joyce8/EMBER2024-capa huggingface dataset:
Function at 0x434928
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x4d0]
add edx, 1
mov dword [ebp - 0x4d0], edx
push ebx
call 0x434928
add byte [ebx + 0x40], al
cmp al, 0x4e
inc edx
dec edx
dec esi
inc esi
aaa
add esp, 4
and ebx, 0x70c8
sub ebx, 0x1866f
pop ebx
push ecx
push esi
add esp, 4
xor ecx, 0xf867
jmp 0x434948
pop ecx
mov eax, dword [ebp - 0x4d0]
sub eax, dword [ebp - 0x3c0]
cmp eax, 0xffffffff
jb 0x434991
push edi
push ecx
add esp, 4
sub edi, 0x12cbe
sub edi, 0x173de
add edi, 0x16b76
pop edi
push ecx
add ecx, 0x591b
add ecx, 0xd508
pop ecx
push edi
push ebx
add esp, 4
sub edi, 0xebcb
pop edi
jmp 0x434bbf
mov dword [ebp - 0xc10], 7
mov ecx, dword [ebp - 0x4d0]
mov dword [ebp - 0xa60], ecx
push eax
push ebx
add esp, 4
jmp 0x4349b3
pop eax
push edi
push ebx
add esp, 4
call 0x4349c9
add byte [esi], bh
cmp dword ds:[edi], edi
inc edx
push eax
xor ecx, dword ds:[edi + 0x38]
add esp, 4
or edi, 0x15ebb
or edi, 0x1357f
pop edi
mov edx, dword [ebp - 0x14c8]
mov dword [ebp - 0x9f0], edx
mov dword [ebp - 0xc14], 0
mov eax, dword [ebp - 0x4d0]
cmp eax, dword [ebp - 0x14c8]
jne 0x434a40
push esi
or esi, 0x648
pop esi
push edx
push eax
add esp, 4
add edx, 0x10f0d
pop edx
push edi
jmp 0x434a1a
pop edi
push ecx
add ecx, 0x9564
add ecx, 0x2a68
xor ecx, 0x1266b
pop ecx
mov ecx, dword [ebp - 0xc14]
mov dword [ebp - 0x14d0], ecx
jmp 0x434b71
cmp dword [ebp - 0xc10], 0
jle 0x434b65
push edx
push eax
add esp, 4
xor edx, 0x92e3
pop edx
push edi
add edi, 0xd1c0
pop edi
push edi
jmp 0x434a6b
add edi, 0x3c37
pop edi
push ecx
jmp 0x434a78
jmp 0x434a7e
pop ecx
mov edx, dword [ebp - 0xa60]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x9f0]
movzx edx, byte [ecx]
cmp eax, edx
je 0x434b01
push esi
push edi
add esp, 4
call 0x434aa6
add byte [edx], dh
inc ebx
dec edi
dec ebx
xor al, 0x50
add esp, 4
and esi, 0xa07b
pop esi
push ebx
push edx
add esp, 4
call 0x434ac3
add byte [edx + ecx*2], dh
cmp eax, 0x3e4c3347
dec esi
add esp, 4
pop ebx
mov eax, dword [ebp - 0xa60]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x9f0]
movzx eax, byte [edx]
cmp ecx, eax
jle 0x434ae9
mov dword [ebp - 0x14cc], 1
jmp 0x434af3
mov dword [ebp - 0x14cc], 0xffffffff
mov ecx, dword [ebp - 0x14cc]
mov dword [ebp - 0xc14], ecx
jmp 0x434b65
push edx
push edx
add esp, 4
and edx, 0x11578
pop edx
push ebx
call 0x434b1b
add byte [ebp + 0x38], cl
cmp al, 0x44
inc edi
cmp byte [edx - 0x7d], cl
les eax, [ebx + ebx*2]
push ecx
and ecx, 0x16b18
xor ecx, 0x9b8e
sub ecx, 0x14f05
pop ecx
mov edx, dword [ebp - 0xc10]
sub edx, 1
mov dword [ebp - 0xc10], edx
mov eax, dword [ebp - 0xa60]
add eax, 1
mov dword [ebp - 0xa60], eax
mov ecx, dword [ebp - 0x9f0]
add ecx, 1
mov dword [ebp - 0x9f0], ecx
jmp 0x434a40
mov edx, dword [ebp - 0xc14]
mov dword [ebp - 0x14d0], edx
cmp dword [ebp - 0x14d0], 0
jne 0x434bba
push edi
add edi, 0x143e2
add byte [ecx + 0x23c4ef], al
add byte [edi + 0x53], bl
jmp 0x434908
push ebx
add ebx, 0xa073
pop ebx
push edi
sub edi, 0xffbc
sub edi, 0x10d73
add edi, 0xa68a
pop edi
push edi
and edi, 0xd489
pop edi
push ebx
add ebx, 0x6153
or ebx, 0x8bf6
pop ebx
mov dword [ebp - 0xa5c], 0
Function at 0x4349c9
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x4d0]
add edx, 1
mov dword [ebp - 0x4d0], edx
push ebx
call 0x434928
add byte [ebx + 0x40], al
cmp al, 0x4e
inc edx
dec edx
dec esi
inc esi
aaa
add esp, 4
and ebx, 0x70c8
sub ebx, 0x1866f
pop ebx
push ecx
push esi
add esp, 4
xor ecx, 0xf867
jmp 0x434948
pop ecx
mov eax, dword [ebp - 0x4d0]
sub eax, dword [ebp - 0x3c0]
cmp eax, 0xffffffff
jb 0x434991
push edi
push ecx
add esp, 4
sub edi, 0x12cbe
sub edi, 0x173de
add edi, 0x16b76
pop edi
push ecx
add ecx, 0x591b
add ecx, 0xd508
pop ecx
push edi
push ebx
add esp, 4
sub edi, 0xebcb
pop edi
jmp 0x434bbf
mov dword [ebp - 0xc10], 7
mov ecx, dword [ebp - 0x4d0]
mov dword [ebp - 0xa60], ecx
push eax
push ebx
add esp, 4
jmp 0x4349b3
pop eax
push edi
push ebx
add esp, 4
call 0x4349c9
add byte [esi], bh
cmp dword ds:[edi], edi
inc edx
push eax
xor ecx, dword ds:[edi + 0x38]
add esp, 4
or edi, 0x15ebb
or edi, 0x1357f
pop edi
mov edx, dword [ebp - 0x14c8]
mov dword [ebp - 0x9f0], edx
mov dword [ebp - 0xc14], 0
mov eax, dword [ebp - 0x4d0]
cmp eax, dword [ebp - 0x14c8]
jne 0x434a40
push esi
or esi, 0x648
pop esi
push edx
push eax
add esp, 4
add edx, 0x10f0d
pop edx
push edi
jmp 0x434a1a
pop edi
push ecx
add ecx, 0x9564
add ecx, 0x2a68
xor ecx, 0x1266b
pop ecx
mov ecx, dword [ebp - 0xc14]
mov dword [ebp - 0x14d0], ecx
jmp 0x434b71
cmp dword [ebp - 0xc10], 0
jle 0x434b65
push edx
push eax
add esp, 4
xor edx, 0x92e3
pop edx
push edi
add edi, 0xd1c0
pop edi
push edi
jmp 0x434a6b
add edi, 0x3c37
pop edi
push ecx
jmp 0x434a78
jmp 0x434a7e
pop ecx
mov edx, dword [ebp - 0xa60]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x9f0]
movzx edx, byte [ecx]
cmp eax, edx
je 0x434b01
push esi
push edi
add esp, 4
call 0x434aa6
add byte [edx], dh
inc ebx
dec edi
dec ebx
xor al, 0x50
add esp, 4
and esi, 0xa07b
pop esi
push ebx
push edx
add esp, 4
call 0x434ac3
add byte [edx + ecx*2], dh
cmp eax, 0x3e4c3347
dec esi
add esp, 4
pop ebx
mov eax, dword [ebp - 0xa60]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x9f0]
movzx eax, byte [edx]
cmp ecx, eax
jle 0x434ae9
mov dword [ebp - 0x14cc], 1
jmp 0x434af3
mov dword [ebp - 0x14cc], 0xffffffff
mov ecx, dword [ebp - 0x14cc]
mov dword [ebp - 0xc14], ecx
jmp 0x434b65
push edx
push edx
add esp, 4
and edx, 0x11578
pop edx
push ebx
call 0x434b1b
add byte [ebp + 0x38], cl
cmp al, 0x44
inc edi
cmp byte [edx - 0x7d], cl
les eax, [ebx + ebx*2]
push ecx
and ecx, 0x16b18
xor ecx, 0x9b8e
sub ecx, 0x14f05
pop ecx
mov edx, dword [ebp - 0xc10]
sub edx, 1
mov dword [ebp - 0xc10], edx
mov eax, dword [ebp - 0xa60]
add eax, 1
mov dword [ebp - 0xa60], eax
mov ecx, dword [ebp - 0x9f0]
add ecx, 1
mov dword [ebp - 0x9f0], ecx
jmp 0x434a40
mov edx, dword [ebp - 0xc14]
mov dword [ebp - 0x14d0], edx
cmp dword [ebp - 0x14d0], 0
jne 0x434bba
push edi
add edi, 0x143e2
add byte [ecx + 0x23c4ef], al
add byte [edi + 0x53], bl
jmp 0x434908
push ebx
add ebx, 0xa073
pop ebx
push edi
sub edi, 0xffbc
sub edi, 0x10d73
add edi, 0xa68a
pop edi
push edi
and edi, 0xd489
pop edi
push ebx
add ebx, 0x6153
or ebx, 0x8bf6
pop ebx
mov dword [ebp - 0xa5c], 0
Function at 0x434aa6
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x4d0]
add edx, 1
mov dword [ebp - 0x4d0], edx
push ebx
call 0x434928
add byte [ebx + 0x40], al
cmp al, 0x4e
inc edx
dec edx
dec esi
inc esi
aaa
add esp, 4
and ebx, 0x70c8
sub ebx, 0x1866f
pop ebx
push ecx
push esi
add esp, 4
xor ecx, 0xf867
jmp 0x434948
pop ecx
mov eax, dword [ebp - 0x4d0]
sub eax, dword [ebp - 0x3c0]
cmp eax, 0xffffffff
jb 0x434991
push edi
push ecx
add esp, 4
sub edi, 0x12cbe
sub edi, 0x173de
add edi, 0x16b76
pop edi
push ecx
add ecx, 0x591b
add ecx, 0xd508
pop ecx
push edi
push ebx
add esp, 4
sub edi, 0xebcb
pop edi
jmp 0x434bbf
mov dword [ebp - 0xc10], 7
mov ecx, dword [ebp - 0x4d0]
mov dword [ebp - 0xa60], ecx
push eax
push ebx
add esp, 4
jmp 0x4349b3
pop eax
push edi
push ebx
add esp, 4
call 0x4349c9
add byte [esi], bh
cmp dword ds:[edi], edi
inc edx
push eax
xor ecx, dword ds:[edi + 0x38]
add esp, 4
or edi, 0x15ebb
or edi, 0x1357f
pop edi
mov edx, dword [ebp - 0x14c8]
mov dword [ebp - 0x9f0], edx
mov dword [ebp - 0xc14], 0
mov eax, dword [ebp - 0x4d0]
cmp eax, dword [ebp - 0x14c8]
jne 0x434a40
push esi
or esi, 0x648
pop esi
push edx
push eax
add esp, 4
add edx, 0x10f0d
pop edx
push edi
jmp 0x434a1a
pop edi
push ecx
add ecx, 0x9564
add ecx, 0x2a68
xor ecx, 0x1266b
pop ecx
mov ecx, dword [ebp - 0xc14]
mov dword [ebp - 0x14d0], ecx
jmp 0x434b71
cmp dword [ebp - 0xc10], 0
jle 0x434b65
push edx
push eax
add esp, 4
xor edx, 0x92e3
pop edx
push edi
add edi, 0xd1c0
pop edi
push edi
jmp 0x434a6b
add edi, 0x3c37
pop edi
push ecx
jmp 0x434a78
jmp 0x434a7e
pop ecx
mov edx, dword [ebp - 0xa60]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x9f0]
movzx edx, byte [ecx]
cmp eax, edx
je 0x434b01
push esi
push edi
add esp, 4
call 0x434aa6
add byte [edx], dh
inc ebx
dec edi
dec ebx
xor al, 0x50
add esp, 4
and esi, 0xa07b
pop esi
push ebx
push edx
add esp, 4
call 0x434ac3
add byte [edx + ecx*2], dh
cmp eax, 0x3e4c3347
dec esi
add esp, 4
pop ebx
mov eax, dword [ebp - 0xa60]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x9f0]
movzx eax, byte [edx]
cmp ecx, eax
jle 0x434ae9
mov dword [ebp - 0x14cc], 1
jmp 0x434af3
mov dword [ebp - 0x14cc], 0xffffffff
mov ecx, dword [ebp - 0x14cc]
mov dword [ebp - 0xc14], ecx
jmp 0x434b65
push edx
push edx
add esp, 4
and edx, 0x11578
pop edx
push ebx
call 0x434b1b
add byte [ebp + 0x38], cl
cmp al, 0x44
inc edi
cmp byte [edx - 0x7d], cl
les eax, [ebx + ebx*2]
push ecx
and ecx, 0x16b18
xor ecx, 0x9b8e
sub ecx, 0x14f05
pop ecx
mov edx, dword [ebp - 0xc10]
sub edx, 1
mov dword [ebp - 0xc10], edx
mov eax, dword [ebp - 0xa60]
add eax, 1
mov dword [ebp - 0xa60], eax
mov ecx, dword [ebp - 0x9f0]
add ecx, 1
mov dword [ebp - 0x9f0], ecx
jmp 0x434a40
mov edx, dword [ebp - 0xc14]
mov dword [ebp - 0x14d0], edx
cmp dword [ebp - 0x14d0], 0
jne 0x434bba
push edi
add edi, 0x143e2
add byte [ecx + 0x23c4ef], al
add byte [edi + 0x53], bl
jmp 0x434908
push ebx
add ebx, 0xa073
pop ebx
push edi
sub edi, 0xffbc
sub edi, 0x10d73
add edi, 0xa68a
pop edi
push edi
and edi, 0xd489
pop edi
push ebx
add ebx, 0x6153
or ebx, 0x8bf6
pop ebx
mov dword [ebp - 0xa5c], 0
Function at 0x434ac3
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x4d0]
add edx, 1
mov dword [ebp - 0x4d0], edx
push ebx
call 0x434928
add byte [ebx + 0x40], al
cmp al, 0x4e
inc edx
dec edx
dec esi
inc esi
aaa
add esp, 4
and ebx, 0x70c8
sub ebx, 0x1866f
pop ebx
push ecx
push esi
add esp, 4
xor ecx, 0xf867
jmp 0x434948
pop ecx
mov eax, dword [ebp - 0x4d0]
sub eax, dword [ebp - 0x3c0]
cmp eax, 0xffffffff
jb 0x434991
push edi
push ecx
add esp, 4
sub edi, 0x12cbe
sub edi, 0x173de
add edi, 0x16b76
pop edi
push ecx
add ecx, 0x591b
add ecx, 0xd508
pop ecx
push edi
push ebx
add esp, 4
sub edi, 0xebcb
pop edi
jmp 0x434bbf
mov dword [ebp - 0xc10], 7
mov ecx, dword [ebp - 0x4d0]
mov dword [ebp - 0xa60], ecx
push eax
push ebx
add esp, 4
jmp 0x4349b3
pop eax
push edi
push ebx
add esp, 4
call 0x4349c9
add byte [esi], bh
cmp dword ds:[edi], edi
inc edx
push eax
xor ecx, dword ds:[edi + 0x38]
add esp, 4
or edi, 0x15ebb
or edi, 0x1357f
pop edi
mov edx, dword [ebp - 0x14c8]
mov dword [ebp - 0x9f0], edx
mov dword [ebp - 0xc14], 0
mov eax, dword [ebp - 0x4d0]
cmp eax, dword [ebp - 0x14c8]
jne 0x434a40
push esi
or esi, 0x648
pop esi
push edx
push eax
add esp, 4
add edx, 0x10f0d
pop edx
push edi
jmp 0x434a1a
pop edi
push ecx
add ecx, 0x9564
add ecx, 0x2a68
xor ecx, 0x1266b
pop ecx
mov ecx, dword [ebp - 0xc14]
mov dword [ebp - 0x14d0], ecx
jmp 0x434b71
cmp dword [ebp - 0xc10], 0
jle 0x434b65
push edx
push eax
add esp, 4
xor edx, 0x92e3
pop edx
push edi
add edi, 0xd1c0
pop edi
push edi
jmp 0x434a6b
add edi, 0x3c37
pop edi
push ecx
jmp 0x434a78
jmp 0x434a7e
pop ecx
mov edx, dword [ebp - 0xa60]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x9f0]
movzx edx, byte [ecx]
cmp eax, edx
je 0x434b01
push esi
push edi
add esp, 4
call 0x434aa6
add byte [edx], dh
inc ebx
dec edi
dec ebx
xor al, 0x50
add esp, 4
and esi, 0xa07b
pop esi
push ebx
push edx
add esp, 4
call 0x434ac3
add byte [edx + ecx*2], dh
cmp eax, 0x3e4c3347
dec esi
add esp, 4
pop ebx
mov eax, dword [ebp - 0xa60]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x9f0]
movzx eax, byte [edx]
cmp ecx, eax
jle 0x434ae9
mov dword [ebp - 0x14cc], 1
jmp 0x434af3
mov dword [ebp - 0x14cc], 0xffffffff
mov ecx, dword [ebp - 0x14cc]
mov dword [ebp - 0xc14], ecx
jmp 0x434b65
push edx
push edx
add esp, 4
and edx, 0x11578
pop edx
push ebx
call 0x434b1b
add byte [ebp + 0x38], cl
cmp al, 0x44
inc edi
cmp byte [edx - 0x7d], cl
les eax, [ebx + ebx*2]
push ecx
and ecx, 0x16b18
xor ecx, 0x9b8e
sub ecx, 0x14f05
pop ecx
mov edx, dword [ebp - 0xc10]
sub edx, 1
mov dword [ebp - 0xc10], edx
mov eax, dword [ebp - 0xa60]
add eax, 1
mov dword [ebp - 0xa60], eax
mov ecx, dword [ebp - 0x9f0]
add ecx, 1
mov dword [ebp - 0x9f0], ecx
jmp 0x434a40
mov edx, dword [ebp - 0xc14]
mov dword [ebp - 0x14d0], edx
cmp dword [ebp - 0x14d0], 0
jne 0x434bba
push edi
add edi, 0x143e2
add byte [ecx + 0x23c4ef], al
add byte [edi + 0x53], bl
jmp 0x434908
push ebx
add ebx, 0xa073
pop ebx
push edi
sub edi, 0xffbc
sub edi, 0x10d73
add edi, 0xa68a
pop edi
push edi
and edi, 0xd489
pop edi
push ebx
add ebx, 0x6153
or ebx, 0x8bf6
pop ebx
mov dword [ebp - 0xa5c], 0
Function at 0x434b1b
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x4d0]
add edx, 1
mov dword [ebp - 0x4d0], edx
push ebx
call 0x434928
add byte [ebx + 0x40], al
cmp al, 0x4e
inc edx
dec edx
dec esi
inc esi
aaa
add esp, 4
and ebx, 0x70c8
sub ebx, 0x1866f
pop ebx
push ecx
push esi
add esp, 4
xor ecx, 0xf867
jmp 0x434948
pop ecx
mov eax, dword [ebp - 0x4d0]
sub eax, dword [ebp - 0x3c0]
cmp eax, 0xffffffff
jb 0x434991
push edi
push ecx
add esp, 4
sub edi, 0x12cbe
sub edi, 0x173de
add edi, 0x16b76
pop edi
push ecx
add ecx, 0x591b
add ecx, 0xd508
pop ecx
push edi
push ebx
add esp, 4
sub edi, 0xebcb
pop edi
jmp 0x434bbf
mov dword [ebp - 0xc10], 7
mov ecx, dword [ebp - 0x4d0]
mov dword [ebp - 0xa60], ecx
push eax
push ebx
add esp, 4
jmp 0x4349b3
pop eax
push edi
push ebx
add esp, 4
call 0x4349c9
add byte [esi], bh
cmp dword ds:[edi], edi
inc edx
push eax
xor ecx, dword ds:[edi + 0x38]
add esp, 4
or edi, 0x15ebb
or edi, 0x1357f
pop edi
mov edx, dword [ebp - 0x14c8]
mov dword [ebp - 0x9f0], edx
mov dword [ebp - 0xc14], 0
mov eax, dword [ebp - 0x4d0]
cmp eax, dword [ebp - 0x14c8]
jne 0x434a40
push esi
or esi, 0x648
pop esi
push edx
push eax
add esp, 4
add edx, 0x10f0d
pop edx
push edi
jmp 0x434a1a
pop edi
push ecx
add ecx, 0x9564
add ecx, 0x2a68
xor ecx, 0x1266b
pop ecx
mov ecx, dword [ebp - 0xc14]
mov dword [ebp - 0x14d0], ecx
jmp 0x434b71
cmp dword [ebp - 0xc10], 0
jle 0x434b65
push edx
push eax
add esp, 4
xor edx, 0x92e3
pop edx
push edi
add edi, 0xd1c0
pop edi
push edi
jmp 0x434a6b
add edi, 0x3c37
pop edi
push ecx
jmp 0x434a78
jmp 0x434a7e
pop ecx
mov edx, dword [ebp - 0xa60]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x9f0]
movzx edx, byte [ecx]
cmp eax, edx
je 0x434b01
push esi
push edi
add esp, 4
call 0x434aa6
add byte [edx], dh
inc ebx
dec edi
dec ebx
xor al, 0x50
add esp, 4
and esi, 0xa07b
pop esi
push ebx
push edx
add esp, 4
call 0x434ac3
add byte [edx + ecx*2], dh
cmp eax, 0x3e4c3347
dec esi
add esp, 4
pop ebx
mov eax, dword [ebp - 0xa60]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x9f0]
movzx eax, byte [edx]
cmp ecx, eax
jle 0x434ae9
mov dword [ebp - 0x14cc], 1
jmp 0x434af3
mov dword [ebp - 0x14cc], 0xffffffff
mov ecx, dword [ebp - 0x14cc]
mov dword [ebp - 0xc14], ecx
jmp 0x434b65
push edx
push edx
add esp, 4
and edx, 0x11578
pop edx
push ebx
call 0x434b1b
add byte [ebp + 0x38], cl
cmp al, 0x44
inc edi
cmp byte [edx - 0x7d], cl
les eax, [ebx + ebx*2]
push ecx
and ecx, 0x16b18
xor ecx, 0x9b8e
sub ecx, 0x14f05
pop ecx
mov edx, dword [ebp - 0xc10]
sub edx, 1
mov dword [ebp - 0xc10], edx
mov eax, dword [ebp - 0xa60]
add eax, 1
mov dword [ebp - 0xa60], eax
mov ecx, dword [ebp - 0x9f0]
add ecx, 1
mov dword [ebp - 0x9f0], ecx
jmp 0x434a40
mov edx, dword [ebp - 0xc14]
mov dword [ebp - 0x14d0], edx
cmp dword [ebp - 0x14d0], 0
jne 0x434bba
push edi
add edi, 0x143e2
add byte [ecx + 0x23c4ef], al
add byte [edi + 0x53], bl
jmp 0x434908
push ebx
add ebx, 0xa073
pop ebx
push edi
sub edi, 0xffbc
sub edi, 0x10d73
add edi, 0xa68a
pop edi
push edi
and edi, 0xd489
pop edi
push ebx
add ebx, 0x6153
or ebx, 0x8bf6
pop ebx
mov dword [ebp - 0xa5c], 0
Function at 0x434c09
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [ecx + 0x23c4ef], al
add byte [edi + 0x53], bl
or ebx, 0xf886
pop ebx
push esi
add esi, 0xdb37
xor esi, 0x11c0e
add esi, 0x160ec
jmp 0x434bab
pop esi
mov eax, dword [ebp - 0x4d0]
mov dword [ebp - 0xa5c], eax
jmp 0x434bfb
push ecx
call 0x434c09
add byte [edi], dh
aas
dec edi
cmp byte [ecx + 0x45], cl
xor al, byte [ebx - 0x1e7efb3c]
ret

Function at 0x434ca0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
pop edi
push edi
push edi
add esp, 4
xor edi, 0x11dd5
add edi, 0x17946
pop edi
mov ecx, 0x6b
mov word [ebp - 0x1628], cx
mov edx, 0x65
add byte gs:[eax], al
add byte [esi - 0x77], ah
xchg ebp, eax
fucompp
invalid
invalid
mov eax, 0x72
mov word [ebp - 0x1624], ax
mov ecx, 0x6e
mov word [ebp - 0x1622], cx
mov edx, 0x65
mov word [ebp - 0x1620], dx
mov eax, 0x6c
mov word [ebp - 0x161e], ax
mov ecx, 0x33
mov word [ebp - 0x161c], cx
mov edx, 0x32
mov word [ebp - 0x161a], dx
mov eax, 0x2e
mov word [ebp - 0x1618], ax
mov ecx, 0x64
mov word [ebp - 0x1616], cx
mov edx, 0x6c
mov word [ebp - 0x1614], dx
mov eax, 0x6c
mov word [ebp - 0x1612], ax
xor ecx, ecx
mov word [ebp - 0x1610], cx
push esi
push edx
add esp, 4
add al, 0x81
into
jg 0x434d63
add dword [eax], eax
pop esi
push ecx
push ecx
add esp, 4
xor ecx, 0xd28b
sub ecx, 0x3ab4
pop ecx
push eax
add eax, 0x14ad2
and eax, 0x4ba4
sub eax, 0x1a95
pop eax
push edx
push ebx
add esp, 4
call fcn.00434d90
add byte [eax + 0x40], dl
inc esp
xor eax, 0x83494b3b
add esp, 4
pop edx

Function at 0x434cc0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte gs:[eax], al
add byte [esi - 0x77], ah
xchg ebp, eax
fucompp
invalid

Function at 0x434d90
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edx
push esi
push ecx
add esp, 4
call 0x434da6
add byte [eax + 0x3e], al
push eax
dec eax
push eax
inc edx
cmp al, 0x83
les eax, [ecx + eax*4]
idiv byte [edi + 5]
add dword [eax], eax
pop esi

Function at 0x434da6
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edx
push esi
push ecx
add esp, 4
call 0x434da6
add byte [eax + 0x3e], al
push eax
dec eax
push eax
inc edx
cmp al, 0x83
les eax, [ecx + eax*4]
idiv byte [edi + 5]
add dword [eax], eax
pop esi
Function at 0x43534a
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edx
xor edx, 0x140ff
pop edx
push ebx
push edx
add esp, 4
sub ebx, 0x6792
or ebx, 0x102ee
pop ebx
push edx
and edx, 0xc22e
call fcn.0043534a
add byte [edx], bh
dec ebx
dec esp
xor al, byte ss:[eax + 0x40]
add esp, 4
pop edx
lea edx, [ebp - 0x16cc]
mov dword [ebp - 0xc28], edx
mov eax, dword [ebp - 0x4d8]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc24], ecx
xor edx, edx
mov word [ebp - 0x1fc], dx
xor eax, eax
mov word [ebp - 0x104], ax
push ebx
push esi
add esp, 4
or ebx, 0xd774
sub ebx, 0x12d06
pop ebx
push edi
push ecx
add esp, 4
or edi, 0x123d8
and edi, 0xba8b
pop edi
push ebx
or ebx, 0xf36b
or ebx, 0x7d8b
pop ebx
mov ecx, dword [ebp - 0xc24]
mov dx, word [ecx]
mov word [ebp - 0xf82], dx
mov eax, dword [ebp - 0xc24]
add eax, 2
mov dword [ebp - 0xc24], eax
mov cx, word [ebp - 0xf82]
mov word [ebp - 0x1fc], cx
mov edx, dword [ebp - 0xc28]
mov ax, word [edx]
mov word [ebp - 0xf84], ax
mov ecx, dword [ebp - 0xc28]
add ecx, 2
mov dword [ebp - 0xc28], ecx
mov dx, word [ebp - 0xf84]
mov word [ebp - 0x104], dx
push esi
push eax
add esp, 4
or esi, 0x10e6a
pop esi
push eax
call 0x435423
add byte [eax + 0x49], cl
xor al, 0x3a
inc esp
cmp dword [edi + 0x3e], ecx
xor al, byte [ebx - 0x377efb3c]
rcl byte [ecx], 0
add byte [eax + 0x51], bl
push edx
add esp, 4
xor ecx, 0x868
pop ecx
movzx eax, word [ebp - 0x104]
test eax, eax
jne 0x43545c
movzx ecx, word [ebp - 0x1fc]
movzx edx, word [ebp - 0x104]
sub ecx, edx
mov dword [ebp - 0x14e4], ecx
jmp 0x4354bf
movzx eax, word [ebp - 0x1fc]
movzx ecx, word [ebp - 0x104]
cmp eax, ecx
je 0x43537b
movzx edx, word [ebp - 0x1fc]
xor edx, 0x20
movzx eax, word [ebp - 0x104]
cmp edx, eax
je 0x43537b
movzx ecx, word [ebp - 0x1fc]
movzx edx, word [ebp - 0x104]
cmp ecx, edx
jge 0x4354a9
mov dword [ebp - 0x14e0], 0xffffffff
jmp 0x4354b3
mov dword [ebp - 0x14e0], 1
mov eax, dword [ebp - 0x14e0]
mov dword [ebp - 0x14e4], eax
cmp dword [ebp - 0x14e4], 0
jne 0x435508
push esi
jmp 0x4354d0
add esi, 0xa38d
pop esi
push ecx
push ecx
add esp, 4
call 0x4354e8
add byte [edi + 0x41], cl
cmp dh, byte [edx]
inc eax
cmp eax, dword [ebx + 0x525904c4]
and edx, 0x7bb
and edx, 0x140c0
pop edx
mov ecx, dword [ebp - 0x4d8]
mov dword [ebp - 0x6ec], ecx
jmp 0x435570
push edx
push esi
add esp, 4
call 0x43551b
add byte [0x40384036], bh
inc eax
dec edx
xor al, 0x83
les eax, [edx + ebx*2]
push edi
jmp 0x435528
jmp 0x43552d
and edi, 0x17f65
xor edi, 0x158ae
pop edi
mov edx, dword [ebp - 0x4d8]
mov eax, dword [edx]
mov dword [ebp - 0x4d8], eax
mov ecx, dword [ebp - 0x4d8]
cmp ecx, dword [ebp - 0xc2c]
je 0x435566
mov edx, dword [ebp - 0x4d8]
cmp dword [edx + 0x30], 0
jne 0x43531c
mov dword [ebp - 0x6ec], 0
Function at 0x435423
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edx
xor edx, 0x140ff
pop edx
push ebx
push edx
add esp, 4
sub ebx, 0x6792
or ebx, 0x102ee
pop ebx
push edx
and edx, 0xc22e
call fcn.0043534a
add byte [edx], bh
dec ebx
dec esp
xor al, byte ss:[eax + 0x40]
add esp, 4
pop edx
lea edx, [ebp - 0x16cc]
mov dword [ebp - 0xc28], edx
mov eax, dword [ebp - 0x4d8]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc24], ecx
xor edx, edx
mov word [ebp - 0x1fc], dx
xor eax, eax
mov word [ebp - 0x104], ax
push ebx
push esi
add esp, 4
or ebx, 0xd774
sub ebx, 0x12d06
pop ebx
push edi
push ecx
add esp, 4
or edi, 0x123d8
and edi, 0xba8b
pop edi
push ebx
or ebx, 0xf36b
or ebx, 0x7d8b
pop ebx
mov ecx, dword [ebp - 0xc24]
mov dx, word [ecx]
mov word [ebp - 0xf82], dx
mov eax, dword [ebp - 0xc24]
add eax, 2
mov dword [ebp - 0xc24], eax
mov cx, word [ebp - 0xf82]
mov word [ebp - 0x1fc], cx
mov edx, dword [ebp - 0xc28]
mov ax, word [edx]
mov word [ebp - 0xf84], ax
mov ecx, dword [ebp - 0xc28]
add ecx, 2
mov dword [ebp - 0xc28], ecx
mov dx, word [ebp - 0xf84]
mov word [ebp - 0x104], dx
push esi
push eax
add esp, 4
or esi, 0x10e6a
pop esi
push eax
call 0x435423
add byte [eax + 0x49], cl
xor al, 0x3a
inc esp
cmp dword [edi + 0x3e], ecx
xor al, byte [ebx - 0x377efb3c]
rcl byte [ecx], 0
add byte [eax + 0x51], bl
push edx
add esp, 4
xor ecx, 0x868
pop ecx
movzx eax, word [ebp - 0x104]
test eax, eax
jne 0x43545c
movzx ecx, word [ebp - 0x1fc]
movzx edx, word [ebp - 0x104]
sub ecx, edx
mov dword [ebp - 0x14e4], ecx
jmp 0x4354bf
movzx eax, word [ebp - 0x1fc]
movzx ecx, word [ebp - 0x104]
cmp eax, ecx
je 0x43537b
movzx edx, word [ebp - 0x1fc]
xor edx, 0x20
movzx eax, word [ebp - 0x104]
cmp edx, eax
je 0x43537b
movzx ecx, word [ebp - 0x1fc]
movzx edx, word [ebp - 0x104]
cmp ecx, edx
jge 0x4354a9
mov dword [ebp - 0x14e0], 0xffffffff
jmp 0x4354b3
mov dword [ebp - 0x14e0], 1
mov eax, dword [ebp - 0x14e0]
mov dword [ebp - 0x14e4], eax
cmp dword [ebp - 0x14e4], 0
jne 0x435508
push esi
jmp 0x4354d0
add esi, 0xa38d
pop esi
push ecx
push ecx
add esp, 4
call 0x4354e8
add byte [edi + 0x41], cl
cmp dh, byte [edx]
inc eax
cmp eax, dword [ebx + 0x525904c4]
and edx, 0x7bb
and edx, 0x140c0
pop edx
mov ecx, dword [ebp - 0x4d8]
mov dword [ebp - 0x6ec], ecx
jmp 0x435570
push edx
push esi
add esp, 4
call 0x43551b
add byte [0x40384036], bh
inc eax
dec edx
xor al, 0x83
les eax, [edx + ebx*2]
push edi
jmp 0x435528
jmp 0x43552d
and edi, 0x17f65
xor edi, 0x158ae
pop edi
mov edx, dword [ebp - 0x4d8]
mov eax, dword [edx]
mov dword [ebp - 0x4d8], eax
mov ecx, dword [ebp - 0x4d8]
cmp ecx, dword [ebp - 0xc2c]
je 0x435566
mov edx, dword [ebp - 0x4d8]
cmp dword [edx + 0x30], 0
jne 0x43531c
mov dword [ebp - 0x6ec], 0