joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42067f
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
pop eax
mov ecx, dword [ebp - 0x24c]
mov dword [ebp - 0x128], ecx
inc edi
test dword [esi + edi*8 + 0xffff], esp
add byte [eax], al
mov edx, dword [ebp - 0x78]
cmp edx, dword [ebp - 0x24c]
jne 0x42065e
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x254], eax
jmp 0x42078f
cmp dword [ebp - 0x158], 0
jle fcn.00420783
push edi
or edi, 0xf374
call 0x42067f
add byte [0x3c36474d], dh
dec ebx
dec edi
add esp, 4
add edi, 0x71df
and edi, 0xeb0e
pop edi
push edi
xor edi, 0x52a8
sub edi, 0x1869
pop edi
mov ecx, dword [ebp - 0x124]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0x128]
movzx ecx, byte [eax]
cmp edx, ecx
je 0x42071f
push ecx
and ecx, 0x17906
xor ecx, 0x13e5d
pop ecx
push eax
push edi
add esp, 4
or eax, 0xf6ee
or eax, 0xf92a
add eax, 0x1529e
pop eax
push esi
push edx
add esp, 4
and esi, 0x861a
pop esi
mov edx, dword [ebp - 0x124]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x128]
movzx edx, byte [ecx]
cmp eax, edx
jle 0x420707
mov dword [ebp - 0x250], 1
jmp 0x420711
mov dword [ebp - 0x250], 0xffffffff
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0x15c], eax
jmp fcn.00420783
push edx
add edx, 0x1efc
or edx, 0x4447
sub edx, 0xcd65
pop edx
push ebx
push eax
add esp, 4
sub ebx, 0xdb0f
add ebx, 0x565b
or ebx, 0x178ac
and ebx, 0xbbe1
pop ebx
invalid

Function at 0x420788
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ebp - 0x78]
add ecx, 1
mov dword [ebp - 0x78], ecx
mov edx, dword [ebp - 0x78]
sub edx, dword [ebp - 0xc4]
cmp edx, 0xffffffff
jb 0x4205e7
push edx
push eax
add esp, 4
sub edx, 0x17e72
or edx, 0xa31e
and edx, 0x283
pop edx
push edi
push ecx
add esp, 4
add edi, 0x2ffe
add edi, 0x5d46
pop edi
push edi
or edi, 0xcb67
pop edi
jmp 0x4207d7
mov dword [ebp - 0x158], 7
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x124], eax
push ebx
push edi
add esp, 4
and ebx, 0x150d7
or ebx, 0xcffa
add ebx, 0xc282
pop ebx
push esi
call 0x420620
add byte [0x34423b42], dh
inc esp
dec esp
add esp, 4
pop esi
push eax
or eax, 0x3a9
invalid
add eax, dword [eax]
invalid
mov ecx, dword [ebp - 0x15c]
mov dword [ebp - 0x254], ecx
cmp dword [ebp - 0x254], 0
jne 0x4207d2
push esi
push ebx
add esp, 4
and esi, 0xc156
sub esi, 0xcd85
pop esi
push esi
call 0x4207ba
add byte [eax + 0x47], dl
inc edx
dec edi
inc esi
push eax
aas
cmp byte [ebx + 0x535e04c4], al
push ecx
add esp, 4
and ebx, 0x748b
pop ebx
mov edx, dword [ebp - 0x78]
push ebp
mov byte [ecx + 0xceb9855], cl
jmp 0x420599
mov dword [ebp - 0x68], 0
push edi
push ebx
add esp, 4
add edi, 0x169ee
pop edi
push edi
and edi, 0x17f91
jmp 0x4207f7
pop edi
push ebx
push ecx
add esp, 4
sub ebx, 0x18038
or ebx, 0xef96
xor ebx, 0xc76
pop ebx
mov eax, 1
imul ecx, eax, 0
lea edx, [ebp + ecx - 0x140]
mov dword [ebp - 0x258], edx
invalid
test dword [esp + edi*8 - 1], esp
Function at 0x4207ba
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ebp - 0x78]
add ecx, 1
mov dword [ebp - 0x78], ecx
mov edx, dword [ebp - 0x78]
sub edx, dword [ebp - 0xc4]
cmp edx, 0xffffffff
jb 0x4205e7
push edx
push eax
add esp, 4
sub edx, 0x17e72
or edx, 0xa31e
and edx, 0x283
pop edx
push edi
push ecx
add esp, 4
add edi, 0x2ffe
add edi, 0x5d46
pop edi
push edi
or edi, 0xcb67
pop edi
jmp 0x4207d7
mov dword [ebp - 0x158], 7
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x124], eax
push ebx
push edi
add esp, 4
and ebx, 0x150d7
or ebx, 0xcffa
add ebx, 0xc282
pop ebx
push esi
call 0x420620
add byte [0x34423b42], dh
inc esp
dec esp
add esp, 4
pop esi
push eax
or eax, 0x3a9
invalid
add eax, dword [eax]
invalid
mov ecx, dword [ebp - 0x15c]
mov dword [ebp - 0x254], ecx
cmp dword [ebp - 0x254], 0
jne 0x4207d2
push esi
push ebx
add esp, 4
and esi, 0xc156
sub esi, 0xcd85
pop esi
push esi
call 0x4207ba
add byte [eax + 0x47], dl
inc edx
dec edi
inc esi
push eax
aas
cmp byte [ebx + 0x535e04c4], al
push ecx
add esp, 4
and ebx, 0x748b
pop ebx
mov edx, dword [ebp - 0x78]
push ebp
mov byte [ecx + 0xceb9855], cl
jmp 0x420599
mov dword [ebp - 0x68], 0
push edi
push ebx
add esp, 4
add edi, 0x169ee
pop edi
push edi
and edi, 0x17f91
jmp 0x4207f7
pop edi
push ebx
push ecx
add esp, 4
sub ebx, 0x18038
or ebx, 0xef96
xor ebx, 0xc76
pop ebx
mov eax, 1
imul ecx, eax, 0
lea edx, [ebp + ecx - 0x140]
mov dword [ebp - 0x258], edx
invalid
test dword [esp + edi*8 - 1], esp

Function at 0x420840
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp al, 0x40
dec ebp
cmp dword [eax - 0x7d], edx
add esp, 4
pop eax

Function at 0x420845
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp al, 0x40
dec ebp
cmp dword [eax - 0x7d], edx
add esp, 4
pop eax

Function at 0x4208f5
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop eax
push edi
push edx
add esp, 4
xor edi, 0xa4ce
add edi, 0x6040
add edi, 0xc1c8
pop edi
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x7c], eax
jmp 0x420875
mov edx, dword [ebp - 0x7c]
sub edx, dword [ebp - 0xc4]
cmp edx, 0xffffffff
jb 0x4208ba
push ecx
jmp 0x42088c
pop ecx
push ebx
sub ebx, 0xd992
xor ebx, 0x184ac
xor ebx, 0xdb27
jmp 0x4208a5
pop ebx
push ecx
and ecx, 0xf2dd
pop ecx
push edi
jmp 0x4208b4
pop edi
jmp 0x420aad
mov dword [ebp - 0x160], 7
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x12c], eax
push edx
or edx, 0x8ebc
or edx, 0xef1c
sub edx, 0x284
pop edx
push edx
add edx, 0x1424a
call 0x4208f5
add byte [ebx + 0x46], al
push eax
inc ebx
xor al, 0x37
dec esi
add esp, 4
and edx, 0x4db0
pop edx
mov ecx, dword [ebp - 0x258]
mov dword [ebp - 0x130], ecx
mov dword [ebp - 0x164], 0
mov edx, dword [ebp - 0x7c]
cmp edx, dword [ebp - 0x258]
push dword [ebp + 0x11]
invalid
invalid
pushfd
Function at 0x420956
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ebp - 0x7c]
add ecx, 1
mov dword [ebp - 0x7c], ecx
cmp dword [ebp - 0x160], 0
jle 0x420a56
push esi
push esi
add esp, 4
jmp 0x420949
call 0x420956
add byte [edi], dh
cmp dword [esi + 0x4f], eax
inc ebx
cmp byte [edi], bh
add esp, 4
cmp edx, ecx
je 0x4209f2
push ebx
sub ebx, 0xa1ad
jmp 0x420937
mov eax, dword [0xf3810000]
dec edx
inc edx
add dword [eax], eax
add ebx, 0x668f
pop ebx
push ebx
push edx
add esp, 4
sub ebx, 0xff34
or ebx, 0xaef5
or ebx, 0x887c
add ebx, 0x14a12
pop ebx
mov edx, dword [ebp - 0x12c]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x130]
movzx edx, byte [ecx]
cmp eax, edx
jle 0x4209da
mov dword [ebp - 0x25c], 1
jmp 0x4209e4
mov dword [ebp - 0x25c], 0xffffffff
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 0x164], eax
jmp 0x420a56
push ebx
push esi
add esp, 4
sub ebx, 0x13d3d
and ebx, 0x15586
and ebx, 0x1e12
pop ebx
push edi
sub edi, 0xcc46
sub edi, 0x16329
pop edi
push eax
push edx
add esp, 4
or eax, 0x15888
pop eax
mov ecx, dword [ebp - 0x160]
sub ecx, 1
mov dword [ebp - 0x160], ecx
mov edx, dword [ebp - 0x12c]
add edx, 1
mov dword [ebp - 0x12c], edx
mov eax, dword [ebp - 0x130]
add eax, 1
mov dword [ebp - 0x130], eax
jmp 0x420931
mov ecx, dword [ebp - 0x164]
mov dword [ebp - 0x260], ecx
cmp dword [ebp - 0x260], 0
jne 0x420aa8
push edi
push esi
add esp, 4
and edi, 0x11397
add al, ch
or eax, dword [eax]
add byte [eax], al
add byte [esi + 0x3e], cl
cmp byte [edx + 0x3f], al
aas
xor bh, byte [ecx]
inc ebx
add esp, 4
call 0x420a99
add byte [ecx], bh
dec edx
inc edx
cmp byte ss:[edx], dh
inc esi
cmp ecx, dword [eax + edi - 0x7d]
les eax, [edi + ebx*2]
mov edx, dword [ebp - 0x7c]
mov dword [ebp - 0x134], edx
int3
invalid
invalid
invalid
jmp 0x42086c

Function at 0x42096c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
pop esi
push ebx
push edx
add esp, 4
call 0x42096c
add byte [esi + esi], bh
cmp edi, dword [0x833d493c]
les eax, [ebx + ebx*2]
mov ecx, dword [ebp - 0x12c]
Function at 0x420982
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ebp - 0x7c]
add ecx, 1
mov dword [ebp - 0x7c], ecx
cmp dword [ebp - 0x160], 0
jle 0x420a56
push esi
push esi
add esp, 4
jmp 0x420949
call 0x420956
add byte [edi], dh
cmp dword [esi + 0x4f], eax
inc ebx
cmp byte [edi], bh
add esp, 4
cmp edx, ecx
je 0x4209f2
push ebx
sub ebx, 0xa1ad
jmp 0x420937
mov eax, dword [0xf3810000]
dec edx
inc edx
add dword [eax], eax
add ebx, 0x668f
pop ebx
push ebx
push edx
add esp, 4
sub ebx, 0xff34
or ebx, 0xaef5
or ebx, 0x887c
add ebx, 0x14a12
pop ebx
mov edx, dword [ebp - 0x12c]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x130]
movzx edx, byte [ecx]
cmp eax, edx
jle 0x4209da
mov dword [ebp - 0x25c], 1
jmp 0x4209e4
mov dword [ebp - 0x25c], 0xffffffff
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 0x164], eax
jmp 0x420a56
push ebx
push esi
add esp, 4
sub ebx, 0x13d3d
and ebx, 0x15586
and ebx, 0x1e12
pop ebx
push edi
sub edi, 0xcc46
sub edi, 0x16329
pop edi
push eax
push edx
add esp, 4
or eax, 0x15888
pop eax
mov ecx, dword [ebp - 0x160]
sub ecx, 1
mov dword [ebp - 0x160], ecx
mov edx, dword [ebp - 0x12c]
add edx, 1
mov dword [ebp - 0x12c], edx
mov eax, dword [ebp - 0x130]
add eax, 1
mov dword [ebp - 0x130], eax
jmp 0x420931
mov ecx, dword [ebp - 0x164]
mov dword [ebp - 0x260], ecx
cmp dword [ebp - 0x260], 0
jne 0x420aa8
push edi
push esi
add esp, 4
and edi, 0x11397
add al, ch
or eax, dword [eax]
add byte [eax], al
add byte [esi + 0x3e], cl
cmp byte [edx + 0x3f], al
aas
xor bh, byte [ecx]
inc ebx
add esp, 4
call 0x420a99
add byte [ecx], bh
dec edx
inc edx
cmp byte ss:[edx], dh
inc esi
cmp ecx, dword [eax + edi - 0x7d]
les eax, [edi + ebx*2]
mov edx, dword [ebp - 0x7c]
mov dword [ebp - 0x134], edx
int3
invalid
invalid
invalid
jmp 0x42086c
Function at 0x420988
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ebp - 0x7c]
add ecx, 1
mov dword [ebp - 0x7c], ecx
cmp dword [ebp - 0x160], 0
jle 0x420a56
push esi
push esi
add esp, 4
jmp 0x420949
call 0x420956
add byte [edi], dh
cmp dword [esi + 0x4f], eax
inc ebx
cmp byte [edi], bh
add esp, 4
cmp edx, ecx
je 0x4209f2
push ebx
sub ebx, 0xa1ad
jmp 0x420937
mov eax, dword [0xf3810000]
dec edx
inc edx
add dword [eax], eax
add ebx, 0x668f
pop ebx
push ebx
push edx
add esp, 4
sub ebx, 0xff34
or ebx, 0xaef5
or ebx, 0x887c
add ebx, 0x14a12
pop ebx
mov edx, dword [ebp - 0x12c]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x130]
movzx edx, byte [ecx]
cmp eax, edx
jle 0x4209da
mov dword [ebp - 0x25c], 1
jmp 0x4209e4
mov dword [ebp - 0x25c], 0xffffffff
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 0x164], eax
jmp 0x420a56
push ebx
push esi
add esp, 4
sub ebx, 0x13d3d
and ebx, 0x15586
and ebx, 0x1e12
pop ebx
push edi
sub edi, 0xcc46
sub edi, 0x16329
pop edi
push eax
push edx
add esp, 4
or eax, 0x15888
pop eax
mov ecx, dword [ebp - 0x160]
sub ecx, 1
mov dword [ebp - 0x160], ecx
mov edx, dword [ebp - 0x12c]
add edx, 1
mov dword [ebp - 0x12c], edx
mov eax, dword [ebp - 0x130]
add eax, 1
mov dword [ebp - 0x130], eax
jmp 0x420931
mov ecx, dword [ebp - 0x164]
mov dword [ebp - 0x260], ecx
cmp dword [ebp - 0x260], 0
jne 0x420aa8
push edi
push esi
add esp, 4
and edi, 0x11397
add al, ch
or eax, dword [eax]
add byte [eax], al
add byte [esi + 0x3e], cl
cmp byte [edx + 0x3f], al
aas
xor bh, byte [ecx]
inc ebx
add esp, 4
call 0x420a99
add byte [ecx], bh
dec edx
inc edx
cmp byte ss:[edx], dh
inc esi
cmp ecx, dword [eax + edi - 0x7d]
les eax, [edi + ebx*2]
mov edx, dword [ebp - 0x7c]
mov dword [ebp - 0x134], edx
int3
invalid
invalid
invalid
jmp 0x42086c
Function at 0x420a86
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ebp - 0x7c]
add ecx, 1
mov dword [ebp - 0x7c], ecx
cmp dword [ebp - 0x160], 0
jle 0x420a56
push esi
push esi
add esp, 4
jmp 0x420949
call 0x420956
add byte [edi], dh
cmp dword [esi + 0x4f], eax
inc ebx
cmp byte [edi], bh
add esp, 4
cmp edx, ecx
je 0x4209f2
push ebx
sub ebx, 0xa1ad
jmp 0x420937
mov eax, dword [0xf3810000]
dec edx
inc edx
add dword [eax], eax
add ebx, 0x668f
pop ebx
push ebx
push edx
add esp, 4
sub ebx, 0xff34
or ebx, 0xaef5
or ebx, 0x887c
add ebx, 0x14a12
pop ebx
mov edx, dword [ebp - 0x12c]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x130]
movzx edx, byte [ecx]
cmp eax, edx
jle 0x4209da
mov dword [ebp - 0x25c], 1
jmp 0x4209e4
mov dword [ebp - 0x25c], 0xffffffff
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 0x164], eax
jmp 0x420a56
push ebx
push esi
add esp, 4
sub ebx, 0x13d3d
and ebx, 0x15586
and ebx, 0x1e12
pop ebx
push edi
sub edi, 0xcc46
sub edi, 0x16329
pop edi
push eax
push edx
add esp, 4
or eax, 0x15888
pop eax
mov ecx, dword [ebp - 0x160]
sub ecx, 1
mov dword [ebp - 0x160], ecx
mov edx, dword [ebp - 0x12c]
add edx, 1
mov dword [ebp - 0x12c], edx
mov eax, dword [ebp - 0x130]
add eax, 1
mov dword [ebp - 0x130], eax
jmp 0x420931
mov ecx, dword [ebp - 0x164]
mov dword [ebp - 0x260], ecx
cmp dword [ebp - 0x260], 0
jne 0x420aa8
push edi
push esi
add esp, 4
and edi, 0x11397
add al, ch
or eax, dword [eax]
add byte [eax], al
add byte [esi + 0x3e], cl
cmp byte [edx + 0x3f], al
aas
xor bh, byte [ecx]
inc ebx
add esp, 4
call 0x420a99
add byte [ecx], bh
dec edx
inc edx
cmp byte ss:[edx], dh
inc esi
cmp ecx, dword [eax + edi - 0x7d]
les eax, [edi + ebx*2]
mov edx, dword [ebp - 0x7c]
mov dword [ebp - 0x134], edx
int3
invalid
invalid
invalid
jmp 0x42086c
Function at 0x420a99
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ebp - 0x7c]
add ecx, 1
mov dword [ebp - 0x7c], ecx
cmp dword [ebp - 0x160], 0
jle 0x420a56
push esi
push esi
add esp, 4
jmp 0x420949
call 0x420956
add byte [edi], dh
cmp dword [esi + 0x4f], eax
inc ebx
cmp byte [edi], bh
add esp, 4
cmp edx, ecx
je 0x4209f2
push ebx
sub ebx, 0xa1ad
jmp 0x420937
mov eax, dword [0xf3810000]
dec edx
inc edx
add dword [eax], eax
add ebx, 0x668f
pop ebx
push ebx
push edx
add esp, 4
sub ebx, 0xff34
or ebx, 0xaef5
or ebx, 0x887c
add ebx, 0x14a12
pop ebx
mov edx, dword [ebp - 0x12c]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x130]
movzx edx, byte [ecx]
cmp eax, edx
jle 0x4209da
mov dword [ebp - 0x25c], 1
jmp 0x4209e4
mov dword [ebp - 0x25c], 0xffffffff
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 0x164], eax
jmp 0x420a56
push ebx
push esi
add esp, 4
sub ebx, 0x13d3d
and ebx, 0x15586
and ebx, 0x1e12
pop ebx
push edi
sub edi, 0xcc46
sub edi, 0x16329
pop edi
push eax
push edx
add esp, 4
or eax, 0x15888
pop eax
mov ecx, dword [ebp - 0x160]
sub ecx, 1
mov dword [ebp - 0x160], ecx
mov edx, dword [ebp - 0x12c]
add edx, 1
mov dword [ebp - 0x12c], edx
mov eax, dword [ebp - 0x130]
add eax, 1
mov dword [ebp - 0x130], eax
jmp 0x420931
mov ecx, dword [ebp - 0x164]
mov dword [ebp - 0x260], ecx
cmp dword [ebp - 0x260], 0
jne 0x420aa8
push edi
push esi
add esp, 4
and edi, 0x11397
add al, ch
or eax, dword [eax]
add byte [eax], al
add byte [esi + 0x3e], cl
cmp byte [edx + 0x3f], al
aas
xor bh, byte [ecx]
inc ebx
add esp, 4
call 0x420a99
add byte [ecx], bh
dec edx
inc edx
cmp byte ss:[edx], dh
inc esi
cmp ecx, dword [eax + edi - 0x7d]
les eax, [edi + ebx*2]
mov edx, dword [ebp - 0x7c]
mov dword [ebp - 0x134], edx
int3
invalid
invalid
invalid
jmp 0x42086c

Function at 0x420ac6
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or edi, 0x157d5
or edi, 0x15548
pop edi
push edx
and edx, 0xe205
jmp fcn.00420ae2

Function at 0x420ae2
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
jmp 0x420ae8
pop edx
mov byte [ebp - 0xf0], 0x45
mov byte [ebp - 0xef], 0x78
mov byte [ebp - 0xee], 0x69
invalid
test dword [ebx], edx
invalid

Function at 0x420c72
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
and ebx, 0x11efc
and ebx, 0xcede
pop ebx
push edx
push edx
add esp, 4
sub edx, 0x75eb
add byte [eax], al
Function at 0x420ccd
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x420cd7
pop ecx
push eax
push eax
add esp, 4
jmp 0x420ce6
xor eax, 0x2c1f
pop eax
cmp dword [ebp - 0x170], 0
jne 0x420d02
mov dword [ebp - 0x44], 0
jmp 0x420f22
mov edx, dword [ebp - 0x170]
mov dword [ebp - 0x84], edx
push ecx
add ecx, 0x1255f
rcr dword [edi + 0x25], 1
add byte [ecx + 0x53], bl
push edi
add esp, 4
and ebx, 0xd94
sub ebx, 0xc3f4
xor ebx, 0xacb7
pop ebx
push esi
push esi
add esp, 4
or esi, 0x17342
and esi, 0x763b
pop esi
lea eax, [ebp - 0x27c]
mov dword [ebp - 0x16c], eax
mov ecx, dword [ebp - 0x84]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x168], edx
xor eax, eax
mov word [ebp - 0x30], ax
xor ecx, ecx
mov word [ebp - 0x14], cx
push ecx
push ecx
add esp, 4
sub ecx, 0xf48a
and ecx, 0x8a8e
or ecx, 0xd94b
or ecx, 0x130a7
pop ecx
push eax
add eax, 0xff44
xor eax, 0x74dc
or eax, 0x122a
pop eax
invalid
xchg ebp, eax
cwde
invalid
invalid
Function at 0x4222d3
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
mov word [ebp - 0x292], ax
mov ecx, 0x65
mov word [ebp - 0x290], cx
mov edx, 0x6c
mov word [ebp - 0x28e], dx

Function at 0x4222f4
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x33
mov word [ebp - 0x28c], ax
mov ecx, 0x32
mov word [ebp - 0x28a], cx
mov edx, 0x2e
mov word [ebp - 0x288], dx
mov eax, 0x64
mov word [ebp - 0x286], ax
mov ecx, 0x6c
mov word [ebp - 0x284], cx
mov edx, 0x6c
mov word [ebp - 0x282], dx
xor eax, eax
mov word [ebp - 0x280], ax
push ebx
push ecx
add esp, 4
and ebx, 0x172
xor ebx, 0xf8ec
xor ebx, 0x9ce7
pop ebx
push esi
and esi, 0x7616
or esi, 0x14912
pop esi
push ecx
push esi
add esp, 4
or ecx, 0x17cc5
pop ecx
mov byte [ebp - 0x110], 0x4c
mov byte [ebp - 0x10f], 0x6f
mov byte [ebp - 0x10e], 0x61
mov byte [ebp - 0x10d], 0x64
mov byte [ebp - 0x10c], 0x4c
mov byte [ebp - 0x10b], 0x69
mov byte [ebp - 0x10a], 0x62
mov byte [ebp - 0x109], 0x72
mov byte [ebp - 0x108], 0x61
mov byte [ebp - 0x107], 0x72
mov byte [ebp - 0x106], 0x79
mov byte [ebp - 0x105], 0x57
mov byte [ebp - 0x104], 0
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x2e0], ecx
mov edx, dword [ebp - 0x2e0]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x2e4], eax
mov ecx, dword [ebp - 0x2e4]
mov dword [ebp - 0x218], ecx
push eax
sub eax, 0x148f8
pop eax
push ecx
sub ecx, 0xd4d0
pop ecx
push edx
push edi
add esp, 4
jmp 0x422415
and edx, 0x22b9
pop edx
push esi
add esi, 0x55a7
pop esi
push esi
and esi, 0xb68e
pop esi
cmp dword [ebp - 0x218], 0
jne 0x422444
mov dword [ebp - 0xa8], 0
jmp 0x4226b1
mov edx, dword [ebp - 0x218]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x1a8], ecx
push esi
or esi, 0x6901
add esi, 0x2866
or esi, 0xe8be
sub esi, 0xe39
pop esi
push eax
push edi
add esp, 4
and eax, 0x3ce6
add eax, 0xd92c
xor eax, 0x364c
pop eax
cmp dword [ebp - 0x1a8], 0
jne 0x4224a0
mov dword [ebp - 0xa8], 0
jmp 0x4226b1
mov edx, dword [ebp - 0x1a8]
mov dword [ebp - 0x74], edx
Function at 0x422521
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
jmp 0x422505
add ecx, 0x9d0a
pop ecx
push ecx
push ebx
add esp, 4
call fcn.00422521
add byte [edx], dh
cmp dh, byte ds:[edi]
cmp al, 0x3f
xor esi, dword [ecx + ecx*2]
dec esp
add esp, 4
xor ecx, 0xcb0e
or ecx, 0xf086
pop ecx
mov edx, dword [ebp - 0x1a0]
mov ax, word [edx]
mov word [ebp - 0x14e], ax
mov ecx, dword [ebp - 0x1a0]
add ecx, 2
mov dword [ebp - 0x1a0], ecx
mov dx, word [ebp - 0x14e]
mov word [ebp - 0x3c], dx
mov eax, dword [ebp - 0x1a4]
mov cx, word [eax]
mov word [ebp - 0x150], cx
mov edx, dword [ebp - 0x1a4]
add edx, 2
mov dword [ebp - 0x1a4], edx
mov ax, word [ebp - 0x150]
mov word [ebp - 0x24], ax
push edx
push edx
add esp, 4
jmp 0x422592
or edx, 0x129db
sub edx, 0x142a1
pop edx
push ebx
push ecx
add esp, 4
and ebx, 0x10ce7
or ebx, 0x4e70
add ebx, 0xf4c0
pop ebx
movzx ecx, word [ebp - 0x24]
test ecx, ecx
jne 0x4225d1
movzx edx, word [ebp - 0x3c]
movzx eax, word [ebp - 0x24]
sub edx, eax
mov dword [ebp - 0x220], edx
jmp 0x42260f
movzx ecx, word [ebp - 0x3c]
movzx edx, word [ebp - 0x24]
cmp ecx, edx
je 0x4224ff
movzx eax, word [ebp - 0x3c]
movzx ecx, word [ebp - 0x24]
cmp eax, ecx
jge 0x4225f9
mov dword [ebp - 0x21c], 0xffffffff
jmp 0x422603
mov dword [ebp - 0x21c], 1
mov edx, dword [ebp - 0x21c]
mov dword [ebp - 0x220], edx
cmp dword [ebp - 0x220], 0
jne 0x422655
push eax
push edi
add esp, 4
sub eax, 0x18117
and eax, 0x14b5b
xor eax, 0x102a5
pop eax
push edi
add edi, 0xd107
and edi, 0x142b5
jmp 0x422643
jmp 0x422649
pop edi
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0xa8], eax
jmp 0x4226b1
push ecx
push ecx
add esp, 4
xor ecx, 0xe706
call 0x422670
add byte [eax + 0x41], al
aaa
dec edx
aaa
inc ebx
aaa
inc ecx
add esp, 4
pop ecx
push ebx
call 0x422683
add byte [edx], dh
dec esi
cmp dword [esp + esi], esi
inc esp
dec esi
inc ebp
add esp, 4
pop ebx
mov ecx, dword [ebp - 0x74]
Function at 0x422670
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
jmp 0x422505
add ecx, 0x9d0a
pop ecx
push ecx
push ebx
add esp, 4
call fcn.00422521
add byte [edx], dh
cmp dh, byte ds:[edi]
cmp al, 0x3f
xor esi, dword [ecx + ecx*2]
dec esp
add esp, 4
xor ecx, 0xcb0e
or ecx, 0xf086
pop ecx
mov edx, dword [ebp - 0x1a0]
mov ax, word [edx]
mov word [ebp - 0x14e], ax
mov ecx, dword [ebp - 0x1a0]
add ecx, 2
mov dword [ebp - 0x1a0], ecx
mov dx, word [ebp - 0x14e]
mov word [ebp - 0x3c], dx
mov eax, dword [ebp - 0x1a4]
mov cx, word [eax]
mov word [ebp - 0x150], cx
mov edx, dword [ebp - 0x1a4]
add edx, 2
mov dword [ebp - 0x1a4], edx
mov ax, word [ebp - 0x150]
mov word [ebp - 0x24], ax
push edx
push edx
add esp, 4
jmp 0x422592
or edx, 0x129db
sub edx, 0x142a1
pop edx
push ebx
push ecx
add esp, 4
and ebx, 0x10ce7
or ebx, 0x4e70
add ebx, 0xf4c0
pop ebx
movzx ecx, word [ebp - 0x24]
test ecx, ecx
jne 0x4225d1
movzx edx, word [ebp - 0x3c]
movzx eax, word [ebp - 0x24]
sub edx, eax
mov dword [ebp - 0x220], edx
jmp 0x42260f
movzx ecx, word [ebp - 0x3c]
movzx edx, word [ebp - 0x24]
cmp ecx, edx
je 0x4224ff
movzx eax, word [ebp - 0x3c]
movzx ecx, word [ebp - 0x24]
cmp eax, ecx
jge 0x4225f9
mov dword [ebp - 0x21c], 0xffffffff
jmp 0x422603
mov dword [ebp - 0x21c], 1
mov edx, dword [ebp - 0x21c]
mov dword [ebp - 0x220], edx
cmp dword [ebp - 0x220], 0
jne 0x422655
push eax
push edi
add esp, 4
sub eax, 0x18117
and eax, 0x14b5b
xor eax, 0x102a5
pop eax
push edi
add edi, 0xd107
and edi, 0x142b5
jmp 0x422643
jmp 0x422649
pop edi
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0xa8], eax
jmp 0x4226b1
push ecx
push ecx
add esp, 4
xor ecx, 0xe706
call 0x422670
add byte [eax + 0x41], al
aaa
dec edx
aaa
inc ebx
aaa
inc ecx
add esp, 4
pop ecx
push ebx
call 0x422683
add byte [edx], dh
dec esi
cmp dword [esp + esi], esi
inc esp
dec esi
inc ebp
add esp, 4
pop ebx
mov ecx, dword [ebp - 0x74]