joyce8/EMBER2024-capa huggingface dataset:
Function at 0x584090
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x7f7460]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x584233
sub esp, 0x34
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov eax, dword [esp + 0x38]
mov dword [esp], eax
lea eax, [esp + 0x28]
mov dword [esp + 4], eax
mov byte [esp + 8], 2
call fcn.00584b80
movzx eax, byte [esp + 0xc]
test al, al
je 0x58411f
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x58411f
mov edx, dword [esp + 0x28]
cmp eax, 1
je 0x584112
movzx ebx, byte [edx]
test bl, bl
jne 0x584104
movzx ebp, byte [edx + 1]
xchg ebp, eax
test al, 0x80
xchg ebp, eax
je 0x58411f
cmp bl, 0xff
jne 0x584112
movzx ebx, byte [edx + 1]
test bl, 0x80
jne 0x58411f
cmp eax, 8
jg 0x584128
mov ebx, dword [esp + 0x3c]
xor ecx, ecx
jmp 0x584153
mov byte [esp + 0x40], 0
add esp, 0x34
ret
jg 0x58411f
mov byte [esp + 0x40], 1
add esp, 0x34
ret
mov ebp, dword [ebx]
mov esi, dword [ebx + 4]
mov edi, ebp
shl ebp, 8
mov dword [ebx], ebp
shl esi, 8
shr edi, 0x18
or edi, esi
mov dword [ebx + 4], edi
movzx esi, byte [edx + ecx]
or esi, ebp
mov dword [ebx], esi
inc ecx
cmp ecx, eax
jl 0x584133
mov dword [esp + 0x14], eax
mov edx, dword [ebx]
mov dword [esp + 0x24], edx
mov ebp, dword [ebx + 4]
shl eax, 3
lea ecx, [eax - 0x20]
mov byte [esp + 0x13], cl
mov edi, edx
shr edx, cl
mov dword [esp + 0x20], edx
add eax, 0xffffffc0
neg eax
mov byte [esp + 0x12], al
mov ecx, eax
shl ebp, cl
shl edi, cl
movzx esi, byte [esp + 0x13]
xchg esi, ebx
neg ebx
xchg esi, ebx
mov ecx, esi
mov edx, dword [esp + 0x24]
shl edx, cl
mov dword [esp + 0x24], edx
shr al, 5
movzx eax, al
mov dword [esp + 0x1c], eax
movzx eax, byte [esp + 0x12]
cmp al, 0x20
sbb edx, edx
sbb ecx, ecx
and edi, edx
mov dword [ebx], edi
and ebp, edx
not ecx
or ecx, eax
mov byte [esp + 0x12], cl
mov ecx, eax
shr edi, cl
and edi, edx
mov dword [esp + 0x18], edi
xchg esi, eax
cmp al, 0x20
xchg esi, eax
sbb eax, eax
sbb ecx, ecx
mov edx, dword [esp + 0x24]
and edx, eax
not ecx
or ecx, esi
mov eax, dword [esp + 0x1c]
cmp eax, 1
sbb eax, eax
xor eax, 0xffffffff
movzx esi, byte [esp + 0x13]
xchg esi, eax
cmp al, 0x20
xchg esi, eax
sbb edi, edi
mov esi, dword [esp + 0x20]
and esi, edi
or esi, ebp
or esi, edx
mov dword [ebx + 4], esi
mov edx, esi
sar esi, cl
and eax, esi
movzx ecx, byte [esp + 0x13]
mov ebp, edx
shl edx, cl
and edx, edi
mov esi, dword [esp + 0x18]
or esi, edx
or eax, esi
mov dword [ebx], eax
movzx ecx, byte [esp + 0x12]
sar ebp, cl
mov dword [ebx + 4], ebp
mov eax, dword [esp + 0x14]
cmp eax, 8
jmp 0x584128
call fcn.00465ea0
jmp fcn.00584090
Function at 0x591310
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x7f7460]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5914ab
sub esp, 0x30
lea eax, [0x5eb3c0]
mov dword [esp], eax
call fcn.0040c490
mov eax, dword [esp + 4]
mov dword [esp + 0x2c], eax
xor ecx, ecx
xor edx, edx
xor ebx, ebx
jmp 0x59134f
mov ecx, ebp
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x28]
mov ebp, dword [esp + 0x38]
cmp ebp, ecx
jle 0x59147d
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x40]
mov ecx, dword [eax + 0x20]
mov edx, dword [esp + 0x44]
mov dword [esp], edx
mov ebx, dword [esp + 0x48]
mov dword [esp + 4], ebx
mov ebp, dword [esp + 0x4c]
mov dword [esp + 8], ebp
mov esi, dword [esp + 0x50]
mov dword [esp + 0xc], esi
call ecx
mov eax, dword [esp + 0x40]
mov ecx, dword [eax + 0x20]
mov edx, dword [esp + 0x44]
mov dword [esp], edx
mov ebx, dword [esp + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp + 8], 4
mov dword [esp + 0xc], 4
call ecx
mov eax, dword [esp + 0x40]
mov ecx, dword [eax + 0x1c]
mov edx, dword [esp + 0x44]
mov dword [esp], edx
mov ebx, dword [esp + 0x28]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0
mov ebx, dword [esp + 0x24]
mov dword [esp + 0xc], ebx
call ecx
mov eax, dword [esp + 0x40]
mov ecx, dword [eax + 0x14]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x28], edx
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x20], ebx
mov ebp, dword [esp + 0x18]
mov dword [esp + 0x24], ebp
mov esi, dword [esp + 0x44]
mov dword [esp], esi
call ecx
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x28]
mov ebx, dword [esp + 0x38]
mov ebp, dword [esp + 0x1c]
xor esi, esi
jmp 0x591497
mov eax, dword [esp + 0x2c]
movzx esi, byte [eax + 3]
lea edi, [esi + 1]
xchg edi, ebx
mov byte [eax + 3], bl
xchg edi, ebx
xchg esi, eax
cmp al, 0xff
xchg esi, eax
jne 0x591345
movzx esi, byte [eax + 2]
lea edi, [esi + 1]
xchg edi, ebx
mov byte [eax + 2], bl
xchg edi, ebx
xchg esi, eax
cmp al, 0xff
xchg esi, eax
jne 0x591345
movzx esi, byte [eax + 1]
lea edi, [esi + 1]
xchg edi, ebx
mov byte [eax + 1], bl
xchg edi, ebx
xchg esi, eax
cmp al, 0xff
xchg esi, eax
jne 0x591345
movzx esi, byte [eax]
inc esi
xchg esi, ebx
mov byte [eax], bl
xchg esi, ebx
jmp 0x591345
add esp, 0x30
ret
movzx edi, byte [ebp + ecx]
movzx edx, byte [edx + esi]
xor edi, edx
xchg edi, eax
mov byte [ecx + ebp], al
xchg edi, eax
inc esi
inc ebp
mov edx, dword [esp + 0x28]
cmp esi, eax
jge 0x59141f
cmp ebx, ebp
jle 0x59141f
ja 0x591481
mov eax, ebp
mov ecx, ebx
call fcn.00467310
nop
call fcn.00465ea0
jmp fcn.00591310
Function at 0x596860
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x7f7460]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5969b0
sub esp, 0x28
lea eax, [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], eax
mov byte [esp + 8], 0x30
call fcn.00584b80
movzx eax, byte [esp + 0xc]
test al, al
jne 0x5968c8
lea eax, [0x5f7ae0]
mov dword [esp], eax
call fcn.0040c490
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x27
lea ecx, [0x629ce4]
mov dword [eax], ecx
lea ecx, [0x669cac]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], eax
add esp, 0x28
ret
mov eax, dword [esp + 0x30]
test eax, eax
je 0x59699c
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov byte [esp + 0x1b], 0
lea eax, [esp + 0x2c]
mov dword [esp], eax
lea ecx, [esp + 0x1c]
mov dword [esp + 4], ecx
lea ecx, [esp + 0x1b]
mov dword [esp + 8], ecx
mov byte [esp + 0xc], 1
call fcn.005851d0
movzx eax, byte [esp + 0x10]
test al, al
je 0x596969
mov edx, dword [esp + 0x38]
mov eax, dword [edx]
movzx ecx, byte [esp + 0x1b]
xor ecx, 0xffffff80
movzx ecx, cl
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], esi
call eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x5968c8
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ecx
add esp, 0x28
ret
lea eax, [0x5f7ae0]
mov dword [esp], eax
call fcn.0040c490
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x26
lea ecx, [0x62980f]
mov dword [eax], ecx
lea ecx, [0x669cac]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], eax
add esp, 0x28
ret
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
add esp, 0x28
ret
call fcn.00465ea0
jmp fcn.00596860
Function at 0x5a1830
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x7f7460]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5a1a5d
sub esp, 0x6c
mov dword [esp + 0x88], 0
mov dword [esp + 0x8c], 0
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 0
mov dword [esp + 0x98], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x1c], 0
lea edi, [esp + 0x40]
xor eax, eax
call fcn.00467545
lea ecx, [0x5a1a70]
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x4c], ecx
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x44], ecx
lea ecx, [esp + 0x80]
mov dword [esp + 0x50], ecx
lea ecx, [esp + 0x94]
mov dword [esp + 0x54], ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x58], ecx
lea edx, [esp + 0x28]
mov dword [esp + 0x5c], edx
lea edx, [esp + 0x1c]
mov dword [esp + 0x60], edx
mov edx, dword [esp + 0x84]
mov dword [esp + 0x64], edx
lea ebx, [esp + 0x88]
mov dword [esp + 0x68], ebx
mov ebx, dword [edx + 0xc]
mov dword [esp], ebx
mov dword [esp + 4], ecx
call fcn.00593d00
mov ecx, dword [esp + 8]
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0xc]
mov dword [esp + 0x18], edx
xor eax, eax
jmp 0x5a1953
mov dword [esp + 0x14], eax
mov ebx, dword [ecx + eax*4]
mov ebp, dword [esp + 0x40]
mov dword [esp], 2
mov dword [esp + 4], ebx
lea edx, [esp + 0x40]
call ebp
mov eax, dword [esp + 0x14]
inc eax
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x18]
cmp eax, edx
jl 0x5a192a
mov eax, dword [esp + 0x84]
mov eax, dword [eax + 8]
mov dword [esp], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 4], eax
call fcn.00593d00
mov eax, dword [esp + 8]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x18], ecx
xor edx, edx
jmp 0x5a19b0
mov dword [esp + 0x14], edx
mov ecx, dword [eax + edx*4]
mov ebx, dword [esp + 0x40]
mov dword [esp], 1
mov dword [esp + 4], ecx
lea edx, [esp + 0x40]
call ebx
mov eax, dword [esp + 0x14]
lea edx, [eax + 1]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
cmp edx, ecx
jl 0x5a1985
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x5a19d5
mov dword [esp + 0x94], 0
mov dword [esp + 0x98], 0
mov eax, dword [esp + 0x8c]
test eax, eax
jne 0x5a1a59
mov eax, dword [esp + 0x94]
test eax, eax
jne 0x5a1a59
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov eax, dword [esp + 0x70]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x3c], eax
lea eax, [0x6073c0]
mov dword [esp], eax
lea eax, [esp + 0x30]
mov dword [esp + 4], eax
call fcn.00409a90
mov eax, dword [esp + 8]
lea ecx, [0x66a084]
mov dword [esp + 0x94], ecx
mov dword [esp + 0x98], eax
add esp, 0x6c
ret
call fcn.00465ea0
jmp fcn.005a1830
Function at 0x4090ba
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x416d30]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.004078a4
mov dword [ebp - 0x14], eax
cmp dword [0x417d0c], edi
jne 0x4091ab
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x409138
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40928b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x40928b
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40928b
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x417d0c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x417d10], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x417d14], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x417d1c], eax
test eax, eax
je 0x4091a8
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x417d18], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4091d0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4091c3
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x4091e5
push 4
pop eax
jmp 0x40928d
cmp dword [ebp - 0x14], edi
je 0x4091e5
push dword [0x417d0c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4091ca
mov eax, dword [0x417d18]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x409243
cmp dword [0x417d1c], esi
je 0x409243
push eax
call ebx
push dword [0x417d1c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x409243
test eax, eax
je 0x409243
call ecx
test eax, eax
je 0x409238
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x409238
test byte [ebp - 8], 1
jne 0x409243
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x409273
mov eax, dword [0x417d10]
cmp eax, esi
je 0x409270
push eax
call ebx
test eax, eax
je 0x409270
call eax
mov edi, eax
test edi, edi
je 0x409270
mov eax, dword [0x417d14]
cmp eax, esi
je 0x409270
push eax
call ebx
test eax, eax
je 0x409270
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x417d0c]
call ebx
test eax, eax
je 0x40928b
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x40928d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040929c
leave
ret
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x41d44a
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x41d384
add byte [ebx], bh
dec esi
dec edi
push eax
add esp, 4
add eax, 0xadee
pop eax
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xb80]
mov dword [ebp - 0x14c8], eax
push eax
and eax, 0xb4c9
call 0x41d3b7
add byte [eax], bh
inc edx
dec edx
dec eax
push eax
aaa
dec ebp
add esp, 4
pop eax
push edx
push esi
add esp, 4
or edx, 0x10f73
add edx, 0x2197
jmp 0x41d3d4
pop edx
mov dword [ebp - 0x1fac], 0xffffffff
push edi
jmp 0x41d3e8
add edi, 0x106fc
sub edi, 0x7298
pop edi
push edi
jmp 0x41d3fd
pop edi
push ecx
push ebx
add esp, 4
xor ecx, 0x7af4
jmp 0x41d410
pop ecx
mov ecx, dword [ebp - 0x3c0]
mov dword [ebp - 0x4d0], ecx
jmp 0x41d42e
push esi
push ecx
add esp, 4
or esi, 0x3bf0
pop esi
push edx
call 0x41d44a
add byte [0x453a3437], bh
dec ecx
xor eax, 0xc4833744
add al, 0x81
retf 0xbd6d

Function at 0x41d49f
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
sub ebx, 0x5da6
and ebx, 0x142b9
call 0x41d49f
add byte [esi + esi + 0x35], cl
dec ebx
cmp eax, 0xc483424d
add al, 0x5b
jmp 0x41d6d6
push eax
xor eax, 0x32c8
call 0x41d6ec
add byte [esi + 0x43], cl
dec eax
aaa
xor al, 0x44
inc ecx
cmp eax, dword [ebx - 0xf7efb3c]
iretd
Function at 0x41d63a
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
and edx, 0xb9e9
and edx, 0x137b7
pop edx
mov edx, dword [ebp - 0xc10]
sub edx, 1
mov dword [ebp - 0xc10], edx
mov eax, dword [ebp - 0xa60]
add eax, 1
mov dword [ebp - 0xa60], eax
mov ecx, dword [ebp - 0x9f0]
add ecx, 1
mov dword [ebp - 0x9f0], ecx
jmp 0x41d557

Function at 0x41d6ec
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
sub ebx, 0x5da6
and ebx, 0x142b9
call 0x41d49f
add byte [esi + esi + 0x35], cl
dec ebx
cmp eax, 0xc483424d
add al, 0x5b
jmp 0x41d6d6
push eax
xor eax, 0x32c8
call 0x41d6ec
add byte [esi + 0x43], cl
dec eax
aaa
xor al, 0x44
inc ecx
cmp eax, dword [ebx - 0xf7efb3c]
iretd
Function at 0x41f03c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
dec dword [edi]
mov bh, 0x4d
enter 0xffffffffffffc13b, 0xf
test byte [0xfffffff], dl
mov bh, 0x95

Function at 0x41f0f0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x41f101
add byte [edx + 0x46], cl
cmp byte [ebx + esi + 0x3b], al
inc ebp
aaa
add esp, 4
xor ebx, 0xd9f9
pop ebx
mov edx, dword [ebp - 0x4e4]
mov eax, dword [edx]
mov dword [ebp - 0x4e4], eax
mov ecx, dword [ebp - 0x4e4]
cmp ecx, dword [ebp - 0xc4c]
je 0x41f137
mov edx, dword [ebp - 0x4e4]
cmp dword [edx + 0x30], 0
jne 0x41ef02
mov dword [ebp - 0x2a8], 0

Function at 0x41f101
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x41f101
add byte [edx + 0x46], cl
cmp byte [ebx + esi + 0x3b], al
inc ebp
aaa
add esp, 4
xor ebx, 0xd9f9
pop ebx
mov edx, dword [ebp - 0x4e4]
mov eax, dword [edx]
mov dword [ebp - 0x4e4], eax
mov ecx, dword [ebp - 0x4e4]
cmp ecx, dword [ebp - 0xc4c]
je 0x41f137
mov edx, dword [ebp - 0x4e4]
cmp dword [edx + 0x30], 0
jne 0x41ef02
mov dword [ebp - 0x2a8], 0
Function at 0x41f475
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
jmp 0x41f387
or eax, 0x8536
xor eax, 0x181d4
pop eax
push esi
add esi, 0x8411
pop esi
push edi
add edi, 0x1858c
pop edi
push esi
xor esi, 0x142c7
xor esi, 0x15b8a
pop esi
lea eax, [ebp - 0x16e8]
mov dword [ebp - 0xc54], eax
mov ecx, dword [ebp - 0x4e8]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc50], edx
xor eax, eax
mov word [ebp - 0x208], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
push ebx
push edx
add esp, 4
jmp 0x41f3e9
jmp 0x41f3ee
pop ebx
push esi
push edx
add esp, 4
add esi, 0x44ef
jmp 0x41f3ff
or esi, 0xcf52
jmp 0x41f40d
pop esi
mov edx, dword [ebp - 0xc50]
mov ax, word [edx]
mov word [ebp - 0xf8e], ax
mov ecx, dword [ebp - 0xc50]
add ecx, 2
mov dword [ebp - 0xc50], ecx
mov dx, word [ebp - 0xf8e]
mov word [ebp - 0x208], dx
mov eax, dword [ebp - 0xc54]
mov cx, word [eax]
mov word [ebp - 0xf90], cx
mov edx, dword [ebp - 0xc54]
add edx, 2
mov dword [ebp - 0xc54], edx
mov ax, word [ebp - 0xf90]
mov word [ebp - 0x3c], ax
push edi
call 0x41f475
add byte [0x4c47324f], dh
inc edx
inc ebx
xor al, 0x37
add esp, 4
call fcn.0041f484
add byte [ecx + eax*2 + 0x4b], cl
inc edx
dec edi
add esp, 4
call 0x41f493
add byte [esi + eax*2], bh
cmp eax, dword [ebx + 0x50]
add esp, 4
pop edi
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x41f4b4
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x1560], edx
jmp 0x41f50e
movzx ecx, word [ebp - 0x208]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x41f3dc
movzx eax, word [ebp - 0x208]
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x41f3dc
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x41f4f8
mov dword [ebp - 0x151c], 0xffffffff
jmp 0x41f502
mov dword [ebp - 0x151c], 1
mov ecx, dword [ebp - 0x151c]
mov dword [ebp - 0x1560], ecx
cmp dword [ebp - 0x1560], 0
jne 0x41f557
push eax
add eax, 0x9481
sub eax, 0x12337
pop eax
push ecx
push edx
add esp, 4
sub ecx, 0x15da8
pop ecx
push edi
push edi
add esp, 4
jmp 0x41f53c
and edi, 0x2c7
and edi, 0x3598
pop edi
mov edx, dword [ebp - 0x4e8]
mov dword [ebp - 0x710], edx
jmp 0x41f5bf
push ebx
push edi
add esp, 4
or ebx, 0x1728e
add ebx, 0xbcde
pop ebx
push edi
push edi
add esp, 4
jmp 0x41f577
pop edi
push ecx
and ecx, 0x8e18
jmp 0x41f588
pop ecx
mov eax, dword [ebp - 0x4e8]
mov ecx, dword [eax]
mov dword [ebp - 0x4e8], ecx
mov edx, dword [ebp - 0x4e8]
cmp edx, dword [ebp - 0xc58]
je 0x41f5b5
mov eax, dword [ebp - 0x4e8]
cmp dword [eax + 0x30], 0
jne 0x41f380
mov dword [ebp - 0x710], 0
Function at 0x41f484
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
jmp 0x41f387
or eax, 0x8536
xor eax, 0x181d4
pop eax
push esi
add esi, 0x8411
pop esi
push edi
add edi, 0x1858c
pop edi
push esi
xor esi, 0x142c7
xor esi, 0x15b8a
pop esi
lea eax, [ebp - 0x16e8]
mov dword [ebp - 0xc54], eax
mov ecx, dword [ebp - 0x4e8]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc50], edx
xor eax, eax
mov word [ebp - 0x208], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
push ebx
push edx
add esp, 4
jmp 0x41f3e9
jmp 0x41f3ee
pop ebx
push esi
push edx
add esp, 4
add esi, 0x44ef
jmp 0x41f3ff
or esi, 0xcf52
jmp 0x41f40d
pop esi
mov edx, dword [ebp - 0xc50]
mov ax, word [edx]
mov word [ebp - 0xf8e], ax
mov ecx, dword [ebp - 0xc50]
add ecx, 2
mov dword [ebp - 0xc50], ecx
mov dx, word [ebp - 0xf8e]
mov word [ebp - 0x208], dx
mov eax, dword [ebp - 0xc54]
mov cx, word [eax]
mov word [ebp - 0xf90], cx
mov edx, dword [ebp - 0xc54]
add edx, 2
mov dword [ebp - 0xc54], edx
mov ax, word [ebp - 0xf90]
mov word [ebp - 0x3c], ax
push edi
call 0x41f475
add byte [0x4c47324f], dh
inc edx
inc ebx
xor al, 0x37
add esp, 4
call fcn.0041f484
add byte [ecx + eax*2 + 0x4b], cl
inc edx
dec edi
add esp, 4
call 0x41f493
add byte [esi + eax*2], bh
cmp eax, dword [ebx + 0x50]
add esp, 4
pop edi
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x41f4b4
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x1560], edx
jmp 0x41f50e
movzx ecx, word [ebp - 0x208]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x41f3dc
movzx eax, word [ebp - 0x208]
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x41f3dc
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x41f4f8
mov dword [ebp - 0x151c], 0xffffffff
jmp 0x41f502
mov dword [ebp - 0x151c], 1
mov ecx, dword [ebp - 0x151c]
mov dword [ebp - 0x1560], ecx
cmp dword [ebp - 0x1560], 0
jne 0x41f557
push eax
add eax, 0x9481
sub eax, 0x12337
pop eax
push ecx
push edx
add esp, 4
sub ecx, 0x15da8
pop ecx
push edi
push edi
add esp, 4
jmp 0x41f53c
and edi, 0x2c7
and edi, 0x3598
pop edi
mov edx, dword [ebp - 0x4e8]
mov dword [ebp - 0x710], edx
jmp 0x41f5bf
push ebx
push edi
add esp, 4
or ebx, 0x1728e
add ebx, 0xbcde
pop ebx
push edi
push edi
add esp, 4
jmp 0x41f577
pop edi
push ecx
and ecx, 0x8e18
jmp 0x41f588
pop ecx
mov eax, dword [ebp - 0x4e8]
mov ecx, dword [eax]
mov dword [ebp - 0x4e8], ecx
mov edx, dword [ebp - 0x4e8]
cmp edx, dword [ebp - 0xc58]
je 0x41f5b5
mov eax, dword [ebp - 0x4e8]
cmp dword [eax + 0x30], 0
jne 0x41f380
mov dword [ebp - 0x710], 0