joyce8/EMBER2024-capa huggingface dataset:
Function at 0x65016891
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
aas
add dword [eax], eax
pop esi
cmp dword [ebp - 0x190c], 0
jne 0x6501679c
mov dword [ebp - 0x37c], 0
jmp 0x65016a58
mov ecx, dword [ebp - 0x190c]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xeb0], eax
push ebx
call 0x650167bc
add byte [ecx], bh
inc ebp
aas
dec edx
dec esi
inc ebp
add esp, 4
xor ebx, 0x1f7e
and ebx, 0xc17
pop ebx
push eax
and eax, 0x1ce1
sub eax, 0x1251c
sub eax, 0xd0e6
pop eax
cmp dword [ebp - 0xeb0], 0
jne 0x650167f8
mov dword [ebp - 0x37c], 0
jmp 0x65016a58
mov ecx, dword [ebp - 0xeb0]
mov dword [ebp - 0x5d0], ecx
push esi
or esi, 0x17848
pop esi
push eax
push edi
add esp, 4
sub eax, 0x15e82
and eax, 0x15166
pop eax
push esi
push ecx
add esp, 4
sub esi, 0x18459
pop esi
push edi
push ecx
add esp, 4
sub edi, 0x1827e
pop edi
lea edx, [ebp - 0x1a88]
mov dword [ebp - 0xeac], edx
mov eax, dword [ebp - 0x5d0]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xea8], ecx
xor edx, edx
mov word [ebp - 0x270], dx
xor eax, eax
mov word [ebp - 0x138], ax
push esi
push ebx
add esp, 4
add esi, 0xbc4
call 0x6501687a
add byte [ecx + 0x50], cl
inc edx
inc esp
cmp dword [ecx - 0x7d], eax
les eax, [esi + ebx*2]
push esi
push edi
add esp, 4
call 0x65016891
add byte [ebx], dh
aas
inc ebp
xor al, 0x44
inc ebx
push eax
cmp eax, 0x5e04c483
mov ecx, dword [ebp - 0xea8]
mov dx, word [ecx]
mov word [ebp - 0x12c6], dx
mov eax, dword [ebp - 0xea8]
add eax, 2
mov dword [ebp - 0xea8], eax
mov cx, word [ebp - 0x12c6]
mov word [ebp - 0x270], cx
mov edx, dword [ebp - 0xeac]
mov ax, word [edx]
invalid
invalid
test dword [eax], edi
in eax, dx

Function at 0x65016a10
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
jmp 0x6501c78c
or byte [edx + edx*8], bh
outsd dx, dword [esi]

Function at 0x65016e51
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edx
push edi
add edi, 0xeabf
call 0x65016e6b
add byte [ebx + 0x40], al
inc ebp
dec esp
cmp dh, byte [esi]
cmp al, 0x47
push eax
add esp, 4
or edi, 0x13093
pop edi
mov edx, dword [ebp - 0x5d4]
invalid
xchg ebp, eax
js 0x65016e76
invalid

Function at 0x65016e6b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edx
push edi
add edi, 0xeabf
call 0x65016e6b
add byte [ebx + 0x40], al
inc ebp
dec esp
cmp dh, byte [esi]
cmp al, 0x47
push eax
add esp, 4
or edi, 0x13093
pop edi
mov edx, dword [ebp - 0x5d4]
invalid
xchg ebp, eax
js 0x65016e76
invalid

Function at 0x65016e96
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
and edi, 0x8664
or edi, 0x17b8b
call 0x65016eb1
add byte [esp + esi + 0x4c], cl
inc ebp
dec eax
cmp dword [ebx - 0x74a0fb3c], eax
test dword [edx + edi*8], ebp
invalid

Function at 0x65016eb1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
and edi, 0x8664
or edi, 0x17b8b
call 0x65016eb1
add byte [esp + esi + 0x4c], cl
inc ebp
dec eax
cmp dword [ebx - 0x74a0fb3c], eax
test dword [edx + edi*8], ebp
invalid
Function at 0x650173c6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
sub eax, 0x943b
add eax, 0xd8c6
pop eax
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x26e8], ecx
mov edx, dword [ebp - 0x26e8]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x26ec], eax
mov ecx, dword [ebp - 0x26ec]
mov dword [ebp - 0x1930], ecx
push ebx
push esi
add esp, 4
add ebx, 0x1468a
pop ebx
push esi
push eax
add esp, 4
xor esi, 0xa8
add esi, 0x3350
add esi, 0x5d0a
pop esi
push ecx
or ecx, 0x14032
xor ecx, 0xa821
pop ecx
cmp dword [ebp - 0x1930], 0
jne 0x65017448
mov dword [ebp - 0x37c], 0
jmp 0x65017704
mov edx, dword [ebp - 0x1930]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xecc], ecx
push ecx
xor ecx, 0x10ce
call 0x65017471
add byte [esi], bh
cmp al, byte [edi + 0x4e]
cmp edi, dword [0x3c4e354e]
add esp, 4
call 0x65017482
add byte [esi], dh
dec eax
xor al, 0x4e
inc edi
dec ebp
dec edx
dec esi
add esp, 4
sub ecx, 0xae66
pop ecx
cmp dword [ebp - 0xecc], 0
jne 0x650174a4
mov dword [ebp - 0x37c], 0
jmp 0x65017704
mov edx, dword [ebp - 0xecc]
mov dword [ebp - 0x5d8], edx

Function at 0x65017471
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
sub eax, 0x943b
add eax, 0xd8c6
pop eax
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x26e8], ecx
mov edx, dword [ebp - 0x26e8]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x26ec], eax
mov ecx, dword [ebp - 0x26ec]
mov dword [ebp - 0x1930], ecx
push ebx
push esi
add esp, 4
add ebx, 0x1468a
pop ebx
push esi
push eax
add esp, 4
xor esi, 0xa8
add esi, 0x3350
add esi, 0x5d0a
pop esi
push ecx
or ecx, 0x14032
xor ecx, 0xa821
pop ecx
cmp dword [ebp - 0x1930], 0
jne 0x65017448
mov dword [ebp - 0x37c], 0
jmp 0x65017704
mov edx, dword [ebp - 0x1930]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xecc], ecx
push ecx
xor ecx, 0x10ce
call 0x65017471
add byte [esi], bh
cmp al, byte [edi + 0x4e]
cmp edi, dword [0x3c4e354e]
add esp, 4
call 0x65017482
add byte [esi], dh
dec eax
xor al, 0x4e
inc edi
dec ebp
dec edx
dec esi
add esp, 4
sub ecx, 0xae66
pop ecx
cmp dword [ebp - 0xecc], 0
jne 0x650174a4
mov dword [ebp - 0x37c], 0
jmp 0x65017704
mov edx, dword [ebp - 0xecc]
mov dword [ebp - 0x5d8], edx
Function at 0x65017482
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
sub eax, 0x943b
add eax, 0xd8c6
pop eax
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x26e8], ecx
mov edx, dword [ebp - 0x26e8]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x26ec], eax
mov ecx, dword [ebp - 0x26ec]
mov dword [ebp - 0x1930], ecx
push ebx
push esi
add esp, 4
add ebx, 0x1468a
pop ebx
push esi
push eax
add esp, 4
xor esi, 0xa8
add esi, 0x3350
add esi, 0x5d0a
pop esi
push ecx
or ecx, 0x14032
xor ecx, 0xa821
pop ecx
cmp dword [ebp - 0x1930], 0
jne 0x65017448
mov dword [ebp - 0x37c], 0
jmp 0x65017704
mov edx, dword [ebp - 0x1930]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xecc], ecx
push ecx
xor ecx, 0x10ce
call 0x65017471
add byte [esi], bh
cmp al, byte [edi + 0x4e]
cmp edi, dword [0x3c4e354e]
add esp, 4
call 0x65017482
add byte [esi], dh
dec eax
xor al, 0x4e
inc edi
dec ebp
dec edx
dec esi
add esp, 4
sub ecx, 0xae66
pop ecx
cmp dword [ebp - 0xecc], 0
jne 0x650174a4
mov dword [ebp - 0x37c], 0
jmp 0x65017704
mov edx, dword [ebp - 0xecc]
mov dword [ebp - 0x5d8], edx
Function at 0x650175c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
add ebx, 0x8003
or ebx, 0xf149
xor ebx, 0x559b
or ebx, 0x756c
pop ebx
push esi
push edi
add esp, 4
sub esi, 0x2bac
pop esi
push ecx
push eax
add esp, 4
or ecx, 0x11e6d
pop ecx
lea eax, [ebp - 0x1a88]
mov dword [ebp - 0xec8], eax
mov ecx, dword [ebp - 0x5d8]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xec4], edx
xor eax, eax
mov word [ebp - 0x278], ax
xor ecx, ecx
mov word [ebp - 0x140], cx
push ecx
and ecx, 0xd42d
pop ecx
push esi
push edx
add esp, 4
or esi, 0x173ed
pop esi
push ecx
add ecx, 0xde4e
jmp 0x65017532
pop ecx
push ebx
or ebx, 0x4f0b
and ebx, 0x1102d
pop ebx
mov edx, dword [ebp - 0xec4]
mov ax, word [edx]
mov word [ebp - 0x12ce], ax
mov ecx, dword [ebp - 0xec4]
add ecx, 2
mov dword [ebp - 0xec4], ecx
mov dx, word [ebp - 0x12ce]
mov word [ebp - 0x278], dx
mov eax, dword [ebp - 0xec8]
mov cx, word [eax]
mov word [ebp - 0x12d0], cx
mov edx, dword [ebp - 0xec8]
add edx, 2
mov dword [ebp - 0xec8], edx
mov ax, word [ebp - 0x12d0]
mov word [ebp - 0x140], ax
push eax
push ebx
add esp, 4
and eax, 0xfcf9
pop eax
push edx
jmp 0x650175ae
pop edx
push ecx
push edi
add esp, 4
jmp 0x650175ba
pop ecx
push ecx
push ecx
add esp, 4
or ecx, 0xb62
sub ecx, 0x4eee
pop ecx
movzx ecx, word [ebp - 0x140]
test ecx, ecx
jne 0x650175f0
movzx edx, word [ebp - 0x278]
movzx eax, word [ebp - 0x140]
sub edx, eax
mov dword [ebp - 0x1938], edx
jmp 0x65017653
movzx ecx, word [ebp - 0x278]
movzx edx, word [ebp - 0x140]
cmp ecx, edx
je 0x6501750f
movzx eax, word [ebp - 0x278]
xor eax, 0x20
movzx ecx, word [ebp - 0x140]
cmp eax, ecx
je 0x6501750f
movzx edx, word [ebp - 0x278]
movzx eax, word [ebp - 0x140]
cmp edx, eax
jge 0x6501763d
mov dword [ebp - 0x1934], 0xffffffff
jmp 0x65017647
mov dword [ebp - 0x1934], 1
mov ecx, dword [ebp - 0x1934]
mov dword [ebp - 0x1938], ecx
cmp dword [ebp - 0x1938], 0
jne 0x6501769c
push edi
and edi, 0x165f
jmp 0x65017669
and edi, 0x60b
or edi, 0xf761
pop edi
push edx
push edx
add esp, 4
add edx, 0x12b01
sub edx, 0xaaf4
and edx, 0xcacc
pop edx
mov edx, dword [ebp - 0x5d8]
mov dword [ebp - 0x37c], edx
jmp 0x65017704
push edi
or edi, 0x865e
pop edi
push edi
push ebx
add esp, 4
call 0x650176b8
add byte [eax], bh
dec eax
inc ecx
dec esi
dec ecx
push eax
inc edi
dec esp
add esp, 4
add edi, 0xc6a
xor edi, 0xb028
xor edi, 0x181b9
pop edi
mov eax, dword [ebp - 0x5d8]
sub dl, bh
invalid
dec dword [ebx + 0x288d8908]
cli
invalid
dec dword [ebx - 0x5d76b]
invalid
cmp edx, dword [ebp - 0xecc]
je 0x650176fa
mov eax, dword [ebp - 0x5d8]
cmp dword [eax + 0x30], 0
jne 0x650174b0
mov dword [ebp - 0x37c], 0
push ecx
jmp 0x6501770d
sub ecx, 0x12dba
xor ecx, 0xc88b
pop ecx
push ecx
push esi
add esp, 4
xor ecx, 0x6079
jmp 0x6501772d
pop ecx
push eax
or eax, 0x12f81
enter 0x2f81, 1
add byte [eax - 0x75], bl
lea eax, [esp + edi*8 + 0x518bffff]
sbb byte [ecx - 0x3d36b], cl
call dword [eax + 0x56]
add esp, 4
or eax, 0x985e
Function at 0x650176b8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
add ebx, 0x8003
or ebx, 0xf149
xor ebx, 0x559b
or ebx, 0x756c
pop ebx
push esi
push edi
add esp, 4
sub esi, 0x2bac
pop esi
push ecx
push eax
add esp, 4
or ecx, 0x11e6d
pop ecx
lea eax, [ebp - 0x1a88]
mov dword [ebp - 0xec8], eax
mov ecx, dword [ebp - 0x5d8]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xec4], edx
xor eax, eax
mov word [ebp - 0x278], ax
xor ecx, ecx
mov word [ebp - 0x140], cx
push ecx
and ecx, 0xd42d
pop ecx
push esi
push edx
add esp, 4
or esi, 0x173ed
pop esi
push ecx
add ecx, 0xde4e
jmp 0x65017532
pop ecx
push ebx
or ebx, 0x4f0b
and ebx, 0x1102d
pop ebx
mov edx, dword [ebp - 0xec4]
mov ax, word [edx]
mov word [ebp - 0x12ce], ax
mov ecx, dword [ebp - 0xec4]
add ecx, 2
mov dword [ebp - 0xec4], ecx
mov dx, word [ebp - 0x12ce]
mov word [ebp - 0x278], dx
mov eax, dword [ebp - 0xec8]
mov cx, word [eax]
mov word [ebp - 0x12d0], cx
mov edx, dword [ebp - 0xec8]
add edx, 2
mov dword [ebp - 0xec8], edx
mov ax, word [ebp - 0x12d0]
mov word [ebp - 0x140], ax
push eax
push ebx
add esp, 4
and eax, 0xfcf9
pop eax
push edx
jmp 0x650175ae
pop edx
push ecx
push edi
add esp, 4
jmp 0x650175ba
pop ecx
push ecx
push ecx
add esp, 4
or ecx, 0xb62
sub ecx, 0x4eee
pop ecx
movzx ecx, word [ebp - 0x140]
test ecx, ecx
jne 0x650175f0
movzx edx, word [ebp - 0x278]
movzx eax, word [ebp - 0x140]
sub edx, eax
mov dword [ebp - 0x1938], edx
jmp 0x65017653
movzx ecx, word [ebp - 0x278]
movzx edx, word [ebp - 0x140]
cmp ecx, edx
je 0x6501750f
movzx eax, word [ebp - 0x278]
xor eax, 0x20
movzx ecx, word [ebp - 0x140]
cmp eax, ecx
je 0x6501750f
movzx edx, word [ebp - 0x278]
movzx eax, word [ebp - 0x140]
cmp edx, eax
jge 0x6501763d
mov dword [ebp - 0x1934], 0xffffffff
jmp 0x65017647
mov dword [ebp - 0x1934], 1
mov ecx, dword [ebp - 0x1934]
mov dword [ebp - 0x1938], ecx
cmp dword [ebp - 0x1938], 0
jne 0x6501769c
push edi
and edi, 0x165f
jmp 0x65017669
and edi, 0x60b
or edi, 0xf761
pop edi
push edx
push edx
add esp, 4
add edx, 0x12b01
sub edx, 0xaaf4
and edx, 0xcacc
pop edx
mov edx, dword [ebp - 0x5d8]
mov dword [ebp - 0x37c], edx
jmp 0x65017704
push edi
or edi, 0x865e
pop edi
push edi
push ebx
add esp, 4
call 0x650176b8
add byte [eax], bh
dec eax
inc ecx
dec esi
dec ecx
push eax
inc edi
dec esp
add esp, 4
add edi, 0xc6a
xor edi, 0xb028
xor edi, 0x181b9
pop edi
mov eax, dword [ebp - 0x5d8]
sub dl, bh
invalid
dec dword [ebx + 0x288d8908]
cli
invalid
dec dword [ebx - 0x5d76b]
invalid
cmp edx, dword [ebp - 0xecc]
je 0x650176fa
mov eax, dword [ebp - 0x5d8]
cmp dword [eax + 0x30], 0
jne 0x650174b0
mov dword [ebp - 0x37c], 0
push ecx
jmp 0x6501770d
sub ecx, 0x12dba
xor ecx, 0xc88b
pop ecx
push ecx
push esi
add esp, 4
xor ecx, 0x6079
jmp 0x6501772d
pop ecx
push eax
or eax, 0x12f81
enter 0x2f81, 1
add byte [eax - 0x75], bl
lea eax, [esp + edi*8 + 0x518bffff]
sbb byte [ecx - 0x3d36b], cl
call dword [eax + 0x56]
add esp, 4
or eax, 0x985e
Function at 0x65017730
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
add ebx, 0x8003
or ebx, 0xf149
xor ebx, 0x559b
or ebx, 0x756c
pop ebx
push esi
push edi
add esp, 4
sub esi, 0x2bac
pop esi
push ecx
push eax
add esp, 4
or ecx, 0x11e6d
pop ecx
lea eax, [ebp - 0x1a88]
mov dword [ebp - 0xec8], eax
mov ecx, dword [ebp - 0x5d8]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xec4], edx
xor eax, eax
mov word [ebp - 0x278], ax
xor ecx, ecx
mov word [ebp - 0x140], cx
push ecx
and ecx, 0xd42d
pop ecx
push esi
push edx
add esp, 4
or esi, 0x173ed
pop esi
push ecx
add ecx, 0xde4e
jmp 0x65017532
pop ecx
push ebx
or ebx, 0x4f0b
and ebx, 0x1102d
pop ebx
mov edx, dword [ebp - 0xec4]
mov ax, word [edx]
mov word [ebp - 0x12ce], ax
mov ecx, dword [ebp - 0xec4]
add ecx, 2
mov dword [ebp - 0xec4], ecx
mov dx, word [ebp - 0x12ce]
mov word [ebp - 0x278], dx
mov eax, dword [ebp - 0xec8]
mov cx, word [eax]
mov word [ebp - 0x12d0], cx
mov edx, dword [ebp - 0xec8]
add edx, 2
mov dword [ebp - 0xec8], edx
mov ax, word [ebp - 0x12d0]
mov word [ebp - 0x140], ax
push eax
push ebx
add esp, 4
and eax, 0xfcf9
pop eax
push edx
jmp 0x650175ae
pop edx
push ecx
push edi
add esp, 4
jmp 0x650175ba
pop ecx
push ecx
push ecx
add esp, 4
or ecx, 0xb62
sub ecx, 0x4eee
pop ecx
movzx ecx, word [ebp - 0x140]
test ecx, ecx
jne 0x650175f0
movzx edx, word [ebp - 0x278]
movzx eax, word [ebp - 0x140]
sub edx, eax
mov dword [ebp - 0x1938], edx
jmp 0x65017653
movzx ecx, word [ebp - 0x278]
movzx edx, word [ebp - 0x140]
cmp ecx, edx
je 0x6501750f
movzx eax, word [ebp - 0x278]
xor eax, 0x20
movzx ecx, word [ebp - 0x140]
cmp eax, ecx
je 0x6501750f
movzx edx, word [ebp - 0x278]
movzx eax, word [ebp - 0x140]
cmp edx, eax
jge 0x6501763d
mov dword [ebp - 0x1934], 0xffffffff
jmp 0x65017647
mov dword [ebp - 0x1934], 1
mov ecx, dword [ebp - 0x1934]
mov dword [ebp - 0x1938], ecx
cmp dword [ebp - 0x1938], 0
jne 0x6501769c
push edi
and edi, 0x165f
jmp 0x65017669
and edi, 0x60b
or edi, 0xf761
pop edi
push edx
push edx
add esp, 4
add edx, 0x12b01
sub edx, 0xaaf4
and edx, 0xcacc
pop edx
mov edx, dword [ebp - 0x5d8]
mov dword [ebp - 0x37c], edx
jmp 0x65017704
push edi
or edi, 0x865e
pop edi
push edi
push ebx
add esp, 4
call 0x650176b8
add byte [eax], bh
dec eax
inc ecx
dec esi
dec ecx
push eax
inc edi
dec esp
add esp, 4
add edi, 0xc6a
xor edi, 0xb028
xor edi, 0x181b9
pop edi
mov eax, dword [ebp - 0x5d8]
sub dl, bh
invalid
dec dword [ebx + 0x288d8908]
cli
invalid
dec dword [ebx - 0x5d76b]
invalid
cmp edx, dword [ebp - 0xecc]
je 0x650176fa
mov eax, dword [ebp - 0x5d8]
cmp dword [eax + 0x30], 0
jne 0x650174b0
mov dword [ebp - 0x37c], 0
push ecx
jmp 0x6501770d
sub ecx, 0x12dba
xor ecx, 0xc88b
pop ecx
push ecx
push esi
add esp, 4
xor ecx, 0x6079
jmp 0x6501772d
pop ecx
push eax
or eax, 0x12f81
enter 0x2f81, 1
add byte [eax - 0x75], bl
lea eax, [esp + edi*8 + 0x518bffff]
sbb byte [ecx - 0x3d36b], cl
call dword [eax + 0x56]
add esp, 4
or eax, 0x985e
Function at 0x65017750
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop eax
push ecx
or ecx, 0x315c
pop ecx
push ebx
add ebx, 0x1301
xor ebx, 0xe234
call 0x65017773
add byte [ecx + 0x42], al
dec ebp
inc edi
xor bh, byte [edi]
dec edx
add esp, 4
pop ebx
mov dword [ebp - 0x8a8], 0
add byte [ebx - 0x3d37b], cl
dec dword [ecx - 0x193b7b]
inc dword [ebx - 0x193b43]
inc dword [eax]
jne 0x650177a7
mov ecx, dword [ebp - 0x8a8]
mov dword [ebp - 0x5dc], ecx
jmp 0x65017a98
mov edx, dword [ebp - 0x193c]
invalid
invalid
invalid

Function at 0x65017773
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop eax
push ecx
or ecx, 0x315c
pop ecx
push ebx
add ebx, 0x1301
xor ebx, 0xe234
call 0x65017773
add byte [ecx + 0x42], al
dec ebp
inc edi
xor bh, byte [edi]
dec edx
add esp, 4
pop ebx
mov dword [ebp - 0x8a8], 0
add byte [ebx - 0x3d37b], cl
dec dword [ecx - 0x193b7b]
inc dword [ebx - 0x193b43]
inc dword [eax]
jne 0x650177a7
mov ecx, dword [ebp - 0x8a8]
mov dword [ebp - 0x5dc], ecx
jmp 0x65017a98
mov edx, dword [ebp - 0x193c]
invalid
invalid
invalid

Function at 0x65017afc
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
add esi, 0x9aef
jmp 0x65017b0e
pop esi
push edx
xor edx, 0xdfdc
pop edx
cmp dword [ebp - 0x494], 0
je 0x65017b29
cmp dword [ebp - 0xc20], 0
jne 0x65017b6f
push ebx
xor ebx, 0x7a0
xor ebx, 0xef95
or ebx, 0xbbd8
add ebx, 0xbfa8
pop ebx
push eax
push eax
add esp, 4
xor eax, 0xea9a
sub eax, 0x12d60
xor eax, 0xda99
pop eax
mov eax, dword [ebp - 0x8d4]
mov dword [ebp - 0x1f90], eax
push 0
call dword [ebp - 0x1f90]
mov dword [ebp - 0x27bc], 0xa
push ecx
push ebx
add esp, 4
add ecx, 0xa4a9
xor ecx, 0x138bb
sub ecx, 0x4097
call 0x65017b9f
add byte [ecx + 0x49], al
cmp eax, dword [ebx + 0x4b]
inc edx
dec esi
add esp, 4
pop ecx
push ecx
add ecx, 0x52f2
pop ecx
mov ecx, dword [ebp - 0x494]
mov dl, byte [ecx + 0xa]
mov byte [ebp - 0x459], dl
mov eax, dword [ebp - 0xc20]
sub eax, dword [ebp - 0x494]
mov dword [ebp - 0x19c8], eax
mov dword [ebp - 0xf00], 0
push eax
push ecx
add esp, 4
or eax, 0x295e
and eax, 0xc0b8
jmp 0x65017bf0
jmp 0x65017bf6
pop eax
push edx
jmp 0x65017c01
or edx, 0x13053
pop edx
mov byte [ebp - 0xb74], 0x56
mov byte [ebp - 0xb73], 0x69
mov byte [ebp - 0xb72], 0x72
mov byte [ebp - 0xb71], 0x74
mov byte [ebp - 0xb70], 0x75
mov byte [ebp - 0xb6f], 0x61
mov byte [ebp - 0xb6e], 0x6c
mov byte [ebp - 0xb6d], 0x50
Function at 0x65017b9f
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
add esi, 0x9aef
jmp 0x65017b0e
pop esi
push edx
xor edx, 0xdfdc
pop edx
cmp dword [ebp - 0x494], 0
je 0x65017b29
cmp dword [ebp - 0xc20], 0
jne 0x65017b6f
push ebx
xor ebx, 0x7a0
xor ebx, 0xef95
or ebx, 0xbbd8
add ebx, 0xbfa8
pop ebx
push eax
push eax
add esp, 4
xor eax, 0xea9a
sub eax, 0x12d60
xor eax, 0xda99
pop eax
mov eax, dword [ebp - 0x8d4]
mov dword [ebp - 0x1f90], eax
push 0
call dword [ebp - 0x1f90]
mov dword [ebp - 0x27bc], 0xa
push ecx
push ebx
add esp, 4
add ecx, 0xa4a9
xor ecx, 0x138bb
sub ecx, 0x4097
call 0x65017b9f
add byte [ecx + 0x49], al
cmp eax, dword [ebx + 0x4b]
inc edx
dec esi
add esp, 4
pop ecx
push ecx
add ecx, 0x52f2
pop ecx
mov ecx, dword [ebp - 0x494]
mov dl, byte [ecx + 0xa]
mov byte [ebp - 0x459], dl
mov eax, dword [ebp - 0xc20]
sub eax, dword [ebp - 0x494]
mov dword [ebp - 0x19c8], eax
mov dword [ebp - 0xf00], 0
push eax
push ecx
add esp, 4
or eax, 0x295e
and eax, 0xc0b8
jmp 0x65017bf0
jmp 0x65017bf6
pop eax
push edx
jmp 0x65017c01
or edx, 0x13053
pop edx
mov byte [ebp - 0xb74], 0x56
mov byte [ebp - 0xb73], 0x69
mov byte [ebp - 0xb72], 0x72
mov byte [ebp - 0xb71], 0x74
mov byte [ebp - 0xb70], 0x75
mov byte [ebp - 0xb6f], 0x61
mov byte [ebp - 0xb6e], 0x6c
mov byte [ebp - 0xb6d], 0x50
Function at 0x6501af40
Capabilities:
Encode data using xor

Disassembly:
xchg esi, eax
stc
out dx, al
or byte [eax], cl
mov esi, es
stc
out dx, al
or byte [eax], cl
or dword [esi + 0x49], edi
pop ebx
pop ecx
mov ebp, cs
or eax, 0x3e73f38a
or dword [ecx], ecx
mov ch, bl
imul ebp, dword [edi], 0xcb8a0909
xor dword [esi], esi
or dword [ecx], ecx
arpl word [eax - 0x76], sp
fmul dword [eax]
mov word [edx], cs
or dword [edx + 0x958abd0], ecx
or dword [edx + 0x959eed0], ecx
or dword [edx + 0xa7914f8], ecx
or dword [eax - 0x6c], ebp
sahf
or dword [ebx], eax
or byte [eax], cl
xchg edx, eax
sahf
cdq
add eax, 0x71f40808
pop ebx
mov dl, bl
in al, dx
sbb ecx, dword [edx]
or esp, esi
adc byte [esp + edx*2], bh
inc ebx
inc ecx
dec esi
dec esp
dec ebp
mov ch, bl
mov dword [ecx], edx
or dword [ecx], ecx
arpl word [eax + 0x60], sp
mov ebp, cs
or eax, 0x90910f1
or dword [ecx], ecx
dec esi
dec esi
dec ecx
inc ecx
inc eax
dec edi
mov ebp, cs
or eax, 0x8e61f08a
or dword [ecx], ecx
push 0x3098e94
or byte [eax], cl
xchg esp, eax
adc dword [edx + 0x8030996], edx
or byte [esi + ebx*4 + 0x8080309], dl
inc esp
sahf
sar ecx, 1
or byte [eax], cl
jge 0x6501aff5
xchg esp, eax
mov cs, word [ecx]
add ecx, dword [eax]
or byte [ecx + eax*4 - 0x71e7f6c7], cl
aam 6
or byte [eax], cl
ror byte [esi + 0x8080599], 1
or dword [ecx], ecx
or dword [ecx], ecx
pop ebx
pop edi
or dword [ebx + 0x5f], ebx
mov ebp, cs
or eax, 0xcd3df38a
or dword [ecx], ecx
arpl word [ebx + 0x5b], bx
mov ebp, cs
or eax, 0x8b9ceb8a
or cl, byte [ecx]
mov ch, bl
pop ebx
xor cl, byte [edx]
or dword [edx + 0x9b858fb], ecx
or dword [ebx + 0x5c], esp
mov bh, ah
adc cl, byte [edi]
or dword [ecx], ecx
mov cl, ah
jbe 0x6501aff4
or dword [ecx], ecx
mov esi, es
cdq
add eax, 0x18090808
mov es, word [ecx]
adc dword [ecx], ecx
or edx, eax
je 0x6501b041
or dword [ecx], ecx
outsd dx, dword [esi]
xchg edx, eax
xchg esi, eax
xchg ebp, eax
in eax, dx
or byte [eax], cl
ret

Function at 0x65023c50
Capabilities:
Encode data using xor

Disassembly:
arpl word [edx + ecx*4 - 0x34], bx
jp 0x65023c11
or dword [edx + 0x9cb9cec], ecx
or dword [edx + 0xa2ae1ec], ecx
sub cl, byte [edx]
or dword [edx + 0x966cdd4], ecx
or dword [esi + edx*4 - 0x72], esp
or ebp, ebp
or byte [eax], cl
xchg edx, eax
mov fs, ecx
clc
or byte [eax], cl
xchg esp, eax
xchg esi, eax
mov cl, 2
or byte [eax], cl
xchg esp, eax
pop edx
cmp dword [edx + 0x8f8e59e], edx
or byte [ecx + ecx*8], bh
outsd dx, dword [esi]
xchg edx, eax
mov cs, word [0x3c080806]
shr byte [edi - 0x6e], cl
xchg esi, eax
jno 0x65023c4e
or byte [eax], cl
pop ecx
pop edx
mov ebp, cs
or eax, 0x49a3f98a
dec ecx
stc
mov dword [0x8a090949], eax
dec ecx
or dword [ecx], ecx
mov dh, cl
or dword [ecx], ecx
mov dh, cl
xchg ebx, eax
jp 0x65023c61
or dword [edx + 0xa1af5f1], ecx
or ecx, esi
adc ecx, dword [ecx]
or dword [ecx], ecx
or dword [esi], edi
inc ebp
or dword [ecx], ecx
or dword [ecx], ecx
inc ebp
push esp
inc esp
aas
inc eax
inc esp
cmp al, 0x40
mov ebp, cs
Function at 0x432002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x24b86773
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f314
nop
mov ecx, 0x4a5a577e
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x432084
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219