joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41daa0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46defd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0
cmp esi, 0xffffffff
je 0x41dba3
test esi, esi
je 0x41dba3
push ebx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp dword [ebp - 0x10], 0
mov dword [ebp - 0x18], eax
je 0x41db2b
push esi
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop ebx
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [ebp + 0xc]
mov ecx, edi
mov ebx, dword [edi + 4]
sub ebx, dword [edi]
add eax, ebx
push eax
call fcn.004278c0
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push dword [ebp - 0x18]
mov eax, dword [edi]
add eax, ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41db87
mov eax, dword [ebp - 0x14]
mov ecx, edi
add eax, ebx
push eax
call fcn.004278c0
pop edi
push esi
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop ebx
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
pop edi
push esi
mov bl, 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop ebx
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
xor al, al
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x424000
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x46ce90
push eax
mov dword fs:[0], esp
push esi
mov esi, ecx
push edi
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.004026a0
mov edi, eax
add esp, 4
test edi, edi
je 0x4240a0
push 1
mov dword [ebp - 4], 0
call fcn.00437acf
mov dword [edi + 4], eax
add esp, 4
mov dword [esi + 0x30], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x30], 0
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x426510
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x426541
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x426530
pop edi
mov eax, edx
pop esi
pop ebp
ret 8

Function at 0x426550
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x426581
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x426570
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x4297b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [esi], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 8], eax
lea eax, [esi + 0xc]
mov dword [esi + 4], 0
push eax
mov byte [esi + 0x24], 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
push 0
push esi
push 0x42b0a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x42a3a0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x46cc80
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
mov edi, ecx
mov eax, dword [edi]
cmp eax, 0xffffffff
je 0x42a3d5
push eax
call ebx
mov dword [edi], 0xffffffff
cmp dword [edi + 4], 0xffffffff
je 0x42a4c5
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push dword [edi]
mov byte [edi + 0x24], 1
call ebx
push str.Kernel32.dll
mov dword [edi], 0xffffffff
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
push str.CancelSynchronousIo
push esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x42a46a
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
push dword [edi + 4]
call ebx
test eax, eax
jne 0x42a44d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x42a44d
push 0
push dword [edi + 4]
call esi
cmp eax, 0x102
jne 0x42a44d
push 0x3e8
push dword [edi + 4]
call esi
jmp 0x42a420
push 0xffffffffffffffff
push dword [edi + 4]
call esi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
jmp 0x42a4ab
push 0x3e8
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x42a48f
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push esi
jmp 0x42a4ae
lea esi, [edi + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 4], 0xffffffff
pop esi
lea eax, [edi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov ecx, dword [ebp - 0xc]
pop edi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x42ea00
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x46e7fd
push eax
mov dword fs:[0], esp
sub esp, 0xc
push edi
mov edi, ecx
cmp dword [edi + 4], 0xffffffff
je 0x42eb27
push ebx
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push dword [edi]
mov byte [edi + 0x24], 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.Kernel32.dll
mov dword [edi], 0xffffffff
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.CancelSynchronousIo
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x42eadb
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [edi + 4]
call ebx
test eax, eax
jne 0x42eaa1
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x42eaa1
push 0
push dword [edi + 4]
call esi
cmp eax, 0x102
jne 0x42eaa1
push 0x3e8
push dword [edi + 4]
call esi
jmp 0x42ea74
push 0xffffffffffffffff
push dword [edi + 4]
call esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push dword [ebp - 0x14]
mov esi, dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
pop esi
pop ebx
pop edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push 0x3e8
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x42eaa8
lea esi, [edi + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [ebp - 0x14]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
pop esi
pop ebx
pop edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop edi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x433fc0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x433fcd
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.00433fd5
Function at 0x43b120
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
push ecx
add esp, 4
and ebx, 0x10362
sub ebx, 0x1711d
and ebx, 0x9e9c
pop ebx
push ecx
and ecx, 0x122a2
xor ecx, 0x17429
xor ecx, 0x6e49
and ecx, 0x136ca
pop ecx
lea ecx, [ebp - 0x1738]
mov dword [ebp - 0xc94], ecx
mov edx, dword [ebp - 0x504]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xc90], eax
xor ecx, ecx
mov word [ebp - 0x210], cx
xor edx, edx
mov word [ebp - 0x10c], dx
push ebx
push eax
add esp, 4
add ebx, 0x12d4c
or ebx, 0x108cd
add ebx, 0x18fc
pop ebx
push ebx
and ebx, 0xf909
xor ebx, 0x10423
and ebx, 0x87d2
or ebx, 0x5723
pop ebx
mov eax, dword [ebp - 0xc90]
mov cx, word [eax]
mov word [ebp - 0x1032], cx
mov edx, dword [ebp - 0xc90]
add edx, 2
mov dword [ebp - 0xc90], edx
mov ax, word [ebp - 0x1032]
mov word [ebp - 0x210], ax
mov ecx, dword [ebp - 0xc94]
mov dx, word [ecx]
mov word [ebp - 0x1034], dx
mov eax, dword [ebp - 0xc94]
add eax, 2
mov dword [ebp - 0xc94], eax
mov cx, word [ebp - 0x1034]
mov word [ebp - 0x10c], cx
push ebx
push esi
add esp, 4
and ebx, 0x80ee
pop ebx
push esi
jmp 0x43b210
call 0x43b21c
add byte [ebx + edi], dh
inc esi
cmp al, byte [eax + 0x4f]
add esp, 4
and esi, 0x12318
sub esi, 0x13106
pop esi
movzx edx, word [ebp - 0x10c]
test edx, edx
jne 0x43b24f
movzx eax, word [ebp - 0x210]
movzx ecx, word [ebp - 0x10c]
sub eax, ecx
mov dword [ebp - 0x15e0], eax
jmp 0x43b2b2
invalid

Function at 0x43b21c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
push ecx
add esp, 4
and ebx, 0x10362
sub ebx, 0x1711d
and ebx, 0x9e9c
pop ebx
push ecx
and ecx, 0x122a2
xor ecx, 0x17429
xor ecx, 0x6e49
and ecx, 0x136ca
pop ecx
lea ecx, [ebp - 0x1738]
mov dword [ebp - 0xc94], ecx
mov edx, dword [ebp - 0x504]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xc90], eax
xor ecx, ecx
mov word [ebp - 0x210], cx
xor edx, edx
mov word [ebp - 0x10c], dx
push ebx
push eax
add esp, 4
add ebx, 0x12d4c
or ebx, 0x108cd
add ebx, 0x18fc
pop ebx
push ebx
and ebx, 0xf909
xor ebx, 0x10423
and ebx, 0x87d2
or ebx, 0x5723
pop ebx
mov eax, dword [ebp - 0xc90]
mov cx, word [eax]
mov word [ebp - 0x1032], cx
mov edx, dword [ebp - 0xc90]
add edx, 2
mov dword [ebp - 0xc90], edx
mov ax, word [ebp - 0x1032]
mov word [ebp - 0x210], ax
mov ecx, dword [ebp - 0xc94]
mov dx, word [ecx]
mov word [ebp - 0x1034], dx
mov eax, dword [ebp - 0xc94]
add eax, 2
mov dword [ebp - 0xc94], eax
mov cx, word [ebp - 0x1034]
mov word [ebp - 0x10c], cx
push ebx
push esi
add esp, 4
and ebx, 0x80ee
pop ebx
push esi
jmp 0x43b210
call 0x43b21c
add byte [ebx + edi], dh
inc esi
cmp al, byte [eax + 0x4f]
add esp, 4
and esi, 0x12318
sub esi, 0x13106
pop esi
movzx edx, word [ebp - 0x10c]
test edx, edx
jne 0x43b24f
movzx eax, word [ebp - 0x210]
movzx ecx, word [ebp - 0x10c]
sub eax, ecx
mov dword [ebp - 0x15e0], eax
jmp 0x43b2b2
invalid
Function at 0x43b2e3
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
add esi, 0xed0
pop esi
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0x31c], eax
jmp 0x43b363
push edx
and edx, 0x16ae3
add edx, 0x1642
and edx, 0x560a
pop edx
push eax
jmp fcn.0043b37f

Function at 0x43b2fd
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov bh, 0x85
invalid
jecxz 0x43b27f
sbb al, byte [eax]
add byte [ebx + 0x53], bl

Function at 0x43b317
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
and ebx, 0x1307a
xor ebx, 0x17b04
sub ebx, 0x527e
pop ebx
mov ecx, dword [ebp - 0x504]
mov edx, dword [ecx]
mov dword [ebp - 0x504], edx
mov eax, dword [ebp - 0x504]
cmp eax, dword [ebp - 0xc98]
je 0x43b359
mov ecx, dword [ebp - 0x504]
cmp dword [ecx + 0x30], 0
jne 0x43b10f
mov dword [ebp - 0x31c], 0

Function at 0x43b360
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
invalid
add byte [eax], al
add byte [edx - 0x7f], dl
loop 0x43b34a
push 1
add byte [ecx + 0x1642c2], al
add byte [ecx + 0x560ae2], al
add byte [edx + 0x50], bl
Function at 0x43b806
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
jmp 0x43b738
mov eax, dword [ebp - 0x15e8]
mov dword [ebp - 0x15ec], eax
cmp dword [ebp - 0x15ec], 0
jne 0x43b78d
push edi
jmp 0x43b755
and edi, 0xc9d4
and edi, 0x12ff5
and edi, 0x6972
pop edi
push ecx
push ebx
add esp, 4
jmp 0x43b772
and ecx, 0x1578
and ecx, 0x69c4
pop ecx
mov ecx, dword [ebp - 0x508]
mov dword [ebp - 0x750], ecx
jmp 0x43b7f5
push eax
xor eax, 0x150ff
add eax, 0x17412
jmp 0x43b7a1
jmp 0x43b7a6
pop eax
push eax
push ebx
add esp, 4
add eax, 0x137ab
add eax, 0x14ec5
add eax, 0x3d85
pop eax
mov edx, dword [ebp - 0x508]
mov eax, dword [edx]
mov dword [ebp - 0x508], eax
mov ecx, dword [ebp - 0x508]
cmp ecx, dword [ebp - 0xca4]
je 0x43b7eb
mov edx, dword [ebp - 0x508]
cmp dword [edx + 0x30], 0
jne 0x43b5a1
mov dword [ebp - 0x750], 0
push edx
call 0x43b806
add byte [esi + esi + 0x3e], cl
dec edi
aas
push eax
dec ebx
inc ebp
cmp cl, byte [ebx - 0x7d]
les eax, [ecx + eax*4]
retf 0x7437

Function at 0x43b823
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edx
cmp dword [ebp - 0x750], 0
jne 0x43b871
push edx
push edx
add esp, 4
xor edx, 0xfbd9
pop edx
push ecx
call 0x43b849
add byte [ebp + 0x32], al
cmp dword [ebp + 0x4d], ecx
add esp, 4
call 0x43b858
add byte [eax + 0x41], al
cmp byte [eax], bh
inc ebp
dec esi
add esp, 4
and ecx, 0x15d8f
pop ecx
mov dword [ebp - 0x79c], 0
jmp 0x43c398
push esi
sub esi, 0x6064
add esi, 0xe640
sub esi, 0x7aa0
pop esi
push ebx
push ebx
add esp, 4
xor ebx, 0xd9bd
add ebx, 0x3065
add ebx, 0xc1cb
or ebx, 0xd0d3
pop ebx
mov eax, dword [ebp - 0x750]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x320], ecx
mov dword [ebp - 0x760], 0
mov edx, dword [ebp - 0x320]
mov dword [ebp - 0x15f0], edx
cmp dword [ebp - 0x15f0], 0
jne 0x43b8e2
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0x3f4], eax
jmp 0x43bbd3
mov ecx, dword [ebp - 0x15f0]
mov edx, dword [ebp - 0x320]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x15f4], edx
jne 0x43b90a
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0x3f4], eax
jmp 0x43bbd3
mov ecx, 8
imul edx, ecx, 0
mov eax, dword [ebp - 0x15f4]
mov ecx, dword [eax + edx + 0x78]
mov dword [ebp - 0x15f8], ecx
cmp dword [ebp - 0x15f8], 0
jne 0x43b93c
mov edx, dword [ebp - 0x760]
mov dword [ebp - 0x3f4], edx
jmp 0x43bbd3
mov eax, dword [ebp - 0x320]
add eax, dword [ebp - 0x15f8]
mov dword [ebp - 0x754], eax
jne 0x43b961
mov ecx, dword [ebp - 0x760]
mov dword [ebp - 0x3f4], ecx
jmp 0x43bbd3
mov edx, dword [ebp - 0x754]
mov eax, dword [ebp - 0x320]
add eax, dword [edx + 0x20]
mov dword [ebp - 0x1964], eax
mov ecx, dword [ebp - 0x754]
mov edx, dword [ebp - 0x320]
add edx, dword [ecx + 0x24]
mov dword [ebp - 0x1968], edx
mov eax, dword [ebp - 0x754]
mov ecx, dword [ebp - 0x320]
inc dword [ebx]
dec eax
sbb al, 0x89
lea edx, [esi - 0x7a380001]
test al, 0xf8
invalid
inc dword [eax]
add byte [eax], al
add bl, ch
invalid
Function at 0x43b849
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edx
cmp dword [ebp - 0x750], 0
jne 0x43b871
push edx
push edx
add esp, 4
xor edx, 0xfbd9
pop edx
push ecx
call 0x43b849
add byte [ebp + 0x32], al
cmp dword [ebp + 0x4d], ecx
add esp, 4
call 0x43b858
add byte [eax + 0x41], al
cmp byte [eax], bh
inc ebp
dec esi
add esp, 4
and ecx, 0x15d8f
pop ecx
mov dword [ebp - 0x79c], 0
jmp 0x43c398
push esi
sub esi, 0x6064
add esi, 0xe640
sub esi, 0x7aa0
pop esi
push ebx
push ebx
add esp, 4
xor ebx, 0xd9bd
add ebx, 0x3065
add ebx, 0xc1cb
or ebx, 0xd0d3
pop ebx
mov eax, dword [ebp - 0x750]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x320], ecx
mov dword [ebp - 0x760], 0
mov edx, dword [ebp - 0x320]
mov dword [ebp - 0x15f0], edx
cmp dword [ebp - 0x15f0], 0
jne 0x43b8e2
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0x3f4], eax
jmp 0x43bbd3
mov ecx, dword [ebp - 0x15f0]
mov edx, dword [ebp - 0x320]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x15f4], edx
jne 0x43b90a
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0x3f4], eax
jmp 0x43bbd3
mov ecx, 8
imul edx, ecx, 0
mov eax, dword [ebp - 0x15f4]
mov ecx, dword [eax + edx + 0x78]
mov dword [ebp - 0x15f8], ecx
cmp dword [ebp - 0x15f8], 0
jne 0x43b93c
mov edx, dword [ebp - 0x760]
mov dword [ebp - 0x3f4], edx
jmp 0x43bbd3
mov eax, dword [ebp - 0x320]
add eax, dword [ebp - 0x15f8]
mov dword [ebp - 0x754], eax
jne 0x43b961
mov ecx, dword [ebp - 0x760]
mov dword [ebp - 0x3f4], ecx
jmp 0x43bbd3
mov edx, dword [ebp - 0x754]
mov eax, dword [ebp - 0x320]
add eax, dword [edx + 0x20]
mov dword [ebp - 0x1964], eax
mov ecx, dword [ebp - 0x754]
mov edx, dword [ebp - 0x320]
add edx, dword [ecx + 0x24]
mov dword [ebp - 0x1968], edx
mov eax, dword [ebp - 0x754]
mov ecx, dword [ebp - 0x320]
inc dword [ebx]
dec eax
sbb al, 0x89
lea edx, [esi - 0x7a380001]
test al, 0xf8
invalid
inc dword [eax]
add byte [eax], al
add bl, ch
invalid
Function at 0x43b858
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edx
cmp dword [ebp - 0x750], 0
jne 0x43b871
push edx
push edx
add esp, 4
xor edx, 0xfbd9
pop edx
push ecx
call 0x43b849
add byte [ebp + 0x32], al
cmp dword [ebp + 0x4d], ecx
add esp, 4
call 0x43b858
add byte [eax + 0x41], al
cmp byte [eax], bh
inc ebp
dec esi
add esp, 4
and ecx, 0x15d8f
pop ecx
mov dword [ebp - 0x79c], 0
jmp 0x43c398
push esi
sub esi, 0x6064
add esi, 0xe640
sub esi, 0x7aa0
pop esi
push ebx
push ebx
add esp, 4
xor ebx, 0xd9bd
add ebx, 0x3065
add ebx, 0xc1cb
or ebx, 0xd0d3
pop ebx
mov eax, dword [ebp - 0x750]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x320], ecx
mov dword [ebp - 0x760], 0
mov edx, dword [ebp - 0x320]
mov dword [ebp - 0x15f0], edx
cmp dword [ebp - 0x15f0], 0
jne 0x43b8e2
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0x3f4], eax
jmp 0x43bbd3
mov ecx, dword [ebp - 0x15f0]
mov edx, dword [ebp - 0x320]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x15f4], edx
jne 0x43b90a
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0x3f4], eax
jmp 0x43bbd3
mov ecx, 8
imul edx, ecx, 0
mov eax, dword [ebp - 0x15f4]
mov ecx, dword [eax + edx + 0x78]
mov dword [ebp - 0x15f8], ecx
cmp dword [ebp - 0x15f8], 0
jne 0x43b93c
mov edx, dword [ebp - 0x760]
mov dword [ebp - 0x3f4], edx
jmp 0x43bbd3
mov eax, dword [ebp - 0x320]
add eax, dword [ebp - 0x15f8]
mov dword [ebp - 0x754], eax
jne 0x43b961
mov ecx, dword [ebp - 0x760]
mov dword [ebp - 0x3f4], ecx
jmp 0x43bbd3
mov edx, dword [ebp - 0x754]
mov eax, dword [ebp - 0x320]
add eax, dword [edx + 0x20]
mov dword [ebp - 0x1964], eax
mov ecx, dword [ebp - 0x754]
mov edx, dword [ebp - 0x320]
add edx, dword [ecx + 0x24]
mov dword [ebp - 0x1968], edx
mov eax, dword [ebp - 0x754]
mov ecx, dword [ebp - 0x320]
inc dword [ebx]
dec eax
sbb al, 0x89
lea edx, [esi - 0x7a380001]
test al, 0xf8
invalid
inc dword [eax]
add byte [eax], al
add bl, ch
invalid

Function at 0x43b996
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
inc dword [ebx]
dec eax
sbb al, 0x89
lea edx, [esi - 0x7a380001]
test al, 0xf8
invalid
Function at 0x43be38
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edi
push ebx
add esp, 4
add edi, 0x865d
xor edi, 0x8fea
or edi, 0xdc99
call fcn.0043be38
add byte [ebp + 0x37], cl
inc edx
cmp al, 0x43
inc ebp
add esp, 4
pop edi
push edx
jmp 0x43be46
pop edx
mov ecx, dword [ebp - 0xcac]
mov dx, word [ecx]
mov word [ebp - 0x103a], dx
mov eax, dword [ebp - 0xcac]
add eax, 2
mov dword [ebp - 0xcac], eax
mov cx, word [ebp - 0x103a]
mov word [ebp - 0x218], cx
mov edx, dword [ebp - 0xcb0]
mov ax, word [edx]
mov word [ebp - 0x103c], ax
mov ecx, dword [ebp - 0xcb0]
add ecx, 2
mov dword [ebp - 0xcb0], ecx
mov dx, word [ebp - 0x103c]
mov word [ebp - 0x34], dx
push edx
xor edx, 0x423b
pop edx
push edx
call 0x43beb7
add byte [ebp + 0x38], cl
inc eax
dec esp
push eax
dec esp
dec ecx
xor eax, 0xc4833447
add al, 0xe8
pop es
add byte [eax], al
add byte [eax], al
xor al, byte [edi + esi + 0x47]
inc edx
inc esi
add esp, 4
sub edx, 0x16c57
pop edx
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x43beed
movzx ecx, word [ebp - 0x218]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x1604], ecx
jmp 0x43bf47
movzx eax, word [ebp - 0x218]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x43be15
movzx edx, word [ebp - 0x218]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x43be15
movzx ecx, word [ebp - 0x218]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x43bf31
mov dword [ebp - 0x1600], 0xffffffff
jmp 0x43bf3b
mov dword [ebp - 0x1600], 1
mov eax, dword [ebp - 0x1600]
mov dword [ebp - 0x1604], eax
cmp dword [ebp - 0x1604], 0
jne 0x43bf90
push edx
push ecx
add esp, 4
jmp 0x43bf5e
xor edx, 0x794c
jmp 0x43bf69
pop edx
push ebx
push eax
add esp, 4
and ebx, 0xdb65
xor ebx, 0xa24e
or ebx, 0x2e3e
pop ebx
mov ecx, dword [ebp - 0x50c]
mov dword [ebp - 0x31c], ecx
jmp 0x43bff8
push esi
jmp 0x43bf97
sub esi, 0x13fd2
add esi, 0x64e2
pop esi
push ecx
push ecx
add esp, 4
jmp 0x43bfaf
add ecx, 0x4cd1
add ecx, 0x4b8c
add ecx, 0x17b9a
pop ecx
mov edx, dword [ebp - 0x50c]
mov eax, dword [edx]
mov dword [ebp - 0x50c], eax
mov ecx, dword [ebp - 0x50c]
cmp ecx, dword [ebp - 0xcb4]
je 0x43bfee
mov edx, dword [ebp - 0x50c]
cmp dword [edx + 0x30], 0
jne 0x43bdb9
mov dword [ebp - 0x31c], 0
Function at 0x43beb7
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edi
push ebx
add esp, 4
add edi, 0x865d
xor edi, 0x8fea
or edi, 0xdc99
call fcn.0043be38
add byte [ebp + 0x37], cl
inc edx
cmp al, 0x43
inc ebp
add esp, 4
pop edi
push edx
jmp 0x43be46
pop edx
mov ecx, dword [ebp - 0xcac]
mov dx, word [ecx]
mov word [ebp - 0x103a], dx
mov eax, dword [ebp - 0xcac]
add eax, 2
mov dword [ebp - 0xcac], eax
mov cx, word [ebp - 0x103a]
mov word [ebp - 0x218], cx
mov edx, dword [ebp - 0xcb0]
mov ax, word [edx]
mov word [ebp - 0x103c], ax
mov ecx, dword [ebp - 0xcb0]
add ecx, 2
mov dword [ebp - 0xcb0], ecx
mov dx, word [ebp - 0x103c]
mov word [ebp - 0x34], dx
push edx
xor edx, 0x423b
pop edx
push edx
call 0x43beb7
add byte [ebp + 0x38], cl
inc eax
dec esp
push eax
dec esp
dec ecx
xor eax, 0xc4833447
add al, 0xe8
pop es
add byte [eax], al
add byte [eax], al
xor al, byte [edi + esi + 0x47]
inc edx
inc esi
add esp, 4
sub edx, 0x16c57
pop edx
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x43beed
movzx ecx, word [ebp - 0x218]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x1604], ecx
jmp 0x43bf47
movzx eax, word [ebp - 0x218]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x43be15
movzx edx, word [ebp - 0x218]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x43be15
movzx ecx, word [ebp - 0x218]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x43bf31
mov dword [ebp - 0x1600], 0xffffffff
jmp 0x43bf3b
mov dword [ebp - 0x1600], 1
mov eax, dword [ebp - 0x1600]
mov dword [ebp - 0x1604], eax
cmp dword [ebp - 0x1604], 0
jne 0x43bf90
push edx
push ecx
add esp, 4
jmp 0x43bf5e
xor edx, 0x794c
jmp 0x43bf69
pop edx
push ebx
push eax
add esp, 4
and ebx, 0xdb65
xor ebx, 0xa24e
or ebx, 0x2e3e
pop ebx
mov ecx, dword [ebp - 0x50c]
mov dword [ebp - 0x31c], ecx
jmp 0x43bff8
push esi
jmp 0x43bf97
sub esi, 0x13fd2
add esi, 0x64e2
pop esi
push ecx
push ecx
add esp, 4
jmp 0x43bfaf
add ecx, 0x4cd1
add ecx, 0x4b8c
add ecx, 0x17b9a
pop ecx
mov edx, dword [ebp - 0x50c]
mov eax, dword [edx]
mov dword [ebp - 0x50c], eax
mov ecx, dword [ebp - 0x50c]
cmp ecx, dword [ebp - 0xcb4]
je 0x43bfee
mov edx, dword [ebp - 0x50c]
cmp dword [edx + 0x30], 0
jne 0x43bdb9
mov dword [ebp - 0x31c], 0