joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10025de4
Capabilities:
Print debug messages

Disassembly:
push 0xac4
mov eax, 0x1002ce82
call fcn.1002a0fc
cmp byte [0x1003cde0], 0
mov ebx, 0x1003e190
mov eax, dword [ebp + 0x18]
mov esi, dword [ebp + 8]
mov dword [ebp - 0xacc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xad0], eax
je 0x10025e33
push str._ACTWinBrowser__SendAcroIPCMessage
push ebx
call fcn.1001ca9d
cmp byte [0x1003cde0], 0
pop ecx
pop ecx
je 0x10025e33
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push 0x208
xor ebx, ebx
lea eax, [ebp - 0x218]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0xac8]
call fcn.10025dc7
mov eax, dword [ebp - 0xacc]
lea edi, [ebp - 0xac8]
test eax, eax
cmovne edi, eax
test esi, esi
je 0x1002602b
cmp dword [esi + 0x400], ebx
jne 0x10025e8a
push ebx
push ebx
push ebx
push ebx
call fcn.10022610
add esp, 0x10
test eax, eax
je 0x1002602b
push dword [esi + 0x400]
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
push eax
push str.AcroSBL
push str._s__lu__lu
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.1001ca9d
add esp, 0x18
test eax, eax
jle 0x1002602b
lea ecx, [ebp - 0x6bc]
call fcn.10025da7
push dword [ebp + 0x14]
lea eax, [ebp - 0x6bc]
push dword [ebp - 0xad0]
push 1
push 1
push dword [ebp + 0xc]
push eax
call fcn.1001ca9d
add esp, 0x18
test eax, eax
jne 0x10026002
push ebx
lea eax, [ebp - 0x218]
push eax
push 1
lea ecx, [ebp - 0x2ac]
call fcn.10029305
push dword [esi + 0x400]
lea eax, [ebp - 0x6bc]
mov dword [ebp - 4], ebx
push 0x1388
push edi
push eax
lea ecx, [ebp - 0x2ac]
call fcn.1002952a
test eax, eax
jne 0x10025f6a
cmp dword [edi + 4], eax
sete bl
cmp byte [0x1003cde0], al
je 0x10025ff5
push dword [edi + 4]
mov esi, 0x1003e190
push str._ACTWinBrowser__SendAcroIPCMessage_IPC_call_success_status___lu
push esi
call fcn.1001ca9d
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x10025ff5
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
jmp 0x10025ff5
cmp byte [0x1003cde0], 0
mov esi, 0x1003e190
je 0x10025f95
push str.IPC_Error:_AIPC_ERR
push esi
call fcn.1001ca9d
cmp byte [0x1003cde0], 0
pop ecx
pop ecx
je 0x10025f95
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
call dword [sym.imp.kernel32.dll_GetLastError]
push ebx
push ebx
lea ecx, [ebp - 0xacc]
mov dword [ebp - 0xacc], ebx
push ecx
push 0x400
push eax
push ebx
push 0x1300
call dword [sym.imp.kernel32.dll_FormatMessageA]
cmp byte [0x1003cde0], 0
je 0x10025fe9
push dword [ebp - 0xacc]
push str._ACTWinBrowser__IPC_Error_:__s
push esi
call fcn.1001ca9d
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x10025fe9
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push dword [ebp - 0xacc]
call dword [sym.imp.kernel32.dll_LocalFree]
lea ecx, [ebp - 0x2ac]
call fcn.1001ca9d
jmp 0x1002602b
cmp byte [0x1003cde0], bl
je 0x1002602b
push str.IPC_CreateMessage_Error:_CreateMessage_failed
mov esi, 0x1003e190
push esi
call fcn.1001ca9d
pop ecx
pop ecx
cmp byte [0x1003cde0], bl
je 0x1002602b
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov al, bl
call fcn.1002a0a6
ret
Function at 0x100277eb
Capabilities:
Print debug messages

Disassembly:
push esi
push 8
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
pop ecx
test esi, esi
je 0x10027808
push 8
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x100278ec
push edi
push 0x64
push str.sizeof__t_ASMBlock____d
mov edi, 0x1003e5e0
push edi
call fcn.1001ca9d
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x100278eb
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cde0], 0
je 0x100278eb
push 4
push str.sizeof_Uns32____d
push edi
call fcn.1001ca9d
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x100278eb
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cde0], 0
je 0x100278eb
push 4
push str.sizeof_HANDLE____d
push edi
call fcn.1001ca9d
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x100278eb
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cde0], 0
je 0x100278eb
push 4
push str.sizeof_Handle32____d
push edi
call fcn.1001ca9d
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x100278eb
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cde0], 0
je 0x100278eb
push 4
push str.sizeof_void____d
push edi
call fcn.1001ca9d
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x100278eb
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
pop edi
mov eax, esi
pop esi
ret

Function at 0x1002795e
Capabilities:
Print debug messages

Disassembly:
push 0x1c
mov eax, 0x1002cf70
call fcn.1002a0fc
cmp byte [0x1003cde0], 0
mov edi, dword [ebp + 8]
je 0x1002799d
lea eax, [edi + 4]
mov esi, 0x1003e5e0
push eax
push str.ASM_Release__s
push esi
call fcn.1001ca9d
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x1002799d
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
lea eax, [edi + 4]
push eax
lea ecx, [ebp - 0x28]
call fcn.10001b12
push dword [edi + 0x48]
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.1000276d
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x100279d3
mov ecx, dword [ebx]
push 1
mov esi, dword [ecx]
mov ecx, esi
call dword [0x1002e5c4]
mov ecx, ebx
call esi
lea ecx, [ebp - 0x28]
call fcn.1001ca9d
and dword [edi + 0x4c], 0
and dword [edi + 0x44], 0
call fcn.1002a0a6
ret
Function at 0x100279e9
Capabilities:
Print debug messages

Disassembly:
push 0x24
mov eax, 0x1002cf9d
call fcn.1002a0fc
cmp byte [0x1003cde0], 0
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], esi
je 0x10027a48
call fcn.1001ca9d
test al, al
mov edx, 0x1002ea51
mov ecx, str._in_AppContaner
cmove ecx, edx
push ecx
push str.ASM_Retrieve_retrieving_shared_memory_in_Plug_in_s
push 0x1003e5e0
call fcn.1001ca9d
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x10027a48
push 0x1003e5e0
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
and dword [esi], 0
lea eax, [edi + 4]
and dword [ebx], 0
lea ecx, [ebp - 0x28]
push eax
call fcn.10001b12
push dword [edi + 0x48]
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.1000276d
or dword [ebp - 4], 0xffffffff
mov ebx, eax
pop ecx
pop ecx
lea ecx, [ebp - 0x28]
call fcn.1001ca9d
test ebx, ebx
jne 0x10027aae
cmp byte [0x1003cde0], bl
je 0x10027b0f
push str.ASM_Retrieve_ERROR__finding_memory_mapped_file_
mov ebx, 0x1003e5e0
push ebx
call fcn.1001ca9d
cmp byte [0x1003cde0], 0
pop ecx
pop ecx
je 0x10027b0f
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
jmp 0x10027b0f
mov eax, dword [ebx]
mov esi, dword [eax + 0x20]
mov ecx, esi
call dword [0x1002e5c4]
mov ecx, ebx
call esi
mov dword [edi + 0x44], eax
test eax, eax
jne 0x10027ad5
cmp byte [0x1003cde0], al
je 0x10027b0f
push str.ASM_Retrieve_ERROR__getting_memory_mapped_file_handle_
jmp 0x10027a8f
mov eax, dword [ebx]
push dword [edi + 0x48]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x1002e5c4]
mov ecx, ebx
call esi
mov dword [edi + 0x4c], eax
test eax, eax
jne 0x10027aff
cmp byte [0x1003cde0], al
je 0x10027b0f
push str.ASM_Retrieve_ERROR__mapping_for_writing_
jmp 0x10027a8f
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edi + 0x48]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [edi + 0x4c]
mov dword [ecx], eax
call fcn.1002a0a6
ret
Function at 0x2e00206e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x2e00207d
pop dword [ebp - 0x30]
mov eax, 0x4bb59f30
add eax, 0xe24a814d
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x2b31dd6c
sub dword [ebp - 0x40], 0xdcdf9821
mov dword [ebp - 0x3c], 0x6172f353
add dword [ebp - 0x3c], 0xd0c058f2
mov dword [ebp - 0x38], 0x9c627d23
add dword [ebp - 0x38], 0xafe9c70b
mov dword [ebp - 0x34], 0xe859e07c
sub dword [ebp - 0x34], 0xe859e07c
lea eax, [ebp - 0x40]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x8367278c
sub dword [ebp - 0x40], 0xef4be36
mov dword [ebp - 0x3c], 0x352fc189
add dword [ebp - 0x3c], 0xc3c9fec
mov dword [ebp - 0x38], 0x8ce21951
add dword [ebp - 0x38], 0xd68d531b
mov dword [ebp - 0x34], 0xacc4398c
add dword [ebp - 0x34], 0x533bc674
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x40e09
push 0
call eax
mov ecx, 0xf514d330
sub ecx, 0xf5148c76
xor edi, edi
add edi, eax
mov ebx, 0x30efe2e4
sub ebx, 0x2ea74e4
add ebx, dword [ebp - 0x30]
mov esi, 0x8b00bbb5
add esi, 0xfc48560f
xor dword [ebp - 4], 0xa8e255b3
mov edx, dword [ebx]
xor dword [ebp - 0x28], 0xb387712d
xor edx, esi
add dword [ebp - 0xc], esi
mov dword [edi], edx
add dword [ebp - 0x28], eax
add edi, 0xc8f8dfe6
add edi, 0x3707201e
add ebx, 0x728d67b6
add ebx, 0x8d72984e
loop 0x2e002197
add eax, 0x10dbb
mov ebx, eax
add eax, 0x66cc7d14
sub eax, 0x66cc7d0f
mov ecx, 0x2e000000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x2e013ece
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x2e03021f
call fcn.2e00153c
mov edi, ecx
mov dword [ebp - 0x18], edi
xor ebx, ebx
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
mov byte [edi], bl
mov dword [ebp - 4], ebx
call fcn.2e014c10
test ax, ax
je 0x2e013f76
lea eax, [ebp - 0x10]
push eax
push str.softwaremicrosoftwindows_shell_associationsurlassociationshttpuserchoice
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e013f76
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push str.progid
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e013f6d
mov eax, dword [ebp - 0x14]
inc eax
push eax
call fcn.2e00206e
mov esi, eax
pop ecx
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
push esi
push ebx
push ebx
push str.progid
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e013f60
push esi
mov ecx, edi
call fcn.2e010c49
push 1
push esi
mov byte [ebp - 4], bl
call fcn.2e00206e
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
call fcn.2e001586
ret
Function at 0x426640
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ffc73
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xb4
push ebx
push esi
mov esi, ecx
mov eax, dword [esi]
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
call dword [eax + 0xb0]
mov edx, dword [esi]
mov ecx, esi
mov edi, eax
call dword [edx + 0x40]
cmp eax, edi
jge 0x426684
mov edi, eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xb0]
mov edx, dword [esi]
mov ecx, esi
mov ebx, eax
call dword [edx + 0x40]
cmp eax, ebx
mov ecx, eax
jg 0x42669f
mov ecx, ebx
cmp edi, ecx
mov eax, dword [ebp + 0xc]
jg 0x4266b7
cmp eax, edi
jge 0x4266af
mov eax, edi
mov dword [ebp + 0xc], eax
cmp eax, ecx
jle 0x4266c9
mov eax, ecx
jmp 0x4266c6
cmp eax, ecx
jge 0x4266c0
mov eax, ecx
mov dword [ebp + 0xc], eax
cmp eax, edi
jle 0x4266c9
mov eax, edi
mov dword [ebp + 0xc], eax
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, esi
call fcn.00478cd0
mov ecx, dword [0x57377c]
mov edx, dword [esi]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [0x573780]
mov dword [eax + 4], ecx
mov ecx, dword [0x573784]
mov dword [eax + 8], ecx
mov ecx, dword [0x573788]
mov dword [eax + 0xc], ecx
mov eax, dword [esi + 0x30]
push eax
mov ecx, esi
call dword [edx + 0x8c]
mov ecx, dword [0x57371c]
mov edx, dword [esi]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [0x573720]
mov dword [eax + 4], ecx
mov ecx, dword [0x573724]
mov dword [eax + 8], ecx
mov ecx, dword [0x573728]
mov dword [eax + 0xc], ecx
mov eax, dword [esi + 0x34]
push eax
mov ecx, esi
call dword [edx + 0x8c]
mov ecx, dword [0x5736c8]
mov edx, dword [esi]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [0x5736cc]
mov dword [eax + 4], ecx
mov ecx, dword [0x5736d0]
mov dword [eax + 8], ecx
mov ecx, dword [0x5736d4]
mov dword [eax + 0xc], ecx
mov eax, dword [esi + 0x38]
push eax
mov ecx, esi
call dword [edx + 0x8c]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x48]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x42c2d0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5009dc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xbc
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], esi
call fcn.00473210
mov byte [esi + 0x2c], 0
mov dword [ebp - 4], 0
mov bl, 1
push 0x4c
mov dword [esi], 0x51a290
mov byte [ebp - 4], bl
call fcn.004ee057
mov ecx, eax
add esp, 4
mov dword [ebp - 0x14], ecx
test ecx, ecx
mov byte [ebp - 4], 2
je 0x42c332
call fcn.00425a40
jmp 0x42c334
xor eax, eax
push 0x34
mov byte [ebp - 4], bl
mov dword [esi + 0x30], eax
call fcn.004ee057
mov ecx, eax
add esp, 4
mov dword [ebp - 0x14], ecx
test ecx, ecx
mov byte [ebp - 4], 3
je 0x42c358
call fcn.004242c0
jmp 0x42c35a
xor eax, eax
push 0x38
mov byte [ebp - 4], bl
mov dword [esi + 0x34], eax
call fcn.004ee057
mov ecx, eax
add esp, 4
mov dword [ebp - 0x14], ecx
test ecx, ecx
mov byte [ebp - 4], 4
je 0x42c37e
call fcn.004252a0
jmp 0x42c380
xor eax, eax
mov dword [esi + 0x38], eax
mov eax, dword [esi + 0x30]
push eax
mov ecx, esi
mov byte [ebp - 4], bl
call fcn.00478f80
mov ecx, dword [esi + 0x34]
push ecx
mov ecx, esi
call fcn.00478f80
mov edx, dword [esi + 0x38]
push edx
mov ecx, esi
call fcn.00478f80
push 0x64
push 0xaa
mov ecx, esi
call fcn.00426640
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43af97
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ebx
push eax
and eax, 0xb4d8
and eax, 0x158c6
xor eax, 0x150cf
pop eax
mov dword [ebp - 0x228], 0
Function at 0x43b35b
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
and ebx, 0xcfa2
pop ebx
mov dword [ebp - 0x614], 0
push eax
push eax
add esp, 4
and eax, 0x51a6
pop eax
push ebx
xor ebx, 0x10415
xor ebx, 0x16028
pop ebx
push esi
push edx
add esp, 4
or esi, 0x87d0
xor esi, 0xe33c
add esi, 0x140e3
pop esi
mov byte [ebp - 0x494], 0x45
mov byte [ebp - 0x493], 0x78
mov byte [ebp - 0x492], 0x69
mov byte [ebp - 0x491], 0x74
mov byte [ebp - 0x490], 0x50
mov byte [ebp - 0x48f], 0x72
mov byte [ebp - 0x48e], 0x6f
mov byte [ebp - 0x48d], 0x63
mov byte [ebp - 0x48c], 0x65
mov byte [ebp - 0x48b], 0x73
mov byte [ebp - 0x48a], 0x73
mov byte [ebp - 0x489], 0
push ebx
call 0x43b403
add byte [eax + 0x4d], al
dec edx
aaa
inc esp
xor al, 0x3e
add esp, 4
jmp 0x43b40d
call 0x43b41b
add byte [ebx + 0x4a], al
inc esi
dec ebx
xor esi, dword [esi]
cmp dword [ebx], esi
add esp, 4
pop ebx
push esi
add esi, 0x124f0
pop esi
mov edx, 0x6b
mov word [ebp - 0xc50], dx
mov eax, 0x65
mov word [ebp - 0xc4e], ax
mov ecx, 0x72
mov word [ebp - 0xc4c], cx
mov edx, 0x6e
mov word [ebp - 0xc4a], dx
mov eax, 0x65
mov word [ebp - 0xc48], ax
mov ecx, 0x6c
mov word [ebp - 0xc46], cx
mov edx, 0x33
mov word [ebp - 0xc44], dx
mov eax, 0x32
mov word [ebp - 0xc42], ax
mov ecx, 0x2e
mov word [ebp - 0xc40], cx
mov edx, 0x64
mov word [ebp - 0xc3e], dx
mov eax, 0x6c
mov word [ebp - 0xc3c], ax
mov ecx, 0x6c
mov word [ebp - 0xc3a], cx
xor edx, edx
mov word [ebp - 0xc38], dx
push ebx
xor ebx, 0x3a0a
and ebx, 0x9cb4
pop ebx
push eax
push ecx
add esp, 4
xor eax, 0x15ddf
xor eax, 0x15c66
sub eax, 0xdeab
pop eax
push ebx
push ebx
add esp, 4
sub ebx, 0x15d62
pop ebx
mov eax, dword fs:[0x18]
mov dword [ebp - 0xe28], eax
mov ecx, dword [ebp - 0xe28]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xe2c], edx
mov eax, dword [ebp - 0xe2c]
mov dword [ebp - 0xb54], eax
push ecx
or ecx, 0x1467e
Function at 0x43b403
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
and ebx, 0xcfa2
pop ebx
mov dword [ebp - 0x614], 0
push eax
push eax
add esp, 4
and eax, 0x51a6
pop eax
push ebx
xor ebx, 0x10415
xor ebx, 0x16028
pop ebx
push esi
push edx
add esp, 4
or esi, 0x87d0
xor esi, 0xe33c
add esi, 0x140e3
pop esi
mov byte [ebp - 0x494], 0x45
mov byte [ebp - 0x493], 0x78
mov byte [ebp - 0x492], 0x69
mov byte [ebp - 0x491], 0x74
mov byte [ebp - 0x490], 0x50
mov byte [ebp - 0x48f], 0x72
mov byte [ebp - 0x48e], 0x6f
mov byte [ebp - 0x48d], 0x63
mov byte [ebp - 0x48c], 0x65
mov byte [ebp - 0x48b], 0x73
mov byte [ebp - 0x48a], 0x73
mov byte [ebp - 0x489], 0
push ebx
call 0x43b403
add byte [eax + 0x4d], al
dec edx
aaa
inc esp
xor al, 0x3e
add esp, 4
jmp 0x43b40d
call 0x43b41b
add byte [ebx + 0x4a], al
inc esi
dec ebx
xor esi, dword [esi]
cmp dword [ebx], esi
add esp, 4
pop ebx
push esi
add esi, 0x124f0
pop esi
mov edx, 0x6b
mov word [ebp - 0xc50], dx
mov eax, 0x65
mov word [ebp - 0xc4e], ax
mov ecx, 0x72
mov word [ebp - 0xc4c], cx
mov edx, 0x6e
mov word [ebp - 0xc4a], dx
mov eax, 0x65
mov word [ebp - 0xc48], ax
mov ecx, 0x6c
mov word [ebp - 0xc46], cx
mov edx, 0x33
mov word [ebp - 0xc44], dx
mov eax, 0x32
mov word [ebp - 0xc42], ax
mov ecx, 0x2e
mov word [ebp - 0xc40], cx
mov edx, 0x64
mov word [ebp - 0xc3e], dx
mov eax, 0x6c
mov word [ebp - 0xc3c], ax
mov ecx, 0x6c
mov word [ebp - 0xc3a], cx
xor edx, edx
mov word [ebp - 0xc38], dx
push ebx
xor ebx, 0x3a0a
and ebx, 0x9cb4
pop ebx
push eax
push ecx
add esp, 4
xor eax, 0x15ddf
xor eax, 0x15c66
sub eax, 0xdeab
pop eax
push ebx
push ebx
add esp, 4
sub ebx, 0x15d62
pop ebx
mov eax, dword fs:[0x18]
mov dword [ebp - 0xe28], eax
mov ecx, dword [ebp - 0xe28]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xe2c], edx
mov eax, dword [ebp - 0xe2c]
mov dword [ebp - 0xb54], eax
push ecx
or ecx, 0x1467e
Function at 0x43b41b
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
and ebx, 0xcfa2
pop ebx
mov dword [ebp - 0x614], 0
push eax
push eax
add esp, 4
and eax, 0x51a6
pop eax
push ebx
xor ebx, 0x10415
xor ebx, 0x16028
pop ebx
push esi
push edx
add esp, 4
or esi, 0x87d0
xor esi, 0xe33c
add esi, 0x140e3
pop esi
mov byte [ebp - 0x494], 0x45
mov byte [ebp - 0x493], 0x78
mov byte [ebp - 0x492], 0x69
mov byte [ebp - 0x491], 0x74
mov byte [ebp - 0x490], 0x50
mov byte [ebp - 0x48f], 0x72
mov byte [ebp - 0x48e], 0x6f
mov byte [ebp - 0x48d], 0x63
mov byte [ebp - 0x48c], 0x65
mov byte [ebp - 0x48b], 0x73
mov byte [ebp - 0x48a], 0x73
mov byte [ebp - 0x489], 0
push ebx
call 0x43b403
add byte [eax + 0x4d], al
dec edx
aaa
inc esp
xor al, 0x3e
add esp, 4
jmp 0x43b40d
call 0x43b41b
add byte [ebx + 0x4a], al
inc esi
dec ebx
xor esi, dword [esi]
cmp dword [ebx], esi
add esp, 4
pop ebx
push esi
add esi, 0x124f0
pop esi
mov edx, 0x6b
mov word [ebp - 0xc50], dx
mov eax, 0x65
mov word [ebp - 0xc4e], ax
mov ecx, 0x72
mov word [ebp - 0xc4c], cx
mov edx, 0x6e
mov word [ebp - 0xc4a], dx
mov eax, 0x65
mov word [ebp - 0xc48], ax
mov ecx, 0x6c
mov word [ebp - 0xc46], cx
mov edx, 0x33
mov word [ebp - 0xc44], dx
mov eax, 0x32
mov word [ebp - 0xc42], ax
mov ecx, 0x2e
mov word [ebp - 0xc40], cx
mov edx, 0x64
mov word [ebp - 0xc3e], dx
mov eax, 0x6c
mov word [ebp - 0xc3c], ax
mov ecx, 0x6c
mov word [ebp - 0xc3a], cx
xor edx, edx
mov word [ebp - 0xc38], dx
push ebx
xor ebx, 0x3a0a
and ebx, 0x9cb4
pop ebx
push eax
push ecx
add esp, 4
xor eax, 0x15ddf
xor eax, 0x15c66
sub eax, 0xdeab
pop eax
push ebx
push ebx
add esp, 4
sub ebx, 0x15d62
pop ebx
mov eax, dword fs:[0x18]
mov dword [ebp - 0xe28], eax
mov ecx, dword [ebp - 0xe28]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xe2c], edx
mov eax, dword [ebp - 0xe2c]
mov dword [ebp - 0xb54], eax
push ecx
or ecx, 0x1467e

Function at 0x43b547
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
pop ecx
push edi
push eax
add esp, 4
jmp 0x43b52e
xor edi, 0x5042
and edi, 0xe2eb
call 0x43b547
add byte [edi + 0x4d], cl
dec edi
dec ebp
dec eax
push eax
dec eax
add esp, 4
pop edi
cmp dword [ebp - 0xb54], 0
jne 0x43b563
mov dword [ebp - 0x188], 0
jmp 0x43b80a
mov ecx, dword [ebp - 0xb54]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
invalid
Function at 0x43ba00
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp eax, 0x4e463d3b
mov edx, dword [ebp - 0xc8]
add edx, 1
mov dword [ebp - 0xc8], edx
mov edx, dword [ebp - 0x3e8]
add edx, dword [ebp - 0xc8]
movsx eax, byte [edx]
xor eax, 0x20
mov ecx, dword [ebp - 0xc8]
movsx edx, byte [ebp + ecx - 0x494]
cmp eax, edx
jne 0x43c6f1
jmp 0x43c637
jmp 0x43c6f8
Function at 0x43d702
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edx
call 0x43d702
add byte [esi], bh
xor eax, 0x413b3435
dec edi
dec ebx
cmp al, 0x45
add esp, 4
pop edx
push ecx
push esi
add esp, 4
jmp 0x43d710
add ecx, 0xbcd3
or ecx, 0x3483
and ecx, 0x119e5
pop ecx
lea ecx, [ebp - 0xc50]
mov dword [ebp - 0x6f4], ecx
mov edx, dword [ebp - 0x244]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x6f0], eax
xor ecx, ecx
mov word [ebp - 0x128], cx
xor edx, edx
mov word [ebp - 0x3c], dx
push ecx
and ecx, 0x27ed
jmp 0x43d75a
add ecx, 0x179a0
pop ecx
push ecx
xor ecx, 0xcc61
jmp 0x43d76f
call 0x43d77b
add byte [eax + 0x3d], cl
inc edx
dec esi
dec eax
cmp dword [ebx - 0x74a6fb3c], eax
test dword [eax], edx
stc
invalid
cmp edx, eax
je 0x43d74d
movzx ecx, word [ebp - 0x128]
xor ecx, 0x20
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x43d74d
movzx eax, word [ebp - 0x128]
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
jge 0x43d869
mov dword [ebp - 0xbf8], 0xffffffff
jmp 0x43d873
mov dword [ebp - 0xbf8], 1
mov edx, dword [ebp - 0xbf8]
mov dword [ebp - 0xbfc], edx
cmp dword [ebp - 0xbfc], 0
jne 0x43d8c8
push edi
add edi, 0x1473b
add edi, 0xd4f4
sub edi, 0xc59a
pop edi
push ecx
push ecx
add esp, 4
and ecx, 0x44e8
add ecx, 0x558f
and ecx, 0x102b0
xor ecx, 0x10a45
pop ecx
mov eax, dword [ebp - 0x244]
mov dword [ebp - 0x18c], eax
jmp 0x43d930
push ebx
push edx
add esp, 4
sub ebx, 0xc02d
pop ebx
push edx
push eax
add esp, 4
xor edx, 0x176b6
pop edx
push edx
push ebx
add esp, 4
xor edx, 0x139f7
pop edx
push esi
sub esi, 0xc17c
sub esi, 0x2da0
pop esi
mov ecx, dword [ebp - 0x244]
mov edx, dword [ecx]
mov dword [ebp - 0x244], edx
mov eax, dword [ebp - 0x244]
cmp eax, dword [ebp - 0x6f8]
je 0x43d926
mov ecx, dword [ebp - 0x244]
cmp dword [ecx + 0x30], 0
jne 0x43d6f1
mov dword [ebp - 0x18c], 0
push edi
push edx
add esp, 4
add edi, 0xf1c5
pop edi
push ecx
push edx
add esp, 4
call 0x43d94d
add byte [eax + edx*2], bh
xor eax, dword [ebx + 0x3f]
inc ebx
add esp, 4
pop ecx
push edi
jmp 0x43d959
pop edi
push eax
and eax, 0x13202
pop eax
mov edx, dword [ebp - 0x18c]
mov eax, dword [edx + 0x18]
mov dword [ebp - 0x1c0], eax
push edi
push edx
add esp, 4
xor edi, 0xdfc1
or edi, 0x8f76
pop edi
push eax
push edi
add esp, 4
sub eax, 0x817d
or eax, 0x3c2e
or eax, 0x1f9b
pop eax
push edi
or edi, 0x3e35
pop edi
mov dword [ebp - 0x410], 0
mov ecx, dword [ebp - 0x1c0]
mov dword [ebp - 0xc00], ecx
cmp dword [ebp - 0xc00], 0