joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100015a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
clc
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.100011f8
push eax
push esi
push dword [ebp + 8]
call fcn.100011ad
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.100011f8
push eax
push esi
push dword [ebp + 8]
call fcn.100011ad
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.100011e8
add dword [ebx - 0x6277adfc], esi
jl 0x1000166d
invalid
invalid

Function at 0x10002940
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
mov eax, dword [ebp - 0x700]
cmp eax, dword [ebp - 0x38c]
jae 0x1000298a
je 0x1000293e
invalid
mov eax, dword [ebp - 0x748]
add eax, dword [ebp - 0x700]
movsx eax, byte [eax]
movsx ecx, byte [ebp - 8]
xor eax, ecx
mov ecx, dword [ebp - 0x748]
add ecx, dword [ebp - 0x700]
mov byte [ecx], al
mov eax, dword [ebp - 0x748]
add eax, dword [ebp - 0x700]
movsx eax, byte [eax]
not eax
mov ecx, dword [ebp - 0x748]
add ecx, dword [ebp - 0x700]
mov byte [ecx], al
jmp 0x1000292b
and dword [ebp - 0x700], 0
jmp 0x100029a0
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
mov eax, dword [ebp - 0x700]
cmp eax, dword [ebp - 0x688]
jae 0x100029f2
mov eax, dword [ebp - 0x6f8]
add eax, dword [ebp - 0x700]
movsx eax, byte [eax]
movsx ecx, byte [ebp - 8]
xor eax, ecx
mov ecx, dword [ebp - 0x6f8]
add ecx, dword [ebp - 0x700]
mov byte [ecx], al
mov eax, dword [ebp - 0x6f8]
add eax, dword [ebp - 0x700]
movsx eax, byte [eax]
not eax
mov ecx, dword [ebp - 0x6f8]
add ecx, dword [ebp - 0x700]
mov byte [ecx], al
jmp 0x10002993
and byte [ebp - 0x714], 0
and byte [ebp - 0x713], 0
mov byte [ebp - 0x712], 0x71
and byte [ebp - 0x711], 0
mov byte [ebp - 0x710], 0xc8
mov byte [ebp - 0x70f], 0xe2
mov byte [ebp - 0x70e], 0xe1
mov byte [ebp - 0x70d], 0xe1
mov byte [ebp - 0x70c], 0xea
mov byte [ebp - 0x70b], 0xc8
mov byte [ebp - 0x70a], 0xe7
mov byte [ebp - 0x709], 0xf6
mov byte [ebp - 0x708], 0xbc
mov byte [ebp - 0x707], 0x8e
call fcn.100011e8
lodsd eax, dword [esi]
in eax, dx
popfd
invalid
invalid
movsd dword es:[edi], dword [esi]
invalid
Function at 0x1000e6b0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x1001a050]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor eax, eax
mov esi, ecx
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov dword [ebp - 0x210], esi
mov ebx, 0x1800
mov word [ebp - 0x20c], ax
call fcn.10012fe0
mov eax, dword [esi + 0x2c]
add esp, 0xc
push 0x208
lea edx, [ebp - 0x20c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000e7a3
push edi
push 0
push 0
push 0
push 8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
mov dword [ebp - 0x214], edi
test edi, edi
je 0x1000e7a2
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push 0
push 0
push 1
push edi
mov dword [ebp - 0x218], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
je 0x1000e795
mov edx, dword [ebp - 0x218]
mov ecx, edi
call fcn.1000e7c0
mov ebx, eax
test ebx, ebx
jne 0x1000e78e
mov ecx, dword [ebp - 0x210]
call fcn.1000ea40
mov ebx, eax
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
test esi, esi
je 0x1000e7ae
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.1000f5b7
mov esp, ebp
pop ebp
ret
Function at 0x1000e7c0
Capabilities:
Contain obfuscated stackstrings
Hash data using sha256
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2bc
mov eax, dword [0x1001a050]
xor eax, esp
mov dword [esp + 0x2b8], eax
push ebx
mov ebx, ecx
push esi
mov esi, dword [ebx + 0x3c]
add esi, ebx
mov ecx, 0x5a4d
mov eax, 0x1800
push edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], esi
cmp cx, word [ebx]
jne 0x1000ea2b
cmp dword [esi], 0x4550
jne 0x1000ea2b
cmp dword [esi + 0x58], 0
je 0x1000e82f
cmp dword [esi + 0x9c], 0
je 0x1000e82f
mov eax, dword [esi + 0x98]
sub eax, 0x240
mov dword [esp + 0xc], eax
jmp 0x1000e83b
add edx, 0xfffffdc0
mov dword [esp + 0xc], edx
mov eax, edx
add ebx, eax
lea ecx, [esp + 0x2a4]
mov dword [esp + 0x2a4], 0x6f72506e
mov dword [esp + 0x2a8], 0x74636574
mov dword [esp + 0x2ac], 0x70797263
mov dword [esp + 0x2b0], 0x246f74
mov dword [esp + 0x14], ebx
mov edx, 0x10
mov eax, ebx
sub ecx, ebx
lea ecx, [ecx]
mov edi, dword [ecx + eax]
cmp edi, dword [eax]
jne 0x1000ea17
sub edx, 4
add eax, 4
cmp edx, 4
jae 0x1000e880
xor eax, eax
lea ecx, [esp + 0x2a4]
mov byte [esp + 0x2a4], 0
mov dword [esp + 0x2a5], eax
mov dword [esp + 0x2a9], eax
mov dword [esp + 0x2ad], eax
mov dword [esp + 0x2b1], eax
mov dword [esp + 0x2b5], eax
mov dword [esp + 0x2b9], eax
mov dword [esp + 0x2bd], eax
mov word [esp + 0x2c1], ax
mov byte [esp + 0x2c3], al
test ecx, ecx
je 0x1000e93f
add ebx, 0x14
push 0x100
push ebx
mov dword [esp + 0x8c], eax
mov dword [esp + 0x88], eax
mov ecx, 8
mov esi, 0x100186d8
lea edi, [esp + 0x68]
lea ebx, [esp + 0x28]
rep movsd dword es:[edi], dword [esi]
call fcn.100010a0
mov esi, ebx
call fcn.100015a0
push 0x20
mov edx, ebx
push edx
lea eax, [esp + 0x2b4]
push eax
call fcn.10013090
mov esi, dword [esp + 0x30]
mov ebx, dword [esp + 0x28]
add esp, 0x14
mov eax, 0x20
lea ecx, [ebx + 0x114]
lea edx, [esp + 0x2a4]
mov edi, dword [edx]
cmp edi, dword [ecx]
jne 0x1000e967
sub eax, 4
add ecx, 4
add edx, 4
cmp eax, 4
jae 0x1000e951
jmp 0x1000e99b
movzx eax, byte [edx]
movzx edi, byte [ecx]
sub eax, edi
jne 0x1000e993
movzx eax, byte [edx + 1]
movzx edi, byte [ecx + 1]
sub eax, edi
jne 0x1000e993
movzx eax, byte [edx + 2]
movzx edi, byte [ecx + 2]
sub eax, edi
jne 0x1000e993
movzx eax, byte [edx + 3]
movzx ecx, byte [ecx + 3]
sub eax, ecx
sar eax, 0x1f
or eax, 1
jne 0x1000ea17
xor eax, eax
push 0x214
mov dword [esi + 0x58], eax
push eax
lea edx, [esp + 0x90]
mov dword [esi + 0x98], eax
push edx
mov dword [esi + 0x9c], eax
call fcn.10012fe0
mov eax, dword [ebx + 0x134]
mov dword [esp + 0x94], eax
mov ecx, dword [ebx + 0x138]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x1a0], ecx
push 0x100
lea edx, [ebx + 0x14]
push edx
lea esi, [ebx + 0x13c]
mov ecx, 0x40
lea edi, [esp + 0xa0]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x2c]
push eax
push ecx
lea ecx, [esp + 0xa4]
call fcn.1000a9f0
add esp, 0x1c
test eax, eax
jne 0x1000ea17
mov dword [esp + 0x10], eax
push 0x240
push 0
push ebx
call fcn.10012fe0
mov eax, dword [esp + 0x1c]
add esp, 0xc
mov ecx, dword [esp + 0x2c4]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1000f5b7
mov esp, ebp
pop ebp
ret
Function at 0x1000eba0
Capabilities:
Encode data using xor
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x3fc
mov ebx, eax
xor esi, esi
call fcn.1000f7b2
mov edi, eax
add esp, 4
test edi, edi
jne 0x1000ebc4
pop edi
pop esi
pop ebx
pop ebp
ret 4
push 0x3fc
push 0
push edi
call fcn.10012fe0
add esp, 0xc
xor ecx, ecx
mov eax, ecx
shl eax, 0x18
test eax, eax
jns 0x1000ebe8
add eax, eax
xor eax, 0x4c11db7
jmp 0x1000ebea
add eax, eax
test eax, eax
jns 0x1000ebf7
add eax, eax
xor eax, 0x4c11db7
jmp 0x1000ebf9
add eax, eax
test eax, eax
jns 0x1000ec06
add eax, eax
xor eax, 0x4c11db7
jmp 0x1000ec08
add eax, eax
test eax, eax
jns 0x1000ec15
add eax, eax
xor eax, 0x4c11db7
jmp 0x1000ec17
add eax, eax
test eax, eax
jns 0x1000ec24
add eax, eax
xor eax, 0x4c11db7
jmp 0x1000ec26
add eax, eax
test eax, eax
jns 0x1000ec33
add eax, eax
xor eax, 0x4c11db7
jmp 0x1000ec35
add eax, eax
test eax, eax
jns 0x1000ec42
add eax, eax
xor eax, 0x4c11db7
jmp 0x1000ec44
add eax, eax
test eax, eax
jns 0x1000ec51
add eax, eax
xor eax, 0x4c11db7
jmp 0x1000ec53
add eax, eax
mov dword [edi + ecx*4], eax
inc ecx
cmp ecx, 0xff
jb 0x1000ebd6
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x1000ec89
lea ebx, [ebx]
movzx edx, byte [ebx]
mov eax, esi
shr eax, 0x18
xor eax, edx
and eax, 0xfe
shl esi, 8
xor esi, dword [edi + eax*4]
inc ebx
dec ecx
jne 0x1000ec70
push edi
call fcn.1000f758
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x1000ece0
Capabilities:
Check for peb beingdebugged flag
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [sym.imp.USER32.dll_FindWindowA]
push 0
push str.WinDbgFrameClass
mov byte [ebp - 1], 0
call esi
test eax, eax
je 0x1000ed08
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
push 0
push str.OLLYDBG
call esi
test eax, eax
jne 0x1000ecfe
mov eax, dword fs:[0x30]
mov al, byte [eax + 2]
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
jne 0x1000ecfe
mov dword [ebp - 8], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x68]
mov dword [ebp - 8], eax
test byte [ebp - 8], 0x70
mov eax, 0
setne al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000ef20
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 8]
push 0
push eax
mov dword [esi], vtable.CNp_cu.0
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test byte [ebp + 8], 1
je 0x1000ef47
push esi
call fcn.1000f758
add esp, 4
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x1000ef50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 8], 0
jne 0x1000ef79
lea eax, [ebp - 4]
push eax
push 0
lea ecx, [esi + 4]
push ecx
push 0x1000ed90
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 8], eax
cmp dword [esi + 4], 0
je 0x1000ef94
mov edx, dword [ebp + 8]
mov dword [edx], 0
mov eax, 5
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x30
call fcn.1000f7b2
add esp, 4
test eax, eax
je 0x1000f009
mov edx, dword [ebp + 8]
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
push edi
mov edi, eax
mov ecx, 0xa
mov esi, str.918926adebdce99294240230fc59fccfd2339308
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor ecx, 0xfb331fd
mov dword [eax + 0x28], 1
mov dword [edx], ecx
mov ecx, dword [0x1001e970]
pop edi
mov esi, eax
mov dword [eax + 0x2c], ecx
call fcn.1000aea0
mov esi, eax
test esi, esi
jne 0x1000f000
call fcn.10004ab0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x1000f5b7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1001a050]
jne 0x1000f5c1
repz ret
jmp fcn.1000fc3a
Function at 0x422b60
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
and edx, 0x14209
sub edx, 0x42af
or edx, 0x181e1
pop edx
lea edx, [ebp - 0xc50]
mov dword [ebp - 0x6ac], edx
mov eax, dword [ebp - 0x25c]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x6a8], ecx
xor edx, edx
mov word [ebp - 0x114], dx
xor eax, eax
mov word [ebp - 0x28], ax
push ecx
push esi
add esp, 4
sub ecx, 0xfed0
and ecx, 0x4e22
or ecx, 0x5826
jmp 0x422bbc
pop ecx
push ecx
push esi
add esp, 4
and ecx, 0xfa32
or ecx, 0x13ecd
pop ecx
mov ecx, dword [ebp - 0x6a8]
mov dx, word [ecx]
mov word [ebp - 0x87a], dx
mov eax, dword [ebp - 0x6a8]
add eax, 2
mov dword [ebp - 0x6a8], eax
mov cx, word [ebp - 0x87a]
mov word [ebp - 0x114], cx
mov edx, dword [ebp - 0x6ac]
mov ax, word [edx]
mov word [ebp - 0x92c], ax
mov ecx, dword [ebp - 0x6ac]
add ecx, 2
mov dword [ebp - 0x6ac], ecx
mov dx, word [ebp - 0x92c]
mov word [ebp - 0x28], dx
push edi
push ebx
add esp, 4
sub edi, 0x17fc8
pop edi
push eax
push ecx
add esp, 4
or eax, 0x921f
jmp 0x422c45
xor eax, 0x15f2f
pop eax
push edx
push esi
add esp, 4
and edx, 0xaf9f
pop edx
movzx eax, word [ebp - 0x28]
test eax, eax
jne 0x422c75
movzx ecx, word [ebp - 0x114]
movzx edx, word [ebp - 0x28]
sub ecx, edx
mov dword [ebp - 0xb5c], ecx
jmp 0x422ccf
movzx eax, word [ebp - 0x114]
movzx ecx, word [ebp - 0x28]
cmp eax, ecx
je 0x422b9d
movzx edx, word [ebp - 0x114]
xor edx, 0x20
movzx eax, word [ebp - 0x28]
cmp edx, eax
je 0x422b9d
movzx ecx, word [ebp - 0x114]
movzx edx, word [ebp - 0x28]
cmp ecx, edx
jge 0x422cb9
mov dword [ebp - 0xb58], 0xffffffff
jmp 0x422cc3
mov dword [ebp - 0xb58], 1
mov eax, dword [ebp - 0xb58]
mov dword [ebp - 0xb5c], eax
cmp dword [ebp - 0xb5c], 0
jne 0x422d18
push edx
call 0x422ce7
add byte [ebp + 0x4e], cl
inc esp
cmp al, 0x46
cmp al, 0x36
add esp, 4
call 0x422cf8
add byte [eax + 0x3f], dl
inc ebp
dec edx
dec ebp
inc edx
inc ecx
xor eax, dword [ebx + 0x575a04c4]
xor edi, 0xc1d2
sub edi, 0x3149
pop edi
mov ecx, dword [ebp - 0x25c]
mov dword [ebp - 0x188], ecx
jmp 0x422d80
push eax
xor eax, 0x5ab7
sub eax, 0xf3e4
and eax, 0x1253d
add eax, 0xcf43
pop eax
push edx
call 0x422d40
add byte [edx], bh
inc ebx
xor al, 0x4d
inc eax
add esp, 4
sub edx, 0x24f9
pop edx
mov edx, dword [ebp - 0x25c]
mov eax, dword [edx]
mov dword [ebp - 0x25c], eax
mov ecx, dword [ebp - 0x25c]
cmp ecx, dword [ebp - 0x6b0]
je 0x422d76
mov edx, dword [ebp - 0x25c]
cmp dword [edx + 0x30], 0
jne 0x422b41
mov dword [ebp - 0x188], 0
Function at 0x422ce7
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
and edx, 0x14209
sub edx, 0x42af
or edx, 0x181e1
pop edx
lea edx, [ebp - 0xc50]
mov dword [ebp - 0x6ac], edx
mov eax, dword [ebp - 0x25c]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x6a8], ecx
xor edx, edx
mov word [ebp - 0x114], dx
xor eax, eax
mov word [ebp - 0x28], ax
push ecx
push esi
add esp, 4
sub ecx, 0xfed0
and ecx, 0x4e22
or ecx, 0x5826
jmp 0x422bbc
pop ecx
push ecx
push esi
add esp, 4
and ecx, 0xfa32
or ecx, 0x13ecd
pop ecx
mov ecx, dword [ebp - 0x6a8]
mov dx, word [ecx]
mov word [ebp - 0x87a], dx
mov eax, dword [ebp - 0x6a8]
add eax, 2
mov dword [ebp - 0x6a8], eax
mov cx, word [ebp - 0x87a]
mov word [ebp - 0x114], cx
mov edx, dword [ebp - 0x6ac]
mov ax, word [edx]
mov word [ebp - 0x92c], ax
mov ecx, dword [ebp - 0x6ac]
add ecx, 2
mov dword [ebp - 0x6ac], ecx
mov dx, word [ebp - 0x92c]
mov word [ebp - 0x28], dx
push edi
push ebx
add esp, 4
sub edi, 0x17fc8
pop edi
push eax
push ecx
add esp, 4
or eax, 0x921f
jmp 0x422c45
xor eax, 0x15f2f
pop eax
push edx
push esi
add esp, 4
and edx, 0xaf9f
pop edx
movzx eax, word [ebp - 0x28]
test eax, eax
jne 0x422c75
movzx ecx, word [ebp - 0x114]
movzx edx, word [ebp - 0x28]
sub ecx, edx
mov dword [ebp - 0xb5c], ecx
jmp 0x422ccf
movzx eax, word [ebp - 0x114]
movzx ecx, word [ebp - 0x28]
cmp eax, ecx
je 0x422b9d
movzx edx, word [ebp - 0x114]
xor edx, 0x20
movzx eax, word [ebp - 0x28]
cmp edx, eax
je 0x422b9d
movzx ecx, word [ebp - 0x114]
movzx edx, word [ebp - 0x28]
cmp ecx, edx
jge 0x422cb9
mov dword [ebp - 0xb58], 0xffffffff
jmp 0x422cc3
mov dword [ebp - 0xb58], 1
mov eax, dword [ebp - 0xb58]
mov dword [ebp - 0xb5c], eax
cmp dword [ebp - 0xb5c], 0
jne 0x422d18
push edx
call 0x422ce7
add byte [ebp + 0x4e], cl
inc esp
cmp al, 0x46
cmp al, 0x36
add esp, 4
call 0x422cf8
add byte [eax + 0x3f], dl
inc ebp
dec edx
dec ebp
inc edx
inc ecx
xor eax, dword [ebx + 0x575a04c4]
xor edi, 0xc1d2
sub edi, 0x3149
pop edi
mov ecx, dword [ebp - 0x25c]
mov dword [ebp - 0x188], ecx
jmp 0x422d80
push eax
xor eax, 0x5ab7
sub eax, 0xf3e4
and eax, 0x1253d
add eax, 0xcf43
pop eax
push edx
call 0x422d40
add byte [edx], bh
inc ebx
xor al, 0x4d
inc eax
add esp, 4
sub edx, 0x24f9
pop edx
mov edx, dword [ebp - 0x25c]
mov eax, dword [edx]
mov dword [ebp - 0x25c], eax
mov ecx, dword [ebp - 0x25c]
cmp ecx, dword [ebp - 0x6b0]
je 0x422d76
mov edx, dword [ebp - 0x25c]
cmp dword [edx + 0x30], 0
jne 0x422b41
mov dword [ebp - 0x188], 0
Function at 0x422cf8
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
and edx, 0x14209
sub edx, 0x42af
or edx, 0x181e1
pop edx
lea edx, [ebp - 0xc50]
mov dword [ebp - 0x6ac], edx
mov eax, dword [ebp - 0x25c]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x6a8], ecx
xor edx, edx
mov word [ebp - 0x114], dx
xor eax, eax
mov word [ebp - 0x28], ax
push ecx
push esi
add esp, 4
sub ecx, 0xfed0
and ecx, 0x4e22
or ecx, 0x5826
jmp 0x422bbc
pop ecx
push ecx
push esi
add esp, 4
and ecx, 0xfa32
or ecx, 0x13ecd
pop ecx
mov ecx, dword [ebp - 0x6a8]
mov dx, word [ecx]
mov word [ebp - 0x87a], dx
mov eax, dword [ebp - 0x6a8]
add eax, 2
mov dword [ebp - 0x6a8], eax
mov cx, word [ebp - 0x87a]
mov word [ebp - 0x114], cx
mov edx, dword [ebp - 0x6ac]
mov ax, word [edx]
mov word [ebp - 0x92c], ax
mov ecx, dword [ebp - 0x6ac]
add ecx, 2
mov dword [ebp - 0x6ac], ecx
mov dx, word [ebp - 0x92c]
mov word [ebp - 0x28], dx
push edi
push ebx
add esp, 4
sub edi, 0x17fc8
pop edi
push eax
push ecx
add esp, 4
or eax, 0x921f
jmp 0x422c45
xor eax, 0x15f2f
pop eax
push edx
push esi
add esp, 4
and edx, 0xaf9f
pop edx
movzx eax, word [ebp - 0x28]
test eax, eax
jne 0x422c75
movzx ecx, word [ebp - 0x114]
movzx edx, word [ebp - 0x28]
sub ecx, edx
mov dword [ebp - 0xb5c], ecx
jmp 0x422ccf
movzx eax, word [ebp - 0x114]
movzx ecx, word [ebp - 0x28]
cmp eax, ecx
je 0x422b9d
movzx edx, word [ebp - 0x114]
xor edx, 0x20
movzx eax, word [ebp - 0x28]
cmp edx, eax
je 0x422b9d
movzx ecx, word [ebp - 0x114]
movzx edx, word [ebp - 0x28]
cmp ecx, edx
jge 0x422cb9
mov dword [ebp - 0xb58], 0xffffffff
jmp 0x422cc3
mov dword [ebp - 0xb58], 1
mov eax, dword [ebp - 0xb58]
mov dword [ebp - 0xb5c], eax
cmp dword [ebp - 0xb5c], 0
jne 0x422d18
push edx
call 0x422ce7
add byte [ebp + 0x4e], cl
inc esp
cmp al, 0x46
cmp al, 0x36
add esp, 4
call 0x422cf8
add byte [eax + 0x3f], dl
inc ebp
dec edx
dec ebp
inc edx
inc ecx
xor eax, dword [ebx + 0x575a04c4]
xor edi, 0xc1d2
sub edi, 0x3149
pop edi
mov ecx, dword [ebp - 0x25c]
mov dword [ebp - 0x188], ecx
jmp 0x422d80
push eax
xor eax, 0x5ab7
sub eax, 0xf3e4
and eax, 0x1253d
add eax, 0xcf43
pop eax
push edx
call 0x422d40
add byte [edx], bh
inc ebx
xor al, 0x4d
inc eax
add esp, 4
sub edx, 0x24f9
pop edx
mov edx, dword [ebp - 0x25c]
mov eax, dword [edx]
mov dword [ebp - 0x25c], eax
mov ecx, dword [ebp - 0x25c]
cmp ecx, dword [ebp - 0x6b0]
je 0x422d76
mov edx, dword [ebp - 0x25c]
cmp dword [edx + 0x30], 0
jne 0x422b41
mov dword [ebp - 0x188], 0
Function at 0x422d40
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
and edx, 0x14209
sub edx, 0x42af
or edx, 0x181e1
pop edx
lea edx, [ebp - 0xc50]
mov dword [ebp - 0x6ac], edx
mov eax, dword [ebp - 0x25c]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x6a8], ecx
xor edx, edx
mov word [ebp - 0x114], dx
xor eax, eax
mov word [ebp - 0x28], ax
push ecx
push esi
add esp, 4
sub ecx, 0xfed0
and ecx, 0x4e22
or ecx, 0x5826
jmp 0x422bbc
pop ecx
push ecx
push esi
add esp, 4
and ecx, 0xfa32
or ecx, 0x13ecd
pop ecx
mov ecx, dword [ebp - 0x6a8]
mov dx, word [ecx]
mov word [ebp - 0x87a], dx
mov eax, dword [ebp - 0x6a8]
add eax, 2
mov dword [ebp - 0x6a8], eax
mov cx, word [ebp - 0x87a]
mov word [ebp - 0x114], cx
mov edx, dword [ebp - 0x6ac]
mov ax, word [edx]
mov word [ebp - 0x92c], ax
mov ecx, dword [ebp - 0x6ac]
add ecx, 2
mov dword [ebp - 0x6ac], ecx
mov dx, word [ebp - 0x92c]
mov word [ebp - 0x28], dx
push edi
push ebx
add esp, 4
sub edi, 0x17fc8
pop edi
push eax
push ecx
add esp, 4
or eax, 0x921f
jmp 0x422c45
xor eax, 0x15f2f
pop eax
push edx
push esi
add esp, 4
and edx, 0xaf9f
pop edx
movzx eax, word [ebp - 0x28]
test eax, eax
jne 0x422c75
movzx ecx, word [ebp - 0x114]
movzx edx, word [ebp - 0x28]
sub ecx, edx
mov dword [ebp - 0xb5c], ecx
jmp 0x422ccf
movzx eax, word [ebp - 0x114]
movzx ecx, word [ebp - 0x28]
cmp eax, ecx
je 0x422b9d
movzx edx, word [ebp - 0x114]
xor edx, 0x20
movzx eax, word [ebp - 0x28]
cmp edx, eax
je 0x422b9d
movzx ecx, word [ebp - 0x114]
movzx edx, word [ebp - 0x28]
cmp ecx, edx
jge 0x422cb9
mov dword [ebp - 0xb58], 0xffffffff
jmp 0x422cc3
mov dword [ebp - 0xb58], 1
mov eax, dword [ebp - 0xb58]
mov dword [ebp - 0xb5c], eax
cmp dword [ebp - 0xb5c], 0
jne 0x422d18
push edx
call 0x422ce7
add byte [ebp + 0x4e], cl
inc esp
cmp al, 0x46
cmp al, 0x36
add esp, 4
call 0x422cf8
add byte [eax + 0x3f], dl
inc ebp
dec edx
dec ebp
inc edx
inc ecx
xor eax, dword [ebx + 0x575a04c4]
xor edi, 0xc1d2
sub edi, 0x3149
pop edi
mov ecx, dword [ebp - 0x25c]
mov dword [ebp - 0x188], ecx
jmp 0x422d80
push eax
xor eax, 0x5ab7
sub eax, 0xf3e4
and eax, 0x1253d
add eax, 0xcf43
pop eax
push edx
call 0x422d40
add byte [edx], bh
inc ebx
xor al, 0x4d
inc eax
add esp, 4
sub edx, 0x24f9
pop edx
mov edx, dword [ebp - 0x25c]
mov eax, dword [edx]
mov dword [ebp - 0x25c], eax
mov ecx, dword [ebp - 0x25c]
cmp ecx, dword [ebp - 0x6b0]
je 0x422d76
mov edx, dword [ebp - 0x25c]
cmp dword [edx + 0x30], 0
jne 0x422b41
mov dword [ebp - 0x188], 0