joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40251e
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add dword [eax], 0
pop eax
push edi
push ebx
add esp, 4
xor edi, 0xe0e9
call 0x40253b
add byte [esi + 0x4f], cl
dec edx
cmp al, byte [edx + eax*2 + 0x32]
inc edx
add esp, 4
pop edi
mov ecx, dword [ebp - 0x2f0]
mov edx, dword [ebp - 0x2ec]
mov dword [ebp - 0x2048], ecx
mov dword [ebp - 0x2044], edx
lea eax, [ebp - 0x2048]
mov dword [ebp - 0x1ee8], eax
mov ecx, dword [ebp - 0x1ee8]
mov dword [ebp - 0xadc], ecx
push ecx
call 0x40257c
add byte [esp + eax*2 + 0x3c], cl
xor ecx, dword [edi + 0x37]
add esp, 4
xor ecx, 0x626b
pop ecx
push ecx
push eax
add esp, 4
or ecx, 0x641c
call 0x40259d
add byte [esi], dh
xor eax, 0x453f4548
add esp, 4
pop ecx
mov edx, dword [ebp - 0xadc]
mov eax, dword [edx]
add eax, 0x138
mov ecx, dword [ebp - 0xadc]
imul edx, dword [ecx + 4], 0x138
add edx, 0x55f3663b
mov ecx, dword [ebp - 0xadc]
imul ecx, dword [ecx + 4], 0x138
add byte [eax], al
sub edx, ecx
xor eax, edx
mov edx, dword [ebp - 0xadc]
imul eax, dword [edx + 4]
mov dword [ebp - 0x1eec], eax
mov eax, dword [ebp - 0x1eec]
mov dword [ebp - 0x1ef4], eax
mov ecx, dword [ebp - 0x1ef0]
sub ecx, dword [ebp - 0x1ef4]
mov dword [ebp - 0x1ef8], ecx
mov dword [ebp - 0x1084], 1
push eax
xor eax, 0xde7a
xor eax, 0xac72
jmp 0x40261e
pop eax
push edx
push edx
add esp, 4
xor edx, 0x15a89
call 0x402638
add byte [ebx], dh
cmp esi, dword [0x3f504646]
inc ebp
add esp, 4
pop edx
imul edx, dword [ebp - 0x1084], 0x138
add edx, 0x55f3663b
imul eax, dword [ebp - 0x1084], 0x138
sub edx, eax
xor edx, dword [ebp - 0x1ef8]
imul edx, dword [ebp - 0x1084]
invalid
lea edi, [edi + ebp*8 - 1]
invalid
invalid
Function at 0x40253b
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add dword [eax], 0
pop eax
push edi
push ebx
add esp, 4
xor edi, 0xe0e9
call 0x40253b
add byte [esi + 0x4f], cl
dec edx
cmp al, byte [edx + eax*2 + 0x32]
inc edx
add esp, 4
pop edi
mov ecx, dword [ebp - 0x2f0]
mov edx, dword [ebp - 0x2ec]
mov dword [ebp - 0x2048], ecx
mov dword [ebp - 0x2044], edx
lea eax, [ebp - 0x2048]
mov dword [ebp - 0x1ee8], eax
mov ecx, dword [ebp - 0x1ee8]
mov dword [ebp - 0xadc], ecx
push ecx
call 0x40257c
add byte [esp + eax*2 + 0x3c], cl
xor ecx, dword [edi + 0x37]
add esp, 4
xor ecx, 0x626b
pop ecx
push ecx
push eax
add esp, 4
or ecx, 0x641c
call 0x40259d
add byte [esi], dh
xor eax, 0x453f4548
add esp, 4
pop ecx
mov edx, dword [ebp - 0xadc]
mov eax, dword [edx]
add eax, 0x138
mov ecx, dword [ebp - 0xadc]
imul edx, dword [ecx + 4], 0x138
add edx, 0x55f3663b
mov ecx, dword [ebp - 0xadc]
imul ecx, dword [ecx + 4], 0x138
add byte [eax], al
sub edx, ecx
xor eax, edx
mov edx, dword [ebp - 0xadc]
imul eax, dword [edx + 4]
mov dword [ebp - 0x1eec], eax
mov eax, dword [ebp - 0x1eec]
mov dword [ebp - 0x1ef4], eax
mov ecx, dword [ebp - 0x1ef0]
sub ecx, dword [ebp - 0x1ef4]
mov dword [ebp - 0x1ef8], ecx
mov dword [ebp - 0x1084], 1
push eax
xor eax, 0xde7a
xor eax, 0xac72
jmp 0x40261e
pop eax
push edx
push edx
add esp, 4
xor edx, 0x15a89
call 0x402638
add byte [ebx], dh
cmp esi, dword [0x3f504646]
inc ebp
add esp, 4
pop edx
imul edx, dword [ebp - 0x1084], 0x138
add edx, 0x55f3663b
imul eax, dword [ebp - 0x1084], 0x138
sub edx, eax
xor edx, dword [ebp - 0x1ef8]
imul edx, dword [ebp - 0x1084]
invalid
lea edi, [edi + ebp*8 - 1]
invalid
invalid
Function at 0x40257c
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add dword [eax], 0
pop eax
push edi
push ebx
add esp, 4
xor edi, 0xe0e9
call 0x40253b
add byte [esi + 0x4f], cl
dec edx
cmp al, byte [edx + eax*2 + 0x32]
inc edx
add esp, 4
pop edi
mov ecx, dword [ebp - 0x2f0]
mov edx, dword [ebp - 0x2ec]
mov dword [ebp - 0x2048], ecx
mov dword [ebp - 0x2044], edx
lea eax, [ebp - 0x2048]
mov dword [ebp - 0x1ee8], eax
mov ecx, dword [ebp - 0x1ee8]
mov dword [ebp - 0xadc], ecx
push ecx
call 0x40257c
add byte [esp + eax*2 + 0x3c], cl
xor ecx, dword [edi + 0x37]
add esp, 4
xor ecx, 0x626b
pop ecx
push ecx
push eax
add esp, 4
or ecx, 0x641c
call 0x40259d
add byte [esi], dh
xor eax, 0x453f4548
add esp, 4
pop ecx
mov edx, dword [ebp - 0xadc]
mov eax, dword [edx]
add eax, 0x138
mov ecx, dword [ebp - 0xadc]
imul edx, dword [ecx + 4], 0x138
add edx, 0x55f3663b
mov ecx, dword [ebp - 0xadc]
imul ecx, dword [ecx + 4], 0x138
add byte [eax], al
sub edx, ecx
xor eax, edx
mov edx, dword [ebp - 0xadc]
imul eax, dword [edx + 4]
mov dword [ebp - 0x1eec], eax
mov eax, dword [ebp - 0x1eec]
mov dword [ebp - 0x1ef4], eax
mov ecx, dword [ebp - 0x1ef0]
sub ecx, dword [ebp - 0x1ef4]
mov dword [ebp - 0x1ef8], ecx
mov dword [ebp - 0x1084], 1
push eax
xor eax, 0xde7a
xor eax, 0xac72
jmp 0x40261e
pop eax
push edx
push edx
add esp, 4
xor edx, 0x15a89
call 0x402638
add byte [ebx], dh
cmp esi, dword [0x3f504646]
inc ebp
add esp, 4
pop edx
imul edx, dword [ebp - 0x1084], 0x138
add edx, 0x55f3663b
imul eax, dword [ebp - 0x1084], 0x138
sub edx, eax
xor edx, dword [ebp - 0x1ef8]
imul edx, dword [ebp - 0x1084]
invalid
lea edi, [edi + ebp*8 - 1]
invalid
invalid
Function at 0x40259d
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add dword [eax], 0
pop eax
push edi
push ebx
add esp, 4
xor edi, 0xe0e9
call 0x40253b
add byte [esi + 0x4f], cl
dec edx
cmp al, byte [edx + eax*2 + 0x32]
inc edx
add esp, 4
pop edi
mov ecx, dword [ebp - 0x2f0]
mov edx, dword [ebp - 0x2ec]
mov dword [ebp - 0x2048], ecx
mov dword [ebp - 0x2044], edx
lea eax, [ebp - 0x2048]
mov dword [ebp - 0x1ee8], eax
mov ecx, dword [ebp - 0x1ee8]
mov dword [ebp - 0xadc], ecx
push ecx
call 0x40257c
add byte [esp + eax*2 + 0x3c], cl
xor ecx, dword [edi + 0x37]
add esp, 4
xor ecx, 0x626b
pop ecx
push ecx
push eax
add esp, 4
or ecx, 0x641c
call 0x40259d
add byte [esi], dh
xor eax, 0x453f4548
add esp, 4
pop ecx
mov edx, dword [ebp - 0xadc]
mov eax, dword [edx]
add eax, 0x138
mov ecx, dword [ebp - 0xadc]
imul edx, dword [ecx + 4], 0x138
add edx, 0x55f3663b
mov ecx, dword [ebp - 0xadc]
imul ecx, dword [ecx + 4], 0x138
add byte [eax], al
sub edx, ecx
xor eax, edx
mov edx, dword [ebp - 0xadc]
imul eax, dword [edx + 4]
mov dword [ebp - 0x1eec], eax
mov eax, dword [ebp - 0x1eec]
mov dword [ebp - 0x1ef4], eax
mov ecx, dword [ebp - 0x1ef0]
sub ecx, dword [ebp - 0x1ef4]
mov dword [ebp - 0x1ef8], ecx
mov dword [ebp - 0x1084], 1
push eax
xor eax, 0xde7a
xor eax, 0xac72
jmp 0x40261e
pop eax
push edx
push edx
add esp, 4
xor edx, 0x15a89
call 0x402638
add byte [ebx], dh
cmp esi, dword [0x3f504646]
inc ebp
add esp, 4
pop edx
imul edx, dword [ebp - 0x1084], 0x138
add edx, 0x55f3663b
imul eax, dword [ebp - 0x1084], 0x138
sub edx, eax
xor edx, dword [ebp - 0x1ef8]
imul edx, dword [ebp - 0x1084]
invalid
lea edi, [edi + ebp*8 - 1]
invalid
invalid
Function at 0x4025cc
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add dword [eax], 0
pop eax
push edi
push ebx
add esp, 4
xor edi, 0xe0e9
call 0x40253b
add byte [esi + 0x4f], cl
dec edx
cmp al, byte [edx + eax*2 + 0x32]
inc edx
add esp, 4
pop edi
mov ecx, dword [ebp - 0x2f0]
mov edx, dword [ebp - 0x2ec]
mov dword [ebp - 0x2048], ecx
mov dword [ebp - 0x2044], edx
lea eax, [ebp - 0x2048]
mov dword [ebp - 0x1ee8], eax
mov ecx, dword [ebp - 0x1ee8]
mov dword [ebp - 0xadc], ecx
push ecx
call 0x40257c
add byte [esp + eax*2 + 0x3c], cl
xor ecx, dword [edi + 0x37]
add esp, 4
xor ecx, 0x626b
pop ecx
push ecx
push eax
add esp, 4
or ecx, 0x641c
call 0x40259d
add byte [esi], dh
xor eax, 0x453f4548
add esp, 4
pop ecx
mov edx, dword [ebp - 0xadc]
mov eax, dword [edx]
add eax, 0x138
mov ecx, dword [ebp - 0xadc]
imul edx, dword [ecx + 4], 0x138
add edx, 0x55f3663b
mov ecx, dword [ebp - 0xadc]
imul ecx, dword [ecx + 4], 0x138
add byte [eax], al
sub edx, ecx
xor eax, edx
mov edx, dword [ebp - 0xadc]
imul eax, dword [edx + 4]
mov dword [ebp - 0x1eec], eax
mov eax, dword [ebp - 0x1eec]
mov dword [ebp - 0x1ef4], eax
mov ecx, dword [ebp - 0x1ef0]
sub ecx, dword [ebp - 0x1ef4]
mov dword [ebp - 0x1ef8], ecx
mov dword [ebp - 0x1084], 1
push eax
xor eax, 0xde7a
xor eax, 0xac72
jmp 0x40261e
pop eax
push edx
push edx
add esp, 4
xor edx, 0x15a89
call 0x402638
add byte [ebx], dh
cmp esi, dword [0x3f504646]
inc ebp
add esp, 4
pop edx
imul edx, dword [ebp - 0x1084], 0x138
add edx, 0x55f3663b
imul eax, dword [ebp - 0x1084], 0x138
sub edx, eax
xor edx, dword [ebp - 0x1ef8]
imul edx, dword [ebp - 0x1084]
invalid
lea edi, [edi + ebp*8 - 1]
invalid
invalid
Function at 0x402638
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add dword [eax], 0
pop eax
push edi
push ebx
add esp, 4
xor edi, 0xe0e9
call 0x40253b
add byte [esi + 0x4f], cl
dec edx
cmp al, byte [edx + eax*2 + 0x32]
inc edx
add esp, 4
pop edi
mov ecx, dword [ebp - 0x2f0]
mov edx, dword [ebp - 0x2ec]
mov dword [ebp - 0x2048], ecx
mov dword [ebp - 0x2044], edx
lea eax, [ebp - 0x2048]
mov dword [ebp - 0x1ee8], eax
mov ecx, dword [ebp - 0x1ee8]
mov dword [ebp - 0xadc], ecx
push ecx
call 0x40257c
add byte [esp + eax*2 + 0x3c], cl
xor ecx, dword [edi + 0x37]
add esp, 4
xor ecx, 0x626b
pop ecx
push ecx
push eax
add esp, 4
or ecx, 0x641c
call 0x40259d
add byte [esi], dh
xor eax, 0x453f4548
add esp, 4
pop ecx
mov edx, dword [ebp - 0xadc]
mov eax, dword [edx]
add eax, 0x138
mov ecx, dword [ebp - 0xadc]
imul edx, dword [ecx + 4], 0x138
add edx, 0x55f3663b
mov ecx, dword [ebp - 0xadc]
imul ecx, dword [ecx + 4], 0x138
add byte [eax], al
sub edx, ecx
xor eax, edx
mov edx, dword [ebp - 0xadc]
imul eax, dword [edx + 4]
mov dword [ebp - 0x1eec], eax
mov eax, dword [ebp - 0x1eec]
mov dword [ebp - 0x1ef4], eax
mov ecx, dword [ebp - 0x1ef0]
sub ecx, dword [ebp - 0x1ef4]
mov dword [ebp - 0x1ef8], ecx
mov dword [ebp - 0x1084], 1
push eax
xor eax, 0xde7a
xor eax, 0xac72
jmp 0x40261e
pop eax
push edx
push edx
add esp, 4
xor edx, 0x15a89
call 0x402638
add byte [ebx], dh
cmp esi, dword [0x3f504646]
inc ebp
add esp, 4
pop edx
imul edx, dword [ebp - 0x1084], 0x138
add edx, 0x55f3663b
imul eax, dword [ebp - 0x1084], 0x138
sub edx, eax
xor edx, dword [ebp - 0x1ef8]
imul edx, dword [ebp - 0x1084]
invalid
lea edi, [edi + ebp*8 - 1]
invalid
invalid

Function at 0x40266c
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add dword [eax], eax
add byte [ebx], ch
ror dword [ecx - 0x10876b], 1
dec dword [ebx - 0x10876b]
dec dword [ebx - 0x10837b]
dec dword [ecx + 0x4589ec55]
invalid

Function at 0x402696
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
and eax, 0x81000136
mul dword [edx + 0x5f0000d6]

Function at 0x4026d4
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edx
push ebx
push edi
add esp, 4
call 0x4026e9
add byte [edx], dh
cmp eax, 0x494e4149
add esp, 4
pop ebx
mov ecx, dword [ebp - 0x14]
add ecx, 0x138
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x55f3663b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor ecx, edx
imul ecx, dword [ebp - 0x10]
mov dword [ebp - 0x1efc], ecx
mov ecx, dword [ebp - 0x1efc]
mov dword [ebp - 0x1f68], ecx
lea edx, [ebp - 0x9b8]
mov dword [ebp - 0x3e8], edx
mov eax, dword [ebp - 0x3e8]
mov dword [eax + 4], 1
push ebx
and ebx, 0x168f
Function at 0x4026e9
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edx
push ebx
push edi
add esp, 4
call 0x4026e9
add byte [edx], dh
cmp eax, 0x494e4149
add esp, 4
pop ebx
mov ecx, dword [ebp - 0x14]
add ecx, 0x138
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x55f3663b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor ecx, edx
imul ecx, dword [ebp - 0x10]
mov dword [ebp - 0x1efc], ecx
mov ecx, dword [ebp - 0x1efc]
mov dword [ebp - 0x1f68], ecx
lea edx, [ebp - 0x9b8]
mov dword [ebp - 0x3e8], edx
mov eax, dword [ebp - 0x3e8]
mov dword [eax + 4], 1
push ebx
and ebx, 0x168f

Function at 0x402744
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
pop ebx
push esi
and esi, 0x10392
jmp 0x402755
or esi, 0xa39a
call 0x40276b
add byte [edi], bh
xor esi, dword [ecx + ecx*2]
xor ecx, dword [ebx + 0x3d]
xor edi, dword [edx]
xor eax, 0x5e04c483
mov ecx, dword [ebp - 0x3e8]
imul edx, dword [ecx + 4], 0x138
add edx, 0x55f3663b
mov eax, dword [ebp - 0x3e8]
imul ecx, dword [eax + 4], 0x138
sub edx, ecx
xor edx, 0x19
mov eax, dword [ebp - 0x3e8]
imul edx, dword [eax + 4]
mov ecx, dword [ebp - 0x3e8]
imul eax, dword [ecx + 4], 0x138
sub edx, eax
mov ecx, dword [ebp - 0x3e8]
mov dword [ecx], edx
mov edx, dword [ebp - 0x3e8]
mov dword [ebp - 0x209c], edx
push ebx
add ebx, 0x16449
add ebx, 0x7fc6
call 0x4027db
add byte [edi], dh
cmp dword [ecx + 0x48], ecx
dec edx
dec eax
add esp, 4
add ebx, 0xe8f9
pop ebx
push eax
add eax, 0xcdfb
and eax, 0x40e5
pop eax
mov dword [ebp - 0x15bc], 1
push edx
push ebx
add esp, 4
xor edx, 0x15872
xor edx, 0xf266
xor edx, 0xa5d2
pop edx
push ebx
xor ebx, 0x4fd
xor ebx, 0xf70e
sub ebx, 0x8d51
and ebx, 0xd27
pop ebx
mov dword [ebp - 0x20a0], 0x38
mov dword [ebp - 0x20a4], 0xe6
mov dword [ebp - 0x20a8], 0x6e
mov dword [ebp - 0x20ac], 0x6e
mov dword [ebp - 0x20b0], 0x78
mov dword [ebp - 0x1650], 1
push edx
call 0x40287b
add byte [0x4f4a4335], dh
cmp edi, dword [0xc4833e33]
add al, 0x81
ljmp 0xea81
Function at 0x40276b
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
pop ebx
push esi
and esi, 0x10392
jmp 0x402755
or esi, 0xa39a
call 0x40276b
add byte [edi], bh
xor esi, dword [ecx + ecx*2]
xor ecx, dword [ebx + 0x3d]
xor edi, dword [edx]
xor eax, 0x5e04c483
mov ecx, dword [ebp - 0x3e8]
imul edx, dword [ecx + 4], 0x138
add edx, 0x55f3663b
mov eax, dword [ebp - 0x3e8]
imul ecx, dword [eax + 4], 0x138
sub edx, ecx
xor edx, 0x19
mov eax, dword [ebp - 0x3e8]
imul edx, dword [eax + 4]
mov ecx, dword [ebp - 0x3e8]
imul eax, dword [ecx + 4], 0x138
sub edx, eax
mov ecx, dword [ebp - 0x3e8]
mov dword [ecx], edx
mov edx, dword [ebp - 0x3e8]
mov dword [ebp - 0x209c], edx
push ebx
add ebx, 0x16449
add ebx, 0x7fc6
call 0x4027db
add byte [edi], dh
cmp dword [ecx + 0x48], ecx
dec edx
dec eax
add esp, 4
add ebx, 0xe8f9
pop ebx
push eax
add eax, 0xcdfb
and eax, 0x40e5
pop eax
mov dword [ebp - 0x15bc], 1
push edx
push ebx
add esp, 4
xor edx, 0x15872
xor edx, 0xf266
xor edx, 0xa5d2
pop edx
push ebx
xor ebx, 0x4fd
xor ebx, 0xf70e
sub ebx, 0x8d51
and ebx, 0xd27
pop ebx
mov dword [ebp - 0x20a0], 0x38
mov dword [ebp - 0x20a4], 0xe6
mov dword [ebp - 0x20a8], 0x6e
mov dword [ebp - 0x20ac], 0x6e
mov dword [ebp - 0x20b0], 0x78
mov dword [ebp - 0x1650], 1
push edx
call 0x40287b
add byte [0x4f4a4335], dh
cmp edi, dword [0xc4833e33]
add al, 0x81
ljmp 0xea81

Function at 0x4027db
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
pop ebx
push esi
and esi, 0x10392
jmp 0x402755
or esi, 0xa39a
call 0x40276b
add byte [edi], bh
xor esi, dword [ecx + ecx*2]
xor ecx, dword [ebx + 0x3d]
xor edi, dword [edx]
xor eax, 0x5e04c483
mov ecx, dword [ebp - 0x3e8]
imul edx, dword [ecx + 4], 0x138
add edx, 0x55f3663b
mov eax, dword [ebp - 0x3e8]
imul ecx, dword [eax + 4], 0x138
sub edx, ecx
xor edx, 0x19
mov eax, dword [ebp - 0x3e8]
imul edx, dword [eax + 4]
mov ecx, dword [ebp - 0x3e8]
imul eax, dword [ecx + 4], 0x138
sub edx, eax
mov ecx, dword [ebp - 0x3e8]
mov dword [ecx], edx
mov edx, dword [ebp - 0x3e8]
mov dword [ebp - 0x209c], edx
push ebx
add ebx, 0x16449
add ebx, 0x7fc6
call 0x4027db
add byte [edi], dh
cmp dword [ecx + 0x48], ecx
dec edx
dec eax
add esp, 4
add ebx, 0xe8f9
pop ebx
push eax
add eax, 0xcdfb
and eax, 0x40e5
pop eax
mov dword [ebp - 0x15bc], 1
push edx
push ebx
add esp, 4
xor edx, 0x15872
xor edx, 0xf266
xor edx, 0xa5d2
pop edx
push ebx
xor ebx, 0x4fd
xor ebx, 0xf70e
sub ebx, 0x8d51
and ebx, 0xd27
pop ebx
mov dword [ebp - 0x20a0], 0x38
mov dword [ebp - 0x20a4], 0xe6
mov dword [ebp - 0x20a8], 0x6e
mov dword [ebp - 0x20ac], 0x6e
mov dword [ebp - 0x20b0], 0x78
mov dword [ebp - 0x1650], 1
push edx
call 0x40287b
add byte [0x4f4a4335], dh
cmp edi, dword [0xc4833e33]
add al, 0x81
ljmp 0xea81
Function at 0x40287b
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
pop ebx
push esi
and esi, 0x10392
jmp 0x402755
or esi, 0xa39a
call 0x40276b
add byte [edi], bh
xor esi, dword [ecx + ecx*2]
xor ecx, dword [ebx + 0x3d]
xor edi, dword [edx]
xor eax, 0x5e04c483
mov ecx, dword [ebp - 0x3e8]
imul edx, dword [ecx + 4], 0x138
add edx, 0x55f3663b
mov eax, dword [ebp - 0x3e8]
imul ecx, dword [eax + 4], 0x138
sub edx, ecx
xor edx, 0x19
mov eax, dword [ebp - 0x3e8]
imul edx, dword [eax + 4]
mov ecx, dword [ebp - 0x3e8]
imul eax, dword [ecx + 4], 0x138
sub edx, eax
mov ecx, dword [ebp - 0x3e8]
mov dword [ecx], edx
mov edx, dword [ebp - 0x3e8]
mov dword [ebp - 0x209c], edx
push ebx
add ebx, 0x16449
add ebx, 0x7fc6
call 0x4027db
add byte [edi], dh
cmp dword [ecx + 0x48], ecx
dec edx
dec eax
add esp, 4
add ebx, 0xe8f9
pop ebx
push eax
add eax, 0xcdfb
and eax, 0x40e5
pop eax
mov dword [ebp - 0x15bc], 1
push edx
push ebx
add esp, 4
xor edx, 0x15872
xor edx, 0xf266
xor edx, 0xa5d2
pop edx
push ebx
xor ebx, 0x4fd
xor ebx, 0xf70e
sub ebx, 0x8d51
and ebx, 0xd27
pop ebx
mov dword [ebp - 0x20a0], 0x38
mov dword [ebp - 0x20a4], 0xe6
mov dword [ebp - 0x20a8], 0x6e
mov dword [ebp - 0x20ac], 0x6e
mov dword [ebp - 0x20b0], 0x78
mov dword [ebp - 0x1650], 1
push edx
call 0x40287b
add byte [0x4f4a4335], dh
cmp edi, dword [0xc4833e33]
add al, 0x81
ljmp 0xea81
Function at 0x403dbc
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edx
push eax
add eax, 0x5491
and eax, 0xbad5
pop eax
push ecx
xor ecx, 0x3242
pop ecx
push eax
and eax, 0x52ba
or eax, 0x5581
jmp 0x403d06
add eax, 0xa76b
pop eax
push ecx
and ecx, 0xe6b5
add ecx, 0xcf21
pop ecx
mov dword [ebp - 0x2dc], 1
push esi
push ebx
add esp, 4
and esi, 0x9ea9
pop esi
push ecx
or ecx, 0x1543a
pop ecx
push edi
push eax
add esp, 4
and edi, 0x2379
add edi, 0x10177
or edi, 0x7cb
xor edi, 0x1c80
pop edi
imul eax, dword [ebp - 0x2dc], 0x138
add eax, 0x55f3663b
imul ecx, dword [ebp - 0x2dc], 0x138
sub eax, ecx
xor eax, 2
imul eax, dword [ebp - 0x2dc]
imul edx, dword [ebp - 0x2dc], 0x138
sub eax, edx
mov dword [ebp - 0x2e0], eax
push ecx
sub ecx, 0x3d2c
jmp 0x403d9d
call 0x403dad
add byte [eax + 0x48], cl
dec ebx
cmp ecx, dword [eax + 0x46]
inc ebx
inc eax
dec ebx
add esp, 4
call 0x403dbc
add byte [eax], bh
xor al, 0x4a
dec ebx
xor al, byte [ebx - 0x74a6fb3c]
test dword [eax - 0xa], eax
invalid
Function at 0x40593d
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ecx
push esi
and esi, 0x1d57
pop esi
mov ecx, dword [ebp - 0x50c]
mov dword [ebp - 0x754], ecx
jmp 0x4059bf
Function at 0x4798a0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5947cb
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x2124
call fcn.0053f9b8
mov eax, dword [0x6340c4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi

Function at 0x4798c8
Capabilities:
Set registry value

Disassembly:
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x211c], ecx
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x2134], eax
lea eax, [ebp - 0x2014]
push eax
mov dword [ebp - 0x212c], ecx
mov dword [ebp - 0x2124], edi
invalid
popfd

Function at 0x479988
Capabilities:
Set registry value

Disassembly:
pushfd
mov al, byte [edi]
add byte [ebx - 0x211b73], cl
dec dword [ebp - 0x20137b]
call dword [eax - 0x18]
in al, dx
mov al, byte [edi]
add byte [ebp + 0x6b880fc0], al
add eax, dword [eax]
add byte [ebx - 0x78f0ec02], al
cmc
add dword [eax], eax
add byte [edi], cl
test byte [esi - 0x7cffffff], ah
dec byte [eax]
je 0x479b29
cmp esi, 0x11
jne 0x479cf0
lea eax, [ebp - 0x2014]
push eax
call 0x54d136
mov ebx, eax
add esp, 4
mov dword [ebp - 0x2128], ebx
test bl, 1
jne 0x479a6c
cdq
sub eax, edx
mov dword [ebp - 0x2118], 0xff
mov ecx, eax
sar ecx, 1
mov dword [ebp - 0x2130], ecx
mov dword [ebp - 4], 3
mov byte [ebp - 4], 4
cmp ecx, 0x100
jbe 0x479a51
push ecx
lea ecx, [ebp - 0x2118]
call fcn.00481bd0
mov eax, dword [ebp - 0x2118]
mov ecx, dword [ebp - 0x2130]
jmp 0x479a5d
lea eax, [ebp - 0x2114]
mov dword [ebp - 0x2118], eax
test eax, eax
jne 0x479a76
lea ecx, [ebp - 0x2118]
call fcn.00481b10
mov eax, 0x80004005
jmp 0x479d11
push ecx
push 0
push eax
call fcn.0054056b
add esp, 0xc
xor esi, esi
test ebx, ebx
jle 0x479ae1
mov edi, dword [ebp - 0x2128]
nop
movzx ebx, word [ebp + esi*2 - 0x2014]
lea eax, [ebx - 0x30]
cmp eax, 0x36
ja case.0x479aa7.58
movzx eax, byte [eax + 0x479d4c]
jmp dword [eax*4 + 0x479d3c]
sub bl, 0x30
jmp 0x479abf
sub bl, 0x37
jmp 0x479abf
sub bl, 0x57
jmp 0x479abf
xor bl, bl
mov eax, esi
mov edx, esi
and eax, 1
shr edx, 1
add edx, dword [ebp - 0x2118]
mov ecx, 4
shl eax, 2
inc esi
sub ecx, eax
shl bl, cl
or byte [edx], bl
cmp esi, edi
jl 0x479a90
push dword [ebp - 0x2130]
mov eax, dword [ebp - 0x2124]
push dword [ebp - 0x2118]
push 3
push 0
push dword [ebp - 0x2120]
push dword [eax]
call dword [0x5c3054]
mov edi, eax
lea eax, [ebp - 0x2114]
cmp dword [ebp - 0x2118], eax
je 0x479ce3
lea ecx, [ebp - 0x2118]
call fcn.00481b10
jmp 0x479ce3
lea eax, [ebp - 0x2014]
push eax
call fcn.0054d298
add esp, 4
lea eax, [eax*2 + 2]
push eax
lea eax, [ebp - 0x2014]
push eax
push 1
push 0
push ebx
push dword [edi]
call dword [0x5c3054]
mov edi, eax
jmp 0x479ce3
test edi, edi
je 0x479cf0
mov ecx, edi
call fcn.004f1b8a
jmp 0x479d11
push dword [ebp - 0x2134]
mov ecx, dword [ebp - 0x211c]
call fcn.004f27ed
xor ecx, ecx
test eax, eax
cmovs ecx, eax
mov eax, ecx
jmp 0x479d11
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0053eaea
mov esp, ebp
pop ebp
ret 0xc