joyce8/EMBER2024-capa huggingface dataset:
Function at 0x427426
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1fbc
push ebx
push esi
push edi
push edx
push edx
add esp, 4
or edx, 0xa6db
call 0x427209
add byte [eax + 0x40], cl
cmp byte [edi], dh
push eax
dec edi
push eax
xor al, byte [ecx - 0x7d]
les eax, [ecx + eax*4]
dec ecx
pop edx
add byte [eax], al
pop edx
push ebx
add ebx, 0xfce5
and ebx, 0x5760
pop ebx
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
mov word [ebp - 0x1ee4], dx
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push edx
push esi
add esp, 4
sub edx, 0xe319
add edx, 0x424d
or edx, 0x1063d
pop edx
push ebx
jmp 0x4272ef
xor ebx, 0xee3b
sub ebx, 0x17a87
xor ebx, 0xb5a6
pop ebx
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push eax
push edx
add esp, 4
or eax, 0x29b3
and eax, 0x92de
pop eax
push ecx
jmp 0x427355
pop ecx
push esi
jmp 0x427360
pop esi
push eax
sub eax, 0x1288e
xor eax, 0x12d76
pop eax
mov dword [ebp - 0x10], 1
push edi
or edi, 0xb32
and edi, 0x10981
call 0x427390
add byte [esp + ecx*2], bh
inc ebx
aaa
dec ebx
xor eax, 0x4c48337
xor edi, 0x129fe
pop edi
push ecx
xor ecx, 0xd46c
sub ecx, 0x17dba
pop ecx
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push edi
or edi, 0x1e32
pop edi
push edx
sub edx, 0x15f0c
or edx, 0x113ee
and edx, 0x3a1d
pop edx
push edi
xor edi, 0x1502d
xor edi, 0xe979
pop edi
push ebx
sub ebx, 0x13af6
pop ebx
push eax
push edx
add esp, 4
or eax, 0x6807
sub eax, 0x2555
pop eax
push edi
call 0x427426
add byte [0x363b3546], dh
dec esi
cmp byte [ebx + 0x525f04c4], al
and edx, 0x18bc
or edx, 0xfd4f
pop edx
mov dword [ebp - 0x2c], 1
push esi
push ecx
add esp, 4
xor esi, 0x3d1e
pop esi
push edi
and edi, 0xc893
call 0x42745f
add byte [edx], bh
cmp eax, 0x414b483d
dec ecx
add esp, 4
pop edi
push eax
or eax, 0x1557c
or eax, 0x11a9f
pop eax
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x138
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x427652
push eax
push esi
add esp, 4
or eax, 0x5d63
xor eax, 0x1428b
sub eax, 0x11de6
pop eax
push edi
call 0x427f1a
add byte [edx], bh
inc esi
inc edi
dec eax
xor edi, dword [edx]
dec edi
dec eax
xor eax, 0x8104c483
iretd
Function at 0x42745f
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1fbc
push ebx
push esi
push edi
push edx
push edx
add esp, 4
or edx, 0xa6db
call 0x427209
add byte [eax + 0x40], cl
cmp byte [edi], dh
push eax
dec edi
push eax
xor al, byte [ecx - 0x7d]
les eax, [ecx + eax*4]
dec ecx
pop edx
add byte [eax], al
pop edx
push ebx
add ebx, 0xfce5
and ebx, 0x5760
pop ebx
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
mov word [ebp - 0x1ee4], dx
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push edx
push esi
add esp, 4
sub edx, 0xe319
add edx, 0x424d
or edx, 0x1063d
pop edx
push ebx
jmp 0x4272ef
xor ebx, 0xee3b
sub ebx, 0x17a87
xor ebx, 0xb5a6
pop ebx
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push eax
push edx
add esp, 4
or eax, 0x29b3
and eax, 0x92de
pop eax
push ecx
jmp 0x427355
pop ecx
push esi
jmp 0x427360
pop esi
push eax
sub eax, 0x1288e
xor eax, 0x12d76
pop eax
mov dword [ebp - 0x10], 1
push edi
or edi, 0xb32
and edi, 0x10981
call 0x427390
add byte [esp + ecx*2], bh
inc ebx
aaa
dec ebx
xor eax, 0x4c48337
xor edi, 0x129fe
pop edi
push ecx
xor ecx, 0xd46c
sub ecx, 0x17dba
pop ecx
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push edi
or edi, 0x1e32
pop edi
push edx
sub edx, 0x15f0c
or edx, 0x113ee
and edx, 0x3a1d
pop edx
push edi
xor edi, 0x1502d
xor edi, 0xe979
pop edi
push ebx
sub ebx, 0x13af6
pop ebx
push eax
push edx
add esp, 4
or eax, 0x6807
sub eax, 0x2555
pop eax
push edi
call 0x427426
add byte [0x363b3546], dh
dec esi
cmp byte [ebx + 0x525f04c4], al
and edx, 0x18bc
or edx, 0xfd4f
pop edx
mov dword [ebp - 0x2c], 1
push esi
push ecx
add esp, 4
xor esi, 0x3d1e
pop esi
push edi
and edi, 0xc893
call 0x42745f
add byte [edx], bh
cmp eax, 0x414b483d
dec ecx
add esp, 4
pop edi
push eax
or eax, 0x1557c
or eax, 0x11a9f
pop eax
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x138
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x427652
push eax
push esi
add esp, 4
or eax, 0x5d63
xor eax, 0x1428b
sub eax, 0x11de6
pop eax
push edi
call 0x427f1a
add byte [edx], bh
inc esi
inc edi
dec eax
xor edi, dword [edx]
dec edi
dec eax
xor eax, 0x8104c483
iretd
Function at 0x42b2d7
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x20
push ebx
push esi
push edi
lea ecx, [esp + 0x18]
call fcn.0040c060
mov ecx, 1
mov esi, dword [0x4a8e90]
mov edi, dword [0x4a8ec4]
cmp ecx, esi
jg 0x40d6a6
mov eax, ecx
inc ecx
test eax, eax
jle 0x40d6a6
shl eax, 4
add eax, edi
je 0x40d6a6
mov ebx, eax
lea eax, [ecx - 1]
mov dword [0x4a8014], eax
mov edx, dword [ebx + 4]
mov eax, dword [edx]
cmp word [eax + 8], 0
mov dword [esp + 0x10], ecx
jne 0x40d5f0
cmp dword [eax], 0x20
jne 0x40d5f0
mov edx, dword [edx + 4]
cmp word [edx + 8], 0x34
jne 0x42b2c4
mov ecx, dword [edx]
push ecx
lea esi, [esp + 0x1c]
call fcn.0040df50
mov edi, dword [esp + 0x18]
sub esp, 0x10
mov esi, esp
call fcn.00401b70
mov eax, 0x4a8054
call fcn.0040f1a0
test eax, eax
jne 0x42b2ca
mov edx, dword [ebx + 4]
mov eax, dword [edx + 8]
cmp word [eax + 8], 0x47
jne 0x42b2c4
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
push ebx
mov dword [esp + 0x24], 3
call fcn.0040da10
test eax, eax
jne 0x42b2db
mov ecx, dword [esp + 0x10]
jmp 0x40d5e4
mov esi, 0x4a8054
call fcn.00410470
lea ecx, [esp + 0x18]
call fcn.00402620
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x20
ret
jmp 0xe893b2c8
add byte [eax], al
add byte [eax], al
xor esi, dword [esi + 0x364f4d3d]
xor al, 0x32
add esp, 4
call 0x42b2e9
or al, byte [eax]
add byte [eax], al
add byte [esi], dh
inc edi
Function at 0x42c727
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
push ebx
add esp, 4
xor ebx, 0xab92
add ebx, 0x67f7
xor ebx, 0x143a8
and ebx, 0x18616
add dword [eax], eax
pop ebx
push eax
push eax
add esp, 4
and eax, 0x56ae
pop eax
push ecx
and ecx, 0xd905
pop ecx
mov ecx, dword [ebp - 0x3cc]
add ecx, 0xe
mov dword [ebp - 0x1918], ecx
push ebx
push edx
add esp, 4
sub ebx, 0x1654
sub ebx, 0x10140
add ebx, 0x8a39
add byte [ebx + 0x50], bl
push eax
add esp, 4
and eax, 0x1140a
or eax, 0xcab6
pop eax
push edi
xor edi, 0x1065e
add byte [edi - 0x7d], bl
mov ebp, 0xfffffc34
invalid
je 0x42c713
cmp dword [ebp - 0xa5c], 0
jne 0x42c759
push esi
and esi, 0xc684
call 0x42c727
add byte [eax + 0x4e], al
aas
inc edx
dec edi
dec esi
cmp eax, dword [ebx + 0x565e04c4]
sub esi, 0x156ab
xor esi, 0xc582
add esi, 0x6e45
and esi, 0x41f8
pop esi
mov edx, dword [ebp - 0x738]
mov dword [ebp - 0x18d0], edx
push 0
call dword [ebp - 0x18d0]
mov dword [ebp - 0x1fb0], 0xa
push ebx
push esi
add esp, 4
and ebx, 0x30b1
pop ebx
push edi
push eax
add esp, 4
xor edi, 0x10c75
or edi, 0x7551
pop edi
push edi
push edx
add esp, 4
jmp 0x42c78e
xor edi, 0x95ea
pop edi
mov eax, dword [ebp - 0x3cc]
mov cl, byte [eax + 0xa]
mov byte [ebp - 0x381], cl
mov edx, dword [ebp - 0xa5c]
sub edx, dword [ebp - 0x3cc]
mov dword [ebp - 0x158c], edx
mov dword [ebp - 0xc70], 0
push ecx
push eax
add esp, 4
or ecx, 0xc8af
or ecx, 0xb4b0
or ecx, 0x4c88
xor ecx, 0x1263c
pop ecx
push edi
push esi
add esp, 4
jmp 0x42c7eb
sub edi, 0x66f7
pop edi
mov byte [ebp - 0x960], 0x56
mov byte [ebp - 0x95f], 0x69
mov byte [ebp - 0x95e], 0x72
mov byte [ebp - 0x95d], 0x74
mov byte [ebp - 0x95c], 0x75
mov byte [ebp - 0x95b], 0x61
mov byte [ebp - 0x95a], 0x6c
mov byte [ebp - 0x959], 0x50
mov byte [ebp - 0x958], 0x72
mov byte [ebp - 0x957], 0x6f
mov byte [ebp - 0x956], 0x74
mov byte [ebp - 0x955], 0x65
mov byte [ebp - 0x954], 0x63
mov byte [ebp - 0x953], 0x74
mov byte [ebp - 0x952], 0
push edi
push eax
add esp, 4
and edi, 0x3599
sub edi, 0x61a5
pop edi
push esi
sub esi, 0xf928
add esi, 0xd2a0
call 0x42c889
add byte [ecx + eax*2], dh
xor bh, byte [edx]
dec ebx
cmp dword [ecx], edi
inc edi
inc ecx
add esp, 4
pop esi
mov eax, dword fs:[0x18]
mov dword [ebp - 0x1c34], eax
mov ecx, dword [ebp - 0x1c34]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x18d4], edx
mov eax, dword [ebp - 0x18d4]
mov dword [ebp - 0x150c], eax
push esi
push ebx
add esp, 4
jmp 0x42c8bf
pop esi
push ecx
push eax
add esp, 4
call 0x42c8d1
add byte [esi], dh
dec edx
xor al, 0x45
xor dl, byte [eax - 0x7d]
les eax, [ebx + ebp*8]
add edi, dword [edx]
xor al, byte ss:[ecx + 0x3bf4c9]
add byte [ecx + 0x375dc9], al
add byte [ecx - 0x7d], bl
mov ebp, 0xffffeaf4
add byte [ebp + 0xf], dh
mov dword [ebp - 0x2a8], 0
jmp fcn.0042cba5
Function at 0x42c8d1
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebx
add esp, 4
xor ebx, 0xab92
add ebx, 0x67f7
xor ebx, 0x143a8
and ebx, 0x18616
add dword [eax], eax
pop ebx
push eax
push eax
add esp, 4
and eax, 0x56ae
pop eax
push ecx
and ecx, 0xd905
pop ecx
mov ecx, dword [ebp - 0x3cc]
add ecx, 0xe
mov dword [ebp - 0x1918], ecx
push ebx
push edx
add esp, 4
sub ebx, 0x1654
sub ebx, 0x10140
add ebx, 0x8a39
add byte [ebx + 0x50], bl
push eax
add esp, 4
and eax, 0x1140a
or eax, 0xcab6
pop eax
push edi
xor edi, 0x1065e
add byte [edi - 0x7d], bl
mov ebp, 0xfffffc34
invalid
je 0x42c713
cmp dword [ebp - 0xa5c], 0
jne 0x42c759
push esi
and esi, 0xc684
call 0x42c727
add byte [eax + 0x4e], al
aas
inc edx
dec edi
dec esi
cmp eax, dword [ebx + 0x565e04c4]
sub esi, 0x156ab
xor esi, 0xc582
add esi, 0x6e45
and esi, 0x41f8
pop esi
mov edx, dword [ebp - 0x738]
mov dword [ebp - 0x18d0], edx
push 0
call dword [ebp - 0x18d0]
mov dword [ebp - 0x1fb0], 0xa
push ebx
push esi
add esp, 4
and ebx, 0x30b1
pop ebx
push edi
push eax
add esp, 4
xor edi, 0x10c75
or edi, 0x7551
pop edi
push edi
push edx
add esp, 4
jmp 0x42c78e
xor edi, 0x95ea
pop edi
mov eax, dword [ebp - 0x3cc]
mov cl, byte [eax + 0xa]
mov byte [ebp - 0x381], cl
mov edx, dword [ebp - 0xa5c]
sub edx, dword [ebp - 0x3cc]
mov dword [ebp - 0x158c], edx
mov dword [ebp - 0xc70], 0
push ecx
push eax
add esp, 4
or ecx, 0xc8af
or ecx, 0xb4b0
or ecx, 0x4c88
xor ecx, 0x1263c
pop ecx
push edi
push esi
add esp, 4
jmp 0x42c7eb
sub edi, 0x66f7
pop edi
mov byte [ebp - 0x960], 0x56
mov byte [ebp - 0x95f], 0x69
mov byte [ebp - 0x95e], 0x72
mov byte [ebp - 0x95d], 0x74
mov byte [ebp - 0x95c], 0x75
mov byte [ebp - 0x95b], 0x61
mov byte [ebp - 0x95a], 0x6c
mov byte [ebp - 0x959], 0x50
mov byte [ebp - 0x958], 0x72
mov byte [ebp - 0x957], 0x6f
mov byte [ebp - 0x956], 0x74
mov byte [ebp - 0x955], 0x65
mov byte [ebp - 0x954], 0x63
mov byte [ebp - 0x953], 0x74
mov byte [ebp - 0x952], 0
push edi
push eax
add esp, 4
and edi, 0x3599
sub edi, 0x61a5
pop edi
push esi
sub esi, 0xf928
add esi, 0xd2a0
call 0x42c889
add byte [ecx + eax*2], dh
xor bh, byte [edx]
dec ebx
cmp dword [ecx], edi
inc edi
inc ecx
add esp, 4
pop esi
mov eax, dword fs:[0x18]
mov dword [ebp - 0x1c34], eax
mov ecx, dword [ebp - 0x1c34]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x18d4], edx
mov eax, dword [ebp - 0x18d4]
mov dword [ebp - 0x150c], eax
push esi
push ebx
add esp, 4
jmp 0x42c8bf
pop esi
push ecx
push eax
add esp, 4
call 0x42c8d1
add byte [esi], dh
dec edx
xor al, 0x45
xor dl, byte [eax - 0x7d]
les eax, [ebx + ebp*8]
add edi, dword [edx]
xor al, byte ss:[ecx + 0x3bf4c9]
add byte [ecx + 0x375dc9], al
add byte [ecx - 0x7d], bl
mov ebp, 0xffffeaf4
add byte [ebp + 0xf], dh
mov dword [ebp - 0x2a8], 0
jmp fcn.0042cba5
Function at 0x42c977
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x58
push ebx
push ebp
mov ebp, dword [esp + 0x64]
push esi
push edi
mov esi, eax
push esi
lea edi, [esp + 0x30]
call fcn.0040f5e0
test eax, eax
je 0x42ca37
mov ebx, dword [esp + 0x74]
cmp dword [ebx], 4
je 0x42ca1f
mov edx, dword [esp + 0x70]
push 0
push 0x4848e8
push esi
push edx
push esi
push ebp
mov dword [ebx], 2
call fcn.004037e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret 0xc
push esi
push ebx
add esp, 4
call 0x42c977
add byte [esi + 0x45], al
dec ebp
aas
dec esp
inc ecx
add esp, 4
or esi, 0x163c1
pop esi
push eax
jmp 0x42c98b
xor eax, 0xbdcc
sub eax, 0xa1d1
pop eax
lea edx, [ebp - 0x1628]
mov dword [ebp - 0xc48], edx
mov eax, dword [ebp - 0x4e4]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc44], ecx
xor edx, edx
mov word [ebp - 0x204], dx
xor eax, eax
mov word [ebp - 0x38], ax
push edi
push edi
add esp, 4
sub edi, 0x10129
pop edi
push esi
add esi, 0x13e55
add esi, 0x16eae
and esi, 0x14877
pop esi
push edi
push eax
add esp, 4
sub edi, 0x1b10
sub edi, 0x106fd
pop edi
mov ecx, dword [ebp - 0xc44]
mov dx, word [ecx]
mov word [ebp - 0xf8a], dx
mov eax, dword [ebp - 0xc44]
add eax, 2
mov dword [ebp - 0xc44], eax
mov cx, word [ebp - 0xf8a]
mov word [ebp - 0x204], cx
mov edx, dword [ebp - 0xc48]
mov ax, word [edx]
mov word [ebp - 0xf8c], ax
mov ecx, dword [ebp - 0xc48]
invalid
add ecx, 2
mov dword [ebp - 0xc48], ecx
mov dx, word [ebp - 0xf8c]
mov word [ebp - 0x38], dx
push ecx
push edi
add esp, 4
or ecx, 0x4919
pop ecx
push edx
jmp 0x42ca60
xor edx, 0xd7ea
pop edx
push eax
push ebx
add esp, 4
call 0x42ca79
add byte [edi + 0x46], cl
dec ebx
aas
cmp al, 0x3e
dec ebx
add esp, 4
pop eax
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x42ca9a
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x1514], ecx
jmp 0x42caf4
movzx eax, word [ebp - 0x204]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x42c9c2
movzx edx, word [ebp - 0x204]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x42c9c2
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x42cade
mov dword [ebp - 0x1510], 0xffffffff
jmp 0x42cae8
mov dword [ebp - 0x1510], 1
mov eax, dword [ebp - 0x1510]
mov dword [ebp - 0x1514], eax
cmp dword [ebp - 0x1514], 0
jne 0x42cb3d
push eax
push esi
add esp, 4
xor eax, 0x1069e
jmp 0x42cb10
and eax, 0xb2fb
pop eax
push edx
add edx, 0x124a
sub edx, 0xebd8
pop edx
push esi
jmp 0x42cb2e
pop esi
mov ecx, dword [ebp - 0x4e4]
mov dword [ebp - 0x2a8], ecx
jmp fcn.0042cba5
push edx
jmp 0x42cb45
sub edx, 0x160c8
or edx, 0x4ad8
pop edx
push edi
call 0x42cb60
add byte [edx + 0x46], al
inc ecx
inc eax
cmp eax, 0xc483324b
add al, 0xeb
add ecx, dword [ecx + 0x45]
inc esp
or edi, 0xa548
pop edi
mov edx, dword [ebp - 0x4e4]
mov eax, dword [edx]
mov dword [ebp - 0x4e4], eax
mov ecx, dword [ebp - 0x4e4]
cmp ecx, dword [ebp - 0xc4c]
je 0x42cb9b
mov edx, dword [ebp - 0x4e4]
cmp dword [edx + 0x30], 0
jne 0x42c966
mov dword [ebp - 0x2a8], 0
Function at 0x42ca79
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x58
push ebx
push ebp
mov ebp, dword [esp + 0x64]
push esi
push edi
mov esi, eax
push esi
lea edi, [esp + 0x30]
call fcn.0040f5e0
test eax, eax
je 0x42ca37
mov ebx, dword [esp + 0x74]
cmp dword [ebx], 4
je 0x42ca1f
mov edx, dword [esp + 0x70]
push 0
push 0x4848e8
push esi
push edx
push esi
push ebp
mov dword [ebx], 2
call fcn.004037e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret 0xc
push esi
push ebx
add esp, 4
call 0x42c977
add byte [esi + 0x45], al
dec ebp
aas
dec esp
inc ecx
add esp, 4
or esi, 0x163c1
pop esi
push eax
jmp 0x42c98b
xor eax, 0xbdcc
sub eax, 0xa1d1
pop eax
lea edx, [ebp - 0x1628]
mov dword [ebp - 0xc48], edx
mov eax, dword [ebp - 0x4e4]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc44], ecx
xor edx, edx
mov word [ebp - 0x204], dx
xor eax, eax
mov word [ebp - 0x38], ax
push edi
push edi
add esp, 4
sub edi, 0x10129
pop edi
push esi
add esi, 0x13e55
add esi, 0x16eae
and esi, 0x14877
pop esi
push edi
push eax
add esp, 4
sub edi, 0x1b10
sub edi, 0x106fd
pop edi
mov ecx, dword [ebp - 0xc44]
mov dx, word [ecx]
mov word [ebp - 0xf8a], dx
mov eax, dword [ebp - 0xc44]
add eax, 2
mov dword [ebp - 0xc44], eax
mov cx, word [ebp - 0xf8a]
mov word [ebp - 0x204], cx
mov edx, dword [ebp - 0xc48]
mov ax, word [edx]
mov word [ebp - 0xf8c], ax
mov ecx, dword [ebp - 0xc48]
invalid
add ecx, 2
mov dword [ebp - 0xc48], ecx
mov dx, word [ebp - 0xf8c]
mov word [ebp - 0x38], dx
push ecx
push edi
add esp, 4
or ecx, 0x4919
pop ecx
push edx
jmp 0x42ca60
xor edx, 0xd7ea
pop edx
push eax
push ebx
add esp, 4
call 0x42ca79
add byte [edi + 0x46], cl
dec ebx
aas
cmp al, 0x3e
dec ebx
add esp, 4
pop eax
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x42ca9a
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x1514], ecx
jmp 0x42caf4
movzx eax, word [ebp - 0x204]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x42c9c2
movzx edx, word [ebp - 0x204]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x42c9c2
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x42cade
mov dword [ebp - 0x1510], 0xffffffff
jmp 0x42cae8
mov dword [ebp - 0x1510], 1
mov eax, dword [ebp - 0x1510]
mov dword [ebp - 0x1514], eax
cmp dword [ebp - 0x1514], 0
jne 0x42cb3d
push eax
push esi
add esp, 4
xor eax, 0x1069e
jmp 0x42cb10
and eax, 0xb2fb
pop eax
push edx
add edx, 0x124a
sub edx, 0xebd8
pop edx
push esi
jmp 0x42cb2e
pop esi
mov ecx, dword [ebp - 0x4e4]
mov dword [ebp - 0x2a8], ecx
jmp fcn.0042cba5
push edx
jmp 0x42cb45
sub edx, 0x160c8
or edx, 0x4ad8
pop edx
push edi
call 0x42cb60
add byte [edx + 0x46], al
inc ecx
inc eax
cmp eax, 0xc483324b
add al, 0xeb
add ecx, dword [ecx + 0x45]
inc esp
or edi, 0xa548
pop edi
mov edx, dword [ebp - 0x4e4]
mov eax, dword [edx]
mov dword [ebp - 0x4e4], eax
mov ecx, dword [ebp - 0x4e4]
cmp ecx, dword [ebp - 0xc4c]
je 0x42cb9b
mov edx, dword [ebp - 0x4e4]
cmp dword [edx + 0x30], 0
jne 0x42c966
mov dword [ebp - 0x2a8], 0
Function at 0x42cb60
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x58
push ebx
push ebp
mov ebp, dword [esp + 0x64]
push esi
push edi
mov esi, eax
push esi
lea edi, [esp + 0x30]
call fcn.0040f5e0
test eax, eax
je 0x42ca37
mov ebx, dword [esp + 0x74]
cmp dword [ebx], 4
je 0x42ca1f
mov edx, dword [esp + 0x70]
push 0
push 0x4848e8
push esi
push edx
push esi
push ebp
mov dword [ebx], 2
call fcn.004037e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret 0xc
push esi
push ebx
add esp, 4
call 0x42c977
add byte [esi + 0x45], al
dec ebp
aas
dec esp
inc ecx
add esp, 4
or esi, 0x163c1
pop esi
push eax
jmp 0x42c98b
xor eax, 0xbdcc
sub eax, 0xa1d1
pop eax
lea edx, [ebp - 0x1628]
mov dword [ebp - 0xc48], edx
mov eax, dword [ebp - 0x4e4]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc44], ecx
xor edx, edx
mov word [ebp - 0x204], dx
xor eax, eax
mov word [ebp - 0x38], ax
push edi
push edi
add esp, 4
sub edi, 0x10129
pop edi
push esi
add esi, 0x13e55
add esi, 0x16eae
and esi, 0x14877
pop esi
push edi
push eax
add esp, 4
sub edi, 0x1b10
sub edi, 0x106fd
pop edi
mov ecx, dword [ebp - 0xc44]
mov dx, word [ecx]
mov word [ebp - 0xf8a], dx
mov eax, dword [ebp - 0xc44]
add eax, 2
mov dword [ebp - 0xc44], eax
mov cx, word [ebp - 0xf8a]
mov word [ebp - 0x204], cx
mov edx, dword [ebp - 0xc48]
mov ax, word [edx]
mov word [ebp - 0xf8c], ax
mov ecx, dword [ebp - 0xc48]
invalid
add ecx, 2
mov dword [ebp - 0xc48], ecx
mov dx, word [ebp - 0xf8c]
mov word [ebp - 0x38], dx
push ecx
push edi
add esp, 4
or ecx, 0x4919
pop ecx
push edx
jmp 0x42ca60
xor edx, 0xd7ea
pop edx
push eax
push ebx
add esp, 4
call 0x42ca79
add byte [edi + 0x46], cl
dec ebx
aas
cmp al, 0x3e
dec ebx
add esp, 4
pop eax
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x42ca9a
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x1514], ecx
jmp 0x42caf4
movzx eax, word [ebp - 0x204]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x42c9c2
movzx edx, word [ebp - 0x204]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x42c9c2
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x42cade
mov dword [ebp - 0x1510], 0xffffffff
jmp 0x42cae8
mov dword [ebp - 0x1510], 1
mov eax, dword [ebp - 0x1510]
mov dword [ebp - 0x1514], eax
cmp dword [ebp - 0x1514], 0
jne 0x42cb3d
push eax
push esi
add esp, 4
xor eax, 0x1069e
jmp 0x42cb10
and eax, 0xb2fb
pop eax
push edx
add edx, 0x124a
sub edx, 0xebd8
pop edx
push esi
jmp 0x42cb2e
pop esi
mov ecx, dword [ebp - 0x4e4]
mov dword [ebp - 0x2a8], ecx
jmp fcn.0042cba5
push edx
jmp 0x42cb45
sub edx, 0x160c8
or edx, 0x4ad8
pop edx
push edi
call 0x42cb60
add byte [edx + 0x46], al
inc ecx
inc eax
cmp eax, 0xc483324b
add al, 0xeb
add ecx, dword [ecx + 0x45]
inc esp
or edi, 0xa548
pop edi
mov edx, dword [ebp - 0x4e4]
mov eax, dword [edx]
mov dword [ebp - 0x4e4], eax
mov ecx, dword [ebp - 0x4e4]
cmp ecx, dword [ebp - 0xc4c]
je 0x42cb9b
mov edx, dword [ebp - 0x4e4]
cmp dword [edx + 0x30], 0
jne 0x42c966
mov dword [ebp - 0x2a8], 0