joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52d468
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff68
push ebx
push esi
xor edx, edx
mov dword [ebp - 4], edx
xor eax, eax
push ebp
push 0x52d5c5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x52d5dc
call fcn.00404d18
mov dword [ebp - 0x98], 0x94
lea eax, [ebp - 0x98]
push eax
call sub.kernel32.dll_GetVersionExA
mov eax, dword [ebp - 0x88]
mov esi, dword [ebp - 0x94]
mov ebx, dword [ebp - 0x90]
cmp eax, 2
jne 0x52d568
lea eax, [ebp - 4]
mov edx, 0x52d5ec
call fcn.00404d18
cmp esi, 5
jne 0x52d4e7
test ebx, ebx
jne 0x52d4e7
lea eax, [ebp - 4]
mov edx, 0x52d5fc
call fcn.00404d18
cmp esi, 5
jne 0x52d503
cmp ebx, 1
je 0x52d4f6
cmp ebx, 2
jne 0x52d503
lea eax, [ebp - 4]
mov edx, 0x52d610
call fcn.00404d18
cmp esi, 6
jne 0x52d519
test ebx, ebx
jne 0x52d519
lea eax, [ebp - 4]
mov edx, 0x52d620
call fcn.00404d18
cmp esi, 6
jne 0x52d550
test ebx, ebx
jl 0x52d550
cmp esi, 6
jne 0x52d537
dec ebx
jne 0x52d537
lea eax, [ebp - 4]
mov edx, 0x52d634
call fcn.00404d18
call fcn.004b6cd4
cmp eax, 2
jle 0x52d596
lea eax, [ebp - 4]
mov edx, 0x52d644
call fcn.00404d18
jmp 0x52d596
cmp esi, 0xa
jl 0x52d596
test ebx, ebx
jl 0x52d596
lea eax, [ebp - 4]
mov edx, 0x52d658
call fcn.00404d18
jmp 0x52d596
cmp esi, 4
jne 0x52d57f
cmp ebx, 0xa
jne 0x52d57f
lea eax, [ebp - 4]
mov edx, 0x52d66c
call fcn.00404d18
cmp esi, 4
jne 0x52d596
cmp ebx, 0x5a
jne 0x52d596
lea eax, [ebp - 4]
mov edx, 0x52d67c
call fcn.00404d18
mov eax, dword [ebp - 4]
call fcn.0040515c
mov ecx, eax
mov edx, 0x52d684
mov eax, 0x52d690
call fcn.004b5b18
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52d5cc
lea eax, [ebp - 4]
call fcn.00404c80
ret

Function at 0x52d6cc
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x50], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x52d7c4
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov esi, 0x52d7d4
lea edi, [ebp - 0x4c]
mov ecx, 0x10
rep movsd dword es:[edi], dword [esi]
xor eax, eax
push ebp
push 0x52d76c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x40
lea eax, [ebp - 0x4c]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 8]
lea edx, [ebp - 0x4c]
mov ecx, 0x40
call fcn.00404ef0
lea eax, [ebp - 0xc]
call fcn.004dfcb8
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, 0x2f0
call fcn.0052d83c
test ebx, ebx
jne 0x52d762
mov cl, 1
mov dl, 1
mov eax, dword [0x5276e8]
call fcn.00427d44
mov ebx, eax
mov byte [ebx + 0xf], 1
mov eax, ebx
call fcn.0042811c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52d7a1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52d7cb
lea eax, [ebp - 0x50]
call fcn.00404c80
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404ca4
ret
Function at 0x544824
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x20c], edx
mov dword [ebp - 0x208], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x544998
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, dword [0x55909c]
mov edx, dword [edx]
call fcn.00404cd4
xor eax, eax
push ebp
push 0x544968
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 0x5449a8
lea edi, [ebp - 0x104]
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
mov esi, 0x5449a8
lea edi, [ebp - 0x204]
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x104]
mov ecx, pe_nt_image_headers32
mov edx, 0xff
call fcn.004b677c
push pe_nt_image_headers32
lea eax, [ebp - 0x204]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x208]
lea edx, [ebp - 0x104]
mov ecx, pe_nt_image_headers32
call fcn.00404ef0
lea eax, [ebp - 0x208]
mov edx, 0x544ab0
call fcn.00404f64
mov eax, dword [ebp - 0x208]
call fcn.0040c200
test al, al
jne 0x544941
lea eax, [ebp - 0x20c]
lea edx, [ebp - 0x204]
mov ecx, pe_nt_image_headers32
call fcn.00404ef0
lea eax, [ebp - 0x20c]
mov edx, 0x544ab0
call fcn.00404f64
mov eax, dword [ebp - 0x20c]
call fcn.0040c200
test al, al
jne 0x54492c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x544972
lea eax, [ebp - 4]
lea edx, [ebp - 0x204]
mov ecx, pe_nt_image_headers32
call fcn.00404ef0
jmp 0x544954
lea eax, [ebp - 4]
lea edx, [ebp - 0x104]
mov ecx, pe_nt_image_headers32
call fcn.00404ef0
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00404cd4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x544972
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54499f
lea eax, [ebp - 0x20c]
mov edx, 2
call fcn.00404ca4
lea eax, [ebp - 4]
call fcn.00404c80
ret
Function at 0x547f40
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffddc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x224], edx
mov dword [ebp - 0x21c], edx
mov dword [ebp - 0x220], edx
mov dword [ebp - 0x218], edx
mov dword [ebp - 0x214], edx
mov dword [ebp - 0x210], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x54815b
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, 0x548174
call fcn.00547d4c
test al, al
je 0x548135
mov esi, 0x548184
lea edi, [ebp - 0x209]
mov ecx, 0x80
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push 0xffffffffffffffff
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_WaitForSingleObject
push 0
mov ecx, 2
mov edx, 0x548390
mov eax, dword [ebx + 0x14]
call fcn.004de164
lea eax, [ebp - 0x209]
push eax
push 0x200
push 0x201
mov ecx, 0x5483bc
mov edx, 0x5483c0
mov eax, 0x5483d4
call fcn.004b5ee0
lea eax, [ebp - 0x210]
lea edx, [ebp - 0x209]
mov ecx, 0x201
call fcn.00404ef0
mov eax, dword [ebp - 0x210]
lea edx, [ebp - 4]
call fcn.0040b8d0
cmp dword [ebp - 4], 0
je 0x5480fa
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.00411014
mov edx, dword [ebp - 0x214]
lea eax, [ebp - 4]
mov ecx, 0x5483e4
call fcn.00404fa8
lea eax, [ebp - 0x218]
mov ecx, 0x5483f8
mov edx, dword [ebp - 4]
call fcn.00404fa8
mov eax, dword [ebp - 0x218]
call fcn.0040c200
test al, al
je 0x5480d2
push 0
lea eax, [ebp - 0x21c]
mov ecx, 0x548424
mov edx, dword [ebp - 4]
call fcn.00404fa8
mov eax, dword [ebp - 0x21c]
call fcn.0040515c
push eax
lea eax, [ebp - 0x220]
mov ecx, 0x5483f8
mov edx, dword [ebp - 4]
call fcn.00404fa8
mov eax, dword [ebp - 0x220]
call fcn.0040515c
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
jne 0x5480bf
push 0
mov ecx, 2
mov edx, 0x548440
mov eax, dword [ebx + 0x14]
call fcn.004de164
mov ecx, 0x548498
mov edx, 0x5484a4
mov eax, ebx
call fcn.00547c04
jmp 0x5480fa
push 0
lea eax, [ebp - 0x224]
mov ecx, dword [ebp - 4]
mov edx, 0x5484c0
call fcn.00404fa8
mov edx, dword [ebp - 0x224]
mov ecx, 2
mov eax, dword [ebx + 0x14]
call fcn.004de164
push 0
mov ecx, 2
mov edx, 0x548504
mov eax, dword [ebx + 0x14]
call fcn.004de164
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_ReleaseMutex
mov eax, 0x548544
call fcn.00547ea0
mov eax, 0x548558
call fcn.00547ea0
mov eax, 0x548568
call fcn.00547ea0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x548162
lea eax, [ebp - 0x224]
mov edx, 6
call fcn.00404ca4
lea eax, [ebp - 4]
call fcn.00404c80
ret
Function at 0x54eae0
Capabilities:
Connect network resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x12c], ebx
mov dword [ebp - 0x130], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.0040514c
mov eax, dword [ebp - 8]
call fcn.0040514c
mov eax, dword [ebp + 8]
call fcn.0040514c
xor eax, eax
push ebp
push 0x54ebf9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x20
call fcn.004033a0
xor eax, eax
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x128]
mov edx, dword [ebp - 4]
call fcn.0040ca90
mov dword [ebp - 0x14], eax
push 0
mov eax, dword [ebp - 8]
call fcn.0040515c
push eax
mov eax, dword [ebp + 8]
call fcn.0040515c
push eax
lea eax, [ebp - 0x28]
push eax
call sub.mpr.dll_WNetAddConnection2A
mov ebx, eax
mov esi, ebx
test ebx, ebx
jne 0x54eb89
mov eax, dword [0x558d88]
mov eax, dword [eax]
xor ecx, ecx
mov edx, 0x54ec14
call fcn.0052a624
jmp 0x54ebc6
mov esi, ebx
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x130]
call fcn.0040bd40
mov ecx, dword [ebp - 0x130]
lea eax, [ebp - 0x12c]
mov edx, 0x54ec28
call fcn.00404fa8
mov edx, dword [ebp - 0x12c]
mov eax, dword [0x558d88]
mov eax, dword [eax]
xor ecx, ecx
call fcn.0052a624
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54ec00
lea eax, [ebp - 0x130]
mov edx, 2
call fcn.00404ca4
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404ca4
lea eax, [ebp + 8]
call fcn.00404c80
ret
Function at 0x54ecb4
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 5
push 0
push 0
dec ecx
jne 0x54ecbd
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.0040514c
xor eax, eax
push ebp
push 0x54ee24
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x18]
call fcn.004d99c8
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x10]
mov ecx, 0x54ee40
call fcn.00404fa8
mov eax, dword [ebp - 0x10]
call fcn.004c3f10
test al, al
jne 0x54ed1a
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x10]
call fcn.004dbeb8
mov eax, dword [0x558d88]
mov eax, dword [eax]
xor ecx, ecx
mov edx, 0x54ee50
call fcn.0052a624
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x54ee01
inc ebx
xor esi, esi
lea ecx, [ebp - 0x20]
mov edx, esi
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x14]
call fcn.0040c594
push 0x54ee64
push dword [ebp - 4]
push 0x54ee7c
push dword [ebp - 0x14]
lea eax, [ebp - 0x24]
mov edx, 4
call fcn.0040501c
mov edx, dword [ebp - 0x24]
mov eax, dword [0x558d88]
mov eax, dword [eax]
xor ecx, ecx
call fcn.0052a624
push 0
push dword [ebp - 0x10]
push 0x54ee7c
push dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.0040501c
mov eax, dword [ebp - 0x28]
call fcn.0040515c
push eax
push dword [ebp - 4]
push 0x54ee7c
push dword [ebp - 0x14]
lea eax, [ebp - 0x2c]
mov edx, 3
call fcn.0040501c
mov eax, dword [ebp - 0x2c]
call fcn.0040515c
push eax
call sub.kernel32.dll_CopyFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x54edf9
mov eax, dword [0x558d88]
mov eax, dword [eax]
xor ecx, ecx
mov edx, 0x54ee88
call fcn.0052a624
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0xc], eax
jmp 0x54ee01
inc esi
dec ebx
jne 0x54ed43
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54ee2b
lea eax, [ebp - 0x2c]
mov edx, 8
call fcn.00404ca4
lea eax, [ebp - 4]
call fcn.00404c80
ret
Function at 0x45eef6
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
jmp 0x486120
test dword [esi + 1], esi
add byte [eax], al

Function at 0x45f09a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x487380
test dword [ecx - 0x7a760001], edi
mov eax, 0x8bffffe1
lea edi, [eax - 0x7e00001f]
jmp 0x487f4f

Function at 0x45fe6e
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
jmp 0x4861b0
push edx
or edx, 0x287
or edx, 0x14722
add edx, 0xae65
pop edx
push eax
push edi
add esp, 4
call 0x485b81
add byte [eax + 0x3c], dl
dec eax
aaa
push eax
xor al, byte [ebx + 0x3a]
xor eax, 0x8104c483
call fcn.0048f599
pop eax
mov edx, dword [ebp - 0x254]
add edx, 0x138
imul eax, dword [ebp - 0x250], 0x138
add eax, 0x44f3644b
imul ecx, dword [ebp - 0x250], 0x138
sub eax, ecx
xor edx, eax
imul edx, dword [ebp - 0x250]
mov dword [ebp - 0x1d68], edx
push ebx
call 0x485bcf
add byte [ebp + 0x44], cl
dec edx
xor eax, 0x83394250
les eax, [ecx + eax*4]
retf
xor eax, ecx
imul eax, dword [ebp - 0x2d0]
mov dword [ebp - 0x1da4], eax
mov eax, dword [ebp - 0x1da4]
mov dword [ebp - 0x1da8], eax
mov ecx, dword [ebp - 0x1da8]
sub ecx, 1
mov dword [ebp - 0x1dac], ecx
mov dword [ebp - 0xfc4], 1
push ecx
push edi
add esp, 4
add ecx, 0x9012
xor ecx, 0xbbe5
sub ecx, 0x1acf
pop ecx
push esi
sub esi, 0x116c7
xor esi, 0xbbc1
and esi, 0x608d
add esi, 0x8ee6
pop esi
imul edx, dword [ebp - 0xfc4], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfc4], 0x138
sub edx, eax
xor edx, dword [ebp - 0x1dac]
imul edx, dword [ebp - 0xfc4]
imul ecx, dword [ebp - 0xfc4], 0x138
sub edx, ecx
mov dword [ebp - 0xfc8], edx
mov edx, dword [ebp - 0xfc8]
mov eax, dword [ebp - 0xfc4]
mov dword [ebp - 0x2d4], edx
mov dword [ebp - 0x2d0], eax
push ecx
add ecx, 0x17004
add ecx, 0x177c0
pop ecx
push ebx
jmp 0x48627f
call 0x48628b
add byte [esi], dh
aaa
xor eax, 0x83473650
les eax, [ebx + ebx*2]
push esi
push edx
add esp, 4
add esi, 0x32b6
pop esi
jmp 0x485b59

Function at 0x46094f
Capabilities:
Terminate process

Disassembly:
jmp 0x50c030
jmp fcn.0050d780
cmp ecx, dword [0x540cac]
jne 0x50c03a
repz ret
jmp 0x461273
Function at 0x47cd60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xcc]
mov ecx, 0x33
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
call fcn.00463634
test eax, eax
je 0x47cd0b
mov eax, dword [ebp - 8]
cmp dword [eax + 8], 0
je 0x47cd0b
mov ecx, dword [ebp - 8]
call fcn.00463634
mov ecx, dword [ebp - 8]
mov edx, dword [eax + 8]
cmp edx, dword [ecx + 8]
ja 0x47cd83
mov esi, esp
push 0x63
push str.c:program_files__x86_microsoft_visual_studio_10.0_vcinclude_vector
push str.vector_iterator_not_incrementable
call dword [0x5438d0]
add esp, 0xc
cmp esi, esp
call fcn.00466014
mov eax, str.Standard_C_Libraries_Out_of_Range
test eax, eax
je 0x47cd36
xor ecx, ecx
jne 0x47cd5e
mov esi, esp
push str._Standard_C_Libraries_Out_of_Range___0
push 0
push 0x64
push str.c:program_files__x86_microsoft_visual_studio_10.0_vcinclude_vector
push 2
call dword [0x543a34]
add esp, 0x14
cmp esi, esp
call fcn.00466014
cmp eax, 1
jne 0x47cd5e
int3
mov esi, esp
push 0
push 0x64
push str.c:program_files__x86_microsoft_visual_studio_10.0_vcinclude_vector
push 0x5275f8
push str._out_of_range_
call dword [0x543a2c]
add esp, 0x14
cmp esi, esp
call fcn.00466014
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
add ecx, 0xa8
mov edx, dword [ebp - 8]
mov dword [edx + 8], ecx
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.00466014
mov esp, ebp
pop ebp
ret

Function at 0x47cef0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xcc]
mov ecx, 0x33
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
call fcn.00463634
test eax, eax
je 0x47cebe
mov eax, dword [ebp - 8]
cmp dword [eax + 8], 0
je 0x47cebe
mov ecx, dword [ebp - 8]
call fcn.00463634
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 8]
cmp edx, dword [eax + 4]
jb 0x47cebe
mov ecx, dword [ebp - 8]
call fcn.00463634
mov ecx, dword [ebp - 8]
mov edx, dword [eax + 8]
cmp edx, dword [ecx + 8]
ja 0x47cf36
mov esi, esp
push 0x46
push str.c:program_files__x86_microsoft_visual_studio_10.0_vcinclude_vector
push str.vector_iterator_not_dereferencable
call dword [0x5438d0]
add esp, 0xc
cmp esi, esp
call fcn.00466014
mov eax, str.Standard_C_Libraries_Out_of_Range
test eax, eax
je 0x47cee9
xor ecx, ecx
jne 0x47cf11
mov esi, esp
push str._Standard_C_Libraries_Out_of_Range___0
push 0
push 0x47
push str.c:program_files__x86_microsoft_visual_studio_10.0_vcinclude_vector
push 2
call dword [0x543a34]
add esp, 0x14
cmp esi, esp
call fcn.00466014
cmp eax, 1
jne 0x47cf11
int3
mov esi, esp
push 0
push 0x47
push str.c:program_files__x86_microsoft_visual_studio_10.0_vcinclude_vector
push 0x527790
push str._out_of_range_
call dword [0x543a2c]
add esp, 0x14
cmp esi, esp
call fcn.00466014
xor eax, eax
jne 0x47cf36
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.00466014
mov esp, ebp
pop ebp
ret
Function at 0x484d07
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xcc]
mov ecx, 0x33
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov dword [eax], 0
mov eax, dword [ebp - 8]
mov dword [eax + 4], 1
mov eax, dword [ebp - 8]
mov dword [eax + 8], 1
mov eax, dword [ebp - 8]
mov dword [eax + 0xc], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x10], 1
mov eax, dword [ebp - 8]
mov dword [eax + 0x14], 1
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x1c], 0xc8
mov eax, dword [ebp - 8]
mov dword [eax + 0x20], 0xffffffff
mov eax, dword [ebp - 8]
mov dword [eax + 0x24], 0xffffffff
mov eax, dword [ebp - 8]
mov dword [eax + 0x28], 0xffffffff
mov eax, dword [ebp - 8]
mov dword [eax + 0x2c], 0xffffffff
mov eax, dword [ebp - 8]
mov dword [eax + 0x30], 0xffffffff
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x484f7f
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1fbc
push ebx
push esi
push edi
push ebx
push edx
add esp, 4
sub ebx, 0x9c07
jmp 0x484e67
pop ebx
push edx
push edi
add esp, 4
xor edx, 0xa2f3
sub edx, 0xbacb
or edx, 0xc575
pop edx
push eax
and eax, 0x11700
pop eax
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
mov word [ebp - 0x1ee4], dx
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push edi
call 0x484f48
add byte [ebx + 0x38], cl
dec esp
inc esi
inc edi
aas
inc ebx
inc ebx
dec esi
dec ebx
add esp, 4
jmp 0x484f53
sub edi, 0x6686
call 0x484f65
add byte [eax], bh
cmp eax, 0x3d413843
add esp, 4
pop edi
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push edi
sub edi, 0x10b25
jmp 0x484fb0
call 0x484fbe
add byte [ebp + 0x46], al
cmp edi, dword [esi]
xor esi, dword [ebx + eax*2]
inc eax
add esp, 4
and edi, 0x29a4
pop edi
push esi
and esi, 0x1131f
sub esi, 0x68d4
pop esi
mov dword [ebp - 0x10], 1
push esi
add esi, 0xddb5
pop esi
push ebx
add ebx, 0x106a3
pop ebx
push edi
xor edi, 0xc467
pop edi
push esi
xor esi, 0x1404e
pop esi
push edi
push eax
add esp, 4
and edi, 0x9cab
or edi, 0x73a1
pop edi
imul edx, dword [ebp - 0x10], 0x138
push ebp
invalid
cmp byte [ecx], al
add byte [eax], al
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push ebx
add ebx, 0x15bd1
xor ebx, 0x10c35
and ebx, 0x80a0
or ebx, 0x3421
pop ebx
push ecx
push eax
add esp, 4
add ecx, 0xa467
pop ecx
push edi
push edx
add esp, 4
add edi, 0x16a4c
pop edi
push eax
push ecx
add esp, 4
xor eax, 0xd557
pop eax
push edx
push edi
add esp, 4
call 0x48508e
add byte [ebx + 0x33], cl
xor eax, 0x38394a4b
push eax
inc ecx
dec edi
add esp, 4
jmp 0x485098
or edx, 0x291d
pop edx
mov dword [ebp - 0x2c], 1
push eax
push edi
add esp, 4
or eax, 0x16c61
jmp 0x4850b9
sub eax, 0xf65d
pop eax
push ebx
push ebx
add esp, 4
sub ebx, 0x4eb3
sub ebx, 0x81a3
xor ebx, 0x14649
pop ebx
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x138
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x4852b9
Function at 0x485047
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1fbc
push ebx
push esi
push edi
push ebx
push edx
add esp, 4
sub ebx, 0x9c07
jmp 0x484e67
pop ebx
push edx
push edi
add esp, 4
xor edx, 0xa2f3
sub edx, 0xbacb
or edx, 0xc575
pop edx
push eax
and eax, 0x11700
pop eax
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
mov word [ebp - 0x1ee4], dx
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push edi
call 0x484f48
add byte [ebx + 0x38], cl
dec esp
inc esi
inc edi
aas
inc ebx
inc ebx
dec esi
dec ebx
add esp, 4
jmp 0x484f53
sub edi, 0x6686
call 0x484f65
add byte [eax], bh
cmp eax, 0x3d413843
add esp, 4
pop edi
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push edi
sub edi, 0x10b25
jmp 0x484fb0
call 0x484fbe
add byte [ebp + 0x46], al
cmp edi, dword [esi]
xor esi, dword [ebx + eax*2]
inc eax
add esp, 4
and edi, 0x29a4
pop edi
push esi
and esi, 0x1131f
sub esi, 0x68d4
pop esi
mov dword [ebp - 0x10], 1
push esi
add esi, 0xddb5
pop esi
push ebx
add ebx, 0x106a3
pop ebx
push edi
xor edi, 0xc467
pop edi
push esi
xor esi, 0x1404e
pop esi
push edi
push eax
add esp, 4
and edi, 0x9cab
or edi, 0x73a1
pop edi
imul edx, dword [ebp - 0x10], 0x138
push ebp
invalid
cmp byte [ecx], al
add byte [eax], al
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push ebx
add ebx, 0x15bd1
xor ebx, 0x10c35
and ebx, 0x80a0
or ebx, 0x3421
pop ebx
push ecx
push eax
add esp, 4
add ecx, 0xa467
pop ecx
push edi
push edx
add esp, 4
add edi, 0x16a4c
pop edi
push eax
push ecx
add esp, 4
xor eax, 0xd557
pop eax
push edx
push edi
add esp, 4
call 0x48508e
add byte [ebx + 0x33], cl
xor eax, 0x38394a4b
push eax
inc ecx
dec edi
add esp, 4
jmp 0x485098
or edx, 0x291d
pop edx
mov dword [ebp - 0x2c], 1
push eax
push edi
add esp, 4
or eax, 0x16c61
jmp 0x4850b9
sub eax, 0xf65d
pop eax
push ebx
push ebx
add esp, 4
sub ebx, 0x4eb3
sub ebx, 0x81a3
xor ebx, 0x14649
pop ebx
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x138
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x4852b9