joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e1e0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3a8
push ebx
push edi
push 0x3a4
lea eax, [esp + 0x10]
push 0
push eax
mov dword [esp + 0x14], 0x3a8
call fcn.004131f0
add esp, 0xc
cmp dword [esi + 0x188], 0
jne 0x40e21f
mov ecx, dword [0x4a7cec]
mov dword [esi + 0x188], ecx
cmp dword [esi + 0x194], 0
jne 0x40e239
mov eax, dword [0x4a7cf0]
mov dword [esi + 0x194], eax
mov dword [esi + 0x198], eax
cmp dword [esi + 0x1a0], 0
jne 0x40e24e
mov ecx, dword [0x4a7cf4]
mov dword [esi + 0x1a0], ecx
mov eax, dword [esi + 0x18c]
lea edi, [esi + 0x190]
test eax, eax
jne 0x42aa0b
mov edx, dword [0x4972c0]
mov dword [esi + 0x18c], 0
mov byte [edi], 0
cmp dword [esi + 0x40], 0
mov ebx, 1
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], 0x401
mov dword [esp + 0x1c], 0
jne 0x42aa20
mov eax, dword [esi + 0x188]
mov dword [esp + 0x1c], eax
mov dword [esi + 0x18c], eax
cmp byte [0x497292], bl
je 0x42aa50
lea ecx, [esp + 8]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov byte [0x497292], bl
mov eax, esi
call fcn.00401e70
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
add dword [eax], eax
add byte [eax], al

Function at 0x40e7e0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, eax
mov ebx, 5
cmp dword [edi + 8], ebx
je 0x42b34a
call fcn.0040e8f0
test esi, esi
je 0x40e833
cmp dword [edi + 8], ebx
jne 0x42b354
mov eax, dword [edi]
mov dword [eax + 0x210], 0
test esi, esi
jle 0x40e833
push ebp
lea ebx, [esp + 0x14]
mov ebp, esi
mov esi, dword [ebx + 4]
add ebx, 4
mov edx, edi
call fcn.0040d0f0
sub ebp, 1
jne 0x40e820
pop ebp
mov eax, dword [edi]
mov ecx, dword [eax + 0x210]
mov dword [eax + 0x20c], ecx
mov edx, dword [edi]
mov dword [edx + 8], 1
mov eax, dword [edi]
cmp dword [eax + 0x20c], 0
jle 0x40e891
xor edx, edx
mov ecx, 0xc
lea esp, [esp]
mov esi, dword [ecx + eax + 0x100]
mov dword [ecx + eax], esi
mov eax, dword [edi]
mov esi, dword [ecx + eax]
imul esi, dword [eax + 8]
mov dword [eax + 8], esi
mov eax, dword [edi]
cmp dword [eax + 8], 0x1000000
jg 0x42b360
inc edx
add ecx, 4
cmp edx, dword [eax + 0x20c]
jl 0x40e860
mov eax, dword [edi]
mov eax, dword [eax + 8]
xor ecx, ecx
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041171a
mov ecx, dword [edi]
push 4
mov dword [ecx], eax
call fcn.0041171a
add esp, 8
test eax, eax
je 0x40e8ea
mov dword [eax], 1
mov edx, dword [edi]
mov dword [edx + 4], eax
mov eax, dword [edi]
cmp dword [eax + 8], 0
jle 0x40e8e4
xor ecx, ecx
mov eax, dword [eax]
mov dword [eax + ecx*4], 0
mov eax, dword [edi]
inc ecx
cmp ecx, dword [eax + 8]
jl 0x40e8d3
pop edi
pop esi
mov al, 1
pop ebx
ret
xor eax, eax
jmp 0x40e8c4
out 0xff, eax
dec dword [ecx - 0x14d36b]
call dword [edx - 0x7f]
retf 0xcc6b
cmp eax, 0x343a3b4c
Function at 0x40e940
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ecx
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0x14]
test eax, eax
jg 0x42adeb
test ecx, ecx
jne 0x42ad4f
test edx, edx
jne 0x42ad6a
test esi, esi
jne 0x42ad82
test edi, edi
jne 0x42ad9d
test ebx, ebx
jne 0x42adb8
test ebp, ebp
jne 0x42add3
xor eax, eax
pop ebp
pop ecx
ret 0xc
std
invalid
add al, 0xeb
add al, 0x42
aaa
cmp bh, byte [0x8356565f]
les eax, [ecx + eax*4]
into
jle 0x42ad5d
add byte [eax], al
add byte [esi - 0x39], bl
test dword [esp + edi*8], esi
invalid
add byte [eax], al
add byte [eax], al
dec ecx
xor eax, 0x433b4539
add byte [ecx + 0xda4f0], al
add byte [eax + 0x50], bl
add eax, 0x37434543
dec ebx

Function at 0x40f110
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [esp + 0x14]
lea ecx, [eax + eax]
lea eax, [esp]
push eax
xor edx, edx
push 1
push edx
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x18]
mov word [esi], dx
mov edx, dword [esp + 0x14]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40f15f
mov ecx, dword [esp + 0x10]
mov edx, dword [esp]
lea eax, [esp + 0x14]
push eax
push esi
push 0
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ecx
ret

Function at 0x40f1a0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ecx
push edi
mov edi, eax
cmp dword [edi + 0xc], 0
jne 0x40f1ba
lea ecx, [esp + 0xc]
call fcn.00402620
xor eax, eax
pop edi
pop ecx
ret 0x10
push ebx
push esi
lea esi, [esp + 0x14]
call fcn.00410a40
mov ebx, dword [edi + 8]
test ebx, ebx
jne 0x42a935
mov esi, dword [edi]
test esi, esi
je 0x40f1ee
lea eax, [esp + 0x14]
call fcn.0040dd00
test al, al
jne 0x42a925
mov esi, dword [esi + 0x20]
test esi, esi
jne 0x40f1d6
lea ecx, [esp + 0x14]
call fcn.00402620
xor eax, eax
pop esi
pop ebx
pop edi
pop ecx
ret 0x10
test dword [esp + esi*8 - 0x39ef0001], ecx
test dword [ebp + 0x10fffff4], ecx
hlt

Function at 0x40f3b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x58
push ebx
push edi
mov edi, eax
mov al, byte [0x497290]
mov byte [esi + 3], al
cmp word [edi], 0
je 0x42ccf4
mov eax, edi
mov ecx, edi
call fcn.0040ffb0
mov ebx, edi
call fcn.00410130
mov ecx, dword [esp + 0x64]
push ecx
mov edx, edi
mov ebx, esi
call fcn.00410020
push eax
push esi
mov eax, edi
call fcn.0040f400
pop edi
pop ebx
add esp, 0x58
ret 4
outsd dx, dword [esi]
jb 0x42ccbc
test edx, ebx
idiv edi
invalid
Function at 0x40f400
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x58
push ebx
push ebp
mov ebp, dword [esp + 0x64]
push esi
push edi
mov esi, eax
push esi
lea edi, [esp + 0x30]
call fcn.0040f5e0
test eax, eax
je 0x42ca37
mov ebx, dword [esp + 0x74]
cmp dword [ebx], 4
je 0x42ca1f
mov edx, dword [esp + 0x70]
push 0
push 0x4848e8
push esi
push edx
push esi
push ebp
mov dword [ebx], 2
call fcn.004037e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret 0xc
push esi
push ebx
add esp, 4
call 0x42c977
add byte [esi + 0x45], al
dec ebp
aas
dec esp
inc ecx
add esp, 4
or esi, 0x163c1
pop esi
push eax
jmp 0x42c98b
xor eax, 0xbdcc
sub eax, 0xa1d1
pop eax
lea edx, [ebp - 0x1628]
mov dword [ebp - 0xc48], edx
mov eax, dword [ebp - 0x4e4]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc44], ecx
xor edx, edx
mov word [ebp - 0x204], dx
xor eax, eax
mov word [ebp - 0x38], ax
push edi
push edi
add esp, 4
sub edi, 0x10129
pop edi
push esi
add esi, 0x13e55
add esi, 0x16eae
and esi, 0x14877
pop esi
push edi
push eax
add esp, 4
sub edi, 0x1b10
sub edi, 0x106fd
pop edi
mov ecx, dword [ebp - 0xc44]
mov dx, word [ecx]
mov word [ebp - 0xf8a], dx
mov eax, dword [ebp - 0xc44]
add eax, 2
mov dword [ebp - 0xc44], eax
mov cx, word [ebp - 0xf8a]
mov word [ebp - 0x204], cx
mov edx, dword [ebp - 0xc48]
mov ax, word [edx]
mov word [ebp - 0xf8c], ax
mov ecx, dword [ebp - 0xc48]
invalid
add ecx, 2
mov dword [ebp - 0xc48], ecx
mov dx, word [ebp - 0xf8c]
mov word [ebp - 0x38], dx
push ecx
push edi
add esp, 4
or ecx, 0x4919
pop ecx
push edx
jmp 0x42ca60
xor edx, 0xd7ea
pop edx
push eax
push ebx
add esp, 4
call 0x42ca79
add byte [edi + 0x46], cl
dec ebx
aas
cmp al, 0x3e
dec ebx
add esp, 4
pop eax
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x42ca9a
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x1514], ecx
jmp 0x42caf4
movzx eax, word [ebp - 0x204]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x42c9c2
movzx edx, word [ebp - 0x204]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x42c9c2
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x42cade
mov dword [ebp - 0x1510], 0xffffffff
jmp 0x42cae8
mov dword [ebp - 0x1510], 1
mov eax, dword [ebp - 0x1510]
mov dword [ebp - 0x1514], eax
cmp dword [ebp - 0x1514], 0
jne 0x42cb3d
push eax
push esi
add esp, 4
xor eax, 0x1069e
jmp 0x42cb10
and eax, 0xb2fb
pop eax
push edx
add edx, 0x124a
sub edx, 0xebd8
pop edx
push esi
jmp 0x42cb2e
pop esi
mov ecx, dword [ebp - 0x4e4]
mov dword [ebp - 0x2a8], ecx
jmp fcn.0042cba5
push edx
jmp 0x42cb45
sub edx, 0x160c8
or edx, 0x4ad8
pop edx
push edi
call 0x42cb60
add byte [edx + 0x46], al
inc ecx
inc eax
cmp eax, 0xc483324b
add al, 0xeb
add ecx, dword [ecx + 0x45]
inc esp
or edi, 0xa548
pop edi
mov edx, dword [ebp - 0x4e4]
mov eax, dword [edx]
mov dword [ebp - 0x4e4], eax
mov ecx, dword [ebp - 0x4e4]
cmp ecx, dword [ebp - 0xc4c]
je 0x42cb9b
mov edx, dword [ebp - 0x4e4]
cmp dword [edx + 0x30], 0
jne 0x42c966
mov dword [ebp - 0x2a8], 0
Function at 0x40f450
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x10020
call fcn.00425210
xor eax, eax
lea esp, [esp]
mov cl, byte [eax + 0x492380]
mov dl, byte [eax + 0x492378]
mov byte [esp + eax + 0xc], cl
mov byte [esp + eax + 0x14], dl
inc eax
cmp eax, 8
jl 0x40f460
lea eax, [esp]
push 0x4876e8
push eax
call fcn.00413990
push 4
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x2c]
push edx
call fcn.00410f70
add esp, 0x14
push ebx
push ebp
push esi
mov dword [esp + 0x14], 0
push edi
jmp 0x40f4b0
mov eax, dword [esp + 0x10034]
mov ecx, dword [eax]
push ecx
push 0x10000
lea edx, [esp + 0x38]
push 1
push edx
call fcn.004151b0
add esp, 0x10
cmp eax, 0x18
jl 0x40f531
mov ebp, eax
lea edi, [ebp - 0x14]
test edi, edi
jle 0x40f4fd
xor edx, edx
mov edi, edi
xor ecx, ecx
lea esi, [esp + edx + 0x30]
mov al, byte [esp + ecx + 0x1c]
cmp al, byte [esi + ecx]
je 0x40f521
cmp ecx, 0x14
je 0x42937a
inc edx
cmp edx, edi
jl 0x40f4e0
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x10034]
lea edx, [ecx + ebp - 0x14]
mov ecx, dword [eax]
push 1
push 0xffffffffffffffec
push ecx
mov dword [esp + 0x24], edx
call fcn.0041557c
add esp, 0xc
jmp 0x40f4b0
mov bl, byte [esp + ecx + 0x1d]
lea eax, [ecx + edx]
cmp bl, byte [esp + eax + 0x31]
je 0x40f543
inc ecx
jmp 0x40f4ef
mov eax, 3
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10020
ret 4
mov bl, byte [esp + ecx + 0x1e]
lea eax, [ecx + edx]
cmp bl, byte [esp + eax + 0x32]
je 0x40f555
add ecx, 2
jmp 0x40f4ef
mov bl, byte [esp + ecx + 0x1f]
lea eax, [ecx + edx]
cmp bl, byte [esp + eax + 0x33]
jne 0x429372
mov bl, byte [esp + ecx + 0x20]
lea eax, [ecx + edx]
cmp bl, byte [esp + eax + 0x34]
je 0x429361
add ecx, 4
jmp 0x40f4ef
add esp, 4
and esi, 0x2912
pop esi
push esi
add byte [eax], al
add byte [eax], al
dec eax
inc ecx
dec edx
Function at 0x4103e0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x4972c8]
push esi
push 0
mov esi, dword [sym.imp.USER32.dll_CreateWindowExW]
push eax
push 0
push 0
push 0x64
push 0x12c
push accept
push accept
push 0xcf0000
push str.AutoIt_v3
push str.AutoIt_v3
push 0
call esi
mov ecx, dword [0x4972c8]
push 0
push ecx
push 1
push eax
push 0
push 0
push 0
push 0
push 0x50b008c4
push 0
push str.edit
push 0
mov dword [0x4972c0], eax
call esi
mov edx, dword [0x4972c0]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push edx
mov dword [0x4972bc], eax
call esi
mov eax, dword [0x4972c0]
push 0
push eax
call esi
pop esi
ret

Function at 0x421fa7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x490e80]
jne 0x421fb1
repz ret
jmp fcn.00426243

Function at 0x422f38
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004169e0
and dword [ebp - 4], 0
cmp dword [0x496efc], 0
mov ebx, eax
jne 0x422fe9
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x42309a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x483de0
push edi
call esi
test eax, eax
je 0x42309a
push eax
call fcn.0041696e
mov dword [esp], 0x483dd0
push edi
mov dword [0x496efc], eax
call esi
push eax
call fcn.0041696e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x496f00], eax
call esi
push eax
call fcn.0041696e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x496f04], eax
call esi
push eax
call fcn.0041696e
pop ecx
mov dword [0x496f0c], eax
test eax, eax
je 0x422fe9
push 0x483d88
push edi
call esi
push eax
call fcn.0041696e
pop ecx
mov dword [0x496f08], eax
mov eax, dword [0x496f08]
cmp eax, ebx
je 0x423041
cmp dword [0x496f0c], ebx
je 0x423041
push eax
call fcn.004169e9
push dword [0x496f0c]
mov esi, eax
call fcn.004169e9
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x423041
test edi, edi
je 0x423041
call esi
test eax, eax
je 0x423038
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x423038
test byte [ebp - 0xc], 1
jne 0x423041
or dword [ebp + 0x10], 0x200000
jmp 0x42307a
mov eax, dword [0x496f00]
cmp eax, ebx
je 0x42307a
push eax
call fcn.004169e9
pop ecx
test eax, eax
je 0x42307a
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x42307a
mov eax, dword [0x496f04]
cmp eax, ebx
je 0x42307a
push eax
call fcn.004169e9
pop ecx
test eax, eax
je 0x42307a
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x496efc]
call fcn.004169e9
pop ecx
test eax, eax
je 0x42309a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x42309c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4271e3
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1fbc
push ebx
push esi
push edi
push edx
push edx
add esp, 4
or edx, 0xa6db
call 0x427209
add byte [eax + 0x40], cl
cmp byte [edi], dh
push eax
dec edi
push eax
xor al, byte [ecx - 0x7d]
les eax, [ecx + eax*4]
dec ecx
pop edx
add byte [eax], al
pop edx
push ebx
add ebx, 0xfce5
and ebx, 0x5760
pop ebx
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
mov word [ebp - 0x1ee4], dx
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push edx
push esi
add esp, 4
sub edx, 0xe319
add edx, 0x424d
or edx, 0x1063d
pop edx
push ebx
jmp 0x4272ef
xor ebx, 0xee3b
sub ebx, 0x17a87
xor ebx, 0xb5a6
pop ebx
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push eax
push edx
add esp, 4
or eax, 0x29b3
and eax, 0x92de
pop eax
push ecx
jmp 0x427355
pop ecx
push esi
jmp 0x427360
pop esi
push eax
sub eax, 0x1288e
xor eax, 0x12d76
pop eax
mov dword [ebp - 0x10], 1
push edi
or edi, 0xb32
and edi, 0x10981
call 0x427390
add byte [esp + ecx*2], bh
inc ebx
aaa
dec ebx
xor eax, 0x4c48337
xor edi, 0x129fe
pop edi
push ecx
xor ecx, 0xd46c
sub ecx, 0x17dba
pop ecx
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push edi
or edi, 0x1e32
pop edi
push edx
sub edx, 0x15f0c
or edx, 0x113ee
and edx, 0x3a1d
pop edx
push edi
xor edi, 0x1502d
xor edi, 0xe979
pop edi
push ebx
sub ebx, 0x13af6
pop ebx
push eax
push edx
add esp, 4
or eax, 0x6807
sub eax, 0x2555
pop eax
push edi
call 0x427426
add byte [0x363b3546], dh
dec esi
cmp byte [ebx + 0x525f04c4], al
and edx, 0x18bc
or edx, 0xfd4f
pop edx
mov dword [ebp - 0x2c], 1
push esi
push ecx
add esp, 4
xor esi, 0x3d1e
pop esi
push edi
and edi, 0xc893
call 0x42745f
add byte [edx], bh
cmp eax, 0x414b483d
dec ecx
add esp, 4
pop edi
push eax
or eax, 0x1557c
or eax, 0x11a9f
pop eax
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x138
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x427652
push eax
push esi
add esp, 4
or eax, 0x5d63
xor eax, 0x1428b
sub eax, 0x11de6
pop eax
push edi
call 0x427f1a
add byte [edx], bh
inc esi
inc edi
dec eax
xor edi, dword [edx]
dec edi
dec eax
xor eax, 0x8104c483
iretd
Function at 0x427209
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1fbc
push ebx
push esi
push edi
push edx
push edx
add esp, 4
or edx, 0xa6db
call 0x427209
add byte [eax + 0x40], cl
cmp byte [edi], dh
push eax
dec edi
push eax
xor al, byte [ecx - 0x7d]
les eax, [ecx + eax*4]
dec ecx
pop edx
add byte [eax], al
pop edx
push ebx
add ebx, 0xfce5
and ebx, 0x5760
pop ebx
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
mov word [ebp - 0x1ee4], dx
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push edx
push esi
add esp, 4
sub edx, 0xe319
add edx, 0x424d
or edx, 0x1063d
pop edx
push ebx
jmp 0x4272ef
xor ebx, 0xee3b
sub ebx, 0x17a87
xor ebx, 0xb5a6
pop ebx
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push eax
push edx
add esp, 4
or eax, 0x29b3
and eax, 0x92de
pop eax
push ecx
jmp 0x427355
pop ecx
push esi
jmp 0x427360
pop esi
push eax
sub eax, 0x1288e
xor eax, 0x12d76
pop eax
mov dword [ebp - 0x10], 1
push edi
or edi, 0xb32
and edi, 0x10981
call 0x427390
add byte [esp + ecx*2], bh
inc ebx
aaa
dec ebx
xor eax, 0x4c48337
xor edi, 0x129fe
pop edi
push ecx
xor ecx, 0xd46c
sub ecx, 0x17dba
pop ecx
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push edi
or edi, 0x1e32
pop edi
push edx
sub edx, 0x15f0c
or edx, 0x113ee
and edx, 0x3a1d
pop edx
push edi
xor edi, 0x1502d
xor edi, 0xe979
pop edi
push ebx
sub ebx, 0x13af6
pop ebx
push eax
push edx
add esp, 4
or eax, 0x6807
sub eax, 0x2555
pop eax
push edi
call 0x427426
add byte [0x363b3546], dh
dec esi
cmp byte [ebx + 0x525f04c4], al
and edx, 0x18bc
or edx, 0xfd4f
pop edx
mov dword [ebp - 0x2c], 1
push esi
push ecx
add esp, 4
xor esi, 0x3d1e
pop esi
push edi
and edi, 0xc893
call 0x42745f
add byte [edx], bh
cmp eax, 0x414b483d
dec ecx
add esp, 4
pop edi
push eax
or eax, 0x1557c
or eax, 0x11a9f
pop eax
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x138
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x427652
push eax
push esi
add esp, 4
or eax, 0x5d63
xor eax, 0x1428b
sub eax, 0x11de6
pop eax
push edi
call 0x427f1a
add byte [edx], bh
inc esi
inc edi
dec eax
xor edi, dword [edx]
dec edi
dec eax
xor eax, 0x8104c483
iretd
Function at 0x427390
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1fbc
push ebx
push esi
push edi
push edx
push edx
add esp, 4
or edx, 0xa6db
call 0x427209
add byte [eax + 0x40], cl
cmp byte [edi], dh
push eax
dec edi
push eax
xor al, byte [ecx - 0x7d]
les eax, [ecx + eax*4]
dec ecx
pop edx
add byte [eax], al
pop edx
push ebx
add ebx, 0xfce5
and ebx, 0x5760
pop ebx
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
mov word [ebp - 0x1ee4], dx
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push edx
push esi
add esp, 4
sub edx, 0xe319
add edx, 0x424d
or edx, 0x1063d
pop edx
push ebx
jmp 0x4272ef
xor ebx, 0xee3b
sub ebx, 0x17a87
xor ebx, 0xb5a6
pop ebx
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push eax
push edx
add esp, 4
or eax, 0x29b3
and eax, 0x92de
pop eax
push ecx
jmp 0x427355
pop ecx
push esi
jmp 0x427360
pop esi
push eax
sub eax, 0x1288e
xor eax, 0x12d76
pop eax
mov dword [ebp - 0x10], 1
push edi
or edi, 0xb32
and edi, 0x10981
call 0x427390
add byte [esp + ecx*2], bh
inc ebx
aaa
dec ebx
xor eax, 0x4c48337
xor edi, 0x129fe
pop edi
push ecx
xor ecx, 0xd46c
sub ecx, 0x17dba
pop ecx
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push edi
or edi, 0x1e32
pop edi
push edx
sub edx, 0x15f0c
or edx, 0x113ee
and edx, 0x3a1d
pop edx
push edi
xor edi, 0x1502d
xor edi, 0xe979
pop edi
push ebx
sub ebx, 0x13af6
pop ebx
push eax
push edx
add esp, 4
or eax, 0x6807
sub eax, 0x2555
pop eax
push edi
call 0x427426
add byte [0x363b3546], dh
dec esi
cmp byte [ebx + 0x525f04c4], al
and edx, 0x18bc
or edx, 0xfd4f
pop edx
mov dword [ebp - 0x2c], 1
push esi
push ecx
add esp, 4
xor esi, 0x3d1e
pop esi
push edi
and edi, 0xc893
call 0x42745f
add byte [edx], bh
cmp eax, 0x414b483d
dec ecx
add esp, 4
pop edi
push eax
or eax, 0x1557c
or eax, 0x11a9f
pop eax
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x138
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x427652
push eax
push esi
add esp, 4
or eax, 0x5d63
xor eax, 0x1428b
sub eax, 0x11de6
pop eax
push edi
call 0x427f1a
add byte [edx], bh
inc esi
inc edi
dec eax
xor edi, dword [edx]
dec edi
dec eax
xor eax, 0x8104c483
iretd