joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47c2c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x66000]
push edi
jmp 0x47c2da
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x47c2e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47c2d0
mov eax, 1
add ebx, ebx
jne 0x47c2f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x47c304
jne 0x47c323
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47c323
dec eax
add ebx, ebx
jne 0x47c310
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x47c2e8
add ebx, ebx
jne 0x47c31f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x47c375
xor ecx, ecx
sub eax, 3
jb 0x47c33b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x47c3aa
sar eax, 1
mov ebp, eax
jmp 0x47c346
add ebx, ebx
jne 0x47c346
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47c314
inc ecx
add ebx, ebx
jne 0x47c354
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47c314
add ebx, ebx
jne 0x47c361
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x47c356
jne 0x47c372
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x47c356
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x47c394
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x47c386
jmp 0x47c2d6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x47c394
add edi, ecx
jmp 0x47c2d6
pop esi
mov edi, esi
mov ecx, 0x2957
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x47c3b2
cmp byte [edi], 6
jne 0x47c3b2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x47c3b7
lea edi, [esi + 0x79000]
mov eax, dword [edi]
or eax, eax
je 0x47c42f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x7c000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x7c118]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x47c3e4
mov ecx, edi
jns 0x47c413
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x7c11c]
or eax, eax
je 0x47c429
mov dword [ebx], eax
add ebx, 4
jmp 0x47c401
call dword [esi + 0x7c12c]
mov ebp, dword [esi + 0x7c120]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x47c463
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x61639f
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp dword [ebp - 0xc08], 0
jle 0x6164a9
push ebx
call fcn.0061639f
add byte [0x3a403a3c], bh
xor al, 0x36
add esp, 4
pop ebx
push ecx
push eax
add esp, 4
add ecx, 0x184fe
sub ecx, 0x1002e
and ecx, 0xc2f3
pop ecx
push ecx
xor ecx, 0x8a7a
pop ecx
mov edx, dword [ebp - 0xa68]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0xa64]
movzx edx, byte [ecx]
cmp eax, edx
je 0x616445
push esi
push eax
add esp, 4
sub esi, 0xa884
sub esi, 0x1016c
add esi, 0x32cc
add esi, 0x13b09
pop esi
push esi
xor esi, 0xf44d
add byte [eax], al
push ecx
and ecx, 0x1891
and ecx, 0x15432
call 0x616462
add byte [edi], dh
xor eax, dword ds:[ecx + 0x3a]
inc eax
cmp dword [edx], esi
dec esp
add esp, 4
jmp 0x61646a
pop ecx
push ecx
push ebx
add esp, 4
sub ecx, 0x13534
pop ecx
mov edx, dword [ebp - 0xc08]
sub edx, 1
mov dword [ebp - 0xc08], edx
mov eax, dword [ebp - 0xa68]
add eax, 1
mov dword [ebp - 0xa68], eax
mov ecx, dword [ebp - 0xa64]
add ecx, 1
mov dword [ebp - 0xa64], ecx
jmp 0x616384
Function at 0x616462
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp dword [ebp - 0xc08], 0
jle 0x6164a9
push ebx
call fcn.0061639f
add byte [0x3a403a3c], bh
xor al, 0x36
add esp, 4
pop ebx
push ecx
push eax
add esp, 4
add ecx, 0x184fe
sub ecx, 0x1002e
and ecx, 0xc2f3
pop ecx
push ecx
xor ecx, 0x8a7a
pop ecx
mov edx, dword [ebp - 0xa68]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0xa64]
movzx edx, byte [ecx]
cmp eax, edx
je 0x616445
push esi
push eax
add esp, 4
sub esi, 0xa884
sub esi, 0x1016c
add esi, 0x32cc
add esi, 0x13b09
pop esi
push esi
xor esi, 0xf44d
add byte [eax], al
push ecx
and ecx, 0x1891
and ecx, 0x15432
call 0x616462
add byte [edi], dh
xor eax, dword ds:[ecx + 0x3a]
inc eax
cmp dword [edx], esi
dec esp
add esp, 4
jmp 0x61646a
pop ecx
push ecx
push ebx
add esp, 4
sub ecx, 0x13534
pop ecx
mov edx, dword [ebp - 0xc08]
sub edx, 1
mov dword [ebp - 0xc08], edx
mov eax, dword [ebp - 0xa68]
add eax, 1
mov dword [ebp - 0xa68], eax
mov ecx, dword [ebp - 0xa64]
add ecx, 1
mov dword [ebp - 0xa64], ecx
jmp 0x616384
Function at 0x61669c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
inc edi
inc edx
cmp byte [ecx + 0x33], al
dec ebx
dec edi
cmp al, byte [ebx + 0x535804c4]
add esp, 4
pop eax
push ebx
push edi
add esp, 4
jmp 0x6166b7
pop ebx
jmp 0x6168eb
push ecx
or ecx, 0x9202
or ecx, 0x78ca
call 0x616905
add byte [esi], dh
xor eax, 0x503f3e3d
dec ebp
add esp, 4
pop ecx
push eax
and eax, 0x1b05
add eax, 0x17f33
sub eax, 0x2e8d
pop eax
mov dword [ebp - 0xa5c], 0
add byte [eax], al
invalid
push edx
and edx, 0xd01b
or edx, 0x9277
jmp 0x61693a
pop edx
push edx
push edx
add esp, 4
or edx, 0xb42f
pop edx
push ebx
push eax
add esp, 4
or ebx, 0x10477
and ebx, 0xd007
pop ebx
mov byte [ebp - 0x804], 0x45
mov byte [ebp - 0x803], 0x78
mov byte [ebp - 0x802], 0x69
mov byte [ebp - 0x801], 0x74
mov byte [ebp - 0x800], 0x50
mov byte [ebp - 0x7ff], 0x72
mov byte [ebp - 0x7fe], 0x6f
mov byte [ebp - 0x7fd], 0x63
mov byte [ebp - 0x7fc], 0x65
mov byte [ebp - 0x7fb], 0x73
mov byte [ebp - 0x7fa], 0x73
mov byte [ebp - 0x7f9], 0
push ecx
push ebx
add esp, 4
or ecx, 0x2258
sub ecx, 0x5fa3
sub ecx, 0xa953
pop ecx
push ecx
push eax
add esp, 4
xor ecx, 0x16f40
pop ecx
push esi
add esi, 0x2b67
and esi, 0x55ec
pop esi
mov ecx, 0x6b
mov word [ebp - 0x1628], cx
mov edx, 0x65
mov word [ebp - 0x1626], dx
mov eax, 0x72
mov word [ebp - 0x1624], ax
mov ecx, 0x6e
mov word [ebp - 0x1622], cx
mov edx, 0x65
mov word [ebp - 0x1620], dx
mov eax, 0x6c
mov word [ebp - 0x161e], ax
mov ecx, 0x33
mov word [ebp - 0x161c], cx
mov edx, 0x32
mov word [ebp - 0x161a], dx
mov eax, 0x2e
mov word [ebp - 0x1618], ax
mov ecx, 0x64
mov word [ebp - 0x1616], cx
mov edx, 0x6c
mov word [ebp - 0x1614], dx
mov eax, 0x6c
mov word [ebp - 0x1612], ax
xor ecx, ecx
mov word [ebp - 0x1610], cx
push eax
push edx
add esp, 4
and eax, 0x17c5a
and eax, 0xdb6b
call 0x616a97
add byte [edi], bh
cmp eax, 0x4b333a4a
cmp al, 0x3e
add esp, 4
jmp 0x616aa1
pop eax
push ebx
sub ebx, 0xf0ed
pop ebx
push edi
push esi
add esp, 4
sub edi, 0xbf23
jmp 0x616aba
and edi, 0x7934
pop edi
push eax
or eax, 0x16d51
call 0x616ad8
add byte [edx], dh
cmp eax, 0x4b32493c
inc eax
inc esp
dec ecx
inc edi
add esp, 4
pop eax
mov edx, dword fs:[0x18]
mov dword [ebp - 0x1890], edx
mov eax, dword [ebp - 0x1890]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x1894], ecx
mov edx, dword [ebp - 0x1894]
mov dword [ebp - 0x14d4], edx
push ebx
or ebx, 0x141b6
and ebx, 0xcd42
call 0x616b20
add byte [esi], bh
cmp eax, 0x363f4747
push eax
aaa
inc edi
add esp, 4
or ebx, 0x9470
pop ebx
push eax
push eax
add esp, 4
and eax, 0x117e0
pop eax
cmp dword [ebp - 0x14d4], 0
jne 0x616b4e
mov dword [ebp - 0x2e0], 0
jmp 0x616e0a
mov eax, dword [ebp - 0x14d4]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xc20], edx
push edi
push eax
add esp, 4
xor edi, 0xada3
or edi, 0xeda3
and edi, 0x139b
pop edi
push ebx
or ebx, 0x4816
and ebx, 0x468a
xor ebx, 0x695
and ebx, 0x163de
pop ebx
cmp dword [ebp - 0xc20], 0
jne 0x616baa
mov dword [ebp - 0x2e0], 0
jmp 0x616e0a
mov eax, dword [ebp - 0xc20]
mov dword [ebp - 0x4d4], eax
Function at 0x6166a5
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
inc edi
inc edx
cmp byte [ecx + 0x33], al
dec ebx
dec edi
cmp al, byte [ebx + 0x535804c4]
add esp, 4
pop eax
push ebx
push edi
add esp, 4
jmp 0x6166b7
pop ebx
jmp 0x6168eb
push ecx
or ecx, 0x9202
or ecx, 0x78ca
call 0x616905
add byte [esi], dh
xor eax, 0x503f3e3d
dec ebp
add esp, 4
pop ecx
push eax
and eax, 0x1b05
add eax, 0x17f33
sub eax, 0x2e8d
pop eax
mov dword [ebp - 0xa5c], 0
add byte [eax], al
invalid
push edx
and edx, 0xd01b
or edx, 0x9277
jmp 0x61693a
pop edx
push edx
push edx
add esp, 4
or edx, 0xb42f
pop edx
push ebx
push eax
add esp, 4
or ebx, 0x10477
and ebx, 0xd007
pop ebx
mov byte [ebp - 0x804], 0x45
mov byte [ebp - 0x803], 0x78
mov byte [ebp - 0x802], 0x69
mov byte [ebp - 0x801], 0x74
mov byte [ebp - 0x800], 0x50
mov byte [ebp - 0x7ff], 0x72
mov byte [ebp - 0x7fe], 0x6f
mov byte [ebp - 0x7fd], 0x63
mov byte [ebp - 0x7fc], 0x65
mov byte [ebp - 0x7fb], 0x73
mov byte [ebp - 0x7fa], 0x73
mov byte [ebp - 0x7f9], 0
push ecx
push ebx
add esp, 4
or ecx, 0x2258
sub ecx, 0x5fa3
sub ecx, 0xa953
pop ecx
push ecx
push eax
add esp, 4
xor ecx, 0x16f40
pop ecx
push esi
add esi, 0x2b67
and esi, 0x55ec
pop esi
mov ecx, 0x6b
mov word [ebp - 0x1628], cx
mov edx, 0x65
mov word [ebp - 0x1626], dx
mov eax, 0x72
mov word [ebp - 0x1624], ax
mov ecx, 0x6e
mov word [ebp - 0x1622], cx
mov edx, 0x65
mov word [ebp - 0x1620], dx
mov eax, 0x6c
mov word [ebp - 0x161e], ax
mov ecx, 0x33
mov word [ebp - 0x161c], cx
mov edx, 0x32
mov word [ebp - 0x161a], dx
mov eax, 0x2e
mov word [ebp - 0x1618], ax
mov ecx, 0x64
mov word [ebp - 0x1616], cx
mov edx, 0x6c
mov word [ebp - 0x1614], dx
mov eax, 0x6c
mov word [ebp - 0x1612], ax
xor ecx, ecx
mov word [ebp - 0x1610], cx
push eax
push edx
add esp, 4
and eax, 0x17c5a
and eax, 0xdb6b
call 0x616a97
add byte [edi], bh
cmp eax, 0x4b333a4a
cmp al, 0x3e
add esp, 4
jmp 0x616aa1
pop eax
push ebx
sub ebx, 0xf0ed
pop ebx
push edi
push esi
add esp, 4
sub edi, 0xbf23
jmp 0x616aba
and edi, 0x7934
pop edi
push eax
or eax, 0x16d51
call 0x616ad8
add byte [edx], dh
cmp eax, 0x4b32493c
inc eax
inc esp
dec ecx
inc edi
add esp, 4
pop eax
mov edx, dword fs:[0x18]
mov dword [ebp - 0x1890], edx
mov eax, dword [ebp - 0x1890]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x1894], ecx
mov edx, dword [ebp - 0x1894]
mov dword [ebp - 0x14d4], edx
push ebx
or ebx, 0x141b6
and ebx, 0xcd42
call 0x616b20
add byte [esi], bh
cmp eax, 0x363f4747
push eax
aaa
inc edi
add esp, 4
or ebx, 0x9470
pop ebx
push eax
push eax
add esp, 4
and eax, 0x117e0
pop eax
cmp dword [ebp - 0x14d4], 0
jne 0x616b4e
mov dword [ebp - 0x2e0], 0
jmp 0x616e0a
mov eax, dword [ebp - 0x14d4]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xc20], edx
push edi
push eax
add esp, 4
xor edi, 0xada3
or edi, 0xeda3
and edi, 0x139b
pop edi
push ebx
or ebx, 0x4816
and ebx, 0x468a
xor ebx, 0x695
and ebx, 0x163de
pop ebx
cmp dword [ebp - 0xc20], 0
jne 0x616baa
mov dword [ebp - 0x2e0], 0
jmp 0x616e0a
mov eax, dword [ebp - 0xc20]
mov dword [ebp - 0x4d4], eax
Function at 0x616905
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
inc edi
inc edx
cmp byte [ecx + 0x33], al
dec ebx
dec edi
cmp al, byte [ebx + 0x535804c4]
add esp, 4
pop eax
push ebx
push edi
add esp, 4
jmp 0x6166b7
pop ebx
jmp 0x6168eb
push ecx
or ecx, 0x9202
or ecx, 0x78ca
call 0x616905
add byte [esi], dh
xor eax, 0x503f3e3d
dec ebp
add esp, 4
pop ecx
push eax
and eax, 0x1b05
add eax, 0x17f33
sub eax, 0x2e8d
pop eax
mov dword [ebp - 0xa5c], 0
add byte [eax], al
invalid
push edx
and edx, 0xd01b
or edx, 0x9277
jmp 0x61693a
pop edx
push edx
push edx
add esp, 4
or edx, 0xb42f
pop edx
push ebx
push eax
add esp, 4
or ebx, 0x10477
and ebx, 0xd007
pop ebx
mov byte [ebp - 0x804], 0x45
mov byte [ebp - 0x803], 0x78
mov byte [ebp - 0x802], 0x69
mov byte [ebp - 0x801], 0x74
mov byte [ebp - 0x800], 0x50
mov byte [ebp - 0x7ff], 0x72
mov byte [ebp - 0x7fe], 0x6f
mov byte [ebp - 0x7fd], 0x63
mov byte [ebp - 0x7fc], 0x65
mov byte [ebp - 0x7fb], 0x73
mov byte [ebp - 0x7fa], 0x73
mov byte [ebp - 0x7f9], 0
push ecx
push ebx
add esp, 4
or ecx, 0x2258
sub ecx, 0x5fa3
sub ecx, 0xa953
pop ecx
push ecx
push eax
add esp, 4
xor ecx, 0x16f40
pop ecx
push esi
add esi, 0x2b67
and esi, 0x55ec
pop esi
mov ecx, 0x6b
mov word [ebp - 0x1628], cx
mov edx, 0x65
mov word [ebp - 0x1626], dx
mov eax, 0x72
mov word [ebp - 0x1624], ax
mov ecx, 0x6e
mov word [ebp - 0x1622], cx
mov edx, 0x65
mov word [ebp - 0x1620], dx
mov eax, 0x6c
mov word [ebp - 0x161e], ax
mov ecx, 0x33
mov word [ebp - 0x161c], cx
mov edx, 0x32
mov word [ebp - 0x161a], dx
mov eax, 0x2e
mov word [ebp - 0x1618], ax
mov ecx, 0x64
mov word [ebp - 0x1616], cx
mov edx, 0x6c
mov word [ebp - 0x1614], dx
mov eax, 0x6c
mov word [ebp - 0x1612], ax
xor ecx, ecx
mov word [ebp - 0x1610], cx
push eax
push edx
add esp, 4
and eax, 0x17c5a
and eax, 0xdb6b
call 0x616a97
add byte [edi], bh
cmp eax, 0x4b333a4a
cmp al, 0x3e
add esp, 4
jmp 0x616aa1
pop eax
push ebx
sub ebx, 0xf0ed
pop ebx
push edi
push esi
add esp, 4
sub edi, 0xbf23
jmp 0x616aba
and edi, 0x7934
pop edi
push eax
or eax, 0x16d51
call 0x616ad8
add byte [edx], dh
cmp eax, 0x4b32493c
inc eax
inc esp
dec ecx
inc edi
add esp, 4
pop eax
mov edx, dword fs:[0x18]
mov dword [ebp - 0x1890], edx
mov eax, dword [ebp - 0x1890]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x1894], ecx
mov edx, dword [ebp - 0x1894]
mov dword [ebp - 0x14d4], edx
push ebx
or ebx, 0x141b6
and ebx, 0xcd42
call 0x616b20
add byte [esi], bh
cmp eax, 0x363f4747
push eax
aaa
inc edi
add esp, 4
or ebx, 0x9470
pop ebx
push eax
push eax
add esp, 4
and eax, 0x117e0
pop eax
cmp dword [ebp - 0x14d4], 0
jne 0x616b4e
mov dword [ebp - 0x2e0], 0
jmp 0x616e0a
mov eax, dword [ebp - 0x14d4]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xc20], edx
push edi
push eax
add esp, 4
xor edi, 0xada3
or edi, 0xeda3
and edi, 0x139b
pop edi
push ebx
or ebx, 0x4816
and ebx, 0x468a
xor ebx, 0x695
and ebx, 0x163de
pop ebx
cmp dword [ebp - 0xc20], 0
jne 0x616baa
mov dword [ebp - 0x2e0], 0
jmp 0x616e0a
mov eax, dword [ebp - 0xc20]
mov dword [ebp - 0x4d4], eax
Function at 0x616924
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
inc edi
inc edx
cmp byte [ecx + 0x33], al
dec ebx
dec edi
cmp al, byte [ebx + 0x535804c4]
add esp, 4
pop eax
push ebx
push edi
add esp, 4
jmp 0x6166b7
pop ebx
jmp 0x6168eb
push ecx
or ecx, 0x9202
or ecx, 0x78ca
call 0x616905
add byte [esi], dh
xor eax, 0x503f3e3d
dec ebp
add esp, 4
pop ecx
push eax
and eax, 0x1b05
add eax, 0x17f33
sub eax, 0x2e8d
pop eax
mov dword [ebp - 0xa5c], 0
add byte [eax], al
invalid
push edx
and edx, 0xd01b
or edx, 0x9277
jmp 0x61693a
pop edx
push edx
push edx
add esp, 4
or edx, 0xb42f
pop edx
push ebx
push eax
add esp, 4
or ebx, 0x10477
and ebx, 0xd007
pop ebx
mov byte [ebp - 0x804], 0x45
mov byte [ebp - 0x803], 0x78
mov byte [ebp - 0x802], 0x69
mov byte [ebp - 0x801], 0x74
mov byte [ebp - 0x800], 0x50
mov byte [ebp - 0x7ff], 0x72
mov byte [ebp - 0x7fe], 0x6f
mov byte [ebp - 0x7fd], 0x63
mov byte [ebp - 0x7fc], 0x65
mov byte [ebp - 0x7fb], 0x73
mov byte [ebp - 0x7fa], 0x73
mov byte [ebp - 0x7f9], 0
push ecx
push ebx
add esp, 4
or ecx, 0x2258
sub ecx, 0x5fa3
sub ecx, 0xa953
pop ecx
push ecx
push eax
add esp, 4
xor ecx, 0x16f40
pop ecx
push esi
add esi, 0x2b67
and esi, 0x55ec
pop esi
mov ecx, 0x6b
mov word [ebp - 0x1628], cx
mov edx, 0x65
mov word [ebp - 0x1626], dx
mov eax, 0x72
mov word [ebp - 0x1624], ax
mov ecx, 0x6e
mov word [ebp - 0x1622], cx
mov edx, 0x65
mov word [ebp - 0x1620], dx
mov eax, 0x6c
mov word [ebp - 0x161e], ax
mov ecx, 0x33
mov word [ebp - 0x161c], cx
mov edx, 0x32
mov word [ebp - 0x161a], dx
mov eax, 0x2e
mov word [ebp - 0x1618], ax
mov ecx, 0x64
mov word [ebp - 0x1616], cx
mov edx, 0x6c
mov word [ebp - 0x1614], dx
mov eax, 0x6c
mov word [ebp - 0x1612], ax
xor ecx, ecx
mov word [ebp - 0x1610], cx
push eax
push edx
add esp, 4
and eax, 0x17c5a
and eax, 0xdb6b
call 0x616a97
add byte [edi], bh
cmp eax, 0x4b333a4a
cmp al, 0x3e
add esp, 4
jmp 0x616aa1
pop eax
push ebx
sub ebx, 0xf0ed
pop ebx
push edi
push esi
add esp, 4
sub edi, 0xbf23
jmp 0x616aba
and edi, 0x7934
pop edi
push eax
or eax, 0x16d51
call 0x616ad8
add byte [edx], dh
cmp eax, 0x4b32493c
inc eax
inc esp
dec ecx
inc edi
add esp, 4
pop eax
mov edx, dword fs:[0x18]
mov dword [ebp - 0x1890], edx
mov eax, dword [ebp - 0x1890]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x1894], ecx
mov edx, dword [ebp - 0x1894]
mov dword [ebp - 0x14d4], edx
push ebx
or ebx, 0x141b6
and ebx, 0xcd42
call 0x616b20
add byte [esi], bh
cmp eax, 0x363f4747
push eax
aaa
inc edi
add esp, 4
or ebx, 0x9470
pop ebx
push eax
push eax
add esp, 4
and eax, 0x117e0
pop eax
cmp dword [ebp - 0x14d4], 0
jne 0x616b4e
mov dword [ebp - 0x2e0], 0
jmp 0x616e0a
mov eax, dword [ebp - 0x14d4]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xc20], edx
push edi
push eax
add esp, 4
xor edi, 0xada3
or edi, 0xeda3
and edi, 0x139b
pop edi
push ebx
or ebx, 0x4816
and ebx, 0x468a
xor ebx, 0x695
and ebx, 0x163de
pop ebx
cmp dword [ebp - 0xc20], 0
jne 0x616baa
mov dword [ebp - 0x2e0], 0
jmp 0x616e0a
mov eax, dword [ebp - 0xc20]
mov dword [ebp - 0x4d4], eax
Function at 0x616a97
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
inc edi
inc edx
cmp byte [ecx + 0x33], al
dec ebx
dec edi
cmp al, byte [ebx + 0x535804c4]
add esp, 4
pop eax
push ebx
push edi
add esp, 4
jmp 0x6166b7
pop ebx
jmp 0x6168eb
push ecx
or ecx, 0x9202
or ecx, 0x78ca
call 0x616905
add byte [esi], dh
xor eax, 0x503f3e3d
dec ebp
add esp, 4
pop ecx
push eax
and eax, 0x1b05
add eax, 0x17f33
sub eax, 0x2e8d
pop eax
mov dword [ebp - 0xa5c], 0
add byte [eax], al
invalid
push edx
and edx, 0xd01b
or edx, 0x9277
jmp 0x61693a
pop edx
push edx
push edx
add esp, 4
or edx, 0xb42f
pop edx
push ebx
push eax
add esp, 4
or ebx, 0x10477
and ebx, 0xd007
pop ebx
mov byte [ebp - 0x804], 0x45
mov byte [ebp - 0x803], 0x78
mov byte [ebp - 0x802], 0x69
mov byte [ebp - 0x801], 0x74
mov byte [ebp - 0x800], 0x50
mov byte [ebp - 0x7ff], 0x72
mov byte [ebp - 0x7fe], 0x6f
mov byte [ebp - 0x7fd], 0x63
mov byte [ebp - 0x7fc], 0x65
mov byte [ebp - 0x7fb], 0x73
mov byte [ebp - 0x7fa], 0x73
mov byte [ebp - 0x7f9], 0
push ecx
push ebx
add esp, 4
or ecx, 0x2258
sub ecx, 0x5fa3
sub ecx, 0xa953
pop ecx
push ecx
push eax
add esp, 4
xor ecx, 0x16f40
pop ecx
push esi
add esi, 0x2b67
and esi, 0x55ec
pop esi
mov ecx, 0x6b
mov word [ebp - 0x1628], cx
mov edx, 0x65
mov word [ebp - 0x1626], dx
mov eax, 0x72
mov word [ebp - 0x1624], ax
mov ecx, 0x6e
mov word [ebp - 0x1622], cx
mov edx, 0x65
mov word [ebp - 0x1620], dx
mov eax, 0x6c
mov word [ebp - 0x161e], ax
mov ecx, 0x33
mov word [ebp - 0x161c], cx
mov edx, 0x32
mov word [ebp - 0x161a], dx
mov eax, 0x2e
mov word [ebp - 0x1618], ax
mov ecx, 0x64
mov word [ebp - 0x1616], cx
mov edx, 0x6c
mov word [ebp - 0x1614], dx
mov eax, 0x6c
mov word [ebp - 0x1612], ax
xor ecx, ecx
mov word [ebp - 0x1610], cx
push eax
push edx
add esp, 4
and eax, 0x17c5a
and eax, 0xdb6b
call 0x616a97
add byte [edi], bh
cmp eax, 0x4b333a4a
cmp al, 0x3e
add esp, 4
jmp 0x616aa1
pop eax
push ebx
sub ebx, 0xf0ed
pop ebx
push edi
push esi
add esp, 4
sub edi, 0xbf23
jmp 0x616aba
and edi, 0x7934
pop edi
push eax
or eax, 0x16d51
call 0x616ad8
add byte [edx], dh
cmp eax, 0x4b32493c
inc eax
inc esp
dec ecx
inc edi
add esp, 4
pop eax
mov edx, dword fs:[0x18]
mov dword [ebp - 0x1890], edx
mov eax, dword [ebp - 0x1890]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x1894], ecx
mov edx, dword [ebp - 0x1894]
mov dword [ebp - 0x14d4], edx
push ebx
or ebx, 0x141b6
and ebx, 0xcd42
call 0x616b20
add byte [esi], bh
cmp eax, 0x363f4747
push eax
aaa
inc edi
add esp, 4
or ebx, 0x9470
pop ebx
push eax
push eax
add esp, 4
and eax, 0x117e0
pop eax
cmp dword [ebp - 0x14d4], 0
jne 0x616b4e
mov dword [ebp - 0x2e0], 0
jmp 0x616e0a
mov eax, dword [ebp - 0x14d4]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xc20], edx
push edi
push eax
add esp, 4
xor edi, 0xada3
or edi, 0xeda3
and edi, 0x139b
pop edi
push ebx
or ebx, 0x4816
and ebx, 0x468a
xor ebx, 0x695
and ebx, 0x163de
pop ebx
cmp dword [ebp - 0xc20], 0
jne 0x616baa
mov dword [ebp - 0x2e0], 0
jmp 0x616e0a
mov eax, dword [ebp - 0xc20]
mov dword [ebp - 0x4d4], eax
Function at 0x616ad8
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
inc edi
inc edx
cmp byte [ecx + 0x33], al
dec ebx
dec edi
cmp al, byte [ebx + 0x535804c4]
add esp, 4
pop eax
push ebx
push edi
add esp, 4
jmp 0x6166b7
pop ebx
jmp 0x6168eb
push ecx
or ecx, 0x9202
or ecx, 0x78ca
call 0x616905
add byte [esi], dh
xor eax, 0x503f3e3d
dec ebp
add esp, 4
pop ecx
push eax
and eax, 0x1b05
add eax, 0x17f33
sub eax, 0x2e8d
pop eax
mov dword [ebp - 0xa5c], 0
add byte [eax], al
invalid
push edx
and edx, 0xd01b
or edx, 0x9277
jmp 0x61693a
pop edx
push edx
push edx
add esp, 4
or edx, 0xb42f
pop edx
push ebx
push eax
add esp, 4
or ebx, 0x10477
and ebx, 0xd007
pop ebx
mov byte [ebp - 0x804], 0x45
mov byte [ebp - 0x803], 0x78
mov byte [ebp - 0x802], 0x69
mov byte [ebp - 0x801], 0x74
mov byte [ebp - 0x800], 0x50
mov byte [ebp - 0x7ff], 0x72
mov byte [ebp - 0x7fe], 0x6f
mov byte [ebp - 0x7fd], 0x63
mov byte [ebp - 0x7fc], 0x65
mov byte [ebp - 0x7fb], 0x73
mov byte [ebp - 0x7fa], 0x73
mov byte [ebp - 0x7f9], 0
push ecx
push ebx
add esp, 4
or ecx, 0x2258
sub ecx, 0x5fa3
sub ecx, 0xa953
pop ecx
push ecx
push eax
add esp, 4
xor ecx, 0x16f40
pop ecx
push esi
add esi, 0x2b67
and esi, 0x55ec
pop esi
mov ecx, 0x6b
mov word [ebp - 0x1628], cx
mov edx, 0x65
mov word [ebp - 0x1626], dx
mov eax, 0x72
mov word [ebp - 0x1624], ax
mov ecx, 0x6e
mov word [ebp - 0x1622], cx
mov edx, 0x65
mov word [ebp - 0x1620], dx
mov eax, 0x6c
mov word [ebp - 0x161e], ax
mov ecx, 0x33
mov word [ebp - 0x161c], cx
mov edx, 0x32
mov word [ebp - 0x161a], dx
mov eax, 0x2e
mov word [ebp - 0x1618], ax
mov ecx, 0x64
mov word [ebp - 0x1616], cx
mov edx, 0x6c
mov word [ebp - 0x1614], dx
mov eax, 0x6c
mov word [ebp - 0x1612], ax
xor ecx, ecx
mov word [ebp - 0x1610], cx
push eax
push edx
add esp, 4
and eax, 0x17c5a
and eax, 0xdb6b
call 0x616a97
add byte [edi], bh
cmp eax, 0x4b333a4a
cmp al, 0x3e
add esp, 4
jmp 0x616aa1
pop eax
push ebx
sub ebx, 0xf0ed
pop ebx
push edi
push esi
add esp, 4
sub edi, 0xbf23
jmp 0x616aba
and edi, 0x7934
pop edi
push eax
or eax, 0x16d51
call 0x616ad8
add byte [edx], dh
cmp eax, 0x4b32493c
inc eax
inc esp
dec ecx
inc edi
add esp, 4
pop eax
mov edx, dword fs:[0x18]
mov dword [ebp - 0x1890], edx
mov eax, dword [ebp - 0x1890]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x1894], ecx
mov edx, dword [ebp - 0x1894]
mov dword [ebp - 0x14d4], edx
push ebx
or ebx, 0x141b6
and ebx, 0xcd42
call 0x616b20
add byte [esi], bh
cmp eax, 0x363f4747
push eax
aaa
inc edi
add esp, 4
or ebx, 0x9470
pop ebx
push eax
push eax
add esp, 4
and eax, 0x117e0
pop eax
cmp dword [ebp - 0x14d4], 0
jne 0x616b4e
mov dword [ebp - 0x2e0], 0
jmp 0x616e0a
mov eax, dword [ebp - 0x14d4]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xc20], edx
push edi
push eax
add esp, 4
xor edi, 0xada3
or edi, 0xeda3
and edi, 0x139b
pop edi
push ebx
or ebx, 0x4816
and ebx, 0x468a
xor ebx, 0x695
and ebx, 0x163de
pop ebx
cmp dword [ebp - 0xc20], 0
jne 0x616baa
mov dword [ebp - 0x2e0], 0
jmp 0x616e0a
mov eax, dword [ebp - 0xc20]
mov dword [ebp - 0x4d4], eax