joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408632
Capabilities:
Get number of processors

Disassembly:
ret

Function at 0x4086a7
Capabilities:
Get number of processors

Disassembly:
out 0xdf, eax
out 0, eax
add byte [edi - 0x75], bl
test dword [eax], esi
sti
invalid

Function at 0x40870c
Capabilities:
Get number of processors

Disassembly:
mov edx, dword [ebp - 0x4d0]
add edx, 1
mov dword [ebp - 0x4d0], edx
push eax
jmp 0x408684
or eax, 0x12b28
pop eax
push eax
push edx
add esp, 4
jmp 0x408696
or eax, 0x27ed
pop eax
push ebx
and ebx, 0x110b3
pop ebx
push edi
and edi, 0xe7df
out 0xdf, eax
out 0, eax
add byte [edi - 0x75], bl
test dword [eax], esi
sti
invalid
jmp [ebx]
test dword [eax - 4], eax
invalid
inc dword [ebx + 0x3772fff8]
push ebx
or ebx, 0x7b98
and ebx, 0x35d7
sub ebx, 0x15174
pop ebx
push edi
push ecx
add esp, 4
add edi, 0x16939
or edi, 0x15893
and edi, 0x1095e
jmp 0x4086ef
pop edi
jmp 0x408923
mov dword [ebp - 0xc10], 7
mov ecx, dword [ebp - 0x4d0]
lea esi, [eax]
sti
invalid
dec dword [ecx - 0xa5f73]
invalid
push ecx
push ebx
add esp, 4
jmp 0x408719
xor ecx, 0xc557
pop ecx
push esi
add esi, 0x6d33
sub esi, 0x8af8
sub esi, 0xb836
jmp 0x40873c
pop esi
mov edx, dword [ebp - 0x14c8]
mov dword [ebp - 0x9f0], edx
mov dword [ebp - 0xc14], 0
mov eax, dword [ebp - 0x4d0]
cmp eax, dword [ebp - 0x14c8]
jne 0x4087a4
push eax
push edx
add esp, 4
add eax, 0x10d7e
xor eax, 0x56cd
sub eax, 0x12ad5
sub al, byte [ecx]
add byte [eax + 0x51], bl
add ecx, 0x13c1f
and ecx, 0x10f93
xor ecx, 0x758c
sub ecx, 0x1061a
pop ecx
mov ecx, dword [ebp - 0xc14]
mov dword [ebp - 0x14d0], ecx
jmp 0x4088d5
cmp dword [ebp - 0xc10], 0
jle 0x4088c9
push ebx
push ecx
add esp, 4
add ebx, 0x14a2a
pop ebx
push edx
sub edx, 0x2290
and al, byte [eax]
add byte [ecx + 0xc075c2], al
add byte [ecx + 0x60aef2], al
add byte [edx + 0x52], bl
push eax
add esp, 4
xor edx, 0x17392
add edx, 0xe0c2
pop edx
mov edx, dword [ebp - 0xa60]
movzx eax, byte [edx]
invalid
invalid
Function at 0x4087c1
Capabilities:
Get number of processors

Disassembly:
mov edx, dword [ebp - 0x4d0]
add edx, 1
mov dword [ebp - 0x4d0], edx
push eax
jmp 0x408684
or eax, 0x12b28
pop eax
push eax
push edx
add esp, 4
jmp 0x408696
or eax, 0x27ed
pop eax
push ebx
and ebx, 0x110b3
pop ebx
push edi
and edi, 0xe7df
out 0xdf, eax
out 0, eax
add byte [edi - 0x75], bl
test dword [eax], esi
sti
invalid
jmp [ebx]
test dword [eax - 4], eax
invalid
inc dword [ebx + 0x3772fff8]
push ebx
or ebx, 0x7b98
and ebx, 0x35d7
sub ebx, 0x15174
pop ebx
push edi
push ecx
add esp, 4
add edi, 0x16939
or edi, 0x15893
and edi, 0x1095e
jmp 0x4086ef
pop edi
jmp 0x408923
mov dword [ebp - 0xc10], 7
mov ecx, dword [ebp - 0x4d0]
lea esi, [eax]
sti
invalid
dec dword [ecx - 0xa5f73]
invalid
push ecx
push ebx
add esp, 4
jmp 0x408719
xor ecx, 0xc557
pop ecx
push esi
add esi, 0x6d33
sub esi, 0x8af8
sub esi, 0xb836
jmp 0x40873c
pop esi
mov edx, dword [ebp - 0x14c8]
mov dword [ebp - 0x9f0], edx
mov dword [ebp - 0xc14], 0
mov eax, dword [ebp - 0x4d0]
cmp eax, dword [ebp - 0x14c8]
jne 0x4087a4
push eax
push edx
add esp, 4
add eax, 0x10d7e
xor eax, 0x56cd
sub eax, 0x12ad5
sub al, byte [ecx]
add byte [eax + 0x51], bl
add ecx, 0x13c1f
and ecx, 0x10f93
xor ecx, 0x758c
sub ecx, 0x1061a
pop ecx
mov ecx, dword [ebp - 0xc14]
mov dword [ebp - 0x14d0], ecx
jmp 0x4088d5
cmp dword [ebp - 0xc10], 0
jle 0x4088c9
push ebx
push ecx
add esp, 4
add ebx, 0x14a2a
pop ebx
push edx
sub edx, 0x2290
and al, byte [eax]
add byte [ecx + 0xc075c2], al
add byte [ecx + 0x60aef2], al
add byte [edx + 0x52], bl
push eax
add esp, 4
xor edx, 0x17392
add edx, 0xe0c2
pop edx
mov edx, dword [ebp - 0xa60]
movzx eax, byte [edx]
invalid
invalid
Function at 0x4090a2
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edi
push edx
add esp, 4
and edi, 0x1403e
or edi, 0x97d9
pop edi
push edi
call fcn.004090a2
add byte [ebx], bh
xor edi, dword [edi]
xor bh, byte [esi + esi]
cmp al, byte [edx + 0x4b]
add esp, 4
xor edi, 0x1047b
jmp 0x4090b1
pop edi
lea edx, [ebp - 0x16cc]
mov dword [ebp - 0xc28], edx
mov eax, dword [ebp - 0x4d8]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc24], ecx
xor edx, edx
mov word [ebp - 0x1fc], dx
xor eax, eax
mov word [ebp - 0x104], ax
push esi
call 0x4090ef
add byte [ecx + 0x3a], cl
inc ecx
xor al, 0x49
aaa
dec edi
dec ebx
add esp, 4
jmp 0x4090fa
pop esi
push esi
push ecx
add esp, 4
jmp 0x409107
jmp 0x409110
pop esi
mov ecx, dword [ebp - 0xc24]
mov dx, word [ecx]
mov word [ebp - 0xf82], dx
mov eax, dword [ebp - 0xc24]
add eax, 2
mov dword [ebp - 0xc24], eax
mov cx, word [ebp - 0xf82]
mov word [ebp - 0x1fc], cx
mov edx, dword [ebp - 0xc28]
mov ax, word [edx]
mov word [ebp - 0xf84], ax
mov ecx, dword [ebp - 0xc28]
add ecx, 2
mov dword [ebp - 0xc28], ecx
mov dx, word [ebp - 0xf84]
mov word [ebp - 0x104], dx
push ebx
sub ebx, 0x10f7a
pop ebx
push edi
push eax
add esp, 4
add edi, 0x597e
or edi, 0xea30
xor edi, 0x1762a
xor edi, 0x180a4
pop edi
push esi
push edx
add esp, 4
xor esi, 0x1442f
pop esi
movzx eax, word [ebp - 0x104]
test eax, eax
jne 0x4091c0
movzx ecx, word [ebp - 0x1fc]
movzx edx, word [ebp - 0x104]
sub ecx, edx
mov dword [ebp - 0x14e4], ecx
jmp 0x409223
movzx eax, word [ebp - 0x1fc]
movzx ecx, word [ebp - 0x104]
cmp eax, ecx
je 0x4090df
movzx edx, word [ebp - 0x1fc]
xor edx, 0x20
movzx eax, word [ebp - 0x104]
cmp edx, eax
je 0x4090df
movzx ecx, word [ebp - 0x1fc]
movzx edx, word [ebp - 0x104]
cmp ecx, edx
jge 0x40920d
mov dword [ebp - 0x14e0], 0xffffffff
jmp 0x409217
mov dword [ebp - 0x14e0], 1
mov eax, dword [ebp - 0x14e0]
mov dword [ebp - 0x14e4], eax
cmp dword [ebp - 0x14e4], 0
jne 0x40926c
push ecx
push ebx
add esp, 4
add ecx, 0xc0
xor ecx, 0xd40b
sub ecx, 0x7ba3
add ecx, 0x85eb
pop ecx
push edi
and edi, 0x8a3e
pop edi
push edx
push ebx
add esp, 4
xor edx, 0x3c82
pop edx
mov ecx, dword [ebp - 0x4d8]
mov dword [ebp - 0x6ec], ecx
jmp 0x4092d4
push edx
xor edx, 0xc6be
or edx, 0x395f
sub edx, 0xd44d
add edx, 0x67ce
pop edx
push edx
push esi
add esp, 4
xor edx, 0x16c2a
xor edx, 0xf447
add edx, 0xff1a
pop edx
mov edx, dword [ebp - 0x4d8]
mov eax, dword [edx]
mov dword [ebp - 0x4d8], eax
mov ecx, dword [ebp - 0x4d8]
cmp ecx, dword [ebp - 0xc2c]
je 0x4092ca
mov edx, dword [ebp - 0x4d8]
cmp dword [edx + 0x30], 0
jne 0x409080
mov dword [ebp - 0x6ec], 0
Function at 0x4090ef
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edi
push edx
add esp, 4
and edi, 0x1403e
or edi, 0x97d9
pop edi
push edi
call fcn.004090a2
add byte [ebx], bh
xor edi, dword [edi]
xor bh, byte [esi + esi]
cmp al, byte [edx + 0x4b]
add esp, 4
xor edi, 0x1047b
jmp 0x4090b1
pop edi
lea edx, [ebp - 0x16cc]
mov dword [ebp - 0xc28], edx
mov eax, dword [ebp - 0x4d8]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc24], ecx
xor edx, edx
mov word [ebp - 0x1fc], dx
xor eax, eax
mov word [ebp - 0x104], ax
push esi
call 0x4090ef
add byte [ecx + 0x3a], cl
inc ecx
xor al, 0x49
aaa
dec edi
dec ebx
add esp, 4
jmp 0x4090fa
pop esi
push esi
push ecx
add esp, 4
jmp 0x409107
jmp 0x409110
pop esi
mov ecx, dword [ebp - 0xc24]
mov dx, word [ecx]
mov word [ebp - 0xf82], dx
mov eax, dword [ebp - 0xc24]
add eax, 2
mov dword [ebp - 0xc24], eax
mov cx, word [ebp - 0xf82]
mov word [ebp - 0x1fc], cx
mov edx, dword [ebp - 0xc28]
mov ax, word [edx]
mov word [ebp - 0xf84], ax
mov ecx, dword [ebp - 0xc28]
add ecx, 2
mov dword [ebp - 0xc28], ecx
mov dx, word [ebp - 0xf84]
mov word [ebp - 0x104], dx
push ebx
sub ebx, 0x10f7a
pop ebx
push edi
push eax
add esp, 4
add edi, 0x597e
or edi, 0xea30
xor edi, 0x1762a
xor edi, 0x180a4
pop edi
push esi
push edx
add esp, 4
xor esi, 0x1442f
pop esi
movzx eax, word [ebp - 0x104]
test eax, eax
jne 0x4091c0
movzx ecx, word [ebp - 0x1fc]
movzx edx, word [ebp - 0x104]
sub ecx, edx
mov dword [ebp - 0x14e4], ecx
jmp 0x409223
movzx eax, word [ebp - 0x1fc]
movzx ecx, word [ebp - 0x104]
cmp eax, ecx
je 0x4090df
movzx edx, word [ebp - 0x1fc]
xor edx, 0x20
movzx eax, word [ebp - 0x104]
cmp edx, eax
je 0x4090df
movzx ecx, word [ebp - 0x1fc]
movzx edx, word [ebp - 0x104]
cmp ecx, edx
jge 0x40920d
mov dword [ebp - 0x14e0], 0xffffffff
jmp 0x409217
mov dword [ebp - 0x14e0], 1
mov eax, dword [ebp - 0x14e0]
mov dword [ebp - 0x14e4], eax
cmp dword [ebp - 0x14e4], 0
jne 0x40926c
push ecx
push ebx
add esp, 4
add ecx, 0xc0
xor ecx, 0xd40b
sub ecx, 0x7ba3
add ecx, 0x85eb
pop ecx
push edi
and edi, 0x8a3e
pop edi
push edx
push ebx
add esp, 4
xor edx, 0x3c82
pop edx
mov ecx, dword [ebp - 0x4d8]
mov dword [ebp - 0x6ec], ecx
jmp 0x4092d4
push edx
xor edx, 0xc6be
or edx, 0x395f
sub edx, 0xd44d
add edx, 0x67ce
pop edx
push edx
push esi
add esp, 4
xor edx, 0x16c2a
xor edx, 0xf447
add edx, 0xff1a
pop edx
mov edx, dword [ebp - 0x4d8]
mov eax, dword [edx]
mov dword [ebp - 0x4d8], eax
mov ecx, dword [ebp - 0x4d8]
cmp ecx, dword [ebp - 0xc2c]
je 0x4092ca
mov edx, dword [ebp - 0x4d8]
cmp dword [edx + 0x30], 0
jne 0x409080
mov dword [ebp - 0x6ec], 0
Function at 0x4099a4
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x4099ae
pop edi
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x4099cc
movzx ecx, word [ebp - 0x200]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x14fc], ecx
jmp 0x409a26
movzx eax, word [ebp - 0x200]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x4098f4
movzx edx, word [ebp - 0x200]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x4098f4
movzx ecx, word [ebp - 0x200]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x409a10
mov dword [ebp - 0x14f8], 0xffffffff
jmp 0x409a1a
mov dword [ebp - 0x14f8], 1
mov eax, dword [ebp - 0x14f8]
mov dword [ebp - 0x14fc], eax
cmp dword [ebp - 0x14fc], 0
jne 0x409a6f
push esi
push esi
add esp, 4
add esi, 0xd7b5
sub esi, 0xce73
sub esi, 0xcdf1
xor esi, 0x941b
pop esi
push ebx
call 0x409a5d
add byte [edx], dh
inc esi
cmp al, 0x4c
xor cl, byte [edi + 0x34]
inc edi
dec ebx
add esp, 4
pop ebx
mov ecx, dword [ebp - 0x4dc]
mov dword [ebp - 0x2e0], ecx
jmp 0x409ad7
push esi
or esi, 0x3536
call 0x409a85
add byte [edx + esi + 0x36], cl
inc esi
aas
cmp al, 0x32
dec edx
add esp, 4
sub esi, 0x4335
pop esi
push ecx
push esi
add esp, 4
xor ecx, 0xa9db
and ecx, 0xb66c
pop ecx
mov edx, dword [ebp - 0x4dc]
mov eax, dword [edx]
mov dword [ebp - 0x4dc], eax
mov ecx, dword [ebp - 0x4dc]
cmp ecx, dword [ebp - 0xc3c]
je 0x409acd
mov edx, dword [ebp - 0x4dc]
cmp dword [edx + 0x30], 0
jne 0x409898
mov dword [ebp - 0x2e0], 0

Function at 0x409a5d
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x4099ae
pop edi
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x4099cc
movzx ecx, word [ebp - 0x200]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x14fc], ecx
jmp 0x409a26
movzx eax, word [ebp - 0x200]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x4098f4
movzx edx, word [ebp - 0x200]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x4098f4
movzx ecx, word [ebp - 0x200]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x409a10
mov dword [ebp - 0x14f8], 0xffffffff
jmp 0x409a1a
mov dword [ebp - 0x14f8], 1
mov eax, dword [ebp - 0x14f8]
mov dword [ebp - 0x14fc], eax
cmp dword [ebp - 0x14fc], 0
jne 0x409a6f
push esi
push esi
add esp, 4
add esi, 0xd7b5
sub esi, 0xce73
sub esi, 0xcdf1
xor esi, 0x941b
pop esi
push ebx
call 0x409a5d
add byte [edx], dh
inc esi
cmp al, 0x4c
xor cl, byte [edi + 0x34]
inc edi
dec ebx
add esp, 4
pop ebx
mov ecx, dword [ebp - 0x4dc]
mov dword [ebp - 0x2e0], ecx
jmp 0x409ad7
push esi
or esi, 0x3536
call 0x409a85
add byte [edx + esi + 0x36], cl
inc esi
aas
cmp al, 0x32
dec edx
add esp, 4
sub esi, 0x4335
pop esi
push ecx
push esi
add esp, 4
xor ecx, 0xa9db
and ecx, 0xb66c
pop ecx
mov edx, dword [ebp - 0x4dc]
mov eax, dword [edx]
mov dword [ebp - 0x4dc], eax
mov ecx, dword [ebp - 0x4dc]
cmp ecx, dword [ebp - 0xc3c]
je 0x409acd
mov edx, dword [ebp - 0x4dc]
cmp dword [edx + 0x30], 0
jne 0x409898
mov dword [ebp - 0x2e0], 0
Function at 0x409a85
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x4099ae
pop edi
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x4099cc
movzx ecx, word [ebp - 0x200]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x14fc], ecx
jmp 0x409a26
movzx eax, word [ebp - 0x200]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x4098f4
movzx edx, word [ebp - 0x200]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x4098f4
movzx ecx, word [ebp - 0x200]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x409a10
mov dword [ebp - 0x14f8], 0xffffffff
jmp 0x409a1a
mov dword [ebp - 0x14f8], 1
mov eax, dword [ebp - 0x14f8]
mov dword [ebp - 0x14fc], eax
cmp dword [ebp - 0x14fc], 0
jne 0x409a6f
push esi
push esi
add esp, 4
add esi, 0xd7b5
sub esi, 0xce73
sub esi, 0xcdf1
xor esi, 0x941b
pop esi
push ebx
call 0x409a5d
add byte [edx], dh
inc esi
cmp al, 0x4c
xor cl, byte [edi + 0x34]
inc edi
dec ebx
add esp, 4
pop ebx
mov ecx, dword [ebp - 0x4dc]
mov dword [ebp - 0x2e0], ecx
jmp 0x409ad7
push esi
or esi, 0x3536
call 0x409a85
add byte [edx + esi + 0x36], cl
inc esi
aas
cmp al, 0x32
dec edx
add esp, 4
sub esi, 0x4335
pop esi
push ecx
push esi
add esp, 4
xor ecx, 0xa9db
and ecx, 0xb66c
pop ecx
mov edx, dword [ebp - 0x4dc]
mov eax, dword [edx]
mov dword [ebp - 0x4dc], eax
mov ecx, dword [ebp - 0x4dc]
cmp ecx, dword [ebp - 0xc3c]
je 0x409acd
mov edx, dword [ebp - 0x4dc]
cmp dword [edx + 0x30], 0
jne 0x409898
mov dword [ebp - 0x2e0], 0
Function at 0x409e02
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x704]
add edx, 1
mov dword [ebp - 0x704], edx
add esp, 4
pop ebx
mov eax, dword [ebp - 0x708]
add eax, dword [ebp - 0x184]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x184]
movsx eax, byte [ebp + edx - 0x804]
or eax, 0x20
cmp ecx, eax
jge 0x409e39
mov dword [ebp - 0xc40], 0xffffffff
jmp 0x409e43
mov dword [ebp - 0xc40], 1
cmp dword [ebp - 0xc40], 0
jne 0x409e5a
mov ecx, dword [ebp - 0x18cc]
mov dword [ebp - 0x4e0], ecx
jmp 0x409e6b
jmp 0x409c44
Function at 0x409e9d
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp esi, dword ss:[edx]
add esp, 4
pop edi
push esi
and esi, 0x180e5
pop esi
mov ecx, dword [ebp - 0x3cc]
add ecx, 0xe
mov dword [ebp - 0x1918], ecx
push edi
call 0x409ec8
add byte [edx + 0x4e], cl
dec eax
inc edi
cmp ecx, dword [edx + 0x37]
cmp dh, byte [edx]
add esp, 4
jmp 0x409ed1
pop edi
push esi
push esi
add esp, 4
add esi, 0x39cc
pop esi
push edx
push edi
add esp, 4
or edx, 0x9555
pop edx
cmp dword [ebp - 0x3cc], 0
je 0x409efc
cmp dword [ebp - 0xa5c], 0
jne 0x409f42
push eax
or eax, 0x528f
jmp 0x409f09
or eax, 0x13323
pop eax
push ecx
push eax
add esp, 4
add ecx, 0xf1
or ecx, 0xc551
xor ecx, 0x5e19
sub ecx, 0x11452
pop ecx
mov edx, dword [ebp - 0x738]
mov dword [ebp - 0x18d0], edx
push 0
call dword [ebp - 0x18d0]
mov dword [ebp - 0x1fb0], 0xa
push ebx
or ebx, 0xa78c
or ebx, 0x87a9
pop ebx
push edi
push edx
add esp, 4
sub edi, 0x4e46
call 0x409f74
add byte [ebp + 0x3a], al
cmp eax, 0x4a35334a
dec eax
cmp al, 0x83
les eax, [ecx + eax*4]
out 0x2d, eax
cmp al, 1
add byte [edi - 0x75], bl
test dword [esp + edi*8], esi
invalid

Function at 0x409ec8
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp esi, dword ss:[edx]
add esp, 4
pop edi
push esi
and esi, 0x180e5
pop esi
mov ecx, dword [ebp - 0x3cc]
add ecx, 0xe
mov dword [ebp - 0x1918], ecx
push edi
call 0x409ec8
add byte [edx + 0x4e], cl
dec eax
inc edi
cmp ecx, dword [edx + 0x37]
cmp dh, byte [edx]
add esp, 4
jmp 0x409ed1
pop edi
push esi
push esi
add esp, 4
add esi, 0x39cc
pop esi
push edx
push edi
add esp, 4
or edx, 0x9555
pop edx
cmp dword [ebp - 0x3cc], 0
je 0x409efc
cmp dword [ebp - 0xa5c], 0
jne 0x409f42
push eax
or eax, 0x528f
jmp 0x409f09
or eax, 0x13323
pop eax
push ecx
push eax
add esp, 4
add ecx, 0xf1
or ecx, 0xc551
xor ecx, 0x5e19
sub ecx, 0x11452
pop ecx
mov edx, dword [ebp - 0x738]
mov dword [ebp - 0x18d0], edx
push 0
call dword [ebp - 0x18d0]
mov dword [ebp - 0x1fb0], 0xa
push ebx
or ebx, 0xa78c
or ebx, 0x87a9
pop ebx
push edi
push edx
add esp, 4
sub edi, 0x4e46
call 0x409f74
add byte [ebp + 0x3a], al
cmp eax, 0x4a35334a
dec eax
cmp al, 0x83
les eax, [ecx + eax*4]
out 0x2d, eax
cmp al, 1
add byte [edi - 0x75], bl
test dword [esp + edi*8], esi
invalid
Function at 0x409f74
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp esi, dword ss:[edx]
add esp, 4
pop edi
push esi
and esi, 0x180e5
pop esi
mov ecx, dword [ebp - 0x3cc]
add ecx, 0xe
mov dword [ebp - 0x1918], ecx
push edi
call 0x409ec8
add byte [edx + 0x4e], cl
dec eax
inc edi
cmp ecx, dword [edx + 0x37]
cmp dh, byte [edx]
add esp, 4
jmp 0x409ed1
pop edi
push esi
push esi
add esp, 4
add esi, 0x39cc
pop esi
push edx
push edi
add esp, 4
or edx, 0x9555
pop edx
cmp dword [ebp - 0x3cc], 0
je 0x409efc
cmp dword [ebp - 0xa5c], 0
jne 0x409f42
push eax
or eax, 0x528f
jmp 0x409f09
or eax, 0x13323
pop eax
push ecx
push eax
add esp, 4
add ecx, 0xf1
or ecx, 0xc551
xor ecx, 0x5e19
sub ecx, 0x11452
pop ecx
mov edx, dword [ebp - 0x738]
mov dword [ebp - 0x18d0], edx
push 0
call dword [ebp - 0x18d0]
mov dword [ebp - 0x1fb0], 0xa
push ebx
or ebx, 0xa78c
or ebx, 0x87a9
pop ebx
push edi
push edx
add esp, 4
sub edi, 0x4e46
call 0x409f74
add byte [ebp + 0x3a], al
cmp eax, 0x4a35334a
dec eax
cmp al, 0x83
les eax, [ecx + eax*4]
out 0x2d, eax
cmp al, 1
add byte [edi - 0x75], bl
test dword [esp + edi*8], esi
invalid

Function at 0x40a0ee
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ecx
or al, 0x8b
inc edx
or al, 0x89
test dword [ebx + esi*8 + 0x5650ffff], esi
add esp, 4
sub eax, 0xac07
pop eax
push eax
sub eax, 0x16e6c
pop eax
push ecx
push ecx
add esp, 4
sub ecx, 0x28be
add ecx, 0x1536c
add byte [ecx + 0x56], bl
Function at 0x40a15c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [ecx + 0x56], bl
push esi
add esp, 4
xor esi, 0x8fea
pop esi
cmp dword [ebp - 0xc4c], 0
jne 0x40a143
mov dword [ebp - 0x2a8], 0
jmp 0x40a38e
mov ecx, dword [ebp - 0xc4c]
mov dword [ebp - 0x4e4], ecx
push eax
call 0x40a15c
add byte [ebx], bh
dec edx
cmp al, byte [ebx + 0x35]
dec ebp
add esp, 4
pop eax
push ecx
jmp 0x40a169
and ecx, 0xab60
pop ecx
push ecx
push edi
add esp, 4
jmp 0x40a17a
xor ecx, 0xfac1
pop ecx
lea edx, [ebp - 0x1628]
mov dword [ebp - 0xc48], edx
mov eax, dword [ebp - 0x4e4]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc44], ecx
xor edx, edx
mov word [ebp - 0x204], dx
xor eax, eax
mov word [ebp - 0x38], ax
push ebx
and ebx, 0x1143e
jmp 0x40a1ba
add ebx, 0x3a18
pop ebx
push ecx
and ecx, 0x10d48
xor ecx, 0xd0f9
pop ecx
push edx
sub edx, 0x17ed0
or edx, 0x6574
pop edx
mov ecx, dword [ebp - 0xc44]
mov dx, word [ecx]
mov word [ebp - 0xf8a], dx
mov eax, dword [ebp - 0xc44]
add eax, 2
mov dword [ebp - 0xc44], eax
mov cx, word [ebp - 0xf8a]
mov word [ebp - 0x204], cx
mov edx, dword [ebp - 0xc48]
mov ax, word [edx]
mov word [ebp - 0xf8c], ax
mov ecx, dword [ebp - 0xc48]
add ecx, 2
mov dword [ebp - 0xc48], ecx
mov dx, word [ebp - 0xf8c]
mov word [ebp - 0x38], dx
push edi
jmp 0x40a23a
and edi, 0x80cf
pop edi
push ecx
push ecx
add esp, 4
and ecx, 0xdeb0
sub ecx, 0xcda7
pop ecx
push ebx
add ebx, 0x127
pop ebx
push ebx
jmp 0x40a265
pop ebx
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x40a283
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x1514], ecx
jmp 0x40a2dd
movzx eax, word [ebp - 0x204]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x40a1ab
movzx edx, word [ebp - 0x204]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x40a1ab
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x40a2c7
mov dword [ebp - 0x1510], 0xffffffff
jmp 0x40a2d1
mov dword [ebp - 0x1510], 1
mov eax, dword [ebp - 0x1510]
mov dword [ebp - 0x1514], eax
cmp dword [ebp - 0x1514], 0
jne 0x40a326
push eax
push esi
add esp, 4
add eax, 0x16af7
jmp 0x40a2f8
pop eax
push ebx
sub ebx, 0x59e0
call 0x40a30e
push edi
add edi, 0x938f
sub edi, 0x122d7
pop edi
push esi
push ecx
add esp, 4
or esi, 0xb047
pop esi
push esi
jmp 0x40a346
jmp 0x40a34c
jmp 0x40a351
or esi, 0x17859
pop esi
mov edx, dword [ebp - 0x4e4]
mov eax, dword [edx]
mov dword [ebp - 0x4e4], eax
mov ecx, dword [ebp - 0x4e4]
cmp ecx, dword [ebp - 0xc4c]
je 0x40a384
mov edx, dword [ebp - 0x4e4]
cmp dword [edx + 0x30], 0
jne 0x40a14f
mov dword [ebp - 0x2a8], 0

Function at 0x40a30e
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [esi], dh
cmp eax, 0x36393a4c
aas
inc ebp
add esp, 4
xor ebx, 0x129ea
pop ebx
mov ecx, dword [ebp - 0x4e4]
mov dword [ebp - 0x2a8], ecx
jmp 0x40a38e
push ebx
push edi
add esp, 4
xor ebx, 0x5539
pop ebx
push edx
xor edx, 0x30ea
xor edx, 0xd38
jmp 0x40a3af
pop edx
push esi
jmp 0x40a3b9
xor esi, 0x109bb
pop esi
cmp dword [ebp - 0x2a8], 0
jne 0x40acc5
mov eax, 0x6b
mov word [ebp - 0x16e8], ax
invalid
invalid
Function at 0x40ab1c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x188]
add edx, 1
mov dword [ebp - 0x188], edx
mov eax, dword [ebp - 0x71c]
add eax, dword [ebp - 0x188]
movsx ecx, byte [eax]
test ecx, ecx
je 0x40aaf4
mov edx, dword [ebp - 0x188]
movsx eax, byte [ebp + edx - 0x830]
idiv edi
inc dword [ebp - 0x7a7bf040]
add byte [eax], al
invalid
push edx
or edx, 0x119e
call fcn.0040aa85
add byte [edi], dh
inc esi
cmp cl, byte [eax + 0x3e]
inc eax
dec esi
dec esp
dec esp
or esi, 0x17e01
pop esi
mov ecx, dword [ebp - 0x71c]
add ecx, dword [ebp - 0x188]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x188]
movsx ecx, byte [ebp + eax - 0x830]
cmp edx, ecx
je 0x40aae6
mov edx, dword [ebp - 0x71c]
add edx, dword [ebp - 0x188]
movsx eax, byte [edx]
xor eax, 0x20
mov ecx, dword [ebp - 0x188]
movsx edx, byte [ebp + ecx - 0x830]
cmp eax, edx
jne 0x40aaed
jmp 0x40aa33
jmp 0x40aaf4
push ebx
add ebx, 0x129ee
call 0x40ab09
add byte [edi + 0x3c], cl
dec edx
dec edx
cmp al, 0x43
cmp byte [ebx - 0x7d], al
les eax, [eax + ebp*8]
or eax, dword [eax]
add byte [eax], al
add byte [esi + 0x4b], cl
aas
dec edi
inc eax
dec esi
cmp eax, dword [ebx + 0x40]
xor al, byte [ebx - 0xc7efb3c]
fld qword [edi - 0x74a50000]
test esp, esp
clc
invalid

Function at 0x40ac0b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
and edx, 0x181c9
pop edx
push edx
and edx, 0x2b92
pop edx
push eax
push edi
add esp, 4
sub eax, 0xb271
pop eax
mov ecx, dword [ebp - 0x3c8]
mov dword [ebp - 0x18f0], ecx
push edx
add edx, 0x9769
pop edx
push eax
push edi
add esp, 4
jmp 0x40ac49
xor eax, 0x11be2
add eax, 0x15f85
call 0x40ac63
add byte [ebx], bh
aas
xor al, 0x50
inc ebx
aas
xor eax, 0x4c4834c
pop eax
mov edx, dword [ebp - 0x18f0]
mov dword [ebp - 0x18f4], edx
lea eax, [ebp - 0x1628]
push eax
call dword [ebp - 0x18f4]
test eax, eax
jne 0x40acc5
push ebx
or ebx, 0xedbe
sub ebx, 0x147fa
or ebx, 0x10530
invalid
retf

Function at 0x40ac63
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
and edx, 0x181c9
pop edx
push edx
and edx, 0x2b92
pop edx
push eax
push edi
add esp, 4
sub eax, 0xb271
pop eax
mov ecx, dword [ebp - 0x3c8]
mov dword [ebp - 0x18f0], ecx
push edx
add edx, 0x9769
pop edx
push eax
push edi
add esp, 4
jmp 0x40ac49
xor eax, 0x11be2
add eax, 0x15f85
call 0x40ac63
add byte [ebx], bh
aas
xor al, 0x50
inc ebx
aas
xor eax, 0x4c4834c
pop eax
mov edx, dword [ebp - 0x18f0]
mov dword [ebp - 0x18f4], edx
lea eax, [ebp - 0x1628]
push eax
call dword [ebp - 0x18f4]
test eax, eax
jne 0x40acc5
push ebx
or ebx, 0xedbe
sub ebx, 0x147fa
or ebx, 0x10530
invalid
retf