joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428c60
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4034
call fcn.0046d780
mov eax, dword [0x4c9124]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x4034], ecx
mov ecx, dword [ebp + 8]
call fcn.00427fd0
mov dword [ebp - 0x4024], eax
mov dword [ebp - 0x4020], 0x1001
mov ecx, dword [ebp + 8]
call fcn.00428980
cmp eax, 0x1001
jae 0x428cb2
mov ecx, dword [ebp + 8]
call fcn.00428980
mov dword [ebp - 0x4020], eax
mov dword [ebp - 0x4028], 0
mov dword [ebp - 0x4018], 0
mov dword [ebp - 0x4010], 0
jmp 0x428ce1
mov eax, dword [ebp - 0x4018]
add eax, 1
mov dword [ebp - 0x4018], eax
mov ecx, dword [ebp - 0x4018]
cmp ecx, dword [ebp - 0x4020]
jae 0x428d8c
mov edx, dword [ebp - 0x4018]
mov eax, dword [ebp - 0x4024]
movzx ecx, word [eax + edx*2]
cmp ecx, 0xa
jne 0x428d4e
mov edx, 0xd
mov eax, dword [ebp - 0x4010]
mov word [ebp + eax*2 - 0x400c], dx
mov ecx, dword [ebp - 0x4010]
add ecx, 1
mov dword [ebp - 0x4010], ecx
mov edx, 0xa
mov eax, dword [ebp - 0x4010]
mov word [ebp + eax*2 - 0x400c], dx
mov ecx, dword [ebp - 0x4010]
add ecx, 1
mov dword [ebp - 0x4010], ecx
jmp 0x428d7b
mov edx, dword [ebp - 0x4010]
mov eax, dword [ebp - 0x4018]
mov ecx, dword [ebp - 0x4024]
mov ax, word [ecx + eax*2]
mov word [ebp + edx*2 - 0x400c], ax
mov ecx, dword [ebp - 0x4010]
add ecx, 1
mov dword [ebp - 0x4010], ecx
mov edx, dword [ebp - 0x4010]
mov dword [ebp - 0x4028], edx
jmp 0x428cd2
mov eax, dword [ebp - 0x4028]
shl eax, 1
mov dword [ebp - 0x402c], eax
cmp dword [ebp - 0x402c], 0x4006
jae 0x428da8
jmp 0x428dad
call fcn.0046da43
xor ecx, ecx
mov edx, dword [ebp - 0x402c]
mov word [ebp + edx - 0x400c], cx
mov ecx, dword [ebp + 8]
call fcn.00418520
mov dword [ebp - 0x401c], eax
mov eax, dword [ebp - 0x401c]
sub eax, 1
mov dword [ebp - 0x401c], eax
cmp dword [ebp - 0x401c], 0x3f
ja case.0x428df0.2
mov ecx, dword [ebp - 0x401c]
movzx edx, byte [ecx + 0x428e88]
jmp dword [edx*4 + 0x428e7c]
mov eax, 4
mov word [ebp - 0x4014], ax
jmp 0x428e1f
mov ecx, 2
mov word [ebp - 0x4014], cx
jmp 0x428e1f
mov edx, 1
mov word [ebp - 0x4014], dx
mov eax, 4
imul ecx, eax, 0
lea edx, [ebp - 0x400c]
mov dword [ebp + ecx - 0x4030], edx
push 0
lea eax, [ebp - 0x4030]
push eax
push 0
push 1
push 0
push 0
push 0
movzx ecx, word [ebp - 0x4014]
push ecx
mov edx, dword [ebp - 0x4034]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
test eax, eax
jne 0x428e6a
or eax, 0xffffffff
jmp 0x428e6c
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046cddf
mov esp, ebp
pop ebp
ret 4
Function at 0x428ed0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0x4c9124]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x424], ecx
push 0x104
lea eax, [ebp - 0x414]
push eax
call fcn.00428c50
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x428f0d
or eax, 0xffffffff
jmp 0x42904c
lea ecx, [ebp - 0x414]
push ecx
call fcn.00419030
add esp, 4
lea edx, [eax + eax + 2]
mov dword [ebp - 0x434], edx
cmp dword [ebp + 8], 0
je 0x428f37
mov eax, dword [ebp + 8]
mov dword [ebp - 0x41c], eax
jmp 0x428f42
call fcn.0041e9c0
mov dword [ebp - 0x41c], eax
mov ecx, dword [ebp - 0x41c]
mov dword [ebp - 0x420], ecx
push str.SYSTEMCurrentControlSetServicesEventLogApplication_
lea edx, [ebp - 0x20c]
push edx
call fcn.00418fd0
add esp, 8
lea eax, [ebp - 0x20c]
push eax
call fcn.00419030
add esp, 4
mov dword [ebp - 0x42c], eax
mov ecx, 0x104
sub ecx, dword [ebp - 0x42c]
push ecx
mov edx, dword [ebp - 0x420]
push edx
lea eax, [ebp - 0x20c]
push eax
call fcn.0041f020
add esp, 0xc
lea ecx, [ebp - 0x418]
push ecx
lea edx, [ebp - 0x20c]
push edx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov dword [ebp - 0x430], 7
push 4
lea eax, [ebp - 0x430]
push eax
push 4
push 0
push str.TypesSupported
mov ecx, dword [ebp - 0x418]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 0x434]
push edx
lea eax, [ebp - 0x414]
push eax
push 1
push 0
push str.EventMessageFile
mov ecx, dword [ebp - 0x418]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 0x418]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x420]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov ecx, dword [ebp - 0x424]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x424]
cmp dword [edx + 4], 0
je 0x42903c
mov dword [ebp - 0x428], 0
jmp 0x429046
mov dword [ebp - 0x428], 0xffffffff
mov eax, dword [ebp - 0x428]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046cddf
mov esp, ebp
pop ebp
ret 4
Function at 0x429e70
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push str.Dbghelp
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
cmp dword [ebp - 4], 0
jne 0x429e99
xor al, al
jmp 0x429ffb
push str.SymGetModuleBase64
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov dword [ecx + 4], edx
cmp dword [ebp - 8], 0
je 0x429ff1
push str.SymFunctionTableAccess64
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
mov dword [edx + 8], eax
cmp dword [ebp - 0xc], 0
je 0x429ff1
push str.SymFromAddr
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
mov dword [eax + 0xc], ecx
cmp dword [ebp - 0x10], 0
je 0x429ff1
push str.SymGetLineFromAddr64
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x14]
mov dword [ecx + 0x10], edx
cmp dword [ebp - 0x14], 0
je 0x429ff1
push str.SymSetOptions
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x18], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x18]
mov dword [edx + 0x14], eax
cmp dword [ebp - 0x18], 0
je 0x429ff1
push str.SymGetOptions
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1c]
mov dword [eax + 0x18], ecx
cmp dword [ebp - 0x1c], 0
je 0x429ff1
push str.SymInitialize
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x20]
mov dword [ecx + 0x1c], edx
cmp dword [ebp - 0x20], 0
je 0x429ff1
push str.StackWalk64
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x24], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x24]
mov dword [edx + 0x20], eax
cmp dword [ebp - 0x24], 0
je 0x429ff1
push str.SymCleanup
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x28]
mov dword [eax + 0x24], ecx
cmp dword [ebp - 0x28], 0
je 0x429ff1
mov dword [ebp - 0x2c], 1
jmp 0x429ff8
mov dword [ebp - 0x2c], 0
mov al, byte [ebp - 0x2c]
mov esp, ebp
pop ebp
ret
Function at 0x42a780
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x42a7c1
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0xc], eax
call fcn.00479715
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
or eax, 0xffffffff
jmp 0x42a7ca
mov eax, dword [ebp - 4]
jmp 0x42a7ca
mov esp, ebp
pop ebp
ret
Function at 0x42eb39
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
add esp, 4
or ebx, 0x17b42
or ebx, 0x39c4
jmp 0x42e95a
xor ebx, 0x17c6f
pop ebx
push edi
push ebx
add esp, 4
and edi, 0x1243e
xor edi, 0xbcf1
pop edi
mov eax, dword [ebp - 0x24c]
add eax, 0x138
imul ecx, dword [ebp - 0x248], 0x138
add ecx, 0x44f3644b
imul edx, dword [ebp - 0x248], 0x138
sub ecx, edx
xor eax, ecx
imul eax, dword [ebp - 0x248]
mov dword [ebp - 0x1de0], eax
push edi
sub edi, 0x14671
or edi, 0x11bef
add edi, 0x1470f
pop edi
push esi
push eax
add esp, 4
jmp 0x42e9c8
sub esi, 0xe29a
add esi, 0x8095
or esi, 0x92f5
pop esi
mov eax, dword [ebp - 0x1de0]
sub eax, 1
mov dword [ebp - 0x14a8], eax
push edi
push edi
add esp, 4
xor edi, 0xb448
pop edi
push ecx
or ecx, 0x1835d
xor ecx, 0xd1cf
or ecx, 0x10868
add ecx, 0xb81f
pop ecx
push ebx
push ebx
add esp, 4
sub ebx, 0x17e4e
pop ebx
push esi
sub esi, 0x8e5d
pop esi
push edi
push edi
add esp, 4
call 0x42ea38
add byte [ebx + 0x44], cl
xor edi, dword [edi + esi]
push eax
cmp cl, byte [ecx + 0x34]
add esp, 4
xor edi, 0xf26d
sub edi, 0x18661
xor edi, 0x26a3
pop edi
imul ecx, dword [ebp - 0x248], 0x138
add ecx, 0x44f3644b
imul edx, dword [ebp - 0x248], 0x138
sub ecx, edx
xor ecx, dword [ebp - 0x14a8]
imul ecx, dword [ebp - 0x248]
imul eax, dword [ebp - 0x248], 0x138
sub ecx, eax
mov dword [ebp - 0x24c], ecx
mov ecx, dword [ebp - 0x14a8]
imul ecx, dword [ebp - 0x248]
mov dword [ebp - 0x1de4], ecx
mov dword [ebp - 0x1548], 1
push edi
sub edi, 0x6160
pop edi
push edx
push eax
add esp, 4
add edx, 0xff3d
add edx, 0x20f1
call 0x42eacc
add byte [ecx + 0x48], al
inc esi
inc ebx
inc eax
inc edi
inc edx
add esp, 4
jmp 0x42ead7
pop edx
imul edx, dword [ebp - 0x1548], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x1548], 0x138
sub edx, eax
xor edx, dword [ebp - 0x1de4]
imul edx, dword [ebp - 0x1548]
imul ecx, dword [ebp - 0x1548], 0x138
sub edx, ecx
mov dword [ebp - 0x154c], edx
push esi
jmp 0x42eb1b
call 0x42eb29
add byte [esi + 0x3c], al
xor eax, 0x37414832
dec esp
add esp, 4
call 0x42eb39
add byte [esi + 0x3d], cl
aas
aaa
inc edx
inc edi
xor al, byte [ebx + 0x6eb04c4]
dec ebp
cmp ecx, dword [ebx + 0x43]
cmp bl, byte ss:[esi - 0x75]
xchg ebp, eax
mov ah, 0xfd
invalid
imul eax, dword [ebp - 0xfdc], 0x138
add eax, 0x44f3644b
imul ecx, dword [ebp - 0xfdc], 0x138
sub eax, ecx
xor eax, dword [ebp - 0x1e24]
imul eax, dword [ebp - 0xfdc]
imul edx, dword [ebp - 0xfdc], 0x138
sub eax, edx
mov dword [ebp - 0xfe0], eax
mov eax, dword [ebp - 0xfe0]
mov ecx, dword [ebp - 0xfdc]
mov dword [ebp - 0x2cc], eax
mov dword [ebp - 0x2c8], ecx
push eax
push esi
add esp, 4
sub eax, 0x570a
sub eax, 0x11cc3
or eax, 0xff5c
pop eax
push ecx
xor ecx, 0x131ce
xor ecx, 0xfe65
and ecx, 0x201d
and ecx, 0x600d
pop ecx
jmp 0x42e941
Function at 0x43100f
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ecx
push eax
add esp, 4
sub ecx, 0x88e0
call fcn.0043100f
add byte [ebx + ecx*2 + 0x39], al
cmp byte [eax + 0x37], cl
cmp eax, 0x5904c483
add esp, 4
pop ecx
add esp, 4
pop ecx
push ecx
sub ecx, 0x1513a
pop ecx
push edi
and edi, 0x2591
add edi, 0x9f09
pop edi
lea ecx, [ebp - 0x1628]
mov dword [ebp - 0xc1c], ecx
mov edx, dword [ebp - 0x4d4]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xc18], eax
xor ecx, ecx
mov word [ebp - 0x1f8], cx
xor edx, edx
mov word [ebp - 0x100], dx
push ebx
push edx
add esp, 4
call 0x43106b
add byte [ebp + 0x46], cl
dec eax
cmp esi, dword [esi]
xor edi, dword ds:[edx + ecx*2]
dec ebp
add esp, 4
pop ebx
push ecx
call 0x43107e
add byte [edi], dh
push eax
cmp esi, dword [0x43453c46]
add esp, 4
or ecx, 0xa77c
pop ecx
mov eax, dword [ebp - 0xc18]
mov cx, word [eax]
mov word [ebp - 0xf7e], cx
mov edx, dword [ebp - 0xc18]
add edx, 2
mov dword [ebp - 0xc18], edx
mov ax, word [ebp - 0xf7e]
mov word [ebp - 0x1f8], ax
mov ecx, dword [ebp - 0xc1c]
mov dx, word [ecx]
mov word [ebp - 0xf80], dx
mov eax, dword [ebp - 0xc1c]
add eax, 2
mov dword [ebp - 0xc1c], eax
mov cx, word [ebp - 0xf80]
mov word [ebp - 0x100], cx
push edi
or edi, 0x147a9
pop edi
push edi
push eax
add esp, 4
call 0x4310fd
add byte [eax + 0x35], dl
inc ebp
xor edi, dword [eax]
dec edx
cmp dword [eax - 0x7d], edx
les eax, [edi + ebx*2]
push ebx
push ebx
add esp, 4
xor ebx, 0xafaf
jmp 0x431113
pop ebx
movzx edx, word [ebp - 0x100]
test edx, edx
jne 0x431137
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
sub eax, ecx
mov dword [ebp - 0x1498], eax
jmp 0x43119a
movzx edx, word [ebp - 0x1f8]
movzx eax, word [ebp - 0x100]
cmp edx, eax
je 0x431056
movzx ecx, word [ebp - 0x1f8]
xor ecx, 0x20
movzx edx, word [ebp - 0x100]
cmp ecx, edx
je 0x431056
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
cmp eax, ecx
jge 0x431184
mov dword [ebp - 0x14d8], 0xffffffff
jmp 0x43118e
mov dword [ebp - 0x14d8], 1
mov edx, dword [ebp - 0x14d8]
mov dword [ebp - 0x1498], edx
cmp dword [ebp - 0x1498], 0
jne 0x4311e3
push esi
push eax
add esp, 4
and esi, 0x14bff
and esi, 0x6d4b
add esi, 0x8343
sub esi, 0xd9f6
pop esi
push esi
push ebx
add esp, 4
or esi, 0x113c
pop esi
push ebx
and ebx, 0xc950
pop ebx
mov eax, dword [ebp - 0x4d4]
mov dword [ebp - 0x2e0], eax
jmp 0x43124b
push ebx
push esi
add esp, 4
and ebx, 0x2222
sub ebx, 0x1570c
pop ebx
push esi
and esi, 0xedb1
pop esi
push eax
push eax
add esp, 4
sub eax, 0xd544
sub eax, 0xabbf
xor eax, 0x7a13
pop eax
mov ecx, dword [ebp - 0x4d4]
mov edx, dword [ecx]
mov dword [ebp - 0x4d4], edx
mov eax, dword [ebp - 0x4d4]
cmp eax, dword [ebp - 0xc20]
je 0x431241
mov ecx, dword [ebp - 0x4d4]
cmp dword [ecx + 0x30], 0
jne 0x430ff7
mov dword [ebp - 0x2e0], 0
Function at 0x43106b
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ecx
push eax
add esp, 4
sub ecx, 0x88e0
call fcn.0043100f
add byte [ebx + ecx*2 + 0x39], al
cmp byte [eax + 0x37], cl
cmp eax, 0x5904c483
add esp, 4
pop ecx
add esp, 4
pop ecx
push ecx
sub ecx, 0x1513a
pop ecx
push edi
and edi, 0x2591
add edi, 0x9f09
pop edi
lea ecx, [ebp - 0x1628]
mov dword [ebp - 0xc1c], ecx
mov edx, dword [ebp - 0x4d4]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xc18], eax
xor ecx, ecx
mov word [ebp - 0x1f8], cx
xor edx, edx
mov word [ebp - 0x100], dx
push ebx
push edx
add esp, 4
call 0x43106b
add byte [ebp + 0x46], cl
dec eax
cmp esi, dword [esi]
xor edi, dword ds:[edx + ecx*2]
dec ebp
add esp, 4
pop ebx
push ecx
call 0x43107e
add byte [edi], dh
push eax
cmp esi, dword [0x43453c46]
add esp, 4
or ecx, 0xa77c
pop ecx
mov eax, dword [ebp - 0xc18]
mov cx, word [eax]
mov word [ebp - 0xf7e], cx
mov edx, dword [ebp - 0xc18]
add edx, 2
mov dword [ebp - 0xc18], edx
mov ax, word [ebp - 0xf7e]
mov word [ebp - 0x1f8], ax
mov ecx, dword [ebp - 0xc1c]
mov dx, word [ecx]
mov word [ebp - 0xf80], dx
mov eax, dword [ebp - 0xc1c]
add eax, 2
mov dword [ebp - 0xc1c], eax
mov cx, word [ebp - 0xf80]
mov word [ebp - 0x100], cx
push edi
or edi, 0x147a9
pop edi
push edi
push eax
add esp, 4
call 0x4310fd
add byte [eax + 0x35], dl
inc ebp
xor edi, dword [eax]
dec edx
cmp dword [eax - 0x7d], edx
les eax, [edi + ebx*2]
push ebx
push ebx
add esp, 4
xor ebx, 0xafaf
jmp 0x431113
pop ebx
movzx edx, word [ebp - 0x100]
test edx, edx
jne 0x431137
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
sub eax, ecx
mov dword [ebp - 0x1498], eax
jmp 0x43119a
movzx edx, word [ebp - 0x1f8]
movzx eax, word [ebp - 0x100]
cmp edx, eax
je 0x431056
movzx ecx, word [ebp - 0x1f8]
xor ecx, 0x20
movzx edx, word [ebp - 0x100]
cmp ecx, edx
je 0x431056
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
cmp eax, ecx
jge 0x431184
mov dword [ebp - 0x14d8], 0xffffffff
jmp 0x43118e
mov dword [ebp - 0x14d8], 1
mov edx, dword [ebp - 0x14d8]
mov dword [ebp - 0x1498], edx
cmp dword [ebp - 0x1498], 0
jne 0x4311e3
push esi
push eax
add esp, 4
and esi, 0x14bff
and esi, 0x6d4b
add esi, 0x8343
sub esi, 0xd9f6
pop esi
push esi
push ebx
add esp, 4
or esi, 0x113c
pop esi
push ebx
and ebx, 0xc950
pop ebx
mov eax, dword [ebp - 0x4d4]
mov dword [ebp - 0x2e0], eax
jmp 0x43124b
push ebx
push esi
add esp, 4
and ebx, 0x2222
sub ebx, 0x1570c
pop ebx
push esi
and esi, 0xedb1
pop esi
push eax
push eax
add esp, 4
sub eax, 0xd544
sub eax, 0xabbf
xor eax, 0x7a13
pop eax
mov ecx, dword [ebp - 0x4d4]
mov edx, dword [ecx]
mov dword [ebp - 0x4d4], edx
mov eax, dword [ebp - 0x4d4]
cmp eax, dword [ebp - 0xc20]
je 0x431241
mov ecx, dword [ebp - 0x4d4]
cmp dword [ecx + 0x30], 0
jne 0x430ff7
mov dword [ebp - 0x2e0], 0
Function at 0x43107e
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ecx
push eax
add esp, 4
sub ecx, 0x88e0
call fcn.0043100f
add byte [ebx + ecx*2 + 0x39], al
cmp byte [eax + 0x37], cl
cmp eax, 0x5904c483
add esp, 4
pop ecx
add esp, 4
pop ecx
push ecx
sub ecx, 0x1513a
pop ecx
push edi
and edi, 0x2591
add edi, 0x9f09
pop edi
lea ecx, [ebp - 0x1628]
mov dword [ebp - 0xc1c], ecx
mov edx, dword [ebp - 0x4d4]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xc18], eax
xor ecx, ecx
mov word [ebp - 0x1f8], cx
xor edx, edx
mov word [ebp - 0x100], dx
push ebx
push edx
add esp, 4
call 0x43106b
add byte [ebp + 0x46], cl
dec eax
cmp esi, dword [esi]
xor edi, dword ds:[edx + ecx*2]
dec ebp
add esp, 4
pop ebx
push ecx
call 0x43107e
add byte [edi], dh
push eax
cmp esi, dword [0x43453c46]
add esp, 4
or ecx, 0xa77c
pop ecx
mov eax, dword [ebp - 0xc18]
mov cx, word [eax]
mov word [ebp - 0xf7e], cx
mov edx, dword [ebp - 0xc18]
add edx, 2
mov dword [ebp - 0xc18], edx
mov ax, word [ebp - 0xf7e]
mov word [ebp - 0x1f8], ax
mov ecx, dword [ebp - 0xc1c]
mov dx, word [ecx]
mov word [ebp - 0xf80], dx
mov eax, dword [ebp - 0xc1c]
add eax, 2
mov dword [ebp - 0xc1c], eax
mov cx, word [ebp - 0xf80]
mov word [ebp - 0x100], cx
push edi
or edi, 0x147a9
pop edi
push edi
push eax
add esp, 4
call 0x4310fd
add byte [eax + 0x35], dl
inc ebp
xor edi, dword [eax]
dec edx
cmp dword [eax - 0x7d], edx
les eax, [edi + ebx*2]
push ebx
push ebx
add esp, 4
xor ebx, 0xafaf
jmp 0x431113
pop ebx
movzx edx, word [ebp - 0x100]
test edx, edx
jne 0x431137
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
sub eax, ecx
mov dword [ebp - 0x1498], eax
jmp 0x43119a
movzx edx, word [ebp - 0x1f8]
movzx eax, word [ebp - 0x100]
cmp edx, eax
je 0x431056
movzx ecx, word [ebp - 0x1f8]
xor ecx, 0x20
movzx edx, word [ebp - 0x100]
cmp ecx, edx
je 0x431056
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
cmp eax, ecx
jge 0x431184
mov dword [ebp - 0x14d8], 0xffffffff
jmp 0x43118e
mov dword [ebp - 0x14d8], 1
mov edx, dword [ebp - 0x14d8]
mov dword [ebp - 0x1498], edx
cmp dword [ebp - 0x1498], 0
jne 0x4311e3
push esi
push eax
add esp, 4
and esi, 0x14bff
and esi, 0x6d4b
add esi, 0x8343
sub esi, 0xd9f6
pop esi
push esi
push ebx
add esp, 4
or esi, 0x113c
pop esi
push ebx
and ebx, 0xc950
pop ebx
mov eax, dword [ebp - 0x4d4]
mov dword [ebp - 0x2e0], eax
jmp 0x43124b
push ebx
push esi
add esp, 4
and ebx, 0x2222
sub ebx, 0x1570c
pop ebx
push esi
and esi, 0xedb1
pop esi
push eax
push eax
add esp, 4
sub eax, 0xd544
sub eax, 0xabbf
xor eax, 0x7a13
pop eax
mov ecx, dword [ebp - 0x4d4]
mov edx, dword [ecx]
mov dword [ebp - 0x4d4], edx
mov eax, dword [ebp - 0x4d4]
cmp eax, dword [ebp - 0xc20]
je 0x431241
mov ecx, dword [ebp - 0x4d4]
cmp dword [ecx + 0x30], 0
jne 0x430ff7
mov dword [ebp - 0x2e0], 0
Function at 0x4310fd
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ecx
push eax
add esp, 4
sub ecx, 0x88e0
call fcn.0043100f
add byte [ebx + ecx*2 + 0x39], al
cmp byte [eax + 0x37], cl
cmp eax, 0x5904c483
add esp, 4
pop ecx
add esp, 4
pop ecx
push ecx
sub ecx, 0x1513a
pop ecx
push edi
and edi, 0x2591
add edi, 0x9f09
pop edi
lea ecx, [ebp - 0x1628]
mov dword [ebp - 0xc1c], ecx
mov edx, dword [ebp - 0x4d4]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xc18], eax
xor ecx, ecx
mov word [ebp - 0x1f8], cx
xor edx, edx
mov word [ebp - 0x100], dx
push ebx
push edx
add esp, 4
call 0x43106b
add byte [ebp + 0x46], cl
dec eax
cmp esi, dword [esi]
xor edi, dword ds:[edx + ecx*2]
dec ebp
add esp, 4
pop ebx
push ecx
call 0x43107e
add byte [edi], dh
push eax
cmp esi, dword [0x43453c46]
add esp, 4
or ecx, 0xa77c
pop ecx
mov eax, dword [ebp - 0xc18]
mov cx, word [eax]
mov word [ebp - 0xf7e], cx
mov edx, dword [ebp - 0xc18]
add edx, 2
mov dword [ebp - 0xc18], edx
mov ax, word [ebp - 0xf7e]
mov word [ebp - 0x1f8], ax
mov ecx, dword [ebp - 0xc1c]
mov dx, word [ecx]
mov word [ebp - 0xf80], dx
mov eax, dword [ebp - 0xc1c]
add eax, 2
mov dword [ebp - 0xc1c], eax
mov cx, word [ebp - 0xf80]
mov word [ebp - 0x100], cx
push edi
or edi, 0x147a9
pop edi
push edi
push eax
add esp, 4
call 0x4310fd
add byte [eax + 0x35], dl
inc ebp
xor edi, dword [eax]
dec edx
cmp dword [eax - 0x7d], edx
les eax, [edi + ebx*2]
push ebx
push ebx
add esp, 4
xor ebx, 0xafaf
jmp 0x431113
pop ebx
movzx edx, word [ebp - 0x100]
test edx, edx
jne 0x431137
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
sub eax, ecx
mov dword [ebp - 0x1498], eax
jmp 0x43119a
movzx edx, word [ebp - 0x1f8]
movzx eax, word [ebp - 0x100]
cmp edx, eax
je 0x431056
movzx ecx, word [ebp - 0x1f8]
xor ecx, 0x20
movzx edx, word [ebp - 0x100]
cmp ecx, edx
je 0x431056
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
cmp eax, ecx
jge 0x431184
mov dword [ebp - 0x14d8], 0xffffffff
jmp 0x43118e
mov dword [ebp - 0x14d8], 1
mov edx, dword [ebp - 0x14d8]
mov dword [ebp - 0x1498], edx
cmp dword [ebp - 0x1498], 0
jne 0x4311e3
push esi
push eax
add esp, 4
and esi, 0x14bff
and esi, 0x6d4b
add esi, 0x8343
sub esi, 0xd9f6
pop esi
push esi
push ebx
add esp, 4
or esi, 0x113c
pop esi
push ebx
and ebx, 0xc950
pop ebx
mov eax, dword [ebp - 0x4d4]
mov dword [ebp - 0x2e0], eax
jmp 0x43124b
push ebx
push esi
add esp, 4
and ebx, 0x2222
sub ebx, 0x1570c
pop ebx
push esi
and esi, 0xedb1
pop esi
push eax
push eax
add esp, 4
sub eax, 0xd544
sub eax, 0xabbf
xor eax, 0x7a13
pop eax
mov ecx, dword [ebp - 0x4d4]
mov edx, dword [ecx]
mov dword [ebp - 0x4d4], edx
mov eax, dword [ebp - 0x4d4]
cmp eax, dword [ebp - 0xc20]
je 0x431241
mov ecx, dword [ebp - 0x4d4]
cmp dword [ecx + 0x30], 0
jne 0x430ff7
mov dword [ebp - 0x2e0], 0
Function at 0x431de0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp eax, ecx
je 0x431cfd
movzx edx, word [ebp - 0x200]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x431cfd
movzx ecx, word [ebp - 0x200]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x431e19
mov dword [ebp - 0x14f8], 0xffffffff
jmp 0x431e23
mov dword [ebp - 0x14f8], 1
mov eax, dword [ebp - 0x14f8]
mov dword [ebp - 0x14fc], eax

Function at 0x431eb0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [edx]
mov dword [ebp - 0x4dc], eax
mov ecx, dword [ebp - 0x4dc]
cmp ecx, dword [ebp - 0xc3c]
je 0x431ed6
mov edx, dword [ebp - 0x4dc]
cmp dword [edx + 0x30], 0
jne 0x431ca1
mov dword [ebp - 0x2e0], 0