joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405048
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
dec ecx
inc esp
dec edx
inc esp
add esp, 4
pop edi
mov byte [ebp - 0x8b4], 0x4c
mov byte [ebp - 0x8b3], 0x6f
mov byte [ebp - 0x8b2], 0x61
mov byte [ebp - 0x8b1], 0x64
mov byte [ebp - 0x8b0], 0x4c
mov byte [ebp - 0x8af], 0x69
mov byte [ebp - 0x8ae], 0x62
mov byte [ebp - 0x8ad], 0x72
mov byte [ebp - 0x8ac], 0x61
mov byte [ebp - 0x8ab], 0x72
mov byte [ebp - 0x8aa], 0x79
mov byte [ebp - 0x8a9], 0x57
mov byte [ebp - 0x8a8], 0
mov edx, dword fs:[0x18]
mov dword [ebp - 0x1d20], edx
mov eax, dword [ebp - 0x1d20]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x1d24], ecx
mov edx, dword [ebp - 0x1d24]
mov dword [ebp - 0x1600], edx
push ecx
or ecx, 0x1666a
jmp 0x4050df
or ecx, 0xd917
pop ecx
push ecx
and ecx, 0x12f41
pop ecx
push eax
add eax, 0x7517
xor eax, 0x6b50
jmp 0x405100
pop eax
cmp dword [ebp - 0x1600], 0
jne 0x405119
mov dword [ebp - 0x780], 0
jmp 0x4053c0
mov eax, dword [ebp - 0x1600]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xce0], edx
push ebx
call 0x40513a
add byte [esi], dh
cmp dword [ecx + ecx*2 + 0x48], eax
inc ebp
dec ebp
dec ebp
add esp, 4
sub ebx, 0x149a5
pop ebx
push edx
jmp 0x40514b
jmp 0x405150
sub edx, 0xec24
xor edx, 0xd766
pop edx
invalid
invalid
invalid

Function at 0x40513a
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
dec ecx
inc esp
dec edx
inc esp
add esp, 4
pop edi
mov byte [ebp - 0x8b4], 0x4c
mov byte [ebp - 0x8b3], 0x6f
mov byte [ebp - 0x8b2], 0x61
mov byte [ebp - 0x8b1], 0x64
mov byte [ebp - 0x8b0], 0x4c
mov byte [ebp - 0x8af], 0x69
mov byte [ebp - 0x8ae], 0x62
mov byte [ebp - 0x8ad], 0x72
mov byte [ebp - 0x8ac], 0x61
mov byte [ebp - 0x8ab], 0x72
mov byte [ebp - 0x8aa], 0x79
mov byte [ebp - 0x8a9], 0x57
mov byte [ebp - 0x8a8], 0
mov edx, dword fs:[0x18]
mov dword [ebp - 0x1d20], edx
mov eax, dword [ebp - 0x1d20]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x1d24], ecx
mov edx, dword [ebp - 0x1d24]
mov dword [ebp - 0x1600], edx
push ecx
or ecx, 0x1666a
jmp 0x4050df
or ecx, 0xd917
pop ecx
push ecx
and ecx, 0x12f41
pop ecx
push eax
add eax, 0x7517
xor eax, 0x6b50
jmp 0x405100
pop eax
cmp dword [ebp - 0x1600], 0
jne 0x405119
mov dword [ebp - 0x780], 0
jmp 0x4053c0
mov eax, dword [ebp - 0x1600]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xce0], edx
push ebx
call 0x40513a
add byte [esi], dh
cmp dword [ecx + ecx*2 + 0x48], eax
inc ebp
dec ebp
dec ebp
add esp, 4
sub ebx, 0x149a5
pop ebx
push edx
jmp 0x40514b
jmp 0x405150
sub edx, 0xec24
xor edx, 0xd766
pop edx
invalid
invalid
invalid

Function at 0x40537a
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
inc eax
inc ecx
aas
or eax, 0x11d56
pop eax
push eax
call 0x40537a
add byte [eax + edx*2], bh
dec eax
xor dh, byte [esi]
inc ecx
inc edx
aas
xor eax, 0x8104c483
enter 0x7598, 1
add byte [ecx + 0x95e6e8], al
add byte [eax - 0x75], bl
lea eax, [eax]
sti
invalid
Function at 0x405400
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
call 0x40540c
add byte [edi], dh
aas
cmp eax, 0x83394c3d
les eax, [eax + ebp*8]
or dword [eax], eax
add byte [eax], al
add byte [edi], bh
xor cl, byte [edi + 0x4d]
inc edx
cmp byte [esi + 0x45], cl
add esp, 4
and edi, 0x142af
xor edi, 0x7435
pop edi
mov dword [ebp - 0x7cc], 0
jmp 0x405f64

Function at 0x40540c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
call 0x40540c
add byte [edi], dh
aas
cmp eax, 0x83394c3d
les eax, [eax + ebp*8]
or dword [eax], eax
add byte [eax], al
add byte [edi], bh
xor cl, byte [edi + 0x4d]
inc edx
cmp byte [esi + 0x45], cl
add esp, 4
and edi, 0x142af
xor edi, 0x7435
pop edi
mov dword [ebp - 0x7cc], 0
jmp 0x405f64

Function at 0x40541d
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
call 0x40540c
add byte [edi], dh
aas
cmp eax, 0x83394c3d
les eax, [eax + ebp*8]
or dword [eax], eax
add byte [eax], al
add byte [edi], bh
xor cl, byte [edi + 0x4d]
inc edx
cmp byte [esi + 0x45], cl
add esp, 4
and edi, 0x142af
xor edi, 0x7435
pop edi
mov dword [ebp - 0x7cc], 0
jmp 0x405f64
Function at 0x4058a0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
dec ebx
dec eax
cmp dh, byte [edi]
inc ecx
add esp, 4
pop edx
mov edx, dword fs:[0x18]
mov dword [ebp - 0x1d40], edx
mov eax, dword [ebp - 0x1d40]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x1d44], ecx
mov edx, dword [ebp - 0x1d44]
mov dword [ebp - 0x1618], edx
push edx
push ebx
add esp, 4
or edx, 0x5dcd
pop edx
push ecx
push eax
add esp, 4
jmp 0x4058ed
call 0x4058fb
add byte [esi + 0x3f], al
dec ebp
cmp dword [edx + 0x40], ecx
inc esp
inc eax
add esp, 4
or ecx, 0x5769
pop ecx
cmp dword [ebp - 0x1618], 0
jne 0x40591d
mov dword [ebp - 0x2bc], 0
jmp 0x405bc4
mov eax, dword [ebp - 0x1618]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xcf0], edx
push edi
push edi
add esp, 4
add edi, 0x7ad5
xor edi, 0x1845f
or edi, 0xeb86
add edi, 0xf3fe
pop edi
push eax
and eax, 0xfb3e
xor eax, 0x1055e
sub eax, 0x4222
pop eax
cmp dword [ebp - 0xcf0], 0
jne 0x405979
mov dword [ebp - 0x2bc], 0
jmp 0x405bc4
mov eax, dword [ebp - 0xcf0]
mov dword [ebp - 0x504], eax

Function at 0x4058a7
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
dec ebx
dec eax
cmp dh, byte [edi]
inc ecx
add esp, 4
pop edx
mov edx, dword fs:[0x18]
mov dword [ebp - 0x1d40], edx
mov eax, dword [ebp - 0x1d40]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x1d44], ecx
mov edx, dword [ebp - 0x1d44]
mov dword [ebp - 0x1618], edx
push edx
push ebx
add esp, 4
or edx, 0x5dcd
pop edx
push ecx
push eax
add esp, 4
jmp 0x4058ed
call 0x4058fb
add byte [esi + 0x3f], al
dec ebp
cmp dword [edx + 0x40], ecx
inc esp
inc eax
add esp, 4
or ecx, 0x5769
pop ecx
cmp dword [ebp - 0x1618], 0
jne 0x40591d
mov dword [ebp - 0x2bc], 0
jmp 0x405bc4
mov eax, dword [ebp - 0x1618]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xcf0], edx
push edi
push edi
add esp, 4
add edi, 0x7ad5
xor edi, 0x1845f
or edi, 0xeb86
add edi, 0xf3fe
pop edi
push eax
and eax, 0xfb3e
xor eax, 0x1055e
sub eax, 0x4222
pop eax
cmp dword [ebp - 0xcf0], 0
jne 0x405979
mov dword [ebp - 0x2bc], 0
jmp 0x405bc4
mov eax, dword [ebp - 0xcf0]
mov dword [ebp - 0x504], eax
Function at 0x4058f0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
dec ebx
dec eax
cmp dh, byte [edi]
inc ecx
add esp, 4
pop edx
mov edx, dword fs:[0x18]
mov dword [ebp - 0x1d40], edx
mov eax, dword [ebp - 0x1d40]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x1d44], ecx
mov edx, dword [ebp - 0x1d44]
mov dword [ebp - 0x1618], edx
push edx
push ebx
add esp, 4
or edx, 0x5dcd
pop edx
push ecx
push eax
add esp, 4
jmp 0x4058ed
call 0x4058fb
add byte [esi + 0x3f], al
dec ebp
cmp dword [edx + 0x40], ecx
inc esp
inc eax
add esp, 4
or ecx, 0x5769
pop ecx
cmp dword [ebp - 0x1618], 0
jne 0x40591d
mov dword [ebp - 0x2bc], 0
jmp 0x405bc4
mov eax, dword [ebp - 0x1618]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xcf0], edx
push edi
push edi
add esp, 4
add edi, 0x7ad5
xor edi, 0x1845f
or edi, 0xeb86
add edi, 0xf3fe
pop edi
push eax
and eax, 0xfb3e
xor eax, 0x1055e
sub eax, 0x4222
pop eax
cmp dword [ebp - 0xcf0], 0
jne 0x405979
mov dword [ebp - 0x2bc], 0
jmp 0x405bc4
mov eax, dword [ebp - 0xcf0]
mov dword [ebp - 0x504], eax

Function at 0x4058fb
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
dec ebx
dec eax
cmp dh, byte [edi]
inc ecx
add esp, 4
pop edx
mov edx, dword fs:[0x18]
mov dword [ebp - 0x1d40], edx
mov eax, dword [ebp - 0x1d40]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x1d44], ecx
mov edx, dword [ebp - 0x1d44]
mov dword [ebp - 0x1618], edx
push edx
push ebx
add esp, 4
or edx, 0x5dcd
pop edx
push ecx
push eax
add esp, 4
jmp 0x4058ed
call 0x4058fb
add byte [esi + 0x3f], al
dec ebp
cmp dword [edx + 0x40], ecx
inc esp
inc eax
add esp, 4
or ecx, 0x5769
pop ecx
cmp dword [ebp - 0x1618], 0
jne 0x40591d
mov dword [ebp - 0x2bc], 0
jmp 0x405bc4
mov eax, dword [ebp - 0x1618]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xcf0], edx
push edi
push edi
add esp, 4
add edi, 0x7ad5
xor edi, 0x1845f
or edi, 0xeb86
add edi, 0xf3fe
pop edi
push eax
and eax, 0xfb3e
xor eax, 0x1055e
sub eax, 0x4222
pop eax
cmp dword [ebp - 0xcf0], 0
jne 0x405979
mov dword [ebp - 0x2bc], 0
jmp 0x405bc4
mov eax, dword [ebp - 0xcf0]
mov dword [ebp - 0x504], eax
Function at 0x4059b0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
or eax, 0x1a53
pop eax
lea ecx, [ebp - 0x16c0]
mov dword [ebp - 0xcec], ecx
mov edx, dword [ebp - 0x504]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xce8], eax
xor ecx, ecx
mov word [ebp - 0x1c8], cx
xor edx, edx
mov word [ebp - 0x28], dx
push edx
sub edx, 0x1505e
pop edx
push edx
push edx
add esp, 4
or edx, 0x4ab9
pop edx
push esi
push ecx
add esp, 4
sub esi, 0x4daa
and esi, 0x16497
and esi, 0x16d2c
or esi, 0x17b82
pop esi
mov eax, dword [ebp - 0xce8]
mov cx, word [eax]
mov word [ebp - 0x10a2], cx
mov edx, dword [ebp - 0xce8]
add edx, 2
mov dword [ebp - 0xce8], edx
invalid
jmp dword [esi - 0x75]
test dword [esi - 0x11], ebx
invalid
jmp dword [esi - 0x77]
test dword [eax], edi
invalid
invalid
dec dword [ebx - 0xceb73]
jmp dword [esi - 0x75]
adc dword [esi - 0x77], esp
xchg ebp, eax
pop esp
out dx, eax
invalid
dec dword [ebx - 0xceb7b]
inc dword [ebx - 0x7a76fd40]
adc al, 0xf3
invalid
jmp dword [esi - 0x75]
lea ebx, [edi + ebp*8 - 1]
jmp dword [esi - 0x77]
dec ebp
fcom dword [esi + 0x53]
add esp, 4
add esi, 0xfc49
or esi, 0x1506a
pop esi
push esi
or esi, 0xb313
call 0x405a90
add byte [edi + 0x50], cl
dec eax
xor eax, 0xc4834c47
add al, 0x5e
push eax
add eax, 0xc034
pop eax
movzx edx, word [ebp - 0x28]

Function at 0x405a90
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
or eax, 0x1a53
pop eax
lea ecx, [ebp - 0x16c0]
mov dword [ebp - 0xcec], ecx
mov edx, dword [ebp - 0x504]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xce8], eax
xor ecx, ecx
mov word [ebp - 0x1c8], cx
xor edx, edx
mov word [ebp - 0x28], dx
push edx
sub edx, 0x1505e
pop edx
push edx
push edx
add esp, 4
or edx, 0x4ab9
pop edx
push esi
push ecx
add esp, 4
sub esi, 0x4daa
and esi, 0x16497
and esi, 0x16d2c
or esi, 0x17b82
pop esi
mov eax, dword [ebp - 0xce8]
mov cx, word [eax]
mov word [ebp - 0x10a2], cx
mov edx, dword [ebp - 0xce8]
add edx, 2
mov dword [ebp - 0xce8], edx
invalid
jmp dword [esi - 0x75]
test dword [esi - 0x11], ebx
invalid
jmp dword [esi - 0x77]
test dword [eax], edi
invalid
invalid
dec dword [ebx - 0xceb73]
jmp dword [esi - 0x75]
adc dword [esi - 0x77], esp
xchg ebp, eax
pop esp
out dx, eax
invalid
dec dword [ebx - 0xceb7b]
inc dword [ebx - 0x7a76fd40]
adc al, 0xf3
invalid
jmp dword [esi - 0x75]
lea ebx, [edi + ebp*8 - 1]
jmp dword [esi - 0x77]
dec ebp
fcom dword [esi + 0x53]
add esp, 4
add esi, 0xfc49
or esi, 0x1506a
pop esi
push esi
or esi, 0xb313
call 0x405a90
add byte [edi + 0x50], cl
dec eax
xor eax, 0xc4834c47
add al, 0x5e
push eax
add eax, 0xc034
pop eax
movzx edx, word [ebp - 0x28]
Function at 0x405aa0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push eax
or eax, 0xd9a9
pop eax
push eax
push edi
add esp, 4
add eax, 0x226
add eax, 0xa5af
pop eax
push eax
push edx
add esp, 4
and eax, 0x104f4
and eax, 0x14ccd
test edx, edx
jne 0x405ab9
movzx eax, word [ebp - 0x1c8]
movzx ecx, word [ebp - 0x28]
sub eax, ecx
mov dword [ebp - 0x1620], eax
jmp 0x405b13
movzx edx, word [ebp - 0x1c8]
movzx eax, word [ebp - 0x28]
cmp edx, eax
je 0x4059e1
movzx ecx, word [ebp - 0x1c8]
xor ecx, 0x20
movzx edx, word [ebp - 0x28]
cmp ecx, edx
je 0x4059e1
movzx eax, word [ebp - 0x1c8]
movzx ecx, word [ebp - 0x28]
cmp eax, ecx
jge 0x405afd
mov dword [ebp - 0x161c], 0xffffffff
jmp 0x405b07
mov dword [ebp - 0x161c], 1
mov edx, dword [ebp - 0x161c]
mov dword [ebp - 0x1620], edx
cmp dword [ebp - 0x1620], 0
jne 0x405b5c
push ecx
call 0x405b2c
add byte [edi], dh
inc eax
xor ecx, dword [ebx + 0x40]
cmp dword [edx], edi
cmp dword [edx], edi
add esp, 4
pop ecx
push ebx
call 0x405b3e
add byte [ebx + edi + 0x45], al
inc esi
inc eax
cmp eax, dword [eax - 0x7d]
les eax, [ecx + eax*4]
xchg edx, eax
add byte [eax], 0
or ebx, 0x643e
pop ebx
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0x2bc], eax
jmp 0x405bc4
push ecx
sub ecx, 0x94d9
or ecx, 0x4931
pop ecx
push esi
or esi, 0x15537
xor esi, 0x7814
call 0x405b84
add byte [edi + esi], bh
dec ebp
cmp byte [ecx], bh
xor eax, 0x4c48349
and esi, 0x8463
pop esi
mov ecx, dword [ebp - 0x504]
mov edx, dword [ecx]
mov dword [ebp - 0x504], edx
mov eax, dword [ebp - 0x504]
cmp eax, dword [ebp - 0xcf0]
je 0x405bba
mov ecx, dword [ebp - 0x504]
cmp dword [ecx + 0x30], 0
jne 0x405985
mov dword [ebp - 0x2bc], 0
push ecx
push esi
add esp, 4
xor ecx, 0x107c6
add ecx, 0xd838
and ecx, 0x17ce
and ecx, 0x17715
pop ecx
push ecx
sub ecx, 0x1465d
pop ecx
push ebx
push edx
add esp, 4
or ebx, 0xe8f7
pop ebx
mov edx, dword [ebp - 0x2bc]
mov eax, dword [edx + 0x18]
invalid
Function at 0x405b2c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push eax
or eax, 0xd9a9
pop eax
push eax
push edi
add esp, 4
add eax, 0x226
add eax, 0xa5af
pop eax
push eax
push edx
add esp, 4
and eax, 0x104f4
and eax, 0x14ccd
test edx, edx
jne 0x405ab9
movzx eax, word [ebp - 0x1c8]
movzx ecx, word [ebp - 0x28]
sub eax, ecx
mov dword [ebp - 0x1620], eax
jmp 0x405b13
movzx edx, word [ebp - 0x1c8]
movzx eax, word [ebp - 0x28]
cmp edx, eax
je 0x4059e1
movzx ecx, word [ebp - 0x1c8]
xor ecx, 0x20
movzx edx, word [ebp - 0x28]
cmp ecx, edx
je 0x4059e1
movzx eax, word [ebp - 0x1c8]
movzx ecx, word [ebp - 0x28]
cmp eax, ecx
jge 0x405afd
mov dword [ebp - 0x161c], 0xffffffff
jmp 0x405b07
mov dword [ebp - 0x161c], 1
mov edx, dword [ebp - 0x161c]
mov dword [ebp - 0x1620], edx
cmp dword [ebp - 0x1620], 0
jne 0x405b5c
push ecx
call 0x405b2c
add byte [edi], dh
inc eax
xor ecx, dword [ebx + 0x40]
cmp dword [edx], edi
cmp dword [edx], edi
add esp, 4
pop ecx
push ebx
call 0x405b3e
add byte [ebx + edi + 0x45], al
inc esi
inc eax
cmp eax, dword [eax - 0x7d]
les eax, [ecx + eax*4]
xchg edx, eax
add byte [eax], 0
or ebx, 0x643e
pop ebx
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0x2bc], eax
jmp 0x405bc4
push ecx
sub ecx, 0x94d9
or ecx, 0x4931
pop ecx
push esi
or esi, 0x15537
xor esi, 0x7814
call 0x405b84
add byte [edi + esi], bh
dec ebp
cmp byte [ecx], bh
xor eax, 0x4c48349
and esi, 0x8463
pop esi
mov ecx, dword [ebp - 0x504]
mov edx, dword [ecx]
mov dword [ebp - 0x504], edx
mov eax, dword [ebp - 0x504]
cmp eax, dword [ebp - 0xcf0]
je 0x405bba
mov ecx, dword [ebp - 0x504]
cmp dword [ecx + 0x30], 0
jne 0x405985
mov dword [ebp - 0x2bc], 0
push ecx
push esi
add esp, 4
xor ecx, 0x107c6
add ecx, 0xd838
and ecx, 0x17ce
and ecx, 0x17715
pop ecx
push ecx
sub ecx, 0x1465d
pop ecx
push ebx
push edx
add esp, 4
or ebx, 0xe8f7
pop ebx
mov edx, dword [ebp - 0x2bc]
mov eax, dword [edx + 0x18]
invalid
Function at 0x405b3e
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push eax
or eax, 0xd9a9
pop eax
push eax
push edi
add esp, 4
add eax, 0x226
add eax, 0xa5af
pop eax
push eax
push edx
add esp, 4
and eax, 0x104f4
and eax, 0x14ccd
test edx, edx
jne 0x405ab9
movzx eax, word [ebp - 0x1c8]
movzx ecx, word [ebp - 0x28]
sub eax, ecx
mov dword [ebp - 0x1620], eax
jmp 0x405b13
movzx edx, word [ebp - 0x1c8]
movzx eax, word [ebp - 0x28]
cmp edx, eax
je 0x4059e1
movzx ecx, word [ebp - 0x1c8]
xor ecx, 0x20
movzx edx, word [ebp - 0x28]
cmp ecx, edx
je 0x4059e1
movzx eax, word [ebp - 0x1c8]
movzx ecx, word [ebp - 0x28]
cmp eax, ecx
jge 0x405afd
mov dword [ebp - 0x161c], 0xffffffff
jmp 0x405b07
mov dword [ebp - 0x161c], 1
mov edx, dword [ebp - 0x161c]
mov dword [ebp - 0x1620], edx
cmp dword [ebp - 0x1620], 0
jne 0x405b5c
push ecx
call 0x405b2c
add byte [edi], dh
inc eax
xor ecx, dword [ebx + 0x40]
cmp dword [edx], edi
cmp dword [edx], edi
add esp, 4
pop ecx
push ebx
call 0x405b3e
add byte [ebx + edi + 0x45], al
inc esi
inc eax
cmp eax, dword [eax - 0x7d]
les eax, [ecx + eax*4]
xchg edx, eax
add byte [eax], 0
or ebx, 0x643e
pop ebx
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0x2bc], eax
jmp 0x405bc4
push ecx
sub ecx, 0x94d9
or ecx, 0x4931
pop ecx
push esi
or esi, 0x15537
xor esi, 0x7814
call 0x405b84
add byte [edi + esi], bh
dec ebp
cmp byte [ecx], bh
xor eax, 0x4c48349
and esi, 0x8463
pop esi
mov ecx, dword [ebp - 0x504]
mov edx, dword [ecx]
mov dword [ebp - 0x504], edx
mov eax, dword [ebp - 0x504]
cmp eax, dword [ebp - 0xcf0]
je 0x405bba
mov ecx, dword [ebp - 0x504]
cmp dword [ecx + 0x30], 0
jne 0x405985
mov dword [ebp - 0x2bc], 0
push ecx
push esi
add esp, 4
xor ecx, 0x107c6
add ecx, 0xd838
and ecx, 0x17ce
and ecx, 0x17715
pop ecx
push ecx
sub ecx, 0x1465d
pop ecx
push ebx
push edx
add esp, 4
or ebx, 0xe8f7
pop ebx
mov edx, dword [ebp - 0x2bc]
mov eax, dword [edx + 0x18]
invalid
Function at 0x405b84
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push eax
or eax, 0xd9a9
pop eax
push eax
push edi
add esp, 4
add eax, 0x226
add eax, 0xa5af
pop eax
push eax
push edx
add esp, 4
and eax, 0x104f4
and eax, 0x14ccd
test edx, edx
jne 0x405ab9
movzx eax, word [ebp - 0x1c8]
movzx ecx, word [ebp - 0x28]
sub eax, ecx
mov dword [ebp - 0x1620], eax
jmp 0x405b13
movzx edx, word [ebp - 0x1c8]
movzx eax, word [ebp - 0x28]
cmp edx, eax
je 0x4059e1
movzx ecx, word [ebp - 0x1c8]
xor ecx, 0x20
movzx edx, word [ebp - 0x28]
cmp ecx, edx
je 0x4059e1
movzx eax, word [ebp - 0x1c8]
movzx ecx, word [ebp - 0x28]
cmp eax, ecx
jge 0x405afd
mov dword [ebp - 0x161c], 0xffffffff
jmp 0x405b07
mov dword [ebp - 0x161c], 1
mov edx, dword [ebp - 0x161c]
mov dword [ebp - 0x1620], edx
cmp dword [ebp - 0x1620], 0
jne 0x405b5c
push ecx
call 0x405b2c
add byte [edi], dh
inc eax
xor ecx, dword [ebx + 0x40]
cmp dword [edx], edi
cmp dword [edx], edi
add esp, 4
pop ecx
push ebx
call 0x405b3e
add byte [ebx + edi + 0x45], al
inc esi
inc eax
cmp eax, dword [eax - 0x7d]
les eax, [ecx + eax*4]
xchg edx, eax
add byte [eax], 0
or ebx, 0x643e
pop ebx
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0x2bc], eax
jmp 0x405bc4
push ecx
sub ecx, 0x94d9
or ecx, 0x4931
pop ecx
push esi
or esi, 0x15537
xor esi, 0x7814
call 0x405b84
add byte [edi + esi], bh
dec ebp
cmp byte [ecx], bh
xor eax, 0x4c48349
and esi, 0x8463
pop esi
mov ecx, dword [ebp - 0x504]
mov edx, dword [ecx]
mov dword [ebp - 0x504], edx
mov eax, dword [ebp - 0x504]
cmp eax, dword [ebp - 0xcf0]
je 0x405bba
mov ecx, dword [ebp - 0x504]
cmp dword [ecx + 0x30], 0
jne 0x405985
mov dword [ebp - 0x2bc], 0
push ecx
push esi
add esp, 4
xor ecx, 0x107c6
add ecx, 0xd838
and ecx, 0x17ce
and ecx, 0x17715
pop ecx
push ecx
sub ecx, 0x1465d
pop ecx
push ebx
push edx
add esp, 4
or ebx, 0xe8f7
pop ebx
mov edx, dword [ebp - 0x2bc]
mov eax, dword [edx + 0x18]
invalid

Function at 0x406110
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push cs
idiv bh
push dword [esi + eax*8 - 0x7b]
psadbw mm7, mm7
jmp dword [ebp - 0x3a]
Function at 0x4067e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movzx edx, word [ebp - 0x30]
sub ecx, edx
mov dword [ebp - 0x1644], ecx
jmp 0x406848
Function at 0x406e2c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ebp - 0x1d84]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x1d88], edx
mov eax, dword [ebp - 0x1d88]
mov dword [ebp - 0x1654], eax
push eax
push eax
add esp, 4
xor eax, 0x119fc
sub eax, 0x10f12
call 0x406e2c
add byte [edi], dh
inc edi
inc esi
dec ebp
dec edi
cmp eax, 0x834a4d4d
les eax, [ecx + eax*4]
call fcn.00408067
pop eax
push ecx
jmp 0x406e3c
pop ecx
cmp dword [ebp - 0x1654], 0
jne 0x406e55
mov dword [ebp - 0x2c0], 0
jmp 0x4070fc
mov ecx, dword [ebp - 0x1654]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xd1c], eax
push ecx
push esi
add esp, 4
or ecx, 0x74f9
sub ecx, 0x7bd1
pop ecx
push edx
push ebx
add esp, 4
or edx, 0x9823
jmp 0x406e8c
pop edx
push edx
push ecx
add esp, 4
xor edx, 0x446f
pop edx
cmp dword [ebp - 0xd1c], 0
jne 0x406eb1
mov dword [ebp - 0x2c0], 0
jmp 0x4070fc
mov ecx, dword [ebp - 0xd1c]
mov dword [ebp - 0x514], ecx
push esi
call 0x406eca
add byte [edx], dh
dec edi
cmp dword [0xc4834b4a], edi
add al, 0x81
out 0x55, al
pop ds
add byte [eax], al
pop esi
push eax
push ecx
add esp, 4
add eax, 0x16529
xor eax, 0xa77f
pop eax
push ebx
jmp 0x406eee
pop ebx
lea edx, [ebp - 0x16c0]
mov dword [ebp - 0xd18], edx
mov eax, dword [ebp - 0x514]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xd14], ecx
xor edx, edx
invalid
invalid
xchg ebp, eax
invalid

Function at 0x406eca
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ebp - 0x1d84]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x1d88], edx
mov eax, dword [ebp - 0x1d88]
mov dword [ebp - 0x1654], eax
push eax
push eax
add esp, 4
xor eax, 0x119fc
sub eax, 0x10f12
call 0x406e2c
add byte [edi], dh
inc edi
inc esi
dec ebp
dec edi
cmp eax, 0x834a4d4d
les eax, [ecx + eax*4]
call fcn.00408067
pop eax
push ecx
jmp 0x406e3c
pop ecx
cmp dword [ebp - 0x1654], 0
jne 0x406e55
mov dword [ebp - 0x2c0], 0
jmp 0x4070fc
mov ecx, dword [ebp - 0x1654]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xd1c], eax
push ecx
push esi
add esp, 4
or ecx, 0x74f9
sub ecx, 0x7bd1
pop ecx
push edx
push ebx
add esp, 4
or edx, 0x9823
jmp 0x406e8c
pop edx
push edx
push ecx
add esp, 4
xor edx, 0x446f
pop edx
cmp dword [ebp - 0xd1c], 0
jne 0x406eb1
mov dword [ebp - 0x2c0], 0
jmp 0x4070fc
mov ecx, dword [ebp - 0xd1c]
mov dword [ebp - 0x514], ecx
push esi
call 0x406eca
add byte [edx], dh
dec edi
cmp dword [0xc4834b4a], edi
add al, 0x81
out 0x55, al
pop ds
add byte [eax], al
pop esi
push eax
push ecx
add esp, 4
add eax, 0x16529
xor eax, 0xa77f
pop eax
push ebx
jmp 0x406eee
pop ebx
lea edx, [ebp - 0x16c0]
mov dword [ebp - 0xd18], edx
mov eax, dword [ebp - 0x514]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xd14], ecx
xor edx, edx
invalid
invalid
xchg ebp, eax
invalid