joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4077d8
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov word [ebp - 0x16c6], dx
mov eax, 0x65
mov word [ebp - 0x16c4], ax
mov ecx, 0x6c
mov word [ebp - 0x16c2], cx
mov edx, 0x33
mov word [ebp - 0x16c0], dx
mov eax, 0x32
mov word [ebp - 0x16be], ax
mov ecx, 0x2e
mov word [ebp - 0x16bc], cx
mov edx, 0x64
mov word [ebp - 0x16ba], dx
mov eax, 0x6c
mov word [ebp - 0x16b8], ax
mov ecx, 0x6c
mov word [ebp - 0x16b6], cx
xor edx, edx
mov word [ebp - 0x16b4], dx
push ebx
and ebx, 0x1c35
pop ebx

Function at 0x407850
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edi
push edi
add esp, 4
or edi, 0x1323f
xor edi, 0x9753
pop edi
push ebx
push ecx
add esp, 4
add ebx, 0xb36b
pop ebx
push edx
push esi
add esp, 4
invalid
ret 0x959f
invalid

Function at 0x4078e4
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
out 0xff, eax
dec dword [ebx - 0x6a76cfaf]
out 0xff, eax
dec dword [ebx - 0x189b7b]
dec dword [ecx - 0x14db7b]
call dword [ebx + 0x57]

Function at 0x407904
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
inc edx
add byte [eax], al
and ebx, 0x11716
pop ebx
push esi
and esi, 0x472d
call 0x407924
add byte [esi], dh
inc eax
cmp eax, 0x463e3e3b
inc ecx
cmp eax, 0x8104c483
mov byte [ebp + 0x5a], 0
add byte [esi - 0x7d], bl
mov ebp, 0xffffeb24
add byte [ebp + 0xf], dh
mov dword [ebp - 0x6ec], 0
jmp 0x407c02

Function at 0x407924
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
inc edx
add byte [eax], al
and ebx, 0x11716
pop ebx
push esi
and esi, 0x472d
call 0x407924
add byte [esi], dh
inc eax
cmp eax, 0x463e3e3b
inc ecx
cmp eax, 0x8104c483
mov byte [ebp + 0x5a], 0
add byte [esi - 0x7d], bl
mov ebp, 0xffffeb24
add byte [ebp + 0xf], dh
mov dword [ebp - 0x6ec], 0
jmp 0x407c02

Function at 0x4079c5
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push eax
add eax, 0x6005
call fcn.004079c5
add byte [0x3d3d3f32], dh
dec esi
cmp eax, 0xc483404f
add esp, 4
sub eax, 0x73a6
add esp, 4
sub eax, 0x73a6
or eax, 0x13e02
pop eax
push ebx
push esi
add esp, 4
jmp 0x4079df
pop ebx
lea edx, [ebp - 0x16cc]
mov dword [ebp - 0xc28], edx
mov eax, dword [ebp - 0x4d8]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc24], ecx
xor edx, edx
mov word [ebp - 0x1fc], dx
xor eax, eax
mov word [ebp - 0x104], ax
push eax
xor eax, 0xd338
xor eax, 0x874f
add eax, 0x130f9
pop eax
push edx
push ebx
add esp, 4
sub edx, 0x168bc
sub edx, 0x83ce
and edx, 0xf90c
and edx, 0x69c7
pop edx
invalid
invalid
fdivr st(3), st(0)
invalid

Function at 0x407a54
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
inc dword [ebx - 0x7a76fd40]
fdivr st(3), st(0)
invalid
Function at 0x407aec
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
jmp 0x407b51
cmp dword [ebp - 0x14e4], 0
jne 0x407b9a
push esi
push edx
add esp, 4
add esi, 0x2a22
pop esi
push ecx
push esi
add esp, 4
jmp 0x407b70
call 0x407b80
add byte [edi], bh
xor al, 0x45
dec esi
dec ebp
cmp dh, byte [0x83494637]
les eax, [ebx + ebp*8]
push es
cmp eax, 0x3241374e
dec ebp
pop ecx
mov ecx, dword [ebp - 0x4d8]
mov dword [ebp - 0x6ec], ecx
jmp 0x407c02
push edx
and edx, 0x185c0
loop 0x407b5e
test dword [ecx], eax
add bl, ch
invalid
call 0x407bb6
add byte [esi + 0x404e493e], dh
xor eax, 0x83444c34
les eax, [ecx + eax*4]
loop 0x407c33
add dword [ecx], 0
pop edx
push edi
push edi
add esp, 4
xor edi, 0xac21
pop edi
mov edx, dword [ebp - 0x4d8]
mov eax, dword [edx]
mov dword [ebp - 0x4d8], eax
mov ecx, dword [ebp - 0x4d8]
cmp ecx, dword [ebp - 0xc2c]
je 0x407bf8
mov edx, dword [ebp - 0x4d8]
cmp dword [edx + 0x30], 0
jne 0x4079ae
mov dword [ebp - 0x6ec], 0
pop ebx
cmp dword [ebp - 0x6ec], 0
jne 0x407c7e
push ebx
push ebx
add esp, 4
sub ebx, 0xe0c3
sub ebx, 0x19f0
xor ebx, 0x4010
pop ebx
push edx
and edx, 0x14485
and edx, 0xdbac
or edx, 0x1342c
and edx, 0x132c2
pop edx
mov dword [ebp - 0x738], 0
jmp 0x4087a5
push edi
and edi, 0x12f5a
out 0x5a, eax
das
add dword [eax], eax

Function at 0x407b80
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
jmp 0x407b51
cmp dword [ebp - 0x14e4], 0
jne 0x407b9a
push esi
push edx
add esp, 4
add esi, 0x2a22
pop esi
push ecx
push esi
add esp, 4
jmp 0x407b70
call 0x407b80
add byte [edi], bh
xor al, 0x45
dec esi
dec ebp
cmp dh, byte [0x83494637]
les eax, [ebx + ebp*8]
push es
cmp eax, 0x3241374e
dec ebp
pop ecx
mov ecx, dword [ebp - 0x4d8]
mov dword [ebp - 0x6ec], ecx
jmp 0x407c02
push edx
and edx, 0x185c0
loop 0x407b5e
test dword [ecx], eax
add bl, ch
invalid
call 0x407bb6
add byte [esi + 0x404e493e], dh
xor eax, 0x83444c34
les eax, [ecx + eax*4]
loop 0x407c33
add dword [ecx], 0
pop edx
push edi
push edi
add esp, 4
xor edi, 0xac21
pop edi
mov edx, dword [ebp - 0x4d8]
mov eax, dword [edx]
mov dword [ebp - 0x4d8], eax
mov ecx, dword [ebp - 0x4d8]
cmp ecx, dword [ebp - 0xc2c]
je 0x407bf8
mov edx, dword [ebp - 0x4d8]
cmp dword [edx + 0x30], 0
jne 0x4079ae
mov dword [ebp - 0x6ec], 0
pop ebx
cmp dword [ebp - 0x6ec], 0
jne 0x407c7e
push ebx
push ebx
add esp, 4
sub ebx, 0xe0c3
sub ebx, 0x19f0
xor ebx, 0x4010
pop ebx
push edx
and edx, 0x14485
and edx, 0xdbac
or edx, 0x1342c
and edx, 0x132c2
pop edx
mov dword [ebp - 0x738], 0
jmp 0x4087a5
push edi
and edi, 0x12f5a
out 0x5a, eax
das
add dword [eax], eax
Function at 0x407ba8
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
jmp 0x407b51
cmp dword [ebp - 0x14e4], 0
jne 0x407b9a
push esi
push edx
add esp, 4
add esi, 0x2a22
pop esi
push ecx
push esi
add esp, 4
jmp 0x407b70
call 0x407b80
add byte [edi], bh
xor al, 0x45
dec esi
dec ebp
cmp dh, byte [0x83494637]
les eax, [ebx + ebp*8]
push es
cmp eax, 0x3241374e
dec ebp
pop ecx
mov ecx, dword [ebp - 0x4d8]
mov dword [ebp - 0x6ec], ecx
jmp 0x407c02
push edx
and edx, 0x185c0
loop 0x407b5e
test dword [ecx], eax
add bl, ch
invalid
call 0x407bb6
add byte [esi + 0x404e493e], dh
xor eax, 0x83444c34
les eax, [ecx + eax*4]
loop 0x407c33
add dword [ecx], 0
pop edx
push edi
push edi
add esp, 4
xor edi, 0xac21
pop edi
mov edx, dword [ebp - 0x4d8]
mov eax, dword [edx]
mov dword [ebp - 0x4d8], eax
mov ecx, dword [ebp - 0x4d8]
cmp ecx, dword [ebp - 0xc2c]
je 0x407bf8
mov edx, dword [ebp - 0x4d8]
cmp dword [edx + 0x30], 0
jne 0x4079ae
mov dword [ebp - 0x6ec], 0
pop ebx
cmp dword [ebp - 0x6ec], 0
jne 0x407c7e
push ebx
push ebx
add esp, 4
sub ebx, 0xe0c3
sub ebx, 0x19f0
xor ebx, 0x4010
pop ebx
push edx
and edx, 0x14485
and edx, 0xdbac
or edx, 0x1342c
and edx, 0x132c2
pop edx
mov dword [ebp - 0x738], 0
jmp 0x4087a5
push edi
and edi, 0x12f5a
out 0x5a, eax
das
add dword [eax], eax

Function at 0x407bb6
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
jmp 0x407b51
cmp dword [ebp - 0x14e4], 0
jne 0x407b9a
push esi
push edx
add esp, 4
add esi, 0x2a22
pop esi
push ecx
push esi
add esp, 4
jmp 0x407b70
call 0x407b80
add byte [edi], bh
xor al, 0x45
dec esi
dec ebp
cmp dh, byte [0x83494637]
les eax, [ebx + ebp*8]
push es
cmp eax, 0x3241374e
dec ebp
pop ecx
mov ecx, dword [ebp - 0x4d8]
mov dword [ebp - 0x6ec], ecx
jmp 0x407c02
push edx
and edx, 0x185c0
loop 0x407b5e
test dword [ecx], eax
add bl, ch
invalid
call 0x407bb6
add byte [esi + 0x404e493e], dh
xor eax, 0x83444c34
les eax, [ecx + eax*4]
loop 0x407c33
add dword [ecx], 0
pop edx
push edi
push edi
add esp, 4
xor edi, 0xac21
pop edi
mov edx, dword [ebp - 0x4d8]
mov eax, dword [edx]
mov dword [ebp - 0x4d8], eax
mov ecx, dword [ebp - 0x4d8]
cmp ecx, dword [ebp - 0xc2c]
je 0x407bf8
mov edx, dword [ebp - 0x4d8]
cmp dword [edx + 0x30], 0
jne 0x4079ae
mov dword [ebp - 0x6ec], 0
pop ebx
cmp dword [ebp - 0x6ec], 0
jne 0x407c7e
push ebx
push ebx
add esp, 4
sub ebx, 0xe0c3
sub ebx, 0x19f0
xor ebx, 0x4010
pop ebx
push edx
and edx, 0x14485
and edx, 0xdbac
or edx, 0x1342c
and edx, 0x132c2
pop edx
mov dword [ebp - 0x738], 0
jmp 0x4087a5
push edi
and edi, 0x12f5a
out 0x5a, eax
das
add dword [eax], eax

Function at 0x407cac
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
out 0x5a, eax
das
add dword [eax], eax
pop edi
push esi
push edi
add esp, 4
or esi, 0xe907
xor esi, 0x17716
pop esi
push eax
push edx
add esp, 4
call 0x407cac
add byte [edi], bh
inc esp
dec ebx
inc esp
aas
cmp dword [edi + 0x41], eax
cmp dword [ebx - 0x74a7fb3c], eax
test dword [ecx + edi*8], edx
invalid
Function at 0x407e38
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ebp - 0x180]
add ecx, 1
mov dword [ebp - 0x180], ecx
mov edx, dword [ebp - 0x6f8]
add edx, dword [ebp - 0x180]
movsx eax, byte [edx]
test eax, eax
je 0x407eea
mov ecx, dword [ebp - 0x180]
movsx edx, byte [ebp + ecx - 0x820]
test edx, edx
je 0x407eea
push ecx
call fcn.00407e74
add byte [ebx + 0x3d], cl
cmp byte [ecx], bh
xor bh, byte [edx]
dec ecx
cmp eax, 0xe804c483
add esp, 4
call 0x407e85
add byte [edx + 0x4e], al
xor eax, 0x3d4e373c
inc ecx
add esp, 4
jmp 0x407e90
and ecx, 0x122a2
pop ecx
invalid
test dword [eax], ecx
stc
invalid

Function at 0x407e85
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ebp - 0x180]
add ecx, 1
mov dword [ebp - 0x180], ecx
mov edx, dword [ebp - 0x6f8]
add edx, dword [ebp - 0x180]
movsx eax, byte [edx]
test eax, eax
je 0x407eea
mov ecx, dword [ebp - 0x180]
movsx edx, byte [ebp + ecx - 0x820]
test edx, edx
je 0x407eea
push ecx
call fcn.00407e74
add byte [ebx + 0x3d], cl
cmp byte [ecx], bh
xor bh, byte [edx]
dec ecx
cmp eax, 0xe804c483
add esp, 4
call 0x407e85
add byte [edx + 0x4e], al
xor eax, 0x3d4e373c
inc ecx
add esp, 4
jmp 0x407e90
and ecx, 0x122a2
pop ecx
invalid
test dword [eax], ecx
stc
invalid

Function at 0x407e9c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
inc dword [ebx]
test dword [eax + 0xffffffe], eax
mov esi, 0x80958b08
invalid

Function at 0x407f5c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x6f4]
add edx, 1
mov dword [ebp - 0x6f4], edx
mov eax, dword [ebp - 0x6f0]
mov ecx, dword [ebp - 0x6f4]
cmp ecx, dword [eax + 0x18]
jae 0x407fd4
mov edx, dword [ebp - 0x6f4]
mov eax, dword [ebp - 0x18a0]
mov ecx, dword [ebp - 0x2f8]
add ecx, dword [eax + edx*4]
or al, 0x90
mov dword [ebp - 0x6f8], ecx
mov edx, dword [ebp - 0x6f4]
mov eax, dword [ebp - 0x18a4]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x18a8]
mov eax, dword [ebp - 0x2f8]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x18ac], eax
mov dword [ebp - 0x180], 0
jmp fcn.00407e38
inc esp
inc esp
add esp, 4
pop eax
push edx
call 0x407f71
add byte [0x3a39404d], dh
inc esp
cmp bh, byte [edx]
add esp, 4
add edx, 0x3fe0
pop edx
mov eax, dword [ebp - 0x6f8]
add eax, dword [ebp - 0x180]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x180]
movsx eax, byte [ebp + edx - 0x820]
or eax, 0x20
cmp ecx, eax
jge 0x407fae
mov dword [ebp - 0xc30], 0xffffffff
jmp 0x407fb8
mov dword [ebp - 0xc30], 1
cmp dword [ebp - 0xc30], 0
jne 0x407fcf
mov ecx, dword [ebp - 0x18ac]
mov dword [ebp - 0x3c4], ecx
jmp 0x407fe0
invalid
Function at 0x407f5e
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x6f4]
add edx, 1
mov dword [ebp - 0x6f4], edx
mov eax, dword [ebp - 0x6f0]
mov ecx, dword [ebp - 0x6f4]
cmp ecx, dword [eax + 0x18]
jae 0x407fd4
mov edx, dword [ebp - 0x6f4]
mov eax, dword [ebp - 0x18a0]
mov ecx, dword [ebp - 0x2f8]
add ecx, dword [eax + edx*4]
or al, 0x90
mov dword [ebp - 0x6f8], ecx
mov edx, dword [ebp - 0x6f4]
mov eax, dword [ebp - 0x18a4]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x18a8]
mov eax, dword [ebp - 0x2f8]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x18ac], eax
mov dword [ebp - 0x180], 0
jmp fcn.00407e38
inc esp
inc esp
add esp, 4
pop eax
push edx
call 0x407f71
add byte [0x3a39404d], dh
inc esp
cmp bh, byte [edx]
add esp, 4
add edx, 0x3fe0
pop edx
mov eax, dword [ebp - 0x6f8]
add eax, dword [ebp - 0x180]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x180]
movsx eax, byte [ebp + edx - 0x820]
or eax, 0x20
cmp ecx, eax
jge 0x407fae
mov dword [ebp - 0xc30], 0xffffffff
jmp 0x407fb8
mov dword [ebp - 0xc30], 1
cmp dword [ebp - 0xc30], 0
jne 0x407fcf
mov ecx, dword [ebp - 0x18ac]
mov dword [ebp - 0x3c4], ecx
jmp 0x407fe0
invalid

Function at 0x407f71
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x6f4]
add edx, 1
mov dword [ebp - 0x6f4], edx
mov eax, dword [ebp - 0x6f0]
mov ecx, dword [ebp - 0x6f4]
cmp ecx, dword [eax + 0x18]
jae 0x407fd4
mov edx, dword [ebp - 0x6f4]
mov eax, dword [ebp - 0x18a0]
mov ecx, dword [ebp - 0x2f8]
add ecx, dword [eax + edx*4]
or al, 0x90
mov dword [ebp - 0x6f8], ecx
mov edx, dword [ebp - 0x6f4]
mov eax, dword [ebp - 0x18a4]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x18a8]
mov eax, dword [ebp - 0x2f8]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x18ac], eax
mov dword [ebp - 0x180], 0
jmp fcn.00407e38
inc esp
inc esp
add esp, 4
pop eax
push edx
call 0x407f71
add byte [0x3a39404d], dh
inc esp
cmp bh, byte [edx]
add esp, 4
add edx, 0x3fe0
pop edx
mov eax, dword [ebp - 0x6f8]
add eax, dword [ebp - 0x180]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x180]
movsx eax, byte [ebp + edx - 0x820]
or eax, 0x20
cmp ecx, eax
jge 0x407fae
mov dword [ebp - 0xc30], 0xffffffff
jmp 0x407fb8
mov dword [ebp - 0xc30], 1
cmp dword [ebp - 0xc30], 0
jne 0x407fcf
mov ecx, dword [ebp - 0x18ac]
mov dword [ebp - 0x3c4], ecx
jmp 0x407fe0
invalid
Function at 0x408178
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
ret

Function at 0x40821c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edi
xor edi, 0x11737
add edi, 0x109af
xor edi, 0xf4b5
pop edi
push ebx
push edx
add esp, 4
add ebx, 0xec43
add ebx, 0x9a1b
sub ebx, 0xd2a8
add ebx, 0x4060
pop ebx
lea edx, [ebp - 0x1628]
mov dword [ebp - 0xc38], edx
mov eax, dword [ebp - 0x4dc]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc34], ecx
xor edx, edx
mov word [ebp - 0x200], dx
xor eax, eax
mov word [ebp - 0x34], ax
push ecx
add ecx, 0x5901
sub ecx, 0xc1f5
or ecx, 0x1c5
pop ecx
push eax
push edx
add esp, 4
sub eax, 0xfbd3
pop eax
push esi
push ebx
add esp, 4
add esi, 0xbdc0
and esi, 0xe212
pop esi
mov ecx, dword [ebp - 0xc34]
mov dx, word [ecx]
mov word [ebp - 0xf86], dx
mov eax, dword [ebp - 0xc34]
invalid
invalid

Function at 0x40826c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add cl, byte [ecx - 0xc337b]
jmp dword [esi - 0x75]
Function at 0x40863d
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x704]
add edx, 1
mov dword [ebp - 0x704], edx
mov eax, dword [ebp - 0x700]
mov ecx, dword [ebp - 0x704]
cmp ecx, dword [eax + 0x18]
jae 0x40878d
mov edx, dword [ebp - 0x704]
mov eax, dword [ebp - 0x18c0]
mov ecx, dword [ebp - 0x2fc]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x708], ecx
mov edx, dword [ebp - 0x704]
mov eax, dword [ebp - 0x18c4]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x18c8]
mov eax, dword [ebp - 0x2fc]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x18cc], eax
mov dword [ebp - 0x184], 0
jmp 0x4085f1
mov ecx, dword [ebp - 0x184]
add ecx, 1
mov dword [ebp - 0x184], ecx
mov edx, dword [ebp - 0x708]
add edx, dword [ebp - 0x184]
movsx eax, byte [edx]
test eax, eax
je 0x4086a3
mov ecx, dword [ebp - 0x184]
movsx edx, byte [ebp + ecx - 0x804]
test edx, edx
je 0x4086a3
push esi
push eax
add esp, 4
or esi, 0x14b37
jmp 0x40862e
pop esi
push ecx
call 0x40863d
add byte [ebx + 0x3e], cl
cmp edi, dword [ecx]
aaa
dec eax
xor al, 0x83
les eax, [eax + ebp*8]
pop es
add byte [eax], al
add byte [eax], al
inc ebx
inc ebx
xor dh, byte [esp + ecx*2]
xor al, 0x83
les eax, [ecx + ebx*2]
mov eax, dword [ebp - 0x708]
add eax, dword [ebp - 0x184]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x184]
movsx eax, byte [ebp + edx - 0x804]
cmp ecx, eax
je 0x408695
mov ecx, dword [ebp - 0x708]
add ecx, dword [ebp - 0x184]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x184]
movsx ecx, byte [ebp + eax - 0x804]
cmp edx, ecx
jne 0x40869c
jmp 0x4085e2
jmp 0x4086a3
push ecx
sub ecx, 0xe54c
add ecx, 0xe57b
pop ecx
push edi
call 0x4086bf
add byte [ebx], dh
inc esi
push eax
cmp al, 0x4a
inc esi
cmp eax, 0x8104c483
mul esi
dec edi
add dword [eax], eax
add edi, 0x14195
and edi, 0x112c8
pop edi
mov edx, dword [ebp - 0x708]
add edx, dword [ebp - 0x184]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x184]
movsx edx, byte [ebp + ecx - 0x804]
cmp eax, edx
jne 0x408702
mov dword [ebp - 0xc40], 0
jmp 0x408771
push ebx
push edi
push edi
push ecx
add esp, 4
add edi, 0x50ee
pop edi
mov eax, dword [ebp - 0x708]
add eax, dword [ebp - 0x184]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x184]
movsx eax, byte [ebp + edx - 0x804]
or eax, 0x20
cmp ecx, eax
jge 0x408767
mov dword [ebp - 0xc40], 0xffffffff
jmp 0x408771
mov dword [ebp - 0xc40], 1
cmp dword [ebp - 0xc40], 0
jne 0x408788
mov ecx, dword [ebp - 0x18cc]
mov dword [ebp - 0x4e0], ecx
jmp 0x408799
jmp 0x408572
mov edx, dword [ebp - 0x70c]
mov dword [ebp - 0x4e0], edx
mov eax, dword [ebp - 0x4e0]
mov dword [ebp - 0x738], eax
push ecx
or ecx, 0x90c5
and ecx, 0x6e26
and ecx, 0xdd69
or ecx, 0x12eba
pop ecx
push ebx
Function at 0x40864c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x704]
add edx, 1
mov dword [ebp - 0x704], edx
mov eax, dword [ebp - 0x700]
mov ecx, dword [ebp - 0x704]
cmp ecx, dword [eax + 0x18]
jae 0x40878d
mov edx, dword [ebp - 0x704]
mov eax, dword [ebp - 0x18c0]
mov ecx, dword [ebp - 0x2fc]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x708], ecx
mov edx, dword [ebp - 0x704]
mov eax, dword [ebp - 0x18c4]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x18c8]
mov eax, dword [ebp - 0x2fc]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x18cc], eax
mov dword [ebp - 0x184], 0
jmp 0x4085f1
mov ecx, dword [ebp - 0x184]
add ecx, 1
mov dword [ebp - 0x184], ecx
mov edx, dword [ebp - 0x708]
add edx, dword [ebp - 0x184]
movsx eax, byte [edx]
test eax, eax
je 0x4086a3
mov ecx, dword [ebp - 0x184]
movsx edx, byte [ebp + ecx - 0x804]
test edx, edx
je 0x4086a3
push esi
push eax
add esp, 4
or esi, 0x14b37
jmp 0x40862e
pop esi
push ecx
call 0x40863d
add byte [ebx + 0x3e], cl
cmp edi, dword [ecx]
aaa
dec eax
xor al, 0x83
les eax, [eax + ebp*8]
pop es
add byte [eax], al
add byte [eax], al
inc ebx
inc ebx
xor dh, byte [esp + ecx*2]
xor al, 0x83
les eax, [ecx + ebx*2]
mov eax, dword [ebp - 0x708]
add eax, dword [ebp - 0x184]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x184]
movsx eax, byte [ebp + edx - 0x804]
cmp ecx, eax
je 0x408695
mov ecx, dword [ebp - 0x708]
add ecx, dword [ebp - 0x184]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x184]
movsx ecx, byte [ebp + eax - 0x804]
cmp edx, ecx
jne 0x40869c
jmp 0x4085e2
jmp 0x4086a3
push ecx
sub ecx, 0xe54c
add ecx, 0xe57b
pop ecx
push edi
call 0x4086bf
add byte [ebx], dh
inc esi
push eax
cmp al, 0x4a
inc esi
cmp eax, 0x8104c483
mul esi
dec edi
add dword [eax], eax
add edi, 0x14195
and edi, 0x112c8
pop edi
mov edx, dword [ebp - 0x708]
add edx, dword [ebp - 0x184]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x184]
movsx edx, byte [ebp + ecx - 0x804]
cmp eax, edx
jne 0x408702
mov dword [ebp - 0xc40], 0
jmp 0x408771
push ebx
push edi
push edi
push ecx
add esp, 4
add edi, 0x50ee
pop edi
mov eax, dword [ebp - 0x708]
add eax, dword [ebp - 0x184]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x184]
movsx eax, byte [ebp + edx - 0x804]
or eax, 0x20
cmp ecx, eax
jge 0x408767
mov dword [ebp - 0xc40], 0xffffffff
jmp 0x408771
mov dword [ebp - 0xc40], 1
cmp dword [ebp - 0xc40], 0
jne 0x408788
mov ecx, dword [ebp - 0x18cc]
mov dword [ebp - 0x4e0], ecx
jmp 0x408799
jmp 0x408572
mov edx, dword [ebp - 0x70c]
mov dword [ebp - 0x4e0], edx
mov eax, dword [ebp - 0x4e0]
mov dword [ebp - 0x738], eax
push ecx
or ecx, 0x90c5
and ecx, 0x6e26
and ecx, 0xdd69
or ecx, 0x12eba
pop ecx
push ebx
Function at 0x4086bf
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x704]
add edx, 1
mov dword [ebp - 0x704], edx
mov eax, dword [ebp - 0x700]
mov ecx, dword [ebp - 0x704]
cmp ecx, dword [eax + 0x18]
jae 0x40878d
mov edx, dword [ebp - 0x704]
mov eax, dword [ebp - 0x18c0]
mov ecx, dword [ebp - 0x2fc]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x708], ecx
mov edx, dword [ebp - 0x704]
mov eax, dword [ebp - 0x18c4]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x18c8]
mov eax, dword [ebp - 0x2fc]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x18cc], eax
mov dword [ebp - 0x184], 0
jmp 0x4085f1
mov ecx, dword [ebp - 0x184]
add ecx, 1
mov dword [ebp - 0x184], ecx
mov edx, dword [ebp - 0x708]
add edx, dword [ebp - 0x184]
movsx eax, byte [edx]
test eax, eax
je 0x4086a3
mov ecx, dword [ebp - 0x184]
movsx edx, byte [ebp + ecx - 0x804]
test edx, edx
je 0x4086a3
push esi
push eax
add esp, 4
or esi, 0x14b37
jmp 0x40862e
pop esi
push ecx
call 0x40863d
add byte [ebx + 0x3e], cl
cmp edi, dword [ecx]
aaa
dec eax
xor al, 0x83
les eax, [eax + ebp*8]
pop es
add byte [eax], al
add byte [eax], al
inc ebx
inc ebx
xor dh, byte [esp + ecx*2]
xor al, 0x83
les eax, [ecx + ebx*2]
mov eax, dword [ebp - 0x708]
add eax, dword [ebp - 0x184]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x184]
movsx eax, byte [ebp + edx - 0x804]
cmp ecx, eax
je 0x408695
mov ecx, dword [ebp - 0x708]
add ecx, dword [ebp - 0x184]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x184]
movsx ecx, byte [ebp + eax - 0x804]
cmp edx, ecx
jne 0x40869c
jmp 0x4085e2
jmp 0x4086a3
push ecx
sub ecx, 0xe54c
add ecx, 0xe57b
pop ecx
push edi
call 0x4086bf
add byte [ebx], dh
inc esi
push eax
cmp al, 0x4a
inc esi
cmp eax, 0x8104c483
mul esi
dec edi
add dword [eax], eax
add edi, 0x14195
and edi, 0x112c8
pop edi
mov edx, dword [ebp - 0x708]
add edx, dword [ebp - 0x184]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x184]
movsx edx, byte [ebp + ecx - 0x804]
cmp eax, edx
jne 0x408702
mov dword [ebp - 0xc40], 0
jmp 0x408771
push ebx
push edi
push edi
push ecx
add esp, 4
add edi, 0x50ee
pop edi
mov eax, dword [ebp - 0x708]
add eax, dword [ebp - 0x184]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x184]
movsx eax, byte [ebp + edx - 0x804]
or eax, 0x20
cmp ecx, eax
jge 0x408767
mov dword [ebp - 0xc40], 0xffffffff
jmp 0x408771
mov dword [ebp - 0xc40], 1
cmp dword [ebp - 0xc40], 0
jne 0x408788
mov ecx, dword [ebp - 0x18cc]
mov dword [ebp - 0x4e0], ecx
jmp 0x408799
jmp 0x408572
mov edx, dword [ebp - 0x70c]
mov dword [ebp - 0x4e0], edx
mov eax, dword [ebp - 0x4e0]
mov dword [ebp - 0x738], eax
push ecx
or ecx, 0x90c5
and ecx, 0x6e26
and ecx, 0xdd69
or ecx, 0x12eba
pop ecx
push ebx

Function at 0x408704
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x408713
add byte [edx], bh
inc ecx
dec eax
xor dl, byte [eax + 0x50]
add esp, 4
jmp 0x40871b
and ebx, 0xe6d1
or ebx, 0x7989
pop ebx