joyce8/EMBER2024-capa huggingface dataset:
Function at 0x464130
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebp, ecx
mov dword [esp], edx
mov ebx, eax
xor edi, edi
cmp dword [ebx + 0x68], 0xffffffff
je 0x464177
call sub.kernel32.dll_GetTickCount
mov esi, eax
cmp dword [ebx + 0x80], 0
jne 0x464162
call sub.kernel32.dll_GetTickCount
sub eax, esi
cmp eax, 0x1388
jb 0x46414b
cmp byte [ebx + 0x70], 0
je 0x464177
mov edi, ebp
mov ecx, ebp
mov edx, dword [esp]
mov eax, dword [ebx + 0x68]
call fcn.004635a8
mov eax, edi
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x464384
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059ac
xor eax, eax
push ebp
push 0x464408
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004054fc
mov eax, dword [ebp - 4]
call fcn.004059bc
mov edi, eax
push edi
call sub.ws2_32.dll_inet_addr
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4643e9
push edi
call sub.ws2_32.dll_gethostbyname
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4643e9
mov eax, dword [ebp - 8]
cmp word [eax + 0xa], 0
jle 0x4643e9
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ebx, dword [eax]
mov edx, esi
mov eax, ebx
call fcn.0045f578
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46440f
lea eax, [ebp - 4]
call fcn.004054fc
ret

Function at 0x464860
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004059ac
mov eax, dword [ebp - 8]
call fcn.004059ac
xor eax, eax
push ebp
push 0x464912
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
jne 0x4648a2
mov eax, dword [ebp - 4]
call fcn.004059bc
push eax
push ebx
call sub.advapi32.dll_RegDeleteKeyA
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004059bc
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyA
test eax, eax
jne 0x4648f7
xor eax, eax
push ebp
push 0x4648f0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.004059bc
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegDeleteValueA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4648f7
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464919
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405520
ret
Function at 0x465278
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4652c7
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetTickCount
mov esi, eax
jmp 0x46529e
push 0xa
call sub.kernel32.dll_Sleep_2
cmp byte [ebx + 0x50], 0
je 0x4652b2
call sub.kernel32.dll_GetTickCount
sub eax, esi
cmp eax, 0x1388
jbe 0x465297
mov eax, ebx
call fcn.00465d58
mov byte [ebx + 0x50], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4652d1
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x466740
Capabilities:
Get number of processors
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x466748
push ecx
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x466896
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x2c], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x30], eax
lea edx, [ebp - 4]
lea eax, [esi + 0x18]
call fcn.0045f364
mov edx, dword [ebp - 4]
lea eax, [ebx + 0x34]
call fcn.00405c54
lea edx, [ebp - 8]
lea eax, [esi + 0x118]
call fcn.0045f364
mov edx, dword [ebp - 8]
lea eax, [ebx + 0x38]
call fcn.00405c54
lea edx, [ebp - 0xc]
lea eax, [esi + 0x198]
call fcn.0045f364
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0x3c]
call fcn.00405c54
lea edx, [ebp - 0x10]
lea eax, [esi + 0x218]
call fcn.0045f364
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x40]
call fcn.00405c54
lea edx, [ebp - 0x14]
lea eax, [esi + 0x298]
call fcn.0045f364
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x44]
call fcn.00405c54
lea edx, [ebp - 0x18]
lea eax, [esi + 0x318]
call fcn.0045f364
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x48]
call fcn.00405c54
mov eax, dword [esi + 0x398]
mov dword [ebx + 0x4c], eax
mov eax, dword [esi + 0x39c]
mov dword [ebx + 0x50], eax
mov eax, dword [esi + 0x3a0]
mov dword [ebx + 0x54], eax
mov eax, dword [esi + 0x3a8]
mov dword [ebx + 0x58], eax
mov eax, dword [esi + 0x3ac]
mov dword [ebx + 0x5c], eax
lea edx, [ebp - 0x1c]
lea eax, [esi + 0x3b0]
call fcn.0045f364
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x60]
call fcn.00405784
lea edx, [ebp - 0x20]
lea eax, [esi + 0x430]
call fcn.0045f364
mov edx, dword [ebp - 0x20]
lea eax, [ebx + 0x64]
call fcn.00405784
lea edx, [ebp - 0x24]
lea eax, [esi + 0x4b0]
call fcn.0045f364
mov edx, dword [ebp - 0x24]
lea eax, [ebx + 0x68]
call fcn.00405784
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46689d
lea eax, [ebp - 0x24]
mov edx, 9
call fcn.00405c30
ret
Function at 0x145bd60
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.sect_1
lea edi, [esi - 0xbdb000]
push edi
or ebp, 0xffffffff
jmp 0x145bd82
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x145bd89
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x145bd78
mov eax, 1
add ebx, ebx
jne 0x145bd9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x145bdac
jne 0x145bdcb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x145bdcb
dec eax
add ebx, ebx
jne 0x145bdb8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x145bd90
add ebx, ebx
jne 0x145bdc7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x145be1d
xor ecx, ecx
sub eax, 3
jb 0x145bde3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x145be52
sar eax, 1
mov ebp, eax
jmp 0x145bdee
add ebx, ebx
jne 0x145bdee
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x145bdbc
inc ecx
add ebx, ebx
jne 0x145bdfc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x145bdbc
add ebx, ebx
jne 0x145be09
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x145bdfe
jne 0x145be1a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x145bdfe
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x145be3c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x145be2e
jmp 0x145bd7e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x145be3c
add edi, ecx
jmp 0x145bd7e
pop esi
mov edi, esi
mov ecx, 0x8cdb87
mov al, 0xe8
repne scasb al, byte es:[edi]
jne 0x145be77
cmp byte [edi], 0x96
jne 0x145be5c
mov eax, dword [edi]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
stosd dword es:[edi], eax
jmp 0x145be5a
lea edi, [esi + 0xff5000]
mov eax, dword [edi]
or eax, eax
je 0x145bebf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1089780]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x108999c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x145be7d
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x10899a4]
or eax, eax
je 0x145beb9
mov dword [ebx], eax
add ebx, 4
jmp 0x145be9a
call dword [esi + 0x10899a0]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x145bef0
cmp al, 0xef
ja 0x145bee3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x145bec5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x145bed2
mov ebp, dword [esi + 0x10899a8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x145bf24
sub esp, 0xffffff80
jmp 0xd72ec0
Function at 0x4021d0
Capabilities:
Hide graphical window

Disassembly:
push esi
push edi
mov edi, ecx
cmp dword [edi + 0xcc], 0
je 0x402224
xor esi, esi
cmp dword [edi + 0xd8], esi
jbe 0x402216
push ebx
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
mov edi, edi
mov eax, dword [edi + 0xcc]
push 0
push dword [eax + esi*4]
call ebx
mov eax, dword [edi + 0xcc]
push dword [eax + esi*4]
call dword [sym.imp.USER32.dll_DestroyWindow]
inc esi
cmp esi, dword [edi + 0xd8]
jb 0x4021f0
pop ebx
push dword [edi + 0xcc]
call fcn.00404640
add esp, 4
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov ecx, dword [edi + 0x20]
mov eax, dword [ecx]
call dword [eax + 0x60]
mov eax, dword [edi + 0xd4]
mov ecx, dword [eax]
mov dword [eax], eax
mov eax, dword [edi + 0xd4]
mov dword [eax + 4], eax
mov dword [edi + 0xd8], 0
cmp ecx, dword [edi + 0xd4]
je 0x40226c
mov esi, dword [ecx]
push ecx
call fcn.00404640
add esp, 4
mov ecx, esi
cmp esi, dword [edi + 0xd4]
jne 0x402257
mov ecx, dword [edi + 0x20]
pop edi
pop esi
test ecx, ecx
je 0x40227c
mov eax, dword [ecx]
push 1
call dword [eax + 4]
mov eax, 1
ret

Function at 0x4044a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4044b5
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4044f4
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x4044f0
lea ebx, [ebx]
cmp esi, edx
jae 0x4044f4
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x4044e0
cmp esi, edx
jb 0x4044f9
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret

Function at 0x40967f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x4096c4
call fcn.00414cc9
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4096c4
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x4096e0
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00417a7b
mov ebx, eax
test edi, edi
je 0x4096de
test esi, esi
je 0x4096de
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41dbb7
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
call fcn.0040e179
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x41dbf3
call fcn.0041ddd6
mov dword [esi + 0xc], 1
jmp 0x41dbf8
call fcn.0041ddd6
cmp dword [esi], 0
je 0x41dc41
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, dword [ebp + 0x10]
test eax, eax
jle 0x41dc1b
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, esi
call fcn.0040526f
jmp 0x41dc2c
push 0xff
mov ecx, esi
call fcn.004041d0
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, esi
call fcn.00405292
jmp 0x41dc65
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x41dc65
push dword [esi]
push dword [ebp - 4]
call fcn.00416542
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x41dd2b
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.0041ddd6
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x41dd73
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0040526f
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.00405292
jmp 0x41dd7e
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.00416542
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x42344a
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
pop edx
push edx
or edx, 0x406e
xor edx, 0x18393
or edx, 0x639a
pop edx
push edi
push ecx
add esp, 4
add al, 0x81
imul ecx
dec ecx
add byte [eax], al
xor edi, 0xb1ce
xor edi, 0xe9d3
sub edi, 0x5f51
pop edi
imul eax, dword [ebp - 0x2c], 0x138
add eax, 0x44f3644b
imul ecx, dword [ebp - 0x2c], 0x138
sub eax, ecx
xor eax, dword [ebp - 0x1494]
imul eax, dword [ebp - 0x2c]
imul edx, dword [ebp - 0x2c], 0x138
sub eax, edx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x1494]
imul eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1d24], eax
mov dword [ebp - 0x1520], 1
push ebx
push eax
add esp, 4
sub ebx, 0xa56
add ebx, 0xda6f
pop ebx
push edx
push ecx
add esp, 4
and edx, 0x109e4
pop edx
push ebx
push eax
add esp, 4
sub ebx, 0xccd6
pop ebx
push eax
and eax, 0xb5b0
pop eax
imul ecx, dword [ebp - 0x1520], 0x138
add byte [ecx - 0xc9bb43f], al
inc esp
imul edx, dword [ebp - 0x1520], 0x138
sub ecx, edx
xor ecx, dword [ebp - 0x1d24]
imul ecx, dword [ebp - 0x1520]
imul eax, dword [ebp - 0x1520], 0x138
sub ecx, eax
mov dword [ebp - 0x1524], ecx

Function at 0x4234fd
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
pop edx
push edx
or edx, 0x406e
xor edx, 0x18393
or edx, 0x639a
pop edx
push edi
push ecx
add esp, 4
add al, 0x81
imul ecx
dec ecx
add byte [eax], al
xor edi, 0xb1ce
xor edi, 0xe9d3
sub edi, 0x5f51
pop edi
imul eax, dword [ebp - 0x2c], 0x138
add eax, 0x44f3644b
imul ecx, dword [ebp - 0x2c], 0x138
sub eax, ecx
xor eax, dword [ebp - 0x1494]
imul eax, dword [ebp - 0x2c]
imul edx, dword [ebp - 0x2c], 0x138
sub eax, edx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x1494]
imul eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1d24], eax
mov dword [ebp - 0x1520], 1
push ebx
push eax
add esp, 4
sub ebx, 0xa56
add ebx, 0xda6f
pop ebx
push edx
push ecx
add esp, 4
and edx, 0x109e4
pop edx
push ebx
push eax
add esp, 4
sub ebx, 0xccd6
pop ebx
push eax
and eax, 0xb5b0
pop eax
imul ecx, dword [ebp - 0x1520], 0x138
add byte [ecx - 0xc9bb43f], al
inc esp
imul edx, dword [ebp - 0x1520], 0x138
sub ecx, edx
xor ecx, dword [ebp - 0x1d24]
imul ecx, dword [ebp - 0x1520]
imul eax, dword [ebp - 0x1520], 0x138
sub ecx, eax
mov dword [ebp - 0x1524], ecx
Function at 0x427685
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
outsd dx, dword [esi]
mov byte [ebp - 0x81e], 0x61
mov byte [ebp - 0x81d], 0x64
mov byte [ebp - 0x81c], 0x4c
mov byte [ebp - 0x81b], 0x69
mov byte [ebp - 0x81a], 0x62
mov byte [ebp - 0x819], 0x72
mov byte [ebp - 0x818], 0x61
mov byte [ebp - 0x817], 0x72
jb 0x42764d
test edx, ebp
idiv edi
invalid
jns 0x427654
test ebx, ebp
idiv edi
call dword [edi - 0x3a]
test esp, ebp
idiv edi
inc dword [eax]
jb 0x42764d
test edx, ebp
idiv edi
invalid

Function at 0x427695
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
test esp, ebp
idiv edi
inc dword [eax]
mov eax, dword fs:[0x18]
mov dword [ebp - 0x1898], eax
mov ecx, dword [ebp - 0x1898]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x189c], edx
mov eax, dword [ebp - 0x189c]
mov dword [ebp - 0x14dc], eax
push ebx
xor ebx, 0x12b5c
xor ebx, 0x2e5a
sub ebx, 0x11987
and ebx, 0xc6c6
pop ebx
push edi
or edi, 0x11e50
pop edi
push esi
jmp 0x4276ed
add esi, 0x15488
pop esi
cmp dword [ebp - 0x14dc], 0
jne 0x42770c
mov dword [ebp - 0x6ec], 0
jmp 0x4279c8
mov ecx, dword [ebp - 0x14dc]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xc2c], eax
push ebx
push edx
add esp, 4
jmp 0x427729
pop ebx
push edi
jmp 0x427733
sub edi, 0xb23
call 0x427746
add byte [ecx*2 + 0x3c423232], bh
cmp al, byte [ebx - 0x87efb3c]
ficom word [edx + 1]
add byte [edi - 0x7d], bl
mov ebp, 0xfffff3d4
add byte [ebp + 0xf], dh
mov dword [ebp - 0x6ec], 0
jmp 0x4279c8
push ecx
add ecx, 0xdd88
sub ecx, 0xe694
pop ecx
push edi
call 0x4279e4
add byte [eax], bh
dec edx
dec edi
cmp dh, byte [esi]
dec esp
inc ebx
add esp, 4
or edi, 0x12ecb
add edi, 0xcde8
xor edi, 0xf472
pop edi
cmp dword [ebp - 0x6ec], 0
jne 0x427a44
push edi
add edi, 0x788b
pop edi
push edx
push eax
add esp, 4
and edx, 0x138f5
or edx, 0xcc21
pop edx
push esi
push edx
add esp, 4
xor esi, 0x3b7c
add esi, 0x6aad
or esi, 0x1a2e
pop esi
mov dword [ebp - 0x738], 0
jmp 0x42856b
push edx
sub edx, 0x3954
add edx, 0x43c2
add edx, 0x15965
pop edx
push edi
push esi
add esp, 4
xor edi, 0x243e
pop edi
push edi
push esi
add esp, 4
xor edi, 0x1134b
xor edi, 0x157e2
pop edi
mov eax, dword [ebp - 0x6ec]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x2f8], ecx
mov dword [ebp - 0x6fc], 0
mov edx, dword [ebp - 0x2f8]
mov dword [ebp - 0x14e8], edx
cmp dword [ebp - 0x14e8], 0
jne 0x427ab5
mov eax, dword [ebp - 0x6fc]
mov dword [ebp - 0x3c4], eax
jmp 0x427da6
mov ecx, dword [ebp - 0x14e8]
mov edx, dword [ebp - 0x2f8]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x14ec], edx
jne 0x427add
mov eax, dword [ebp - 0x6fc]
mov dword [ebp - 0x3c4], eax
jmp 0x427da6
mov ecx, 8
imul edx, ecx, 0
mov eax, dword [ebp - 0x14ec]
mov ecx, dword [eax + edx + 0x78]
mov dword [ebp - 0x14f0], ecx
Function at 0x427746
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
test esp, ebp
idiv edi
inc dword [eax]
mov eax, dword fs:[0x18]
mov dword [ebp - 0x1898], eax
mov ecx, dword [ebp - 0x1898]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x189c], edx
mov eax, dword [ebp - 0x189c]
mov dword [ebp - 0x14dc], eax
push ebx
xor ebx, 0x12b5c
xor ebx, 0x2e5a
sub ebx, 0x11987
and ebx, 0xc6c6
pop ebx
push edi
or edi, 0x11e50
pop edi
push esi
jmp 0x4276ed
add esi, 0x15488
pop esi
cmp dword [ebp - 0x14dc], 0
jne 0x42770c
mov dword [ebp - 0x6ec], 0
jmp 0x4279c8
mov ecx, dword [ebp - 0x14dc]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xc2c], eax
push ebx
push edx
add esp, 4
jmp 0x427729
pop ebx
push edi
jmp 0x427733
sub edi, 0xb23
call 0x427746
add byte [ecx*2 + 0x3c423232], bh
cmp al, byte [ebx - 0x87efb3c]
ficom word [edx + 1]
add byte [edi - 0x7d], bl
mov ebp, 0xfffff3d4
add byte [ebp + 0xf], dh
mov dword [ebp - 0x6ec], 0
jmp 0x4279c8
push ecx
add ecx, 0xdd88
sub ecx, 0xe694
pop ecx
push edi
call 0x4279e4
add byte [eax], bh
dec edx
dec edi
cmp dh, byte [esi]
dec esp
inc ebx
add esp, 4
or edi, 0x12ecb
add edi, 0xcde8
xor edi, 0xf472
pop edi
cmp dword [ebp - 0x6ec], 0
jne 0x427a44
push edi
add edi, 0x788b
pop edi
push edx
push eax
add esp, 4
and edx, 0x138f5
or edx, 0xcc21
pop edx
push esi
push edx
add esp, 4
xor esi, 0x3b7c
add esi, 0x6aad
or esi, 0x1a2e
pop esi
mov dword [ebp - 0x738], 0
jmp 0x42856b
push edx
sub edx, 0x3954
add edx, 0x43c2
add edx, 0x15965
pop edx
push edi
push esi
add esp, 4
xor edi, 0x243e
pop edi
push edi
push esi
add esp, 4
xor edi, 0x1134b
xor edi, 0x157e2
pop edi
mov eax, dword [ebp - 0x6ec]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x2f8], ecx
mov dword [ebp - 0x6fc], 0
mov edx, dword [ebp - 0x2f8]
mov dword [ebp - 0x14e8], edx
cmp dword [ebp - 0x14e8], 0
jne 0x427ab5
mov eax, dword [ebp - 0x6fc]
mov dword [ebp - 0x3c4], eax
jmp 0x427da6
mov ecx, dword [ebp - 0x14e8]
mov edx, dword [ebp - 0x2f8]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x14ec], edx
jne 0x427add
mov eax, dword [ebp - 0x6fc]
mov dword [ebp - 0x3c4], eax
jmp 0x427da6
mov ecx, 8
imul edx, ecx, 0
mov eax, dword [ebp - 0x14ec]
mov ecx, dword [eax + edx + 0x78]
mov dword [ebp - 0x14f0], ecx
Function at 0x42788d
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
add esp, 4
sub ebx, 0x760a
or ebx, 0x950d
pop ebx
push ebx
push ebx
add esp, 4
or ebx, 0x9fe2
jmp 0x427799
xor ebx, 0x8e73
or ebx, 0x12e25
pop ebx
lea edx, [ebp - 0x16cc]
mov dword [ebp - 0xc28], edx
mov eax, dword [ebp - 0x4d8]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc24], ecx
xor edx, edx
mov word [ebp - 0x1fc], dx
xor eax, eax
mov word [ebp - 0x104], ax
push edx
push edi
add esp, 4
add edx, 0xc1fe
or edx, 0x107c8
pop edx
push edx
jmp 0x4277ec
sub edx, 0xc2df
pop edx
push eax
push ecx
add esp, 4
add eax, 0x267a
xor eax, 0xc17a
pop eax
mov ecx, dword [ebp - 0xc24]
mov dx, word [ecx]
mov word [ebp - 0xf82], dx
mov eax, dword [ebp - 0xc24]
add eax, 2
mov dword [ebp - 0xc24], eax
mov cx, word [ebp - 0xf82]
mov word [ebp - 0x1fc], cx
mov edx, dword [ebp - 0xc28]
mov ax, word [edx]
mov word [ebp - 0xf84], ax
mov ecx, dword [ebp - 0xc28]
add ecx, 2
mov dword [ebp - 0xc28], ecx
mov dx, word [ebp - 0xf84]
mov word [ebp - 0x104], dx
push ecx
or ecx, 0x13cd3
xor ecx, 0x165cb
sub ecx, 0xf13b
sub ecx, 0xe580
pop ecx
push ecx
xor ecx, 0x7154
call fcn.0042788d
add byte [edi], dh
aaa
cmp byte [esi + 0x50], al
dec ecx
xor al, byte [ebx + 0xf5904c4]
add esp, 4
pop ecx
invalid
mov bh, 0x85
cld
invalid
add esp, 4
pop ecx
movzx eax, word [ebp - 0x104]
test eax, eax
jne 0x4278b4
movzx ecx, word [ebp - 0x1fc]
movzx edx, word [ebp - 0x104]
sub ecx, edx
mov dword [ebp - 0x14e4], ecx
jmp 0x427917
movzx eax, word [ebp - 0x1fc]
movzx ecx, word [ebp - 0x104]
cmp eax, ecx
je 0x4277d3
movzx edx, word [ebp - 0x1fc]
xor edx, 0x20
movzx eax, word [ebp - 0x104]
cmp edx, eax
je 0x4277d3
movzx ecx, word [ebp - 0x1fc]
movzx edx, word [ebp - 0x104]
cmp ecx, edx
jge 0x427901
mov dword [ebp - 0x14e0], 0xffffffff
jmp 0x42790b
mov dword [ebp - 0x14e0], 1
mov eax, dword [ebp - 0x14e0]
mov dword [ebp - 0x14e4], eax
cmp dword [ebp - 0x14e4], 0
jne 0x427960
push edx
or edx, 0x29c1
xor edx, 0x14270
pop edx
push eax
or eax, 0x2a8a
or eax, 0x1297f
call 0x427948
add byte [0x38333a4b], bh
dec ecx
inc ebp
add esp, 4
add eax, 0x2316
pop eax
mov ecx, dword [ebp - 0x4d8]
mov dword [ebp - 0x6ec], ecx
jmp 0x4279c8
push edi
sub edi, 0x97a7
sub edi, 0x26cb
or edi, 0x118d0
pop edi
push eax
push ecx
add esp, 4
and eax, 0x5578
or eax, 0x10bc5
xor eax, 0xc0de
sub eax, 0x6e74
pop eax
mov edx, dword [ebp - 0x4d8]
mov eax, dword [edx]
mov dword [ebp - 0x4d8], eax
mov ecx, dword [ebp - 0x4d8]
cmp ecx, dword [ebp - 0xc2c]
je 0x4279be
mov edx, dword [ebp - 0x4d8]
cmp dword [edx + 0x30], 0
jne 0x427774
mov dword [ebp - 0x6ec], 0