joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b800
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x40b8af
mov eax, dword [esi + 0x18]
push edi
mov edi, ecx
test eax, eax
je 0x40b81d
push eax
call fcn.0040b800
mov eax, dword [esi + 0x1c]
test eax, eax
jne 0x40b8d5
cmp byte [esi + 0x10], 0
jne 0x40b884
mov edi, dword [esi + 0x14]
test edi, edi
je 0x40b884
push ebx
mov ebx, dword [edi + 0xc]
test ebx, ebx
jne 0x40b8b3
mov eax, dword [edi + 8]
pop ebx
cmp eax, 8
je 0x42ba02
cmp eax, 0xa
je 0x42ba23
cmp eax, 5
je 0x40b8f8
cmp eax, 0xb
je 0x42ba38
cmp eax, 0xc
je 0x42ba53
push edi
mov dword [edi + 8], 1
mov dword [edi], 0
call fcn.004112ef
add esp, 4
mov eax, dword [esi + 0xc]
dec dword [eax]
mov ecx, dword [esi + 0xc]
cmp dword [ecx], 0
pop edi
jne 0x40b8a6
mov edx, dword [esi]
push edx
call fcn.004112ef
mov eax, dword [esi + 0xc]
push eax
call fcn.004112ef
add esp, 8
push esi
call fcn.004112ef
add esp, 4
pop esi
ret 4
mov eax, dword [ebx + 0xc]
dec dword [eax]
mov eax, dword [ebx + 0xc]
cmp dword [eax], 0
je 0x40b8e2
push ebx
call fcn.004112ef
add esp, 4
mov dword [edi + 0xc], 0
jmp 0x40b83d
push eax
mov ecx, edi
call fcn.0040b800
jmp 0x40b828
mov ecx, dword [ebx]
push ecx
call fcn.004112ef
mov edx, dword [ebx + 0xc]
push edx
call fcn.004112ef
add esp, 8
jmp 0x40b8c0
mov eax, edi
call fcn.0040e380
jmp 0x40b86e
invalid
or al, bh
test dword [eax], esp
jmp 0x42ba28
invalid
invalid
add byte [edx + esi + 0x32], cl
xor edi, dword [ebx]
push eax
xor eax, 0x4c4833f
add esp, 4
call 0x42ba6b
add byte [esi + 0x32], al
inc esi
inc edi
push eax
add esp, 4
and edi, 0x161b
pop edi
mov ecx, dword [ebp - 0x4d8]
mov dword [ebp - 0x6ec], ecx
jmp 0x42baeb

Function at 0x40b910
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov edi, eax
mov eax, dword [esi + 8]
cmp eax, 1
jne 0x40b99f
mov ecx, dword [edi + 8]
cmp ecx, eax
jne 0x40b967
mov eax, dword [edi]
mov ebx, dword [esi]
lea ebp, [eax + ebx]
cdq
mov ecx, eax
mov edi, edx
mov eax, ebx
cdq
add ecx, eax
adc edi, edx
mov eax, ebp
cdq
cmp eax, ecx
jne 0x42b7cf
cmp edx, edi
jne 0x42b7cf
mov dword [esi], ebp
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x42b7f9
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
cmp ecx, 2
je 0x42b7e0
cmp eax, 3
je case.0x40b9a7.3
mov ecx, esi
call fcn.0040be90
fstp qword [esp + 0x10]
call fcn.004092c0
fld qword [esp + 0x10]
fstp qword [esi]
mov dword [esi + 8], 3
mov ecx, edi
call fcn.0040be90
fadd qword [esi]
fstp qword [esi]
jmp case.0x40b9a7.5
sub eax, 2
cmp eax, 9
ja case.0x40b9a7.5
jmp dword [eax*4 + 0x40b9b0]
mov dword [ebp - 0x16b8], eax
outsd dx, dword [esi]
jb 0x42b770
test edx, ebp
idiv edi
invalid
dec dword [ebx - 0x6a76cfaf]
out 0xff, eax
dec dword [ebx - 0x189b7b]
dec dword [ecx - 0x14db7b]
call dword [edx + 0x52]
test dword [ebx + ebp*8], esp
invalid
Function at 0x40be00
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esi + 0xc]
cmp dword [esi + 8], eax
je 0x40be36
push 0x10
call fcn.0041171a
add esp, 4
test eax, eax
je 0x42c015
push ebx
mov ebx, eax
mov eax, dword [esp + 8]
call fcn.0040bd50
pop ebx
mov ecx, dword [esi + 8]
mov edx, dword [esi + 4]
mov dword [edx + ecx*4], eax
inc dword [esi + 8]
ret 4
add eax, eax
mov dword [esi + 0xc], eax
cmp eax, 4
jae 0x40be45
mov eax, 4
xor ecx, ecx
mov dword [esi + 0xc], eax
mov edx, 4
mul edx
seto cl
push edi
neg ecx
or ecx, eax
push ecx
call fcn.0041171a
mov ecx, dword [esi + 4]
mov edi, eax
mov eax, dword [esi + 8]
add eax, eax
add eax, eax
push eax
push ecx
push edi
call fcn.00410f70
mov edx, dword [esi + 4]
push edx
call fcn.004112ef
add esp, 0x14
mov dword [esi + 4], edi
pop edi
jmp 0x40be08

Function at 0x40c2a0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
inc dword [eax]
mov ecx, dword [eax]
push edi
xor edi, edi
mov dword [edx], ecx
lea esp, [esp]
mov ecx, dword [eax]
mov edx, dword [esi + 4]
mov edx, dword [edx + ecx*4]
movsx edx, word [edx + 8]
cmp edx, 0x47
jge 0x40c2c6
inc ecx
mov dword [eax], ecx
jmp 0x40c2b0
sub edx, 0x47
je 0x40c2f3
sub edx, 1
jne 0x40c2e3
test edi, edi
jne 0x40c2ed
mov edx, dword [esp + 0xc]
mov dword [edx], ecx
inc ecx
mov dword [eax], ecx
xor eax, eax
pop edi
ret 8
sub edx, 0x37
jne 0x40c2c1
jmp 0x42b171
dec edi
inc ecx
mov dword [eax], ecx
jmp 0x40c2b0
inc edi
inc ecx
mov dword [eax], ecx
jmp 0x40c2b0
inc dword [eax]
add byte [eax], al
add byte [ecx + 0x51], dl

Function at 0x40c300
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x18
push ebx
push ebp
mov ebp, dword [esp + 0x28]
push esi
push edi
mov edi, eax
mov edx, dword [edi]
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebp + 4]
mov edx, dword [eax + edx*4]
mov esi, dword [edx]
lea ecx, [esp + 0x34]
xor ebx, ebx
push ecx
xor ecx, ecx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x1c], ebx
call fcn.0040c3e0
mov esi, dword [esp + 0x30]
cmp esi, ebx
je 0x42cd91
inc dword [edi]
cmp dword [esi + 8], 5
mov ebx, 0x4e
je 0x40c3a4
mov eax, dword [esi + 8]
cmp eax, 8
je 0x42cdb4
cmp eax, 5
je 0x40c36e
mov edx, dword [edi]
mov eax, dword [ebp + 4]
mov eax, dword [eax + edx*4]
cmp word [eax + 8], bx
je 0x42cdfe
mov ebp, dword [esp + 0x34]
push esi
mov ebx, ebp
call fcn.00409210
mov edi, dword [esp + 0x2c]
cmp byte [edi + 0xfd], 0
jne 0x42ce19
cmp byte [edi + 0xfe], 0
jne 0x42ce19
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0xc
mov eax, dword [edi]
mov edx, dword [ebp + 4]
mov eax, dword [edx + eax*4]
cmp word [eax + 8], bx
jne 0x40c34b
mov edx, dword [esp + 0x2c]
push 1
lea ecx, [esp + 0x34]
push ecx
push edx
mov eax, edi
mov ecx, ebp
call fcn.0040c620
test eax, eax
jne 0x42cdaa
mov esi, dword [esp + 0x30]
jmp 0x40c34b
add byte [eax], al
add byte [eax], al
inc esi
cmp al, 0x3e
dec ecx
les eax, [ebx + ebp*8]
pop es
cmp al, 0x42
cmp al, 0x4a
xor eax, dword [esi + 0x47]
iretd
jmp 0x85ccce1d
Function at 0x40c620
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x118
push ebx
push ebp
mov ebp, dword [esp + 0x128]
push esi
push edi
mov esi, eax
mov eax, dword [esi]
mov edi, ecx
mov ecx, dword [edi + 4]
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], ebx
mov edx, dword [ecx + eax*4 - 4]
lea eax, [ecx + eax*4]
movsx ecx, word [edx + 0xa]
mov edx, dword [eax]
cmp word [edx + 8], 0x4e
mov dword [esp + 0x24], ecx
jne 0x40c6d7
inc dword [esi]
mov eax, dword [esi]
mov ecx, dword [edi + 4]
mov edx, dword [ecx + eax*4]
movsx eax, word [edx + 0xa]
push 0xffffffffffffffff
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x134]
push esi
push edi
mov dword [esp + 0x30], eax
call fcn.0040ab50
test eax, eax
jne 0x42c290
lea ecx, [esp + 0x10]
call fcn.0040c760
test eax, eax
jl 0x42c267
mov eax, dword [esi]
mov edx, dword [edi + 4]
mov ecx, dword [edx + eax*4]
cmp word [ecx + 8], 0x4f
jne 0x42c278
inc eax
lea ecx, [esp + 0x10]
mov dword [esi], eax
call fcn.0040c760
mov edx, dword [esi]
mov dword [esp + ebx*4 + 0x28], eax
mov eax, dword [edi + 4]
mov ecx, dword [eax + edx*4]
inc ebx
cmp word [ecx + 8], 0x4e
je 0x40c664
mov esi, dword [ebp]
cmp dword [esi + 8], 5
jne 0x42c24a
mov eax, dword [esi]
xor edi, edi
cmp ebx, edi
mov dword [eax + 0x210], edi
jle 0x40c703
mov esi, dword [esp + edi*4 + 0x28]
mov edx, dword [ebp]
call fcn.0040d0f0
inc edi
cmp edi, ebx
jl 0x40c6f2
mov ecx, dword [esp + 0x134]
mov edx, dword [ebp]
push 0
push ecx
push edx
call fcn.0040d030
add esp, 0xc
mov dword [ebp], eax
test eax, eax
je 0x42c256
lea esi, [esp + 0x10]
call fcn.004092c0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x118
ret 0xc
add al, 0xeb
push es
dec edi
cmp byte [0x593e4e35], dh
dec esp

Function at 0x40c770
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [esi + 8]
sub esp, 0xc
push ebx
push edi
mov edi, eax
mov eax, dword [edi + 8]
lea eax, [eax + eax*2]
lea edx, [ecx + eax*4]
mov eax, dword [edx*4 + 0x4923c8]
cmp eax, 1
jne 0x40c7ae
mov ecx, edi
call fcn.0040c760
mov ecx, esi
mov edi, eax
call fcn.0040c760
xor ecx, ecx
cmp edi, eax
setl cl
mov al, cl
pop edi
pop ebx
add esp, 0xc
ret
cmp eax, 3
jne 0x42a889
mov ecx, edi
call fcn.0040be90
fstp qword [esp + 0xc]
mov ecx, esi
call fcn.0040be90
fcomp qword [esp + 0xc]
fnstsw ax
test ah, 0x41
je 0x42a8d8
pop edi
xor eax, eax
pop ebx
add esp, 0xc
ret
push ds
pushfd
add byte [eax], al
Function at 0x40cc14
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x28
push ebx
push esi
mov esi, ecx
push edi
mov edi, eax
mov eax, dword [esi + 8]
mov edx, dword [edi + 8]
lea ecx, [eax + eax*2]
lea ecx, [edx + ecx*4]
mov ecx, dword [ecx*4 + 0x4923c8]
dec ecx
cmp ecx, 0xa
ja case.0x40cc37.5
jmp dword [ecx*4 + 0x40cca4]
mov ecx, esi
call fcn.0040c760
mov ecx, edi
mov esi, eax
call fcn.0040c760
cmp esi, eax
jne 0x42c30c
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x28
ret
cmp edx, 4
jne 0x42c2e2
cmp dword [esi + 8], 4
mov edi, dword [edi + 0xc]
jne 0x42c2f7
mov esi, dword [esi + 0xc]
mov ecx, dword [edi + 4]
mov edi, dword [edi]
mov edx, dword [esi]
push edi
push edx
mov edx, dword [esi + 4]
xor eax, eax
call fcn.0040e740
test eax, eax
jne 0x42c30c
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x28
ret
invalid
movsb byte es:[edi], byte [esi]
or al, byte [ecx]
add byte [ecx + 0x21f5e8], al
add byte [eax + 0x52], bl
add byte [ecx + 0x15e56c2], al
add byte [ecx + 0x16eb0c2], al
add edx, 0x16eb0
or edx, 0xc5be
pop edx
invalid
test dword [eax], esp
std
invalid
add al, ch
or al, byte [eax]
add byte [eax], al
add al, 0x81
out 0x50, eax
pop edi
add dword [eax], eax
invalid

Function at 0x40cfe0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp byte [ebx + 9], 0
push edi
mov edi, eax
jne 0x42c2a3
push esi
push 0x38
call fcn.0041171a
add esp, 4
test eax, eax
je 0x40d011
mov esi, eax
call fcn.0040cd40
mov ecx, dword [ebx + 4]
mov dword [esi + 0x30], ecx
inc dword [ebx]
mov dword [ebx + 4], esi
pop esi
pop edi
ret
mov ecx, dword [ebx + 4]
xor esi, esi
mov dword [esi + 0x30], ecx
inc dword [ebx]
mov dword [ebx + 4], esi
pop esi
pop edi
ret
add byte [eax], al

Function at 0x40d030
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
mov ebx, 5
cmp dword [ebp + 8], ebx
jne 0x42c13d
cmp byte [esp + 0x10], 0
push esi
push edi
mov edi, dword [esp + 0x1c]
je 0x40d07b
test edi, edi
jne 0x40d084
mov eax, ebp
call fcn.0040d120
test eax, eax
jl 0x42c14e
mov ecx, dword [ebp]
mov edx, dword [ecx]
mov esi, eax
cmp dword [edx + esi*4], 0
je 0x40d0b6
mov ecx, dword [ecx]
mov eax, dword [ecx + esi*4]
pop edi
pop esi
pop ebp
pop ebx
ret
mov esi, ebp
call fcn.0040e7c0
jmp 0x40d051
cmp dword [ebp + 8], ebx
jne 0x42c142
mov eax, dword [ebp]
mov dword [eax + 0x210], 0
test edi, edi
jle 0x40d055
lea ebx, [esp + 0x1c]
mov esi, dword [ebx + 4]
add ebx, 4
mov edx, ebp
call fcn.0040d0f0
sub edi, 1
je 0x40d055
jmp 0x40d0a2
push 0x10
call fcn.0041171a
add esp, 4
test eax, eax
je 0x40d0e5
mov edi, 0x4848e8
mov ebx, eax
call fcn.0040d420
mov ecx, dword [ebp]
mov edx, dword [ecx]
mov dword [edx + esi*4], eax
mov eax, dword [ebp]
mov ecx, dword [eax]
mov eax, dword [ecx + esi*4]
pop edi
pop esi
pop ebp
pop ebx
ret
xor eax, eax
jmp 0x40d0d0
jmp dword [esi - 0x75]
test esp, ecx
invalid
Function at 0x40d5d0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x20
push ebx
push esi
push edi
lea ecx, [esp + 0x18]
call fcn.0040c060
mov ecx, 1
mov esi, dword [0x4a8e90]
mov edi, dword [0x4a8ec4]
cmp ecx, esi
jg 0x40d6a6
mov eax, ecx
inc ecx
test eax, eax
jle 0x40d6a6
shl eax, 4
add eax, edi
je 0x40d6a6
mov ebx, eax
lea eax, [ecx - 1]
mov dword [0x4a8014], eax
mov edx, dword [ebx + 4]
mov eax, dword [edx]
cmp word [eax + 8], 0
mov dword [esp + 0x10], ecx
jne 0x40d5f0
cmp dword [eax], 0x20
jne 0x40d5f0
mov edx, dword [edx + 4]
cmp word [edx + 8], 0x34
jne 0x42b2c4
mov ecx, dword [edx]
push ecx
lea esi, [esp + 0x1c]
call fcn.0040df50
mov edi, dword [esp + 0x18]
sub esp, 0x10
mov esi, esp
call fcn.00401b70
mov eax, 0x4a8054
call fcn.0040f1a0
test eax, eax
jne 0x42b2ca
mov edx, dword [ebx + 4]
mov eax, dword [edx + 8]
cmp word [eax + 8], 0x47
jne 0x42b2c4
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
push ebx
mov dword [esp + 0x24], 3
call fcn.0040da10
test eax, eax
jne 0x42b2db
mov ecx, dword [esp + 0x10]
jmp 0x40d5e4
mov esi, 0x4a8054
call fcn.00410470
lea ecx, [esp + 0x18]
call fcn.00402620
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x20
ret
jmp 0x5396b2c8
les eax, [ecx + eax*4]
ret
dec edx
xor eax, 0x83463d4e
les eax, [ebx + ebx*2]

Function at 0x40d6d0
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x438
push ebx
push esi
push edi
mov edi, eax
lea eax, [esp + 0x20]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push edi
call fcn.00401f80
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x431a9d
mov eax, dword [0x4a7cfc]
test eax, eax
je 0x431ab6
mov byte [esp + 0xf], 0
mov esi, 0x4a8e80
cmp eax, 1
je 0x431aca
push 0x4a7cfc
lea ecx, [esp + 0x13]
mov eax, 0x4a7d14
call fcn.0040f3b0
test al, al
je 0x431aeb
mov dl, byte [0x4a8e80]
mov bl, byte [0x4a8e81]
push 0x4a7cf8
lea eax, [esp + 0x234]
push eax
push 0x104
push 0x4a7d14
mov byte [0x4a7d00], dl
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov ecx, dword [0x4a7cfc]
push ecx
push 0x4a7d14
call fcn.00401440
test eax, eax
jne 0x431aff
cmp bl, 1
je 0x431b23
call fcn.004101f0
call fcn.004103e0
cmp byte [0x4a7d00], 0
jne 0x40d7a8
mov esi, 0x4a84b8
call fcn.0040e1e0
push 1
mov ecx, 0x4a7f20
call fcn.00409560
cmp byte [0x4a7d00], 0
jne 0x40d7c7
mov ecx, 0x4a84b8
call fcn.00401000
mov ebx, 0x4a8e80
call fcn.0040ebc0
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
pop edi
pop esi
pop ebx
add esp, 0x438
ret
lock or dword [eax + eax*2], edi
nop
inc edi
xor eax, 0xf8318a8e
add al, 4
cmp dh, cl
imul ecx, dword [esi + 0x402dd92], 4
cmp bh, dl
imul ecx, dword [esi + 0x5b5ca95a], 0xffffff88
leave
or dword [esi + 0x61900cc], eax
add eax, 0xf734d486
add eax, 0x4d0bf005
inc ecx
dec esp
inc edx
cmp eax, dword [edx - 0x7a]
cld
xchg esp, eax
add eax, 0x58566405
add eax, 0x58566405
mov cl, cl
or dword [esi + 0x5584be6], eax
add eax, 0x618f686
push es
add eax, 0x318a905e
pop esi
nop
mov dh, byte [ecx]
clc
add al, 4
imul edx, dword [eax - 0x6d7194f3], 0xffffffef
hlt
hlt
Function at 0x40da10
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x4c
push ebx
push ebp
mov ebp, dword [esp + 0x5c]
push esi
push edi
lea ecx, [esp + 0x38]
call fcn.0040c060
mov eax, dword [esp + 0x6c]
mov ebx, dword [eax]
xor edi, edi
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], 0x4848ec
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x10], 0xffffffff
dec ebx
call fcn.0040c060
mov ecx, dword [esp + 0x60]
mov esi, dword [ecx + 4]
mov edx, dword [ebp]
mov eax, dword [esi + edx*4]
cmp word [eax + 8], 0x48
je 0x40db52
mov dword [esp + 0x14], edi
mov edi, edi
mov ecx, dword [ebp]
mov edx, dword [esi + ecx*4]
cmp word [edx + 8], 0
mov byte [esp + 0x64], 0
je 0x42b1ac
mov ecx, dword [ebp]
mov esi, dword [esi + ecx*4]
cmp word [esi + 8], 0x33
jne 0x42b27f
mov eax, dword [esi]
lea edx, [esp + 0x28]
cmp edx, eax
je 0x40daa8
mov ecx, edx
call fcn.00404080
mov eax, dword [esp + 0x20]
xor edi, edi
test eax, eax
jbe 0x40dad1
mov ecx, dword [esp + 0x1c]
mov esi, dword [ecx + edi*4]
lea eax, [esp + 0x28]
call fcn.0040dd00
test al, al
jne 0x40dacd
inc edi
cmp edi, dword [esp + 0x20]
jb 0x40dab2
mov eax, dword [esp + 0x20]
cmp edi, eax
jne 0x42b266
lea edi, [esp + 0x28]
lea esi, [esp + 0x18]
call fcn.0040d970
inc dword [ebp]
mov edi, dword [esp + 0x60]
mov eax, dword [ebp]
mov esi, dword [edi + 4]
mov edx, dword [esi + eax*4]
cmp word [edx + 8], 0x41
je 0x42b1ee
cmp dword [esp + 0x10], 0xffffffff
jne 0x42b24a
mov edx, dword [esi + eax*4]
movzx ecx, word [edx + 8]
inc dword [esp + 0x14]
cmp cx, 0x40
jne 0x40dbe6
mov edx, 0x48
cmp cx, 0x40
jne 0x40db3e
mov ecx, dword [esi + eax*4 + 4]
inc eax
mov dword [ebp], eax
cmp word [ecx + 8], dx
je 0x42b25c
mov eax, dword [ebp]
mov ecx, dword [esi + eax*4]
cmp word [ecx + 8], dx
jne 0x40da70
mov edi, dword [esp + 0x14]
inc dword [ebp]
mov edx, dword [esp + 0x60]
mov ebp, dword [ebp]
mov eax, dword [edx + 4]
mov ecx, dword [eax + ebp*4]
cmp word [ecx + 8], 0x7f
jne 0x42b244
mov edx, dword [esp + 0x6c]
call fcn.0040f320
test eax, eax
jne 0x42b29f
mov edx, dword [esp + 0x68]
mov ebp, dword [esp + 0x6c]
push edx
lea esi, [esp + 0x3c]
call fcn.0040df50
mov eax, dword [ebp]
dec eax
cmp dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x48], ebx
mov dword [esp + 0x54], eax
mov dword [esp + 0x4c], edi
jne 0x40dbab
mov dword [esp + 0x10], edi
mov ecx, dword [esp + 0x10]
lea edi, [esp + 0x38]
mov ebx, 0x4a8054
mov dword [esp + 0x50], ecx
call fcn.0040eaf0
lea ecx, [esp + 0x28]
call fcn.00402620
lea ecx, [esp + 0x18]
call fcn.00410a20
mov ecx, edi
call fcn.00402620
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret 0x10
cmp cx, 0x48
je 0x40db21
jmp 0x42b250
invalid
invalid
add byte [esi - 0x77], ah
test esp, ebx
jmp 0x6efcb253
invalid
invalid
invalid
loopne 0x42b251
invalid
jmp 0x32fdb283
Function at 0x40e1e0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3a8
push ebx
push edi
push 0x3a4
lea eax, [esp + 0x10]
push 0
push eax
mov dword [esp + 0x14], 0x3a8
call fcn.004131f0
add esp, 0xc
cmp dword [esi + 0x188], 0
jne 0x40e21f
mov ecx, dword [0x4a7cec]
mov dword [esi + 0x188], ecx
cmp dword [esi + 0x194], 0
jne 0x40e239
mov eax, dword [0x4a7cf0]
mov dword [esi + 0x194], eax
mov dword [esi + 0x198], eax
cmp dword [esi + 0x1a0], 0
jne 0x40e24e
mov ecx, dword [0x4a7cf4]
mov dword [esi + 0x1a0], ecx
mov eax, dword [esi + 0x18c]
lea edi, [esi + 0x190]
test eax, eax
jne 0x42aa0b
mov edx, dword [0x4972c0]
mov dword [esi + 0x18c], 0
mov byte [edi], 0
cmp dword [esi + 0x40], 0
mov ebx, 1
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], 0x401
mov dword [esp + 0x1c], 0
jne 0x42aa20
mov eax, dword [esi + 0x188]
mov dword [esp + 0x1c], eax
mov dword [esi + 0x18c], eax
cmp byte [0x497292], bl
je 0x42aa50
lea ecx, [esp + 8]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov byte [0x497292], bl
mov eax, esi
call fcn.00401e70
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
add dword [eax], eax
add byte [eax], al

Function at 0x40e7e0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, eax
mov ebx, 5
cmp dword [edi + 8], ebx
je 0x42b34a
call fcn.0040e8f0
test esi, esi
je 0x40e833
cmp dword [edi + 8], ebx
jne 0x42b354
mov eax, dword [edi]
mov dword [eax + 0x210], 0
test esi, esi
jle 0x40e833
push ebp
lea ebx, [esp + 0x14]
mov ebp, esi
mov esi, dword [ebx + 4]
add ebx, 4
mov edx, edi
call fcn.0040d0f0
sub ebp, 1
jne 0x40e820
pop ebp
mov eax, dword [edi]
mov ecx, dword [eax + 0x210]
mov dword [eax + 0x20c], ecx
mov edx, dword [edi]
mov dword [edx + 8], 1
mov eax, dword [edi]
cmp dword [eax + 0x20c], 0
jle 0x40e891
xor edx, edx
mov ecx, 0xc
lea esp, [esp]
mov esi, dword [ecx + eax + 0x100]
mov dword [ecx + eax], esi
mov eax, dword [edi]
mov esi, dword [ecx + eax]
imul esi, dword [eax + 8]
mov dword [eax + 8], esi
mov eax, dword [edi]
cmp dword [eax + 8], 0x1000000
jg 0x42b360
inc edx
add ecx, 4
cmp edx, dword [eax + 0x20c]
jl 0x40e860
mov eax, dword [edi]
mov eax, dword [eax + 8]
xor ecx, ecx
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041171a
mov ecx, dword [edi]
push 4
mov dword [ecx], eax
call fcn.0041171a
add esp, 8
test eax, eax
je 0x40e8ea
mov dword [eax], 1
mov edx, dword [edi]
mov dword [edx + 4], eax
mov eax, dword [edi]
cmp dword [eax + 8], 0
jle 0x40e8e4
xor ecx, ecx
mov eax, dword [eax]
mov dword [eax + ecx*4], 0
mov eax, dword [edi]
inc ecx
cmp ecx, dword [eax + 8]
jl 0x40e8d3
pop edi
pop esi
mov al, 1
pop ebx
ret
xor eax, eax
jmp 0x40e8c4
out 0xff, eax
dec dword [ecx - 0x14d36b]
call dword [ebx + 0x51]
jbe 0x42b374
add dword [eax], eax
add byte [eax], al
add byte [eax], al
inc eax
dec edi
Function at 0x40e940
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ecx
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0x14]
test eax, eax
jg 0x42adeb
test ecx, ecx
jne 0x42ad4f
test edx, edx
jne 0x42ad6a
test esi, esi
jne 0x42ad82
test edi, edi
jne 0x42ad9d
test ebx, ebx
jne 0x42adb8
test ebp, ebp
jne 0x42add3
xor eax, eax
pop ebp
pop ecx
ret 0xc
std
invalid
inc ebp
add byte [esi - 0x39], bl
test dword [esp + edi*8], esi
invalid
add byte [eax], al
add byte [ecx + 0x1586dc7], al
add byte [edi + 0x53], bl
add byte [eax], al
dec esi
dec esp
inc esi

Function at 0x40f110
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [esp + 0x14]
lea ecx, [eax + eax]
lea eax, [esp]
push eax
xor edx, edx
push 1
push edx
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x18]
mov word [esi], dx
mov edx, dword [esp + 0x14]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40f15f
mov ecx, dword [esp + 0x10]
mov edx, dword [esp]
lea eax, [esp + 0x14]
push eax
push esi
push 0
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ecx
ret

Function at 0x40f1a0
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ecx
push edi
mov edi, eax
cmp dword [edi + 0xc], 0
jne 0x40f1ba
lea ecx, [esp + 0xc]
call fcn.00402620
xor eax, eax
pop edi
pop ecx
ret 0x10
push ebx
push esi
lea esi, [esp + 0x14]
call fcn.00410a40
mov ebx, dword [edi + 8]
test ebx, ebx
jne 0x42a935
mov esi, dword [edi]
test esi, esi
je 0x40f1ee
lea eax, [esp + 0x14]
call fcn.0040dd00
test al, al
jne 0x42a925
mov esi, dword [esi + 0x20]
test esi, esi
jne 0x40f1d6
lea ecx, [esp + 0x14]
call fcn.00402620
xor eax, eax
pop esi
pop ebx
pop edi
pop ecx
ret 0x10
test dword [esp + esi*8 - 0x39ef0001], ecx
test dword [ebp + 0x10fffff4], ecx
hlt

Function at 0x40f320
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ecx
mov eax, dword [edx]
lea ecx, [eax + 1]
mov dword [edx], ecx
call fcn.0040f2a0
test eax, eax
je 0x40f359
dec ecx
mov dword [0x4a8014], ecx
mov eax, dword [eax + 4]
mov eax, dword [eax]
movzx ecx, word [eax + 8]
test cx, cx
jne 0x40f321
cmp dword [eax], 0x20
je 0x42b194
test cx, cx
jne 0x40f321
cmp dword [eax], 0x21
jne 0x40f321
xor eax, eax
pop ecx
ret

Function at 0x40f3b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x58
push ebx
push edi
mov edi, eax
mov al, byte [0x497290]
mov byte [esi + 3], al
cmp word [edi], 0
je 0x42ccf4
mov eax, edi
mov ecx, edi
call fcn.0040ffb0
mov ebx, edi
call fcn.00410130
mov ecx, dword [esp + 0x64]
push ecx
mov edx, edi
mov ebx, esi
call fcn.00410020
push eax
push esi
mov eax, edi
call fcn.0040f400
pop edi
pop ebx
add esp, 0x58
ret 4
outsd dx, dword [esi]
jb 0x42ccbc
test edx, ebx
idiv edi
invalid