joyce8/EMBER2024-capa huggingface dataset:
Function at 0x477064
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x108], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4770f6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x104]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryA
mov ebx, eax
test ebx, ebx
jle 0x4770cc
cmp ebx, 0x104
jge 0x4770cc
lea eax, [ebp - 0x108]
lea edx, [ebp - 0x104]
mov ecx, 0x104
call fcn.0040355c
mov eax, dword [ebp - 0x108]
mov edx, esi
call fcn.00476f8c
jmp 0x4770dd
mov eax, 0x47710c
call fcn.00452bc4
mov eax, esi
call fcn.00403400
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4770fd
lea eax, [ebp - 0x108]
call fcn.00403400
ret

Function at 0x47728d
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1fbc
push ebx
push esi
push edi
push edi
push eax
add esp, 4
xor edi, 0x16db3
call 0x4772b1
add byte [esi + 0x43], cl
inc esi
inc eax
inc edx
aas
add esp, 4
xor edi, 0x8430
call 0x4772c7
add byte [edx], bh
inc ecx
inc ecx
cmp edi, dword [ecx]
cmp esi, dword [ebx + eax*4]
les eax, [edi + ebx*2]
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
mov word [ebp - 0x1ee4], dx
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push ebx
push ecx
add esp, 4
or ebx, 0x598b
or ebx, 0x15ba4
pop ebx
push ecx
push edx
add esp, 4
xor ecx, 0x56e8
pop ecx
push edi
add edi, 0x1110e
or edi, 0x12f07
add edi, 0xaf53
pop edi
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push eax
sub eax, 0x7d8e
xor eax, 0xd42d
call 0x477401
add byte [ecx], bh
xor eax, 0x3b493b32
dec ebx
add esp, 4
add eax, 0x1817
pop eax
push edi
xor edi, 0x33a1
xor edi, 0x17d1e
pop edi
mov dword [ebp - 0x10], 1
push esi
add esi, 0xfdd2
call 0x477437
add byte [edi + 0x3d], al
inc edx
cmp eax, dword [edi + 0x4b]
xor al, 0x36
cmp dword [ebx + eax*4], esi
les eax, [ecx + eax*4]
out dx, al
mov byte [0xe8000067], al
or dword [eax], eax
add byte [eax], al
add byte [ebx + 0x36], al
dec ebp
cmp byte [ebp + 0x32], cl
dec edx
cmp byte [ebx + 0x695e04c4], al
push ebp
invalid
Function at 0x4772b1
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1fbc
push ebx
push esi
push edi
push edi
push eax
add esp, 4
xor edi, 0x16db3
call 0x4772b1
add byte [esi + 0x43], cl
inc esi
inc eax
inc edx
aas
add esp, 4
xor edi, 0x8430
call 0x4772c7
add byte [edx], bh
inc ecx
inc ecx
cmp edi, dword [ecx]
cmp esi, dword [ebx + eax*4]
les eax, [edi + ebx*2]
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
mov word [ebp - 0x1ee4], dx
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push ebx
push ecx
add esp, 4
or ebx, 0x598b
or ebx, 0x15ba4
pop ebx
push ecx
push edx
add esp, 4
xor ecx, 0x56e8
pop ecx
push edi
add edi, 0x1110e
or edi, 0x12f07
add edi, 0xaf53
pop edi
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push eax
sub eax, 0x7d8e
xor eax, 0xd42d
call 0x477401
add byte [ecx], bh
xor eax, 0x3b493b32
dec ebx
add esp, 4
add eax, 0x1817
pop eax
push edi
xor edi, 0x33a1
xor edi, 0x17d1e
pop edi
mov dword [ebp - 0x10], 1
push esi
add esi, 0xfdd2
call 0x477437
add byte [edi + 0x3d], al
inc edx
cmp eax, dword [edi + 0x4b]
xor al, 0x36
cmp dword [ebx + eax*4], esi
les eax, [ecx + eax*4]
out dx, al
mov byte [0xe8000067], al
or dword [eax], eax
add byte [eax], al
add byte [ebx + 0x36], al
dec ebp
cmp byte [ebp + 0x32], cl
dec edx
cmp byte [ebx + 0x695e04c4], al
push ebp
invalid
Function at 0x4772c7
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1fbc
push ebx
push esi
push edi
push edi
push eax
add esp, 4
xor edi, 0x16db3
call 0x4772b1
add byte [esi + 0x43], cl
inc esi
inc eax
inc edx
aas
add esp, 4
xor edi, 0x8430
call 0x4772c7
add byte [edx], bh
inc ecx
inc ecx
cmp edi, dword [ecx]
cmp esi, dword [ebx + eax*4]
les eax, [edi + ebx*2]
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
mov word [ebp - 0x1ee4], dx
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push ebx
push ecx
add esp, 4
or ebx, 0x598b
or ebx, 0x15ba4
pop ebx
push ecx
push edx
add esp, 4
xor ecx, 0x56e8
pop ecx
push edi
add edi, 0x1110e
or edi, 0x12f07
add edi, 0xaf53
pop edi
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push eax
sub eax, 0x7d8e
xor eax, 0xd42d
call 0x477401
add byte [ecx], bh
xor eax, 0x3b493b32
dec ebx
add esp, 4
add eax, 0x1817
pop eax
push edi
xor edi, 0x33a1
xor edi, 0x17d1e
pop edi
mov dword [ebp - 0x10], 1
push esi
add esi, 0xfdd2
call 0x477437
add byte [edi + 0x3d], al
inc edx
cmp eax, dword [edi + 0x4b]
xor al, 0x36
cmp dword [ebx + eax*4], esi
les eax, [ecx + eax*4]
out dx, al
mov byte [0xe8000067], al
or dword [eax], eax
add byte [eax], al
add byte [ebx + 0x36], al
dec ebp
cmp byte [ebp + 0x32], cl
dec edx
cmp byte [ebx + 0x695e04c4], al
push ebp
invalid
Function at 0x477401
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1fbc
push ebx
push esi
push edi
push edi
push eax
add esp, 4
xor edi, 0x16db3
call 0x4772b1
add byte [esi + 0x43], cl
inc esi
inc eax
inc edx
aas
add esp, 4
xor edi, 0x8430
call 0x4772c7
add byte [edx], bh
inc ecx
inc ecx
cmp edi, dword [ecx]
cmp esi, dword [ebx + eax*4]
les eax, [edi + ebx*2]
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
mov word [ebp - 0x1ee4], dx
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push ebx
push ecx
add esp, 4
or ebx, 0x598b
or ebx, 0x15ba4
pop ebx
push ecx
push edx
add esp, 4
xor ecx, 0x56e8
pop ecx
push edi
add edi, 0x1110e
or edi, 0x12f07
add edi, 0xaf53
pop edi
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push eax
sub eax, 0x7d8e
xor eax, 0xd42d
call 0x477401
add byte [ecx], bh
xor eax, 0x3b493b32
dec ebx
add esp, 4
add eax, 0x1817
pop eax
push edi
xor edi, 0x33a1
xor edi, 0x17d1e
pop edi
mov dword [ebp - 0x10], 1
push esi
add esi, 0xfdd2
call 0x477437
add byte [edi + 0x3d], al
inc edx
cmp eax, dword [edi + 0x4b]
xor al, 0x36
cmp dword [ebx + eax*4], esi
les eax, [ecx + eax*4]
out dx, al
mov byte [0xe8000067], al
or dword [eax], eax
add byte [eax], al
add byte [ebx + 0x36], al
dec ebp
cmp byte [ebp + 0x32], cl
dec edx
cmp byte [ebx + 0x695e04c4], al
push ebp
invalid
Function at 0x477437
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1fbc
push ebx
push esi
push edi
push edi
push eax
add esp, 4
xor edi, 0x16db3
call 0x4772b1
add byte [esi + 0x43], cl
inc esi
inc eax
inc edx
aas
add esp, 4
xor edi, 0x8430
call 0x4772c7
add byte [edx], bh
inc ecx
inc ecx
cmp edi, dword [ecx]
cmp esi, dword [ebx + eax*4]
les eax, [edi + ebx*2]
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
mov word [ebp - 0x1ee4], dx
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push ebx
push ecx
add esp, 4
or ebx, 0x598b
or ebx, 0x15ba4
pop ebx
push ecx
push edx
add esp, 4
xor ecx, 0x56e8
pop ecx
push edi
add edi, 0x1110e
or edi, 0x12f07
add edi, 0xaf53
pop edi
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push eax
sub eax, 0x7d8e
xor eax, 0xd42d
call 0x477401
add byte [ecx], bh
xor eax, 0x3b493b32
dec ebx
add esp, 4
add eax, 0x1817
pop eax
push edi
xor edi, 0x33a1
xor edi, 0x17d1e
pop edi
mov dword [ebp - 0x10], 1
push esi
add esi, 0xfdd2
call 0x477437
add byte [edi + 0x3d], al
inc edx
cmp eax, dword [edi + 0x4b]
xor al, 0x36
cmp dword [ebx + eax*4], esi
les eax, [ecx + eax*4]
out dx, al
mov byte [0xe8000067], al
or dword [eax], eax
add byte [eax], al
add byte [ebx + 0x36], al
dec ebp
cmp byte [ebp + 0x32], cl
dec edx
cmp byte [ebx + 0x695e04c4], al
push ebp
invalid
Function at 0x47744e
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1fbc
push ebx
push esi
push edi
push edi
push eax
add esp, 4
xor edi, 0x16db3
call 0x4772b1
add byte [esi + 0x43], cl
inc esi
inc eax
inc edx
aas
add esp, 4
xor edi, 0x8430
call 0x4772c7
add byte [edx], bh
inc ecx
inc ecx
cmp edi, dword [ecx]
cmp esi, dword [ebx + eax*4]
les eax, [edi + ebx*2]
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
mov word [ebp - 0x1ee4], dx
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push ebx
push ecx
add esp, 4
or ebx, 0x598b
or ebx, 0x15ba4
pop ebx
push ecx
push edx
add esp, 4
xor ecx, 0x56e8
pop ecx
push edi
add edi, 0x1110e
or edi, 0x12f07
add edi, 0xaf53
pop edi
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push eax
sub eax, 0x7d8e
xor eax, 0xd42d
call 0x477401
add byte [ecx], bh
xor eax, 0x3b493b32
dec ebx
add esp, 4
add eax, 0x1817
pop eax
push edi
xor edi, 0x33a1
xor edi, 0x17d1e
pop edi
mov dword [ebp - 0x10], 1
push esi
add esi, 0xfdd2
call 0x477437
add byte [edi + 0x3d], al
inc edx
cmp eax, dword [edi + 0x4b]
xor al, 0x36
cmp dword [ebx + eax*4], esi
les eax, [ecx + eax*4]
out dx, al
mov byte [0xe8000067], al
or dword [eax], eax
add byte [eax], al
add byte [ebx + 0x36], al
dec ebp
cmp byte [ebp + 0x32], cl
dec edx
cmp byte [ebx + 0x695e04c4], al
push ebp
invalid

Function at 0x47a8e8
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x13379797
pop eax
mov dword [ebp - 0x3c0], eax
push ebx
push ecx
add esp, 4
or ebx, 0x151d6
sub ebx, 0x9c0b
call 0x47a8e8
add byte [edx], dh
inc ecx
inc ecx
xor cl, byte [ebx + 0x34]
cmp ecx, dword ss:[eax - 0x7d]
les eax, [ecx + eax*4]
jmp 0x47a95e
dec eax
jmp 0x47a960
invalid
Function at 0x47af64
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x4d0]
add edx, 1
mov dword [ebp - 0x4d0], edx
push edi
push esi
add esp, 4
and edi, 0x464e
jmp 0x47af4d
pop edi
push edi
or edi, 0x126ce
call 0x47af64
add byte [eax + 0x34], cl
cmp dword [esi + 0x35], ecx
xor eax, 0x8348373f
les eax, [ecx + eax*4]
out 0xb6, eax
test byte [eax], al
jmp 0x47b118
mov ecx, dword [ebp - 0x14cc]
mov dword [ebp - 0xc14], ecx
jmp 0x47b18a
mov edx, dword [ebp - 0xc14]
mov dword [ebp - 0x14d0], edx
cmp dword [ebp - 0x14d0], 0
jne 0x47b1df
push ecx
push ebx
add esp, 4
jmp 0x47b1ad
call 0x47b1bc
add byte [edi], dh
inc ecx
cmp al, 0x44
dec ecx
inc ebp
inc eax
cmp eax, 0x4c48350
pop ecx
push edi
push ecx
add esp, 4
jmp 0x47b1ca
add edi, 0xef9c
pop edi
mov eax, dword [ebp - 0x4d0]
mov dword [ebp - 0xa5c], eax
jmp 0x47b220
jmp 0x47af2d
push ebx
and ebx, 0x54
pop ebx
push edi
add edi, 0x820
pop edi
push edx
push edi
add esp, 4
add edx, 0x52a8
add edx, 0x14e43
jmp 0x47b249
pop edx
push ecx
xor ecx, 0x7bdd
pop ecx
mov byte [ebp - 0x804], 0x45
mov byte [ebp - 0x803], 0x78
mov byte [ebp - 0x802], 0x69
mov byte [ebp - 0x801], 0x74
mov byte [ebp - 0x800], 0x50
mov byte [ebp - 0x7ff], 0x72
mov byte [ebp - 0x7fe], 0x6f
mov byte [ebp - 0x7fd], 0x63
mov byte [ebp - 0x7fc], 0x65
mov byte [ebp - 0x7fb], 0x73
mov byte [ebp - 0x7fa], 0x73
mov byte [ebp - 0x7f9], 0
push edi
push eax
add esp, 4
or edi, 0xff45
pop edi
push edi
add edi, 0x111d7
pop edi
push eax
push edi
add esp, 4
or eax, 0x59d5
and eax, 0x39cc
xor eax, 0x1229c
and eax, 0x6c9c
pop eax
mov ecx, 0x6b
mov word [ebp - 0x1628], cx
mov edx, 0x65
mov word [ebp - 0x1626], dx
mov eax, 0x72
mov word [ebp - 0x1624], ax
mov ecx, 0x6e
mov word [ebp - 0x1622], cx
mov edx, 0x65
mov word [ebp - 0x1620], dx
mov eax, 0x6c
mov word [ebp - 0x161e], ax
mov ecx, 0x33
mov word [ebp - 0x161c], cx
mov edx, 0x32
mov word [ebp - 0x161a], dx

Function at 0x47b036
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edi
push ecx
push ebx
add esp, 4
xor ecx, 0xf5ff
xor ecx, 0x3be6
pop ecx
push edi
or edi, 0x172f2
pop edi
mov ecx, dword [ebp - 0xc14]
mov dword [ebp - 0x14d0], ecx
jmp 0x47b196
Function at 0x47b1bc
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x4d0]
add edx, 1
mov dword [ebp - 0x4d0], edx
push edi
push esi
add esp, 4
and edi, 0x464e
jmp 0x47af4d
pop edi
push edi
or edi, 0x126ce
call 0x47af64
add byte [eax + 0x34], cl
cmp dword [esi + 0x35], ecx
xor eax, 0x8348373f
les eax, [ecx + eax*4]
out 0xb6, eax
test byte [eax], al
jmp 0x47b118
mov ecx, dword [ebp - 0x14cc]
mov dword [ebp - 0xc14], ecx
jmp 0x47b18a
mov edx, dword [ebp - 0xc14]
mov dword [ebp - 0x14d0], edx
cmp dword [ebp - 0x14d0], 0
jne 0x47b1df
push ecx
push ebx
add esp, 4
jmp 0x47b1ad
call 0x47b1bc
add byte [edi], dh
inc ecx
cmp al, 0x44
dec ecx
inc ebp
inc eax
cmp eax, 0x4c48350
pop ecx
push edi
push ecx
add esp, 4
jmp 0x47b1ca
add edi, 0xef9c
pop edi
mov eax, dword [ebp - 0x4d0]
mov dword [ebp - 0xa5c], eax
jmp 0x47b220
jmp 0x47af2d
push ebx
and ebx, 0x54
pop ebx
push edi
add edi, 0x820
pop edi
push edx
push edi
add esp, 4
add edx, 0x52a8
add edx, 0x14e43
jmp 0x47b249
pop edx
push ecx
xor ecx, 0x7bdd
pop ecx
mov byte [ebp - 0x804], 0x45
mov byte [ebp - 0x803], 0x78
mov byte [ebp - 0x802], 0x69
mov byte [ebp - 0x801], 0x74
mov byte [ebp - 0x800], 0x50
mov byte [ebp - 0x7ff], 0x72
mov byte [ebp - 0x7fe], 0x6f
mov byte [ebp - 0x7fd], 0x63
mov byte [ebp - 0x7fc], 0x65
mov byte [ebp - 0x7fb], 0x73
mov byte [ebp - 0x7fa], 0x73
mov byte [ebp - 0x7f9], 0
push edi
push eax
add esp, 4
or edi, 0xff45
pop edi
push edi
add edi, 0x111d7
pop edi
push eax
push edi
add esp, 4
or eax, 0x59d5
and eax, 0x39cc
xor eax, 0x1229c
and eax, 0x6c9c
pop eax
mov ecx, 0x6b
mov word [ebp - 0x1628], cx
mov edx, 0x65
mov word [ebp - 0x1626], dx
mov eax, 0x72
mov word [ebp - 0x1624], ax
mov ecx, 0x6e
mov word [ebp - 0x1622], cx
mov edx, 0x65
mov word [ebp - 0x1620], dx
mov eax, 0x6c
mov word [ebp - 0x161e], ax
mov ecx, 0x33
mov word [ebp - 0x161c], cx
mov edx, 0x32
mov word [ebp - 0x161a], dx

Function at 0x47b20c
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
or ebx, dword [edi + 1]
add byte [ecx + 0x56], bl
add esi, 0xd336
pop esi
push edi
push ebx
add esp, 4
or edi, 0x64c8
pop edi
push ecx
push eax
add esp, 4
xor ecx, 0x9821
pop ecx
jmp 0x47b1e4
push eax
jmp 0x47b1ea
or eax, 0x3f38
pop eax
push ecx
push ecx
add esp, 4
add ecx, 0x695b
call 0x47b20c
add byte [esi], dh
dec ebx
cmp esi, dword [edi]
cmp byte [ebp + 0x4b], al
xor al, byte [esi + 0x3d]
add esp, 4
xor ecx, 0x138f7
pop ecx
mov dword [ebp - 0xa5c], 0
Function at 0x47b951
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x47b963
add byte [eax + ecx*2 + 0x4c], cl
inc esi
push eax
inc eax
xor al, 0x3f
dec ebp
add esp, 4
xor esi, 0x14c99
or esi, 0x2589
pop esi
lea edx, [ebp - 0x16cc]
mov dword [ebp - 0xc28], edx
mov eax, dword [ebp - 0x4d8]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc24], ecx
xor edx, edx
mov word [ebp - 0x1fc], dx
xor eax, eax
mov word [ebp - 0x104], ax

Function at 0x47b963
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x47b963
add byte [eax + ecx*2 + 0x4c], cl
inc esi
push eax
inc eax
xor al, 0x3f
dec ebp
add esp, 4
xor esi, 0x14c99
or esi, 0x2589
pop esi
lea edx, [ebp - 0x16cc]
mov dword [ebp - 0xc28], edx
mov eax, dword [ebp - 0x4d8]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc24], ecx
xor edx, edx
mov word [ebp - 0x1fc], dx
xor eax, eax
mov word [ebp - 0x104], ax
Function at 0x47bf84
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
jno 0x47bf87
add byte [ecx + 0x14c6cc6], al
add byte [esi + 0x51], bl

Function at 0x47bfc0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
and eax, 0xd4c1
call 0x47bfd6
add byte [eax + 0x37], al
dec ecx
dec esp
dec edx
cmp al, 0x49
add esp, 4
pop eax
push esi
and esi, 0x8cec
and esi, 0x105cb
jmp 0x47bfef
pop esi
mov ecx, dword [ebp - 0x18b0]
mov dword [ebp - 0x18b4], ecx
lea edx, [ebp - 0x1628]
push edx
call dword [ebp - 0x18b4]
test eax, eax
jne 0x47c04e
push eax
push esi
add esp, 4
les eax, [eax + ebp*8]
or al, byte [eax]
add byte [eax], al

Function at 0x47bfd6
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
and eax, 0xd4c1
call 0x47bfd6
add byte [eax + 0x37], al
dec ecx
dec esp
dec edx
cmp al, 0x49
add esp, 4
pop eax
push esi
and esi, 0x8cec
and esi, 0x105cb
jmp 0x47bfef
pop esi
mov ecx, dword [ebp - 0x18b0]
mov dword [ebp - 0x18b4], ecx
lea edx, [ebp - 0x1628]
push edx
call dword [ebp - 0x18b4]
test eax, eax
jne 0x47c04e
push eax
push esi
add esp, 4
les eax, [eax + ebp*8]
or al, byte [eax]
add byte [eax], al

Function at 0x47c010
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
les eax, [eax + ebp*8]
or al, byte [eax]
add byte [eax], al
add byte [edx + 0x45], cl
dec edx
cmp byte [ecx + ecx*2], dh
inc ebp
dec ebx
inc ebx
add esp, 4
jmp 0x47c02c
sub eax, 0x10356
pop eax
push edi
push esi
add esp, 4
xor edi, 0xdea4
pop edi
mov dword [ebp - 0x738], 0
jmp 0x47c738

Function at 0x47c021
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
les eax, [eax + ebp*8]
or al, byte [eax]
add byte [eax], al
add byte [edx + 0x45], cl
dec edx
cmp byte [ecx + ecx*2], dh
inc ebp
dec ebx
inc ebx
add esp, 4
jmp 0x47c02c
sub eax, 0x10356
pop eax
push edi
push esi
add esp, 4
xor edi, 0xdea4
pop edi
mov dword [ebp - 0x738], 0
jmp 0x47c738
Function at 0x47c26c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
add esp, 4
sub ebx, 0x1610c
and ebx, 0xa46c
and ebx, 0xf983
pop ebx
push ecx
push eax
add esp, 4
or ecx, 0xd1e9
sub ecx, 0x5197
pop ecx
push edi
sub edi, 0x174d5
pop edi
mov ecx, dword [ebp - 0xc34]
mov dx, word [ecx]
mov word [ebp - 0xf86], dx
mov eax, dword [ebp - 0xc34]
add eax, 2
mov dword [ebp - 0xc34], eax
mov cx, word [ebp - 0xf86]
mov word [ebp - 0x200], cx
mov edx, dword [ebp - 0xc38]
mov ax, word [edx]
mov word [ebp - 0xf88], ax
mov ecx, dword [ebp - 0xc38]
add ecx, 2
mov dword [ebp - 0xc38], ecx
mov dx, word [ebp - 0xf88]
mov word [ebp - 0x34], dx
push ebx
jmp 0x47c244
sub ebx, 0x143f
or ebx, 0x1189b
pop ebx
push edi
or edi, 0x17d53
sub edi, 0x3c0f
call 0x47c26c
add byte [edx + 0x40], cl
inc ebx
xor al, 0x34
dec edx
aas
inc esp
add esp, 4
pop edi
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x47c28d
movzx ecx, word [ebp - 0x200]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x14fc], ecx
jmp 0x47c2e7
movzx eax, word [ebp - 0x200]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x47c1b5
movzx edx, word [ebp - 0x200]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x47c1b5
movzx ecx, word [ebp - 0x200]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x47c2d1
mov dword [ebp - 0x14f8], 0xffffffff
jmp 0x47c2db
mov dword [ebp - 0x14f8], 1
mov eax, dword [ebp - 0x14f8]
mov dword [ebp - 0x14fc], eax
cmp dword [ebp - 0x14fc], 0
jne 0x47c330
push eax
and eax, 0x12afa
or eax, 0x120c5
call 0x47c30a
add byte [edx + 0x41], cl
inc eax
inc ebx
xor eax, 0xc4834946
add al, 0x58
push ebx
sub ebx, 0xf69d
or ebx, 0x1669f
xor ebx, 0x184ec
pop ebx
mov ecx, dword [ebp - 0x4dc]
mov dword [ebp - 0x2e0], ecx
jmp 0x47c398
push edi
push edi
add esp, 4
call 0x47c342
add byte [esp + ecx*2], dh
aaa
inc esi
dec edi
push eax
add esp, 4
call 0x47c352
add byte [eax + 0x3a], cl
aas
inc edx
inc edi
cmp eax, 0x4c4834e
jmp 0x47c35b
or edi, 0x15edc
pop edi
mov edx, dword [ebp - 0x4dc]
mov eax, dword [edx]
mov dword [ebp - 0x4dc], eax
mov ecx, dword [ebp - 0x4dc]
cmp ecx, dword [ebp - 0xc3c]
je 0x47c38e
mov edx, dword [ebp - 0x4dc]
cmp dword [edx + 0x30], 0
jne 0x47c159
mov dword [ebp - 0x2e0], 0