joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45a9b0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, ecx
push ebp
push esi
mov eax, dword [ebx + 0x13c]
push edi
test eax, eax
jle 0x45a9fc
mov eax, dword [ebx + 0x140]
test eax, eax
jle 0x45a9fc
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
lea edi, [ebx + 0x150]
mov eax, dword [edi]
test eax, eax
je 0x45a9e6
push eax
call ebp
test ax, ax
jl 0x45a9f4
inc esi
add edi, 4
cmp esi, 6
jb 0x45a9d8
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
mov ecx, ebx
call fcn.0045a6b0
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x45ce80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x9c
push esi
mov esi, ecx
mov dword [esp + 0x18], esi
mov eax, dword [esi + 0x44c]
test eax, eax
je 0x45d4cb
mov eax, dword [esp + 0xa4]
cmp eax, 1
jge 0x45ceac
mov eax, 1
mov ecx, dword [esp + 0xa8]
mov dword [esp + 0x14], eax
cmp ecx, 1
mov dword [esp + 0xc], 1
jl 0x45cec8
mov dword [esp + 0xc], ecx
fild dword [esi + 0x18]
push ebx
mov ebx, dword [esi + 0x444]
imul ebx, eax
fidiv dword [esp + 0x18]
push ebp
push edi
test bl, 3
mov dword [esp + 0x3c], ebx
fild dword [esi + 0x1c]
fidiv dword [esp + 0x18]
fstp dword [esp + 0x28]
je 0x45cef9
inc ebx
test bl, 3
jne 0x45ceef
mov dword [esp + 0x3c], ebx
fmul dword [0x49a5ec]
call fcn.00460438
fld dword [esp + 0x28]
fmul dword [0x49a5ec]
mov dword [esp + 0x50], eax
call fcn.00460438
mov edi, ebx
mov dword [esp + 0x58], eax
imul edi, dword [esp + 0x18]
push edi
mov dword [esp + 0x68], edi
call fcn.004616b7
mov ebp, eax
mov eax, dword [esi + 0x44c]
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x1c]
xor edx, edx
add esp, 4
cmp eax, edx
mov dword [esp + 0x5c], ebp
mov dword [esp + 0x30], edx
mov dword [esp + 0x28], edx
jle 0x45d499

Function at 0x45d9c0
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [ecx + 0xcc], 1
je 0x45da20
mov eax, dword [ecx + 0x1c]
test eax, eax
je 0x45da20
mov eax, dword [ecx + 0xb0]
test eax, eax
je 0x45da20
push esi
mov edx, 5
mov esi, dword [ecx + 0xbc]
cmp esi, edx
pop esi
je 0x45da20
mov dword [ecx + 0xb4], eax
mov dword [ecx + 0x94], 0
mov dword [ecx + 0xbc], edx
lea eax, [esp]
push eax
push 0
push ecx
push 0x45da30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
ret
Function at 0x472c89
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x472cc1
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00470d40
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00470d18
jmp 0x472ccd
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x47437e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4743c0
call fcn.0047a025
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4743c0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4743b7
xor eax, eax
jmp 0x4743c8
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004743ce
pop edi
pop esi
pop ebx
ret 4

Function at 0x47a555
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x47a583
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x47a5a1
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0047a4bb
jmp 0x47a5a1
mov eax, dword [esi + 0x14]
test eax, eax
je 0x47a5a1
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0047a4bb
test edi, edi
mov eax, edi
jne 0x47a58b
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x402730
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebx
push ebp
push esi
push edi
mov ebp, ecx
push 1
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x402833
call sub.MFC42.DLL_AfxGetThread
test eax, eax
je 0x402758
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x7c]
jmp 0x40275a
xor eax, eax
mov eax, dword [eax + 0x20]
mov esi, dword [sym.imp.USER32.dll_OpenClipboard]
push eax
call esi
call sub.MFC42.DLL_AfxGetThread
test eax, eax
je 0x402778
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x7c]
jmp 0x40277a
xor eax, eax
mov eax, dword [eax + 0x20]
push eax
call esi
test eax, eax
je 0x402833
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
test edi, edi
je 0x40282d
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, dword [esp + 0x14]
push eax
mov ecx, esi
call sub.MFC42.DLL_CString::operator
mov ecx, dword [esi]
mov eax, dword [ecx - 8]
test eax, eax
je 0x402826
lea edx, [esp + 0x14]
push 2
push edx
mov ecx, esi
call sub.MFC42.DLL_CString::Left
mov eax, dword [eax]
push 0x4060c0
push eax
call dword [sym.imp.MSVCRT.dll__mbsicmp]
add esp, 8
lea ecx, [esp + 0x14]
test eax, eax
sete bl
call fcn.00403198
push ecx
test bl, bl
mov ecx, esp
je 0x4027fd
mov dword [esp + 0x18], esp
push esi
call sub.MFC42.DLL_CString::CString_2
mov ecx, ebp
call fcn.00402440
jmp 0x40280e
mov dword [esp + 0x18], esp
push esi
call sub.MFC42.DLL_CString::CString_2
mov ecx, ebp
call fcn.00402580
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 4

Function at 0x7a6e2c
Capabilities:
Encode data using xor

Disassembly:
jmp 0x7a6e36
pushal
call 0x7a6e3c
pop ebp
sub ebp, 0x10
sub ebp, 0x3a6e2c
mov al, byte [esp + 0x28]
cmp al, 1
je 0x7a6e60
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x7a6e69
mov eax, 0x3a6e2c
add eax, ebp
add eax, 0x63
mov ecx, 0x5ed
mov edx, 0x7d7e9045
xor byte [eax], dl
inc eax
dec ecx
jne 0x7a6e80
jmp 0x7a6e93
into
mov dh, cl
int3
Function at 0x866058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x8661a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x86607e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x86606a
add dl, dl
jne 0x866089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8660dc
xor eax, eax
add dl, dl
jne 0x866096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x86617d
add dl, dl
jne 0x8660a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8660b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8660bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8660c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x8660d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x866075
mov eax, 1
add dl, dl
jne 0x8660ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8660f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8660e1
sub eax, ebx
mov ebx, 1
jne 0x866128
mov ecx, 1
add dl, dl
jne 0x86610e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x866119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x866105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x866075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x86613f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x86614a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x866136
cmp eax, 0x7d00
jae 0x86616d
cmp eax, 0x500
jb 0x866168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x866075
cmp eax, 0x7f
ja 0x866170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x866075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x86619e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x866075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x403ba0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0x6c90ac]
test eax, eax
je 0x403bae
jmp fcn.004464e0
ret

Function at 0x403ea0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0x6c90b8]
test eax, eax
je 0x403eae
jmp fcn.004464e0
ret

Function at 0x404160
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0x6c90c0]
test eax, eax
je 0x40416e
jmp fcn.004464e0
ret
Function at 0x41c1a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5e6698
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebp
push esi
push edi
push ebx
call fcn.0041b4f0
xor esi, esi
push 0x320
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], 0xc8
call fcn.00445250
add esp, 4
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 0xc]
push eax
push ecx
mov dword [esp + 0x28], esi
call fcn.004b4310
mov edi, dword [esp + 0x30]
mov ecx, eax
call fcn.004b4a30
mov edi, dword [esp + 0x10]
cmp edi, esi
mov ebp, dword [esp + 0x14]
jle 0x41c220
lea ebx, [ebx]
mov edx, dword [ebp + esi*4]
mov eax, ebx
call fcn.0041c090
inc esi
cmp esi, edi
jl 0x41c210
test ebp, ebp
je 0x41c22d
push ebp
call fcn.004452b0
add esp, 4
mov ecx, dword [esp + 0x18]
mov eax, edi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x18
ret 8

Function at 0x41c250
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5e6698
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x24]
push edi
mov eax, ebp
call fcn.0041b410
xor edi, edi
push 0x320
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], 0xc8
call fcn.00445250
add esp, 4
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0xc]
push eax
push ecx
mov dword [esp + 0x28], edi
call fcn.004b4310
mov ebx, dword [esp + 0x34]
mov ecx, eax
call fcn.004b4e60
mov ebx, dword [esp + 0x10]
cmp ebx, edi
jle 0x41c2eb
push esi
lea esp, [esp]
mov edx, dword [esp + 0x18]
mov esi, dword [edx + edi*4]
cmp esi, dword [esp + 0x3c]
je 0x41c2e5
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x58]
mov cl, byte [esp + 0x38]
neg cl
sbb ecx, ecx
and ecx, esi
push ecx
push ebp
call fcn.0041bfd0
inc edi
cmp edi, ebx
jl 0x41c2c0
pop esi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x41c2fc
push eax
call fcn.004452b0
add esp, 4
mov ecx, dword [esp + 0x18]
pop edi
pop ebp
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 0x14

Function at 0x42fc50
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5e2d48
push eax
mov dword fs:[0], esp
push esi
mov esi, dword [esp + 0x14]
mov eax, esi
call fcn.0042fdf0
mov dword [esi + 8], vtable.LoadingManager::ProcessRequestsCallback.0
mov dword [esi + 0xc], vtable.PresentationEvent::PresentationEventCallBack.0
mov cl, byte [esi + 0x14]
xor eax, eax
and cl, 0xfc
mov byte [esi + 0x14], cl
mov ecx, dword [0x65ef14]
push eax
mov dword [esi], vtable.BootupContext.2.0
mov dword [esi + 8], vtable.BootupContext.1.0
mov dword [esi + 0xc], vtable.BootupContext.0
mov dword [esi + 0x10], 0xffffffff
mov dword [esi + 0x18], eax
mov edx, dword [ecx]
push str.simple
mov dword [esp + 0x14], eax
call dword [edx + 0x30]
mov dword [esi + 0x18], eax
mov edx, dword [eax]
mov ecx, eax
call dword [edx]
mov ecx, dword [esp + 4]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 4
Function at 0x44201e
Capabilities:
Get number of processors

Disassembly:
ror dword [ecx + 0x5157ec55], 1
add esp, 4
add edi, 0x656f
call 0x44201e
add byte [eax + 0x49], al
cmp edi, dword [edi]
xor eax, 0x833d3933
les eax, [ecx + eax*4]
add al, 0x81

Function at 0x442050
Capabilities:
Get number of processors

Disassembly:
leave
adc esi, dword [ebx]
add dword [eax], eax
and ecx, 0x12f7
invalid
invalid
das
sbb byte [eax], al

Function at 0x442060
Capabilities:
Get number of processors

Disassembly:
add byte [ecx + 0x18197e9], al
add byte [ecx - 0x39], bl
inc ebp
aam 1
add byte [eax], al
add byte [esi - 0x18], dl
pop es
add byte [eax], al
add byte [eax], al
cmp eax, 0x4a403c3f

Function at 0x44207c
Capabilities:
Get number of processors

Disassembly:
add esp, 4
and esi, 0x469b
call fcn.00442091
add byte [ebx], bh
aas
cmp edx, dword [eax + 0x40]

Function at 0x4420a0
Capabilities:
Get number of processors

Disassembly:
pop edx
imul edx, dword [ebp - 0x2c], 0x70
add edx, 0x44f3663b
imul eax, dword [ebp - 0x2c], 0x70
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x70
sub edx, ecx
invalid
push ebp

Function at 0x4420e0
Capabilities:
Get number of processors

Disassembly:
call 0x4420ee
add byte [ebp + 0x43], al
dec edx
dec edx
inc esp
inc esi
dec ebp
inc ebx
add esp, 4
and esi, 0x14b23
pop esi
mov edx, dword [ebp - 0x30]
add edx, 0x70
imul eax, dword [ebp - 0x2c], 0x70
add eax, 0x44f3663b
imul ecx, dword [ebp - 0x2c], 0x70
sub eax, ecx
xor edx, eax
imul edx, dword [ebp - 0x2c]
mov dword [ebp - 0x1d60], edx
push edx
push ecx
add esp, 4
and edx, 0x14fad
pop edx
push eax
and eax, 0x17d56
and eax, 0x13d11
pop eax
push edi
push edx
add esp, 4
or edi, 0x4c43
jmp 0x442144
add edi, 0x157b7
pop edi
mov edx, dword [ebp - 0x1d60]
add edx, 1
mov dword [ebp - 0x159c], edx
push eax
push esi
add esp, 4
xor eax, 0xe8c7
pop eax
push edx
xor edx, 0x32ab
pop edx
push ecx
xor ecx, 0x11c0f
pop ecx
push ebx
and ebx, 0x11066
pop ebx
push esi
sub esi, 0x2ab6
and esi, 0x4231
pop esi
push ecx
or ecx, 0x179bf
pop ecx
push edx
jmp 0x44219d
pop edx
push eax
xor eax, 0x1640f
call 0x4421b4
add byte [ebx + 0x35], al
cmp byte [ebp + 0x35], cl
xor al, byte [edi + esi + 0x50]
add esp, 4
xor eax, 0x1211d
pop eax
imul eax, dword [ebp - 0x2c], 0x70
add eax, 0x44f3663b
imul ecx, dword [ebp - 0x2c], 0x70
sub eax, ecx
xor eax, dword [ebp - 0x159c]
imul eax, dword [ebp - 0x2c]
imul edx, dword [ebp - 0x2c], 0x70
sub eax, edx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x159c]
imul eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1e28], eax
mov dword [ebp - 0x1628], 1
push eax
push edx
add esp, 4
xor eax, 0x6c33
sub eax, 0x133dc
call 0x44221a
add byte [ebp + 0x44], al
push eax
dec eax
inc edi
inc esi
xor edi, dword [esi]
add esp, 4
pop eax
push edi
add edi, 0x1144c
xor edi, 0x11328
pop edi
imul ecx, dword [ebp - 0x1628], 0x70
add ecx, 0x44f3663b
imul edx, dword [ebp - 0x1628], 0x70
sub ecx, edx
xor ecx, dword [ebp - 0x1e28]
imul ecx, dword [ebp - 0x1628]
imul eax, dword [ebp - 0x1628], 0x70
sub ecx, eax
mov dword [ebp - 0x162c], ecx
Function at 0x4420ee
Capabilities:
Get number of processors

Disassembly:
call 0x4420ee
add byte [ebp + 0x43], al
dec edx
dec edx
inc esp
inc esi
dec ebp
inc ebx
add esp, 4
and esi, 0x14b23
pop esi
mov edx, dword [ebp - 0x30]
add edx, 0x70
imul eax, dword [ebp - 0x2c], 0x70
add eax, 0x44f3663b
imul ecx, dword [ebp - 0x2c], 0x70
sub eax, ecx
xor edx, eax
imul edx, dword [ebp - 0x2c]
mov dword [ebp - 0x1d60], edx
push edx
push ecx
add esp, 4
and edx, 0x14fad
pop edx
push eax
and eax, 0x17d56
and eax, 0x13d11
pop eax
push edi
push edx
add esp, 4
or edi, 0x4c43
jmp 0x442144
add edi, 0x157b7
pop edi
mov edx, dword [ebp - 0x1d60]
add edx, 1
mov dword [ebp - 0x159c], edx
push eax
push esi
add esp, 4
xor eax, 0xe8c7
pop eax
push edx
xor edx, 0x32ab
pop edx
push ecx
xor ecx, 0x11c0f
pop ecx
push ebx
and ebx, 0x11066
pop ebx
push esi
sub esi, 0x2ab6
and esi, 0x4231
pop esi
push ecx
or ecx, 0x179bf
pop ecx
push edx
jmp 0x44219d
pop edx
push eax
xor eax, 0x1640f
call 0x4421b4
add byte [ebx + 0x35], al
cmp byte [ebp + 0x35], cl
xor al, byte [edi + esi + 0x50]
add esp, 4
xor eax, 0x1211d
pop eax
imul eax, dword [ebp - 0x2c], 0x70
add eax, 0x44f3663b
imul ecx, dword [ebp - 0x2c], 0x70
sub eax, ecx
xor eax, dword [ebp - 0x159c]
imul eax, dword [ebp - 0x2c]
imul edx, dword [ebp - 0x2c], 0x70
sub eax, edx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x159c]
imul eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1e28], eax
mov dword [ebp - 0x1628], 1
push eax
push edx
add esp, 4
xor eax, 0x6c33
sub eax, 0x133dc
call 0x44221a
add byte [ebp + 0x44], al
push eax
dec eax
inc edi
inc esi
xor edi, dword [esi]
add esp, 4
pop eax
push edi
add edi, 0x1144c
xor edi, 0x11328
pop edi
imul ecx, dword [ebp - 0x1628], 0x70
add ecx, 0x44f3663b
imul edx, dword [ebp - 0x1628], 0x70
sub ecx, edx
xor ecx, dword [ebp - 0x1e28]
imul ecx, dword [ebp - 0x1628]
imul eax, dword [ebp - 0x1628], 0x70
sub ecx, eax
mov dword [ebp - 0x162c], ecx
Function at 0x4421b4
Capabilities:
Get number of processors

Disassembly:
call 0x4420ee
add byte [ebp + 0x43], al
dec edx
dec edx
inc esp
inc esi
dec ebp
inc ebx
add esp, 4
and esi, 0x14b23
pop esi
mov edx, dword [ebp - 0x30]
add edx, 0x70
imul eax, dword [ebp - 0x2c], 0x70
add eax, 0x44f3663b
imul ecx, dword [ebp - 0x2c], 0x70
sub eax, ecx
xor edx, eax
imul edx, dword [ebp - 0x2c]
mov dword [ebp - 0x1d60], edx
push edx
push ecx
add esp, 4
and edx, 0x14fad
pop edx
push eax
and eax, 0x17d56
and eax, 0x13d11
pop eax
push edi
push edx
add esp, 4
or edi, 0x4c43
jmp 0x442144
add edi, 0x157b7
pop edi
mov edx, dword [ebp - 0x1d60]
add edx, 1
mov dword [ebp - 0x159c], edx
push eax
push esi
add esp, 4
xor eax, 0xe8c7
pop eax
push edx
xor edx, 0x32ab
pop edx
push ecx
xor ecx, 0x11c0f
pop ecx
push ebx
and ebx, 0x11066
pop ebx
push esi
sub esi, 0x2ab6
and esi, 0x4231
pop esi
push ecx
or ecx, 0x179bf
pop ecx
push edx
jmp 0x44219d
pop edx
push eax
xor eax, 0x1640f
call 0x4421b4
add byte [ebx + 0x35], al
cmp byte [ebp + 0x35], cl
xor al, byte [edi + esi + 0x50]
add esp, 4
xor eax, 0x1211d
pop eax
imul eax, dword [ebp - 0x2c], 0x70
add eax, 0x44f3663b
imul ecx, dword [ebp - 0x2c], 0x70
sub eax, ecx
xor eax, dword [ebp - 0x159c]
imul eax, dword [ebp - 0x2c]
imul edx, dword [ebp - 0x2c], 0x70
sub eax, edx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x159c]
imul eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1e28], eax
mov dword [ebp - 0x1628], 1
push eax
push edx
add esp, 4
xor eax, 0x6c33
sub eax, 0x133dc
call 0x44221a
add byte [ebp + 0x44], al
push eax
dec eax
inc edi
inc esi
xor edi, dword [esi]
add esp, 4
pop eax
push edi
add edi, 0x1144c
xor edi, 0x11328
pop edi
imul ecx, dword [ebp - 0x1628], 0x70
add ecx, 0x44f3663b
imul edx, dword [ebp - 0x1628], 0x70
sub ecx, edx
xor ecx, dword [ebp - 0x1e28]
imul ecx, dword [ebp - 0x1628]
imul eax, dword [ebp - 0x1628], 0x70
sub ecx, eax
mov dword [ebp - 0x162c], ecx
Function at 0x44221a
Capabilities:
Get number of processors

Disassembly:
call 0x4420ee
add byte [ebp + 0x43], al
dec edx
dec edx
inc esp
inc esi
dec ebp
inc ebx
add esp, 4
and esi, 0x14b23
pop esi
mov edx, dword [ebp - 0x30]
add edx, 0x70
imul eax, dword [ebp - 0x2c], 0x70
add eax, 0x44f3663b
imul ecx, dword [ebp - 0x2c], 0x70
sub eax, ecx
xor edx, eax
imul edx, dword [ebp - 0x2c]
mov dword [ebp - 0x1d60], edx
push edx
push ecx
add esp, 4
and edx, 0x14fad
pop edx
push eax
and eax, 0x17d56
and eax, 0x13d11
pop eax
push edi
push edx
add esp, 4
or edi, 0x4c43
jmp 0x442144
add edi, 0x157b7
pop edi
mov edx, dword [ebp - 0x1d60]
add edx, 1
mov dword [ebp - 0x159c], edx
push eax
push esi
add esp, 4
xor eax, 0xe8c7
pop eax
push edx
xor edx, 0x32ab
pop edx
push ecx
xor ecx, 0x11c0f
pop ecx
push ebx
and ebx, 0x11066
pop ebx
push esi
sub esi, 0x2ab6
and esi, 0x4231
pop esi
push ecx
or ecx, 0x179bf
pop ecx
push edx
jmp 0x44219d
pop edx
push eax
xor eax, 0x1640f
call 0x4421b4
add byte [ebx + 0x35], al
cmp byte [ebp + 0x35], cl
xor al, byte [edi + esi + 0x50]
add esp, 4
xor eax, 0x1211d
pop eax
imul eax, dword [ebp - 0x2c], 0x70
add eax, 0x44f3663b
imul ecx, dword [ebp - 0x2c], 0x70
sub eax, ecx
xor eax, dword [ebp - 0x159c]
imul eax, dword [ebp - 0x2c]
imul edx, dword [ebp - 0x2c], 0x70
sub eax, edx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x159c]
imul eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1e28], eax
mov dword [ebp - 0x1628], 1
push eax
push edx
add esp, 4
xor eax, 0x6c33
sub eax, 0x133dc
call 0x44221a
add byte [ebp + 0x44], al
push eax
dec eax
inc edi
inc esi
xor edi, dword [esi]
add esp, 4
pop eax
push edi
add edi, 0x1144c
xor edi, 0x11328
pop edi
imul ecx, dword [ebp - 0x1628], 0x70
add ecx, 0x44f3663b
imul edx, dword [ebp - 0x1628], 0x70
sub ecx, edx
xor ecx, dword [ebp - 0x1e28]
imul ecx, dword [ebp - 0x1628]
imul eax, dword [ebp - 0x1628], 0x70
sub ecx, eax
mov dword [ebp - 0x162c], ecx

Function at 0x4422a0
Capabilities:
Get number of processors

Disassembly:
add byte [ecx + 0x12b5e9], al
add byte [ecx + 0x53], bl
or ebx, 0x1a6d
and ebx, 0x8044
jecxz 0x4422f6
add byte [eax], 0

Function at 0x4422b0
Capabilities:
Get number of processors

Disassembly:
jecxz 0x4422f6
add byte [eax], 0
pop ebx
push ebx
push eax
add esp, 4
and ebx, 0x14249
pop ebx
push esi
push eax
add esp, 4
add esi, 0x2315
pop esi
push edi
push esi

Function at 0x4422d0
Capabilities:
Get number of processors

Disassembly:
add esp, 4
sub edi, 0x341e
pop edi
mov eax, dword [ebp - 0x30]
add eax, 0x70
imul ecx, dword [ebp - 0x2c], 0x70
add ecx, 0x44f3663b
imul edx, dword [ebp - 0x2c], 0x70
sub ecx, edx
xor eax, ecx
imul eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1e30], eax
push edi
push ebx
add esp, 4
add al, 0x81
out 0x60, eax
push esp
add dword [eax], eax
pop edi
push edx
push eax
add esp, 4
xor edx, 0xd8f1
jmp 0x44231b
and edx, 0x162b1
pop edx
push eax
push eax
add esp, 4
add eax, 0x283e
pop eax
mov eax, dword [ebp - 0x1634]
add eax, 0x70
imul ecx, dword [ebp - 0x1630], 0x70
add ecx, 0x44f3663b
imul edx, dword [ebp - 0x1630], 0x70
sub ecx, edx
xor eax, ecx
invalid
Function at 0x4450e0
Capabilities:
Get number of processors

Disassembly:
mov bh, 0
add byte [ecx + 0xa1fea], al
add byte [ecx + 0xf82de2], al
add byte [edx + 0x6b], bl
xchg ebp, eax
inc eax
out dx, eax
invalid

Function at 0x4451b4
Capabilities:
Get number of processors

Disassembly:
mov eax, 0x13379797
pop eax
mov dword [ebp - 0x3f0], eax
push ecx
push ecx
add esp, 4
xor ecx, 0x8d32
and ecx, 0xad3f
pop ecx
push edx
xor edx, 0x15882
add edx, 0x97f7
call 0x4451b4
add byte [esi + eax*2 + 0x50], cl
inc esp
aas
dec ebp
inc eax
cmp al, byte [edi - 0x7d]
les eax, [edx + ebx*2]
mov ecx, dword [ebp - 0x2098]
mov dword [ebp - 0x15c0], ecx
push edx
sub edx, 0x729e
or edx, 0x87dd
pop edx
push esi
push ebx
add esp, 4
xor esi, 0x13494
jmp 0x4451e3
pop esi
push edx
push ecx
add esp, 4
xor edx, 0x13d68
xor edx, 0xc4e5
pop edx
mov edx, dword [ebp - 0x14]
add edx, 0x70
imul eax, dword [ebp - 0x10], 0x70
add eax, 0x44f3663b
imul ecx, dword [ebp - 0x10], 0x70
sub eax, ecx
xor edx, eax
imul edx, dword [ebp - 0x10]
mov dword [ebp - 0x15c0], edx
mov edx, dword [ebp - 0x3f0]
mov dword [ebp - 0x1ffc], edx
mov eax, dword [ebp - 0x1ffc]
add eax, dword [ebp - 0x15c0]
mov dword [ebp - 0x3f0], eax
test dword [eax], edx
cld
invalid
call dword [esi - 0x15]
invalid
pop esi
push edi
push esi
add esp, 4
jmp 0x44524b
call 0x44525a

Function at 0x445250
Capabilities:
Get number of processors

Disassembly:
add byte [esi + 0x3f], cl
dec edx
inc eax
inc esp
inc edi
dec ebx
dec ebp
add esp, 4
jmp 0x445266
pop edi
mov byte [ebp - 0xbec], 0x52
mov byte [ebp - 0xbeb], 0xb9
mov byte [ebp - 0xbea], 0x10
mov byte [ebp - 0xbe9], 0x10
mov byte [ebp - 0xbe8], 0x10
mov byte [ebp - 0xbe7], 0x10
mov byte [ebp - 0xbe6], 0x5a
push esi
push edi
add esp, 4
jmp 0x4452a3
and esi, 0xb723
add esi, 0x2524
pop esi

Function at 0x44525a
Capabilities:
Get number of processors

Disassembly:
add byte [esi + 0x3f], cl
dec edx
inc eax
inc esp
inc edi
dec ebx
dec ebp
add esp, 4
jmp 0x445266
pop edi
mov byte [ebp - 0xbec], 0x52
mov byte [ebp - 0xbeb], 0xb9
mov byte [ebp - 0xbea], 0x10
mov byte [ebp - 0xbe9], 0x10
mov byte [ebp - 0xbe8], 0x10
mov byte [ebp - 0xbe7], 0x10
mov byte [ebp - 0xbe6], 0x5a
push esi
push edi
add esp, 4
jmp 0x4452a3
and esi, 0xb723
add esi, 0x2524
pop esi

Function at 0x4452b0
Capabilities:
Get number of processors

Disassembly:
push edi
xor edi, 0x3e34
sub edi, 0xf367
pop edi
push edi
push esi