joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426381
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
xor esi, 0xc126
xor esi, 0x15ef5
pop esi
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
mov word [ebp - 0x1ee4], dx
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push ebx
and ebx, 0x16850
pop ebx
push ecx
push esi
add esp, 4
jmp 0x4262c3
add ecx, 0x10676
pop ecx
push eax
jmp 0x4262d1
add eax, 0x17503
jmp 0x4262de
pop eax
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push edi
push esi
add esp, 4
add edi, 0xea2b
xor edi, 0x17855
add edi, 0x156fe
pop edi
push esi
add esi, 0x8a0d
add esi, 0x72fe
and esi, 0x5c73
sub esi, 0xb7a
add byte [eax], al
pop esi
mov dword [ebp - 0x10], 1
push ecx
and ecx, 0x643f
jmp 0x426363
jmp 0x42636a
add ecx, 0x1029c
pop ecx
push ecx
call 0x426381
add byte [ecx + 0x3c], al
xor edx, dword [eax + 0x44]
cmp eax, 0x83393e47
les eax, [ecx + ebx*2]
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push edx
or edx, 0x6c72
add edx, 0x1c84
pop edx
push edx
push ebx
add esp, 4
add edx, 0x824a
call 0x4263da
add byte [edi + esi], bh
inc ebx
inc esi
inc esp
inc ecx
inc ebp
xor al, 0x37
aas
add esp, 4
jmp 0x4263e2
pop edx
push ecx
jmp 0x4263ec
jmp 0x4263f2
jmp 0x4263fa
add ecx, 0x17466
pop ecx
push edi
call 0x426411
add byte [eax + 0x3e], al
inc edx
dec ecx
inc ebp
aas
dec edx
inc ebp
add esp, 4
pop edi
mov dword [ebp - 0x2c], 1
push edx
push edx
add esp, 4
xor edx, 0x12421
call 0x426436
add byte [0x3e344f44], bh
dec edx
aaa
cmp byte [ecx - 0x7d], cl
les eax, [ecx + eax*4]
retf 0x8640
Function at 0x4263da
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
xor esi, 0xc126
xor esi, 0x15ef5
pop esi
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
mov word [ebp - 0x1ee4], dx
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push ebx
and ebx, 0x16850
pop ebx
push ecx
push esi
add esp, 4
jmp 0x4262c3
add ecx, 0x10676
pop ecx
push eax
jmp 0x4262d1
add eax, 0x17503
jmp 0x4262de
pop eax
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push edi
push esi
add esp, 4
add edi, 0xea2b
xor edi, 0x17855
add edi, 0x156fe
pop edi
push esi
add esi, 0x8a0d
add esi, 0x72fe
and esi, 0x5c73
sub esi, 0xb7a
add byte [eax], al
pop esi
mov dword [ebp - 0x10], 1
push ecx
and ecx, 0x643f
jmp 0x426363
jmp 0x42636a
add ecx, 0x1029c
pop ecx
push ecx
call 0x426381
add byte [ecx + 0x3c], al
xor edx, dword [eax + 0x44]
cmp eax, 0x83393e47
les eax, [ecx + ebx*2]
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push edx
or edx, 0x6c72
add edx, 0x1c84
pop edx
push edx
push ebx
add esp, 4
add edx, 0x824a
call 0x4263da
add byte [edi + esi], bh
inc ebx
inc esi
inc esp
inc ecx
inc ebp
xor al, 0x37
aas
add esp, 4
jmp 0x4263e2
pop edx
push ecx
jmp 0x4263ec
jmp 0x4263f2
jmp 0x4263fa
add ecx, 0x17466
pop ecx
push edi
call 0x426411
add byte [eax + 0x3e], al
inc edx
dec ecx
inc ebp
aas
dec edx
inc ebp
add esp, 4
pop edi
mov dword [ebp - 0x2c], 1
push edx
push edx
add esp, 4
xor edx, 0x12421
call 0x426436
add byte [0x3e344f44], bh
dec edx
aaa
cmp byte [ecx - 0x7d], cl
les eax, [ecx + eax*4]
retf 0x8640
Function at 0x426411
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
xor esi, 0xc126
xor esi, 0x15ef5
pop esi
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
mov word [ebp - 0x1ee4], dx
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push ebx
and ebx, 0x16850
pop ebx
push ecx
push esi
add esp, 4
jmp 0x4262c3
add ecx, 0x10676
pop ecx
push eax
jmp 0x4262d1
add eax, 0x17503
jmp 0x4262de
pop eax
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push edi
push esi
add esp, 4
add edi, 0xea2b
xor edi, 0x17855
add edi, 0x156fe
pop edi
push esi
add esi, 0x8a0d
add esi, 0x72fe
and esi, 0x5c73
sub esi, 0xb7a
add byte [eax], al
pop esi
mov dword [ebp - 0x10], 1
push ecx
and ecx, 0x643f
jmp 0x426363
jmp 0x42636a
add ecx, 0x1029c
pop ecx
push ecx
call 0x426381
add byte [ecx + 0x3c], al
xor edx, dword [eax + 0x44]
cmp eax, 0x83393e47
les eax, [ecx + ebx*2]
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push edx
or edx, 0x6c72
add edx, 0x1c84
pop edx
push edx
push ebx
add esp, 4
add edx, 0x824a
call 0x4263da
add byte [edi + esi], bh
inc ebx
inc esi
inc esp
inc ecx
inc ebp
xor al, 0x37
aas
add esp, 4
jmp 0x4263e2
pop edx
push ecx
jmp 0x4263ec
jmp 0x4263f2
jmp 0x4263fa
add ecx, 0x17466
pop ecx
push edi
call 0x426411
add byte [eax + 0x3e], al
inc edx
dec ecx
inc ebp
aas
dec edx
inc ebp
add esp, 4
pop edi
mov dword [ebp - 0x2c], 1
push edx
push edx
add esp, 4
xor edx, 0x12421
call 0x426436
add byte [0x3e344f44], bh
dec edx
aaa
cmp byte [ecx - 0x7d], cl
les eax, [ecx + eax*4]
retf 0x8640
Function at 0x426436
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
xor esi, 0xc126
xor esi, 0x15ef5
pop esi
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
mov word [ebp - 0x1ee4], dx
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push ebx
and ebx, 0x16850
pop ebx
push ecx
push esi
add esp, 4
jmp 0x4262c3
add ecx, 0x10676
pop ecx
push eax
jmp 0x4262d1
add eax, 0x17503
jmp 0x4262de
pop eax
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push edi
push esi
add esp, 4
add edi, 0xea2b
xor edi, 0x17855
add edi, 0x156fe
pop edi
push esi
add esi, 0x8a0d
add esi, 0x72fe
and esi, 0x5c73
sub esi, 0xb7a
add byte [eax], al
pop esi
mov dword [ebp - 0x10], 1
push ecx
and ecx, 0x643f
jmp 0x426363
jmp 0x42636a
add ecx, 0x1029c
pop ecx
push ecx
call 0x426381
add byte [ecx + 0x3c], al
xor edx, dword [eax + 0x44]
cmp eax, 0x83393e47
les eax, [ecx + ebx*2]
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push edx
or edx, 0x6c72
add edx, 0x1c84
pop edx
push edx
push ebx
add esp, 4
add edx, 0x824a
call 0x4263da
add byte [edi + esi], bh
inc ebx
inc esi
inc esp
inc ecx
inc ebp
xor al, 0x37
aas
add esp, 4
jmp 0x4263e2
pop edx
push ecx
jmp 0x4263ec
jmp 0x4263f2
jmp 0x4263fa
add ecx, 0x17466
pop ecx
push edi
call 0x426411
add byte [eax + 0x3e], al
inc edx
dec ecx
inc ebp
aas
dec edx
inc ebp
add esp, 4
pop edi
mov dword [ebp - 0x2c], 1
push edx
push edx
add esp, 4
xor edx, 0x12421
call 0x426436
add byte [0x3e344f44], bh
dec edx
aaa
cmp byte [ecx - 0x7d], cl
les eax, [ecx + eax*4]
retf 0x8640
Function at 0x42664d
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
jmp 0x433029
add byte [eax], al
add byte [eax], al
in al, dx
or ecx, eax
xchg cl, bl
add byte [eax], al
add al, byte [ecx]
add dword [ecx], eax
test byte [esi + 0xf3d9], bh
add dword [esi + 0xf], esi
mov word [esi + 0xe6e1], es
mov al, byte [esi + 0xfbcd]
in al, dx
adc ch, dl
out 0xfe, al
add byte [eax], al
mov word [esi + 0xf939], cs
mov cl, byte [esi + 0xfbcd]
mov word [esi + 0xfbcd], ss
mov dl, byte [esi + 0xf6bd]
imul eax, dword [ecx], 0xffffff8e
xchg ch, al
test byte [eax], 0
push ecx
mov cs, word [esi + 0xf6c5]
push edx
add byte [esi + 0xf6bd], dl
enter 0x6986, 0xfffffffffffffffe
add byte [eax], al
add dword [ecx], eax
add dword [ecx], eax
test byte [esi + 0xfe69], bh
add dword [ebp + 0xb], esi
ljmp 0x97ea

Function at 0x42666d
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x426678
pop ebx
push edx
push ebx
add esp, 4
sub edx, 0x144b8
xor edx, 0xc94d
and edx, 0x70e0
pop edx
push edx
sub edx, 0x19b
and edx, 0x5918
sub edx, 0x16519
sub edx, 0x8dd2
pop edx
mov eax, dword [ebp - 0x30]
add eax, 0x138
imul ecx, dword [ebp - 0x2c], 0x138
add ecx, 0x44f3644b
imul edx, dword [ebp - 0x2c], 0x138
sub ecx, edx
xor eax, ecx
imul eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1d2c], eax
push edi
call 0x4266e5
add byte [esi + 0x4d], al
dec esi
dec edi
aaa
inc ebx
inc edi
inc edi
add esp, 4
xor edi, 0x162a5
call fcn.004266fd
add byte [ebx + esi], dh
xor eax, dword [ebx + 0x4f]

Function at 0x4266e5
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x426678
pop ebx
push edx
push ebx
add esp, 4
sub edx, 0x144b8
xor edx, 0xc94d
and edx, 0x70e0
pop edx
push edx
sub edx, 0x19b
and edx, 0x5918
sub edx, 0x16519
sub edx, 0x8dd2
pop edx
mov eax, dword [ebp - 0x30]
add eax, 0x138
imul ecx, dword [ebp - 0x2c], 0x138
add ecx, 0x44f3644b
imul edx, dword [ebp - 0x2c], 0x138
sub ecx, edx
xor eax, ecx
imul eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1d2c], eax
push edi
call 0x4266e5
add byte [esi + 0x4d], al
dec esi
dec edi
aaa
inc ebx
inc edi
inc edi
add esp, 4
xor edi, 0x162a5
call fcn.004266fd
add byte [ebx + esi], dh
xor eax, dword [ebx + 0x4f]
Function at 0x4266fd
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add esp, 4
add edi, 0x4ba4
pop edi
mov eax, dword [ebp - 0x152c]
add eax, 0x138
imul ecx, dword [ebp - 0x1528], 0x138
add ecx, 0x44f3644b
imul edx, dword [ebp - 0x1528], 0x138
sub ecx, edx
xor eax, ecx
imul eax, dword [ebp - 0x1528]
mov dword [ebp - 0x1d28], eax
mov eax, dword [ebp - 0x1d28]
mov dword [ebp - 0x1d30], eax
mov ecx, dword [ebp - 0x1d2c]
cmp ecx, dword [ebp - 0x1d30]
jae 0x426763
mov dword [ebp - 0x149c], 1
jmp 0x42676d
mov dword [ebp - 0x149c], 0
mov dl, byte [ebp - 0x149c]
mov byte [ebp - 0x382], dl
movzx eax, byte [ebp - 0x382]
test eax, eax
je 0x4297e0
push edx
or edx, 0x68a5
and edx, 0x126f3
xor edx, 0xe1a3
call 0x4267aa
add byte [edi + 0x464e4d3f], dh
dec ebx
dec esp
aas
add esp, 4
pop edx
push eax
push edx
add esp, 4
and eax, 0xe683
pop eax
push ebx
add ebx, 0xb403
jmp 0x4267c8
and ebx, 0x94bc
pop ebx
push esi
xor esi, 0x16ad8
pop esi
push ecx
jmp 0x4267dd
add ecx, 0x243a
pop ecx
push ecx
or ecx, 0xdb9f
pop ecx
mov ecx, dword [ebp - 0x30]
add ecx, 0x138
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor ecx, edx
imul ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x1d34], ecx
mov ecx, dword [ebp - 0x1d34]
mov dword [ebp - 0x1d38], ecx
cmp dword [ebp - 0x1d38], 0x63c1
jne 0x426967
push edx
or edx, 0x12b43
xor edx, 0x48fe
sub edx, 0x2a82
pop edx
push ecx
push eax
add esp, 4
add ecx, 0x193c
sub ecx, 0x45aa
xor ecx, 0x3fbb
and ecx, 0x12ffb
pop ecx
mov edx, dword [ebp - 0x14]
add edx, 0x138
imul eax, dword [ebp - 0x10], 0x138
add eax, 0x44f3644b
imul ecx, dword [ebp - 0x10], 0x138
sub eax, ecx
xor edx, eax
imul edx, dword [ebp - 0x10]
mov dword [ebp - 0x1d3c], edx
mov edx, dword [ebp - 0x1d3c]
mov dword [ebp - 0x1d40], edx
mov eax, dword [ebp - 0x1d40]
sub eax, 0x898
mov dword [ebp - 0x1d44], eax
mov dword [ebp - 0xfb4], 1
push ecx
push eax
add esp, 4
call 0x4268c9
add byte [esi + 0x43], cl
dec ecx
xor eax, 0x42363633
add esp, 4
pop ecx
push edi
add edi, 0x59d9
jmp 0x4268db
pop edi
push esi
push ebx
add esp, 4
sub esi, 0xcc4b
pop esi
imul ecx, dword [ebp - 0xfb4], 0x138
add ecx, 0x44f3644b
imul edx, dword [ebp - 0xfb4], 0x138
sub ecx, edx
xor ecx, dword [ebp - 0x1d44]
imul ecx, dword [ebp - 0xfb4]
imul eax, dword [ebp - 0xfb4], 0x138
add byte [eax], al
sub ecx, eax
mov dword [ebp - 0xfb8], ecx
mov ecx, dword [ebp - 0xfb8]
mov edx, dword [ebp - 0xfb4]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
push esi
push ebx
add esp, 4
call 0x426948
add byte [esi + 0x33], cl
cmp dword [esi + esi + 0x42], ecx
xor al, 0x47
add esp, 4
sub esi, 0x14d39
call 0x42695d
add byte [edi + edi + 0x4e], cl
push eax
dec eax
dec ebp
add esp, 4
and esi, 0xc51d
pop esi
push eax
add eax, 0x10eab
pop eax
push ebx
push edx
add esp, 4
and ebx, 0x2cb4
pop ebx
push edi
or edi, 0x16fd1
call 0x42698f
add byte [edx + ecx*2], bh
xor al, 0x40
inc eax
inc ecx
inc ebp
add esp, 4
xor edi, 0x4e5e
pop edi
mov eax, dword [ebp - 0x14]
add eax, 0x138
imul ecx, dword [ebp - 0x10], 0x138
add ecx, 0x44f3644b
invalid
push ebp
Function at 0x429dfb
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push 0x10
mov dword [esi + 4], 0
mov dword [esi + 8], 0x10
call fcn.0041171a
mov dword [esi], eax
push 4
mov byte [eax], 0
call fcn.0041171a
add esp, 8
test eax, eax
je 0x429ce9
mov dword [eax], 1
mov dword [esi + 0xc], eax
mov eax, esi
ret
inc eax
push ecx
push ebx
add esp, 4
sub ecx, 0xf5ee
sub ecx, 0x106d7
sub ecx, 0x1baf
sub ecx, 0x501d
pop ecx
push ebx
and ebx, 0x14380
or ebx, 0x3ea2
sub ebx, 0x736a
pop ebx
mov eax, dword [ebp - 0x4cc]
mov dword [ebp - 0x3cc], eax
jmp 0x429d6b
push edi
push edi
add esp, 4
xor edi, 0xa294
jmp 0x429d7f
jmp 0x429d88
jmp 0x429d8e
pop edi
push edx
or edx, 0x168eb
xor edx, 0x1656a
pop edx
push ebx
xor ebx, 0x10bb2
and ebx, 0xcec3
or ebx, 0x180f6
pop ebx
push esi
push ebx
add esp, 4
or esi, 0xe394
pop esi
push edx
push edi
add esp, 4
sub edx, 0x18296
xor edx, 0xa0ec
pop edx
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xb80]
mov dword [ebp - 0x14c8], eax
push edi
and edi, 0x11dd0
call 0x429dfb
add byte [ecx + 0x4b], al
dec ebp
dec ecx
xor eax, 0x3437384f
inc esi
add esp, 4
jmp fcn.00429e07

Function at 0x429e4e
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
pop edi
push edi
or edi, 0x99f3
or edi, 0x7da0
pop edi
mov dword [ebp - 0x1fac], 0xffffffff
push esi
push ecx
add esp, 4
jmp 0x429e2c
add esi, 0x13967
and esi, 0x78e3
pop esi
push esi
and esi, 0xacbe
pop esi
push esi
call 0x429e4e
add byte [edx + 0x45], al
aaa
xor al, 0x44
xor al, 0x83
les eax, [esi + ebx*2]
mov ecx, dword [ebp - 0x3c0]
mov dword [ebp - 0x4d0], ecx
jmp 0x429e6f
Function at 0x42affc
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
xor edx, 0x10634
pop edx
mov eax, dword fs:[0x18]
add byte [eax], al
add byte [ecx - 0x18b77b], cl
dec dword [ebx - 0x18b773]
dec dword [ebx - 0x6a76cfaf]
inc esp
out 0xff, eax
dec dword [ebx - 0x18bb7b]
dec dword [ecx - 0x14f37b]
call dword [edi - 0x7f]
out dx, eax
and cl, ch
add byte [eax], al
xor edi, 0x8a0c
pop edi
push ecx
push edi
add esp, 4
call 0x42affc
add byte [esi], dh
inc ebp
dec esi
cmp al, 0x4e
dec esp
cmp eax, 0xc4833937
add al, 0x81
int1
dec ebx
rol byte [eax], 1
add byte [ecx + 0x4ff0e1], al
add byte [ecx - 0x7d], bl
mov ebp, 0xffffeb0c
add byte [ebp + 0xf], dh
mov dword [ebp - 0x2e0], 0
jmp fcn.0042b2cb
Function at 0x42b866
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov edi, eax
mov eax, dword [esi + 8]
cmp eax, 1
jne 0x40b99f
mov ecx, dword [edi + 8]
cmp ecx, eax
jne 0x40b967
mov eax, dword [edi]
mov ebx, dword [esi]
lea ebp, [eax + ebx]
cdq
mov ecx, eax
mov edi, edx
mov eax, ebx
cdq
add ecx, eax
adc edi, edx
mov eax, ebp
cdq
cmp eax, ecx
jne 0x42b7cf
cmp edx, edi
jne 0x42b7cf
mov dword [esi], ebp
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x42b7f9
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
cmp ecx, 2
je 0x42b7e0
cmp eax, 3
je case.0x40b9a7.3
mov ecx, esi
call fcn.0040be90
fstp qword [esp + 0x10]
call fcn.004092c0
fld qword [esp + 0x10]
fstp qword [esi]
mov dword [esi + 8], 3
mov ecx, edi
call fcn.0040be90
fadd qword [esi]
fstp qword [esi]
jmp case.0x40b9a7.5
sub eax, 2
cmp eax, 9
ja case.0x40b9a7.5
jmp dword [eax*4 + 0x40b9b0]
cld
invalid
outsb dx, byte [esi]
add byte [eax], al
loop 0x42b6e1
adc eax, dword [eax]
add byte [ecx + 0x6f7c2], al
add byte [edx - 0x75], bl
xchg ebp, eax
enter 0xfffffffffffffff8, 0xffffffffffffffff
xchg ebp, eax
xor bh, ah
invalid
mov dword [0xce810000], eax
mov byte [edi], cl
add byte [esi + 0x50], bl
jmp 0x42b7b8
sub eax, 0x4d4a
pop eax
push edx
jmp 0x42b7c8
add edx, 0xdb80
pop edx
mov byte [ebp - 0x960], 0x56
mov byte [ebp - 0x95f], 0x69
mov byte [ebp - 0x95e], 0x72
mov byte [ebp - 0x95d], 0x74
idiv bh
push dword [edx - 0x3a]
test dword [ebx + 0x74fffff6], esp
mov byte [ebp - 0x95c], 0x75
mov byte [ebp - 0x95b], 0x61
mov byte [ebp - 0x95a], 0x6c
mov byte [ebp - 0x959], 0x50
mov byte [ebp - 0x958], 0x72
mov byte [ebp - 0x957], 0x6f
mov byte [ebp - 0x956], 0x74
mov byte [ebp - 0x955], 0x65
mov byte [ebp - 0x954], 0x63
mov byte [ebp - 0x953], 0x74
mov byte [ebp - 0x952], 0
push ecx
push ebx
add esp, 4
and ecx, 0x5b48
pop ecx
push eax
push ebx
add esp, 4
or eax, 0x10fb4
jmp 0x42b858
call 0x42b866
add byte [edx], bh
inc ebx
dec ebp
cmp eax, 0x4a463f3c
add esp, 4
pop eax
mov eax, dword fs:[0x18]
mov dword [ebp - 0x1c34], eax
mov ecx, dword [ebp - 0x1c34]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x18d4], edx
mov eax, dword [ebp - 0x18d4]
mov dword [ebp - 0x150c], eax
push ebx
or ebx, 0x9004
or ebx, 0x206e
sub ebx, 0x12c08
pop ebx
push eax
push edi
add esp, 4
or eax, 0x168fc
Function at 0x42c356
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor esi, 0xb64c
pop esi
mov eax, dword [ebp - 0x71c]
add eax, dword [ebp - 0x188]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x188]
movsx eax, byte [ebp + edx - 0x830]
invalid
invalid
cmp ecx, eax
jne 0x42c347
mov dword [ebp - 0xc5c], 0
jmp 0x42c3b6
push edx
call 0x42c356
add byte [ebp + edi + 0x41], al
dec ebx
inc eax
inc esp
inc esp
add esp, 4

Function at 0x42c369
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call 0x42c369
add byte [ecx + 0x34], cl
cmp dword [edi], edi
xor al, 0x40
xor esi, dword [edi]
push eax
add esp, 4
and edx, 0x7d91
or edx, 0xf4fa
hlt
add byte [eax], al
pop edx
mov ecx, dword [ebp - 0x71c]
add ecx, dword [ebp - 0x188]
movsx edx, byte [ecx]
or edx, 0x20
mov eax, dword [ebp - 0x188]
Function at 0x4378b5
Capabilities:
Encode data using xor

Disassembly:
add dword [ecx], eax
inc esi
inc edx
inc ecx
dec ecx
inc ecx
push ecx
aas
xor eax, dword [ebp + eax*8 - 0x7938a0fb]
or ecx, edi
add byte [eax], al
dec edi
mov dword [esi + 0xf90a], 0xb86c775
stc
add byte [eax], al
push edx
mov dword [esi + 0xf90c], 0xd86c776
stc
add byte [eax], al
mov word [esi + 0xf90e], 0xc773
mov dword [esi + 0xf90d], 0xe86c766
stc
add byte [eax], al
jae 0x437879
xchg byte [edi], cl
stc
add byte [eax], al
jp 0x437880
xchg byte [eax], dl
stc
add byte [eax], al
inc ebp
mov dword [esi + 0xf911], 0x1286c766
stc
add byte [eax], al
mov dword [bp - 0x6ed], 0xc7620000
xchg byte [ecx + edi*8], dl
add byte [eax], al
jbe 0x4378a3
xchg byte [0x6d0000f9], dl
mov dword [esi + 0xf916], 0x1786c775
stc
add byte [eax], al
dec ebp
mov dword [esi + 0xf918], 0x1986c770
stc
add byte [eax], al
mov dword fs:[esi + 0xf91a], 0x1b86c762
stc
add byte [eax], al
insd dword es:[edi], dx
mov dword [esi + 0xf91c], 0x1d86c766
stc
add byte [eax], al
add dword [edi - 0x14], edx
push es
cmp bh, byte [edi]
dec esp
cmp al, 0x39
jmp 0x1447a31