joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c000
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp dword [esi + 4], 0
push ebx
jne 0x40c014
mov ebx, dword [esi]
push edi
call fcn.00409210
inc dword [esi + 4]
pop ebx
ret
cmp byte [esi + 0xd], 0
je 0x40c02c
mov ebx, dword [esi + 8]
push edi
call fcn.00409210
inc dword [esi + 4]
mov byte [esi + 0xd], 0
pop ebx
ret
push 0x18
call fcn.0041171a
add esp, 4
test eax, eax
je 0x40c059
mov ebx, eax
mov eax, edi
call fcn.0040bd50
mov eax, dword [esi + 8]
test eax, eax
jne 0x42c155
mov dword [ebx + 0x10], eax
inc dword [esi + 4]
mov dword [esi + 8], ebx
pop ebx
ret
xor ebx, ebx
jmp 0x40c043
add cl, byte [ecx - 0xc337b]
jmp dword [esi - 0x75]

Function at 0x40c2a0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
inc dword [eax]
mov ecx, dword [eax]
push edi
xor edi, edi
mov dword [edx], ecx
lea esp, [esp]
mov ecx, dword [eax]
mov edx, dword [esi + 4]
mov edx, dword [edx + ecx*4]
movsx edx, word [edx + 8]
cmp edx, 0x47
jge 0x40c2c6
inc ecx
mov dword [eax], ecx
jmp 0x40c2b0
sub edx, 0x47
je 0x40c2f3
sub edx, 1
jne 0x40c2e3
test edi, edi
jne 0x40c2ed
mov edx, dword [esp + 0xc]
mov dword [edx], ecx
inc ecx
mov dword [eax], ecx
xor eax, eax
pop edi
ret 8
sub edx, 0x37
jne 0x40c2c1
jmp 0x42b171
dec edi
inc ecx
mov dword [eax], ecx
jmp 0x40c2b0
inc edi
inc ecx
mov dword [eax], ecx
jmp 0x40c2b0
inc dword [eax]
add byte [eax], al
add byte [edi + 0x51], dl

Function at 0x40c300
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x18
push ebx
push ebp
mov ebp, dword [esp + 0x28]
push esi
push edi
mov edi, eax
mov edx, dword [edi]
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebp + 4]
mov edx, dword [eax + edx*4]
mov esi, dword [edx]
lea ecx, [esp + 0x34]
xor ebx, ebx
push ecx
xor ecx, ecx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x1c], ebx
call fcn.0040c3e0
mov esi, dword [esp + 0x30]
cmp esi, ebx
je 0x42cd91
inc dword [edi]
cmp dword [esi + 8], 5
mov ebx, 0x4e
je 0x40c3a4
mov eax, dword [esi + 8]
cmp eax, 8
je 0x42cdb4
cmp eax, 5
je 0x40c36e
mov edx, dword [edi]
mov eax, dword [ebp + 4]
mov eax, dword [eax + edx*4]
cmp word [eax + 8], bx
je 0x42cdfe
mov ebp, dword [esp + 0x34]
push esi
mov ebx, ebp
call fcn.00409210
mov edi, dword [esp + 0x2c]
cmp byte [edi + 0xfd], 0
jne 0x42ce19
cmp byte [edi + 0xfe], 0
jne 0x42ce19
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0xc
mov eax, dword [edi]
mov edx, dword [ebp + 4]
mov eax, dword [edx + eax*4]
cmp word [eax + 8], bx
jne 0x40c34b
mov edx, dword [esp + 0x2c]
push 1
lea ecx, [esp + 0x34]
push ecx
push edx
mov eax, edi
mov ecx, ebp
call fcn.0040c620
test eax, eax
jne 0x42cdaa
mov esi, dword [esp + 0x30]
jmp 0x40c34b
mov bh, 0x70
add dword [eax], eax
ret 0x4394
dec edx
xor eax, 0x8137463d
add eax, 0xe16f
pop eax
push esi
jmp 0x85ccce1d
Function at 0x40c620
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x118
push ebx
push ebp
mov ebp, dword [esp + 0x128]
push esi
push edi
mov esi, eax
mov eax, dword [esi]
mov edi, ecx
mov ecx, dword [edi + 4]
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], ebx
mov edx, dword [ecx + eax*4 - 4]
lea eax, [ecx + eax*4]
movsx ecx, word [edx + 0xa]
mov edx, dword [eax]
cmp word [edx + 8], 0x4e
mov dword [esp + 0x24], ecx
jne 0x40c6d7
inc dword [esi]
mov eax, dword [esi]
mov ecx, dword [edi + 4]
mov edx, dword [ecx + eax*4]
movsx eax, word [edx + 0xa]
push 0xffffffffffffffff
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x134]
push esi
push edi
mov dword [esp + 0x30], eax
call fcn.0040ab50
test eax, eax
jne 0x42c290
lea ecx, [esp + 0x10]
call fcn.0040c760
test eax, eax
jl 0x42c267
mov eax, dword [esi]
mov edx, dword [edi + 4]
mov ecx, dword [edx + eax*4]
cmp word [ecx + 8], 0x4f
jne 0x42c278
inc eax
lea ecx, [esp + 0x10]
mov dword [esi], eax
call fcn.0040c760
mov edx, dword [esi]
mov dword [esp + ebx*4 + 0x28], eax
mov eax, dword [edi + 4]
mov ecx, dword [eax + edx*4]
inc ebx
cmp word [ecx + 8], 0x4e
je 0x40c664
mov esi, dword [ebp]
cmp dword [esi + 8], 5
jne 0x42c24a
mov eax, dword [esi]
xor edi, edi
cmp ebx, edi
mov dword [eax + 0x210], edi
jle 0x40c703
mov esi, dword [esp + edi*4 + 0x28]
mov edx, dword [ebp]
call fcn.0040d0f0
inc edi
cmp edi, ebx
jl 0x40c6f2
mov ecx, dword [esp + 0x134]
mov edx, dword [ebp]
push 0
push ecx
push edx
call fcn.0040d030
add esp, 0xc
mov dword [ebp], eax
test eax, eax
je 0x42c256
lea esi, [esp + 0x10]
call fcn.004092c0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x118
ret 0xc
inc esi
add dword [eax], eax
or byte [eax], al
add byte [eax], al
mov dl, 0x44
add byte [eax], al
inc esp
add byte [eax], al

Function at 0x40c770
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [esi + 8]
sub esp, 0xc
push ebx
push edi
mov edi, eax
mov eax, dword [edi + 8]
lea eax, [eax + eax*2]
lea edx, [ecx + eax*4]
mov eax, dword [edx*4 + 0x4923c8]
cmp eax, 1
jne 0x40c7ae
mov ecx, edi
call fcn.0040c760
mov ecx, esi
mov edi, eax
call fcn.0040c760
xor ecx, ecx
cmp edi, eax
setl cl
mov al, cl
pop edi
pop ebx
add esp, 0xc
ret
cmp eax, 3
jne 0x42a889
mov ecx, edi
call fcn.0040be90
fstp qword [esp + 0xc]
mov ecx, esi
call fcn.0040be90
fcomp qword [esp + 0xc]
fnstsw ax
test ah, 0x41
je 0x42a8d8
pop edi
xor eax, eax
pop ebx
add esp, 0xc
ret
pop eax
fld dword [eax]
add byte [edi - 0x75], bl
push ebp
in al, dx
retf
Function at 0x40cc14
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x28
push ebx
push esi
mov esi, ecx
push edi
mov edi, eax
mov eax, dword [esi + 8]
mov edx, dword [edi + 8]
lea ecx, [eax + eax*2]
lea ecx, [edx + ecx*4]
mov ecx, dword [ecx*4 + 0x4923c8]
dec ecx
cmp ecx, 0xa
ja case.0x40cc37.5
jmp dword [ecx*4 + 0x40cca4]
mov ecx, esi
call fcn.0040c760
mov ecx, edi
mov esi, eax
call fcn.0040c760
cmp esi, eax
jne 0x42c30c
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x28
ret
cmp edx, 4
jne 0x42c2e2
cmp dword [esi + 8], 4
mov edi, dword [edi + 0xc]
jne 0x42c2f7
mov esi, dword [esi + 0xc]
mov ecx, dword [edi + 4]
mov edi, dword [edi]
mov edx, dword [esi]
push edi
push edx
mov edx, dword [esi + 4]
xor eax, eax
call fcn.0040e740
test eax, eax
jne 0x42c30c
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x28
ret
invalid
add byte [eax], al
cmp byte [ecx + 0xf6aff2], al
add byte [edx + 0x57], bl
pop edx
push edi
add byte [ecx + 0x16b8ac3], al
add byte [ebx - 0x39], bl
test esp, esi
clc
invalid

Function at 0x40cfe0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp byte [ebx + 9], 0
push edi
mov edi, eax
jne 0x42c2a3
push esi
push 0x38
call fcn.0041171a
add esp, 4
test eax, eax
je 0x40d011
mov esi, eax
call fcn.0040cd40
mov ecx, dword [ebx + 4]
mov dword [esi + 0x30], ecx
inc dword [ebx]
mov dword [ebx + 4], esi
pop esi
pop edi
ret
mov ecx, dword [ebx + 4]
xor esi, esi
mov dword [esi + 0x30], ecx
inc dword [ebx]
mov dword [ebx + 4], esi
pop esi
pop edi
ret

Function at 0x40d030
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
mov ebx, 5
cmp dword [ebp + 8], ebx
jne 0x42c13d
cmp byte [esp + 0x10], 0
push esi
push edi
mov edi, dword [esp + 0x1c]
je 0x40d07b
test edi, edi
jne 0x40d084
mov eax, ebp
call fcn.0040d120
test eax, eax
jl 0x42c14e
mov ecx, dword [ebp]
mov edx, dword [ecx]
mov esi, eax
cmp dword [edx + esi*4], 0
je 0x40d0b6
mov ecx, dword [ecx]
mov eax, dword [ecx + esi*4]
pop edi
pop esi
pop ebp
pop ebx
ret
mov esi, ebp
call fcn.0040e7c0
jmp 0x40d051
cmp dword [ebp + 8], ebx
jne 0x42c142
mov eax, dword [ebp]
mov dword [eax + 0x210], 0
test edi, edi
jle 0x40d055
lea ebx, [esp + 0x1c]
mov esi, dword [ebx + 4]
add ebx, 4
mov edx, ebp
call fcn.0040d0f0
sub edi, 1
je 0x40d055
jmp 0x40d0a2
push 0x10
call fcn.0041171a
add esp, 4
test eax, eax
je 0x40d0e5
mov edi, 0x4848e8
mov ebx, eax
call fcn.0040d420
mov ecx, dword [ebp]
mov edx, dword [ecx]
mov dword [edx + esi*4], eax
mov eax, dword [ebp]
mov ecx, dword [eax]
mov eax, dword [ecx + esi*4]
pop edi
pop esi
pop ebp
pop ebx
ret
xor eax, eax
jmp 0x40d0d0
jmp dword [esi - 0x75]
test esp, ecx
invalid
Function at 0x40d5d0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x20
push ebx
push esi
push edi
lea ecx, [esp + 0x18]
call fcn.0040c060
mov ecx, 1
mov esi, dword [0x4a8e90]
mov edi, dword [0x4a8ec4]
cmp ecx, esi
jg 0x40d6a6
mov eax, ecx
inc ecx
test eax, eax
jle 0x40d6a6
shl eax, 4
add eax, edi
je 0x40d6a6
mov ebx, eax
lea eax, [ecx - 1]
mov dword [0x4a8014], eax
mov edx, dword [ebx + 4]
mov eax, dword [edx]
cmp word [eax + 8], 0
mov dword [esp + 0x10], ecx
jne 0x40d5f0
cmp dword [eax], 0x20
jne 0x40d5f0
mov edx, dword [edx + 4]
cmp word [edx + 8], 0x34
jne 0x42b2c4
mov ecx, dword [edx]
push ecx
lea esi, [esp + 0x1c]
call fcn.0040df50
mov edi, dword [esp + 0x18]
sub esp, 0x10
mov esi, esp
call fcn.00401b70
mov eax, 0x4a8054
call fcn.0040f1a0
test eax, eax
jne 0x42b2ca
mov edx, dword [ebx + 4]
mov eax, dword [edx + 8]
cmp word [eax + 8], 0x47
jne 0x42b2c4
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
push ebx
mov dword [esp + 0x24], 3
call fcn.0040da10
test eax, eax
jne 0x42b2db
mov ecx, dword [esp + 0x10]
jmp 0x40d5e4
mov esi, 0x4a8054
call fcn.00410470
lea ecx, [esp + 0x18]
call fcn.00402620
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x20
ret
jmp 0x539ab2c8
les eax, [ecx + eax*4]
not eax
and al, byte [eax]
add byte [ecx + 0x3ac6f7], al
add byte [ecx + 0xa60ec7], al
add byte [ecx + 0x35b0c7], al
add byte [edi + 0x56], bl
cmpsb byte [esi], byte es:[edi]
add byte [eax], al
Function at 0x40d6d0
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x438
push ebx
push esi
push edi
mov edi, eax
lea eax, [esp + 0x20]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push edi
call fcn.00401f80
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x431a9d
mov eax, dword [0x4a7cfc]
test eax, eax
je 0x431ab6
mov byte [esp + 0xf], 0
mov esi, 0x4a8e80
cmp eax, 1
je 0x431aca
push 0x4a7cfc
lea ecx, [esp + 0x13]
mov eax, 0x4a7d14
call fcn.0040f3b0
test al, al
je 0x431aeb
mov dl, byte [0x4a8e80]
mov bl, byte [0x4a8e81]
push 0x4a7cf8
lea eax, [esp + 0x234]
push eax
push 0x104
push 0x4a7d14
mov byte [0x4a7d00], dl
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov ecx, dword [0x4a7cfc]
push ecx
push 0x4a7d14
call fcn.00401440
test eax, eax
jne 0x431aff
cmp bl, 1
je 0x431b23
call fcn.004101f0
call fcn.004103e0
cmp byte [0x4a7d00], 0
jne 0x40d7a8
mov esi, 0x4a84b8
call fcn.0040e1e0
push 1
mov ecx, 0x4a7f20
call fcn.00409560
cmp byte [0x4a7d00], 0
jne 0x40d7c7
mov ecx, 0x4a84b8
call fcn.00401000
mov ebx, 0x4a8e80
call fcn.0040ebc0
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
pop edi
pop esi
pop ebx
add esp, 0x438
ret
push 0x52a6578b
and edx, 0x26
pushal
add al, byte [edx]
or edx, 0xffffff8e
stc
add al, byte [edx]
add edx, 0xffffffb7
pop eax
add al, byte [edx]
pop edx
push ebx
push ebp
test esi, eax
push es
ljmp 0x4702
add al, byte [edx]
inc edi
inc eax
cmp eax, 0x364c4c44
inc ecx
push ecx
test esi, eax
push es
sub ebx, 0x3e
aaa
add al, byte [edx]
pop ebx
lea eax, [edi + 0x101f52e]
push 0x8b680a8d
invalid
int1
add dword [ecx], eax
push 0xffda878b
add dword [ecx], eax
lea ecx, [edi + 0x101f52a]
push 0x8b68138d
xchg edi, eax
ljmp 0x2a87
Function at 0x40e1e0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3a8
push ebx
push edi
push 0x3a4
lea eax, [esp + 0x10]
push 0
push eax
mov dword [esp + 0x14], 0x3a8
call fcn.004131f0
add esp, 0xc
cmp dword [esi + 0x188], 0
jne 0x40e21f
mov ecx, dword [0x4a7cec]
mov dword [esi + 0x188], ecx
cmp dword [esi + 0x194], 0
jne 0x40e239
mov eax, dword [0x4a7cf0]
mov dword [esi + 0x194], eax
mov dword [esi + 0x198], eax
cmp dword [esi + 0x1a0], 0
jne 0x40e24e
mov ecx, dword [0x4a7cf4]
mov dword [esi + 0x1a0], ecx
mov eax, dword [esi + 0x18c]
lea edi, [esi + 0x190]
test eax, eax
jne 0x42aa0b
mov edx, dword [0x4972c0]
mov dword [esi + 0x18c], 0
mov byte [edi], 0
cmp dword [esi + 0x40], 0
mov ebx, 1
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], 0x401
mov dword [esp + 0x1c], 0
jne 0x42aa20
mov eax, dword [esi + 0x188]
mov dword [esp + 0x1c], eax
mov dword [esi + 0x18c], eax
cmp byte [0x497292], bl
je 0x42aa50
lea ecx, [esp + 8]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov byte [0x497292], bl
mov eax, esi
call fcn.00401e70
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
add dword [eax], eax
add byte [eax], al

Function at 0x40e7e0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, eax
mov ebx, 5
cmp dword [edi + 8], ebx
je 0x42b34a
call fcn.0040e8f0
test esi, esi
je 0x40e833
cmp dword [edi + 8], ebx
jne 0x42b354
mov eax, dword [edi]
mov dword [eax + 0x210], 0
test esi, esi
jle 0x40e833
push ebp
lea ebx, [esp + 0x14]
mov ebp, esi
mov esi, dword [ebx + 4]
add ebx, 4
mov edx, edi
call fcn.0040d0f0
sub ebp, 1
jne 0x40e820
pop ebp
mov eax, dword [edi]
mov ecx, dword [eax + 0x210]
mov dword [eax + 0x20c], ecx
mov edx, dword [edi]
mov dword [edx + 8], 1
mov eax, dword [edi]
cmp dword [eax + 0x20c], 0
jle 0x40e891
xor edx, edx
mov ecx, 0xc
lea esp, [esp]
mov esi, dword [ecx + eax + 0x100]
mov dword [ecx + eax], esi
mov eax, dword [edi]
mov esi, dword [ecx + eax]
imul esi, dword [eax + 8]
mov dword [eax + 8], esi
mov eax, dword [edi]
cmp dword [eax + 8], 0x1000000
jg 0x42b360
inc edx
add ecx, 4
cmp edx, dword [eax + 0x20c]
jl 0x40e860
mov eax, dword [edi]
mov eax, dword [eax + 8]
xor ecx, ecx
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041171a
mov ecx, dword [edi]
push 4
mov dword [ecx], eax
call fcn.0041171a
add esp, 8
test eax, eax
je 0x40e8ea
mov dword [eax], 1
mov edx, dword [edi]
mov dword [edx + 4], eax
mov eax, dword [edi]
cmp dword [eax + 8], 0
jle 0x40e8e4
xor ecx, ecx
mov eax, dword [eax]
mov dword [eax + ecx*4], 0
mov eax, dword [edi]
inc ecx
cmp ecx, dword [eax + 8]
jl 0x40e8d3
pop edi
pop esi
mov al, 1
pop ebx
ret
xor eax, eax
jmp 0x40e8c4
out 0xff, eax
dec dword [ecx - 0x14d36b]
call dword [eax + 0x50]
Function at 0x40e940
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ecx
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0x14]
test eax, eax
jg 0x42adeb
test ecx, ecx
jne 0x42ad4f
test edx, edx
jne 0x42ad6a
test esi, esi
jne 0x42ad82
test edi, edi
jne 0x42ad9d
test ebx, ebx
jne 0x42adb8
test ebp, ebp
jne 0x42add3
xor eax, eax
pop ebp
pop ecx
ret 0xc
std
invalid
add byte [esi - 0x39], bl
test dword [esp + edi*8], esi
invalid
add byte gs:[eax], al
add al, 0x81
into
fld qword [eax + 1]
add byte [esi + 0x56], bl

Function at 0x40f110
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [esp + 0x14]
lea ecx, [eax + eax]
lea eax, [esp]
push eax
xor edx, edx
push 1
push edx
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x18]
mov word [esi], dx
mov edx, dword [esp + 0x14]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40f15f
mov ecx, dword [esp + 0x10]
mov edx, dword [esp]
lea eax, [esp + 0x14]
push eax
push esi
push 0
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ecx
ret

Function at 0x40f1a0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ecx
push edi
mov edi, eax
cmp dword [edi + 0xc], 0
jne 0x40f1ba
lea ecx, [esp + 0xc]
call fcn.00402620
xor eax, eax
pop edi
pop ecx
ret 0x10
push ebx
push esi
lea esi, [esp + 0x14]
call fcn.00410a40
mov ebx, dword [edi + 8]
test ebx, ebx
jne 0x42a935
mov esi, dword [edi]
test esi, esi
je 0x40f1ee
lea eax, [esp + 0x14]
call fcn.0040dd00
test al, al
jne 0x42a925
mov esi, dword [esi + 0x20]
test esi, esi
jne 0x40f1d6
lea ecx, [esp + 0x14]
call fcn.00402620
xor eax, eax
pop esi
pop ebx
pop edi
pop ecx
ret 0x10
test dword [esp + esi*8 - 0x39ef0001], ecx
test dword [ebp + 0x10fffff4], ecx
hlt

Function at 0x40f320
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ecx
mov eax, dword [edx]
lea ecx, [eax + 1]
mov dword [edx], ecx
call fcn.0040f2a0
test eax, eax
je 0x40f359
dec ecx
mov dword [0x4a8014], ecx
mov eax, dword [eax + 4]
mov eax, dword [eax]
movzx ecx, word [eax + 8]
test cx, cx
jne 0x40f321
cmp dword [eax], 0x20
je 0x42b194
test cx, cx
jne 0x40f321
cmp dword [eax], 0x21
jne 0x40f321
xor eax, eax
pop ecx
ret
add byte [edi + 0x56], bl
Function at 0x40f3b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x58
push ebx
push edi
mov edi, eax
mov al, byte [0x497290]
mov byte [esi + 3], al
cmp word [edi], 0
je 0x42ccf4
mov eax, edi
mov ecx, edi
call fcn.0040ffb0
mov ebx, edi
call fcn.00410130
mov ecx, dword [esp + 0x64]
push ecx
mov edx, edi
mov ebx, esi
call fcn.00410020
push eax
push esi
mov eax, edi
call fcn.0040f400
pop edi
pop ebx
add esp, 0x58
ret 4
outsd dx, dword [esi]
mov byte [ebp - 0x82e], 0x61
mov byte [ebp - 0x82d], 0x64
mov byte [ebp - 0x82c], 0x4c
mov byte [ebp - 0x82b], 0x69
mov byte [ebp - 0x82a], 0x62
mov byte [ebp - 0x829], 0x72
mov byte [ebp - 0x828], 0x61
mov byte [ebp - 0x827], 0x72
mov byte [ebp - 0x826], 0x79
mov byte [ebp - 0x825], 0x57
mov byte [ebp - 0x824], 0
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x18d8], ecx
mov edx, dword [ebp - 0x18d8]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x18dc], eax
mov ecx, dword [ebp - 0x18dc]
mov dword [ebp - 0x1518], ecx
push edx
xor edx, 0x4dc7
sub edx, 0xe1ca
add edx, 0xc650
pop edx
push edx
push edi
add esp, 4
or edx, 0x51aa
sub edx, 0x12982
add edx, 0x10882
or edx, 0x9f73
pop edx
cmp dword [ebp - 0x1518], 0
jne 0x42cd7c
jb 0x42ccbc
test edx, ebx
idiv edi
invalid
mov dword [ebp - 0x710], 0
jmp fcn.0042d023
mov edx, dword [ebp - 0x1518]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc58], ecx
push edi
add edi, 0x170b7
and edi, 0x64b
pop edi
push ecx
jmp 0x42cda4
xor ecx, 0x6f86
jmp 0x42cdb1
pop ecx
push edx
add edx, 0x14394
sub edx, 0x147de
pop edx
cmp dword [ebp - 0xc58], 0
jne 0x42cdd8
mov dword [ebp - 0x710], 0
jmp fcn.0042d023
mov edx, dword [ebp - 0xc58]
mov dword [ebp - 0x4e8], edx

Function at 0x40f400
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x58
push ebx
push ebp
mov ebp, dword [esp + 0x64]
push esi
push edi
mov esi, eax
push esi
lea edi, [esp + 0x30]
call fcn.0040f5e0
test eax, eax
je 0x42ca37
mov ebx, dword [esp + 0x74]
cmp dword [ebx], 4
je 0x42ca1f
mov edx, dword [esp + 0x70]
push 0
push 0x4848e8
push esi
push edx
push esi
push ebp
mov dword [ebx], 2
call fcn.004037e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret 0xc
invalid
Function at 0x40f450
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x10020
call fcn.00425210
xor eax, eax
lea esp, [esp]
mov cl, byte [eax + 0x492380]
mov dl, byte [eax + 0x492378]
mov byte [esp + eax + 0xc], cl
mov byte [esp + eax + 0x14], dl
inc eax
cmp eax, 8
jl 0x40f460
lea eax, [esp]
push 0x4876e8
push eax
call fcn.00413990
push 4
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x2c]
push edx
call fcn.00410f70
add esp, 0x14
push ebx
push ebp
push esi
mov dword [esp + 0x14], 0
push edi
jmp 0x40f4b0
mov eax, dword [esp + 0x10034]
mov ecx, dword [eax]
push ecx
push 0x10000
lea edx, [esp + 0x38]
push 1
push edx
call fcn.004151b0
add esp, 0x10
cmp eax, 0x18
jl 0x40f531
mov ebp, eax
lea edi, [ebp - 0x14]
test edi, edi
jle 0x40f4fd
xor edx, edx
mov edi, edi
xor ecx, ecx
lea esi, [esp + edx + 0x30]
mov al, byte [esp + ecx + 0x1c]
cmp al, byte [esi + ecx]
je 0x40f521
cmp ecx, 0x14
je 0x42937a
inc edx
cmp edx, edi
jl 0x40f4e0
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x10034]
lea edx, [ecx + ebp - 0x14]
mov ecx, dword [eax]
push 1
push 0xffffffffffffffec
push ecx
mov dword [esp + 0x24], edx
call fcn.0041557c
add esp, 0xc
jmp 0x40f4b0
mov bl, byte [esp + ecx + 0x1d]
lea eax, [ecx + edx]
cmp bl, byte [esp + eax + 0x31]
je 0x40f543
inc ecx
jmp 0x40f4ef
mov eax, 3
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10020
ret 4
mov bl, byte [esp + ecx + 0x1e]
lea eax, [ecx + edx]
cmp bl, byte [esp + eax + 0x32]
je 0x40f555
add ecx, 2
jmp 0x40f4ef
mov bl, byte [esp + ecx + 0x1f]
lea eax, [ecx + edx]
cmp bl, byte [esp + eax + 0x33]
jne 0x429372
mov bl, byte [esp + ecx + 0x20]
lea eax, [ecx + edx]
cmp bl, byte [esp + eax + 0x34]
je 0x429361
add ecx, 4
jmp 0x40f4ef
ret 0x150
add byte [ecx + 0x7b05c3], al
add byte [ecx + 0x12ff9e3], al
add byte [ebx - 0x75], bl
lea esi, [edi*8 - 0x3e7e0001]
cmp byte [ecx], al
add byte [eax], al
add eax, 0x8100007b
jecxz 0x429375
das
add dword [eax], eax

Function at 0x40f5e0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a8
push ebx
push esi
mov ebx, 0x4848e8
call fcn.0040f580
mov esi, eax
lea eax, [esp + 0xa8]
push esi
push eax
call fcn.00413990
push esi
call fcn.004112ef
add esp, 0xc
lea esi, [esp + 0x18]
call fcn.0040f6a0
lea eax, [esp + 0xa8]
mov ecx, esi
call fcn.0040f6d0
xor ebx, ebx
mov dword [edi + 8], ebx
xor ecx, ecx
mov eax, ebx
movzx edx, byte [esp + ecx + 0x18]
add eax, edx
movzx edx, byte [esp + ecx + 0x19]
add eax, edx
movzx edx, byte [esp + ecx + 0x1a]
add eax, edx
movzx edx, byte [esp + ecx + 0x1b]
add ecx, 4
add eax, edx
cmp ecx, 0x10
jl 0x40f631
mov dword [edi + 8], eax
mov eax, dword [ebp + 8]
push 0x4876c8
push eax
call fcn.00414e06
add esp, 8
mov dword [edi], eax
cmp eax, ebx
je 0x42b2ee
push edi
call fcn.0040f450
cmp eax, ebx
je 0x42b2f8
mov ecx, dword [edi]
push ecx
mov esi, eax
call fcn.00414e94
add esp, 4
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
inc eax
adc byte [ecx], al
add byte [ecx + 0x140e9f6], al
add byte [esi + 0x57], bl
Function at 0x40f6a0
Capabilities:
Hash data with md5

Disassembly:
push 8
lea eax, [esi + 0x44]
push 0
push eax
call fcn.004131f0
add esp, 0xc
mov dword [esi + 0x34], 0x67452301
mov dword [esi + 0x38], 0xefcdab89
mov dword [esi + 0x3c], 0x98badcfe
mov dword [esi + 0x40], 0x10325476
ret

Function at 0x40ff90
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x18
push edi
push eax
lea edi, [esp + 0x14]
call fcn.0040f5e0
test eax, eax
je 0x42b6bf
xor al, al
pop edi
add esp, 0x18
ret
add byte [eax], al

Function at 0x4103e0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x4972c8]
push esi
push 0
mov esi, dword [sym.imp.USER32.dll_CreateWindowExW]
push eax
push 0
push 0
push 0x64
push 0x12c
push accept
push accept
push 0xcf0000
push str.AutoIt_v3
push str.AutoIt_v3
push 0
call esi
mov ecx, dword [0x4972c8]
push 0
push ecx
push 1
push eax
push 0
push 0
push 0
push 0
push 0x50b008c4
push 0
push str.edit
push 0
mov dword [0x4972c0], eax
call esi
mov edx, dword [0x4972c0]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push edx
mov dword [0x4972bc], eax
call esi
mov eax, dword [0x4972c0]
push 0
push eax
call esi
pop esi
ret

Function at 0x421fa7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x490e80]
jne 0x421fb1
repz ret
jmp fcn.00426243