joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54ab58
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5bd1b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0053e393
mov dword [ebp - 0x14], eax
cmp dword [0x5c9398], esi
jne 0x54ac4b
push 0x800
push esi
push 0x5937b0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x54abd8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x54ad2b
push esi
push esi
push 0x5937b0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x54ad2b
push 0x5937c8
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x54ad2b
push eax
call ebx
push 0x5937d4
push edi
mov dword [0x5c9398], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x5937e4
push edi
mov dword [0x5c939c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x5c93a0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x5c93a8], eax
test eax, eax
je 0x54ac48
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x5c93a4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x54ac70
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x54ac63
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x54ac85
push 4
pop eax
jmp 0x54ad2d
cmp dword [ebp - 0x14], esi
je 0x54ac85
push dword [0x5c9398]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x54ac6a
mov eax, dword [0x5c93a4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x54ace3
cmp dword [0x5c93a8], edi
je 0x54ace3
push eax
call ebx
push dword [0x5c93a8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x54ace3
test eax, eax
je 0x54ace3
call ecx
test eax, eax
je 0x54acd8
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x54acd8
test byte [ebp - 8], 1
jne 0x54ace3
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x54ad13
mov eax, dword [0x5c939c]
cmp eax, edi
je 0x54ad10
push eax
call ebx
test eax, eax
je 0x54ad10
call eax
mov esi, eax
test esi, esi
je 0x54ad10
mov eax, dword [0x5c93a0]
cmp eax, edi
je 0x54ad10
push eax
call ebx
test eax, eax
je 0x54ad10
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x5c9398]
call ebx
test eax, eax
je 0x54ad2b
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x54ad2d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00536d2d
mov esp, ebp
pop ebp
ret
Function at 0x42c4b6
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ecx
push eax
push edx
add esp, 4
jmp 0x42c4c8
xor eax, 0x8057
sub eax, 0x13d9c
pop eax
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push eax
push edi
add esp, 4
and eax, 0x13920
call 0x42c51a
add byte [edx + 0x34], cl
xor al, 0x42
inc ebx
inc ebx
xor cl, byte [ebx - 0x7d]
les eax, [eax + ebp*8]
pop es
add byte [eax], al
add byte [eax], al
inc edx
inc esi
push eax
xor al, byte [ebx + 0x42]
add esp, 4
add eax, 0xcfc4
pop eax
push edx
push ecx
add esp, 4
or edx, 0x133dc
sub edx, 0xb0d2
pop edx
push esi
push edi
add esp, 4
sub esi, 0x9669

Function at 0x42c51a
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ecx
push eax
push edx
add esp, 4
jmp 0x42c4c8
xor eax, 0x8057
sub eax, 0x13d9c
pop eax
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push eax
push edi
add esp, 4
and eax, 0x13920
call 0x42c51a
add byte [edx + 0x34], cl
xor al, 0x42
inc ebx
inc ebx
xor cl, byte [ebx - 0x7d]
les eax, [eax + ebp*8]
pop es
add byte [eax], al
add byte [eax], al
inc edx
inc esi
push eax
xor al, byte [ebx + 0x42]
add esp, 4
add eax, 0xcfc4
pop eax
push edx
push ecx
add esp, 4
or edx, 0x133dc
sub edx, 0xb0d2
pop edx
push esi
push edi
add esp, 4
sub esi, 0x9669

Function at 0x42c529
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ecx
push eax
push edx
add esp, 4
jmp 0x42c4c8
xor eax, 0x8057
sub eax, 0x13d9c
pop eax
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push eax
push edi
add esp, 4
and eax, 0x13920
call 0x42c51a
add byte [edx + 0x34], cl
xor al, 0x42
inc ebx
inc ebx
xor cl, byte [ebx - 0x7d]
les eax, [eax + ebp*8]
pop es
add byte [eax], al
add byte [eax], al
inc edx
inc esi
push eax
xor al, byte [ebx + 0x42]
add esp, 4
add eax, 0xcfc4
pop eax
push edx
push ecx
add esp, 4
or edx, 0x133dc
sub edx, 0xb0d2
pop edx
push esi
push edi
add esp, 4
sub esi, 0x9669
Function at 0x4303c0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov word [ebp - 0x1618], ax
mov ecx, 0x64
mov word [ebp - 0x1616], cx
mov edx, 0x6c
mov word [ebp - 0x1614], dx
mov eax, 0x6c
mov word [ebp - 0x1612], ax
xor ecx, ecx
invalid
invalid
invalid
Function at 0x430970
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ebx, 0x81000155
retf 0x31e1

Function at 0x4309b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
add cl, ch
pushal
add al, byte [eax]
add byte [ebx - 0xc2b73], cl
dec dword [ecx - 0x4d773]
call dword [edx + 0x50]

Function at 0x430bc7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edx
push eax
add esp, 4
jmp 0x4309d1
and edx, 0x11da2
pop edx
push edi
push ebx
add esp, 4
xor edi, 0x9c9
xor edi, 0x656d
pop edi
push ecx
push edx
add esp, 4
and ecx, 0x16290
pop ecx
lea edx, [ebp - 0x16cc]
mov dword [ebp - 0xc28], edx
mov eax, dword [ebp - 0x4d8]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc24], ecx
xor edx, edx
mov word [ebp - 0x1fc], dx
xor eax, eax
mov word [ebp - 0x104], ax
push edx
or edx, 0xb076
and edx, 0x101cd
pop edx
push eax
push ecx
add esp, 4
add eax, 0x122dc
add eax, 0x14b6a
pop eax
push ecx
push edi
add esp, 4
and ecx, 0x650a
and ecx, 0x1237
pop ecx
mov ecx, dword [ebp - 0xc24]
mov dx, word [ecx]
mov word [ebp - 0xf82], dx
mov eax, dword [ebp - 0xc24]
add eax, 2
mov dword [ebp - 0xc24], eax
mov cx, word [ebp - 0xf82]
mov word [ebp - 0x1fc], cx
mov edx, dword [ebp - 0xc28]
mov ax, word [edx]
mov word [ebp - 0xf84], ax
mov ecx, dword [ebp - 0xc28]
add ecx, 2
mov dword [ebp - 0xc28], ecx
mov dx, word [ebp - 0xf84]
mov word [ebp - 0x104], dx
push ecx
push ebx
add esp, 4
jmp 0x430aba
pop ecx
push edi
push eax
add esp, 4
xor edi, 0x15ad8
sub edi, 0x3804
pop edi
push edx
push edi
add esp, 4
jmp 0x430ada
xor edx, 0x56b4
pop edx
movzx eax, word [ebp - 0x104]
test eax, eax
jne 0x430b04
movzx ecx, word [ebp - 0x1fc]
movzx edx, word [ebp - 0x104]
sub ecx, edx
mov dword [ebp - 0x14e4], ecx
jmp 0x430b67
movzx eax, word [ebp - 0x1fc]
movzx ecx, word [ebp - 0x104]
cmp eax, ecx
je 0x430a23
movzx edx, word [ebp - 0x1fc]
xor edx, 0x20
movzx eax, word [ebp - 0x104]
cmp edx, eax
je 0x430a23
movzx ecx, word [ebp - 0x1fc]
movzx edx, word [ebp - 0x104]
cmp ecx, edx
jge 0x430b51
mov dword [ebp - 0x14e0], 0xffffffff
jmp 0x430b5b
mov dword [ebp - 0x14e0], 1
mov eax, dword [ebp - 0x14e0]
mov dword [ebp - 0x14e4], eax
cmp dword [ebp - 0x14e4], 0
jne 0x430bb0
push ecx
push edx
add esp, 4
add ecx, 0x9b09
and ecx, 0x83b0
sub ecx, 0x17a19
xor ecx, 0x18020
pop ecx
push edx
push edi
add esp, 4
and edx, 0x3316
jmp 0x430ba1
pop edx
mov ecx, dword [ebp - 0x4d8]
mov dword [ebp - 0x6ec], ecx
jmp fcn.00430c18
push edi
and edi, 0xd417
call fcn.00430bc7
add byte [eax + 0x3c], al
dec ebp
cmp dh, byte [0x333a503f]
inc ebp
add esp, 4
jmp 0x430bd3
pop edi
push ecx
sub ecx, 0x12ad4
sub ecx, 0x4cdc
pop ecx
mov edx, dword [ebp - 0x4d8]
mov eax, dword [edx]
mov dword [ebp - 0x4d8], eax
mov ecx, dword [ebp - 0x4d8]
cmp ecx, dword [ebp - 0xc2c]
je 0x430c0e
mov edx, dword [ebp - 0x4d8]
cmp dword [edx + 0x30], 0
jne 0x4309c4
mov dword [ebp - 0x6ec], 0
mov edx, dword [ebp - 0x704]
add edx, 1
mov dword [ebp - 0x704], edx
Function at 0x430cc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
dec ecx
push eax
inc ebx
xor eax, 0x858b5e3d
adc al, 0xf9
invalid
Function at 0x43180a
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
add byte [ebx + 0x36], al
cmp al, 0x4e
dec esi
inc ecx
xor al, 0x83
les eax, [ecx + eax*4]
jmp 0x43fcf8

Function at 0x43184d
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x43185c
add byte [0x3a36323d], bh
cmp dword [ebx + 0xae804c4], eax
add byte [eax], al
add byte [eax], al
cmp byte [ebx], bh
cmp al, 0x3a
xor ecx, dword [ecx + 0x49]
inc eax
inc ebp
add esp, 4
pop edx
mov edx, dword [ebp - 0x738]
mov dword [ebp - 0x18d0], edx
push 0
call dword [ebp - 0x18d0]
mov dword [ebp - 0x1fb0], 0xa
push ecx
push ecx
add esp, 4
sub ecx, 0xb51d
call 0x4318a8
add byte [0x3f373946], dh
dec edi
inc esi
add esp, 4
call 0x4318b8
add byte [edi + edi], bh
dec esi
inc ebp
inc ebx
aaa
add esp, 4
and ecx, 0x13cdc
pop ecx
mov eax, dword [ebp - 0x3cc]
mov cl, byte [eax + 0xa]
mov byte [ebp - 0x381], cl
mov edx, dword [ebp - 0xa5c]
sub edx, dword [ebp - 0x3cc]
mov dword [ebp - 0x158c], edx
mov dword [ebp - 0xc70], 0
push edi
sub edi, 0x13629
pop edi
push edi
push ebx
add esp, 4
call 0x431908
add byte [edx], bh
inc ecx
cmp byte [edx], dh
inc esp
cmp al, 0x45
inc ebp
add esp, 4
jmp 0x431912
add edi, 0xc037
sub edi, 0x13a3
pop edi
mov byte [ebp - 0x960], 0x56
test dword [eax + 0x56fffff6], esp
mov byte [ebp - 0x95f], 0x69
mov byte [ebp - 0x95e], 0x72
mov byte [ebp - 0x95d], 0x74
mov byte [ebp - 0x95c], 0x75
mov byte [ebp - 0x95b], 0x61
mov byte [ebp - 0x95a], 0x6c
mov byte [ebp - 0x959], 0x50
mov byte [ebp - 0x958], 0x72
mov byte [ebp - 0x957], 0x6f
test eax, 0x6ffffff6
mov byte [ebp - 0x956], 0x74
mov byte [ebp - 0x955], 0x65
mov byte [ebp - 0x954], 0x63
mov byte [ebp - 0x953], 0x74
mov byte [ebp - 0x952], 0
push edi
add edi, 0x8b58
jmp 0x431994
or edi, 0x431b
jmp 0x43199f
pop edi
push ebx
push edi
add esp, 4
xor ebx, 0xb9a8
xor ebx, 0xd82e
jmp 0x4319b9
pop ebx
mov eax, dword fs:[0x18]
Function at 0x43185c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x43185c
add byte [0x3a36323d], bh
cmp dword [ebx + 0xae804c4], eax
add byte [eax], al
add byte [eax], al
cmp byte [ebx], bh
cmp al, 0x3a
xor ecx, dword [ecx + 0x49]
inc eax
inc ebp
add esp, 4
pop edx
mov edx, dword [ebp - 0x738]
mov dword [ebp - 0x18d0], edx
push 0
call dword [ebp - 0x18d0]
mov dword [ebp - 0x1fb0], 0xa
push ecx
push ecx
add esp, 4
sub ecx, 0xb51d
call 0x4318a8
add byte [0x3f373946], dh
dec edi
inc esi
add esp, 4
call 0x4318b8
add byte [edi + edi], bh
dec esi
inc ebp
inc ebx
aaa
add esp, 4
and ecx, 0x13cdc
pop ecx
mov eax, dword [ebp - 0x3cc]
mov cl, byte [eax + 0xa]
mov byte [ebp - 0x381], cl
mov edx, dword [ebp - 0xa5c]
sub edx, dword [ebp - 0x3cc]
mov dword [ebp - 0x158c], edx
mov dword [ebp - 0xc70], 0
push edi
sub edi, 0x13629
pop edi
push edi
push ebx
add esp, 4
call 0x431908
add byte [edx], bh
inc ecx
cmp byte [edx], dh
inc esp
cmp al, 0x45
inc ebp
add esp, 4
jmp 0x431912
add edi, 0xc037
sub edi, 0x13a3
pop edi
mov byte [ebp - 0x960], 0x56
test dword [eax + 0x56fffff6], esp
mov byte [ebp - 0x95f], 0x69
mov byte [ebp - 0x95e], 0x72
mov byte [ebp - 0x95d], 0x74
mov byte [ebp - 0x95c], 0x75
mov byte [ebp - 0x95b], 0x61
mov byte [ebp - 0x95a], 0x6c
mov byte [ebp - 0x959], 0x50
mov byte [ebp - 0x958], 0x72
mov byte [ebp - 0x957], 0x6f
test eax, 0x6ffffff6
mov byte [ebp - 0x956], 0x74
mov byte [ebp - 0x955], 0x65
mov byte [ebp - 0x954], 0x63
mov byte [ebp - 0x953], 0x74
mov byte [ebp - 0x952], 0
push edi
add edi, 0x8b58
jmp 0x431994
or edi, 0x431b
jmp 0x43199f
pop edi
push ebx
push edi
add esp, 4
xor ebx, 0xb9a8
xor ebx, 0xd82e
jmp 0x4319b9
pop ebx
mov eax, dword fs:[0x18]
Function at 0x43186e
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x43185c
add byte [0x3a36323d], bh
cmp dword [ebx + 0xae804c4], eax
add byte [eax], al
add byte [eax], al
cmp byte [ebx], bh
cmp al, 0x3a
xor ecx, dword [ecx + 0x49]
inc eax
inc ebp
add esp, 4
pop edx
mov edx, dword [ebp - 0x738]
mov dword [ebp - 0x18d0], edx
push 0
call dword [ebp - 0x18d0]
mov dword [ebp - 0x1fb0], 0xa
push ecx
push ecx
add esp, 4
sub ecx, 0xb51d
call 0x4318a8
add byte [0x3f373946], dh
dec edi
inc esi
add esp, 4
call 0x4318b8
add byte [edi + edi], bh
dec esi
inc ebp
inc ebx
aaa
add esp, 4
and ecx, 0x13cdc
pop ecx
mov eax, dword [ebp - 0x3cc]
mov cl, byte [eax + 0xa]
mov byte [ebp - 0x381], cl
mov edx, dword [ebp - 0xa5c]
sub edx, dword [ebp - 0x3cc]
mov dword [ebp - 0x158c], edx
mov dword [ebp - 0xc70], 0
push edi
sub edi, 0x13629
pop edi
push edi
push ebx
add esp, 4
call 0x431908
add byte [edx], bh
inc ecx
cmp byte [edx], dh
inc esp
cmp al, 0x45
inc ebp
add esp, 4
jmp 0x431912
add edi, 0xc037
sub edi, 0x13a3
pop edi
mov byte [ebp - 0x960], 0x56
test dword [eax + 0x56fffff6], esp
mov byte [ebp - 0x95f], 0x69
mov byte [ebp - 0x95e], 0x72
mov byte [ebp - 0x95d], 0x74
mov byte [ebp - 0x95c], 0x75
mov byte [ebp - 0x95b], 0x61
mov byte [ebp - 0x95a], 0x6c
mov byte [ebp - 0x959], 0x50
mov byte [ebp - 0x958], 0x72
mov byte [ebp - 0x957], 0x6f
test eax, 0x6ffffff6
mov byte [ebp - 0x956], 0x74
mov byte [ebp - 0x955], 0x65
mov byte [ebp - 0x954], 0x63
mov byte [ebp - 0x953], 0x74
mov byte [ebp - 0x952], 0
push edi
add edi, 0x8b58
jmp 0x431994
or edi, 0x431b
jmp 0x43199f
pop edi
push ebx
push edi
add esp, 4
xor ebx, 0xb9a8
xor ebx, 0xd82e
jmp 0x4319b9
pop ebx
mov eax, dword fs:[0x18]
Function at 0x4318a8
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x43185c
add byte [0x3a36323d], bh
cmp dword [ebx + 0xae804c4], eax
add byte [eax], al
add byte [eax], al
cmp byte [ebx], bh
cmp al, 0x3a
xor ecx, dword [ecx + 0x49]
inc eax
inc ebp
add esp, 4
pop edx
mov edx, dword [ebp - 0x738]
mov dword [ebp - 0x18d0], edx
push 0
call dword [ebp - 0x18d0]
mov dword [ebp - 0x1fb0], 0xa
push ecx
push ecx
add esp, 4
sub ecx, 0xb51d
call 0x4318a8
add byte [0x3f373946], dh
dec edi
inc esi
add esp, 4
call 0x4318b8
add byte [edi + edi], bh
dec esi
inc ebp
inc ebx
aaa
add esp, 4
and ecx, 0x13cdc
pop ecx
mov eax, dword [ebp - 0x3cc]
mov cl, byte [eax + 0xa]
mov byte [ebp - 0x381], cl
mov edx, dword [ebp - 0xa5c]
sub edx, dword [ebp - 0x3cc]
mov dword [ebp - 0x158c], edx
mov dword [ebp - 0xc70], 0
push edi
sub edi, 0x13629
pop edi
push edi
push ebx
add esp, 4
call 0x431908
add byte [edx], bh
inc ecx
cmp byte [edx], dh
inc esp
cmp al, 0x45
inc ebp
add esp, 4
jmp 0x431912
add edi, 0xc037
sub edi, 0x13a3
pop edi
mov byte [ebp - 0x960], 0x56
test dword [eax + 0x56fffff6], esp
mov byte [ebp - 0x95f], 0x69
mov byte [ebp - 0x95e], 0x72
mov byte [ebp - 0x95d], 0x74
mov byte [ebp - 0x95c], 0x75
mov byte [ebp - 0x95b], 0x61
mov byte [ebp - 0x95a], 0x6c
mov byte [ebp - 0x959], 0x50
mov byte [ebp - 0x958], 0x72
mov byte [ebp - 0x957], 0x6f
test eax, 0x6ffffff6
mov byte [ebp - 0x956], 0x74
mov byte [ebp - 0x955], 0x65
mov byte [ebp - 0x954], 0x63
mov byte [ebp - 0x953], 0x74
mov byte [ebp - 0x952], 0
push edi
add edi, 0x8b58
jmp 0x431994
or edi, 0x431b
jmp 0x43199f
pop edi
push ebx
push edi
add esp, 4
xor ebx, 0xb9a8
xor ebx, 0xd82e
jmp 0x4319b9
pop ebx
mov eax, dword fs:[0x18]
Function at 0x4318b8
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x43185c
add byte [0x3a36323d], bh
cmp dword [ebx + 0xae804c4], eax
add byte [eax], al
add byte [eax], al
cmp byte [ebx], bh
cmp al, 0x3a
xor ecx, dword [ecx + 0x49]
inc eax
inc ebp
add esp, 4
pop edx
mov edx, dword [ebp - 0x738]
mov dword [ebp - 0x18d0], edx
push 0
call dword [ebp - 0x18d0]
mov dword [ebp - 0x1fb0], 0xa
push ecx
push ecx
add esp, 4
sub ecx, 0xb51d
call 0x4318a8
add byte [0x3f373946], dh
dec edi
inc esi
add esp, 4
call 0x4318b8
add byte [edi + edi], bh
dec esi
inc ebp
inc ebx
aaa
add esp, 4
and ecx, 0x13cdc
pop ecx
mov eax, dword [ebp - 0x3cc]
mov cl, byte [eax + 0xa]
mov byte [ebp - 0x381], cl
mov edx, dword [ebp - 0xa5c]
sub edx, dword [ebp - 0x3cc]
mov dword [ebp - 0x158c], edx
mov dword [ebp - 0xc70], 0
push edi
sub edi, 0x13629
pop edi
push edi
push ebx
add esp, 4
call 0x431908
add byte [edx], bh
inc ecx
cmp byte [edx], dh
inc esp
cmp al, 0x45
inc ebp
add esp, 4
jmp 0x431912
add edi, 0xc037
sub edi, 0x13a3
pop edi
mov byte [ebp - 0x960], 0x56
test dword [eax + 0x56fffff6], esp
mov byte [ebp - 0x95f], 0x69
mov byte [ebp - 0x95e], 0x72
mov byte [ebp - 0x95d], 0x74
mov byte [ebp - 0x95c], 0x75
mov byte [ebp - 0x95b], 0x61
mov byte [ebp - 0x95a], 0x6c
mov byte [ebp - 0x959], 0x50
mov byte [ebp - 0x958], 0x72
mov byte [ebp - 0x957], 0x6f
test eax, 0x6ffffff6
mov byte [ebp - 0x956], 0x74
mov byte [ebp - 0x955], 0x65
mov byte [ebp - 0x954], 0x63
mov byte [ebp - 0x953], 0x74
mov byte [ebp - 0x952], 0
push edi
add edi, 0x8b58
jmp 0x431994
or edi, 0x431b
jmp 0x43199f
pop edi
push ebx
push edi
add esp, 4
xor ebx, 0xb9a8
xor ebx, 0xd82e
jmp 0x4319b9
pop ebx
mov eax, dword fs:[0x18]
Function at 0x431908
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x43185c
add byte [0x3a36323d], bh
cmp dword [ebx + 0xae804c4], eax
add byte [eax], al
add byte [eax], al
cmp byte [ebx], bh
cmp al, 0x3a
xor ecx, dword [ecx + 0x49]
inc eax
inc ebp
add esp, 4
pop edx
mov edx, dword [ebp - 0x738]
mov dword [ebp - 0x18d0], edx
push 0
call dword [ebp - 0x18d0]
mov dword [ebp - 0x1fb0], 0xa
push ecx
push ecx
add esp, 4
sub ecx, 0xb51d
call 0x4318a8
add byte [0x3f373946], dh
dec edi
inc esi
add esp, 4
call 0x4318b8
add byte [edi + edi], bh
dec esi
inc ebp
inc ebx
aaa
add esp, 4
and ecx, 0x13cdc
pop ecx
mov eax, dword [ebp - 0x3cc]
mov cl, byte [eax + 0xa]
mov byte [ebp - 0x381], cl
mov edx, dword [ebp - 0xa5c]
sub edx, dword [ebp - 0x3cc]
mov dword [ebp - 0x158c], edx
mov dword [ebp - 0xc70], 0
push edi
sub edi, 0x13629
pop edi
push edi
push ebx
add esp, 4
call 0x431908
add byte [edx], bh
inc ecx
cmp byte [edx], dh
inc esp
cmp al, 0x45
inc ebp
add esp, 4
jmp 0x431912
add edi, 0xc037
sub edi, 0x13a3
pop edi
mov byte [ebp - 0x960], 0x56
test dword [eax + 0x56fffff6], esp
mov byte [ebp - 0x95f], 0x69
mov byte [ebp - 0x95e], 0x72
mov byte [ebp - 0x95d], 0x74
mov byte [ebp - 0x95c], 0x75
mov byte [ebp - 0x95b], 0x61
mov byte [ebp - 0x95a], 0x6c
mov byte [ebp - 0x959], 0x50
mov byte [ebp - 0x958], 0x72
mov byte [ebp - 0x957], 0x6f
test eax, 0x6ffffff6
mov byte [ebp - 0x956], 0x74
mov byte [ebp - 0x955], 0x65
mov byte [ebp - 0x954], 0x63
mov byte [ebp - 0x953], 0x74
mov byte [ebp - 0x952], 0
push edi
add edi, 0x8b58
jmp 0x431994
or edi, 0x431b
jmp 0x43199f
pop edi
push ebx
push edi
add esp, 4
xor ebx, 0xb9a8
xor ebx, 0xd82e
jmp 0x4319b9
pop ebx
mov eax, dword fs:[0x18]

Function at 0x431a65
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 0x1c34], eax
mov ecx, dword [ebp - 0x1c34]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x18d4], edx
mov eax, dword [ebp - 0x18d4]
mov dword [ebp - 0x150c], eax
push esi
push edi
add esp, 4
jmp 0x4319ef
or esi, 0x9a0b
pop esi
push esi
push edx
add esp, 4
sub esi, 0x3778
or esi, 0xe10d
add esi, 0x1083
jmp 0x431a12
pop esi
cmp dword [ebp - 0x150c], 0
jne 0x431a2b
mov dword [ebp - 0x2a8], 0
jmp 0x431cd2
mov ecx, dword [ebp - 0x150c]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xc4c], eax
push eax
push esi
add esp, 4
jmp 0x431a48
pop eax
push ecx
push ebx
add esp, 4
jmp 0x431a55
call 0x431a65
add byte [ebx + 0x4b], al
xor ecx, dword [ecx + 0x3f]
inc ebp
inc edi
push eax
cmp al, 0x39
add esp, 4
add ecx, 0x10151
pop ecx
cmp dword [ebp - 0xc4c], 0
jne 0x431a87
mov dword [ebp - 0x2a8], 0
jmp 0x431cd2
mov ecx, dword [ebp - 0xc4c]
invalid
invalid
invalid
Function at 0x431b40
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov cx, word [ebp - 0xf8a]
mov word [ebp - 0x204], cx
mov edx, dword [ebp - 0xc48]
mov ax, word [edx]
mov word [ebp - 0xf8c], ax
mov ecx, dword [ebp - 0xc48]
add ecx, 2
mov dword [ebp - 0xc48], ecx
mov dx, word [ebp - 0xf8c]
mov word [ebp - 0x38], dx
push eax
or eax, 0xdf1b
and eax, 0x1f61
or eax, 0x15934
add eax, 0x61dd
pop eax
push edi
push eax
add esp, 4
sub edi, 0x14399
and edi, 0xc459
or edi, 0xb79f
pop edi
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x431bc7
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
sub ecx, edx
invalid
Function at 0x431ed9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and eax, 0x5e1f
xor eax, 0x923a
call 0x431ed9
add byte [ebx + 0x49], al
inc ebx
xor eax, 0x83354948
les eax, [eax + ebx*2]
push esi
and esi, 0xa477
pop esi
push ecx
xor ecx, 0x37d9
pop ecx
cmp dword [ebp - 0xc58], 0
jne 0x431f05
mov dword [ebp - 0x710], 0
jmp 0x432150
mov edx, dword [ebp - 0xc58]
mov dword [ebp - 0x4e8], edx
push ecx
push ecx
add esp, 4
add ecx, 0x4fc0
or ecx, 0x11d17
sub ecx, 0x6db3
call 0x431f37
add byte [edx], dh
inc ecx
dec edx
dec ebx
inc ecx
aaa
xor al, 0x42
dec ebp
add esp, 4
pop ecx
push edi
or edi, 0x10ec2
pop edi
lea eax, [ebp - 0x16e8]
mov dword [ebp - 0xc54], eax
mov ecx, dword [ebp - 0x4e8]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc50], edx
xor eax, eax
mov word [ebp - 0x208], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
push eax
push edi
add esp, 4
xor eax, 0x937c
jmp 0x431f7e
pop eax
push ebx
add ebx, 0x4976
xor ebx, 0x7fb3
sub ebx, 0x5a0b
add byte [eax], al
pop ebx
push esi
push ecx
add esp, 4
add esi, 0xcf14
pop esi
mov edx, dword [ebp - 0xc50]
mov ax, word [edx]
mov word [ebp - 0xf8e], ax
mov ecx, dword [ebp - 0xc50]
add ecx, 2
mov dword [ebp - 0xc50], ecx
mov dx, word [ebp - 0xf8e]
mov word [ebp - 0x208], dx
mov eax, dword [ebp - 0xc54]
mov cx, word [eax]
mov word [ebp - 0xf90], cx
mov edx, dword [ebp - 0xc54]
add edx, 2
mov dword [ebp - 0xc54], edx
mov ax, word [ebp - 0xf90]
mov word [ebp - 0x3c], ax
push edi
push edi
add esp, 4
and edi, 0x14347
pop edi
push eax
or eax, 0x5be7
and eax, 0x185c2
pop eax
push ebx
push edi
add esp, 4
sub ebx, 0x13f3e
or ebx, 0x1d6
and ebx, 0x3f66
pop ebx
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x432045
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x1560], edx
jmp 0x43209f
movzx ecx, word [ebp - 0x208]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x431f6d
movzx eax, word [ebp - 0x208]
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x431f6d
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x432089
mov dword [ebp - 0x151c], 0xffffffff
jmp 0x432093
mov dword [ebp - 0x151c], 1
mov ecx, dword [ebp - 0x151c]
mov dword [ebp - 0x1560], ecx
cmp dword [ebp - 0x1560], 0
jne 0x4320e8
push edx
or edx, 0xd00b
call 0x4320bf
add byte [eax], bh
push eax
inc ebx
aaa
xor al, 0x3a
dec ebx
xor cl, byte [edx + 0x3f]
add esp, 4
add edx, 0x1846b
jmp 0x4320cd
pop edx
push ebx
push ecx
add esp, 4
xor ebx, 0x9907
pop ebx
mov edx, dword [ebp - 0x4e8]
push ecx
push esi
add esp, 4
jmp 0x4320f3
xor ecx, 0xf8eb
and ecx, 0x12363
pop ecx
push edx
sub edx, 0x173e1
sub edx, 0x9e2e
pop edx
push edi
push eax
add esp, 4
xor edi, 0x5640
pop edi
mov eax, dword [ebp - 0x4e8]
mov ecx, dword [eax]
mov dword [ebp - 0x4e8], ecx
mov edx, dword [ebp - 0x4e8]
cmp edx, dword [ebp - 0xc58]
je 0x432146
mov eax, dword [ebp - 0x4e8]
cmp dword [eax + 0x30], 0
jne 0x431f11
mov dword [ebp - 0x710], 0