50]
mov dword [ebp - 0x3f0], ecx
push edx
push esi
add esp, 4
add edx, 0xb9dd
and edx, 0xf29d
or edx, 0x24e6
sub edx, 0x8f9c
pop edx
push ecx
add ecx, 0x183d8
xor ecx, 0x1529b
add ecx, 0x9ee7
pop ecx
mov edx, dword [ebp - 0x1b0]
mov dword [ebp - 0x218], edx
push esi
call 0x42f625
add byte [ebp + 0x45], cl
cmp ecx, dword [esi + 0x38]
inc ebp
add esp, 4
jmp 0x42f62f
pop esi
push eax
add eax, 0x8f6f
and eax, 0x151d4
sub eax, 0x11b7b
sub eax, 0x10eb7
pop eax
mov eax, dword [ebp - 0x218]
add eax, dword [ebp - 0x3f0]
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x218], 0
je 0x431e1a
cmp dword [ebp - 0x22c], 0
je 0x431e1a
push ebx
push eax
add esp, 4
add ebx, 0xf18d
and ebx, 0xb7e5
or ebx, 0x1753f
pop ebx
push ecx
and ecx, 0x13b51
or ecx, 0x12a96
add ecx, 0x137cc
or ecx, 0xcc56
pop ecx
mov byte [ebp - 0x285], 6
mov byte [ebp - 1], 2
jmp 0x42f6be
Function at 0x4303a7
Capabilities:
Authenticate hmac
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x4303ba
add byte [esi], bh
dec esp
inc esp
aas
dec ebp
dec edi
inc ebp
inc edx
inc ebp
dec edx
add esp, 4
xor edi, 0x11c87
xor edi, 0x176e0
pop edi
movzx ecx, word [ebp - 0x14]
test ecx, ecx
jne 0x4303e7
movzx edx, word [ebp - 0x60]
movzx eax, word [ebp - 0x14]
sub edx, eax
mov dword [ebp - 0x2f4], edx
jmp 0x43046a
movzx ecx, word [ebp - 0x60]
movzx edx, word [ebp - 0x14]
cmp ecx, edx
je 0x4302e0
movzx eax, word [ebp - 0x60]
xor eax, 0x20
movzx ecx, word [ebp - 0x14]
cmp eax, ecx
je 0x4302e0
push ebx
push ebx
add esp, 4
add ebx, 0x103dd
pop ebx
push eax
push ecx
add esp, 4
xor eax, 0x17c01
and eax, 0x33b7
sub eax, 0x13142
pop eax
push ebx
xor ebx, 0xbd88
and ebx, 0x2bb9
pop ebx
movzx edx, word [ebp - 0x60]
movzx eax, word [ebp - 0x14]
cmp edx, eax
jge 0x430454
mov dword [ebp - 0x2f0], 0xffffffff
jmp 0x43045e
mov dword [ebp - 0x2f0], 1
mov ecx, dword [ebp - 0x2f0]
mov dword [ebp - 0x2f4], ecx
cmp dword [ebp - 0x2f4], 0
jne 0x4304b3
push ebx
call 0x430480
add byte [ecx + 0x43], cl
dec ebx
dec esi
dec ebx
aas
add esp, 4
add ebx, 0x41e
call 0x430499
add byte [esi + edi], bh
dec ecx
cmp dword [esi + 0x3e], eax
xor al, byte [ebp + 0x40]
xor eax, dword [ebx + 0x565b04c4]
and esi, 0x17b66
pop esi
mov edx, dword [ebp - 0xa0]
mov dword [ebp - 0x70], edx
jmp 0x43054a
mov eax, dword [ebp - 0xa0]
mov ecx, dword [eax]
mov dword [ebp - 0xa0], ecx
push ebx
call 0x4304d1
add byte [ebx], bh
dec ebp
inc esp
aas
cmp esi, dword [edx]
inc ebx
inc esi
inc esp
add esp, 4
add ebx, 0xc48d
sub ebx, 0xaf06
pop ebx
push ecx
push edi
add esp, 4
xor ecx, 0xdb90
and ecx, 0xc807
pop ecx
mov edx, dword [ebp - 0xa0]
cmp edx, dword [ebp - 0x238]
je 0x430511
mov eax, dword [ebp - 0xa0]
cmp dword [eax + 0x30], 0
jne 0x430255
push ebx
or ebx, 0x16d40
or ebx, 0x1086c
pop ebx
push eax
push edx
add esp, 4
and eax, 0x1002d
jmp 0x430530
add eax, 0x3513
pop eax
push eax
push ecx
add esp, 4
sub eax, 0x34b6
pop eax
mov dword [ebp - 0x70], 0
Function at 0x4303ba
Capabilities:
Authenticate hmac
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x4303ba
add byte [esi], bh
dec esp
inc esp
aas
dec ebp
dec edi
inc ebp
inc edx
inc ebp
dec edx
add esp, 4
xor edi, 0x11c87
xor edi, 0x176e0
pop edi
movzx ecx, word [ebp - 0x14]
test ecx, ecx
jne 0x4303e7
movzx edx, word [ebp - 0x60]
movzx eax, word [ebp - 0x14]
sub edx, eax
mov dword [ebp - 0x2f4], edx
jmp 0x43046a
movzx ecx, word [ebp - 0x60]
movzx edx, word [ebp - 0x14]
cmp ecx, edx
je 0x4302e0
movzx eax, word [ebp - 0x60]
xor eax, 0x20
movzx ecx, word [ebp - 0x14]
cmp eax, ecx
je 0x4302e0
push ebx
push ebx
add esp, 4
add ebx, 0x103dd
pop ebx
push eax
push ecx
add esp, 4
xor eax, 0x17c01
and eax, 0x33b7
sub eax, 0x13142
pop eax
push ebx
xor ebx, 0xbd88
and ebx, 0x2bb9
pop ebx
movzx edx, word [ebp - 0x60]
movzx eax, word [ebp - 0x14]
cmp edx, eax
jge 0x430454
mov dword [ebp - 0x2f0], 0xffffffff
jmp 0x43045e
mov dword [ebp - 0x2f0], 1
mov ecx, dword [ebp - 0x2f0]
mov dword [ebp - 0x2f4], ecx
cmp dword [ebp - 0x2f4], 0
jne 0x4304b3
push ebx
call 0x430480
add byte [ecx + 0x43], cl
dec ebx
dec esi
dec ebx
aas
add esp, 4
add ebx, 0x41e
call 0x430499
add byte [esi + edi], bh
dec ecx
cmp dword [esi + 0x3e], eax
xor al, byte [ebp + 0x40]
xor eax, dword [ebx + 0x565b04c4]
and esi, 0x17b66
pop esi
mov edx, dword [ebp - 0xa0]
mov dword [ebp - 0x70], edx
jmp 0x43054a
mov eax, dword [ebp - 0xa0]
mov ecx, dword [eax]
mov dword [ebp - 0xa0], ecx
push ebx
call 0x4304d1
add byte [ebx], bh
dec ebp
inc esp
aas
cmp esi, dword [edx]
inc ebx
inc esi
inc esp
add esp, 4
add ebx, 0xc48d
sub ebx, 0xaf06
pop ebx
push ecx
push edi
add esp, 4
xor ecx, 0xdb90
and ecx, 0xc807
pop ecx
mov edx, dword [ebp - 0xa0]
cmp edx, dword [ebp - 0x238]
je 0x430511
mov eax, dword [ebp - 0xa0]
cmp dword [eax + 0x30], 0
jne 0x430255
push ebx
or ebx, 0x16d40
or ebx, 0x1086c
pop ebx
push eax
push edx
add esp, 4
and eax, 0x1002d
jmp 0x430530
add eax, 0x3513
pop eax
push eax
push ecx
add esp, 4
sub eax, 0x34b6
pop eax
mov dword [ebp - 0x70], 0
Function at 0x430480
Capabilities:
Authenticate hmac
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x4303ba
add byte [esi], bh
dec esp
inc esp
aas
dec ebp
dec edi
inc ebp
inc edx
inc ebp
dec edx
add esp, 4
xor edi, 0x11c87
xor edi, 0x176e0
pop edi
movzx ecx, word [ebp - 0x14]
test ecx, ecx
jne 0x4303e7
movzx edx, word [ebp - 0x60]
movzx eax, word [ebp - 0x14]
sub edx, eax
mov dword [ebp - 0x2f4], edx
jmp 0x43046a
movzx ecx, word [ebp - 0x60]
movzx edx, word [ebp - 0x14]
cmp ecx, edx
je 0x4302e0
movzx eax, word [ebp - 0x60]
xor eax, 0x20
movzx ecx, word [ebp - 0x14]
cmp eax, ecx
je 0x4302e0
push ebx
push ebx
add esp, 4
add ebx, 0x103dd
pop ebx
push eax
push ecx
add esp, 4
xor eax, 0x17c01
and eax, 0x33b7
sub eax, 0x13142
pop eax
push ebx
xor ebx, 0xbd88
and ebx, 0x2bb9
pop ebx
movzx edx, word [ebp - 0x60]
movzx eax, word [ebp - 0x14]
cmp edx, eax
jge 0x430454
mov dword [ebp - 0x2f0], 0xffffffff
jmp 0x43045e
mov dword [ebp - 0x2f0], 1
mov ecx, dword [ebp - 0x2f0]
mov dword [ebp - 0x2f4], ecx
cmp dword [ebp - 0x2f4], 0
jne 0x4304b3
push ebx
call 0x430480
add byte [ecx + 0x43], cl
dec ebx
dec esi
dec ebx
aas
add esp, 4
add ebx, 0x41e
call 0x430499
add byte [esi + edi], bh
dec ecx
cmp dword [esi + 0x3e], eax
xor al, byte [ebp + 0x40]
xor eax, dword [ebx + 0x565b04c4]
and esi, 0x17b66
pop esi
mov edx, dword [ebp - 0xa0]
mov dword [ebp - 0x70], edx
jmp 0x43054a
mov eax, dword [ebp - 0xa0]
mov ecx, dword [eax]
mov dword [ebp - 0xa0], ecx
push ebx
call 0x4304d1
add byte [ebx], bh
dec ebp
inc esp
aas
cmp esi, dword [edx]
inc ebx
inc esi
inc esp
add esp, 4
add ebx, 0xc48d
sub ebx, 0xaf06
pop ebx
push ecx
push edi
add esp, 4
xor ecx, 0xdb90
and ecx, 0xc807
pop ecx
mov edx, dword [ebp - 0xa0]
cmp edx, dword [ebp - 0x238]
je 0x430511
mov eax, dword [ebp - 0xa0]
cmp dword [eax + 0x30], 0
jne 0x430255
push ebx
or ebx, 0x16d40
or ebx, 0x1086c
pop ebx
push eax
push edx
add esp, 4
and eax, 0x1002d
jmp 0x430530
add eax, 0x3513
pop eax
push eax
push ecx
add esp, 4
sub eax, 0x34b6
pop eax
mov dword [ebp - 0x70], 0
Function at 0x430499
Capabilities:
Authenticate hmac
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x4303ba
add byte [esi], bh
dec esp
inc esp
aas
dec ebp
dec edi
inc ebp
inc edx
inc ebp
dec edx
add esp, 4
xor edi, 0x11c87
xor edi, 0x176e0
pop edi
movzx ecx, word [ebp - 0x14]
test ecx, ecx
jne 0x4303e7
movzx edx, word [ebp - 0x60]
movzx eax, word [ebp - 0x14]
sub edx, eax
mov dword [ebp - 0x2f4], edx
jmp 0x43046a
movzx ecx, word [ebp - 0x60]
movzx edx, word [ebp - 0x14]
cmp ecx, edx
je 0x4302e0
movzx eax, word [ebp - 0x60]
xor eax, 0x20
movzx ecx, word [ebp - 0x14]
cmp eax, ecx
je 0x4302e0
push ebx
push ebx
add esp, 4
add ebx, 0x103dd
pop ebx
push eax
push ecx
add esp, 4
xor eax, 0x17c01
and eax, 0x33b7
sub eax, 0x13142
pop eax
push ebx
xor ebx, 0xbd88
and ebx, 0x2bb9
pop ebx
movzx edx, word [ebp - 0x60]
movzx eax, word [ebp - 0x14]
cmp edx, eax
jge 0x430454
mov dword [ebp - 0x2f0], 0xffffffff
jmp 0x43045e
mov dword [ebp - 0x2f0], 1
mov ecx, dword [ebp - 0x2f0]
mov dword [ebp - 0x2f4], ecx
cmp dword [ebp - 0x2f4], 0
jne 0x4304b3
push ebx
call 0x430480
add byte [ecx + 0x43], cl
dec ebx
dec esi
dec ebx
aas
add esp, 4
add ebx, 0x41e
call 0x430499
add byte [esi + edi], bh
dec ecx
cmp dword [esi + 0x3e], eax
xor al, byte [ebp + 0x40]
xor eax, dword [ebx + 0x565b04c4]
and esi, 0x17b66
pop esi
mov edx, dword [ebp - 0xa0]
mov dword [ebp - 0x70], edx
jmp 0x43054a
mov eax, dword [ebp - 0xa0]
mov ecx, dword [eax]
mov dword [ebp - 0xa0], ecx
push ebx
call 0x4304d1
add byte [ebx], bh
dec ebp
inc esp
aas
cmp esi, dword [edx]
inc ebx
inc esi
inc esp
add esp, 4
add ebx, 0xc48d
sub ebx, 0xaf06
pop ebx
push ecx
push edi
add esp, 4
xor ecx, 0xdb90
and ecx, 0xc807
pop ecx
mov edx, dword [ebp - 0xa0]
cmp edx, dword [ebp - 0x238]
je 0x430511
mov eax, dword [ebp - 0xa0]
cmp dword [eax + 0x30], 0
jne 0x430255
push ebx
or ebx, 0x16d40
or ebx, 0x1086c
pop ebx
push eax
push edx
add esp, 4
and eax, 0x1002d
jmp 0x430530
add eax, 0x3513
pop eax
push eax
push ecx
add esp, 4
sub eax, 0x34b6
pop eax
mov dword [ebp - 0x70], 0
Function at 0x4304d1
Capabilities:
Authenticate hmac
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x4303ba
add byte [esi], bh
dec esp
inc esp
aas
dec ebp
dec edi
inc ebp
inc edx
inc ebp
dec edx
add esp, 4
xor edi, 0x11c87
xor edi, 0x176e0
pop edi
movzx ecx, word [ebp - 0x14]
test ecx, ecx
jne 0x4303e7
movzx edx, word [ebp - 0x60]
movzx eax, word [ebp - 0x14]
sub edx, eax
mov dword [ebp - 0x2f4], edx
jmp 0x43046a
movzx ecx, word [ebp - 0x60]
movzx edx, word [ebp - 0x14]
cmp ecx, edx
je 0x4302e0
movzx eax, word [ebp - 0x60]
xor eax, 0x20
movzx ecx, word [ebp - 0x14]
cmp eax, ecx
je 0x4302e0
push ebx
push ebx
add esp, 4
add ebx, 0x103dd
pop ebx
push eax
push ecx
add esp, 4
xor eax, 0x17c01
and eax, 0x33b7
sub eax, 0x13142
pop eax
push ebx
xor ebx, 0xbd88
and ebx, 0x2bb9
pop ebx
movzx edx, word [ebp - 0x60]
movzx eax, word [ebp - 0x14]
cmp edx, eax
jge 0x430454
mov dword [ebp - 0x2f0], 0xffffffff
jmp 0x43045e
mov dword [ebp - 0x2f0], 1
mov ecx, dword [ebp - 0x2f0]
mov dword [ebp - 0x2f4], ecx
cmp dword [ebp - 0x2f4], 0
jne 0x4304b3
push ebx
call 0x430480
add byte [ecx + 0x43], cl
dec ebx
dec esi
dec ebx
aas
add esp, 4
add ebx, 0x41e
call 0x430499
add byte [esi + edi], bh
dec ecx
cmp dword [esi + 0x3e], eax
xor al, byte [ebp + 0x40]
xor eax, dword [ebx + 0x565b04c4]
and esi, 0x17b66
pop esi
mov edx, dword [ebp - 0xa0]
mov dword [ebp - 0x70], edx
jmp 0x43054a
mov eax, dword [ebp - 0xa0]
mov ecx, dword [eax]
mov dword [ebp - 0xa0], ecx
push ebx
call 0x4304d1
add byte [ebx], bh
dec ebp
inc esp
aas
cmp esi, dword [edx]
inc ebx
inc esi
inc esp
add esp, 4
add ebx, 0xc48d
sub ebx, 0xaf06
pop ebx
push ecx
push edi
add esp, 4
xor ecx, 0xdb90
and ecx, 0xc807
pop ecx
mov edx, dword [ebp - 0xa0]
cmp edx, dword [ebp - 0x238]
je 0x430511
mov eax, dword [ebp - 0xa0]
cmp dword [eax + 0x30], 0
jne 0x430255
push ebx
or ebx, 0x16d40
or ebx, 0x1086c
pop ebx
push eax
push edx
add esp, 4
and eax, 0x1002d
jmp 0x430530
add eax, 0x3513
pop eax
push eax
push ecx
add esp, 4
sub eax, 0x34b6
pop eax
mov dword [ebp - 0x70], 0
Function at 0x430c38
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop eax
push esi
push esi
add esp, 4
or esi, 0x4c14
add esi, 0x124d8
jmp 0x430c56
pop esi
mov edx, dword [ebp - 0xfc]
mov dword [ebp - 0x94], edx
jmp 0x431157
cmp dword [ebp - 0x94], 0
je 0x431200
push edi
or edi, 0xaf94
and edi, 0x9432
add edi, 0x1166c
and edi, 0xb85
pop edi
push ebx
push edx
add esp, 4
sub ebx, 0x11310
pop ebx
push eax
push ecx
add esp, 4
and eax, 0x57aa
pop eax
mov edx, dword [ebp - 0x94]
mov dword [ebp - 0x414], edx
mov eax, dword [ebp - 0x414]
mov dword [ebp - 0x418], eax
lea ecx, [ebp - 0x2b0]
push ecx
call dword [ebp - 0x418]
test eax, eax
jne 0x431200
push ecx
push ecx
add esp, 4
xor ecx, 0x638c
add ecx, 0x158ee
pop ecx
push ecx
xor ecx, 0x9097
pop ecx
push ebx
push edx
add esp, 4
add ebx, 0xb30c
xor ebx, 0x552f
or ebx, 0xa79a
pop ebx
mov dword [ebp - 0x1bc], 0
jmp 0x431ca7

Function at 0x430cfd
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
sub edi, 0x171c5
pop edi
push esi
and esi, 0x6db1
and esi, 0x2cfb
pop esi
mov ecx, dword [ebp - 0xfc]
mov dword [ebp - 0x94], ecx
jmp 0x431157

Function at 0x430d94
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
and esi, 0x112a7
pop esi
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x94], eax
jmp 0x431157

Function at 0x430dd9
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edi
push ecx
and ecx, 0xb7cd
call 0x430df2
add byte [eax + 0x48], cl
inc ebp
xor al, 0x34
xor al, byte [ecx - 0x7d]
les eax, [ecx + ebx*2]
mov eax, dword [ebp - 0xf0]
mov ecx, dword [ebp - 0x84]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x408], ecx
push esi
push ecx
add esp, 4
sub esi, 0x9989
pop esi
push eax
and eax, 0x1027a
or eax, 0x15de8
sub eax, 0xcf1
and eax, 0xb5b0
pop eax
push eax
push ebx
add esp, 4
and eax, 0xe31e
pop eax
mov edx, dword [ebp - 0xf0]
mov eax, dword [ebp - 0x84]
add eax, dword [edx + 0x1c]
mov dword [ebp - 0x40c], eax
mov dword [ebp - 0xf4], 0
jmp 0x430e6d
mov edx, dword [ebp - 0xf0]
mov eax, dword [ebp - 0xf4]
cmp eax, dword [edx + 0x18]
jae 0x43114b
push esi
sub esi, 0x151f6
or esi, 0x11971
xor esi, 0xe3a7
and esi, 0x10ba2
pop esi
push edi
push esi
add esp, 4
add edi, 0x35be
add edi, 0x10765
and edi, 0xde50
pop edi
mov ecx, dword [ebp - 0xf4]
mov edx, dword [ebp - 0x404]
mov eax, dword [ebp - 0x84]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0xf8], eax
push eax
push ecx
add esp, 4
add eax, 0xb1a4
or eax, 0x125b8
pop eax
push edx
call 0x430ef1
add byte [ebx + 0x37], al
cmp eax, 0x5050454d
inc ebp
xor eax, dword [ebx - 0x1d7efb3c]
inc ecx
adc al, byte [eax]
add byte [ecx + 0x177b3c2], al
add byte [edx - 0x75], bl
lea ecx, [edi + edi*8]
invalid
mov ecx, dword [ebp - 0xfc]
mov dword [ebp - 0x94], ecx
Function at 0x430df2
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edi
push ecx
and ecx, 0xb7cd
call 0x430df2
add byte [eax + 0x48], cl
inc ebp
xor al, 0x34
xor al, byte [ecx - 0x7d]
les eax, [ecx + ebx*2]
mov eax, dword [ebp - 0xf0]
mov ecx, dword [ebp - 0x84]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x408], ecx
push esi
push ecx
add esp, 4
sub esi, 0x9989
pop esi
push eax
and eax, 0x1027a
or eax, 0x15de8
sub eax, 0xcf1
and eax, 0xb5b0
pop eax
push eax
push ebx
add esp, 4
and eax, 0xe31e
pop eax
mov edx, dword [ebp - 0xf0]
mov eax, dword [ebp - 0x84]
add eax, dword [edx + 0x1c]
mov dword [ebp - 0x40c], eax
mov dword [ebp - 0xf4], 0
jmp 0x430e6d
mov edx, dword [ebp - 0xf0]
mov eax, dword [ebp - 0xf4]
cmp eax, dword [edx + 0x18]
jae 0x43114b
push esi
sub esi, 0x151f6
or esi, 0x11971
xor esi, 0xe3a7
and esi, 0x10ba2
pop esi
push edi
push esi
add esp, 4
add edi, 0x35be
add edi, 0x10765
and edi, 0xde50
pop edi
mov ecx, dword [ebp - 0xf4]
mov edx, dword [ebp - 0x404]
mov eax, dword [ebp - 0x84]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0xf8], eax
push eax
push ecx
add esp, 4
add eax, 0xb1a4
or eax, 0x125b8
pop eax
push edx
call 0x430ef1
add byte [ebx + 0x37], al
cmp eax, 0x5050454d
inc ebp
xor eax, dword [ebx - 0x1d7efb3c]
inc ecx
adc al, byte [eax]
add byte [ecx + 0x177b3c2], al
add byte [edx - 0x75], bl
lea ecx, [edi + edi*8]
invalid
mov ecx, dword [ebp - 0xfc]
mov dword [ebp - 0x94], ecx

Function at 0x430ef1
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edi
push ecx
and ecx, 0xb7cd
call 0x430df2
add byte [eax + 0x48], cl
inc ebp
xor al, 0x34
xor al, byte [ecx - 0x7d]
les eax, [ecx + ebx*2]
mov eax, dword [ebp - 0xf0]
mov ecx, dword [ebp - 0x84]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x408], ecx
push esi
push ecx
add esp, 4
sub esi, 0x9989
pop esi
push eax
and eax, 0x1027a
or eax, 0x15de8
sub eax, 0xcf1
and eax, 0xb5b0
pop eax
push eax
push ebx
add esp, 4
and eax, 0xe31e
pop eax
mov edx, dword [ebp - 0xf0]
mov eax, dword [ebp - 0x84]
add eax, dword [edx + 0x1c]
mov dword [ebp - 0x40c], eax
mov dword [ebp - 0xf4], 0
jmp 0x430e6d
mov edx, dword [ebp - 0xf0]
mov eax, dword [ebp - 0xf4]
cmp eax, dword [edx + 0x18]
jae 0x43114b
push esi
sub esi, 0x151f6
or esi, 0x11971
xor esi, 0xe3a7
and esi, 0x10ba2
pop esi
push edi
push esi
add esp, 4
add edi, 0x35be
add edi, 0x10765
and edi, 0xde50
pop edi
mov ecx, dword [ebp - 0xf4]
mov edx, dword [ebp - 0x404]
mov eax, dword [ebp - 0x84]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0xf8], eax
push eax
push ecx
add esp, 4
add eax, 0xb1a4
or eax, 0x125b8
pop eax
push edx
call 0x430ef1
add byte [ebx + 0x37], al
cmp eax, 0x5050454d
inc ebp
xor eax, dword [ebx - 0x1d7efb3c]
inc ecx
adc al, byte [eax]
add byte [ecx + 0x177b3c2], al
add byte [edx - 0x75], bl
lea ecx, [edi + edi*8]
invalid
mov ecx, dword [ebp - 0xfc]
mov dword [ebp - 0x94], ecx
Function at 0x430f3a
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ebp - 0xf4]
add ecx, 1
mov dword [ebp - 0xf4], ecx
add esp, 4
pop edi
push edx
push edx
add esp, 4
sub edx, 0x17b23
jmp 0x430f51
xor edx, 0x1794b
pop edx
mov dword [ebp - 0x38], 0
jmp 0x430f6a
mov eax, dword [ebp - 0x38]
add eax, 1
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0xf8]
add ecx, dword [ebp - 0x38]
movsx edx, byte [ecx]
test edx, edx
je 0x431006
mov eax, dword [ebp - 0x38]
movsx ecx, byte [ebp + eax - 0x164]
test ecx, ecx
je 0x431006
push ecx
add ecx, 0x16dae
or ecx, 0x1008b
or ecx, 0xd8c8
pop ecx
push edx
push eax
add esp, 4
add edx, 0xfd4
or edx, 0x3040
xor edx, 0x5ab1
or edx, 0x7045
pop edx
mov edx, dword [ebp - 0xf8]
add edx, dword [ebp - 0x38]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x38]
movsx edx, byte [ebp + ecx - 0x164]
cmp eax, edx
je 0x430ff8
mov eax, dword [ebp - 0xf8]
add eax, dword [ebp - 0x38]
movsx ecx, byte [eax]
xor ecx, 0x20
mov edx, dword [ebp - 0x38]
movsx eax, byte [ebp + edx - 0x164]
cmp ecx, eax
jne 0x430fff
jmp 0x430f61
jmp 0x431006
push ebx
xor ebx, 0x10e2e
add ebx, 0xba86
pop ebx
push ecx
push esi
add esp, 4
xor ecx, 0x2406
pop ecx
push ebx
call 0x43102f
add byte [esi], dh
cmp eax, dword [esi + edi + 0x34]
dec ecx
xor al, 0x37
add esp, 4
jmp 0x431037
pop ebx
mov ecx, dword [ebp - 0xf8]
add ecx, dword [ebp - 0x38]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x38]
movsx ecx, byte [ebp + eax - 0x164]
cmp edx, ecx
jne 0x431062
mov dword [ebp - 0x248], 0
jmp 0x4310fd
push ebx
xor ebx, 0x961b
or ebx, 0xb45a
call 0x43107c
add byte [edx + 0x47], al
inc esp
cmp dword [esi + 0x35], ecx
cmp eax, dword [ebx + 0x575b04c4]
or edi, 0x131c6
pop edi
push ecx
push esi
add esp, 4
add ecx, 0x581a
pop ecx
mov edx, dword [ebp - 0xf8]
add edx, dword [ebp - 0x38]
movsx eax, byte [edx]
or eax, 0x20
mov ecx, dword [ebp - 0x38]
movsx edx, byte [ebp + ecx - 0x164]
or edx, 0x20
cmp eax, edx
jge 0x4310c1
mov dword [ebp - 0x248], 0xffffffff
jmp 0x4310fd
push ecx
push edi
add esp, 4
xor ecx, 0x10518
xor ecx, 0xa88e
sub ecx, 0x2710
pop ecx
push edi
and edi, 0xad95
and edi, 0xf8ad
add edi, 0x2f5a
sub edi, 0xd40b
pop edi
mov dword [ebp - 0x248], 1
cmp dword [ebp - 0x248], 0
jne 0x431146
push edi
push esi
add esp, 4
add edi, 0x18370
add edi, 0x11fda
sub edi, 0x14d62
pop edi
push edi
and edi, 0x11d47
add edi, 0x142fb
add edi, 0x1411b
or edi, 0x907b
pop edi
mov eax, dword [ebp - 0x410]
mov dword [ebp - 0x94], eax
jmp 0x431157
jmp 0x430e5e
Function at 0x43102f
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ebp - 0xf4]
add ecx, 1
mov dword [ebp - 0xf4], ecx
add esp, 4
pop edi
push edx
push edx
add esp, 4
sub edx, 0x17b23
jmp 0x430f51
xor edx, 0x1794b
pop edx
mov dword [ebp - 0x38], 0
jmp 0x430f6a
mov eax, dword [ebp - 0x38]
add eax, 1
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0xf8]
add ecx, dword [ebp - 0x38]
movsx edx, byte [ecx]
test edx, edx
je 0x431006
mov eax, dword [ebp - 0x38]
movsx ecx, byte [ebp + eax - 0x164]
test ecx, ecx
je 0x431006
push ecx
add ecx, 0x16dae
or ecx, 0x1008b
or ecx, 0xd8c8
pop ecx
push edx
push eax
add esp, 4
add edx, 0xfd4
or edx, 0x3040
xor edx, 0x5ab1
or edx, 0x7045
pop edx
mov edx, dword [ebp - 0xf8]
add edx, dword [ebp - 0x38]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x38]
movsx edx, byte [ebp + ecx - 0x164]
cmp eax, edx
je 0x430ff8
mov eax, dword [ebp - 0xf8]
add eax, dword [ebp - 0x38]
movsx ecx, byte [eax]
xor ecx, 0x20
mov edx, dword [ebp - 0x38]
movsx eax, byte [ebp + edx - 0x164]
cmp ecx, eax
jne 0x430fff
jmp 0x430f61
jmp 0x431006
push ebx
xor ebx, 0x10e2e
add ebx, 0xba86
pop ebx
push ecx
push esi
add esp, 4
xor ecx, 0x2406
pop ecx
push ebx
call 0x43102f
add byte [esi], dh
cmp eax, dword [esi + edi + 0x34]
dec ecx
xor al, 0x37
add esp, 4
jmp 0x431037
pop ebx
mov ecx, dword [ebp - 0xf8]
add ecx, dword [ebp - 0x38]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x38]
movsx ecx, byte [ebp + eax - 0x164]
cmp edx, ecx
jne 0x431062
mov dword [ebp - 0x248], 0
jmp 0x4310fd
push ebx
xor ebx, 0x961b
or ebx, 0xb45a
call 0x43107c
add byte [edx + 0x47], al
inc esp
cmp dword [esi + 0x35], ecx
cmp eax, dword [ebx + 0x575b04c4]
or edi, 0x131c6
pop edi
push ecx
push esi
add esp, 4
add ecx, 0x581a
pop ecx
mov edx, dword [ebp - 0xf8]
add edx, dword [ebp - 0x38]
movsx eax, byte [edx]
or eax, 0x20
mov ecx, dword [ebp - 0x38]
movsx edx, byte [ebp + ecx - 0x164]
or edx, 0x20
cmp eax, edx
jge 0x4310c1
mov dword [ebp - 0x248], 0xffffffff
jmp 0x4310fd
push ecx
push edi
add esp, 4
xor ecx, 0x10518
xor ecx, 0xa88e
sub ecx, 0x2710
pop ecx
push edi
and edi, 0xad95
and edi, 0xf8ad
add edi, 0x2f5a
sub edi, 0xd40b
pop edi
mov dword [ebp - 0x248], 1
cmp dword [ebp - 0x248], 0
jne 0x431146
push edi
push esi
add esp, 4
add edi, 0x18370
add edi, 0x11fda
sub edi, 0x14d62
pop edi
push edi
and edi, 0x11d47
add edi, 0x142fb
add edi, 0x1411b
or edi, 0x907b
pop edi
mov eax, dword [ebp - 0x410]
mov dword [ebp - 0x94], eax
jmp 0x431157
jmp 0x430e5e