joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1e023ff6
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [eax]
sub ecx, 0xf
push esi
push edi
je 0x1e039ba5
dec ecx
je 0x1e039ba5
dec ecx
dec ecx
je 0x1e039b9d
sub ecx, 4
je 0x1e02401d
or eax, 0xffffffff
pop edi
pop esi
ret
push 0
push dword [eax + 4]
call sym.python31.dll__PyUnicodeUCS2_AsDefaultEncodedString
pop ecx
pop ecx
add eax, 0x10
mov edi, str.True
mov esi, eax
push 5
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x1e024041
sbb edx, edx
sbb edx, 0xffffffff
test edx, edx
je 0x1e039b9d
push 6
mov edi, str.False
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x1e02405e
sbb edx, edx
sbb edx, 0xffffffff
test edx, edx
je 0x1e024099
push 5
mov edi, str.None
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x1e024077
sbb edx, edx
sbb edx, 0xffffffff
test edx, edx
je 0x1e024099
mov esi, eax
push 0xa
mov edi, str.__debug__
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x1e024090
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1e024017
jmp 0x1e039b8d
xor eax, eax
jmp 0x1e02401a
dec dword [ebx - 0x74773]
dec dword [ecx - 0x4c773]
dec dword [ebx - 0x4c76b]
dec dword [ecx - 0x7736b]
sti
invalid
call dword [ebx - 0x7f]
retf

Function at 0x1e02420a
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push sym.python31.dll_PyGen_Type
call sym.python31.dll__PyObject_GC_New
pop ecx
test eax, eax
je 0x1e03a0f2
push esi
mov esi, eax
mov eax, dword [esp + 8]
mov dword [esi + 8], eax
mov ecx, dword [eax + 0x10]
inc dword [ecx]
mov eax, dword [eax + 0x10]
and dword [esi + 0xc], 0
and dword [esi + 0x14], 0
push edi
lea edi, [esi - 0x10]
mov dword [esi + 0x10], eax
cmp dword [edi + 8], 0xfffffffe
jne 0x1e03a105
mov dword [edi + 8], 0xfffffffd
mov dword [edi], 0x1e1e89e0
mov eax, dword [0x1e1e89e4]
mov dword [edi + 4], eax
mov eax, dword [0x1e1e89e4]
mov dword [eax], edi
mov dword [0x1e1e89e4], edi
pop edi
mov eax, esi
pop esi
ret
pop esp
std
invalid
lodsb al, byte [esi]
jmp 0x83bca10a

Function at 0x1e024305
Capabilities:
Get number of processors
Query environment variable
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
cmp dword [sym.python31.dll_Py_IgnoreEnvironmentFlag], 0
jne 0x1e02432b
push str.PYTHONCASEOK
call dword [sym.imp.MSVCR90.dll_getenv]
pop ecx
test eax, eax
jne 0x1e0386ed
lea eax, [ebp - 0x144]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x1e0386f2
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [ebp + 0xc]
lea eax, [ebp - 0x118]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.MSVCR90.dll_strncmp]
add esp, 0xc
neg eax
sbb eax, eax
inc eax
leave
ret
push dword [esi + eax*8 - 0x7b]
enter 0xfffffffffffffff7, 0xffffffffffffffff
push eax
idiv edi
call dword [eax - 0x3a]
test ecx, ecx
idiv edi
push dword [edx - 0x3a]
test edx, ecx
idiv edi
jmp [edi - 0x3a]
Function at 0x1e024b83
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x4000
call fcn.1e038250
push esi
push edi
push dword [ebp + 8]
call fcn.1e024c12
pop ecx
test eax, eax
jle 0x1e044622
mov edi, eax
cmp edi, 0x4000
jg 0x1e024bdd
lea esi, [esp + 8]
push dword [ebp + 8]
push edi
push 1
push esi
call dword [sym.imp.MSVCR90.dll_fread]
push eax
push esi
call sym.python31.dll_PyMarshal_ReadObjectFromString
mov edi, eax
lea eax, [esp + 0x20]
add esp, 0x18
cmp esi, eax
jne 0x1e024c04
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp edi, 0x40000
jg 0x1e044622
cmp edi, 0x7fffffff
jg 0x1e024c0e
push edi
call dword [sym.imp.MSVCR90.dll_malloc]
pop ecx
mov esi, eax
test esi, esi
jne 0x1e024bb4
jmp 0x1e044622
push esi
call dword [sym.imp.MSVCR90.dll_free]
pop ecx
jmp 0x1e024bd5
xor esi, esi
jmp 0x1e024bfb

Function at 0x1e0251e5
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [eax + 4]
mov ecx, sym.python31.dll_PyFloat_Type
cmp eax, ecx
je 0x1e039b68
push ecx
push eax
call sym.python31.dll_PyType_IsSubtype
pop ecx
pop ecx
test eax, eax
jne 0x1e039b68
ret

Function at 0x1e025d39
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
push str.PyCapsule_GetPointer_called_with_invalid_PyCapsule_object
call fcn.1e0030cc
pop ecx
test eax, eax
je 0x1e025d6a
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
mov ecx, dword [esi + 0xc]
call fcn.1e029a3d
test eax, eax
je 0x1e03a2f5
mov eax, dword [esi + 8]
pop esi
ret
xor eax, eax
ret
dec dword [ecx - 0x4cf73]
call dword [edx + 0x51]
Function at 0x1e026c43
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [edx + 0x10]
push ebx
push esi
push edi
cmp eax, 1
jne 0x1e026c6b
mov edx, dword [edx + 0x14]
movsx eax, word [edx]
dec eax
je 0x1e026cd3
sub eax, 0x13
je 0x1e026ccf
dec eax
je 0x1e026d10
sub eax, 7
jne 0x1e026cc4
inc eax
jmp 0x1e026cc0
cmp eax, 2
jne 0x1e038b71
mov eax, dword [edx + 0x14]
movsx ecx, word [eax]
dec ecx
jne 0x1e038b53
mov esi, dword [eax + 0x1c]
push 3
mov edi, 0x1e18d27c
pop ecx
xor ebx, ebx
repe cmpsb byte [esi], byte es:[edi]
je 0x1e026c97
sbb ebx, ebx
sbb ebx, 0xffffffff
test ebx, ebx
je 0x1e038b4c
mov esi, dword [eax + 4]
push 3
mov edi, 0x1e18d540
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x1e026cb5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1e038b53
push 8
pop eax
pop edi
pop esi
pop ebx
ret
dec eax
jne 0x1e038b2e
push 2
jmp 0x1e026cbf
push 3
jmp 0x1e026cbf
mov ebx, dword [edx + 4]
mov edi, 0x1e18d27c
mov esi, ebx
push 3
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x1e026ceb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1e026d14
push 3
mov edi, 0x1e18d540
mov esi, ebx
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x1e026d04
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1e038b42
push 7
jmp 0x1e026cbf
push 5
jmp 0x1e026cbf
push 9
jmp 0x1e026cbf
or byte [eax], al
add byte [eax], al
add al, 0x5b
dec dword [ebx + 0x448d8908]
sti
invalid
js 0x1e038ba3
add byte [edi], cl
test dword [esi - 0x38000003], esi
test dword [eax - 3], esp
invalid

Function at 0x1e028243
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [eax + 0x18]
cmp dword [ecx + 0x34], 0x14
jge 0x1e0389b6
mov eax, ecx
mov ecx, dword [eax + 0x34]
lea edx, [eax + ecx*8 + 0x38]
inc ecx
mov dword [eax + 0x34], ecx
mov eax, dword [esp + 4]
mov dword [edx], eax
mov eax, dword [esp + 8]
mov dword [edx + 4], eax
xor eax, eax
inc eax
ret
in eax, dx
js 0x1e0389ba
add byte [ecx + 0xd059e7], al
add byte [edi - 0x75], bl
xchg ebp, eax
in al, dx
invalid

Function at 0x1e028f73
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push esi
push edi
mov esi, eax
mov edi, dword [esi + 0xc]
push edi
call sym.python31.dll_PyList_New
pop ecx
test eax, eax
je 0x1e03a1c3
cmp edi, dword [esi + 0xc]
jne 0x1e03a1ae
mov ecx, dword [esi + 0x14]
mov esi, dword [esi + 0x10]
test esi, esi
jl 0x1e028f61
xor edi, edi
lea edx, [ecx + 4]
inc esi
push ebx
cmp dword [edx + 4], 0
jne 0x1e028f64
add edx, 0xc
dec esi
jne 0x1e028f54
pop ebx
pop edi
pop esi
ret
mov ecx, dword [edx]
inc dword [ecx]
mov ebx, dword [eax + 0xc]
mov dword [edi + ebx], ecx
add edi, 4
jmp 0x1e028f5a
mov eax, dword [esp + 4]
test eax, eax
je 0x1e03f19e
mov ecx, dword [eax + 4]
test dword [ecx + 0x54], 0x20000000
je 0x1e03f19e
jmp 0x1e028f24
inc ebp
xor eax, dword [ebp + 0x38]
push ds
enter 0x505, 0xffffffffffffff86
iretd
Function at 0x1e0296ca
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
lea eax, [ecx - 1]
push esi
push edi
cmp eax, 0x92
ja case.0x1e0296e3.18
movzx eax, byte [eax + 0x1e0297aa]
mov esi, edx
jmp dword [eax*4 + 0x1e029762]
xor eax, eax
inc eax
pop edi
pop esi
ret
or eax, 0xffffffff
jmp 0x1e0296ed
xor eax, eax
jmp 0x1e0296ed
mov eax, esi
cdq
mov ecx, 0x100
idiv ecx
mov esi, edx
cdq
idiv ecx
mov eax, esi
neg eax
add edx, edx
sub eax, edx
jmp 0x1e0296ed
push 6
pop eax
jmp 0x1e0296ed
xor eax, eax
inc eax
sub eax, esi
jmp 0x1e0296ed
push 0xfffffffffffffffe
jmp 0x1e029714
mov eax, esi
cdq
mov ecx, 0x100
idiv ecx
sar esi, 0x10
and esi, 0xffff
mov edi, edx
cdq
idiv ecx
mov eax, edx
neg eax
add eax, eax
sub eax, esi
sub eax, edi
jmp 0x1e0296ed
lea eax, [esi - 1]
jmp 0x1e0296ed
mov eax, esi
neg eax
jmp 0x1e0296ed
xor eax, eax
cmp esi, 3
setne al
dec eax
dec eax
jmp 0x1e0296ed
push 0xfffffffffffffffd
jmp 0x1e029714
cmp dword [esi + 0x39], eax
inc ebx
inc ebx

Function at 0x1e0299dc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
mov edi, dword [esp + 8]
test edi, edi
je 0x1e03a3c9
mov eax, dword [edi + 4]
push esi
mov esi, dword [eax + 0x34]
test esi, esi
je 0x1e03a3ee
cmp dword [esi + 0x14], 0
je 0x1e03a3ee
cmp dword [esp + 0x10], 0
jl 0x1e03a3d3
push 0
push dword [esp + 0x14]
push edi
call dword [esi + 0x14]
add esp, 0xc
pop esi
pop edi
ret
mov al, 0xf3
invalid
invalid
or eax, 0x810000a1
ret

Function at 0x1e029a3d
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
test eax, eax
je 0x1e0396ce
test ecx, ecx
je 0x1e0396ce
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1e029a73
test dl, dl
je 0x1e029a67
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1e029a73
inc eax
inc eax
inc ecx
inc ecx
test dl, dl
jne 0x1e029a4d
xor eax, eax
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
ret
sbb eax, eax
sbb eax, 0xffffffff
jmp 0x1e029a69
sub eax, 0x505a0001

Function at 0x1e02a051
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
cmp dword [esp + 0xc], eax
jle 0x1e0390ba
mov ecx, dword [esp + 8]
mov cx, word [ecx + eax*2]
cmp cx, word [esp + 4]
jne 0x1e0390af
xor eax, eax
inc eax
ret 0xc
test dword [esp + edi*8 - 0x7a380001], ebp
enter 0xfffffffffffffff8, 0xffffffffffffffff
add byte [eax], al
add byte [eax], al

Function at 0x1e02a259
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 4]
mov ecx, sym.python31.dll_PyModule_Type
cmp eax, ecx
jne 0x1e03927d
mov eax, dword [esi + 0xc]
pop esi
ret
Function at 0x1e02a93e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [eax + 8]
push esi
push edi
test ebx, ebx
jle 0x1e02aa36
mov edi, dword [eax + 0xc]
xor esi, esi
cmp esi, ebx
jge 0x1e02a989
jmp 0x1e02a965
mov ecx, esi
cmp esi, ebx
jge 0x1e02aa2e
movzx eax, word [edi + esi*2]
mov ecx, 0x80
cmp ax, cx
jae 0x1e03f4fc
movzx eax, ax
movzx eax, byte [eax + sym.python31.dll__Py_ascii_whitespace]
test eax, eax
jne 0x1e03f50a
cmp esi, ebx
jge 0x1e02aa36
mov ecx, esi
movzx eax, word [edi + esi*2]
mov edx, 0x80
cmp ax, dx
jae 0x1e03f510
movzx eax, ax
movzx eax, byte [eax + sym.python31.dll__Py_ascii_whitespace]
test eax, eax
jne 0x1e02a9b8
inc esi
cmp esi, ebx
jl 0x1e02a993
cmp ecx, esi
jge 0x1e02a95d
mov eax, dword [ebp + 0xc]
test eax, eax
jle 0x1e02aa2e
dec dword [ebp + 0xc]
mov eax, esi
sub eax, ecx
push eax
lea eax, [edi + ecx*2]
push eax
call sym.python31.dll_PyUnicodeUCS2_FromUnicode
pop ecx
pop ecx
test eax, eax
je 0x1e03f575
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
call sym.python31.dll_PyList_Append
pop ecx
test eax, eax
mov eax, dword [ebp - 4]
pop ecx
jne 0x1e03f539
dec dword [eax]
je 0x1e03f51e
cmp esi, ebx
jge 0x1e02a95b
movzx eax, word [edi + esi*2]
mov ecx, 0x80
cmp ax, cx
jae 0x1e03f52b
movzx eax, ax
movzx eax, byte [eax + sym.python31.dll__Py_ascii_whitespace]
test eax, eax
je 0x1e02a95b
inc esi
jmp 0x1e02a9ff
cmp ecx, ebx
jl 0x1e03f546
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret
mov dword [edi], 0xf8259a8e
add al, 4
add al, 0x6b
mov cs, word [edx - 0x4f]
pop eax
in eax, dx
or eax, 0x5050505
inc ebx
leave
add eax, 0xc6865660
jb 0x1e03f598
push es
add eax, 0x8856565e
leave
or dword [esi + 0x63e6ef6], eax
add eax, 0x52bc145e
mov cl, 0x8a
into
jp 0x1e03f563
adc al, 0xbc
lcall 0xbc14, 0x4040325
dec edx
mov cl, 0x30
aad 0x8e
lcall 0x5ff0, 0x404f3d1
adc al, 0xbc
xchg edx, eax
and eax, 0x14040403
mov esp, 0xcf40b15a
adc al, 0x89
sbb al, byte [esp + eax]
add al, 0x14
mov esp, 0x403258a
add al, 0x88
cmc
add al, 4
adc al, 0xbc
pop edx
mov cl, 0x40
iretd
add eax, dword [esp + eax]
mov ch, dh
and eax, 0xb152bc14
inc eax
invalid
aad 0xf3
add al, 4
add al, 4
add al, 4

Function at 0x1e02ad32
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [ecx + 0x14]
mov edx, dword [esp + 8]
mov dword [ecx + 0x14], edx
test eax, eax
jne 0x1e039582
ret

Function at 0x1e02b04e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call sym.python31.dll_PyLong_FromLongLong
pop ecx
pop ecx
test eax, eax
je 0x1e02b09d
cmp dword [0x1e1d9684], 0
push esi
mov esi, eax
je 0x1e02b09f
mov eax, dword [ebp + 0x10]
fild dword [ebp + 0x10]
test eax, eax
jl 0x1e03ba82
fmul qword [0x1e1a5b20]
push ecx
fild qword [ebp + 8]
push ecx
faddp st(1)
fstp qword [esp]
call sym.python31.dll_PyFloat_FromDouble
pop ecx
pop ecx
mov dword [ebx + edi*4 + 0xc], esi
mov dword [ebx + edi*4 + 0x18], eax
pop esi
leave
ret
inc dword [esi]
jmp 0x1e02b094
Function at 0x1e02b996
Capabilities:
Encode data using xor

Disassembly:
xor ecx, ecx
cmp dword [esp + 4], ecx
je 0x1e02b9ca
mov eax, dword [esp + 8]
cmp eax, ecx
je 0x1e04115a
cmp byte [eax], cl
je 0x1e04115a
lea ecx, [esp + 0xc]
push ecx
push eax
call sym.python31.dll__Py_VaBuildValue_SizeT
pop ecx
pop ecx
push dword [esp + 4]
call fcn.1e004fa5
pop ecx
ret
jmp fcn.1e05e721
add al, 4
add al, 4
add al, 4
invalid

Function at 0x1e02c227
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp dword [0x1e20008c], 0
je 0x1e0399c0
jmp dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
add al, 0x4a
Function at 0x1e02d52a
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esi]
push ebx
mov ebx, dword [sym.imp.MSVCR90.dll_getc]
push edi
test eax, eax
jne 0x1e0386b5
mov eax, dword [esi + 0x10]
cmp eax, dword [esi + 0x14]
jae 0x1e0386c1
movzx cx, byte [eax]
inc eax
movzx edi, cx
mov dword [esi + 0x10], eax
mov eax, dword [esi]
test eax, eax
jne 0x1e0386c9
mov ecx, dword [esi + 0x10]
cmp ecx, dword [esi + 0x14]
jae 0x1e0386d2
movzx eax, byte [ecx]
inc ecx
mov dword [esi + 0x10], ecx
shl eax, 8
or edi, eax
mov eax, edi
and eax, 0xffff8000
neg eax
movsx ecx, di
cwde
pop edi
or eax, ecx
pop ebx
ret
dec ebp
xor al, 0x81
invalid
invalid
les eax, [ebx + ebp*8]
pop es
xor edi, dword [ebx]
cmp byte [eax + 0x4e], dl
dec esi
dec esi
cmp eax, 0x7cf5ef81
add dword [eax], eax

Function at 0x1e02ded6
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x44], 0x14
jge 0x1e0392f6
mov ecx, dword [esi + 0x44]
lea eax, [ecx + 6]
imul eax, eax, 0xc
add eax, esi
inc ecx
mov dword [esi + 0x44], ecx
mov ecx, dword [esp + 0xc]
mov dword [eax], ecx
mov ecx, dword [esp + 0x14]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 4], ecx
pop esi
ret

Function at 0x1e02ee01
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, dword [0x1e200560]
push edi
test esi, esi
je 0x1e02ee6a
lea edi, [esi + 0x14]
mov ebx, dword [edi]
push 0x40000
mov dword [0x1e200560], ebx
call dword [sym.imp.MSVCR90.dll_malloc]
pop ecx
mov dword [esi], eax
test eax, eax
je 0x1e03924c
inc dword [0x1e200568]
and dword [esi + 0x10], 0
mov ecx, eax
and ecx, 0xfff
mov dword [esi + 4], eax
mov dword [esi + 8], 0x40
je 0x1e02ee5e
sub eax, ecx
add eax, 0x1000
mov dword [esi + 8], 0x3f
mov dword [esi + 4], eax
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
mov eax, esi
pop edi
pop esi
pop ebx
ret
mov esi, dword [0x1e20055c]
test esi, esi
jne 0x1e039244
push 0x10
pop edi
cmp edi, esi
jbe 0x1e039254
cmp edi, 0x9249249
ja 0x1e039254
mov eax, edi
imul eax, eax, 0x1c
push eax
push dword [0x1e200558]
call dword [sym.imp.MSVCR90.dll_realloc]
pop ecx
pop ecx
test eax, eax
je 0x1e039254
mov dword [0x1e200558], eax
cmp esi, edi
jae 0x1e02eed9
mov ecx, esi
imul ecx, ecx, 0x1c
push ebp
mov edx, esi
lea ebp, [edi - 1]
lea ecx, [ecx + eax + 0x14]
and dword [ecx - 0x14], 0
cmp edx, ebp
jae 0x1e02eee9
lea ebx, [ecx + 8]
mov dword [ecx], ebx
inc edx
add ecx, 0x1c
cmp edx, edi
jb 0x1e02eec3
pop ebp
imul esi, esi, 0x1c
add esi, eax
mov dword [0x1e20055c], edi
jmp 0x1e02ee0e
xor ebx, ebx
jmp 0x1e02eece
add byte [eax], al
add byte [ebx - 0x14f7b], cl
dec dword [edi]
mov esi, 0xf7b4058c
invalid

Function at 0x1e02f6bb
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
dec eax
je 0x1e02f6cd
dec eax
jne 0x1e038a0e
push 0xc
pop eax
ret
push 0xf
pop eax
ret
mov eax, dword [ebp - 0xfb8]
Function at 0x1e030292
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
mov dword [ebp + 8], eax
mov bl, byte [eax]
movsx ecx, bl
add ecx, 0xffffffd8
cmp ecx, 0x52
ja case.0x1e0302be.46
movzx edx, byte [ecx + 0x1e030306]
mov ecx, dword [ebp + 0xc]
inc eax
mov dword [ebp + 8], eax
jmp dword [edx*4 + 0x1e0302ea]
mov cl, byte [eax]
cmp cl, 0x21
je 0x1e038917
cmp cl, 0x26
mov ecx, dword [ebp + 0xc]
je 0x1e038923
add dword [ecx], 4
mov dword [edi], eax
xor eax, eax
pop edi
pop ebx
pop ebp
ret
pushal
std
invalid
add byte [ebx - 0xc1b6b], cl
dec dword [ecx - 0x4bb6b]
call dword [edx + 0x50]

Function at 0x1e03099e
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push esi
mov eax, ebx
push edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1e0309ab
sub eax, edx
lea ecx, [eax + 0xd]
cmp ecx, 0x100
jae 0x1e039afd
lea ecx, [eax + ebx]
inc eax
lea edi, [eax + ebx]
mov byte [ecx], 0x5c
mov dword [ebp - 4], edi
mov esi, str.__init__.py
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x40]
push eax
movsd dword es:[edi], dword [esi]
mov esi, dword [sym.imp.MSVCR90.dll__stat64i32]
push ebx
mov dword [ebp - 8], ecx
call esi
pop ecx
pop ecx
test eax, eax
jne 0x1e039b04
push dword [ebp - 4]
push 8
push ebx
call fcn.1e024305
add esp, 0xc
test eax, eax
je 0x1e039b04
mov eax, dword [ebp - 8]
mov byte [eax], 0
xor eax, eax
inc eax
pop edi
pop esi
leave
ret
add byte [eax], al
add byte [eax], al

Function at 0x1e030ab6
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, eax
add esi, 0xfffffffa
push edi
xor edi, edi
mov dword [ebp - 8], esi
test esi, esi
jle 0x1e030ad7
mov al, byte [edi + ecx]
cmp al, 0x20
jne 0x1e030ae3
inc edi
cmp edi, esi
jl 0x1e030acb
cmp edi, esi
push ebx
jl 0x1e030af3
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret
cmp al, 0x23
je 0x1e030ad7
cmp al, 9
je 0x1e030ad2
cmp al, 0xc
je 0x1e030ad2
xor eax, eax
jmp 0x1e030adf
lea ebx, [edi + ecx + 6]
push 6
lea eax, [ebx - 6]
push str.coding
push eax
call dword [sym.imp.MSVCR90.dll_strncmp]
add esp, 0xc
test eax, eax
je 0x1e039dec
inc edi
inc ebx
cmp edi, esi
jl 0x1e030af7
jmp 0x1e030adc
Function at 0x1e031733
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
push edi
push 1
push dword [0x1e200674]
call sym.python31.dll_PyThread_acquire_lock
mov esi, dword [esp + 0x18]
mov edi, dword [esi + 4]
pop ecx
xor ebx, ebx
jmp 0x1e031757
push edi
call sym.python31.dll_PyThreadState_Clear
mov edi, dword [edi]
pop ecx
cmp edi, ebx
jne 0x1e03174f
push dword [0x1e200674]
call sym.python31.dll_PyThread_release_lock
mov eax, dword [esi + 0x1c]
pop ecx
cmp eax, ebx
je 0x1e03177e
mov dword [esi + 0x1c], ebx
dec dword [eax]
jne 0x1e03177e
mov ecx, dword [eax + 4]
push eax
call dword [ecx + 0x18]
pop ecx
mov eax, dword [esi + 0x20]
cmp eax, ebx
je 0x1e031794
mov dword [esi + 0x20], ebx
dec dword [eax]
jne 0x1e031794
mov ecx, dword [eax + 4]
push eax
call dword [ecx + 0x18]
pop ecx
mov eax, dword [esi + 0x24]
cmp eax, ebx
je 0x1e0317aa
mov dword [esi + 0x24], ebx
dec dword [eax]
jne 0x1e0317aa
mov ecx, dword [eax + 4]
push eax
call dword [ecx + 0x18]
pop ecx
mov eax, dword [esi + 8]
cmp eax, ebx
jne 0x1e039a75
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x1e0317cb
mov dword [esi + 0xc], ebx
dec dword [eax]
jne 0x1e0317cb
mov ecx, dword [eax + 4]
push eax
call dword [ecx + 0x18]
pop ecx
mov eax, dword [esi + 0x18]
cmp eax, ebx
jne 0x1e039a8d
mov eax, dword [esi + 0x10]
cmp eax, ebx
je 0x1e0317e8
mov dword [esi + 0x10], ebx
dec dword [eax]
je 0x1e039aa5
mov eax, dword [esi + 0x14]
cmp eax, ebx
je 0x1e0317fa
mov dword [esi + 0x14], ebx
dec dword [eax]
je 0x1e039ab2
pop edi
pop esi
pop ebx
ret
mov eax, dword [ebp - 0x154]
add eax, 1
mov dword [ebp - 0x154], eax
clc
invalid
adc eax, 0xfffff7c4
cmp ecx, eax
jne 0x1e039a9d
jmp 0x1e0399e3
jmp 0x1e039aa4
les eax, [ebx + ebp*8]
add al, 0x48
inc eax
inc ecx
inc ebp

Function at 0x1e031de7
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push dword [esp + 8]
push dword [esp + 8]
call sym.python31.dll_PyObject_GetAttr
pop ecx
pop ecx
test eax, eax
jne 0x1e03a06a
call sym.python31.dll_PyErr_Clear
xor eax, eax
ret
Function at 0x1e03230f
Capabilities:
Execute syscall

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
and dword [esp], 0
push ebx
mov ebx, dword [eax + 8]
push ebp
push esi
push edi
lea ebp, [ebx + 4]
test ebx, ebx
je 0x1e03e7f1
mov eax, dword [ebx]
cmp dword [esp + 0x10], eax
jge 0x1e0323f3
mov eax, dword [ebp]
push dword [eax]
call sym.python31.dll__PyUnicode_AsString
pop ecx
test eax, eax
je 0x1e03e861
push 0xe
mov edi, str.nested_scopes
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x1e03235e
sbb edx, edx
sbb edx, 0xffffffff
test edx, edx
je 0x1e0323e7
push 0xb
mov edi, str.generators
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x1e03237b
sbb edx, edx
sbb edx, 0xffffffff
test edx, edx
je 0x1e0323e7
push 9
mov edi, str.division
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x1e032394
sbb edx, edx
sbb edx, 0xffffffff
test edx, edx
je 0x1e0323e7
push 0x10
mov edi, str.absolute_import
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x1e0323ad
sbb edx, edx
sbb edx, 0xffffffff
test edx, edx
je 0x1e0323e7
push 0xf
mov edi, str.with_statement
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x1e0323c6
sbb edx, edx
sbb edx, 0xffffffff
test edx, edx
je 0x1e0323e7
push 0xf
mov edi, str.print_function
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x1e0323df
sbb edx, edx
sbb edx, 0xffffffff
test edx, edx
jne 0x1e03e7f8
inc dword [esp + 0x10]
add ebp, 4
jmp 0x1e032322
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
cmc
add eax, 0xcd8acc5e
cli
add al, 4
add eax, 0xcb050505
mov ah, byte [eax + 3]
add al, 4
add eax, 0x152bc14
mov dh, bh
push es
sbb dword [ecx - 0x70], 0xbc14f55a
pop es
mov ch, bh
and eax, 0xf0564e84
or byte [edx], bh
push esp
aaa
pop esi
pop eax
pop eax
mov cl, cl
or dword [esi + 0x54cadf0], eax
add eax, 0x50510ed
add eax, 0x3c494e05
cmp eax, 0x544e533f

Function at 0x1e032523
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
call fcn.1e032581
test eax, eax
je 0x1e03257e
push esi
push edi
mov edi, dword [sym.imp.MSVCR90.dll_malloc]
push 0x200
mov esi, eax
call edi
pop ecx
mov dword [esi], eax
test eax, eax
je 0x1e039d70
mov dword [esi + 8], eax
mov dword [esi + 4], eax
add eax, 0x200
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0xc]
mov dword [esi + 0x18], eax
mov eax, dword [esp + 0x10]
mov dword [esi + 0x1bc], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 0x1c0], eax
test ebx, ebx
jne 0x1e039d06
mov eax, esi
pop edi
pop esi
ret
xor eax, eax
ret
add dword gs:[eax], eax
invalid