joyce8/EMBER2024-capa huggingface dataset:
Function at 0x556420
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x14]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.00406c4c
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.0054eb88
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x556486
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x26e], 0
je 0x556486
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0x18]
add eax, 0x25e
call fcn.00406c54
test al, al
jne 0x556486
mov eax, dword [ebp - 0x18]
mov byte [eax + 0x26e], 0
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.0054e5ac
mov eax, dword [ebp - 4]
cmp byte [eax + 0x2a8], 0
je 0x556519
mov eax, dword [ebp - 4]
cmp dword [eax + 0x29c], 0xffffffff
jle 0x556519
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2a0]
cmp eax, dword [ebp - 0x14]
jne 0x5564be
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2a4]
cmp eax, dword [ebp - 0x10]
je 0x556519
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x298]
cmp eax, dword [ebp - 0x18]
jne 0x556500
mov eax, dword [ebp - 4]
cmp dword [eax + 0x29c], 0
jne 0x556519
mov eax, dword [ebp - 4]
mov dword [eax + 0x29c], 1
mov eax, dword [ebp - 4]
movsx edx, word [eax + 0x7a]
mov eax, dword [0x5be7f0]
mov eax, dword [eax]
call fcn.00476514
push eax
call sub.user32.dll_SetCursor
jmp 0x556519
mov eax, dword [ebp - 4]
cmp dword [eax + 0x29c], 0
jne 0x556519
mov eax, dword [ebp - 4]
mov dword [eax + 0x29c], 0xffffffff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x284]
cmp eax, dword [ebp - 8]
jne 0x556535
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x288]
cmp eax, dword [ebp - 0xc]
je 0x5565ac
mov eax, dword [ebp - 4]
cmp dword [eax + 0x290], 0
je 0x556557
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x290]
call fcn.0045eca0
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28c]
call fcn.0043948c
cmp dword [ebp - 0x18], 0
je 0x5565ac
lea ecx, [ebp - 0x20]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.00406c4c
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x20]
mov dword [eax + 0x284], edx
mov edx, dword [ebp - 0x1c]
mov dword [eax + 0x288], edx
mov eax, dword [ebp - 4]
cmp byte [eax + 0x364], 0
je 0x5565ac
mov dl, 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28c]
call fcn.0043948c
mov esp, ebp
pop ebp
ret
Function at 0x55d7e8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x24]
mov edi, dword [ebx + 0x34]
sub edi, dword [ebx + 0x6c]
sub edi, dword [ebx + 0x64]
jmp 0x55d815
mov eax, dword [ebx + 0x24]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x64]
ja 0x55d894
push esi
mov eax, dword [ebx + 0x30]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.0055c554
add esp, 0xc
sub dword [ebx + 0x68], esi
sub dword [ebx + 0x64], esi
sub dword [ebx + 0x54], ebp
mov eax, dword [ebx + 0x44]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x3c]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x55d862
mov cx, word [esp]
sub cx, si
jmp 0x55d864
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x55d84b
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x38]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x55d88a
mov cx, word [esp]
sub cx, si
jmp 0x55d88c
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x55d873
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x55d8f1
mov edx, dword [ebx + 0x30]
mov ecx, edi
add edx, dword [ebx + 0x64]
mov eax, ebp
add edx, dword [ebx + 0x6c]
call fcn.0055d4c0
add dword [ebx + 0x6c], eax
cmp dword [ebx + 0x6c], 3
jb 0x55d8dc
mov eax, dword [ebx + 0x30]
mov edx, dword [ebx + 0x64]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x40], eax
mov ecx, dword [ebx + 0x50]
shl eax, cl
mov edx, dword [ebx + 0x30]
mov ecx, dword [ebx + 0x64]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp dword [ebx + 0x6c], 0x106
jae 0x55d8f1
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x55d7f2
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5637dc
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov ecx, 8
mov edx, 0x3020100
mov dword [eax], edx
add edx, 0x4040404
mov dword [eax + 4], edx
add edx, 0x4040404
mov dword [eax + 8], edx
add edx, 0x4040404
mov dword [eax + 0xc], edx
add edx, 0x4040404
mov dword [eax + 0x10], edx
add edx, 0x4040404
mov dword [eax + 0x14], edx
add edx, 0x4040404
mov dword [eax + 0x18], edx
add edx, 0x4040404
mov dword [eax + 0x1c], edx
add edx, 0x4040404
add eax, 0x20
dec ecx
jne 0x5637e6
ret

Function at 0x565d18
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x565d9f
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.00565b20
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x20]
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.00409054
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.005658c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x565da6
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004044b8
ret

Function at 0x5661fc
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x566260
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00409cb4
mov eax, dword [ebp - 4]
call fcn.0056615c
test al, al
je 0x566235
mov byte [ebp - 5], 1
jmp 0x56624a
mov eax, dword [ebp - 0xc]
call fcn.00404964
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
sete byte [ebp - 5]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x566267
lea eax, [ebp - 0xc]
call fcn.00404494
ret

Function at 0x5664b0
Capabilities:
Encode data using xor

Disassembly:
and edx, edx
je 0x5664d3
and ecx, ecx
jle 0x5664d3
push ebx
push edi
xor ebx, ebx
lea edi, cs:[0x5664d9]
mov bl, al
shr eax, 8
xor bl, byte [edx]
xor eax, dword [edi + ebx*4]
inc edx
dec ecx
jne 0x5664c3
pop edi
pop ebx
ret
Function at 0x566ab4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
dec eax
test eax, eax
jl 0x566b11
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, dword [ebp - 0x14]
mov al, byte [eax]
mov byte [ebp - 0xe], al
mov eax, dword [ebp - 0xc]
call fcn.00566a04
xor al, byte [ebp - 0xe]
mov byte [ebp - 0xd], al
mov edx, dword [ebp - 0xc]
mov al, byte [ebp - 0xd]
call fcn.0056696c
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, dword [ebp - 0x14]
mov dl, byte [ebp - 0xd]
mov byte [eax], dl
inc dword [ebp - 0x14]
dec dword [ebp - 0x18]
jne 0x566ad6
mov esp, ebp
pop ebp
ret

Function at 0x566b6c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0x12345678
mov dword [eax + 4], 0
mov eax, dword [ebp - 8]
mov dword [eax + 8], 0x23456789
mov dword [eax + 0xc], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x10], 0x34567890
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 4]
call fcn.00404764
dec eax
test eax, eax
jl 0x566be2
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 4]
call fcn.00404964
add eax, dword [ebp - 0x10]
mov al, byte [eax]
mov edx, dword [ebp - 8]
call fcn.0056696c
inc dword [ebp - 0x10]
dec dword [ebp - 0x18]
jne 0x566bc5
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
call fcn.00566a04
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
xor al, byte [edx + ecx]
mov byte [ebp - 0x11], al
mov edx, dword [ebp - 8]
mov al, byte [ebp - 0x11]
call fcn.0056696c
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov cl, byte [ebp - 0x11]
mov byte [eax + edx], cl
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xc
jne 0x566be7
mov esp, ebp
pop ebp
ret
Function at 0x570ef8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x113]
mov edx, 0x570f80
call fcn.0040a29c
mov eax, dword [ebp - 4]
cmp dword [eax + 0x48], 0
je 0x570f33
lea eax, [ebp - 0x108]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x48]
call fcn.0040a29c
jmp 0x570f44
lea eax, [ebp - 0x108]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 0x218]
push eax
push 0
lea eax, [ebp - 0x113]
push eax
lea eax, [ebp - 0x108]
push eax
call sub.kernel32.dll_GetTempFileNameA
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x218]
mov ecx, 0x105
call fcn.00404714
mov esp, ebp
pop ebp
ret
Function at 0x5758e0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x575b40
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x575943
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.00575588
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040e2e4
cmp al, 1
jne 0x575943
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.00575850
test al, al
je 0x575acf
cmp dword [ebp - 8], 0
jge 0x575961
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.00575588
mov eax, dword [ebp - 0x210]
call fcn.00404764
cmp ebx, eax
jge 0x5759ab
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.00575588
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x5be808]
and eax, 0xff
bt dword [edx], eax
jae 0x5759ab
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x5759bf
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.005758bc
cmp ebx, dword [ebp - 8]
je 0x575ac1
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x5759eb
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403768
and eax, 0x7f
movzx eax, word [eax*2 + 0x5bd9ec]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x575aae
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403768
and eax, 0x7f
movzx eax, word [eax*2 + 0x5bd9ec]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.0045eca0
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403768
and eax, 0x7f
movzx eax, word [eax*2 + 0x5bd9ec]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.0045eca0
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x575ab5
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x575b22
cmp dword [ebp - 8], 0
jge 0x575ada
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.00575588
mov eax, dword [ebp - 0x218]
call fcn.00404764
cmp eax, dword [ebp - 8]
jg 0x575b14
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.00575588
mov eax, dword [ebp - 0x21c]
call fcn.00404764
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.005758bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x575b47
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.004044b8
ret
Function at 0x59b18c
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 0x10], 2
jne 0x59b1b1
cmp dword [esp + 4], 5
jb 0x59b1b1
mov al, 1
jmp 0x59b1b3
xor eax, eax
add esp, 0x94
ret
Function at 0x40b3b8
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407ad8
xor eax, eax
push ebp
push 0x40b478
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
lea eax, [ebp - 0xc]
push eax
push 3
call sub.kernel32.dll_GetUserDefaultUILanguage
movzx eax, ax
push eax
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.0040856c
mov ecx, dword [ebp - 0x10]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040871c
mov eax, dword [ebx]
call fcn.0040b268
test al, al
jne 0x40b455
mov word [ebp - 8], 0
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.0040856c
mov ecx, dword [ebp - 0x14]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040871c
mov eax, dword [ebx]
call fcn.0040b268
test al, al
jne 0x40b455
mov eax, ebx
call fcn.004079f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b47f
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00407a54
lea eax, [ebp - 4]
call fcn.004079f4
ret

Function at 0x40cde0
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret
Function at 0x411ef2
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor ebx, 0xe69e
call 0x411f09
add byte [ebx], bh
inc edx
dec edx
dec ebp
xor dh, byte [edi]
xor ecx, dword [ecx - 0x7d]
les eax, [ecx + eax*4]
ret

Function at 0x411f09
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor ebx, 0xe69e
call 0x411f09
add byte [ebx], bh
inc edx
dec edx
dec ebp
xor dh, byte [edi]
xor ecx, dword [ecx - 0x7d]
les eax, [ecx + eax*4]
ret
Function at 0x412524
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
sub edi, 0xd4a0
pop edi
movzx edx, word [ebp - 0x10c]
test edx, edx
jne 0x412551
movzx eax, word [ebp - 0x210]
movzx ecx, word [ebp - 0x10c]
sub eax, ecx
mov dword [ebp - 0x15e8], eax
jmp 0x4125b4
movzx edx, word [ebp - 0x210]
movzx eax, word [ebp - 0x10c]
cmp edx, eax
je 0x412470
movzx ecx, word [ebp - 0x210]
xor ecx, 0x20
movzx edx, word [ebp - 0x10c]
cmp ecx, edx
je 0x412470
movzx eax, word [ebp - 0x210]
movzx ecx, word [ebp - 0x10c]
cmp eax, ecx
jge 0x41259e
mov dword [ebp - 0x15e4], 0xffffffff
jmp 0x4125a8
mov dword [ebp - 0x15e4], 1
mov edx, dword [ebp - 0x15e4]
mov dword [ebp - 0x15e8], edx
cmp dword [ebp - 0x15e8], 0
jne 0x4125fd
push ebx
and ebx, 0x1191b
jmp 0x4125ca
or ebx, 0x17aa7
pop ebx
push edx
push edi
add esp, 4
xor edx, 0x17400
add edx, 0x61be
add edx, 0x923b
xor edx, 0x40c8
pop edx
mov eax, dword [ebp - 0x508]
mov dword [ebp - 0x2d4], eax
jmp 0x412665
push edx
push esi
add esp, 4
add edx, 0xf730
call 0x412616
add byte [edx], dh
dec esi
cmp al, 0x43
dec esi
xor edi, dword [eax + eax*2]
add esp, 4
pop edx
push edx
jmp 0x412622
sub edx, 0x113bc
add edx, 0x10ebd
pop edx
mov ecx, dword [ebp - 0x508]
mov edx, dword [ecx]
mov dword [ebp - 0x508], edx
mov eax, dword [ebp - 0x508]
cmp eax, dword [ebp - 0xc9c]
je 0x41265b
mov ecx, dword [ebp - 0x508]
cmp dword [ecx + 0x30], 0
jne 0x412411
mov dword [ebp - 0x2d4], 0

Function at 0x412616
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
sub edi, 0xd4a0
pop edi
movzx edx, word [ebp - 0x10c]
test edx, edx
jne 0x412551
movzx eax, word [ebp - 0x210]
movzx ecx, word [ebp - 0x10c]
sub eax, ecx
mov dword [ebp - 0x15e8], eax
jmp 0x4125b4
movzx edx, word [ebp - 0x210]
movzx eax, word [ebp - 0x10c]
cmp edx, eax
je 0x412470
movzx ecx, word [ebp - 0x210]
xor ecx, 0x20
movzx edx, word [ebp - 0x10c]
cmp ecx, edx
je 0x412470
movzx eax, word [ebp - 0x210]
movzx ecx, word [ebp - 0x10c]
cmp eax, ecx
jge 0x41259e
mov dword [ebp - 0x15e4], 0xffffffff
jmp 0x4125a8
mov dword [ebp - 0x15e4], 1
mov edx, dword [ebp - 0x15e4]
mov dword [ebp - 0x15e8], edx
cmp dword [ebp - 0x15e8], 0
jne 0x4125fd
push ebx
and ebx, 0x1191b
jmp 0x4125ca
or ebx, 0x17aa7
pop ebx
push edx
push edi
add esp, 4
xor edx, 0x17400
add edx, 0x61be
add edx, 0x923b
xor edx, 0x40c8
pop edx
mov eax, dword [ebp - 0x508]
mov dword [ebp - 0x2d4], eax
jmp 0x412665
push edx
push esi
add esp, 4
add edx, 0xf730
call 0x412616
add byte [edx], dh
dec esi
cmp al, 0x43
dec esi
xor edi, dword [eax + eax*2]
add esp, 4
pop edx
push edx
jmp 0x412622
sub edx, 0x113bc
add edx, 0x10ebd
pop edx
mov ecx, dword [ebp - 0x508]
mov edx, dword [ecx]
mov dword [ebp - 0x508], edx
mov eax, dword [ebp - 0x508]
cmp eax, dword [ebp - 0xc9c]
je 0x41265b
mov ecx, dword [ebp - 0x508]
cmp dword [ecx + 0x30], 0
jne 0x412411
mov dword [ebp - 0x2d4], 0
Function at 0x412b5a
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or ecx, 0x70a5
pop ecx
mov dword [ebp - 0x7a0], 0
jmp 0x41369a

Function at 0x412f7f
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
and edx, 0xb8f2
sub edx, 0x183d
pop edx
push eax
push esi
add esp, 4
sub eax, 0x566c
xor eax, 0x1308f
pop eax
mov dword [ebp - 0x7a0], 0
jmp 0x41369a
Function at 0x413e6e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edx
push esi
add esp, 4
or edx, 0x78e0
and edx, 0xff48
pop edx
push ecx
call fcn.00413e6e
add byte [edx + 0x48], cl
inc esi
xor al, byte [edx + 0x3f]
inc ecx
xor eax, 0x4c48337
add esp, 4
add esp, 4
or ecx, 0x124ff
xor ecx, 0xc138
pop ecx
mov edx, dword [ebp - 0xccc]
mov ax, word [edx]
mov word [ebp - 0x1046], ax
mov ecx, dword [ebp - 0xccc]
add ecx, 2
mov dword [ebp - 0xccc], ecx
mov dx, word [ebp - 0x1046]
mov word [ebp - 0x220], dx
mov eax, dword [ebp - 0xcd0]
mov cx, word [eax]
mov word [ebp - 0x1048], cx
mov edx, dword [ebp - 0xcd0]
add edx, 2
mov dword [ebp - 0xcd0], edx
mov ax, word [ebp - 0x1048]
mov word [ebp - 0x3c], ax
push edx
call 0x413ee5
add byte [eax + 0x50], al
cmp eax, dword [ebx + 0x3f]
aas
inc ebp
dec eax
cmp al, byte [ebx + 0x525a04c4]
xor edx, 0x10f8
call 0x413efd
add byte [eax + edx*2 + 0x3b], al
inc ecx
inc edx
dec edx
inc ecx
add esp, 4
or edx, 0x140fe
pop edx
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x413f24
movzx edx, word [ebp - 0x220]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x1670], edx
jmp 0x413f7e
movzx ecx, word [ebp - 0x220]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x413e4c
movzx eax, word [ebp - 0x220]
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x413e4c
movzx edx, word [ebp - 0x220]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x413f68
mov dword [ebp - 0x162c], 0xffffffff
jmp 0x413f72
mov dword [ebp - 0x162c], 1
mov ecx, dword [ebp - 0x162c]
mov dword [ebp - 0x1670], ecx
cmp dword [ebp - 0x1670], 0
jne 0x413fc7
push edi
push eax
add esp, 4
and edi, 0x10588
call 0x413fa2
add byte [esi + edi + 0x4c], al
dec edi
push eax
cmp eax, 0x3e344b45
add esp, 4
pop edi
push edx
push esi
add esp, 4
jmp 0x413fb2
or edx, 0x13d13
pop edx
mov edx, dword [ebp - 0x51c]
mov dword [ebp - 0x778], edx
jmp 0x41402f
push eax
and eax, 0xddf
or eax, 0xc5f5
sub eax, 0x1bef
pop eax
push edi
push eax
add esp, 4
and edi, 0x13a81
xor edi, 0x22d0
xor edi, 0x2e31
add edi, 0x2671
pop edi
mov eax, dword [ebp - 0x51c]
mov ecx, dword [eax]
mov dword [ebp - 0x51c], ecx
mov edx, dword [ebp - 0x51c]
cmp edx, dword [ebp - 0xcd4]
je 0x414025
mov eax, dword [ebp - 0x51c]
cmp dword [eax + 0x30], 0
jne 0x413df0
mov dword [ebp - 0x778], 0
Function at 0x413ee5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edx
push esi
add esp, 4
or edx, 0x78e0
and edx, 0xff48
pop edx
push ecx
call fcn.00413e6e
add byte [edx + 0x48], cl
inc esi
xor al, byte [edx + 0x3f]
inc ecx
xor eax, 0x4c48337
add esp, 4
add esp, 4
or ecx, 0x124ff
xor ecx, 0xc138
pop ecx
mov edx, dword [ebp - 0xccc]
mov ax, word [edx]
mov word [ebp - 0x1046], ax
mov ecx, dword [ebp - 0xccc]
add ecx, 2
mov dword [ebp - 0xccc], ecx
mov dx, word [ebp - 0x1046]
mov word [ebp - 0x220], dx
mov eax, dword [ebp - 0xcd0]
mov cx, word [eax]
mov word [ebp - 0x1048], cx
mov edx, dword [ebp - 0xcd0]
add edx, 2
mov dword [ebp - 0xcd0], edx
mov ax, word [ebp - 0x1048]
mov word [ebp - 0x3c], ax
push edx
call 0x413ee5
add byte [eax + 0x50], al
cmp eax, dword [ebx + 0x3f]
aas
inc ebp
dec eax
cmp al, byte [ebx + 0x525a04c4]
xor edx, 0x10f8
call 0x413efd
add byte [eax + edx*2 + 0x3b], al
inc ecx
inc edx
dec edx
inc ecx
add esp, 4
or edx, 0x140fe
pop edx
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x413f24
movzx edx, word [ebp - 0x220]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x1670], edx
jmp 0x413f7e
movzx ecx, word [ebp - 0x220]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x413e4c
movzx eax, word [ebp - 0x220]
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x413e4c
movzx edx, word [ebp - 0x220]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x413f68
mov dword [ebp - 0x162c], 0xffffffff
jmp 0x413f72
mov dword [ebp - 0x162c], 1
mov ecx, dword [ebp - 0x162c]
mov dword [ebp - 0x1670], ecx
cmp dword [ebp - 0x1670], 0
jne 0x413fc7
push edi
push eax
add esp, 4
and edi, 0x10588
call 0x413fa2
add byte [esi + edi + 0x4c], al
dec edi
push eax
cmp eax, 0x3e344b45
add esp, 4
pop edi
push edx
push esi
add esp, 4
jmp 0x413fb2
or edx, 0x13d13
pop edx
mov edx, dword [ebp - 0x51c]
mov dword [ebp - 0x778], edx
jmp 0x41402f
push eax
and eax, 0xddf
or eax, 0xc5f5
sub eax, 0x1bef
pop eax
push edi
push eax
add esp, 4
and edi, 0x13a81
xor edi, 0x22d0
xor edi, 0x2e31
add edi, 0x2671
pop edi
mov eax, dword [ebp - 0x51c]
mov ecx, dword [eax]
mov dword [ebp - 0x51c], ecx
mov edx, dword [ebp - 0x51c]
cmp edx, dword [ebp - 0xcd4]
je 0x414025
mov eax, dword [ebp - 0x51c]
cmp dword [eax + 0x30], 0
jne 0x413df0
mov dword [ebp - 0x778], 0