joyce8/EMBER2024-capa huggingface dataset:
Function at 0x437a32
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ecx
push edx
add esp, 4
jmp 0x437925
jmp 0x43792c
add ecx, 0x9c5f
pop ecx
push ecx
push edi
add esp, 4
add ecx, 0x4669
sub ecx, 0xeb73
add ecx, 0x560e
pop ecx
lea edx, [ebp - 0x16cc]
mov dword [ebp - 0xc28], edx
mov eax, dword [ebp - 0x4d8]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc24], ecx
xor edx, edx
mov word [ebp - 0x1fc], dx
xor eax, eax
mov word [ebp - 0x104], ax
push ecx
push edx
add esp, 4
sub ecx, 0x13b08
sub ecx, 0xb84b
pop ecx
push esi
call fcn.0043799a
add byte [edi + 0x4c494737], bh
inc ebx
dec ebx
aas
add esp, 4
xor esi, 0xb90a
add esi, 0x9f24
pop esi
mov ecx, dword [ebp - 0xc24]
mov dx, word [ecx]
mov word [ebp - 0xf82], dx
mov eax, dword [ebp - 0xc24]
add eax, 2
mov dword [ebp - 0xc24], eax
mov cx, word [ebp - 0xf82]
mov word [ebp - 0x1fc], cx
mov edx, dword [ebp - 0xc28]
mov ax, word [edx]
mov word [ebp - 0xf84], ax
mov ecx, dword [ebp - 0xc28]
add ecx, 2
mov dword [ebp - 0xc28], ecx
mov dx, word [ebp - 0xf84]
mov word [ebp - 0x104], dx
push ebx
xor ebx, 0x523a
add ebx, 0x44c7
add ebx, 0x3e9e
sub ebx, 0x15d9b
pop ebx
push esi
xor esi, 0x4dfc
call 0x437a32
add byte [ebx], bh
cmp byte [esi + eax*2 + 0x4b], cl
xor al, 0x83
les eax, [esi + ebx*2]
movzx eax, word [ebp - 0x104]
test eax, eax
jne 0x437a59
movzx ecx, word [ebp - 0x1fc]
movzx edx, word [ebp - 0x104]
sub ecx, edx
mov dword [ebp - 0x14e4], ecx
jmp 0x437abc
movzx eax, word [ebp - 0x1fc]
movzx ecx, word [ebp - 0x104]
cmp eax, ecx
je 0x437978
movzx edx, word [ebp - 0x1fc]
xor edx, 0x20
movzx eax, word [ebp - 0x104]
cmp edx, eax
je 0x437978
movzx ecx, word [ebp - 0x1fc]
movzx edx, word [ebp - 0x104]
cmp ecx, edx
jge 0x437aa6
mov dword [ebp - 0x14e0], 0xffffffff
jmp 0x437ab0
mov dword [ebp - 0x14e0], 1
mov eax, dword [ebp - 0x14e0]
mov dword [ebp - 0x14e4], eax
cmp dword [ebp - 0x14e4], 0
jne 0x437b05
push edi
push eax
add esp, 4
and edi, 0xf6bd
pop edi
push esi
xor esi, 0x1716e
or esi, 0x1c3
pop esi
push edx
push edx
add esp, 4
call 0x437af3
add byte [ecx], bh
dec edi
inc ebx
cmp dword [0x833d3e48], edi
les eax, [edx + ebx*2]
mov ecx, dword [ebp - 0x4d8]
mov dword [ebp - 0x6ec], ecx
jmp 0x437b6d
push ecx
push edi
add esp, 4
xor ecx, 0x5e6a
sub ecx, 0x776c
or ecx, 0x152a0
and ecx, 0x13401
pop ecx
push edx
jmp 0x437b2a
sub edx, 0x7916
and edx, 0x5b40
pop edx
mov edx, dword [ebp - 0x4d8]
mov eax, dword [edx]
mov dword [ebp - 0x4d8], eax
mov ecx, dword [ebp - 0x4d8]
cmp ecx, dword [ebp - 0xc2c]
je 0x437b63
mov edx, dword [ebp - 0x4d8]
cmp dword [edx + 0x30], 0
jne 0x437919
mov dword [ebp - 0x6ec], 0
push edx
or edx, 0x5887
pop edx
push ebx
push eax
add esp, 4
call 0x437b88
add byte [edx], bh
inc eax
push eax
dec edx
xor ecx, dword [ebp + 0x3d]
cmp eax, 0x8104c483
retf
Function at 0x437af3
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ecx
push edx
add esp, 4
jmp 0x437925
jmp 0x43792c
add ecx, 0x9c5f
pop ecx
push ecx
push edi
add esp, 4
add ecx, 0x4669
sub ecx, 0xeb73
add ecx, 0x560e
pop ecx
lea edx, [ebp - 0x16cc]
mov dword [ebp - 0xc28], edx
mov eax, dword [ebp - 0x4d8]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc24], ecx
xor edx, edx
mov word [ebp - 0x1fc], dx
xor eax, eax
mov word [ebp - 0x104], ax
push ecx
push edx
add esp, 4
sub ecx, 0x13b08
sub ecx, 0xb84b
pop ecx
push esi
call fcn.0043799a
add byte [edi + 0x4c494737], bh
inc ebx
dec ebx
aas
add esp, 4
xor esi, 0xb90a
add esi, 0x9f24
pop esi
mov ecx, dword [ebp - 0xc24]
mov dx, word [ecx]
mov word [ebp - 0xf82], dx
mov eax, dword [ebp - 0xc24]
add eax, 2
mov dword [ebp - 0xc24], eax
mov cx, word [ebp - 0xf82]
mov word [ebp - 0x1fc], cx
mov edx, dword [ebp - 0xc28]
mov ax, word [edx]
mov word [ebp - 0xf84], ax
mov ecx, dword [ebp - 0xc28]
add ecx, 2
mov dword [ebp - 0xc28], ecx
mov dx, word [ebp - 0xf84]
mov word [ebp - 0x104], dx
push ebx
xor ebx, 0x523a
add ebx, 0x44c7
add ebx, 0x3e9e
sub ebx, 0x15d9b
pop ebx
push esi
xor esi, 0x4dfc
call 0x437a32
add byte [ebx], bh
cmp byte [esi + eax*2 + 0x4b], cl
xor al, 0x83
les eax, [esi + ebx*2]
movzx eax, word [ebp - 0x104]
test eax, eax
jne 0x437a59
movzx ecx, word [ebp - 0x1fc]
movzx edx, word [ebp - 0x104]
sub ecx, edx
mov dword [ebp - 0x14e4], ecx
jmp 0x437abc
movzx eax, word [ebp - 0x1fc]
movzx ecx, word [ebp - 0x104]
cmp eax, ecx
je 0x437978
movzx edx, word [ebp - 0x1fc]
xor edx, 0x20
movzx eax, word [ebp - 0x104]
cmp edx, eax
je 0x437978
movzx ecx, word [ebp - 0x1fc]
movzx edx, word [ebp - 0x104]
cmp ecx, edx
jge 0x437aa6
mov dword [ebp - 0x14e0], 0xffffffff
jmp 0x437ab0
mov dword [ebp - 0x14e0], 1
mov eax, dword [ebp - 0x14e0]
mov dword [ebp - 0x14e4], eax
cmp dword [ebp - 0x14e4], 0
jne 0x437b05
push edi
push eax
add esp, 4
and edi, 0xf6bd
pop edi
push esi
xor esi, 0x1716e
or esi, 0x1c3
pop esi
push edx
push edx
add esp, 4
call 0x437af3
add byte [ecx], bh
dec edi
inc ebx
cmp dword [0x833d3e48], edi
les eax, [edx + ebx*2]
mov ecx, dword [ebp - 0x4d8]
mov dword [ebp - 0x6ec], ecx
jmp 0x437b6d
push ecx
push edi
add esp, 4
xor ecx, 0x5e6a
sub ecx, 0x776c
or ecx, 0x152a0
and ecx, 0x13401
pop ecx
push edx
jmp 0x437b2a
sub edx, 0x7916
and edx, 0x5b40
pop edx
mov edx, dword [ebp - 0x4d8]
mov eax, dword [edx]
mov dword [ebp - 0x4d8], eax
mov ecx, dword [ebp - 0x4d8]
cmp ecx, dword [ebp - 0xc2c]
je 0x437b63
mov edx, dword [ebp - 0x4d8]
cmp dword [edx + 0x30], 0
jne 0x437919
mov dword [ebp - 0x6ec], 0
push edx
or edx, 0x5887
pop edx
push ebx
push eax
add esp, 4
call 0x437b88
add byte [edx], bh
inc eax
push eax
dec edx
xor ecx, dword [ebp + 0x3d]
cmp eax, 0x8104c483
retf
Function at 0x437b88
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ecx
push edx
add esp, 4
jmp 0x437925
jmp 0x43792c
add ecx, 0x9c5f
pop ecx
push ecx
push edi
add esp, 4
add ecx, 0x4669
sub ecx, 0xeb73
add ecx, 0x560e
pop ecx
lea edx, [ebp - 0x16cc]
mov dword [ebp - 0xc28], edx
mov eax, dword [ebp - 0x4d8]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc24], ecx
xor edx, edx
mov word [ebp - 0x1fc], dx
xor eax, eax
mov word [ebp - 0x104], ax
push ecx
push edx
add esp, 4
sub ecx, 0x13b08
sub ecx, 0xb84b
pop ecx
push esi
call fcn.0043799a
add byte [edi + 0x4c494737], bh
inc ebx
dec ebx
aas
add esp, 4
xor esi, 0xb90a
add esi, 0x9f24
pop esi
mov ecx, dword [ebp - 0xc24]
mov dx, word [ecx]
mov word [ebp - 0xf82], dx
mov eax, dword [ebp - 0xc24]
add eax, 2
mov dword [ebp - 0xc24], eax
mov cx, word [ebp - 0xf82]
mov word [ebp - 0x1fc], cx
mov edx, dword [ebp - 0xc28]
mov ax, word [edx]
mov word [ebp - 0xf84], ax
mov ecx, dword [ebp - 0xc28]
add ecx, 2
mov dword [ebp - 0xc28], ecx
mov dx, word [ebp - 0xf84]
mov word [ebp - 0x104], dx
push ebx
xor ebx, 0x523a
add ebx, 0x44c7
add ebx, 0x3e9e
sub ebx, 0x15d9b
pop ebx
push esi
xor esi, 0x4dfc
call 0x437a32
add byte [ebx], bh
cmp byte [esi + eax*2 + 0x4b], cl
xor al, 0x83
les eax, [esi + ebx*2]
movzx eax, word [ebp - 0x104]
test eax, eax
jne 0x437a59
movzx ecx, word [ebp - 0x1fc]
movzx edx, word [ebp - 0x104]
sub ecx, edx
mov dword [ebp - 0x14e4], ecx
jmp 0x437abc
movzx eax, word [ebp - 0x1fc]
movzx ecx, word [ebp - 0x104]
cmp eax, ecx
je 0x437978
movzx edx, word [ebp - 0x1fc]
xor edx, 0x20
movzx eax, word [ebp - 0x104]
cmp edx, eax
je 0x437978
movzx ecx, word [ebp - 0x1fc]
movzx edx, word [ebp - 0x104]
cmp ecx, edx
jge 0x437aa6
mov dword [ebp - 0x14e0], 0xffffffff
jmp 0x437ab0
mov dword [ebp - 0x14e0], 1
mov eax, dword [ebp - 0x14e0]
mov dword [ebp - 0x14e4], eax
cmp dword [ebp - 0x14e4], 0
jne 0x437b05
push edi
push eax
add esp, 4
and edi, 0xf6bd
pop edi
push esi
xor esi, 0x1716e
or esi, 0x1c3
pop esi
push edx
push edx
add esp, 4
call 0x437af3
add byte [ecx], bh
dec edi
inc ebx
cmp dword [0x833d3e48], edi
les eax, [edx + ebx*2]
mov ecx, dword [ebp - 0x4d8]
mov dword [ebp - 0x6ec], ecx
jmp 0x437b6d
push ecx
push edi
add esp, 4
xor ecx, 0x5e6a
sub ecx, 0x776c
or ecx, 0x152a0
and ecx, 0x13401
pop ecx
push edx
jmp 0x437b2a
sub edx, 0x7916
and edx, 0x5b40
pop edx
mov edx, dword [ebp - 0x4d8]
mov eax, dword [edx]
mov dword [ebp - 0x4d8], eax
mov ecx, dword [ebp - 0x4d8]
cmp ecx, dword [ebp - 0xc2c]
je 0x437b63
mov edx, dword [ebp - 0x4d8]
cmp dword [edx + 0x30], 0
jne 0x437919
mov dword [ebp - 0x6ec], 0
push edx
or edx, 0x5887
pop edx
push ebx
push eax
add esp, 4
call 0x437b88
add byte [edx], bh
inc eax
push eax
dec edx
xor ecx, dword [ebp + 0x3d]
cmp eax, 0x8104c483
retf

Function at 0x437bb6
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x437bc7
add byte [ebp + 0x34], cl
dec esp
inc ecx
dec eax
inc edx
inc ebp
dec ecx
add esp, 4
jmp 0x437bd3
and ebx, 0x13b0
pop ebx
mov dword [ebp - 0x738], 0
jmp 0x438710
Function at 0x437bc7
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x437bc7
add byte [ebp + 0x34], cl
dec esp
inc ecx
dec eax
inc edx
inc ebp
dec ecx
add esp, 4
jmp 0x437bd3
and ebx, 0x13b0
pop ebx
mov dword [ebp - 0x738], 0
jmp 0x438710
Function at 0x4385a0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x704]
add edx, 1
mov dword [ebp - 0x704], edx
mov eax, dword [ebp - 0x700]
mov ecx, dword [ebp - 0x704]
cmp ecx, dword [eax + 0x18]
jae 0x4386f8
mov edx, dword [ebp - 0x704]
mov eax, dword [ebp - 0x18c0]
mov ecx, dword [ebp - 0x2fc]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x708], ecx
mov edx, dword [ebp - 0x704]
mov eax, dword [ebp - 0x18c4]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x18c8]
mov eax, dword [ebp - 0x2fc]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x18cc], eax
mov dword [ebp - 0x184], 0
jmp 0x43855c
mov ecx, dword [ebp - 0x184]
add ecx, 1
mov dword [ebp - 0x184], ecx
mov edx, dword [ebp - 0x708]
add edx, dword [ebp - 0x184]
movsx eax, byte [edx]
test eax, eax
je 0x43860e
mov ecx, dword [ebp - 0x184]
movsx edx, byte [ebp + ecx - 0x804]
test edx, edx
je 0x43860e
push esi
push edi
add esp, 4
and esi, 0x7043
call fcn.004385a0
add byte [eax + 0x3c], al
inc esp
dec esp
dec esi
dec ebp
add esp, 4
or esi, 0x8bed
pop esi
push ebx
xor ebx, 0x10028
jmp 0x4385ba
pop ebx
mov eax, dword [ebp - 0x708]
add eax, dword [ebp - 0x184]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x184]
movsx eax, byte [ebp + edx - 0x804]
cmp ecx, eax
je 0x438600
mov ecx, dword [ebp - 0x708]
add ecx, dword [ebp - 0x184]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x184]
movsx ecx, byte [ebp + eax - 0x804]
cmp edx, ecx
jne 0x438607
jmp 0x43854d
jmp 0x43860e
push edx
and edx, 0x16782
pop edx
push esi
push edi
add esp, 4
xor esi, 0xdcc9
jmp 0x43862a
pop esi
push eax
jmp 0x438634
or eax, 0x15e6b
jmp 0x43863f
pop eax
mov edx, dword [ebp - 0x708]
add edx, dword [ebp - 0x184]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x184]
movsx edx, byte [ebp + ecx - 0x804]
cmp eax, edx
jne 0x43866d
mov dword [ebp - 0xc40], 0
jmp 0x4386dc
push esi
sub esi, 0x170c4
and esi, 0x77b1
pop esi
push esi
push ebx
add esp, 4
sub esi, 0x9cde
xor esi, 0x20a4
call 0x43869b
add byte [ecx + 0x50], cl
inc edi
dec ebx
aas
dec ebx
dec esi
cmp al, 0x4d
add esp, 4
pop esi
mov eax, dword [ebp - 0x708]
add eax, dword [ebp - 0x184]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x184]
movsx eax, byte [ebp + edx - 0x804]
or eax, 0x20
cmp ecx, eax
jge 0x4386d2
mov dword [ebp - 0xc40], 0xffffffff
jmp 0x4386dc
mov dword [ebp - 0xc40], 1
cmp dword [ebp - 0xc40], 0
jne 0x4386f3
mov ecx, dword [ebp - 0x18cc]
mov dword [ebp - 0x4e0], ecx
jmp 0x438704
jmp 0x4384dd
mov edx, dword [ebp - 0x70c]
mov dword [ebp - 0x4e0], edx
mov eax, dword [ebp - 0x4e0]
mov dword [ebp - 0x738], eax
Function at 0x43869b
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x704]
add edx, 1
mov dword [ebp - 0x704], edx
mov eax, dword [ebp - 0x700]
mov ecx, dword [ebp - 0x704]
cmp ecx, dword [eax + 0x18]
jae 0x4386f8
mov edx, dword [ebp - 0x704]
mov eax, dword [ebp - 0x18c0]
mov ecx, dword [ebp - 0x2fc]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x708], ecx
mov edx, dword [ebp - 0x704]
mov eax, dword [ebp - 0x18c4]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x18c8]
mov eax, dword [ebp - 0x2fc]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x18cc], eax
mov dword [ebp - 0x184], 0
jmp 0x43855c
mov ecx, dword [ebp - 0x184]
add ecx, 1
mov dword [ebp - 0x184], ecx
mov edx, dword [ebp - 0x708]
add edx, dword [ebp - 0x184]
movsx eax, byte [edx]
test eax, eax
je 0x43860e
mov ecx, dword [ebp - 0x184]
movsx edx, byte [ebp + ecx - 0x804]
test edx, edx
je 0x43860e
push esi
push edi
add esp, 4
and esi, 0x7043
call fcn.004385a0
add byte [eax + 0x3c], al
inc esp
dec esp
dec esi
dec ebp
add esp, 4
or esi, 0x8bed
pop esi
push ebx
xor ebx, 0x10028
jmp 0x4385ba
pop ebx
mov eax, dword [ebp - 0x708]
add eax, dword [ebp - 0x184]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x184]
movsx eax, byte [ebp + edx - 0x804]
cmp ecx, eax
je 0x438600
mov ecx, dword [ebp - 0x708]
add ecx, dword [ebp - 0x184]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x184]
movsx ecx, byte [ebp + eax - 0x804]
cmp edx, ecx
jne 0x438607
jmp 0x43854d
jmp 0x43860e
push edx
and edx, 0x16782
pop edx
push esi
push edi
add esp, 4
xor esi, 0xdcc9
jmp 0x43862a
pop esi
push eax
jmp 0x438634
or eax, 0x15e6b
jmp 0x43863f
pop eax
mov edx, dword [ebp - 0x708]
add edx, dword [ebp - 0x184]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x184]
movsx edx, byte [ebp + ecx - 0x804]
cmp eax, edx
jne 0x43866d
mov dword [ebp - 0xc40], 0
jmp 0x4386dc
push esi
sub esi, 0x170c4
and esi, 0x77b1
pop esi
push esi
push ebx
add esp, 4
sub esi, 0x9cde
xor esi, 0x20a4
call 0x43869b
add byte [ecx + 0x50], cl
inc edi
dec ebx
aas
dec ebx
dec esi
cmp al, 0x4d
add esp, 4
pop esi
mov eax, dword [ebp - 0x708]
add eax, dword [ebp - 0x184]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x184]
movsx eax, byte [ebp + edx - 0x804]
or eax, 0x20
cmp ecx, eax
jge 0x4386d2
mov dword [ebp - 0xc40], 0xffffffff
jmp 0x4386dc
mov dword [ebp - 0xc40], 1
cmp dword [ebp - 0xc40], 0
jne 0x4386f3
mov ecx, dword [ebp - 0x18cc]
mov dword [ebp - 0x4e0], ecx
jmp 0x438704
jmp 0x4384dd
mov edx, dword [ebp - 0x70c]
mov dword [ebp - 0x4e0], edx
mov eax, dword [ebp - 0x4e0]
mov dword [ebp - 0x738], eax
Function at 0x438afb
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edi
push eax
add esp, 4
and edi, 0x87af
sub edi, 0xffe9
sub edi, 0x5dad
pop edi
push esi
add esi, 0x5fbc
xor esi, 0xcde2
or esi, 0x39d1
xor esi, 0xfe36
pop esi
lea edx, [ebp - 0x1628]
mov dword [ebp - 0xc48], edx
mov eax, dword [ebp - 0x4e4]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc44], ecx
xor edx, edx
mov word [ebp - 0x204], dx
xor eax, eax
mov word [ebp - 0x38], ax
push ecx
push ebx
add esp, 4
and ecx, 0xb6c
or ecx, 0x1d36
sub ecx, 0x464f
or ecx, 0x14399
pop ecx
push ecx
push eax
add esp, 4
xor ecx, 0xcef3
pop ecx
push edi
add edi, 0x12572
pop edi
mov ecx, dword [ebp - 0xc44]
mov dx, word [ecx]
mov word [ebp - 0xf8a], dx
mov eax, dword [ebp - 0xc44]
add eax, 2
mov dword [ebp - 0xc44], eax
mov cx, word [ebp - 0xf8a]
mov word [ebp - 0x204], cx
mov edx, dword [ebp - 0xc48]
mov ax, word [edx]
mov word [ebp - 0xf8c], ax
mov ecx, dword [ebp - 0xc48]
add ecx, 2
mov dword [ebp - 0xc48], ecx
mov dx, word [ebp - 0xf8c]
mov word [ebp - 0x38], dx
push esi
or esi, 0x8a83
jmp 0x438add
pop esi
push esi
xor esi, 0x101
sub esi, 0x423a
call fcn.00438afb
add byte [edx + edi + 0x39], cl
inc edi
aas
dec ebx
cmp dword [ebx + 0x42], ecx
cmp dword [ebx + 0xf5e04c4], eax
add esp, 4
pop esi
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x438b1c
invalid
mov bh, 0x8d
cld
std
invalid
add esp, 4
pop esi
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x438b1c
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x1514], ecx
jmp 0x438b76
movzx eax, word [ebp - 0x204]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x438a44
movzx edx, word [ebp - 0x204]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x438a44
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x438b60
mov dword [ebp - 0x1510], 0xffffffff
jmp 0x438b6a
mov dword [ebp - 0x1510], 1
mov eax, dword [ebp - 0x1510]
mov dword [ebp - 0x1514], eax
cmp dword [ebp - 0x1514], 0
jne 0x438bbf
push ebx
push edx
add esp, 4
xor ebx, 0xd520
or ebx, 0x62dc
pop ebx
push edx
jmp 0x438b9b
pop edx
push ecx
jmp 0x438ba4
xor ecx, 0x804c
sub ecx, 0x13871
pop ecx
mov ecx, dword [ebp - 0x4e4]
mov dword [ebp - 0x2a8], ecx
jmp 0x438c27
push esi
add esi, 0x13d8a
pop esi
push eax
jmp 0x438bd1
or eax, 0x10d2f
call 0x438be5
add byte [ecx + eax*2 + 0x36], cl
cmp ecx, dword [eax + 0x4d]
inc esi
xor eax, 0x5804c483
push ebx
add ebx, 0x8191
pop ebx
mov edx, dword [ebp - 0x4e4]
mov eax, dword [edx]
mov dword [ebp - 0x4e4], eax
mov ecx, dword [ebp - 0x4e4]
cmp ecx, dword [ebp - 0xc4c]
je 0x438c1d
mov edx, dword [ebp - 0x4e4]
cmp dword [edx + 0x30], 0
jne 0x4389e8
mov dword [ebp - 0x2a8], 0
Function at 0x438be5
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edi
push eax
add esp, 4
and edi, 0x87af
sub edi, 0xffe9
sub edi, 0x5dad
pop edi
push esi
add esi, 0x5fbc
xor esi, 0xcde2
or esi, 0x39d1
xor esi, 0xfe36
pop esi
lea edx, [ebp - 0x1628]
mov dword [ebp - 0xc48], edx
mov eax, dword [ebp - 0x4e4]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc44], ecx
xor edx, edx
mov word [ebp - 0x204], dx
xor eax, eax
mov word [ebp - 0x38], ax
push ecx
push ebx
add esp, 4
and ecx, 0xb6c
or ecx, 0x1d36
sub ecx, 0x464f
or ecx, 0x14399
pop ecx
push ecx
push eax
add esp, 4
xor ecx, 0xcef3
pop ecx
push edi
add edi, 0x12572
pop edi
mov ecx, dword [ebp - 0xc44]
mov dx, word [ecx]
mov word [ebp - 0xf8a], dx
mov eax, dword [ebp - 0xc44]
add eax, 2
mov dword [ebp - 0xc44], eax
mov cx, word [ebp - 0xf8a]
mov word [ebp - 0x204], cx
mov edx, dword [ebp - 0xc48]
mov ax, word [edx]
mov word [ebp - 0xf8c], ax
mov ecx, dword [ebp - 0xc48]
add ecx, 2
mov dword [ebp - 0xc48], ecx
mov dx, word [ebp - 0xf8c]
mov word [ebp - 0x38], dx
push esi
or esi, 0x8a83
jmp 0x438add
pop esi
push esi
xor esi, 0x101
sub esi, 0x423a
call fcn.00438afb
add byte [edx + edi + 0x39], cl
inc edi
aas
dec ebx
cmp dword [ebx + 0x42], ecx
cmp dword [ebx + 0xf5e04c4], eax
add esp, 4
pop esi
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x438b1c
invalid
mov bh, 0x8d
cld
std
invalid
add esp, 4
pop esi
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x438b1c
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x1514], ecx
jmp 0x438b76
movzx eax, word [ebp - 0x204]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x438a44
movzx edx, word [ebp - 0x204]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x438a44
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x438b60
mov dword [ebp - 0x1510], 0xffffffff
jmp 0x438b6a
mov dword [ebp - 0x1510], 1
mov eax, dword [ebp - 0x1510]
mov dword [ebp - 0x1514], eax
cmp dword [ebp - 0x1514], 0
jne 0x438bbf
push ebx
push edx
add esp, 4
xor ebx, 0xd520
or ebx, 0x62dc
pop ebx
push edx
jmp 0x438b9b
pop edx
push ecx
jmp 0x438ba4
xor ecx, 0x804c
sub ecx, 0x13871
pop ecx
mov ecx, dword [ebp - 0x4e4]
mov dword [ebp - 0x2a8], ecx
jmp 0x438c27
push esi
add esi, 0x13d8a
pop esi
push eax
jmp 0x438bd1
or eax, 0x10d2f
call 0x438be5
add byte [ecx + eax*2 + 0x36], cl
cmp ecx, dword [eax + 0x4d]
inc esi
xor eax, 0x5804c483
push ebx
add ebx, 0x8191
pop ebx
mov edx, dword [ebp - 0x4e4]
mov eax, dword [edx]
mov dword [ebp - 0x4e4], eax
mov ecx, dword [ebp - 0x4e4]
cmp ecx, dword [ebp - 0xc4c]
je 0x438c1d
mov edx, dword [ebp - 0x4e4]
cmp dword [edx + 0x30], 0
jne 0x4389e8
mov dword [ebp - 0x2a8], 0
Function at 0x438ddc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
add edi, 0x5a1f
pop edi
cmp dword [ebp - 0x1518], 0
jne 0x438dfe
mov dword [ebp - 0x710], 0
jmp 0x4390a5
mov edx, dword [ebp - 0x1518]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc58], ecx
push edx
push edi
add esp, 4
add edx, 0x5751
add edx, 0x6b2f
or edx, 0x170f
xor edx, 0x104b2
pop edx
push edi
push eax
add esp, 4
sub edi, 0xd746
pop edi
push esi
and esi, 0x6c27
pop esi
cmp dword [ebp - 0xc58], 0
jne 0x438e5a
mov dword [ebp - 0x710], 0
jmp 0x4390a5
mov edx, dword [ebp - 0xc58]
mov dword [ebp - 0x4e8], edx
Function at 0x4549e0
Capabilities:
Get disk information
Get volume information via ioctl

Disassembly:
sub esp, 0x40
mov eax, dword [0x496028]
xor eax, esp
mov dword [esp + 0x38], eax
cmp dword [esi + 0x14], 0
push edi
jne 0x454b1c
mov ecx, dword [0x47d684]
mov eax, dword [0x47d680]
mov dx, word [esi + 0x10]
push 0xc
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
xor eax, eax
lea ecx, [esp + 0x28]
push ecx
push eax
push eax
push eax
push eax
mov word [esp + 0x24], dx
push eax
lea edx, [esp + 0x28]
push edx
mov word [esp + 0x44], ax
mov dword [esp + 0x46], eax
mov dword [esp + 0x4a], eax
mov dword [esp + 0x4e], eax
mov dword [esp + 0x52], eax
mov dword [esp + 0x56], eax
mov word [esp + 0x5a], ax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x454b15
lea eax, [esp + 0x24]
push str.NTFS
push eax
call dword [0x47c42c]
add esp, 8
test eax, eax
jne 0x454b15
push 0
push 0
push 3
mov dword [esi + 0x14], 2
mov eax, dword [0x4851a8]
mov ecx, dword [str..C:]
mov edx, dword [0x4851a4]
push 0
push 3
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], ecx
mov cx, word [0x4851ac]
mov dword [esp + 0x2c], edx
mov dx, word [esi + 0x10]
push SysReAllocString
lea eax, [esp + 0x2c]
push eax
mov word [esp + 0x3c], cx
mov word [esp + 0x38], dx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x454b1c
push 0
lea ecx, [esp + 0xc]
push ecx
push 0x60
lea edx, [esi + 0x18]
push edx
push 0
push 0
push 0x90064
push edi
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x454af9
mov dword [esi + 0x14], 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop edi
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.004734e6
add esp, 0x40
ret
mov dword [esi + 0x14], 1
mov ecx, dword [esp + 0x3c]
pop edi
xor ecx, esp
mov eax, 1
call fcn.004734e6
add esp, 0x40
ret
Function at 0x455770
Capabilities:
Get disk information
Get disk size

Disassembly:
sub esp, 0x30
mov eax, dword [0x496028]
xor eax, esp
mov dword [esp + 0x28], eax
mov ecx, dword [0x47d684]
mov eax, dword [0x47d680]
push esi
push 0xc
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
xor eax, eax
lea ecx, [esp + 0x18]
push ecx
push eax
push eax
push eax
push eax
mov word [esp + 0x24], dx
push eax
lea edx, [esp + 0x28]
push edx
mov word [esp + 0x34], ax
mov dword [esp + 0x36], eax
mov dword [esp + 0x3a], eax
mov dword [esp + 0x3e], eax
mov dword [esp + 0x42], eax
mov dword [esp + 0x46], eax
mov word [esp + 0x4a], ax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x45589a
mov esi, dword [0x47c42c]
lea eax, [esp + 0x14]
push str.NTFS
push eax
call esi
add esp, 8
test eax, eax
jne 0x455804
mov eax, 3
pop esi
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.004734e6
add esp, 0x30
ret
lea ecx, [esp + 0x14]
push 0x4878d0
push ecx
call esi
add esp, 8
test eax, eax
je 0x45583d
lea edx, [esp + 0x14]
push str.FAT32
push edx
call esi
add esp, 8
test eax, eax
je 0x45583d
lea eax, [esp + 0x14]
push 0x4878e8
push eax
call esi
add esp, 8
test eax, eax
jne 0x45589a
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 0
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x45589a
mov eax, dword [esp + 8]
cmp eax, 0xfff5
jbe 0x45587f
mov eax, 2
pop esi
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.004734e6
add esp, 0x30
ret
mov ecx, 0xff5
cmp ecx, eax
sbb eax, eax
neg eax
pop esi
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.004734e6
add esp, 0x30
ret
mov ecx, dword [esp + 0x2c]
pop esi
xor ecx, esp
mov eax, 4
call fcn.004734e6
add esp, 0x30
ret