joyce8/EMBER2024-capa huggingface dataset:
Function at 0x61f3f8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x61f5f5
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x28]
mov eax, dword [esi + 0x31e]
call fcn.00493c08
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x10]
call fcn.00406db8
fstp dword [ebp - 0xc]
wait
mov eax, esi
call fcn.0061ed64
test al, al
je 0x61f49d
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x61f49d
fld dword [esi + 0x2b0]
fmul dword [0x61f604]
fsubr dword [ebp - 0xc]
fstp dword [ebp - 0xc]
wait
fld dword [esi + 0x2b0]
fmul dword [0x61f604]
fdivr dword [ebp - 0xc]
call fcn.00404d4c
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
fild qword [ebp - 0x30]
fld dword [esi + 0x2b0]
fmul dword [0x61f604]
fmulp st(1)
fstp dword [ebp - 0xc]
wait
jmp 0x61f4aa
fld dword [ebp - 0xc]
fsub dword [esi + 0x2b0]
fstp dword [ebp - 0xc]
wait
fld dword [ebp - 0xc]
fcomp dword [esi + 0x2a8]
wait
fnstsw ax
sahf
jae 0x61f4c2
mov eax, dword [esi + 0x2a8]
mov dword [ebp - 0xc], eax
fld dword [ebp - 0xc]
fcomp dword [esi + 0x2ac]
wait
fnstsw ax
sahf
jbe 0x61f4da
mov eax, dword [esi + 0x2ac]
mov dword [ebp - 0xc], eax
fld dword [ebp - 0xc]
fmul dword [0x61f608]
call fcn.00404d4c
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
fild qword [ebp - 0x30]
fdiv dword [0x61f608]
fstp dword [ebp - 0xc]
wait
fld dword [ebp - 0xc]
fstp qword [esi + 0x316]
wait
fld dword [ebp - 0xc]
fstp xword [ebp - 0x20]
wait
mov bl, 2
mov edi, 0xa
mov eax, dword [esi + 0x2c0]
mov dword [ebp - 0x24], eax
movzx eax, word [ebp - 0x18]
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
mov eax, dword [0x7a6c88]
push eax
lea eax, [ebp - 8]
push eax
mov eax, ebx
mov ecx, dword [ebp - 0x24]
mov edx, edi
call fcn.004251a0
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.004091cc
movzx eax, byte [0x61f60c]
push eax
lea eax, [ebp - 0x34]
push eax
mov ecx, 0x61f61c
mov edx, 0x61f62c
mov eax, dword [ebp - 4]
call fcn.004298b0
mov edx, dword [ebp - 0x34]
lea eax, [ebp - 4]
call fcn.004091cc
movzx eax, byte [0x61f60c]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x3c]
mov edx, dword [0x7a7048]
movzx edx, word [edx]
call fcn.00409c34
mov edx, dword [ebp - 0x3c]
mov ecx, 0x61f61c
mov eax, dword [ebp - 4]
call fcn.004298b0
mov edx, dword [ebp - 0x38]
lea eax, [ebp - 4]
call fcn.004091cc
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0x31e]
call fcn.00493c64
mov eax, dword [esi + 0x31e]
mov edx, dword [eax]
call dword [edx + 0xa8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61f5fc
lea eax, [ebp - 0x3c]
mov edx, 3
call fcn.00408e04
lea eax, [ebp - 0x28]
call fcn.00408da4
lea eax, [ebp - 8]
mov edx, 2
call fcn.00408e04
ret
Function at 0x620848
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebx
push esi
add esp, 0xffffffe8
cmp dword [0x7aec28], 0
jne 0x620878
mov dl, 1
mov eax, dword [0x471608]
call fcn.0047a624
mov ebx, eax
mov dl, 7
mov eax, ebx
call fcn.0047c288
mov dl, 1
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x78]
jmp 0x62087e
mov ebx, dword [0x7aec28]
mov eax, dword [0x7aeb48]
call fcn.00493530
push eax
mov eax, dword [0x7aeb48]
call fcn.004934f0
mov edx, eax
mov eax, ebx
pop ecx
mov esi, dword [eax]
call dword [esi + 0x6c]
push 1
mov eax, dword [0x7aeb38]
mov eax, dword [eax + 0x1b0]
call fcn.004756e0
push eax
call sub.gdi32.dll_SetMapMode
push esp
call sub.kernel32.dll_QueryPerformanceFrequency
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_QueryPerformanceCounter
push 0xcc0020
mov eax, dword [0x7aeb48]
mov eax, dword [eax + 0x290]
mov eax, dword [eax + 0xc]
push eax
mov eax, dword [0x7aeb48]
mov eax, dword [eax + 0x280]
mov eax, dword [eax + 0xc]
push eax
mov eax, dword [0x7aeb38]
mov eax, dword [eax + 0x1b0]
call fcn.004756e0
push eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x24]
push eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x30]
push eax
push 0
push 0
mov eax, ebx
call fcn.0047af44
call fcn.004756e0
push eax
call sub.gdi32.dll_BitBlt
lea eax, [esp + 0x10]
push eax
call sub.kernel32.dll_QueryPerformanceCounter
call fcn.0062072c
mov eax, ebx
add esp, 0x18
pop esi
pop ebx
ret
Function at 0x6388d8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov ebx, edx
mov edi, eax
mov edx, edi
mov eax, dword [0x7cf664]
call fcn.00447f1c
mov ebp, eax
cmp bl, byte [ebp + 0x15]
je 0x638a3b
mov eax, ebp
call fcn.0064a43c
test al, al
jne 0x638910
mov eax, ebp
call fcn.0064a428
test al, al
je 0x63891a
cmp byte [ebp + 0x28], 0
je 0x638a3b
mov byte [ebp + 0x15], bl
mov edx, dword [0x7cf664]
mov eax, edi
call fcn.00638a44
cmp byte [ebp], 7
jne 0x638973
mov eax, dword [ebp + 0x187]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x638955
inc esi
xor edi, edi
mov edx, edi
mov eax, dword [ebp + 0x187]
call fcn.00447f1c
mov byte [eax + 0x15], bl
inc edi
dec esi
jne 0x638941
mov eax, ebp
call fcn.0064a43c
test al, al
jne 0x638a3b
mov eax, ebp
call fcn.0064a428
test al, al
jne 0x638a3b
push 0x12
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jne 0x638a3b
mov eax, ebp
call fcn.0063b38c
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x638a32
inc esi
mov dword [esp], 0
mov edx, dword [esp]
mov eax, dword [esp + 8]
call fcn.00447f1c
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
cmp bl, byte [eax + 0x15]
je 0x638a28
mov eax, ebp
call fcn.0064a43c
test al, al
jne 0x6389d5
mov eax, ebp
call fcn.0064a428
test al, al
je 0x6389db
cmp byte [ebp + 0x28], 0
je 0x638a28
mov eax, dword [esp + 4]
mov byte [eax + 0x15], bl
mov eax, dword [esp + 4]
cmp byte [eax], 7
jne 0x638a1f
mov eax, dword [esp + 4]
mov eax, dword [eax + 0x187]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x638a1f
inc eax
mov dword [esp + 0xc], eax
xor edi, edi
mov eax, dword [esp + 4]
mov eax, dword [eax + 0x187]
mov edx, edi
call fcn.00447f1c
mov byte [eax + 0x15], bl
inc edi
dec dword [esp + 0xc]
jne 0x638a04
mov eax, dword [esp + 4]
call fcn.00638a5c
inc dword [esp]
dec esi
jne 0x6389a6
mov eax, dword [esp + 8]
call fcn.004071a4
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x653498
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x6534c6
mov eax, ebx
call fcn.00653f54
cmp dword [ebx + 0x40], 0
je 0x6534bf
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x653537
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x653529
cmp dword [ebx + 8], 0
je 0x6534e8
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x6534fa
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x653529
cmp dword [ebx + 8], 0
je 0x6534db
cmp eax, 3
je 0x65350d
dec eax
jne 0x6534db
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x6534db
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x6534db
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x653555
cmp dword [ebx + 0x14], 0xcc
je 0x653555
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00653560
pop ebx
ret

Function at 0x6ad70c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6ad7d7
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x6857b0]
call fcn.0040b02c
add esp, 4
mov eax, edi
and al, 0xff
mov edx, dword [ebp - 4]
mov byte [edx], al
mov eax, edi
shr eax, 8
and al, 0xff
mov edx, dword [ebp - 4]
mov byte [edx + 1], al
mov eax, edi
shr eax, 0x10
and al, 0xff
mov edx, dword [ebp - 4]
mov byte [edx + 2], al
mov eax, edi
shr eax, 0x18
and al, 0xff
mov edx, dword [ebp - 4]
mov byte [edx + 3], al
mov eax, esi
call fcn.0040ae78
mov edi, eax
push edi
mov eax, ebx
mov ecx, 1
mov edx, dword [0x6857b0]
call fcn.0040b02c
add esp, 4
mov edx, edi
dec edx
test edx, edx
jl 0x6ad7bb
inc edx
xor eax, eax
mov ecx, eax
and ecx, 0x80000003
jns 0x6ad7a8
dec ecx
or ecx, 0xfffffffc
inc ecx
mov edi, dword [ebp - 4]
movzx ecx, byte [edi + ecx]
xor cl, byte [esi + eax]
mov edi, dword [ebx]
mov byte [edi + eax], cl
inc eax
dec edx
jne 0x6ad799
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6ad7de
lea eax, [ebp - 4]
mov edx, dword [0x6857b0]
call fcn.0040b150
ret
Function at 0x6c7e14
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00408e88
xor eax, eax
push ebp
push 0x6c7fe4
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0042595c
fstp qword [ebp - 0x18]
wait
xor eax, eax
push ebp
push 0x6c7e85
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0042595c
fsub dword [0x6c7ff4]
add esp, 0xfffffff8
fstp qword [esp]
wait
mov ecx, 0x6c8004
mov edx, 0x6c801c
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
fstp qword [ebp - 0x18]
wait
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6c7e8f
call fcn.0042595c
fsub qword [ebp - 0x18]
fcomp dword [0x6c8028]
wait
fnstsw ax
sahf
jbe 0x6c7fce
xor eax, eax
push ebp
push 0x6c7fc7
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov dl, 1
mov eax, dword [0x6c7734]
call fcn.005636f4
mov dword [0x7cfa78], eax
mov eax, dword [0x7cfa78]
add eax, 0x3b0
mov edx, dword [ebp - 4]
call fcn.00409184
cmp dword [ebp - 0xc], 0x60
jle 0x6c7ef2
mov ecx, 0x60
mov edx, dword [ebp - 0xc]
mov eax, dword [0x7cfa78]
call fcn.0049c4d8
call fcn.0042595c
add esp, 0xfffffff8
fstp qword [esp]
wait
mov ecx, 0x6c8004
mov edx, 0x6c801c
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x34]
mov dword [0x7cfa74], 0xffffffff
mov cl, 1
mov dl, 1
mov eax, dword [0x6c7670]
call fcn.00453228
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 0x10]
add eax, 0x40
mov edx, dword [ebp - 4]
call fcn.00409184
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
mov dword [eax + 0x44], edx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0x48], edx
mov eax, dword [ebp - 0x10]
call fcn.004538e4
mov ebx, 0x29
push 0xc8
call sub.kernel32.dll_Sleep
cmp dword [0x7cfa74], 0xffffffff
jne 0x6c7f75
dec ebx
jne 0x6c7f5f
cmp dword [0x7cfa74], 1
jne 0x6c7f90
call fcn.006c802c
mov eax, dword [0x7cfa78]
mov edx, dword [eax]
call dword [edx + 0x120]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6c7fce
mov eax, dword [0x7cfa78]
call fcn.004071a4
cmp dword [0x7cfa74], 0xffffffff
jne 0x6c7fc6
push 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_TerminateThread
mov eax, dword [ebp - 0x10]
call fcn.004071a4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6c7feb
lea eax, [ebp - 4]
call fcn.00408da4
ret
Function at 0x6cb1b0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x418], ecx
mov dword [ebp - 0x414], ecx
mov dword [ebp - 0x410], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x6cb331
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, ebx
add edx, 0xffffff9f
sub dx, 0x1a
jae 0x6cb1f4
mov eax, ebx
and ax, 0xffdf
mov ebx, eax
cmp bx, 0x41
jb 0x6cb313
cmp bx, 0x5a
ja 0x6cb313
mov word [esi + 0x38], bx
push 0x200
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0x200
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x410]
mov edx, ebx
call fcn.00409c34
lea eax, [ebp - 0x410]
mov edx, 0x6cb34c
call fcn.00409e20
mov eax, dword [ebp - 0x410]
call fcn.00409c0c
push eax
call sub.kernel32.dll_GetVolumeInformationW
mov eax, dword [ebp - 4]
cdq
xor eax, edx
sub eax, edx
mov dword [esi + 0x3e], eax
mov eax, dword [ebp - 4]
cdq
xor eax, edx
sub eax, edx
lea edx, [ebp - 0x414]
call fcn.006cb144
mov edx, dword [ebp - 0x414]
lea eax, [esi + 0x3a]
call fcn.00409184
lea edx, [esi + 0x3a]
mov ecx, 5
mov eax, 0x6cb360
call fcn.0040a094
lea eax, [esi + 0x42]
lea edx, [ebp - 0x20c]
mov ecx, pe_nt_image_headers32
call fcn.00409cc8
lea eax, [esi + 0x46]
lea edx, [ebp - 0x40c]
mov ecx, pe_nt_image_headers32
call fcn.00409cc8
lea eax, [ebp - 0x418]
mov edx, ebx
call fcn.00409c34
lea eax, [ebp - 0x418]
mov edx, 0x6cb34c
call fcn.00409e20
mov eax, dword [ebp - 0x418]
call fcn.00409c0c
push eax
call sub.kernel32.dll_GetDriveTypeW
mov byte [esi + 0x4a], al
mov eax, ebx
sub al, 0x40
call fcn.004235ec
mov dword [esi + 0x4b], eax
mov dword [esi + 0x4f], edx
mov eax, ebx
sub al, 0x40
call fcn.004235b8
mov dword [esi + 0x53], eax
mov dword [esi + 0x57], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6cb338
lea eax, [ebp - 0x418]
mov edx, 3
call fcn.00408e04
ret
Function at 0x6cb738
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffb08
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x4f4], ecx
mov dword [ebp - 0x4f8], ecx
mov dword [ebp - 0x4f0], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00408e88
xor eax, eax
push ebp
push 0x6cb8c6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xfa
lea eax, [ebp - 0x210]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
lea edx, [ebp - 0x4f0]
lea eax, [ebp - 0x210]
call fcn.00423a88
push dword [ebp - 0x4f0]
push 0x6cb8e0
push dword [ebp - 4]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00409f00
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.00422db0
test al, al
je 0x6cb840
xor ecx, ecx
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x4ec]
call fcn.00405160
lea eax, [ebp - 0x4ec]
call fcn.00404e14
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x4ec]
call fcn.00405c88
lea eax, [ebp - 0x4ec]
call fcn.00405d94
lea eax, [ebp - 0x4ec]
call fcn.00405260
xor ecx, ecx
mov dl, 1
mov eax, dword [0x6cadfc]
call fcn.006cb018
mov ebx, eax
mov eax, dword [ebp - 8]
movzx edx, word [eax]
mov eax, ebx
call fcn.006cb1b0
mov eax, dword [ebx + 0x3e]
cdq
xor eax, edx
sub eax, edx
mov esi, eax
mov eax, ebx
call fcn.004071a4
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.006cb534
cmp eax, esi
je 0x6cb89b
lea edx, [ebp - 0x4f8]
mov eax, dword [0x7a6b6c]
mov eax, dword [eax]
call fcn.0056e5dc
mov eax, dword [ebp - 0x4f8]
lea edx, [ebp - 0x4f4]
call fcn.004232c0
mov edx, dword [ebp - 0x4f4]
lea eax, [ebp - 8]
mov ecx, 0x6cb8f0
call fcn.00409e78
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.00422db0
test al, al
je 0x6cb896
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.006cb908
test al, al
jne 0x6cb89b
call fcn.006cb39c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6cb8cd
lea eax, [ebp - 0x4f8]
mov edx, 3
call fcn.00408e04
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00408e04
ret

Function at 0x6e7274
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf4
mov ebx, edx
push esp
push 0x104
call sub.kernel32.dll_GetTempPathW
mov edx, ebx
mov eax, esp
call fcn.00423a88
add esp, 0x20c
pop ebx
ret
Function at 0x722f42
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ecx
push edi
jmp 0x722f4d
pop edi
push edx
push eax
add esp, 4
add edx, 0x275b
pop edx
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x722f77
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x1514], ecx
jmp 0x722fd1
movzx eax, word [ebp - 0x204]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x722e9f
movzx edx, word [ebp - 0x204]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x722e9f
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x722fbb
mov dword [ebp - 0x1510], 0xffffffff
jmp 0x722fc5
mov dword [ebp - 0x1510], 1
mov eax, dword [ebp - 0x1510]
mov dword [ebp - 0x1514], eax
cmp dword [ebp - 0x1514], 0
jne 0x72301a
push edx
push ecx
add esp, 4
and edx, 0x173ef
call 0x722ff5
add byte [edx], bh
inc ebx
push eax
cmp byte [eax], bh
cmp eax, dword [eax + 0x4c]
cmp byte [ebx + eax*4 - 0x3c], cl
add al, 0xeb
add eax, 0x35354532
pop edx
push esi
push eax
add esp, 4
sub esi, 0x3f67
pop esi
mov ecx, dword [ebp - 0x4e4]
mov dword [ebp - 0x2a8], ecx
jmp 0x723082
push eax
push edi
add esp, 4
call 0x72302e
add byte [ebx + 0x38], al
inc edx
cmp edi, dword [edi]
xor edi, dword [eax]
dec edi
add esp, 4
and eax, 0xa90c
pop eax
push edi
push edi
add esp, 4
and edi, 0x17e1
pop edi
push edi
xor edi, 0x10b7e
pop edi
mov edx, dword [ebp - 0x4e4]
mov eax, dword [edx]
mov dword [ebp - 0x4e4], eax
mov ecx, dword [ebp - 0x4e4]
cmp ecx, dword [ebp - 0xc4c]
je 0x723078
mov edx, dword [ebp - 0x4e4]
cmp dword [edx + 0x30], 0
jne 0x722e43
mov dword [ebp - 0x2a8], 0
Function at 0x722ff5
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ecx
push edi
jmp 0x722f4d
pop edi
push edx
push eax
add esp, 4
add edx, 0x275b
pop edx
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x722f77
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x1514], ecx
jmp 0x722fd1
movzx eax, word [ebp - 0x204]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x722e9f
movzx edx, word [ebp - 0x204]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x722e9f
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x722fbb
mov dword [ebp - 0x1510], 0xffffffff
jmp 0x722fc5
mov dword [ebp - 0x1510], 1
mov eax, dword [ebp - 0x1510]
mov dword [ebp - 0x1514], eax
cmp dword [ebp - 0x1514], 0
jne 0x72301a
push edx
push ecx
add esp, 4
and edx, 0x173ef
call 0x722ff5
add byte [edx], bh
inc ebx
push eax
cmp byte [eax], bh
cmp eax, dword [eax + 0x4c]
cmp byte [ebx + eax*4 - 0x3c], cl
add al, 0xeb
add eax, 0x35354532
pop edx
push esi
push eax
add esp, 4
sub esi, 0x3f67
pop esi
mov ecx, dword [ebp - 0x4e4]
mov dword [ebp - 0x2a8], ecx
jmp 0x723082
push eax
push edi
add esp, 4
call 0x72302e
add byte [ebx + 0x38], al
inc edx
cmp edi, dword [edi]
xor edi, dword [eax]
dec edi
add esp, 4
and eax, 0xa90c
pop eax
push edi
push edi
add esp, 4
and edi, 0x17e1
pop edi
push edi
xor edi, 0x10b7e
pop edi
mov edx, dword [ebp - 0x4e4]
mov eax, dword [edx]
mov dword [ebp - 0x4e4], eax
mov ecx, dword [ebp - 0x4e4]
cmp ecx, dword [ebp - 0xc4c]
je 0x723078
mov edx, dword [ebp - 0x4e4]
cmp dword [edx + 0x30], 0
jne 0x722e43
mov dword [ebp - 0x2a8], 0
Function at 0x72302e
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ecx
push edi
jmp 0x722f4d
pop edi
push edx
push eax
add esp, 4
add edx, 0x275b
pop edx
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x722f77
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x1514], ecx
jmp 0x722fd1
movzx eax, word [ebp - 0x204]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x722e9f
movzx edx, word [ebp - 0x204]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x722e9f
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x722fbb
mov dword [ebp - 0x1510], 0xffffffff
jmp 0x722fc5
mov dword [ebp - 0x1510], 1
mov eax, dword [ebp - 0x1510]
mov dword [ebp - 0x1514], eax
cmp dword [ebp - 0x1514], 0
jne 0x72301a
push edx
push ecx
add esp, 4
and edx, 0x173ef
call 0x722ff5
add byte [edx], bh
inc ebx
push eax
cmp byte [eax], bh
cmp eax, dword [eax + 0x4c]
cmp byte [ebx + eax*4 - 0x3c], cl
add al, 0xeb
add eax, 0x35354532
pop edx
push esi
push eax
add esp, 4
sub esi, 0x3f67
pop esi
mov ecx, dword [ebp - 0x4e4]
mov dword [ebp - 0x2a8], ecx
jmp 0x723082
push eax
push edi
add esp, 4
call 0x72302e
add byte [ebx + 0x38], al
inc edx
cmp edi, dword [edi]
xor edi, dword [eax]
dec edi
add esp, 4
and eax, 0xa90c
pop eax
push edi
push edi
add esp, 4
and edi, 0x17e1
pop edi
push edi
xor edi, 0x10b7e
pop edi
mov edx, dword [ebp - 0x4e4]
mov eax, dword [edx]
mov dword [ebp - 0x4e4], eax
mov ecx, dword [ebp - 0x4e4]
cmp ecx, dword [ebp - 0xc4c]
je 0x723078
mov edx, dword [ebp - 0x4e4]
cmp dword [edx + 0x30], 0
jne 0x722e43
mov dword [ebp - 0x2a8], 0
Function at 0x723782
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x718]
add eax, 1
mov dword [ebp - 0x718], eax
mov ecx, dword [ebp - 0x714]
mov edx, dword [ebp - 0x718]
cmp edx, dword [ecx + 0x18]
jae 0x7238d2
mov eax, dword [ebp - 0x718]
mov ecx, dword [ebp - 0x18e0]
mov edx, dword [ebp - 0x300]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x71c], edx
mov eax, dword [ebp - 0x718]
mov ecx, dword [ebp - 0x18e4]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x18e8]
mov ecx, dword [ebp - 0x300]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x18ec], ecx
mov dword [ebp - 0x188], 0
jmp 0x723736
mov edx, dword [ebp - 0x188]
add edx, 1
mov dword [ebp - 0x188], edx
mov eax, dword [ebp - 0x71c]
add eax, dword [ebp - 0x188]
movsx ecx, byte [eax]
test ecx, ecx
je 0x7237e8
mov edx, dword [ebp - 0x188]
movsx eax, byte [ebp + edx - 0x830]
test eax, eax
je 0x7237e8
push ecx
push ecx
add esp, 4
xor ecx, 0xe191
sub ecx, 0x5e8b
call fcn.00723782
add byte [edi + 0x40], al
dec ebx
inc ebx
inc edx
xor eax, 0xc483323b
add esp, 4
jmp 0x72378d
inc edi
dec eax
xor al, 0x3c
cmp eax, dword [esi + 0x59]
add esp, 4
jmp 0x72378d
pop ecx
push eax
jmp 0x723794
pop eax
mov ecx, dword [ebp - 0x71c]
add ecx, dword [ebp - 0x188]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x188]
movsx ecx, byte [ebp + eax - 0x830]
cmp edx, ecx
je 0x7237da
mov edx, dword [ebp - 0x71c]
add edx, dword [ebp - 0x188]
movsx eax, byte [edx]
xor eax, 0x20
mov ecx, dword [ebp - 0x188]
movsx edx, byte [ebp + ecx - 0x830]
cmp eax, edx
jne 0x7237e1
jmp 0x723727
jmp 0x7237e8
push ecx
push esi
add esp, 4
add ecx, 0x722a
or ecx, 0x25a0
xor ecx, 0xffdd
pop ecx
push eax
call 0x723811
add byte [eax + 0x38], al
dec edi
xor al, 0x36
dec ebp
inc ebx
xor eax, 0x4c4833f
jmp 0x723819
pop eax
mov eax, dword [ebp - 0x71c]
add eax, dword [ebp - 0x188]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x188]
movsx eax, byte [ebp + edx - 0x830]
cmp ecx, eax
jne 0x723847
mov dword [ebp - 0xc5c], 0
jmp 0x7238b6
push ecx
and ecx, 0x15a59
pop ecx
push edx
push ebx
add esp, 4
or edx, 0x186a0
and edx, 0xbe02
sub edx, 0xa948
call 0x723875
add byte [edi + 0x3a374435], bh
inc ebx
xor dh, byte [0x5a04c483]
mov ecx, dword [ebp - 0x71c]
add ecx, dword [ebp - 0x188]
movsx edx, byte [ecx]
or edx, 0x20
mov eax, dword [ebp - 0x188]
movsx ecx, byte [ebp + eax - 0x830]
or ecx, 0x20
cmp edx, ecx
jge 0x7238ac
mov dword [ebp - 0xc5c], 0xffffffff
jmp 0x7238b6
mov dword [ebp - 0xc5c], 1
cmp dword [ebp - 0xc5c], 0
jne 0x7238cd
mov edx, dword [ebp - 0x18ec]
mov dword [ebp - 0x3c8], edx
jmp 0x7238de
jmp 0x7236b7
mov eax, dword [ebp - 0x720]
mov dword [ebp - 0x3c8], eax
cmp dword [ebp - 0x3c8], 0
je 0x7239b9
push edx
push ebx
add esp, 4
add edx, 0x7bf5
xor edx, 0xe67d
pop edx
push esi
or esi, 0x15dfb
add esi, 0x14e9f
and esi, 0x513a
pop esi
push edi
push ebx
add esp, 4
sub edi, 0x159b2
pop edi
mov ecx, dword [ebp - 0x3c8]
mov dword [ebp - 0x18f0], ecx
push ecx
push ecx
add esp, 4
jmp 0x723934
call fcn.00723944
add byte [ecx*2 + 0x453e3c43], bh
dec edi
dec esi
inc ebp
dec eax