joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4490d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x46d4d5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xbc
push ebx
push ebp
push esi
mov ebp, ecx
push edi
mov dword [esp + 0x14], ebp
call fcn.004463c0
test eax, eax
mov dword [esp + 0x18], eax
je 0x4499f0
mov eax, dword [esp + 0xf0]
mov esi, dword [esp + 0xec]
mov ecx, eax
mov edi, dword [esp + 0xe8]
and ecx, 0x1e
xor ebx, ebx
cmp ecx, eax
sete bl
test ebx, ebx
jne 0x449153
push esi
push edi
mov ecx, ebp
call fcn.00449fc0
test eax, eax
jne 0x449153
mov eax, dword [esp + 0xf8]
test eax, eax
je 0x4499f0
push eax
call dword [0x46f480]
jmp 0x4499f0
lea ecx, [esp + 0x90]
call fcn.00445390
mov ecx, dword [esp + 0x18]
push 1
push esi
lea edx, [esp + 0x98]
push edi
push edx
mov dword [esp + 0xe4], 0
call fcn.00443710
cmp ebx, 1
push esi
jne 0x44919e
mov ecx, ebp
call fcn.00445f30
push edi
mov ecx, ebp
mov dword [esp + 0x24], eax
call fcn.00445e50
mov dword [esp + 0x24], eax
jmp 0x4491ba
lea eax, [esp + 0x50]
push edi
push eax
mov ecx, ebp
call fcn.00449d50
mov ecx, eax
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x90]
call fcn.00445470
mov edi, eax
lea ecx, [esp + 0x90]
mov dword [esp + 0x44], eax
and edi, 0xf
call fcn.004454e0
mov ebx, dword [esp + 0xe4]
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x28], eax
lea eax, [edx + ebx]
mov edx, dword [esp + 0xe0]
mov ebp, eax
mov eax, dword [esp + 0xf8]
add ecx, edx
mov esi, ebx
test eax, eax
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], ebp
je 0x449224
mov dword [eax], edx
mov dword [eax + 4], esi
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ebp
lea ecx, [esp + 0x90]
call fcn.00445490
mov ebp, eax
cmp ebp, 0xff000000
jne 0x449241
mov edx, dword [esp + 0x14]
mov ebp, dword [edx + 0x40]
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x6c]
test ecx, ecx
jne 0x44927a
mov esi, dword [esp + 0x18]
mov ecx, esi
call fcn.004436f0
cmp dword [esp + 0xe8], eax
jl 0x449270
mov ecx, esi
call fcn.00443700
cmp dword [esp + 0xec], eax
jge 0x44927a
push 0xf
call dword [0x46f41c]
jmp 0x44927c
mov eax, ebp
push eax
lea ecx, [esp + 0x88]
call 0x47e405
mov al, byte [esp + 0xf0]
mov esi, dword [esp + 0xdc]
test al, 0x20
mov byte [esp + 0xd4], 1
je 0x449303
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0xf4]
mov dword [esp + 0x4c], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x50], edx
test eax, eax
mov dword [esp + 0x58], ecx
je 0x4492df
push eax
lea edx, [esp + 0x50]
lea eax, [esp + 0x50]
push edx
push eax
call dword [0x46f440]
mov ecx, dword [esp + 0x88]
lea eax, [esp + 0x84]
mov edx, dword [esi + 4]
Function at 0x450cac
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [ebp + 0x10]
xor edx, edx
push ebx
push esi
mov ecx, dword [eax + 0x18]
push edi
cmp ecx, edx
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], edx
jle 0x450e82
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
add eax, 0x3c
mov dword [esp + 0x10], eax
jmp 0x450ce1

Function at 0x450ec0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc ecx
mov dword [esi + 0x4c], ecx
mov ecx, dword [esi + 0xb4]
mov dl, byte [ecx]
inc ecx
mov byte [esp + 0x2c], dl
mov dword [esi + 0xb4], ecx
Function at 0x4511f5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp ecx, 3
jne 0x4511fe
add dword [esi + 0x68], 4
cmp ecx, 4
jne 0x451207
add dword [esi + 0x68], 2
mov edx, dword [esi + 0x68]
mov edi, dword [esi + 0x58]
cmp edx, edi
jl 0x45121f
inc ecx
mov edx, 0x10
sar edx, cl
mov dword [esi + 0x64], ecx
mov dword [esi + 0x68], edx
Function at 0x4561e8
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x46df18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0x20]
call 0x47c368
push 0x3e8
lea eax, [esp + 0x20]
push 0x3e8
push eax
mov dword [esp + 0x44], 0
call fcn.00455a08
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x4c]
add ecx, 0x64
add esp, 0xc
mov dword [esp + 4], ecx
lea ecx, [esp + 4]
add eax, 0x96
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], eax
call 0x47c296
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0xc]
push edx
push eax
call dword [0x46f3cc]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, eax
mov eax, dword [esp + 0x14]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 4]
cmp dword [esp + 0x44], 1
jne 0x4562ac
cmp dword [esp + 0x40], 1
jne 0x4562aa
cmp ecx, eax
jge 0x4562ac
mov eax, ecx
cmp eax, 0xc8
jge 0x4562b8
mov eax, 0xc8
mov ecx, esi
mov dword [esi + 0xd0], eax
call fcn.00456068
mov ecx, dword [esi + 0x1c]
push 1
push 0
push ecx
call dword [0x46f3d0]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call 0x47c3da
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret 8
Function at 0x459578
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x4595ab
push esi
call fcn.0045c668
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x4595a4
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x459631
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x45961a
mov eax, dword [esi + 8]
test eax, eax
je 0x4595cf
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x459616
cmp eax, 2
je 0x45961a
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4595c2
cmp eax, 3
je 0x4595f5
cmp eax, 1
jne 0x4595c2
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x4595c2
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x4595c2
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00459658
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x459640
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00459658
add esp, 4
pop esi
ret

Function at 0x460dc8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [edi + 0x1b0]
mov ebx, dword [edx + 0x14]
test ebx, ebx
jne 0x460e16
cmp eax, ecx
jne 0x460df8
mov ebp, dword [edi + 0x18c]
mov ebx, dword [edi + 0x9c]
mov ecx, dword [edi + 0x94]
xor eax, eax
test ebp, ebp
sete al
add eax, ebx
cmp ecx, eax
ja 0x460e16
push edi
call dword [edx]
add esp, 4
test eax, eax
je 0x460e86
mov eax, dword [edi + 0x90]
mov ecx, dword [edi + 0x98]
add byte [eax], al
cmp eax, ecx
jle fcn.00460dc8
mov ecx, dword [edi + 0x20]
mov ebp, dword [edi + 0xd8]
xor eax, eax
mov dword [esp + 0x2c], ebp
cmp ecx, eax
mov dword [esp + 0x68], eax
jle 0x4613ce
mov ecx, dword [esp + 0x120]
mov dword [esp + 0x54], eax
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x108
ret

Function at 0x460e10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [edi + 0x1b0]
mov ebx, dword [edx + 0x14]
test ebx, ebx
jne 0x460e16
cmp eax, ecx
jne 0x460df8
mov ebp, dword [edi + 0x18c]
mov ebx, dword [edi + 0x9c]
mov ecx, dword [edi + 0x94]
xor eax, eax
test ebp, ebp
sete al
add eax, ebx
cmp ecx, eax
ja 0x460e16
push edi
call dword [edx]
add esp, 4
test eax, eax
je 0x460e86
mov eax, dword [edi + 0x90]
mov ecx, dword [edi + 0x98]
add byte [eax], al
cmp eax, ecx
jle fcn.00460dc8
mov ecx, dword [edi + 0x20]
mov ebp, dword [edi + 0xd8]
xor eax, eax
mov dword [esp + 0x2c], ebp
cmp ecx, eax
mov dword [esp + 0x68], eax
jle 0x4613ce
mov ecx, dword [esp + 0x120]
mov dword [esp + 0x54], eax
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x108
ret
Function at 0x4642cf
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [eax]
push ebx
scasb al, byte es:[edi]
inc ebx
add byte [edx + 0x10043ad], ch
scasb al, byte es:[edi]
inc ebx
add byte [esi + ebp*4 - 0x50a0ffbd], dh

Function at 0x4642d8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [eax]
push ebx
scasb al, byte es:[edi]
inc ebx
add byte [edx + 0x10043ad], ch
scasb al, byte es:[edi]
inc ebx
add byte [esi + ebp*4 - 0x50a0ffbd], dh

Function at 0x4642f6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc ebx
add byte [eax], al
add byte [esp + eax], al
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4

Function at 0x4642f8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc ebx
add byte [eax], al
add byte [esp + eax], al
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4

Function at 0x464311
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
invalid

Function at 0x464352
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4

Function at 0x464378
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
invalid
Function at 0x4643a1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
invalid

Function at 0x4643c8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 1
add al, 4
add al, 4
add al, byte [ebx]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x4643e3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 1
add al, 4
Function at 0x464d32
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jne 0x464d7d
mov ecx, dword [esi + 0x64]
mov dword [esi + 0x78], 0
cmp ecx, 1
mov edi, 8
jne 0x464d4b
add dword [esi + 0x68], edi
cmp ecx, 2
jne 0x464d53
add dword [esi + 0x68], edi
cmp ecx, 3
jne 0x464d5c
add dword [esi + 0x68], 4
cmp ecx, 4
jne 0x464d65
add dword [esi + 0x68], 2
mov edx, dword [esi + 0x68]
cmp edx, dword [esi + 0x58]
jl 0x464d82
inc ecx
mov edx, 0x10
sar edx, cl
mov dword [esi + 0x64], ecx
mov dword [esi + 0x68], edx
jmp 0x464d82
mov edi, 8
mov ecx, dword [esi + 0x6c]
mov edx, dword [esi + 0x78]
imul ecx, dword [esi + 0x68]
add ecx, edx
mov edx, dword [esi + 0xac]
mov byte [edx + ecx], bl
mov edx, dword [esi + 0x78]
inc edx
mov dword [esi + 0x78], edx
jmp 0x464dcd

Function at 0x4693d3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub al, 0x8b
dec esi
sbb byte [ebx + 0x4c892856], cl
and al, 0x3c
mov ecx, dword [eax + 0x70]
mov eax, dword [eax + 0x88]
mov dword [esp + 4], edx
mov dword [esp + 0x58], ecx
mov edx, dword [eax]
mov dword [esp + 0x4c], edx
mov edx, dword [eax + 4]
mov eax, dword [eax + 8]
mov dword [esp + 0x50], edx
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x6c]
xor edx, edx
cmp eax, edx
jle 0x469692
Function at 0x469411
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x6c]
push edi
mov edi, dword [esp + 0x74]
mov dword [esp + 0x40], eax
and al, 0x40
mov ebx, edi
sub ebp, edi
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x44], ebp
jmp 0x469432
mov ebp, dword [esp + 0x44]
mov eax, dword [ebx + ebp]
mov edi, dword [ebx]
mov ebx, dword [esi + 0x24]
mov dword [esp + 0x74], eax
cmp ebx, edx
mov dword [esp + 0x70], edi
je 0x46947b
add eax, ecx
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x78], 0xfffffffd
mov dword [esi + 0x24], edx
lea eax, [eax + ecx*2 - 3]
mov dword [esp + 0x74], eax
lea eax, [edi + ecx - 1]
mov edi, dword [esi + 0x20]
mov dword [esp + 0x70], eax
lea eax, [ecx + ecx*2 + 3]
lea ebp, [edi + eax*2]
mov eax, dword [esp + 0x74]
jmp 0x469492
mov ebp, dword [esi + 0x20]
mov edi, 1
mov dword [esp + 0x30], edi
mov dword [esp + 0x78], 3
mov dword [esi + 0x24], edi
mov dword [esp + 0x2c], edx
mov dword [esp + 0x28], edx
mov dword [esp + 0x24], edx
xor edx, edx
xor ebx, ebx
xor edi, edi
xor esi, esi
cmp ecx, edx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], esi
jbe 0x469656
mov dword [esp + 0x34], ecx
jmp 0x4694c4
mov ecx, dword [esp + 0x78]
movsx edx, word [ebp + ecx*2]
lea ecx, [edx + esi + 8]
mov esi, dword [esp + 0x10]
sar ecx, 4
xor edx, edx
mov dl, byte [eax]
mov ecx, dword [esi + ecx*4]
mov esi, dword [esp + 0x20]
add ecx, edx
xor edx, edx
mov dl, byte [ecx + esi]
mov ecx, dword [esp + 0x78]
mov esi, edx
movsx edx, word [ebp + ecx*2 + 2]
lea ecx, [edx + edi + 8]
mov edi, dword [esp + 0x10]
sar ecx, 4
xor edx, edx
mov dl, byte [eax + 1]
mov edi, dword [edi + ecx*4]
mov ecx, dword [esp + 0x20]
add edi, edx
xor edx, edx
mov dl, byte [edi + ecx]
mov edi, edx
mov edx, dword [esp + 0x78]
movsx edx, word [ebp + edx*2 + 4]
lea edx, [edx + ebx + 8]
xor ebx, ebx
mov bl, byte [eax + 2]
mov eax, dword [esp + 0x10]
sar edx, 4
mov edx, dword [eax + edx*4]
mov eax, esi
add edx, ebx
xor ebx, ebx
sar eax, 3
mov bl, byte [edx + ecx]
mov ecx, edi
sar ecx, 2
mov edx, ebx
mov esi, dword [esp + 0x38]
mov ax, word [esp + 0x14]
mov ebx, dword [esp + 0x3c]
mov word [ebp], ax
mov ax, word [esp + 0x18]
mov word [ebp + 2], ax
mov ax, word [esp + 0x1c]
mov word [ebp + 4], ax
mov eax, dword [esp + 0x40]
add ebx, 4
dec eax
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], eax
jne 0x46942e
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x58
ret
Function at 0x469544
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0x50], ecx
sar edx, 3
shl ecx, 5
mov dword [esp + 0x4c], edx
add ecx, edx
mov edx, dword [esp + 0x48]
mov edx, dword [edx + eax*4]
cmp word [edx + ecx*2], 0
lea ecx, [edx + ecx*2]
mov dword [esp + 0x54], ecx
jne 0x469585
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x50]
push ecx
push edx
push eax
mov eax, dword [esp + 0x78]
push eax
call fcn.00468f38
mov ecx, dword [esp + 0x64]
add esp, 0x10
xor eax, eax
xor edx, edx
mov ax, word [ecx]
mov ecx, dword [esp + 0x70]
dec eax
mov byte [ecx], al
mov ecx, dword [esp + 0x58]
mov dl, byte [eax + ecx]
mov ecx, dword [esp + 0x5c]
sub esi, edx
xor edx, edx
mov dl, byte [eax + ecx]
mov ecx, dword [esp + 0x60]
sub edi, edx
xor edx, edx
mov dl, byte [eax + ecx]

Function at 0x4695b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0x74]
lea eax, [esi + esi]
sub ebx, edx
mov edx, dword [esp + 0x14]
mov ecx, esi
add esi, eax
add edx, esi
add esi, eax
mov word [ebp], dx
mov edx, dword [esp + 0x24]
add edx, esi
add esi, eax
mov dword [esp + 0x24], ecx
lea eax, [edi + edi]
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x18]
mov ecx, edi
add edi, eax
add edx, edi
add edi, eax
mov word [ebp + 2], dx
mov edx, dword [esp + 0x28]
add edx, edi
add edi, eax
mov dword [esp + 0x28], ecx
lea eax, [ebx + ebx]
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x1c]
mov ecx, ebx
add ebx, eax
add edx, ebx
add ebx, eax
mov word [ebp + 4], dx
mov edx, dword [esp + 0x2c]
add edx, ebx
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x74]
add ebx, eax
mov eax, dword [esp + 0x78]
mov dword [esp + 0x1c], edx
sbb al, 0x8b
push esp
and al, 0x70
add ecx, eax
mov dword [esp + 0x74], ecx
mov ecx, dword [esp + 0x30]
lea ebp, [ebp + eax*2]
mov eax, dword [esp + 0x34]
add edx, ecx
dec eax
mov dword [esp + 0x70], edx
mov dword [esp + 0x34], eax
jne 0x4694c0
mov ecx, dword [esp + 0x64]
mov esi, dword [esp + 0x38]
xor edx, edx
jmp 0x46965a

Function at 0x46c86c
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x46df18
add byte [ecx], ah
add byte [eax], al
add byte [eax + 0x64], dl
mov dword [0], esp
Function at 0x46c872
Capabilities:
Get number of processors

Disassembly:
add byte [ecx], ah
add byte [eax], al
add byte [eax + 0x64], dl
mov dword [0], esp
sub esp, 0x2c
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0x20]
call 0x4929ec
push 0x3e8
lea eax, [esp + 0x20]
push 0x3e8
push eax
mov dword [esp + 0x44], 0
call fcn.0046c08c
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x4c]
add ecx, 0x64
add esp, 0xc
mov dword [esp + 4], ecx
lea ecx, [esp + 4]
add eax, 0x96
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], eax
call 0x49291a
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0xc]
push edx
push eax
call dword [0x46f3cc]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, eax
mov eax, dword [esp + 0x14]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 4]
cmp dword [esp + 0x44], 1
jne 0x46c930
cmp dword [esp + 0x40], 1
jne 0x46c92e
cmp ecx, eax
jge 0x46c930
mov eax, ecx
cmp eax, 0xc8
jge 0x46c93c
mov eax, 0xc8
mov ecx, esi
mov dword [esi + 0xd0], eax
call fcn.0046c6ec
mov ecx, dword [esi + 0x1c]
push 1
push 0
push ecx
call dword [0x46f3d0]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call 0x492a5e
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret 8

Function at 0x46d735
Capabilities:
Access peb ldr_data

Disassembly:
mov edx, dword [edi + 0x1c]
lea ecx, [esp + 0x10]
push ecx
push eax
push 0x4e
push edx
call ebx
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call 0x48c04d
pop edi
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0x10
push eax
call ebx
mov ecx, dword [esp + 0x24]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x401d70
Capabilities:
Print debug messages

Disassembly:
push edi
xor edi, edi
cmp dword [0x415150], edi
je 0x401d86
push str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp dword [0x415148], edi
je 0x401d97
mov eax, 1
pop edi
ret 4
push esi
cmp dword [0x415150], edi
jne 0x401da9
call fcn.00401b60
test eax, eax
je 0x401deb
mov eax, dword [0x41517c]
mov esi, dword [0x414010]
test eax, eax
jne 0x401dd5
push str.ActivateActCtx
push 0x415174
push 0x40f3b8
call fcn.00401030
mov dword [0x41517c], eax
test eax, eax
je 0x401deb
mov ecx, dword [esp + 0xc]
push ecx
push esi
call eax
test eax, eax
je 0x401deb
pop esi
mov eax, 1
pop edi
ret 4
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7f
je 0x401e00
cmp eax, 0x7e
je 0x401e00
cmp eax, 0x78
jne 0x401e0f
mov eax, 1
pop esi
mov dword [0x415148], eax
pop edi
ret 4
pop esi
mov eax, edi
pop edi
ret 4

Function at 0x402df0
Capabilities:
Read .ini file

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x18]
mov dword [esp + 8], ecx
xor ecx, ecx
mov eax, ebp
mov edx, 2
mul edx
seto cl
push esi
push edi
neg ecx
or ecx, eax
push ecx
call sub.MSVCR90.dll_void____cdecl_operator_new___unsigned_int_
lea ebx, [ebp + ebp]
push ebx
mov esi, eax
push 0
push esi
call sub.MSVCR90.dll_memset
mov edi, dword [esp + 0x2c]
add esp, 0x10
push edi
push esi
call dword [sym.imp.kernel32.dll_lstrcpyW]
push ebx
push 0
push edi
call sub.MSVCR90.dll_memset
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
add esp, 0xc
add eax, 0x254
push eax
push ebp
push edi
push esi
push ecx
push str.labels
call dword [sym.imp.kernel32.dll_GetPrivateProfileStringW]
push esi
call sub.MSVCR90.dll_void___cdecl_operator_delete___void__
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc

Function at 0x403260
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x40326f
pop dword [ebp - 0x48]
mov eax, 0x7c9ffdb1
add eax, 0x83a034be
sub dword [ebp - 0x48], eax
push 0x40
push 0x1000
push 0x39843
push 0
mov eax, 0x368d32c2
sub eax, 0x364c41ea
add eax, dword [ebp - 0x48]
call dword [eax]
mov ecx, 0x539a
xor esi, esi
add esi, eax
mov edx, 0x419c00
add edx, dword [ebp - 0x48]
mov edi, 0x69a4db82
add edi, 0x2b02fe58
xor dword [ebp - 0x34], 0x677819cf
mov ebx, dword [edx]
mov dword [ebp - 0x34], 0x67dd5370
add ebx, edi
sub dword [ebp - 0x3c], edi
mov dword [esi], ebx
xor dword [ebp - 4], 0xf66bd76f
add esi, 4
add edx, 0x4c4d5256
sub edx, 0x4c4d5252
loop 0x4032c4
add eax, 0x72eda470
add eax, 0x8d139ccb
xor ebx, ebx
add ebx, eax
add eax, 0x1c36a3de
add eax, 0xe3c95c27
mov ecx, 0x400000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret