joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46ca06
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov word [ebp - 0x172e], cx
mov edx, 0x65
mov word [ebp - 0x172c], dx
mov eax, 0x6c
mov word [ebp - 0x172a], ax
mov ecx, 0x33
xor eax, dword [eax]
add byte [eax], al
mov word [ebp - 0x1728], cx
mov edx, 0x32
mov word [ebp - 0x1726], dx
mov eax, 0x2e
mov word [ebp - 0x1724], ax
mov ecx, 0x64
mov word [ebp - 0x1722], cx
mov edx, 0x6c
mov word [ebp - 0x1720], dx
mov eax, 0x6c
mov word [ebp - 0x171e], ax
xor ecx, ecx
mov word [ebp - 0x171c], cx
push eax
push edx
add esp, 4
sub eax, 0x4abe
pop eax
push edi
add edi, 0xae34
pop edi
push ecx
push edx
add esp, 4
xor ecx, 0x163b3
add ecx, 0x16bf6
add ecx, 0x348e
or ecx, 0x8d68
pop ecx
push ecx
push ecx
add esp, 4
or ecx, 0x16019
add ecx, 0x107e8
and ecx, 0x9148
xor ecx, 0xf118
pop ecx
push ebx
or ebx, 0x10c54
and ebx, 0x15d07
and ebx, 0x2bcf
pop ebx
mov edx, dword fs:[0x18]
mov dword [ebp - 0x1ff4], edx
mov eax, dword [ebp - 0x1ff4]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x1950], ecx
mov edx, dword [ebp - 0x1950]
mov dword [ebp - 0x159c], edx
push edi
and edi, 0x18345
add edi, 0x78c1
or edi, 0x13672
pop edi
push ecx
xor ecx, 0xbc0c
xor ecx, 0x61e8
call 0x46c95a
add byte [esi], dh
xor al, byte [esi + 0x4c]
aaa
inc ecx
xor eax, 0x5904c483
cmp dword [ebp - 0x159c], 0
jne 0x46c976
mov dword [ebp - 0x318], 0
jmp 0x46cc32
mov eax, dword [ebp - 0x159c]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xc98], edx
push esi
push ecx
add esp, 4
add esi, 0xc31d
call 0x46c9a2
add byte [ebx], bh
cmp dword [ecx + 0x32], ecx
inc ebx
cmp esi, dword [edi]
inc esi
add esp, 4
add esi, 0x971b
pop esi
push edx
or edx, 0xc625
sub edx, 0x126cf
pop edx
cmp dword [ebp - 0xc98], 0
jne 0x46c9d2
mov dword [ebp - 0x318], 0
jmp 0x46cc32
mov eax, dword [ebp - 0xc98]
mov dword [ebp - 0x504], eax
push eax
jmp 0x46c9e6
xor eax, 0x77c8
xor eax, 0x12383
and eax, 0x1424b
pop eax
push eax
call 0x46ca06
add byte [ebx], bh
dec esi
inc edi
cmp edi, dword [ebx]
cmp al, 0x83
les eax, [ecx + eax*4]
enter 0x5f79, 1
add byte [eax - 0x73], bl
invalid
push ecx
jmp 0x46cc39
pop ecx
push esi
push edx
add esp, 4
jmp 0x46cc48
xor esi, 0x13185
call 0x46cc5a
add byte [0x383d3548], dh
cmp eax, dword [ebx - 0x397efb3c]
retf 0xb
Function at 0x46ca54
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edi
and edi, 0xf44f
call fcn.0046ca54
add byte [edi + 0x32], cl
inc edx
inc edx
inc esi
inc ebp
xor eax, 0x833f4a47
add esp, 4
pop edi
add esp, 4
pop edi
push eax
call 0x46ca65
add byte [edx + 0x44], al
aaa
inc eax
aas
inc esi
add esp, 4
add eax, 0xa0c2
pop eax
mov eax, dword [ebp - 0xc90]
mov cx, word [eax]
mov word [ebp - 0x1032], cx
mov edx, dword [ebp - 0xc90]
add edx, 2
mov dword [ebp - 0xc90], edx
mov ax, word [ebp - 0x1032]
mov word [ebp - 0x20c], ax
mov ecx, dword [ebp - 0xc94]
mov dx, word [ecx]
mov word [ebp - 0x1034], dx
mov eax, dword [ebp - 0xc94]
add eax, 2
mov dword [ebp - 0xc94], eax
mov cx, word [ebp - 0x1034]
mov word [ebp - 0x10c], cx
push ecx
push edi
add esp, 4
jmp 0x46cad4
or ecx, 0x683a
add ecx, 0x16da2
xor ecx, 0x18445
pop ecx
push esi
or esi, 0xf202
and esi, 0x9eab
sub esi, 0xfb78
pop esi
movzx edx, word [ebp - 0x10c]
test edx, edx
jne 0x46cb1e
movzx eax, word [ebp - 0x20c]
movzx ecx, word [ebp - 0x10c]
sub eax, ecx
mov dword [ebp - 0x15d8], eax
jmp 0x46cb81
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x10c]
cmp edx, eax
je 0x46ca3d
movzx ecx, word [ebp - 0x20c]
xor ecx, 0x20
movzx edx, word [ebp - 0x10c]
cmp ecx, edx
je 0x46ca3d
movzx eax, word [ebp - 0x20c]
movzx ecx, word [ebp - 0x10c]
cmp eax, ecx
jge 0x46cb6b
mov dword [ebp - 0x15d4], 0xffffffff
jmp 0x46cb75
mov dword [ebp - 0x15d4], 1
mov edx, dword [ebp - 0x15d4]
mov dword [ebp - 0x15d8], edx
cmp dword [ebp - 0x15d8], 0
jne 0x46cbca
push edx
push eax
add esp, 4
and edx, 0x13b5f
or edx, 0x3378
pop edx
push edx
push edx
add esp, 4
xor edx, 0x13e93
or edx, 0x11e0
pop edx
push ebx
or ebx, 0x9bed
or ebx, 0x16b5b
pop ebx
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0x318], eax
jmp 0x46cc32
push esi
sub esi, 0x619e
xor esi, 0xd82a
sub esi, 0xb859
pop esi
push edi
push edi
add esp, 4
and edi, 0x41b6
jmp 0x46cbf0
jmp 0x46cbf5
or edi, 0x12923
pop edi
mov ecx, dword [ebp - 0x504]
mov edx, dword [ecx]
mov dword [ebp - 0x504], edx
mov eax, dword [ebp - 0x504]
cmp eax, dword [ebp - 0xc98]
je 0x46cc28
mov ecx, dword [ebp - 0x504]
cmp dword [ecx + 0x30], 0
jne 0x46c9de
mov dword [ebp - 0x318], 0
Function at 0x46ca65
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edi
and edi, 0xf44f
call fcn.0046ca54
add byte [edi + 0x32], cl
inc edx
inc edx
inc esi
inc ebp
xor eax, 0x833f4a47
add esp, 4
pop edi
add esp, 4
pop edi
push eax
call 0x46ca65
add byte [edx + 0x44], al
aaa
inc eax
aas
inc esi
add esp, 4
add eax, 0xa0c2
pop eax
mov eax, dword [ebp - 0xc90]
mov cx, word [eax]
mov word [ebp - 0x1032], cx
mov edx, dword [ebp - 0xc90]
add edx, 2
mov dword [ebp - 0xc90], edx
mov ax, word [ebp - 0x1032]
mov word [ebp - 0x20c], ax
mov ecx, dword [ebp - 0xc94]
mov dx, word [ecx]
mov word [ebp - 0x1034], dx
mov eax, dword [ebp - 0xc94]
add eax, 2
mov dword [ebp - 0xc94], eax
mov cx, word [ebp - 0x1034]
mov word [ebp - 0x10c], cx
push ecx
push edi
add esp, 4
jmp 0x46cad4
or ecx, 0x683a
add ecx, 0x16da2
xor ecx, 0x18445
pop ecx
push esi
or esi, 0xf202
and esi, 0x9eab
sub esi, 0xfb78
pop esi
movzx edx, word [ebp - 0x10c]
test edx, edx
jne 0x46cb1e
movzx eax, word [ebp - 0x20c]
movzx ecx, word [ebp - 0x10c]
sub eax, ecx
mov dword [ebp - 0x15d8], eax
jmp 0x46cb81
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x10c]
cmp edx, eax
je 0x46ca3d
movzx ecx, word [ebp - 0x20c]
xor ecx, 0x20
movzx edx, word [ebp - 0x10c]
cmp ecx, edx
je 0x46ca3d
movzx eax, word [ebp - 0x20c]
movzx ecx, word [ebp - 0x10c]
cmp eax, ecx
jge 0x46cb6b
mov dword [ebp - 0x15d4], 0xffffffff
jmp 0x46cb75
mov dword [ebp - 0x15d4], 1
mov edx, dword [ebp - 0x15d4]
mov dword [ebp - 0x15d8], edx
cmp dword [ebp - 0x15d8], 0
jne 0x46cbca
push edx
push eax
add esp, 4
and edx, 0x13b5f
or edx, 0x3378
pop edx
push edx
push edx
add esp, 4
xor edx, 0x13e93
or edx, 0x11e0
pop edx
push ebx
or ebx, 0x9bed
or ebx, 0x16b5b
pop ebx
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0x318], eax
jmp 0x46cc32
push esi
sub esi, 0x619e
xor esi, 0xd82a
sub esi, 0xb859
pop esi
push edi
push edi
add esp, 4
and edi, 0x41b6
jmp 0x46cbf0
jmp 0x46cbf5
or edi, 0x12923
pop edi
mov ecx, dword [ebp - 0x504]
mov edx, dword [ecx]
mov dword [ebp - 0x504], edx
mov eax, dword [ebp - 0x504]
cmp eax, dword [ebp - 0xc98]
je 0x46cc28
mov ecx, dword [ebp - 0x504]
cmp dword [ecx + 0x30], 0
jne 0x46c9de
mov dword [ebp - 0x318], 0
Function at 0x46cc5a
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov word [ebp - 0x172e], cx
mov edx, 0x65
mov word [ebp - 0x172c], dx
mov eax, 0x6c
mov word [ebp - 0x172a], ax
mov ecx, 0x33
xor eax, dword [eax]
add byte [eax], al
mov word [ebp - 0x1728], cx
mov edx, 0x32
mov word [ebp - 0x1726], dx
mov eax, 0x2e
mov word [ebp - 0x1724], ax
mov ecx, 0x64
mov word [ebp - 0x1722], cx
mov edx, 0x6c
mov word [ebp - 0x1720], dx
mov eax, 0x6c
mov word [ebp - 0x171e], ax
xor ecx, ecx
mov word [ebp - 0x171c], cx
push eax
push edx
add esp, 4
sub eax, 0x4abe
pop eax
push edi
add edi, 0xae34
pop edi
push ecx
push edx
add esp, 4
xor ecx, 0x163b3
add ecx, 0x16bf6
add ecx, 0x348e
or ecx, 0x8d68
pop ecx
push ecx
push ecx
add esp, 4
or ecx, 0x16019
add ecx, 0x107e8
and ecx, 0x9148
xor ecx, 0xf118
pop ecx
push ebx
or ebx, 0x10c54
and ebx, 0x15d07
and ebx, 0x2bcf
pop ebx
mov edx, dword fs:[0x18]
mov dword [ebp - 0x1ff4], edx
mov eax, dword [ebp - 0x1ff4]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x1950], ecx
mov edx, dword [ebp - 0x1950]
mov dword [ebp - 0x159c], edx
push edi
and edi, 0x18345
add edi, 0x78c1
or edi, 0x13672
pop edi
push ecx
xor ecx, 0xbc0c
xor ecx, 0x61e8
call 0x46c95a
add byte [esi], dh
xor al, byte [esi + 0x4c]
aaa
inc ecx
xor eax, 0x5904c483
cmp dword [ebp - 0x159c], 0
jne 0x46c976
mov dword [ebp - 0x318], 0
jmp 0x46cc32
mov eax, dword [ebp - 0x159c]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xc98], edx
push esi
push ecx
add esp, 4
add esi, 0xc31d
call 0x46c9a2
add byte [ebx], bh
cmp dword [ecx + 0x32], ecx
inc ebx
cmp esi, dword [edi]
inc esi
add esp, 4
add esi, 0x971b
pop esi
push edx
or edx, 0xc625
sub edx, 0x126cf
pop edx
cmp dword [ebp - 0xc98], 0
jne 0x46c9d2
mov dword [ebp - 0x318], 0
jmp 0x46cc32
mov eax, dword [ebp - 0xc98]
mov dword [ebp - 0x504], eax
push eax
jmp 0x46c9e6
xor eax, 0x77c8
xor eax, 0x12383
and eax, 0x1424b
pop eax
push eax
call 0x46ca06
add byte [ebx], bh
dec esi
inc edi
cmp edi, dword [ebx]
cmp al, 0x83
les eax, [ecx + eax*4]
enter 0x5f79, 1
add byte [eax - 0x73], bl
invalid
push ecx
jmp 0x46cc39
pop ecx
push esi
push edx
add esp, 4
jmp 0x46cc48
xor esi, 0x13185
call 0x46cc5a
add byte [0x383d3548], dh
cmp eax, dword [ebx - 0x397efb3c]
retf 0xb
Function at 0x46d3c0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x758]
add edx, 1
mov dword [ebp - 0x758], edx
mov eax, dword [ebp - 0x754]
mov ecx, dword [ebp - 0x758]
cmp ecx, dword [eax + 0x18]
jae 0x46d496
mov edx, dword [ebp - 0x758]
mov eax, dword [ebp - 0x195c]
mov ecx, dword [ebp - 0x320]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x75c], ecx
mov edx, dword [ebp - 0x758]
mov eax, dword [ebp - 0x1960]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x1964]
mov eax, dword [ebp - 0x320]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x1968], eax
mov dword [ebp - 0x19c], 0
jmp 0x46d2fa
mov ecx, dword [ebp - 0x19c]
add ecx, 1
mov dword [ebp - 0x19c], ecx
mov edx, dword [ebp - 0x75c]
add edx, dword [ebp - 0x19c]
movsx eax, byte [edx]
test eax, eax
je 0x46d3ac
mov ecx, dword [ebp - 0x19c]
movsx edx, byte [ebp + ecx - 0x894]
test edx, edx
je 0x46d3ac
push ebx
push eax
add esp, 4
add ebx, 0x10122
jmp 0x46d33a
or ebx, 0xdb07
pop ebx
push edi
push ebx
add esp, 4
sub edi, 0x14148
sub edi, 0xeae7
add edi, 0x2c4c
pop edi
mov eax, dword [ebp - 0x75c]
add eax, dword [ebp - 0x19c]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x19c]
movsx eax, byte [ebp + edx - 0x894]
cmp ecx, eax
je 0x46d39e
mov ecx, dword [ebp - 0x75c]
add ecx, dword [ebp - 0x19c]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x19c]
movsx ecx, byte [ebp + eax - 0x894]
cmp edx, ecx
jne 0x46d3a5
jmp 0x46d2eb
jmp 0x46d3ac
push edx
or edx, 0x12366
and edx, 0xaf83
call 0x46d3c8
add byte [esi], dh
inc ebp
inc edi
inc eax
dec ebx
inc esi
inc ebx
dec edi
add esp, 4
pop edx
push edx
push esi
add esp, 4
or edx, 0x7c7
add edx, 0x41eb
pop edx
mov edx, dword [ebp - 0x75c]
add edx, dword [ebp - 0x19c]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x19c]
movsx edx, byte [ebp + ecx - 0x894]
cmp eax, edx
jne 0x46d40b
mov dword [ebp - 0xca8], 0
jmp 0x46d47a
push ecx
push esi
add esp, 4
add ecx, 0xd289
xor ecx, 0x168f5
add ecx, 0x16dfd
pop ecx
push edi
or edi, 0xeeca
and edi, 0x13eca
and edi, 0xf1fa
add edi, 0x1433d
pop edi
mov eax, dword [ebp - 0x75c]
add eax, dword [ebp - 0x19c]
movsx ecx, byte [eax]
or ecx, 0x20
invalid
Function at 0x46d3c8
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x758]
add edx, 1
mov dword [ebp - 0x758], edx
mov eax, dword [ebp - 0x754]
mov ecx, dword [ebp - 0x758]
cmp ecx, dword [eax + 0x18]
jae 0x46d496
mov edx, dword [ebp - 0x758]
mov eax, dword [ebp - 0x195c]
mov ecx, dword [ebp - 0x320]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x75c], ecx
mov edx, dword [ebp - 0x758]
mov eax, dword [ebp - 0x1960]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x1964]
mov eax, dword [ebp - 0x320]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x1968], eax
mov dword [ebp - 0x19c], 0
jmp 0x46d2fa
mov ecx, dword [ebp - 0x19c]
add ecx, 1
mov dword [ebp - 0x19c], ecx
mov edx, dword [ebp - 0x75c]
add edx, dword [ebp - 0x19c]
movsx eax, byte [edx]
test eax, eax
je 0x46d3ac
mov ecx, dword [ebp - 0x19c]
movsx edx, byte [ebp + ecx - 0x894]
test edx, edx
je 0x46d3ac
push ebx
push eax
add esp, 4
add ebx, 0x10122
jmp 0x46d33a
or ebx, 0xdb07
pop ebx
push edi
push ebx
add esp, 4
sub edi, 0x14148
sub edi, 0xeae7
add edi, 0x2c4c
pop edi
mov eax, dword [ebp - 0x75c]
add eax, dword [ebp - 0x19c]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x19c]
movsx eax, byte [ebp + edx - 0x894]
cmp ecx, eax
je 0x46d39e
mov ecx, dword [ebp - 0x75c]
add ecx, dword [ebp - 0x19c]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x19c]
movsx ecx, byte [ebp + eax - 0x894]
cmp edx, ecx
jne 0x46d3a5
jmp 0x46d2eb
jmp 0x46d3ac
push edx
or edx, 0x12366
and edx, 0xaf83
call 0x46d3c8
add byte [esi], dh
inc ebp
inc edi
inc eax
dec ebx
inc esi
inc ebx
dec edi
add esp, 4
pop edx
push edx
push esi
add esp, 4
or edx, 0x7c7
add edx, 0x41eb
pop edx
mov edx, dword [ebp - 0x75c]
add edx, dword [ebp - 0x19c]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x19c]
movsx edx, byte [ebp + ecx - 0x894]
cmp eax, edx
jne 0x46d40b
mov dword [ebp - 0xca8], 0
jmp 0x46d47a
push ecx
push esi
add esp, 4
add ecx, 0xd289
xor ecx, 0x168f5
add ecx, 0x16dfd
pop ecx
push edi
or edi, 0xeeca
and edi, 0x13eca
and edi, 0xf1fa
add edi, 0x1433d
pop edi
mov eax, dword [ebp - 0x75c]
add eax, dword [ebp - 0x19c]
movsx ecx, byte [eax]
or ecx, 0x20
invalid

Function at 0x46d4c0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
call 0x46d4cf
add byte [eax + 0x42], dl
xor eax, 0x434f323a
cmp byte [ebx + 0x6eb04c4], al
inc esi
dec ebx
cmp al, byte [ebx + 0x4b]
dec ebp
sub ebx, 0x6625

Function at 0x46d4cf
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
call 0x46d4cf
add byte [eax + 0x42], dl
xor eax, 0x434f323a
cmp byte [ebx + 0x6eb04c4], al
inc esi
dec ebx
cmp al, byte [ebx + 0x4b]
dec ebp
sub ebx, 0x6625
Function at 0x46d4e0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
pop ebx
mov eax, dword [ebp - 0x3f0]
mov dword [ebp - 0x196c], eax
push edx
push edx
add esp, 4
and edx, 0xb1f9
pop edx
push eax
add eax, 0xe934
pop eax
push eax
push ebx
add esp, 4
and eax, 0x393b
or eax, 0xd839
add byte [eax], al
xor eax, 0xf866
xor eax, 0x2de
pop eax
mov ecx, dword [ebp - 0x196c]
mov dword [ebp - 0x1970], ecx
lea edx, [ebp - 0x1734]
push edx
call dword [ebp - 0x1970]
test eax, eax
jne 0x46d57d
push edi
and edi, 0xf41d
add edi, 0x14559
or edi, 0xba13
pop edi
push esi
push esi
add esp, 4
sub esi, 0xdbe2
and esi, 0x6998
add esi, 0x164aa
or esi, 0x12187
pop esi
mov dword [ebp - 0x79c], 0
jmp 0x46dc67
mov edx, dword [ebp - 0x768]
add edx, 1
mov dword [ebp - 0x768], edx
Function at 0x46d7f0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp ecx, edx
jge fcn.0046d800
mov dword [ebp - 0x15f8], 0xffffffff
jmp 0x46d80a

Function at 0x46d800
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 0x15f8], 1
mov eax, dword [ebp - 0x15f8]
mov dword [ebp - 0x15fc], eax
Function at 0x46dd00
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edi
push ecx
add esp, 4
xor edi, 0xb88e
add edi, 0xb950
add edi, 0x3982
xor edi, 0x3d5e
pop edi
mov edx, dword [ebp - 0x79c]
mov dword [ebp - 0x1988], edx
push 0
call dword [ebp - 0x1988]
mov dword [ebp - 0x2090], 0xa
push ecx
and ecx, 0x308f
add ecx, 0x133f0
and ecx, 0x10c0c
xor ecx, 0xd622
pop ecx
push esi
push edi
add esp, 4
sub esi, 0x11d6f
or esi, 0x14c34
sub esi, 0x150c1
pop esi
mov eax, dword [ebp - 0x3f8]
mov cl, byte [eax + 0xa]
mov byte [ebp - 0x3ae], cl
mov edx, dword [ebp - 0xab4]
sub edx, dword [ebp - 0x3f8]
mov dword [ebp - 0x168c], edx
mov dword [ebp - 0xce8], 0
push esi
and esi, 0x17130
pop esi
push edi
push ebx
add esp, 4
and edi, 0x13493
xor edi, 0xaf2d
pop edi
push edi
push edi
add esp, 4
sub edi, 0xa336
jmp 0x46ddc4
xor edi, 0xf441
pop edi
mov byte [ebp - 0x9d4], 0x56
mov byte [ebp - 0x9d3], 0x69
mov byte [ebp - 0x9d2], 0x72
mov byte [ebp - 0x9d1], 0x74
mov byte [ebp - 0x9d0], 0x75
mov byte [ebp - 0x9cf], 0x61
mov byte [ebp - 0x9ce], 0x6c
mov byte [ebp - 0x9cd], 0x50
mov byte [ebp - 0x9cc], 0x72
mov byte [ebp - 0x9cb], 0x6f
mov byte [ebp - 0x9ca], 0x74
mov byte [ebp - 0x9c9], 0x65
mov byte [ebp - 0x9c8], 0x63
mov byte [ebp - 0x9c7], 0x74
mov byte [ebp - 0x9c6], 0
push edi
push edi
add esp, 4
call 0x46de49
add byte [esi], dh
dec edi
inc esi
dec ebx
dec esp
inc edx
dec esi
dec esp
add esp, 4
sub edi, 0x5489
xor edi, 0xd453
pop edi
push edx
push eax
add esp, 4
jmp 0x46de65

Function at 0x46de49
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edi
push ecx
add esp, 4
xor edi, 0xb88e
add edi, 0xb950
add edi, 0x3982
xor edi, 0x3d5e
pop edi
mov edx, dword [ebp - 0x79c]
mov dword [ebp - 0x1988], edx
push 0
call dword [ebp - 0x1988]
mov dword [ebp - 0x2090], 0xa
push ecx
and ecx, 0x308f
add ecx, 0x133f0
and ecx, 0x10c0c
xor ecx, 0xd622
pop ecx
push esi
push edi
add esp, 4
sub esi, 0x11d6f
or esi, 0x14c34
sub esi, 0x150c1
pop esi
mov eax, dword [ebp - 0x3f8]
mov cl, byte [eax + 0xa]
mov byte [ebp - 0x3ae], cl
mov edx, dword [ebp - 0xab4]
sub edx, dword [ebp - 0x3f8]
mov dword [ebp - 0x168c], edx
mov dword [ebp - 0xce8], 0
push esi
and esi, 0x17130
pop esi
push edi
push ebx
add esp, 4
and edi, 0x13493
xor edi, 0xaf2d
pop edi
push edi
push edi
add esp, 4
sub edi, 0xa336
jmp 0x46ddc4
xor edi, 0xf441
pop edi
mov byte [ebp - 0x9d4], 0x56
mov byte [ebp - 0x9d3], 0x69
mov byte [ebp - 0x9d2], 0x72
mov byte [ebp - 0x9d1], 0x74
mov byte [ebp - 0x9d0], 0x75
mov byte [ebp - 0x9cf], 0x61
mov byte [ebp - 0x9ce], 0x6c
mov byte [ebp - 0x9cd], 0x50
mov byte [ebp - 0x9cc], 0x72
mov byte [ebp - 0x9cb], 0x6f
mov byte [ebp - 0x9ca], 0x74
mov byte [ebp - 0x9c9], 0x65
mov byte [ebp - 0x9c8], 0x63
mov byte [ebp - 0x9c7], 0x74
mov byte [ebp - 0x9c6], 0
push edi
push edi
add esp, 4
call 0x46de49
add byte [esi], dh
dec edi
inc esi
dec ebx
dec esp
inc edx
dec esi
dec esp
add esp, 4
sub edi, 0x5489
xor edi, 0xd453
pop edi
push edx
push eax
add esp, 4
jmp 0x46de65
Function at 0x46de60
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
inc esp
cmp ecx, dword ds:[ecx + 0x39]
pop edx
mov eax, dword fs:[0x18]
mov dword [ebp - 0x198c], eax
mov ecx, dword [ebp - 0x198c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x1990], edx
mov eax, dword [ebp - 0x1990]
mov dword [ebp - 0x160c], eax
push edx
push ebx
add esp, 4
or edx, 0xd36c
call 0x46dea6
add byte [0x433f4d4a], dh
cmp eax, 0xc4833937
add al, 0x5a
push esi
push ebx
add esp, 4
sub esi, 0xe65b
jmp 0x46debe
pop esi
cmp dword [ebp - 0x160c], 0
jne 0x46ded7
mov dword [ebp - 0x314], 0
jmp 0x46e17e
mov ecx, dword [ebp - 0x160c]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xcc4], eax
push esi
push eax
add esp, 4
and esi, 0x10d03
sub esi, 0x2ea4
xor esi, 0x1208e
xor esi, 0x8a43
pop esi
push eax
add eax, 0x8c7e
and eax, 0x13326
xor eax, 0x15d48
pop eax
cmp dword [ebp - 0xcc4], 0
jne 0x46df33
mov dword [ebp - 0x314], 0
jmp 0x46e17e
mov ecx, dword [ebp - 0xcc4]
mov dword [ebp - 0x514], ecx

Function at 0x46dea6
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
inc esp
cmp ecx, dword ds:[ecx + 0x39]
pop edx
mov eax, dword fs:[0x18]
mov dword [ebp - 0x198c], eax
mov ecx, dword [ebp - 0x198c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x1990], edx
mov eax, dword [ebp - 0x1990]
mov dword [ebp - 0x160c], eax
push edx
push ebx
add esp, 4
or edx, 0xd36c
call 0x46dea6
add byte [0x433f4d4a], dh
cmp eax, 0xc4833937
add al, 0x5a
push esi
push ebx
add esp, 4
sub esi, 0xe65b
jmp 0x46debe
pop esi
cmp dword [ebp - 0x160c], 0
jne 0x46ded7
mov dword [ebp - 0x314], 0
jmp 0x46e17e
mov ecx, dword [ebp - 0x160c]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xcc4], eax
push esi
push eax
add esp, 4
and esi, 0x10d03
sub esi, 0x2ea4
xor esi, 0x1208e
xor esi, 0x8a43
pop esi
push eax
add eax, 0x8c7e
and eax, 0x13326
xor eax, 0x15d48
pop eax
cmp dword [ebp - 0xcc4], 0
jne 0x46df33
mov dword [ebp - 0x314], 0
jmp 0x46e17e
mov ecx, dword [ebp - 0xcc4]
mov dword [ebp - 0x514], ecx
Function at 0x46e3a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jne 0x46e3b1
mov dword [ebp - 0x774], 0
jmp 0x46e5fc
mov edx, dword [ebp - 0xcd0]
mov dword [ebp - 0x518], edx
push eax
sub eax, 0x3ac6
and eax, 0x1284
or eax, 0xdb0a
pop eax
push edx
sub edx, 0x167fa
jmp 0x46e3df
and edx, 0xb120
jmp 0x46e3ee
pop edx
lea eax, [ebp - 0x178c]
mov dword [ebp - 0xccc], eax
mov ecx, dword [ebp - 0x518]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xcc8], edx
xor eax, eax
mov word [ebp - 0x21c], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
push eax
sub eax, 0xf21c
xor eax, 0x14cd0
or eax, 0x121ff
pop eax
push edi
push ebx
invalid

Function at 0x46e490
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add cl, byte [ecx - 0xccb6b]
jmp dword [esi - 0x75]

Function at 0x46e500
Capabilities:
Resolve function by parsing pe exports

Disassembly:
adc eax, 0xfffffff
mov bh, 0x85
in al, 0xfd
invalid

Function at 0x46e56e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop edx
movzx eax, word [ebp - 0x21c]
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x46e419
movzx edx, word [ebp - 0x21c]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x46e535
mov dword [ebp - 0x161c], 0xffffffff
jmp 0x46e53f
mov dword [ebp - 0x161c], 1
mov ecx, dword [ebp - 0x161c]
mov dword [ebp - 0x1620], ecx
cmp dword [ebp - 0x1620], 0
jne 0x46e594
push ebx
add ebx, 0x9e19
pop ebx
push ecx
push ecx
add esp, 4
call 0x46e56e
add byte [edi + 0x3a], al
xor ecx, dword [eax + 0x49]
inc ebx
inc edi
add esp, 4
pop ecx
push edi
push eax
add esp, 4
or edi, 0x1419f
pop edi
push ebx
or ebx, 0x4d04
pop ebx
mov edx, dword [ebp - 0x518]
mov dword [ebp - 0x774], edx
jmp 0x46e5fc
push edi
add edi, 0x10923
pop edi
push esi
sub esi, 0x144df
call 0x46e5b0
add byte [esi], bh
push eax
xor edi, dword [ebx]
aas
inc ecx
aaa
add esp, 4
pop esi
push edi
push edx
add esp, 4
sub edi, 0x12983
xor edi, 0x1750e
pop edi
mov eax, dword [ebp - 0x518]
mov ecx, dword [eax]
mov dword [ebp - 0x518], ecx
mov edx, dword [ebp - 0x518]
cmp edx, dword [ebp - 0xcd0]
je 0x46e5f2
mov eax, dword [ebp - 0x518]
cmp dword [eax + 0x30], 0
jne 0x46e3bd
mov dword [ebp - 0x774], 0
Function at 0x46e5b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop edx
movzx eax, word [ebp - 0x21c]
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x46e419
movzx edx, word [ebp - 0x21c]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x46e535
mov dword [ebp - 0x161c], 0xffffffff
jmp 0x46e53f
mov dword [ebp - 0x161c], 1
mov ecx, dword [ebp - 0x161c]
mov dword [ebp - 0x1620], ecx
cmp dword [ebp - 0x1620], 0
jne 0x46e594
push ebx
add ebx, 0x9e19
pop ebx
push ecx
push ecx
add esp, 4
call 0x46e56e
add byte [edi + 0x3a], al
xor ecx, dword [eax + 0x49]
inc ebx
inc edi
add esp, 4
pop ecx
push edi
push eax
add esp, 4
or edi, 0x1419f
pop edi
push ebx
or ebx, 0x4d04
pop ebx
mov edx, dword [ebp - 0x518]
mov dword [ebp - 0x774], edx
jmp 0x46e5fc
push edi
add edi, 0x10923
pop edi
push esi
sub esi, 0x144df
call 0x46e5b0
add byte [esi], bh
push eax
xor edi, dword [ebx]
aas
inc ecx
aaa
add esp, 4
pop esi
push edi
push edx
add esp, 4
sub edi, 0x12983
xor edi, 0x1750e
pop edi
mov eax, dword [ebp - 0x518]
mov ecx, dword [eax]
mov dword [ebp - 0x518], ecx
mov edx, dword [ebp - 0x518]
cmp edx, dword [ebp - 0xcd0]
je 0x46e5f2
mov eax, dword [ebp - 0x518]
cmp dword [eax + 0x30], 0
jne 0x46e3bd
mov dword [ebp - 0x774], 0