joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4062bb
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x768]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x76c], ecx
mov edx, dword [ebp - 0x768]
mov eax, dword [ebp - 0x19d8]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x1d60]
mov eax, dword [ebp - 0x324]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x19dc], eax
mov dword [ebp - 0x19c], 0
jmp 0x4060d9
mov edx, dword [ebp - 0x76c]
add edx, dword [ebp - 0x19c]
movsx eax, byte [edx]
test eax, eax
je 0x40618b
mov ecx, dword [ebp - 0x19c]
movsx edx, byte [ebp + ecx - 0x878]
test edx, edx
je 0x40618b
push ecx
add ecx, 0x125b4
jmp 0x406114
pop ecx
push edx
push esi
add esp, 4
sub edx, 0x5bf4
jmp 0x406126
call 0x406134
add byte [esi], bh
xor bh, byte [eax + eax*2]
dec ebx
dec edx
inc edi
cmp al, byte [ebx - 0x74a5fb3c]
test dword [eax + edi*8 - 0x7afc0001], edx
invalid
push esi
push eax
add esp, 4
call 0x40619c
add byte [eax + 0x3b], al
dec ebp
xor edi, dword [edx + esi]
add esp, 4
or esi, 0xab41
pop esi
push ecx
push edi
add esp, 4
jmp 0x4061b0
sub ecx, 0xab8f
and ecx, 0x16f9d
pop ecx
mov edx, dword [ebp - 0x76c]
add edx, dword [ebp - 0x19c]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x19c]
movsx edx, byte [ebp + ecx - 0x878]
cmp eax, edx
jne 0x4061ea
mov dword [ebp - 0xcb8], 0
jmp 0x406259
push ecx
jmp 0x4061f4
or ecx, 0x11bb4
pop ecx
push edx
push esi
add esp, 4
sub edx, 0xad54
add edx, 0x100c3
call 0x406218
add byte [ebp + 0x34], cl
dec edx
dec esp
inc ebp
inc ebp
add esp, 4
pop edx
mov eax, dword [ebp - 0x76c]
add eax, dword [ebp - 0x19c]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x19c]
movsx eax, byte [ebp + edx - 0x878]
or eax, 0x20
cmp ecx, eax
jge 0x40624f
mov dword [ebp - 0xcb8], 0xffffffff
jmp 0x406259
mov dword [ebp - 0xcb8], 1
cmp dword [ebp - 0xcb8], 0
jne 0x406270
mov ecx, dword [ebp - 0x19dc]
mov dword [ebp - 0x510], ecx
jmp 0x406281
jmp 0x40605a
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0x79c], eax
push edi
or edi, 0xaec
pop edi
push eax
push ebx
add esp, 4
add eax, 0x45b5
or eax, 0x9160
and eax, 0xb647
call 0x4062bb
add byte [esi + 0x45], cl
xor al, byte [edx + 0x36]
inc esi
inc esi
inc esi
cmp al, byte [ebx - 0x74a7fb3c]
lea ebx, [eax]
cld
invalid

Function at 0x4062f0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
insd dword es:[edi], dx
add byte [eax], al
pop edx
push edi
push edi
add esp, 4
xor edi, 0x19d4
pop edi
cmp dword [ebp - 0x3e8], 0
je 0x406312
cmp dword [ebp - 0xab8], 0

Function at 0x406310
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
jne 0x406358
push edx
call fcn.00406321
add byte [ecx + 0x3a], al
cmp eax, 0x3d354d4b
xor al, 0x83
add esp, 4
invalid
ret 0x16b6
mov dword [ebp - 0x20f8], 0xa
push edx
call fcn.00406373
add byte [eax], bh
dec edx
dec ecx
dec eax
aas
cmp eax, 0x383d3838

Function at 0x406321
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
add edx, 0x116b6
call 0x40633a
add byte [esi], bh
cmp dword [edi], esi
dec esp
xor bh, byte ss:[ecx]
cmp eax, 0xc4834d3c
add al, 0x81
ljmp 0x8b5a
Function at 0x40633a
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
add edx, 0x116b6
call 0x40633a
add byte [esi], bh
cmp dword [edi], esi
dec esp
xor bh, byte ss:[ecx]
cmp eax, 0xc4834d3c
add al, 0x81
ljmp 0x8b5a
Function at 0x406373
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor edx, 0x982c
call 0x40638a
add byte [edi], bh
dec ecx
xor bh, byte [edx]
xor esi, dword ss:[0x4c48336]
and edx, 0x46aa
pop edx
mov eax, dword [ebp - 0x3e8]
mov cl, byte [eax + 0xa]
mov byte [ebp - 0x3ae], cl
mov edx, dword [ebp - 0xab8]
sub edx, dword [ebp - 0x3e8]
mov dword [ebp - 0x1694], edx
mov dword [ebp - 0xce8], 0
push ecx
push edi
add esp, 4
or ecx, 0x144cb
or ecx, 0xa0d
pop ecx
push ebx
jmp 0x4063da
call 0x4063e7
add byte [ebp + 0x50], al
dec eax
xor al, 0x41
add esp, 4
xor ebx, 0x13fbb
pop ebx
mov byte [ebp - 0x9d4], 0x56
mov byte [ebp - 0x9d3], 0x69
mov byte [ebp - 0x9d2], 0x72
mov byte [ebp - 0x9d1], 0x74
mov byte [ebp - 0x9d0], 0x75
mov byte [ebp - 0x9cf], 0x61
mov byte [ebp - 0x9ce], 0x6c
mov byte [ebp - 0x9cd], 0x50
mov byte [ebp - 0x9cc], 0x72
mov byte [ebp - 0x9cb], 0x6f
mov byte [ebp - 0x9ca], 0x74
mov byte [ebp - 0x9c9], 0x65
mov byte [ebp - 0x9c8], 0x63
mov byte [ebp - 0x9c7], 0x74
mov byte [ebp - 0x9c6], 0
push eax
push eax
add esp, 4
call 0x40646e
add byte [esi + eax*2 + 0x40], al
cmp bh, byte [0x333f4438]
add esp, 4
add al, 0x58
push edi
and edi, 0xdb9f
and edi, 0x159f
sub edi, 0x16619
out dx, eax
sbb dword [esi + 1], esp
add byte [ecx + 0x5cb8cf], al
add byte [edi + 0x64], bl
mov eax, dword [0x18]
mov dword [ebp - 0x19e4], eax
mov ecx, dword [ebp - 0x19e4]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x19e8], edx
mov eax, dword [ebp - 0x19e8]
mov dword [ebp - 0x1614], eax
push esi
push ebx
add esp, 4
sub esi, 0x65e4
and esi, 0x119f
pop esi
push edi
push esi
add esp, 4
and edi, 0x1031a
pop edi
push eax
sub eax, 0xc799
and eax, 0xe9b3
sub eax, 0x11631
pop eax
cmp dword [ebp - 0x1614], 0
jne 0x4064fd
mov dword [ebp - 0x2fc], 0
jmp 0x4067a4
mov ecx, dword [ebp - 0x1614]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xcc4], eax
push eax
sub eax, 0x119d6
sub eax, 0x899b
and eax, 0x5b46
add eax, 0x4c64
pop eax
push esi
push esi
add esp, 4
sub esi, 0x9d1b
and esi, 0x1062
sub esi, 0x5210
pop esi
cmp dword [ebp - 0xcc4], 0
jne 0x406559
mov dword [ebp - 0x2fc], 0
jmp 0x4067a4
mov ecx, dword [ebp - 0xcc4]
mov dword [ebp - 0x514], ecx
push edi
or edi, 0x55f8
pop edi
push edi
push edx
add esp, 4
xor edi, 0x14366
xor edi, 0x7228
jmp 0x406584
pop edi
push edx
push eax
add esp, 4
sub edx, 0x12875
or edx, 0xe932
pop edx
lea edx, [ebp - 0x1738]
mov dword [ebp - 0xcc0], edx
mov eax, dword [ebp - 0x514]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcbc], ecx
xor edx, edx
mov word [ebp - 0x21c], dx
xor eax, eax
mov word [ebp - 0x38], ax
push edi
push edi
add esp, 4
add edi, 0x16e77
call 0x4065da
add byte [edi], bh
inc ecx
dec ebp
inc esi
dec eax
dec ebx
inc edx
xor al, byte [ebx - 0x107efb3c]
cmp ebx, dword [ebx]
add al, ch
pop es
add byte [eax], al
add byte [eax], al
cmp eax, 0x3a3d3b46
inc edx
add esp, 4
pop edi
mov ecx, dword [ebp - 0xcbc]
mov dx, word [ecx]
mov word [ebp - 0x103e], dx
mov eax, dword [ebp - 0xcbc]
add eax, 2
invalid
invalid
inc esp
invalid
Function at 0x40638a
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor edx, 0x982c
call 0x40638a
add byte [edi], bh
dec ecx
xor bh, byte [edx]
xor esi, dword ss:[0x4c48336]
and edx, 0x46aa
pop edx
mov eax, dword [ebp - 0x3e8]
mov cl, byte [eax + 0xa]
mov byte [ebp - 0x3ae], cl
mov edx, dword [ebp - 0xab8]
sub edx, dword [ebp - 0x3e8]
mov dword [ebp - 0x1694], edx
mov dword [ebp - 0xce8], 0
push ecx
push edi
add esp, 4
or ecx, 0x144cb
or ecx, 0xa0d
pop ecx
push ebx
jmp 0x4063da
call 0x4063e7
add byte [ebp + 0x50], al
dec eax
xor al, 0x41
add esp, 4
xor ebx, 0x13fbb
pop ebx
mov byte [ebp - 0x9d4], 0x56
mov byte [ebp - 0x9d3], 0x69
mov byte [ebp - 0x9d2], 0x72
mov byte [ebp - 0x9d1], 0x74
mov byte [ebp - 0x9d0], 0x75
mov byte [ebp - 0x9cf], 0x61
mov byte [ebp - 0x9ce], 0x6c
mov byte [ebp - 0x9cd], 0x50
mov byte [ebp - 0x9cc], 0x72
mov byte [ebp - 0x9cb], 0x6f
mov byte [ebp - 0x9ca], 0x74
mov byte [ebp - 0x9c9], 0x65
mov byte [ebp - 0x9c8], 0x63
mov byte [ebp - 0x9c7], 0x74
mov byte [ebp - 0x9c6], 0
push eax
push eax
add esp, 4
call 0x40646e
add byte [esi + eax*2 + 0x40], al
cmp bh, byte [0x333f4438]
add esp, 4
add al, 0x58
push edi
and edi, 0xdb9f
and edi, 0x159f
sub edi, 0x16619
out dx, eax
sbb dword [esi + 1], esp
add byte [ecx + 0x5cb8cf], al
add byte [edi + 0x64], bl
mov eax, dword [0x18]
mov dword [ebp - 0x19e4], eax
mov ecx, dword [ebp - 0x19e4]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x19e8], edx
mov eax, dword [ebp - 0x19e8]
mov dword [ebp - 0x1614], eax
push esi
push ebx
add esp, 4
sub esi, 0x65e4
and esi, 0x119f
pop esi
push edi
push esi
add esp, 4
and edi, 0x1031a
pop edi
push eax
sub eax, 0xc799
and eax, 0xe9b3
sub eax, 0x11631
pop eax
cmp dword [ebp - 0x1614], 0
jne 0x4064fd
mov dword [ebp - 0x2fc], 0
jmp 0x4067a4
mov ecx, dword [ebp - 0x1614]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xcc4], eax
push eax
sub eax, 0x119d6
sub eax, 0x899b
and eax, 0x5b46
add eax, 0x4c64
pop eax
push esi
push esi
add esp, 4
sub esi, 0x9d1b
and esi, 0x1062
sub esi, 0x5210
pop esi
cmp dword [ebp - 0xcc4], 0
jne 0x406559
mov dword [ebp - 0x2fc], 0
jmp 0x4067a4
mov ecx, dword [ebp - 0xcc4]
mov dword [ebp - 0x514], ecx
push edi
or edi, 0x55f8
pop edi
push edi
push edx
add esp, 4
xor edi, 0x14366
xor edi, 0x7228
jmp 0x406584
pop edi
push edx
push eax
add esp, 4
sub edx, 0x12875
or edx, 0xe932
pop edx
lea edx, [ebp - 0x1738]
mov dword [ebp - 0xcc0], edx
mov eax, dword [ebp - 0x514]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcbc], ecx
xor edx, edx
mov word [ebp - 0x21c], dx
xor eax, eax
mov word [ebp - 0x38], ax
push edi
push edi
add esp, 4
add edi, 0x16e77
call 0x4065da
add byte [edi], bh
inc ecx
dec ebp
inc esi
dec eax
dec ebx
inc edx
xor al, byte [ebx - 0x107efb3c]
cmp ebx, dword [ebx]
add al, ch
pop es
add byte [eax], al
add byte [eax], al
cmp eax, 0x3a3d3b46
inc edx
add esp, 4
pop edi
mov ecx, dword [ebp - 0xcbc]
mov dx, word [ecx]
mov word [ebp - 0x103e], dx
mov eax, dword [ebp - 0xcbc]
add eax, 2
invalid
invalid
inc esp
invalid
Function at 0x4063e7
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor edx, 0x982c
call 0x40638a
add byte [edi], bh
dec ecx
xor bh, byte [edx]
xor esi, dword ss:[0x4c48336]
and edx, 0x46aa
pop edx
mov eax, dword [ebp - 0x3e8]
mov cl, byte [eax + 0xa]
mov byte [ebp - 0x3ae], cl
mov edx, dword [ebp - 0xab8]
sub edx, dword [ebp - 0x3e8]
mov dword [ebp - 0x1694], edx
mov dword [ebp - 0xce8], 0
push ecx
push edi
add esp, 4
or ecx, 0x144cb
or ecx, 0xa0d
pop ecx
push ebx
jmp 0x4063da
call 0x4063e7
add byte [ebp + 0x50], al
dec eax
xor al, 0x41
add esp, 4
xor ebx, 0x13fbb
pop ebx
mov byte [ebp - 0x9d4], 0x56
mov byte [ebp - 0x9d3], 0x69
mov byte [ebp - 0x9d2], 0x72
mov byte [ebp - 0x9d1], 0x74
mov byte [ebp - 0x9d0], 0x75
mov byte [ebp - 0x9cf], 0x61
mov byte [ebp - 0x9ce], 0x6c
mov byte [ebp - 0x9cd], 0x50
mov byte [ebp - 0x9cc], 0x72
mov byte [ebp - 0x9cb], 0x6f
mov byte [ebp - 0x9ca], 0x74
mov byte [ebp - 0x9c9], 0x65
mov byte [ebp - 0x9c8], 0x63
mov byte [ebp - 0x9c7], 0x74
mov byte [ebp - 0x9c6], 0
push eax
push eax
add esp, 4
call 0x40646e
add byte [esi + eax*2 + 0x40], al
cmp bh, byte [0x333f4438]
add esp, 4
add al, 0x58
push edi
and edi, 0xdb9f
and edi, 0x159f
sub edi, 0x16619
out dx, eax
sbb dword [esi + 1], esp
add byte [ecx + 0x5cb8cf], al
add byte [edi + 0x64], bl
mov eax, dword [0x18]
mov dword [ebp - 0x19e4], eax
mov ecx, dword [ebp - 0x19e4]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x19e8], edx
mov eax, dword [ebp - 0x19e8]
mov dword [ebp - 0x1614], eax
push esi
push ebx
add esp, 4
sub esi, 0x65e4
and esi, 0x119f
pop esi
push edi
push esi
add esp, 4
and edi, 0x1031a
pop edi
push eax
sub eax, 0xc799
and eax, 0xe9b3
sub eax, 0x11631
pop eax
cmp dword [ebp - 0x1614], 0
jne 0x4064fd
mov dword [ebp - 0x2fc], 0
jmp 0x4067a4
mov ecx, dword [ebp - 0x1614]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xcc4], eax
push eax
sub eax, 0x119d6
sub eax, 0x899b
and eax, 0x5b46
add eax, 0x4c64
pop eax
push esi
push esi
add esp, 4
sub esi, 0x9d1b
and esi, 0x1062
sub esi, 0x5210
pop esi
cmp dword [ebp - 0xcc4], 0
jne 0x406559
mov dword [ebp - 0x2fc], 0
jmp 0x4067a4
mov ecx, dword [ebp - 0xcc4]
mov dword [ebp - 0x514], ecx
push edi
or edi, 0x55f8
pop edi
push edi
push edx
add esp, 4
xor edi, 0x14366
xor edi, 0x7228
jmp 0x406584
pop edi
push edx
push eax
add esp, 4
sub edx, 0x12875
or edx, 0xe932
pop edx
lea edx, [ebp - 0x1738]
mov dword [ebp - 0xcc0], edx
mov eax, dword [ebp - 0x514]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcbc], ecx
xor edx, edx
mov word [ebp - 0x21c], dx
xor eax, eax
mov word [ebp - 0x38], ax
push edi
push edi
add esp, 4
add edi, 0x16e77
call 0x4065da
add byte [edi], bh
inc ecx
dec ebp
inc esi
dec eax
dec ebx
inc edx
xor al, byte [ebx - 0x107efb3c]
cmp ebx, dword [ebx]
add al, ch
pop es
add byte [eax], al
add byte [eax], al
cmp eax, 0x3a3d3b46
inc edx
add esp, 4
pop edi
mov ecx, dword [ebp - 0xcbc]
mov dx, word [ecx]
mov word [ebp - 0x103e], dx
mov eax, dword [ebp - 0xcbc]
add eax, 2
invalid
invalid
inc esp
invalid
Function at 0x40646e
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor edx, 0x982c
call 0x40638a
add byte [edi], bh
dec ecx
xor bh, byte [edx]
xor esi, dword ss:[0x4c48336]
and edx, 0x46aa
pop edx
mov eax, dword [ebp - 0x3e8]
mov cl, byte [eax + 0xa]
mov byte [ebp - 0x3ae], cl
mov edx, dword [ebp - 0xab8]
sub edx, dword [ebp - 0x3e8]
mov dword [ebp - 0x1694], edx
mov dword [ebp - 0xce8], 0
push ecx
push edi
add esp, 4
or ecx, 0x144cb
or ecx, 0xa0d
pop ecx
push ebx
jmp 0x4063da
call 0x4063e7
add byte [ebp + 0x50], al
dec eax
xor al, 0x41
add esp, 4
xor ebx, 0x13fbb
pop ebx
mov byte [ebp - 0x9d4], 0x56
mov byte [ebp - 0x9d3], 0x69
mov byte [ebp - 0x9d2], 0x72
mov byte [ebp - 0x9d1], 0x74
mov byte [ebp - 0x9d0], 0x75
mov byte [ebp - 0x9cf], 0x61
mov byte [ebp - 0x9ce], 0x6c
mov byte [ebp - 0x9cd], 0x50
mov byte [ebp - 0x9cc], 0x72
mov byte [ebp - 0x9cb], 0x6f
mov byte [ebp - 0x9ca], 0x74
mov byte [ebp - 0x9c9], 0x65
mov byte [ebp - 0x9c8], 0x63
mov byte [ebp - 0x9c7], 0x74
mov byte [ebp - 0x9c6], 0
push eax
push eax
add esp, 4
call 0x40646e
add byte [esi + eax*2 + 0x40], al
cmp bh, byte [0x333f4438]
add esp, 4
add al, 0x58
push edi
and edi, 0xdb9f
and edi, 0x159f
sub edi, 0x16619
out dx, eax
sbb dword [esi + 1], esp
add byte [ecx + 0x5cb8cf], al
add byte [edi + 0x64], bl
mov eax, dword [0x18]
mov dword [ebp - 0x19e4], eax
mov ecx, dword [ebp - 0x19e4]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x19e8], edx
mov eax, dword [ebp - 0x19e8]
mov dword [ebp - 0x1614], eax
push esi
push ebx
add esp, 4
sub esi, 0x65e4
and esi, 0x119f
pop esi
push edi
push esi
add esp, 4
and edi, 0x1031a
pop edi
push eax
sub eax, 0xc799
and eax, 0xe9b3
sub eax, 0x11631
pop eax
cmp dword [ebp - 0x1614], 0
jne 0x4064fd
mov dword [ebp - 0x2fc], 0
jmp 0x4067a4
mov ecx, dword [ebp - 0x1614]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xcc4], eax
push eax
sub eax, 0x119d6
sub eax, 0x899b
and eax, 0x5b46
add eax, 0x4c64
pop eax
push esi
push esi
add esp, 4
sub esi, 0x9d1b
and esi, 0x1062
sub esi, 0x5210
pop esi
cmp dword [ebp - 0xcc4], 0
jne 0x406559
mov dword [ebp - 0x2fc], 0
jmp 0x4067a4
mov ecx, dword [ebp - 0xcc4]
mov dword [ebp - 0x514], ecx
push edi
or edi, 0x55f8
pop edi
push edi
push edx
add esp, 4
xor edi, 0x14366
xor edi, 0x7228
jmp 0x406584
pop edi
push edx
push eax
add esp, 4
sub edx, 0x12875
or edx, 0xe932
pop edx
lea edx, [ebp - 0x1738]
mov dword [ebp - 0xcc0], edx
mov eax, dword [ebp - 0x514]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcbc], ecx
xor edx, edx
mov word [ebp - 0x21c], dx
xor eax, eax
mov word [ebp - 0x38], ax
push edi
push edi
add esp, 4
add edi, 0x16e77
call 0x4065da
add byte [edi], bh
inc ecx
dec ebp
inc esi
dec eax
dec ebx
inc edx
xor al, byte [ebx - 0x107efb3c]
cmp ebx, dword [ebx]
add al, ch
pop es
add byte [eax], al
add byte [eax], al
cmp eax, 0x3a3d3b46
inc edx
add esp, 4
pop edi
mov ecx, dword [ebp - 0xcbc]
mov dx, word [ecx]
mov word [ebp - 0x103e], dx
mov eax, dword [ebp - 0xcbc]
add eax, 2
invalid
invalid
inc esp
invalid
Function at 0x406480
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor edx, 0x982c
call 0x40638a
add byte [edi], bh
dec ecx
xor bh, byte [edx]
xor esi, dword ss:[0x4c48336]
and edx, 0x46aa
pop edx
mov eax, dword [ebp - 0x3e8]
mov cl, byte [eax + 0xa]
mov byte [ebp - 0x3ae], cl
mov edx, dword [ebp - 0xab8]
sub edx, dword [ebp - 0x3e8]
mov dword [ebp - 0x1694], edx
mov dword [ebp - 0xce8], 0
push ecx
push edi
add esp, 4
or ecx, 0x144cb
or ecx, 0xa0d
pop ecx
push ebx
jmp 0x4063da
call 0x4063e7
add byte [ebp + 0x50], al
dec eax
xor al, 0x41
add esp, 4
xor ebx, 0x13fbb
pop ebx
mov byte [ebp - 0x9d4], 0x56
mov byte [ebp - 0x9d3], 0x69
mov byte [ebp - 0x9d2], 0x72
mov byte [ebp - 0x9d1], 0x74
mov byte [ebp - 0x9d0], 0x75
mov byte [ebp - 0x9cf], 0x61
mov byte [ebp - 0x9ce], 0x6c
mov byte [ebp - 0x9cd], 0x50
mov byte [ebp - 0x9cc], 0x72
mov byte [ebp - 0x9cb], 0x6f
mov byte [ebp - 0x9ca], 0x74
mov byte [ebp - 0x9c9], 0x65
mov byte [ebp - 0x9c8], 0x63
mov byte [ebp - 0x9c7], 0x74
mov byte [ebp - 0x9c6], 0
push eax
push eax
add esp, 4
call 0x40646e
add byte [esi + eax*2 + 0x40], al
cmp bh, byte [0x333f4438]
add esp, 4
add al, 0x58
push edi
and edi, 0xdb9f
and edi, 0x159f
sub edi, 0x16619
out dx, eax
sbb dword [esi + 1], esp
add byte [ecx + 0x5cb8cf], al
add byte [edi + 0x64], bl
mov eax, dword [0x18]
mov dword [ebp - 0x19e4], eax
mov ecx, dword [ebp - 0x19e4]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x19e8], edx
mov eax, dword [ebp - 0x19e8]
mov dword [ebp - 0x1614], eax
push esi
push ebx
add esp, 4
sub esi, 0x65e4
and esi, 0x119f
pop esi
push edi
push esi
add esp, 4
and edi, 0x1031a
pop edi
push eax
sub eax, 0xc799
and eax, 0xe9b3
sub eax, 0x11631
pop eax
cmp dword [ebp - 0x1614], 0
jne 0x4064fd
mov dword [ebp - 0x2fc], 0
jmp 0x4067a4
mov ecx, dword [ebp - 0x1614]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xcc4], eax
push eax
sub eax, 0x119d6
sub eax, 0x899b
and eax, 0x5b46
add eax, 0x4c64
pop eax
push esi
push esi
add esp, 4
sub esi, 0x9d1b
and esi, 0x1062
sub esi, 0x5210
pop esi
cmp dword [ebp - 0xcc4], 0
jne 0x406559
mov dword [ebp - 0x2fc], 0
jmp 0x4067a4
mov ecx, dword [ebp - 0xcc4]
mov dword [ebp - 0x514], ecx
push edi
or edi, 0x55f8
pop edi
push edi
push edx
add esp, 4
xor edi, 0x14366
xor edi, 0x7228
jmp 0x406584
pop edi
push edx
push eax
add esp, 4
sub edx, 0x12875
or edx, 0xe932
pop edx
lea edx, [ebp - 0x1738]
mov dword [ebp - 0xcc0], edx
mov eax, dword [ebp - 0x514]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcbc], ecx
xor edx, edx
mov word [ebp - 0x21c], dx
xor eax, eax
mov word [ebp - 0x38], ax
push edi
push edi
add esp, 4
add edi, 0x16e77
call 0x4065da
add byte [edi], bh
inc ecx
dec ebp
inc esi
dec eax
dec ebx
inc edx
xor al, byte [ebx - 0x107efb3c]
cmp ebx, dword [ebx]
add al, ch
pop es
add byte [eax], al
add byte [eax], al
cmp eax, 0x3a3d3b46
inc edx
add esp, 4
pop edi
mov ecx, dword [ebp - 0xcbc]
mov dx, word [ecx]
mov word [ebp - 0x103e], dx
mov eax, dword [ebp - 0xcbc]
add eax, 2
invalid
invalid
inc esp
invalid
Function at 0x406550
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor edx, 0x982c
call 0x40638a
add byte [edi], bh
dec ecx
xor bh, byte [edx]
xor esi, dword ss:[0x4c48336]
and edx, 0x46aa
pop edx
mov eax, dword [ebp - 0x3e8]
mov cl, byte [eax + 0xa]
mov byte [ebp - 0x3ae], cl
mov edx, dword [ebp - 0xab8]
sub edx, dword [ebp - 0x3e8]
mov dword [ebp - 0x1694], edx
mov dword [ebp - 0xce8], 0
push ecx
push edi
add esp, 4
or ecx, 0x144cb
or ecx, 0xa0d
pop ecx
push ebx
jmp 0x4063da
call 0x4063e7
add byte [ebp + 0x50], al
dec eax
xor al, 0x41
add esp, 4
xor ebx, 0x13fbb
pop ebx
mov byte [ebp - 0x9d4], 0x56
mov byte [ebp - 0x9d3], 0x69
mov byte [ebp - 0x9d2], 0x72
mov byte [ebp - 0x9d1], 0x74
mov byte [ebp - 0x9d0], 0x75
mov byte [ebp - 0x9cf], 0x61
mov byte [ebp - 0x9ce], 0x6c
mov byte [ebp - 0x9cd], 0x50
mov byte [ebp - 0x9cc], 0x72
mov byte [ebp - 0x9cb], 0x6f
mov byte [ebp - 0x9ca], 0x74
mov byte [ebp - 0x9c9], 0x65
mov byte [ebp - 0x9c8], 0x63
mov byte [ebp - 0x9c7], 0x74
mov byte [ebp - 0x9c6], 0
push eax
push eax
add esp, 4
call 0x40646e
add byte [esi + eax*2 + 0x40], al
cmp bh, byte [0x333f4438]
add esp, 4
add al, 0x58
push edi
and edi, 0xdb9f
and edi, 0x159f
sub edi, 0x16619
out dx, eax
sbb dword [esi + 1], esp
add byte [ecx + 0x5cb8cf], al
add byte [edi + 0x64], bl
mov eax, dword [0x18]
mov dword [ebp - 0x19e4], eax
mov ecx, dword [ebp - 0x19e4]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x19e8], edx
mov eax, dword [ebp - 0x19e8]
mov dword [ebp - 0x1614], eax
push esi
push ebx
add esp, 4
sub esi, 0x65e4
and esi, 0x119f
pop esi
push edi
push esi
add esp, 4
and edi, 0x1031a
pop edi
push eax
sub eax, 0xc799
and eax, 0xe9b3
sub eax, 0x11631
pop eax
cmp dword [ebp - 0x1614], 0
jne 0x4064fd
mov dword [ebp - 0x2fc], 0
jmp 0x4067a4
mov ecx, dword [ebp - 0x1614]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xcc4], eax
push eax
sub eax, 0x119d6
sub eax, 0x899b
and eax, 0x5b46
add eax, 0x4c64
pop eax
push esi
push esi
add esp, 4
sub esi, 0x9d1b
and esi, 0x1062
sub esi, 0x5210
pop esi
cmp dword [ebp - 0xcc4], 0
jne 0x406559
mov dword [ebp - 0x2fc], 0
jmp 0x4067a4
mov ecx, dword [ebp - 0xcc4]
mov dword [ebp - 0x514], ecx
push edi
or edi, 0x55f8
pop edi
push edi
push edx
add esp, 4
xor edi, 0x14366
xor edi, 0x7228
jmp 0x406584
pop edi
push edx
push eax
add esp, 4
sub edx, 0x12875
or edx, 0xe932
pop edx
lea edx, [ebp - 0x1738]
mov dword [ebp - 0xcc0], edx
mov eax, dword [ebp - 0x514]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcbc], ecx
xor edx, edx
mov word [ebp - 0x21c], dx
xor eax, eax
mov word [ebp - 0x38], ax
push edi
push edi
add esp, 4
add edi, 0x16e77
call 0x4065da
add byte [edi], bh
inc ecx
dec ebp
inc esi
dec eax
dec ebx
inc edx
xor al, byte [ebx - 0x107efb3c]
cmp ebx, dword [ebx]
add al, ch
pop es
add byte [eax], al
add byte [eax], al
cmp eax, 0x3a3d3b46
inc edx
add esp, 4
pop edi
mov ecx, dword [ebp - 0xcbc]
mov dx, word [ecx]
mov word [ebp - 0x103e], dx
mov eax, dword [ebp - 0xcbc]
add eax, 2
invalid
invalid
inc esp
invalid