joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130

Function at 0x7ef6b0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x7ef6ba
pushal
call 0x7ef6c0
pop ebp
sub ebp, 0x10
sub ebp, 0x3ef6b0
jmp 0x7ef6d6
mov eax, 0x3ef6b0
add eax, ebp
add eax, 0x4c
mov ecx, 0x613
mov edx, 0x336f537f
xor byte [eax], dl
inc eax
dec ecx
jne 0x7ef6ed
jmp 0x7ef700
hlt
Function at 0x436b3d
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x13379797
pop eax
mov dword [ebp - 0x3f0], eax
push ecx
push esi
add esp, 4
call 0x436b3d
add byte [eax + 0x43], al
inc esi
aas
xor al, 0x4e
dec edi
aaa
cmp byte [ebx - 0x3e7efb3c], al
lahf
xor dword [ecx], eax
add byte [ecx + 0x1415ae9], al
add byte [ecx + 0xa29be9], al
add byte [ecx + 0x56], bl
add esi, 0xfe5
pop esi
mov ecx, dword [ebp - 0x20e8]
mov dword [ebp - 0x15c0], ecx
push ecx
push esi
add esp, 4
or ecx, 0xe8b4
add ecx, 0xb83b
jmp 0x436b7e
pop ecx
push esi
push esi
add esp, 4
add esi, 0x5031
jmp 0x436b92
xor esi, 0x838
pop esi
mov edx, dword [ebp - 0x14]
add edx, 0x70
imul eax, dword [ebp - 0x10], 0x70
add eax, 0x44f3663b
imul ecx, dword [ebp - 0x10], 0x70
sub eax, ecx
xor edx, eax
imul edx, dword [ebp - 0x10]
mov dword [ebp - 0x15c0], edx
mov edx, dword [ebp - 0x3f0]
mov dword [ebp - 0x204c], edx
mov eax, dword [ebp - 0x204c]
add eax, dword [ebp - 0x15c0]
mov dword [ebp - 0x3f0], eax
push edi
call 0x436be9
add byte [ecx + 0x3d], cl
cmp dh, byte [esi]
cmp byte [ebx + eax*2 + 0x3a], al
dec esi
add esp, 4
add edi, 0x110ad
sub edi, 0x14d3f
call 0x436c06
add byte [edx + 0x41], al
dec edx
xor eax, 0x4f3d3b4e
add esp, 4
pop edi
mov byte [ebp - 0xbec], 0x52
mov byte [ebp - 0xbeb], 0xb9
mov byte [ebp - 0xbea], 0x10
mov byte [ebp - 0xbe9], 0x10
mov byte [ebp - 0xbe8], 0x10
mov byte [ebp - 0xbe7], 0x10
mov byte [ebp - 0xbe6], 0x5a
push eax
call 0x436c49
add byte [esi + 0x50], cl
dec edi
inc edx
cmp al, byte [eax + 0x3f]
add esp, 4
or eax, 0x71d6
add eax, 0x1760
pop eax
push edi
push edi
add esp, 4
jmp 0x436c66
or edi, 0x14059
pop edi
mov byte [ebp - 0xbe4], 0x52
mov byte [ebp - 0xbe3], 0xb9
mov byte [ebp - 0xbe2], 0x20
mov byte [ebp - 0xbe1], 0x20
mov byte [ebp - 0xbe0], 0x20
mov byte [ebp - 0xbdf], 0x20
mov byte [ebp - 0xbde], 0x5a
push edi
push edi
add esp, 4
xor edi, 0xb928
call 0x436cb5
add byte [ebx], bh
xor al, 0x3e
inc edi
dec eax
add esp, 4
and edi, 0x1599f
call 0x436ccc
add byte [ebp + 0x4a], cl
cmp al, 0x3b
cmp eax, 0x834c4d3a
les eax, [edi + ebx*2]
mov dword [ebp - 0x20ec], 0xe
push edi
push esi
add esp, 4
xor edi, 0x17f81
pop edi
push edx
or edx, 0xdca2
sub edx, 0x809e
sub edx, 0x117a6
and edx, 0x1f3e
pop edx
push eax
push ebx
add esp, 4
xor eax, 0x15bbd
pop eax
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xbec]
mov dword [ebp - 0x15c4], eax
push ecx
call 0x436d31
add byte [ebp + edi + 0x36], al
inc esi
dec ebp
dec ecx
inc esp
aas
aaa
add esp, 4
and ecx, 0x14615
or ecx, 0x589b
add ecx, 0xcecb
pop ecx
push edx
push ebx
add esp, 4
or edx, 0x126bc
pop edx
mov dword [ebp - 0x20f0], 0xffffffff
push edi
push esi
add esp, 4
or edi, 0xff61
xor edi, 0x5b0d
xor edi, 0x100b0
sub edi, 0xdb8b
pop edi
push ebx
add ebx, 0x10a83
sub ebx, 0xa5fd
xor ebx, 0xf9
pop ebx
mov ecx, dword [ebp - 0x3f0]
mov dword [ebp - 0x4fc], ecx
jmp 0x436dac
Function at 0x436be9
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x13379797
pop eax
mov dword [ebp - 0x3f0], eax
push ecx
push esi
add esp, 4
call 0x436b3d
add byte [eax + 0x43], al
inc esi
aas
xor al, 0x4e
dec edi
aaa
cmp byte [ebx - 0x3e7efb3c], al
lahf
xor dword [ecx], eax
add byte [ecx + 0x1415ae9], al
add byte [ecx + 0xa29be9], al
add byte [ecx + 0x56], bl
add esi, 0xfe5
pop esi
mov ecx, dword [ebp - 0x20e8]
mov dword [ebp - 0x15c0], ecx
push ecx
push esi
add esp, 4
or ecx, 0xe8b4
add ecx, 0xb83b
jmp 0x436b7e
pop ecx
push esi
push esi
add esp, 4
add esi, 0x5031
jmp 0x436b92
xor esi, 0x838
pop esi
mov edx, dword [ebp - 0x14]
add edx, 0x70
imul eax, dword [ebp - 0x10], 0x70
add eax, 0x44f3663b
imul ecx, dword [ebp - 0x10], 0x70
sub eax, ecx
xor edx, eax
imul edx, dword [ebp - 0x10]
mov dword [ebp - 0x15c0], edx
mov edx, dword [ebp - 0x3f0]
mov dword [ebp - 0x204c], edx
mov eax, dword [ebp - 0x204c]
add eax, dword [ebp - 0x15c0]
mov dword [ebp - 0x3f0], eax
push edi
call 0x436be9
add byte [ecx + 0x3d], cl
cmp dh, byte [esi]
cmp byte [ebx + eax*2 + 0x3a], al
dec esi
add esp, 4
add edi, 0x110ad
sub edi, 0x14d3f
call 0x436c06
add byte [edx + 0x41], al
dec edx
xor eax, 0x4f3d3b4e
add esp, 4
pop edi
mov byte [ebp - 0xbec], 0x52
mov byte [ebp - 0xbeb], 0xb9
mov byte [ebp - 0xbea], 0x10
mov byte [ebp - 0xbe9], 0x10
mov byte [ebp - 0xbe8], 0x10
mov byte [ebp - 0xbe7], 0x10
mov byte [ebp - 0xbe6], 0x5a
push eax
call 0x436c49
add byte [esi + 0x50], cl
dec edi
inc edx
cmp al, byte [eax + 0x3f]
add esp, 4
or eax, 0x71d6
add eax, 0x1760
pop eax
push edi
push edi
add esp, 4
jmp 0x436c66
or edi, 0x14059
pop edi
mov byte [ebp - 0xbe4], 0x52
mov byte [ebp - 0xbe3], 0xb9
mov byte [ebp - 0xbe2], 0x20
mov byte [ebp - 0xbe1], 0x20
mov byte [ebp - 0xbe0], 0x20
mov byte [ebp - 0xbdf], 0x20
mov byte [ebp - 0xbde], 0x5a
push edi
push edi
add esp, 4
xor edi, 0xb928
call 0x436cb5
add byte [ebx], bh
xor al, 0x3e
inc edi
dec eax
add esp, 4
and edi, 0x1599f
call 0x436ccc
add byte [ebp + 0x4a], cl
cmp al, 0x3b
cmp eax, 0x834c4d3a
les eax, [edi + ebx*2]
mov dword [ebp - 0x20ec], 0xe
push edi
push esi
add esp, 4
xor edi, 0x17f81
pop edi
push edx
or edx, 0xdca2
sub edx, 0x809e
sub edx, 0x117a6
and edx, 0x1f3e
pop edx
push eax
push ebx
add esp, 4
xor eax, 0x15bbd
pop eax
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xbec]
mov dword [ebp - 0x15c4], eax
push ecx
call 0x436d31
add byte [ebp + edi + 0x36], al
inc esi
dec ebp
dec ecx
inc esp
aas
aaa
add esp, 4
and ecx, 0x14615
or ecx, 0x589b
add ecx, 0xcecb
pop ecx
push edx
push ebx
add esp, 4
or edx, 0x126bc
pop edx
mov dword [ebp - 0x20f0], 0xffffffff
push edi
push esi
add esp, 4
or edi, 0xff61
xor edi, 0x5b0d
xor edi, 0x100b0
sub edi, 0xdb8b
pop edi
push ebx
add ebx, 0x10a83
sub ebx, 0xa5fd
xor ebx, 0xf9
pop ebx
mov ecx, dword [ebp - 0x3f0]
mov dword [ebp - 0x4fc], ecx
jmp 0x436dac
Function at 0x436c06
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x13379797
pop eax
mov dword [ebp - 0x3f0], eax
push ecx
push esi
add esp, 4
call 0x436b3d
add byte [eax + 0x43], al
inc esi
aas
xor al, 0x4e
dec edi
aaa
cmp byte [ebx - 0x3e7efb3c], al
lahf
xor dword [ecx], eax
add byte [ecx + 0x1415ae9], al
add byte [ecx + 0xa29be9], al
add byte [ecx + 0x56], bl
add esi, 0xfe5
pop esi
mov ecx, dword [ebp - 0x20e8]
mov dword [ebp - 0x15c0], ecx
push ecx
push esi
add esp, 4
or ecx, 0xe8b4
add ecx, 0xb83b
jmp 0x436b7e
pop ecx
push esi
push esi
add esp, 4
add esi, 0x5031
jmp 0x436b92
xor esi, 0x838
pop esi
mov edx, dword [ebp - 0x14]
add edx, 0x70
imul eax, dword [ebp - 0x10], 0x70
add eax, 0x44f3663b
imul ecx, dword [ebp - 0x10], 0x70
sub eax, ecx
xor edx, eax
imul edx, dword [ebp - 0x10]
mov dword [ebp - 0x15c0], edx
mov edx, dword [ebp - 0x3f0]
mov dword [ebp - 0x204c], edx
mov eax, dword [ebp - 0x204c]
add eax, dword [ebp - 0x15c0]
mov dword [ebp - 0x3f0], eax
push edi
call 0x436be9
add byte [ecx + 0x3d], cl
cmp dh, byte [esi]
cmp byte [ebx + eax*2 + 0x3a], al
dec esi
add esp, 4
add edi, 0x110ad
sub edi, 0x14d3f
call 0x436c06
add byte [edx + 0x41], al
dec edx
xor eax, 0x4f3d3b4e
add esp, 4
pop edi
mov byte [ebp - 0xbec], 0x52
mov byte [ebp - 0xbeb], 0xb9
mov byte [ebp - 0xbea], 0x10
mov byte [ebp - 0xbe9], 0x10
mov byte [ebp - 0xbe8], 0x10
mov byte [ebp - 0xbe7], 0x10
mov byte [ebp - 0xbe6], 0x5a
push eax
call 0x436c49
add byte [esi + 0x50], cl
dec edi
inc edx
cmp al, byte [eax + 0x3f]
add esp, 4
or eax, 0x71d6
add eax, 0x1760
pop eax
push edi
push edi
add esp, 4
jmp 0x436c66
or edi, 0x14059
pop edi
mov byte [ebp - 0xbe4], 0x52
mov byte [ebp - 0xbe3], 0xb9
mov byte [ebp - 0xbe2], 0x20
mov byte [ebp - 0xbe1], 0x20
mov byte [ebp - 0xbe0], 0x20
mov byte [ebp - 0xbdf], 0x20
mov byte [ebp - 0xbde], 0x5a
push edi
push edi
add esp, 4
xor edi, 0xb928
call 0x436cb5
add byte [ebx], bh
xor al, 0x3e
inc edi
dec eax
add esp, 4
and edi, 0x1599f
call 0x436ccc
add byte [ebp + 0x4a], cl
cmp al, 0x3b
cmp eax, 0x834c4d3a
les eax, [edi + ebx*2]
mov dword [ebp - 0x20ec], 0xe
push edi
push esi
add esp, 4
xor edi, 0x17f81
pop edi
push edx
or edx, 0xdca2
sub edx, 0x809e
sub edx, 0x117a6
and edx, 0x1f3e
pop edx
push eax
push ebx
add esp, 4
xor eax, 0x15bbd
pop eax
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xbec]
mov dword [ebp - 0x15c4], eax
push ecx
call 0x436d31
add byte [ebp + edi + 0x36], al
inc esi
dec ebp
dec ecx
inc esp
aas
aaa
add esp, 4
and ecx, 0x14615
or ecx, 0x589b
add ecx, 0xcecb
pop ecx
push edx
push ebx
add esp, 4
or edx, 0x126bc
pop edx
mov dword [ebp - 0x20f0], 0xffffffff
push edi
push esi
add esp, 4
or edi, 0xff61
xor edi, 0x5b0d
xor edi, 0x100b0
sub edi, 0xdb8b
pop edi
push ebx
add ebx, 0x10a83
sub ebx, 0xa5fd
xor ebx, 0xf9
pop ebx
mov ecx, dword [ebp - 0x3f0]
mov dword [ebp - 0x4fc], ecx
jmp 0x436dac
Function at 0x436c49
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x13379797
pop eax
mov dword [ebp - 0x3f0], eax
push ecx
push esi
add esp, 4
call 0x436b3d
add byte [eax + 0x43], al
inc esi
aas
xor al, 0x4e
dec edi
aaa
cmp byte [ebx - 0x3e7efb3c], al
lahf
xor dword [ecx], eax
add byte [ecx + 0x1415ae9], al
add byte [ecx + 0xa29be9], al
add byte [ecx + 0x56], bl
add esi, 0xfe5
pop esi
mov ecx, dword [ebp - 0x20e8]
mov dword [ebp - 0x15c0], ecx
push ecx
push esi
add esp, 4
or ecx, 0xe8b4
add ecx, 0xb83b
jmp 0x436b7e
pop ecx
push esi
push esi
add esp, 4
add esi, 0x5031
jmp 0x436b92
xor esi, 0x838
pop esi
mov edx, dword [ebp - 0x14]
add edx, 0x70
imul eax, dword [ebp - 0x10], 0x70
add eax, 0x44f3663b
imul ecx, dword [ebp - 0x10], 0x70
sub eax, ecx
xor edx, eax
imul edx, dword [ebp - 0x10]
mov dword [ebp - 0x15c0], edx
mov edx, dword [ebp - 0x3f0]
mov dword [ebp - 0x204c], edx
mov eax, dword [ebp - 0x204c]
add eax, dword [ebp - 0x15c0]
mov dword [ebp - 0x3f0], eax
push edi
call 0x436be9
add byte [ecx + 0x3d], cl
cmp dh, byte [esi]
cmp byte [ebx + eax*2 + 0x3a], al
dec esi
add esp, 4
add edi, 0x110ad
sub edi, 0x14d3f
call 0x436c06
add byte [edx + 0x41], al
dec edx
xor eax, 0x4f3d3b4e
add esp, 4
pop edi
mov byte [ebp - 0xbec], 0x52
mov byte [ebp - 0xbeb], 0xb9
mov byte [ebp - 0xbea], 0x10
mov byte [ebp - 0xbe9], 0x10
mov byte [ebp - 0xbe8], 0x10
mov byte [ebp - 0xbe7], 0x10
mov byte [ebp - 0xbe6], 0x5a
push eax
call 0x436c49
add byte [esi + 0x50], cl
dec edi
inc edx
cmp al, byte [eax + 0x3f]
add esp, 4
or eax, 0x71d6
add eax, 0x1760
pop eax
push edi
push edi
add esp, 4
jmp 0x436c66
or edi, 0x14059
pop edi
mov byte [ebp - 0xbe4], 0x52
mov byte [ebp - 0xbe3], 0xb9
mov byte [ebp - 0xbe2], 0x20
mov byte [ebp - 0xbe1], 0x20
mov byte [ebp - 0xbe0], 0x20
mov byte [ebp - 0xbdf], 0x20
mov byte [ebp - 0xbde], 0x5a
push edi
push edi
add esp, 4
xor edi, 0xb928
call 0x436cb5
add byte [ebx], bh
xor al, 0x3e
inc edi
dec eax
add esp, 4
and edi, 0x1599f
call 0x436ccc
add byte [ebp + 0x4a], cl
cmp al, 0x3b
cmp eax, 0x834c4d3a
les eax, [edi + ebx*2]
mov dword [ebp - 0x20ec], 0xe
push edi
push esi
add esp, 4
xor edi, 0x17f81
pop edi
push edx
or edx, 0xdca2
sub edx, 0x809e
sub edx, 0x117a6
and edx, 0x1f3e
pop edx
push eax
push ebx
add esp, 4
xor eax, 0x15bbd
pop eax
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xbec]
mov dword [ebp - 0x15c4], eax
push ecx
call 0x436d31
add byte [ebp + edi + 0x36], al
inc esi
dec ebp
dec ecx
inc esp
aas
aaa
add esp, 4
and ecx, 0x14615
or ecx, 0x589b
add ecx, 0xcecb
pop ecx
push edx
push ebx
add esp, 4
or edx, 0x126bc
pop edx
mov dword [ebp - 0x20f0], 0xffffffff
push edi
push esi
add esp, 4
or edi, 0xff61
xor edi, 0x5b0d
xor edi, 0x100b0
sub edi, 0xdb8b
pop edi
push ebx
add ebx, 0x10a83
sub ebx, 0xa5fd
xor ebx, 0xf9
pop ebx
mov ecx, dword [ebp - 0x3f0]
mov dword [ebp - 0x4fc], ecx
jmp 0x436dac
Function at 0x436cb5
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x13379797
pop eax
mov dword [ebp - 0x3f0], eax
push ecx
push esi
add esp, 4
call 0x436b3d
add byte [eax + 0x43], al
inc esi
aas
xor al, 0x4e
dec edi
aaa
cmp byte [ebx - 0x3e7efb3c], al
lahf
xor dword [ecx], eax
add byte [ecx + 0x1415ae9], al
add byte [ecx + 0xa29be9], al
add byte [ecx + 0x56], bl
add esi, 0xfe5
pop esi
mov ecx, dword [ebp - 0x20e8]
mov dword [ebp - 0x15c0], ecx
push ecx
push esi
add esp, 4
or ecx, 0xe8b4
add ecx, 0xb83b
jmp 0x436b7e
pop ecx
push esi
push esi
add esp, 4
add esi, 0x5031
jmp 0x436b92
xor esi, 0x838
pop esi
mov edx, dword [ebp - 0x14]
add edx, 0x70
imul eax, dword [ebp - 0x10], 0x70
add eax, 0x44f3663b
imul ecx, dword [ebp - 0x10], 0x70
sub eax, ecx
xor edx, eax
imul edx, dword [ebp - 0x10]
mov dword [ebp - 0x15c0], edx
mov edx, dword [ebp - 0x3f0]
mov dword [ebp - 0x204c], edx
mov eax, dword [ebp - 0x204c]
add eax, dword [ebp - 0x15c0]
mov dword [ebp - 0x3f0], eax
push edi
call 0x436be9
add byte [ecx + 0x3d], cl
cmp dh, byte [esi]
cmp byte [ebx + eax*2 + 0x3a], al
dec esi
add esp, 4
add edi, 0x110ad
sub edi, 0x14d3f
call 0x436c06
add byte [edx + 0x41], al
dec edx
xor eax, 0x4f3d3b4e
add esp, 4
pop edi
mov byte [ebp - 0xbec], 0x52
mov byte [ebp - 0xbeb], 0xb9
mov byte [ebp - 0xbea], 0x10
mov byte [ebp - 0xbe9], 0x10
mov byte [ebp - 0xbe8], 0x10
mov byte [ebp - 0xbe7], 0x10
mov byte [ebp - 0xbe6], 0x5a
push eax
call 0x436c49
add byte [esi + 0x50], cl
dec edi
inc edx
cmp al, byte [eax + 0x3f]
add esp, 4
or eax, 0x71d6
add eax, 0x1760
pop eax
push edi
push edi
add esp, 4
jmp 0x436c66
or edi, 0x14059
pop edi
mov byte [ebp - 0xbe4], 0x52
mov byte [ebp - 0xbe3], 0xb9
mov byte [ebp - 0xbe2], 0x20
mov byte [ebp - 0xbe1], 0x20
mov byte [ebp - 0xbe0], 0x20
mov byte [ebp - 0xbdf], 0x20
mov byte [ebp - 0xbde], 0x5a
push edi
push edi
add esp, 4
xor edi, 0xb928
call 0x436cb5
add byte [ebx], bh
xor al, 0x3e
inc edi
dec eax
add esp, 4
and edi, 0x1599f
call 0x436ccc
add byte [ebp + 0x4a], cl
cmp al, 0x3b
cmp eax, 0x834c4d3a
les eax, [edi + ebx*2]
mov dword [ebp - 0x20ec], 0xe
push edi
push esi
add esp, 4
xor edi, 0x17f81
pop edi
push edx
or edx, 0xdca2
sub edx, 0x809e
sub edx, 0x117a6
and edx, 0x1f3e
pop edx
push eax
push ebx
add esp, 4
xor eax, 0x15bbd
pop eax
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xbec]
mov dword [ebp - 0x15c4], eax
push ecx
call 0x436d31
add byte [ebp + edi + 0x36], al
inc esi
dec ebp
dec ecx
inc esp
aas
aaa
add esp, 4
and ecx, 0x14615
or ecx, 0x589b
add ecx, 0xcecb
pop ecx
push edx
push ebx
add esp, 4
or edx, 0x126bc
pop edx
mov dword [ebp - 0x20f0], 0xffffffff
push edi
push esi
add esp, 4
or edi, 0xff61
xor edi, 0x5b0d
xor edi, 0x100b0
sub edi, 0xdb8b
pop edi
push ebx
add ebx, 0x10a83
sub ebx, 0xa5fd
xor ebx, 0xf9
pop ebx
mov ecx, dword [ebp - 0x3f0]
mov dword [ebp - 0x4fc], ecx
jmp 0x436dac
Function at 0x436ccc
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x13379797
pop eax
mov dword [ebp - 0x3f0], eax
push ecx
push esi
add esp, 4
call 0x436b3d
add byte [eax + 0x43], al
inc esi
aas
xor al, 0x4e
dec edi
aaa
cmp byte [ebx - 0x3e7efb3c], al
lahf
xor dword [ecx], eax
add byte [ecx + 0x1415ae9], al
add byte [ecx + 0xa29be9], al
add byte [ecx + 0x56], bl
add esi, 0xfe5
pop esi
mov ecx, dword [ebp - 0x20e8]
mov dword [ebp - 0x15c0], ecx
push ecx
push esi
add esp, 4
or ecx, 0xe8b4
add ecx, 0xb83b
jmp 0x436b7e
pop ecx
push esi
push esi
add esp, 4
add esi, 0x5031
jmp 0x436b92
xor esi, 0x838
pop esi
mov edx, dword [ebp - 0x14]
add edx, 0x70
imul eax, dword [ebp - 0x10], 0x70
add eax, 0x44f3663b
imul ecx, dword [ebp - 0x10], 0x70
sub eax, ecx
xor edx, eax
imul edx, dword [ebp - 0x10]
mov dword [ebp - 0x15c0], edx
mov edx, dword [ebp - 0x3f0]
mov dword [ebp - 0x204c], edx
mov eax, dword [ebp - 0x204c]
add eax, dword [ebp - 0x15c0]
mov dword [ebp - 0x3f0], eax
push edi
call 0x436be9
add byte [ecx + 0x3d], cl
cmp dh, byte [esi]
cmp byte [ebx + eax*2 + 0x3a], al
dec esi
add esp, 4
add edi, 0x110ad
sub edi, 0x14d3f
call 0x436c06
add byte [edx + 0x41], al
dec edx
xor eax, 0x4f3d3b4e
add esp, 4
pop edi
mov byte [ebp - 0xbec], 0x52
mov byte [ebp - 0xbeb], 0xb9
mov byte [ebp - 0xbea], 0x10
mov byte [ebp - 0xbe9], 0x10
mov byte [ebp - 0xbe8], 0x10
mov byte [ebp - 0xbe7], 0x10
mov byte [ebp - 0xbe6], 0x5a
push eax
call 0x436c49
add byte [esi + 0x50], cl
dec edi
inc edx
cmp al, byte [eax + 0x3f]
add esp, 4
or eax, 0x71d6
add eax, 0x1760
pop eax
push edi
push edi
add esp, 4
jmp 0x436c66
or edi, 0x14059
pop edi
mov byte [ebp - 0xbe4], 0x52
mov byte [ebp - 0xbe3], 0xb9
mov byte [ebp - 0xbe2], 0x20
mov byte [ebp - 0xbe1], 0x20
mov byte [ebp - 0xbe0], 0x20
mov byte [ebp - 0xbdf], 0x20
mov byte [ebp - 0xbde], 0x5a
push edi
push edi
add esp, 4
xor edi, 0xb928
call 0x436cb5
add byte [ebx], bh
xor al, 0x3e
inc edi
dec eax
add esp, 4
and edi, 0x1599f
call 0x436ccc
add byte [ebp + 0x4a], cl
cmp al, 0x3b
cmp eax, 0x834c4d3a
les eax, [edi + ebx*2]
mov dword [ebp - 0x20ec], 0xe
push edi
push esi
add esp, 4
xor edi, 0x17f81
pop edi
push edx
or edx, 0xdca2
sub edx, 0x809e
sub edx, 0x117a6
and edx, 0x1f3e
pop edx
push eax
push ebx
add esp, 4
xor eax, 0x15bbd
pop eax
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xbec]
mov dword [ebp - 0x15c4], eax
push ecx
call 0x436d31
add byte [ebp + edi + 0x36], al
inc esi
dec ebp
dec ecx
inc esp
aas
aaa
add esp, 4
and ecx, 0x14615
or ecx, 0x589b
add ecx, 0xcecb
pop ecx
push edx
push ebx
add esp, 4
or edx, 0x126bc
pop edx
mov dword [ebp - 0x20f0], 0xffffffff
push edi
push esi
add esp, 4
or edi, 0xff61
xor edi, 0x5b0d
xor edi, 0x100b0
sub edi, 0xdb8b
pop edi
push ebx
add ebx, 0x10a83
sub ebx, 0xa5fd
xor ebx, 0xf9
pop ebx
mov ecx, dword [ebp - 0x3f0]
mov dword [ebp - 0x4fc], ecx
jmp 0x436dac
Function at 0x436d31
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x13379797
pop eax
mov dword [ebp - 0x3f0], eax
push ecx
push esi
add esp, 4
call 0x436b3d
add byte [eax + 0x43], al
inc esi
aas
xor al, 0x4e
dec edi
aaa
cmp byte [ebx - 0x3e7efb3c], al
lahf
xor dword [ecx], eax
add byte [ecx + 0x1415ae9], al
add byte [ecx + 0xa29be9], al
add byte [ecx + 0x56], bl
add esi, 0xfe5
pop esi
mov ecx, dword [ebp - 0x20e8]
mov dword [ebp - 0x15c0], ecx
push ecx
push esi
add esp, 4
or ecx, 0xe8b4
add ecx, 0xb83b
jmp 0x436b7e
pop ecx
push esi
push esi
add esp, 4
add esi, 0x5031
jmp 0x436b92
xor esi, 0x838
pop esi
mov edx, dword [ebp - 0x14]
add edx, 0x70
imul eax, dword [ebp - 0x10], 0x70
add eax, 0x44f3663b
imul ecx, dword [ebp - 0x10], 0x70
sub eax, ecx
xor edx, eax
imul edx, dword [ebp - 0x10]
mov dword [ebp - 0x15c0], edx
mov edx, dword [ebp - 0x3f0]
mov dword [ebp - 0x204c], edx
mov eax, dword [ebp - 0x204c]
add eax, dword [ebp - 0x15c0]
mov dword [ebp - 0x3f0], eax
push edi
call 0x436be9
add byte [ecx + 0x3d], cl
cmp dh, byte [esi]
cmp byte [ebx + eax*2 + 0x3a], al
dec esi
add esp, 4
add edi, 0x110ad
sub edi, 0x14d3f
call 0x436c06
add byte [edx + 0x41], al
dec edx
xor eax, 0x4f3d3b4e
add esp, 4
pop edi
mov byte [ebp - 0xbec], 0x52
mov byte [ebp - 0xbeb], 0xb9
mov byte [ebp - 0xbea], 0x10
mov byte [ebp - 0xbe9], 0x10
mov byte [ebp - 0xbe8], 0x10
mov byte [ebp - 0xbe7], 0x10
mov byte [ebp - 0xbe6], 0x5a
push eax
call 0x436c49
add byte [esi + 0x50], cl
dec edi
inc edx
cmp al, byte [eax + 0x3f]
add esp, 4
or eax, 0x71d6
add eax, 0x1760
pop eax
push edi
push edi
add esp, 4
jmp 0x436c66
or edi, 0x14059
pop edi
mov byte [ebp - 0xbe4], 0x52
mov byte [ebp - 0xbe3], 0xb9
mov byte [ebp - 0xbe2], 0x20
mov byte [ebp - 0xbe1], 0x20
mov byte [ebp - 0xbe0], 0x20
mov byte [ebp - 0xbdf], 0x20
mov byte [ebp - 0xbde], 0x5a
push edi
push edi
add esp, 4
xor edi, 0xb928
call 0x436cb5
add byte [ebx], bh
xor al, 0x3e
inc edi
dec eax
add esp, 4
and edi, 0x1599f
call 0x436ccc
add byte [ebp + 0x4a], cl
cmp al, 0x3b
cmp eax, 0x834c4d3a
les eax, [edi + ebx*2]
mov dword [ebp - 0x20ec], 0xe
push edi
push esi
add esp, 4
xor edi, 0x17f81
pop edi
push edx
or edx, 0xdca2
sub edx, 0x809e
sub edx, 0x117a6
and edx, 0x1f3e
pop edx
push eax
push ebx
add esp, 4
xor eax, 0x15bbd
pop eax
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xbec]
mov dword [ebp - 0x15c4], eax
push ecx
call 0x436d31
add byte [ebp + edi + 0x36], al
inc esi
dec ebp
dec ecx
inc esp
aas
aaa
add esp, 4
and ecx, 0x14615
or ecx, 0x589b
add ecx, 0xcecb
pop ecx
push edx
push ebx
add esp, 4
or edx, 0x126bc
pop edx
mov dword [ebp - 0x20f0], 0xffffffff
push edi
push esi
add esp, 4
or edi, 0xff61
xor edi, 0x5b0d
xor edi, 0x100b0
sub edi, 0xdb8b
pop edi
push ebx
add ebx, 0x10a83
sub ebx, 0xa5fd
xor ebx, 0xf9
pop ebx
mov ecx, dword [ebp - 0x3f0]
mov dword [ebp - 0x4fc], ecx
jmp 0x436dac
Function at 0x436eb4
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x436eb4
add byte [edi], bh
dec edx
dec eax
xor eax, 0xc4834b41
add al, 0x81
out 0x18, al
sbb dword [eax], eax
add byte [ecx + 0x1351fc6], al
add byte [esi - 0x75], bl
lea edi, [ebx + esi*8 - 1]
dec dword [ecx - 0x15cb73]
invalid
Function at 0x43977c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop eax
mov edx, dword [ebp - 0x1a04]
mov dword [ebp - 0x1a08], edx
lea eax, [ebp - 0x1738]
push eax
call dword [ebp - 0x1a08]
test eax, eax
jne 0x4397de
push ebx
push ecx
add esp, 4
sub ebx, 0x8e2a
xor ebx, 0xb11a
pop ebx
push edi
push ebx
add esp, 4
sub edi, 0x73ff
pop edi
push ebx
and ebx, 0x3998
and ebx, 0x17ec2
or ebx, 0x1553b
pop ebx
mov dword [ebp - 0xab4], 0
jmp 0x439ec9