joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413386
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
and word [esi], 0
mov cx, word [edx + edi]
lea eax, [edi + 2]
cmp eax, dword [ebp + 0xc]
jle 0x4133a8
xor eax, eax
jmp 0x4133de
cmp cx, 0x5c
jne 0x4133bf
mov cx, word [eax + edx]
inc eax
inc eax
cmp cx, 0x5c
je 0x4133bf
or eax, 0xffffffff
jmp 0x4133de
cmp cx, 0xcc
je 0x4133d8
mov word [esi], cx
inc esi
inc esi
cmp eax, dword [ebp + 0xc]
jg 0x4133d8
mov cx, word [eax + edx]
inc eax
inc eax
jmp 0x4133bf
and word [esi], 0
sub eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x4133e2
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 0x18]
push edi
and word [esi], 0
and word [ecx], 0
mov di, word [edx + eax]
add eax, 2
cmp eax, dword [ebp + 0xc]
jle 0x41340f
xor eax, eax
jmp 0x4134ca
cmp di, 0x5c
jne 0x413408
mov bx, word [eax + edx]
push 2
movzx ebx, bx
pop edi
add eax, edi
cmp ebx, 0x3d
je 0x4134a1
cmp ebx, 0x7c
jne 0x413408
mov word [esi], di
mov si, word [eax + edx]
add eax, edi
xor ebx, ebx
cmp si, 0xcc
je 0x413456
cmp eax, dword [ebp + 0xc]
jg 0x41347f
mov word [ecx], si
mov si, word [eax + edx]
add ecx, edi
add eax, edi
cmp si, 0xcc
jne 0x41343d
xor ebx, ebx
cmp word [eax + edx], 0x5c
jne 0x41348a
add eax, edi
cmp eax, dword [ebp + 0xc]
jg 0x41348a
cmp word [eax + edx], 0x7c
jne 0x413493
add eax, edi
mov word [ecx], bx
cmp eax, dword [ebp + 0xc]
jg 0x41348d
mov si, word [eax + edx]
add ecx, edi
add eax, edi
jmp 0x413436
and word [ecx], 0
and word [ecx + 2], 0
jmp 0x4134c7
mov word [ecx], bx
mov word [ecx + 2], bx
jmp 0x4134c7
sub eax, dword [ebp + 0x10]
mov word [ecx], bx
mov word [ecx + 2], bx
sub eax, edi
jmp 0x4134ca
mov word [esi], 1
mov si, word [eax + edx]
add eax, edi
cmp si, 0xcc
je 0x4134c3
cmp eax, dword [ebp + 0xc]
jg 0x413408
mov word [ecx], si
add ecx, edi
jmp 0x4134a6
and word [ecx], 0
sub eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4134cf
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
and word [esi], 0
mov cx, word [edx + edi]
lea eax, [edi + 2]
cmp cx, 0x5c
jne 0x4134ff
cmp eax, dword [ebp + 0xc]
jg 0x41351e
mov cx, word [eax + edx]
inc eax
inc eax
cmp cx, 0x23
je 0x413503
xor eax, eax
jmp 0x413520
mov cx, word [eax + edx]
inc eax
inc eax
cmp cx, 0xcc
je 0x41351a
mov word [esi], cx
inc esi
inc esi
cmp eax, dword [ebp + 0xc]
jle 0x413503
and word [esi], 0
sub eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x41398c
Capabilities:
Copy file
Set registry value

Disassembly:
mov eax, 0x4198a8
call fcn.00418790
sub esp, 0x428
push ebx
xor ebx, ebx
mov dword [ebp - 0x18], ebx
call sub.WT13LI.DLL_WtGetDefaultLanguage
cmp ax, bx
je 0x413b3b
push esi
push edi
push eax
push ebx
call fcn.004180f8
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x20], eax
push ecx
push ebx
push eax
call fcn.00418007
mov esi, eax
add esp, 0x14
cmp esi, ebx
je 0x413b2b
lea eax, [ebp - 0x22c]
mov byte [ebp - 0x22c], bl
push eax
call fcn.00417ebe
pop ecx
push 1
pop edi
cmp eax, edi
jne 0x413b2b
lea eax, [ebp - 0x32c]
mov byte [ebp - 0x32c], bl
push eax
lea eax, [ebp - 0x124]
push eax
push ebx
push ebx
mov byte [ebp - 0x124], bl
push dword [esi + 2]
call dword [sym.imp.MSVCRT.dll__splitpath]
add esp, 0x14
lea ecx, [ebp - 0x14]
push dword [esi + 2]
call sub.MFC42.DLL_CString::CString_1
lea eax, [ebp - 0x22c]
lea ecx, [ebp - 0x10]
push eax
mov dword [ebp - 4], ebx
call sub.MFC42.DLL_CString::CString_1
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call sub.MFC42.DLL_CString::MakeLower
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::MakeLower
lea eax, [ebp - 0x10]
mov ecx, 0x4262c8
push eax
call sub.MFC42.DLL_CString::operator
push dword [ebp - 0x10]
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::Find
test eax, eax
je 0x413b11
lea eax, [ebp - 0x124]
lea ecx, [ebp - 0x10]
push eax
call fcn.00418ca4
lea eax, [ebp - 0x32c]
lea ecx, [ebp - 0x10]
push eax
call fcn.00418ca4
push edi
push dword [ebp - 0x10]
push dword [esi + 2]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push ebx
lea eax, [ebp - 0x434]
push str.Word_List__d
push eax
mov byte [ebp - 0x434], bl
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
push 2
lea eax, [ebp - 0x434]
push ebx
push eax
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x413b14
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x10]
mov eax, dword [eax - 8]
inc eax
push eax
push eax
call sub.MFC42.DLL_CString::GetBuffer
push eax
push edi
push ebx
push str.Name
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
mov esi, eax
call sub.MFC42.DLL_CString::ReleaseBuffer
cmp esi, ebx
jne 0x413b06
mov dword [ebp - 0x18], edi
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x413b14
mov dword [ebp - 0x18], edi
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.004189b0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004189b0
cmp dword [ebp - 0x20], ebx
pop edi
pop esi
je 0x413b3b
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x413ecc
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
cmp word [eax], 0
je 0x413ee7
mov cl, byte [esp + 8]
xor byte [eax], cl
xor byte [eax + 1], cl
inc eax
inc eax
cmp word [eax], 0
jne 0x413eda
ret
Function at 0x414565
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
movzx edi, word [ebp + 0x14]
push edi
push 0
push esi
call fcn.00417b3a
mov ebx, dword [ebp + 0xc]
add esp, 0xc
lea eax, [edi + esi - 4]
push 2
mov dword [ebp - 4], eax
pop edi
lea eax, [ebp + 0x14]
push eax
push ebx
push dword [ebp + 8]
call fcn.00414649
movsx eax, ax
add esp, 0xc
cmp eax, 0xffffffff
je 0x414644
test eax, eax
jne 0x414604
mov eax, dword [ebp + 0x14]
cmp ax, 0xcc
jne 0x4145be
cmp word [0x4263a0], ax
je 0x41458c
cmp ax, 0xcc
mov word [0x4263a0], ax
jne 0x4145f8
mov al, bl
and al, 8
cmp al, 8
jne 0x4145d9
mov word [esi], 0xcc
jmp 0x4145fb
mov al, bl
and al, 0x10
cmp al, 0x10
jne 0x4145eb
and dword [ebp + 0x14], 0
and word [esi], 0
jmp 0x4145fb
push 0xa
mov word [esi], 0xd
pop eax
add esi, edi
mov dword [ebp + 0x14], eax
mov word [esi], ax
add esi, edi
cmp esi, dword [ebp - 4]
ja 0x41462c
jmp 0x41458c
cmp eax, 1
jne 0x414644
mov al, bl
and al, 8
cmp al, 8
jne 0x414618
mov word [esi], 0xcc
jmp 0x41462a
and bl, 0x10
cmp bl, 0x10
jne 0x414636
and word [esi], 0
add esi, edi
and word [esi], 0
add esi, edi
mov eax, esi
sub eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
leave
ret
mov word [esi], 0xd
add esi, edi
mov word [esi], 0xa
jmp 0x41462a
or eax, 0xffffffff
jmp 0x414631

Function at 0x4174e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30c
push esi
push edi
push 8
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
test eax, eax
pop ecx
je 0x417502
mov ecx, eax
call fcn.00417449
mov edi, eax
jmp 0x417504
xor edi, edi
test edi, edi
jne 0x41751b
push edi
push 2
push 2
call fcn.00417f2c
add esp, 0xc
xor eax, eax
pop edi
pop esi
leave
ret
cmp dword [ebp + 8], 0
je 0x41752c
push dword [ebp + 8]
call fcn.0041783c
pop ecx
jmp 0x41758f
lea eax, [ebp - 0x208]
mov esi, 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x417515
cmp eax, esi
jae 0x417515
add eax, 0xc
cmp eax, esi
jae 0x417515
lea eax, [ebp - 0x104]
push eax
push 0
lea eax, [ebp - 0x208]
push str.WT13
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x417515
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x30c]
push eax
call fcn.004179f7
lea eax, [ebp - 0x30c]
push eax
call fcn.00417889
add esp, 0xc
push dword [ebp + 0xc]
mov dword [edi + 4], eax
push eax
call fcn.004175be
pop ecx
cmp eax, 0xffffffff
pop ecx
mov dword [edi], eax
jne 0x4175b7
mov ecx, edi
call fcn.00417453
push edi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
jmp 0x417515
mov eax, edi
jmp 0x417517

Function at 0x41768a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp + 0x10]
push 0
push eax
mov eax, dword [ebp + 8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4176c1
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00417432
pop ecx
push eax
call fcn.00417f2c
add esp, 0xc
mov eax, dword [ebp + 0x10]
pop ebp
ret
Function at 0x417724
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp + 0x10]
push 0
push eax
mov eax, dword [ebp + 8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x41775b
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00417432
pop ecx
push eax
call fcn.00417f2c
add esp, 0xc
mov eax, dword [ebp + 0x10]
pop ebp
ret

Function at 0x417ebe
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 5
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x417f1d
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
push dword [ebp - 4]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push str.Corel_User_Files_
push dword [ebp + 8]
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x417f21
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x417f21
xor eax, eax
leave
ret
push 1
pop eax
leave
ret

Function at 0x418007
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x419b1e
call fcn.00418790
sub esp, 0x214
push esi
push edi
push dword [ebp + 0xc]
lea eax, [ebp - 0x11c]
push str.Word_List__d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp + 0xc]
xor edi, edi
push eax
push 0x20019
lea eax, [ebp - 0x11c]
push edi
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x418085
lea eax, [ebp - 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push str.Name
mov dword [ebp - 0x10], 0x104
push dword [ebp + 0xc]
call esi
test eax, eax
je 0x418095
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 4
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push str.Enabled
push dword [ebp + 0xc]
call esi
test eax, eax
jne 0x4180c4
cmp dword [ebp - 0x14], edi
mov ecx, dword [ebp + 0x10]
setne al
mov dword [ecx], eax
jmp 0x4180cd
mov eax, dword [ebp + 0x10]
mov dword [eax], 1
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 6
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov ecx, eax
mov dword [ebp + 0x10], ecx
cmp ecx, edi
mov dword [ebp - 4], edi
je 0x418085
lea eax, [ebp - 0x220]
push eax
call fcn.004177b2
jmp 0x418087
Function at 0x41817c
Capabilities:
Check if file exists
Delete registry key
Get file attributes
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push edi
xor ebx, ebx
mov edi, str.Word_List__d
push ebx
lea eax, [ebp - 0x3c]
push edi
push eax
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], 0x104
call esi
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
push 0x20019
lea eax, [ebp - 0x3c]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
push dword [ebp + 8]
call ebx
test eax, eax
jne 0x4182f5
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
push str.Name
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4182be
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4182be
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jne 0x41821b
inc dword [ebp - 4]
jmp 0x4182be
push dword [ebp - 4]
lea eax, [ebp - 0x3c]
push edi
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push 0x20006
lea eax, [ebp - 0x3c]
push 0
push eax
push dword [ebp + 8]
call ebx
test eax, eax
jne 0x4182be
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
push str.Enabled
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x41826e
mov dword [ebp - 0x18], 1
lea eax, [ebp - 0x140]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
inc eax
push eax
lea eax, [ebp - 0x140]
push eax
push 1
push 0
push str.Name
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x4182b5
lea eax, [ebp - 0x18]
push 4
push eax
push 3
push 0
push str.Enabled
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
inc dword [ebp - 4]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 8]
lea eax, [ebp - 0x3c]
push dword [ebp - 8]
mov dword [ebp - 0xc], 0x104
push edi
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
push 0x20019
lea eax, [ebp - 0x3c]
push 0
push eax
push dword [ebp + 8]
jmp 0x4181c4
mov ebx, dword [ebp - 4]
cmp ebx, dword [ebp - 8]
jge 0x418318
push ebx
lea eax, [ebp - 0x3c]
push edi
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x3c]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
inc ebx
jmp 0x4182f8
pop edi
pop esi
pop ebx
leave
ret
Function at 0x418729
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x418781
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
push dword [ebp + 8]
push esi
push esi
push 0x4262d4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x418774
push 1
pop esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x418783
xor eax, eax
pop esi
leave
ret 4
Function at 0x4072ad
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x46bc7c], 0
jne 0x4072eb
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4072c1
mov dword [ecx*4 + 0x46bc78], eax
inc ecx
cmp ecx, 0x100
jl 0x4072bc
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x407318
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x46bc78]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4072f9
not eax
pop ebp
ret 0xc

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x650702a7
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e3d0
mov ecx, 0x2f4432a4
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x46c9d5
Capabilities:
Get number of processors

Disassembly:
mov edx, dword [ebp - 0x4d0]
add edx, 1
mov dword [ebp - 0x4d0], edx
cmp dword [ebp - 0xc10], 0
jle 0x46cacd
push esi
push ebx
add esp, 4
and esi, 0xf7d7
pop esi
push esi
sub esi, 0x9241
call fcn.0046c9d5
add byte [eax + 0x34], dl
aas
cmp dword [ebx], esi
inc edx
xor eax, 0x8104c483
add esp, 4
sub esi, 0x6e65
add esp, 4
sub esi, 0x6e65
pop esi
push edx
or edx, 0x9a3f
pop edx
mov edx, dword [ebp - 0xa60]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x9f0]
movzx edx, byte [ecx]
cmp eax, edx
je 0x46ca69
push eax
or eax, 0x10ab4
xor eax, 0x166df
pop eax
push edi
sub edi, 0xbcea
or edi, 0xde0c
call 0x46ca25
add byte [eax], bh
dec edx
dec ecx
cmp dl, byte [eax + 0x43]
dec edx
add esp, 4
and edi, 0x1723b
pop edi
mov eax, dword [ebp - 0xa60]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x9f0]
movzx eax, byte [edx]
cmp ecx, eax
jle 0x46ca51
mov dword [ebp - 0x14cc], 1
jmp 0x46ca5b
mov dword [ebp - 0x14cc], 0xffffffff
mov ecx, dword [ebp - 0x14cc]
mov dword [ebp - 0xc14], ecx
jmp 0x46cacd
push eax
push eax
add esp, 4
xor eax, 0xd631
call 0x46ca84
add byte [eax], bh
inc ebp
dec esp
xor cl, byte [edx + 0x3d]
cmp bh, byte [esi]
dec ebx
dec ecx
add esp, 4
jmp 0x46ca8e
pop eax
push esi
push ebx
add esp, 4
or esi, 0x8905
pop esi
mov edx, dword [ebp - 0xc10]
sub edx, 1
mov dword [ebp - 0xc10], edx
mov eax, dword [ebp - 0xa60]
add eax, 1
mov dword [ebp - 0xa60], eax
mov ecx, dword [ebp - 0x9f0]
add ecx, 1
mov dword [ebp - 0x9f0], ecx
jmp 0x46c9a8
mov edx, dword [ebp - 0xc14]
mov dword [ebp - 0x14d0], edx
cmp dword [ebp - 0x14d0], 0
jne 0x46cb22
push ebx
push ecx
add esp, 4
add ebx, 0x5c38
pop ebx
push edi
and edi, 0x3797
xor edi, 0x33a1
pop edi
push ebx
push esi
add esp, 4
and ebx, 0x9965
pop ebx
push edi
push edi
add esp, 4
add edi, 0x77b5
pop edi
mov eax, dword [ebp - 0x4d0]
mov dword [ebp - 0xa5c], eax
jmp 0x46cb63
jmp 0x46c870
Function at 0x46ca25
Capabilities:
Get number of processors

Disassembly:
mov edx, dword [ebp - 0x4d0]
add edx, 1
mov dword [ebp - 0x4d0], edx
cmp dword [ebp - 0xc10], 0
jle 0x46cacd
push esi
push ebx
add esp, 4
and esi, 0xf7d7
pop esi
push esi
sub esi, 0x9241
call fcn.0046c9d5
add byte [eax + 0x34], dl
aas
cmp dword [ebx], esi
inc edx
xor eax, 0x8104c483
add esp, 4
sub esi, 0x6e65
add esp, 4
sub esi, 0x6e65
pop esi
push edx
or edx, 0x9a3f
pop edx
mov edx, dword [ebp - 0xa60]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x9f0]
movzx edx, byte [ecx]
cmp eax, edx
je 0x46ca69
push eax
or eax, 0x10ab4
xor eax, 0x166df
pop eax
push edi
sub edi, 0xbcea
or edi, 0xde0c
call 0x46ca25
add byte [eax], bh
dec edx
dec ecx
cmp dl, byte [eax + 0x43]
dec edx
add esp, 4
and edi, 0x1723b
pop edi
mov eax, dword [ebp - 0xa60]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x9f0]
movzx eax, byte [edx]
cmp ecx, eax
jle 0x46ca51
mov dword [ebp - 0x14cc], 1
jmp 0x46ca5b
mov dword [ebp - 0x14cc], 0xffffffff
mov ecx, dword [ebp - 0x14cc]
mov dword [ebp - 0xc14], ecx
jmp 0x46cacd
push eax
push eax
add esp, 4
xor eax, 0xd631
call 0x46ca84
add byte [eax], bh
inc ebp
dec esp
xor cl, byte [edx + 0x3d]
cmp bh, byte [esi]
dec ebx
dec ecx
add esp, 4
jmp 0x46ca8e
pop eax
push esi
push ebx
add esp, 4
or esi, 0x8905
pop esi
mov edx, dword [ebp - 0xc10]
sub edx, 1
mov dword [ebp - 0xc10], edx
mov eax, dword [ebp - 0xa60]
add eax, 1
mov dword [ebp - 0xa60], eax
mov ecx, dword [ebp - 0x9f0]
add ecx, 1
mov dword [ebp - 0x9f0], ecx
jmp 0x46c9a8
mov edx, dword [ebp - 0xc14]
mov dword [ebp - 0x14d0], edx
cmp dword [ebp - 0x14d0], 0
jne 0x46cb22
push ebx
push ecx
add esp, 4
add ebx, 0x5c38
pop ebx
push edi
and edi, 0x3797
xor edi, 0x33a1
pop edi
push ebx
push esi
add esp, 4
and ebx, 0x9965
pop ebx
push edi
push edi
add esp, 4
add edi, 0x77b5
pop edi
mov eax, dword [ebp - 0x4d0]
mov dword [ebp - 0xa5c], eax
jmp 0x46cb63
jmp 0x46c870
Function at 0x46ca84
Capabilities:
Get number of processors

Disassembly:
mov edx, dword [ebp - 0x4d0]
add edx, 1
mov dword [ebp - 0x4d0], edx
cmp dword [ebp - 0xc10], 0
jle 0x46cacd
push esi
push ebx
add esp, 4
and esi, 0xf7d7
pop esi
push esi
sub esi, 0x9241
call fcn.0046c9d5
add byte [eax + 0x34], dl
aas
cmp dword [ebx], esi
inc edx
xor eax, 0x8104c483
add esp, 4
sub esi, 0x6e65
add esp, 4
sub esi, 0x6e65
pop esi
push edx
or edx, 0x9a3f
pop edx
mov edx, dword [ebp - 0xa60]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x9f0]
movzx edx, byte [ecx]
cmp eax, edx
je 0x46ca69
push eax
or eax, 0x10ab4
xor eax, 0x166df
pop eax
push edi
sub edi, 0xbcea
or edi, 0xde0c
call 0x46ca25
add byte [eax], bh
dec edx
dec ecx
cmp dl, byte [eax + 0x43]
dec edx
add esp, 4
and edi, 0x1723b
pop edi
mov eax, dword [ebp - 0xa60]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x9f0]
movzx eax, byte [edx]
cmp ecx, eax
jle 0x46ca51
mov dword [ebp - 0x14cc], 1
jmp 0x46ca5b
mov dword [ebp - 0x14cc], 0xffffffff
mov ecx, dword [ebp - 0x14cc]
mov dword [ebp - 0xc14], ecx
jmp 0x46cacd
push eax
push eax
add esp, 4
xor eax, 0xd631
call 0x46ca84
add byte [eax], bh
inc ebp
dec esp
xor cl, byte [edx + 0x3d]
cmp bh, byte [esi]
dec ebx
dec ecx
add esp, 4
jmp 0x46ca8e
pop eax
push esi
push ebx
add esp, 4
or esi, 0x8905
pop esi
mov edx, dword [ebp - 0xc10]
sub edx, 1
mov dword [ebp - 0xc10], edx
mov eax, dword [ebp - 0xa60]
add eax, 1
mov dword [ebp - 0xa60], eax
mov ecx, dword [ebp - 0x9f0]
add ecx, 1
mov dword [ebp - 0x9f0], ecx
jmp 0x46c9a8
mov edx, dword [ebp - 0xc14]
mov dword [ebp - 0x14d0], edx
cmp dword [ebp - 0x14d0], 0
jne 0x46cb22
push ebx
push ecx
add esp, 4
add ebx, 0x5c38
pop ebx
push edi
and edi, 0x3797
xor edi, 0x33a1
pop edi
push ebx
push esi
add esp, 4
and ebx, 0x9965
pop ebx
push edi
push edi
add esp, 4
add edi, 0x77b5
pop edi
mov eax, dword [ebp - 0x4d0]
mov dword [ebp - 0xa5c], eax
jmp 0x46cb63
jmp 0x46c870