joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b0e0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x569a18
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x5a53f4]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x40]
xor edi, edi
push 0xffffffffffffffff
push edi
xor eax, eax
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], edi
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], edi
mov word [esp + 0x20], ax
call fcn.0040a900
mov edx, dword [esp + 0x44]
mov eax, edx
mov dword [esp + 0x34], edi
lea esi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x40b140
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x18]
call fcn.0040aa60
mov esi, dword [esp + 0x3c]
push 0xffffffffffffffff
push edi
xor edx, edx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push eax
mov ecx, esi
mov word [esi + 4], dx
call fcn.0040a900
cmp dword [esp + 0x28], 8
jb 0x40b18d
mov eax, dword [esp + 0x14]
push eax
call fcn.005303ae
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x2c
ret

Function at 0x40de20
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x5a53f4]
xor eax, esp
mov dword [esp + 0x114], eax
push 0x110
lea eax, [esp + 8]
push 0
push eax
call fcn.00534b20
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 4], 5
jne 0x40de6c
mov eax, 1
cmp dword [esp + 8], eax
je 0x40de6e
xor eax, eax
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.005308cb
add esp, 0x118
ret

Function at 0x40df70
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x5a53f4]
xor eax, esp
mov dword [esp + 0x11c], eax
push 0x118
lea eax, [esp + 8]
push 0
push eax
call fcn.00534b20
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x40dfc5
mov al, 1
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.005308cb
add esp, 0x120
ret
cmp dword [esp + 4], 6
jb 0x40dfd7
mov eax, 1
cmp dword [esp + 8], eax
jae 0x40dfd9
xor al, al
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.005308cb
add esp, 0x120
ret
Function at 0x40ef5e
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20bc
push ebx
push esi
push edi
push edx
push ebx
add esp, 4
and edx, 0xcc0
pop edx
push eax
jmp 0x40ef7d
call 0x40ef8c
add byte [eax + 0x43], cl
inc esp
cmp dh, byte [esi]
inc ecx
xor edx, dword [eax + 0x40]
add esp, 4
sub eax, 0x6034
and eax, 0x17531
pop eax
mov eax, 0x4d
mov word [ebp - 0x1ff8], ax
mov ecx, 0x42
mov word [ebp - 0x1ff6], cx
mov edx, 0x53
mov word [ebp - 0x1ff4], dx
mov eax, 0x65
mov word [ebp - 0x1ff2], ax
mov ecx, 0x72
mov word [ebp - 0x1ff0], cx
mov edx, 0x76
mov word [ebp - 0x1fee], dx
mov eax, 0x69
mov word [ebp - 0x1fec], ax
mov ecx, 0x63
mov word [ebp - 0x1fea], cx
mov edx, 0x65
mov word [ebp - 0x1fe8], dx
mov eax, 0x2e
mov word [ebp - 0x1fe6], ax
mov ecx, 0x65
mov word [ebp - 0x1fe4], cx
mov edx, 0x78
mov word [ebp - 0x1fe2], dx
mov eax, 0x65
mov word [ebp - 0x1fe0], ax
xor ecx, ecx
mov word [ebp - 0x1fde], cx
mov dword [ebp - 0x1060], 1
push ecx
push edi
add esp, 4
call fcn.0040f060
add byte [ebx + 0x45], cl
inc ebp
inc ecx
aaa
dec eax
dec ecx
dec edx
inc edi
xor eax, dword [ebx + 0xbe804c4]
add esp, 4
call 0x40f073
add byte [0x46384e34], bh

Function at 0x40ef8c
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20bc
push ebx
push esi
push edi
push edx
push ebx
add esp, 4
and edx, 0xcc0
pop edx
push eax
jmp 0x40ef7d
call 0x40ef8c
add byte [eax + 0x43], cl
inc esp
cmp dh, byte [esi]
inc ecx
xor edx, dword [eax + 0x40]
add esp, 4
sub eax, 0x6034
and eax, 0x17531
pop eax
mov eax, 0x4d
mov word [ebp - 0x1ff8], ax
mov ecx, 0x42
mov word [ebp - 0x1ff6], cx
mov edx, 0x53
mov word [ebp - 0x1ff4], dx
mov eax, 0x65
mov word [ebp - 0x1ff2], ax
mov ecx, 0x72
mov word [ebp - 0x1ff0], cx
mov edx, 0x76
mov word [ebp - 0x1fee], dx
mov eax, 0x69
mov word [ebp - 0x1fec], ax
mov ecx, 0x63
mov word [ebp - 0x1fea], cx
mov edx, 0x65
mov word [ebp - 0x1fe8], dx
mov eax, 0x2e
mov word [ebp - 0x1fe6], ax
mov ecx, 0x65
mov word [ebp - 0x1fe4], cx
mov edx, 0x78
mov word [ebp - 0x1fe2], dx
mov eax, 0x65
mov word [ebp - 0x1fe0], ax
xor ecx, ecx
mov word [ebp - 0x1fde], cx
mov dword [ebp - 0x1060], 1
push ecx
push edi
add esp, 4
call fcn.0040f060
add byte [ebx + 0x45], cl
inc ebp
inc ecx
aaa
dec eax
dec ecx
dec edx
inc edi
xor eax, dword [ebx + 0xbe804c4]
add esp, 4
call 0x40f073
add byte [0x46384e34], bh
Function at 0x40f060
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x40f073
add byte [0x46384e34], bh
cmp bh, byte [edx]
dec esi
inc esp
dec eax
add esp, 4
sub ecx, 0x15522
pop ecx
imul edx, dword [ebp - 0x1060], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x1060], 0xfe
sub edx, eax
xor edx, 0xaa6272
imul edx, dword [ebp - 0x1060]
imul ecx, dword [ebp - 0x1060], 0xfe
sub edx, ecx
mov dword [ebp - 0x1064], edx
push edx
and edx, 0x16f4c
jmp 0x40f0c6
jmp 0x40f0cc
pop edx
push esi
or esi, 0xde9c
jmp 0x40f0db
xor esi, 0x617e
jmp 0x40f0e9
pop esi
mov dword [ebp - 0x10], 1
push ecx
push ebx
add esp, 4
and ecx, 0xaa6
call 0x40f108
add byte [ecx + 0x49], cl
cmp al, 0x33
dec ecx
xor eax, dword [ebx - 0xe7efb3c]
retf

Function at 0x40f073
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x40f073
add byte [0x46384e34], bh
cmp bh, byte [edx]
dec esi
inc esp
dec eax
add esp, 4
sub ecx, 0x15522
pop ecx
imul edx, dword [ebp - 0x1060], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x1060], 0xfe
sub edx, eax
xor edx, 0xaa6272
imul edx, dword [ebp - 0x1060]
imul ecx, dword [ebp - 0x1060], 0xfe
sub edx, ecx
mov dword [ebp - 0x1064], edx
push edx
and edx, 0x16f4c
jmp 0x40f0c6
jmp 0x40f0cc
pop edx
push esi
or esi, 0xde9c
jmp 0x40f0db
xor esi, 0x617e
jmp 0x40f0e9
pop esi
mov dword [ebp - 0x10], 1
push ecx
push ebx
add esp, 4
and ecx, 0xaa6
call 0x40f108
add byte [ecx + 0x49], cl
cmp al, 0x33
dec ecx
xor eax, dword [ebx - 0xe7efb3c]
retf

Function at 0x40f108
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x40f073
add byte [0x46384e34], bh
cmp bh, byte [edx]
dec esi
inc esp
dec eax
add esp, 4
sub ecx, 0x15522
pop ecx
imul edx, dword [ebp - 0x1060], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x1060], 0xfe
sub edx, eax
xor edx, 0xaa6272
imul edx, dword [ebp - 0x1060]
imul ecx, dword [ebp - 0x1060], 0xfe
sub edx, ecx
mov dword [ebp - 0x1064], edx
push edx
and edx, 0x16f4c
jmp 0x40f0c6
jmp 0x40f0cc
pop edx
push esi
or esi, 0xde9c
jmp 0x40f0db
xor esi, 0x617e
jmp 0x40f0e9
pop esi
mov dword [ebp - 0x10], 1
push ecx
push ebx
add esp, 4
and ecx, 0xaa6
call 0x40f108
add byte [ecx + 0x49], cl
cmp al, 0x33
dec ecx
xor eax, dword [ebx - 0xe7efb3c]
retf
Function at 0x40f11f
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop esi
imul edx, dword [ebp - 0x10], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x10], 0xfe
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0xfe
sub edx, ecx
mov dword [ebp - 0x14], edx
push ebx
xor ebx, 0x16fba
xor ebx, 0x11576
and ebx, 0x15a1d
add dword [eax], eax
add ebx, 0x10b12
pop ebx
push edi
push eax
add esp, 4
and edi, 0xb08d
and edi, 0xc0c5
or edi, 0x12c6f
pop edi
push ebx
xor ebx, 0xc8fa
sub ebx, 0xb38d
and ebx, 0x16ec9
call 0x40f1a1
add byte [eax + 0x46], al
cmp al, 0x4e
xor bh, byte [eax]
inc edi
add esp, 4
pop ebx
push edi
xor edi, 0x10f2d
add edi, 0x16f30
pop edi
mov dword [ebp - 0x2c], 1
push ecx
add ecx, 0xe1fd
pop ecx
push ecx
jmp 0x40f1ca
pop ecx
push ebx
push edx
add esp, 4

Function at 0x40f160
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop esi
imul edx, dword [ebp - 0x10], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x10], 0xfe
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0xfe
sub edx, ecx
mov dword [ebp - 0x14], edx
push ebx
xor ebx, 0x16fba
xor ebx, 0x11576
and ebx, 0x15a1d
add dword [eax], eax
add ebx, 0x10b12
pop ebx
push edi
push eax
add esp, 4
and edi, 0xb08d
and edi, 0xc0c5
or edi, 0x12c6f
pop edi
push ebx
xor ebx, 0xc8fa
sub ebx, 0xb38d
and ebx, 0x16ec9
call 0x40f1a1
add byte [eax + 0x46], al
cmp al, 0x4e
xor bh, byte [eax]
inc edi
add esp, 4
pop ebx
push edi
xor edi, 0x10f2d
add edi, 0x16f30
pop edi
mov dword [ebp - 0x2c], 1
push ecx
add ecx, 0xe1fd
pop ecx
push ecx
jmp 0x40f1ca
pop ecx
push ebx
push edx
add esp, 4

Function at 0x40f1a1
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop esi
imul edx, dword [ebp - 0x10], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x10], 0xfe
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0xfe
sub edx, ecx
mov dword [ebp - 0x14], edx
push ebx
xor ebx, 0x16fba
xor ebx, 0x11576
and ebx, 0x15a1d
add dword [eax], eax
add ebx, 0x10b12
pop ebx
push edi
push eax
add esp, 4
and edi, 0xb08d
and edi, 0xc0c5
or edi, 0x12c6f
pop edi
push ebx
xor ebx, 0xc8fa
sub ebx, 0xb38d
and ebx, 0x16ec9
call 0x40f1a1
add byte [eax + 0x46], al
cmp al, 0x4e
xor bh, byte [eax]
inc edi
add esp, 4
pop ebx
push edi
xor edi, 0x10f2d
add edi, 0x16f30
pop edi
mov dword [ebp - 0x2c], 1
push ecx
add ecx, 0xe1fd
pop ecx
push ecx
jmp 0x40f1ca
pop ecx
push ebx
push edx
add esp, 4
Function at 0x40f1d0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
jmp 0x40f1d9
and ebx, 0x51ec
or ebx, 0x15e30
or ebx, 0x1634a
pop ebx
imul edx, dword [ebp - 0x2c], 0xfe
add byte [eax], al
add byte [ecx - 0xc99c43e], al
push esi
imul eax, dword [ebp - 0x2c], 0xfe
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0xfe
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x40f3cd
mov ecx, dword [ebp - 0x1064]
mov edx, dword [ebp - 0x1060]
mov dword [ebp - 0x1634], ecx
mov dword [ebp - 0x1630], edx
push ebx
push edx
add esp, 4
call 0x40f3f8
add byte [ebx + 0x3b], al
inc ebx
cmp ecx, dword [esi + 0x4e]
inc edx
xor eax, dword [ebx + 0x505b04c4]
jmp 0x40f403
and eax, 0x17c6b
xor eax, 0x4661
jmp 0x40f416
pop eax
push edi
push edi
add esp, 4
xor edi, 0x16277
and edi, 0x18070
pop edi
push ecx
push ecx
add esp, 4
and ecx, 0x15ef1
or ecx, 0x123ae
pop ecx
push ecx
add ecx, 0xe3e5
sub ecx, 0x3802
pop ecx
mov eax, dword [ebp - 0x30]
add eax, 0xfe
imul ecx, dword [ebp - 0x2c], 0xfe
add ecx, 0x56f3663b
imul edx, dword [ebp - 0x2c], 0xfe
sub ecx, edx
xor eax, ecx
imul eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1e30], eax
push edx
push esi
add esp, 4
add edx, 0x8749
and edx, 0x382e
or edx, 0x162a6
sub edx, 0x7aad

Function at 0x40f1f0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
jmp 0x40f1d9
and ebx, 0x51ec
or ebx, 0x15e30
or ebx, 0x1634a
pop ebx
imul edx, dword [ebp - 0x2c], 0xfe
add byte [eax], al
add byte [ecx - 0xc99c43e], al
push esi
imul eax, dword [ebp - 0x2c], 0xfe
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0xfe
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x40f3cd
mov ecx, dword [ebp - 0x1064]
mov edx, dword [ebp - 0x1060]
mov dword [ebp - 0x1634], ecx
mov dword [ebp - 0x1630], edx
push ebx
push edx
add esp, 4
call 0x40f3f8
add byte [ebx + 0x3b], al
inc ebx
cmp ecx, dword [esi + 0x4e]
inc edx
xor eax, dword [ebx + 0x505b04c4]
jmp 0x40f403
and eax, 0x17c6b
xor eax, 0x4661
jmp 0x40f416
pop eax
push edi
push edi
add esp, 4
xor edi, 0x16277
and edi, 0x18070
pop edi
push ecx
push ecx
add esp, 4
and ecx, 0x15ef1
or ecx, 0x123ae
pop ecx
push ecx
add ecx, 0xe3e5
sub ecx, 0x3802
pop ecx
mov eax, dword [ebp - 0x30]
add eax, 0xfe
imul ecx, dword [ebp - 0x2c], 0xfe
add ecx, 0x56f3663b
imul edx, dword [ebp - 0x2c], 0xfe
sub ecx, edx
xor eax, ecx
imul eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1e30], eax
push edx
push esi
add esp, 4
add edx, 0x8749
and edx, 0x382e
or edx, 0x162a6
sub edx, 0x7aad
Function at 0x40f3f8
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
jmp 0x40f1d9
and ebx, 0x51ec
or ebx, 0x15e30
or ebx, 0x1634a
pop ebx
imul edx, dword [ebp - 0x2c], 0xfe
add byte [eax], al
add byte [ecx - 0xc99c43e], al
push esi
imul eax, dword [ebp - 0x2c], 0xfe
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0xfe
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x40f3cd
mov ecx, dword [ebp - 0x1064]
mov edx, dword [ebp - 0x1060]
mov dword [ebp - 0x1634], ecx
mov dword [ebp - 0x1630], edx
push ebx
push edx
add esp, 4
call 0x40f3f8
add byte [ebx + 0x3b], al
inc ebx
cmp ecx, dword [esi + 0x4e]
inc edx
xor eax, dword [ebx + 0x505b04c4]
jmp 0x40f403
and eax, 0x17c6b
xor eax, 0x4661
jmp 0x40f416
pop eax
push edi
push edi
add esp, 4
xor edi, 0x16277
and edi, 0x18070
pop edi
push ecx
push ecx
add esp, 4
and ecx, 0x15ef1
or ecx, 0x123ae
pop ecx
push ecx
add ecx, 0xe3e5
sub ecx, 0x3802
pop ecx
mov eax, dword [ebp - 0x30]
add eax, 0xfe
imul ecx, dword [ebp - 0x2c], 0xfe
add ecx, 0x56f3663b
imul edx, dword [ebp - 0x2c], 0xfe
sub ecx, edx
xor eax, ecx
imul eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1e30], eax
push edx
push esi
add esp, 4
add edx, 0x8749
and edx, 0x382e
or edx, 0x162a6
sub edx, 0x7aad
Function at 0x412730
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
sub ecx, 0x61da
pop ecx
push ecx
push edi
add esp, 4
xor ecx, 0x51ba
sub ecx, 0x7a15
pop ecx
mov dword [ebp - 0x209c], 0xe
push esi
add esi, 0x90db
sub esi, 0xe773
jmp 0x412766
jmp 0x41276c
pop esi
push edx
push eax
add esp, 4
and edx, 0xbffc
sub edx, 0xeda4
and edx, 0x12f98
pop edx
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xbec]
mov dword [ebp - 0x15c4], eax
push eax
and eax, 0x10749
and eax, 0xb8ff
pop eax
push edx
push edx
add esp, 4
and edx, 0x118cc
pop edx
push esi
push esi
add esp, 4
and esi, 0x7738
or esi, 0x321f
sub esi, 0x9e7
pop esi
mov dword [ebp - 0x20a0], 0xffffffff
push ecx
xor ecx, 0x90cc
and ecx, 0x15398
and ecx, 0x9151
add ecx, 0xf92c
pop ecx
push ebx
and ebx, 0x7788
call 0x412804
add byte [esi], dh
cmp al, 0x4e
dec esp
inc eax
cmp al, byte [ebp - 0x7d]
les eax, [ebx + ebx*2]
mov ecx, dword [ebp - 0x3f0]
mov dword [ebp - 0x4fc], ecx
jmp 0x412825

Function at 0x412804
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
sub ecx, 0x61da
pop ecx
push ecx
push edi
add esp, 4
xor ecx, 0x51ba
sub ecx, 0x7a15
pop ecx
mov dword [ebp - 0x209c], 0xe
push esi
add esi, 0x90db
sub esi, 0xe773
jmp 0x412766
jmp 0x41276c
pop esi
push edx
push eax
add esp, 4
and edx, 0xbffc
sub edx, 0xeda4
and edx, 0x12f98
pop edx
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xbec]
mov dword [ebp - 0x15c4], eax
push eax
and eax, 0x10749
and eax, 0xb8ff
pop eax
push edx
push edx
add esp, 4
and edx, 0x118cc
pop edx
push esi
push esi
add esp, 4
and esi, 0x7738
or esi, 0x321f
sub esi, 0x9e7
pop esi
mov dword [ebp - 0x20a0], 0xffffffff
push ecx
xor ecx, 0x90cc
and ecx, 0x15398
and ecx, 0x9151
add ecx, 0xf92c
pop ecx
push ebx
and ebx, 0x7788
call 0x412804
add byte [esi], dh
cmp al, 0x4e
dec esp
inc eax
cmp al, byte [ebp - 0x7d]
les eax, [ebx + ebx*2]
mov ecx, dword [ebp - 0x3f0]
mov dword [ebp - 0x4fc], ecx
jmp 0x412825
Function at 0x412ae1
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ecx
push ecx
xor ecx, 0x17e3e
add ecx, 0xc7e8
pop ecx
push edi
push edx
add esp, 4
or edi, 0xe7f5
pop edi
mov dword [ebp - 0x3e8], 0
Function at 0x41333f
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x41334e
add byte [0x3a48483d], dh
xor al, 0x83
les eax, [ecx + eax*4]
into
mov word [ebx], ss
add dword [eax], eax
and esi, 0x102ba
pop esi
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0x31c], eax
jmp 0x4133d4
push eax
or eax, 0x15e2c
pop eax
push esi
push edx
add esp, 4
xor esi, 0x15a04
and esi, 0xa546
or esi, 0x38ef
call 0x413402
add byte [eax + 0x32], al
inc edx
inc ebp
dec ebx
dec ecx
dec ebx
inc esi
dec ebp
add esp, 4
pop esi
cmp dword [ebp - 0x31c], 0
jne 0x413d1f
mov edx, 0x6b
mov word [ebp - 0x1774], dx
mov eax, 0x65
mov word [ebp - 0x1772], ax
mov ecx, 0x72
mov word [ebp - 0x1770], cx
mov edx, 0x6e
mov word [ebp - 0x176e], dx
mov eax, 0x65
mov word [ebp - 0x176c], ax
mov ecx, 0x6c
mov word [ebp - 0x176a], cx
mov edx, 0x33

Function at 0x41334e
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x41334e
add byte [0x3a48483d], dh
xor al, 0x83
les eax, [ecx + eax*4]
into
mov word [ebx], ss
add dword [eax], eax
and esi, 0x102ba
pop esi
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0x31c], eax
jmp 0x4133d4
push eax
or eax, 0x15e2c
pop eax
push esi
push edx
add esp, 4
xor esi, 0x15a04
and esi, 0xa546
or esi, 0x38ef
call 0x413402
add byte [eax + 0x32], al
inc edx
inc ebp
dec ebx
dec ecx
dec ebx
inc esi
dec ebp
add esp, 4
pop esi
cmp dword [ebp - 0x31c], 0
jne 0x413d1f
mov edx, 0x6b
mov word [ebp - 0x1774], dx
mov eax, 0x65
mov word [ebp - 0x1772], ax
mov ecx, 0x72
mov word [ebp - 0x1770], cx
mov edx, 0x6e
mov word [ebp - 0x176e], dx
mov eax, 0x65
mov word [ebp - 0x176c], ax
mov ecx, 0x6c
mov word [ebp - 0x176a], cx
mov edx, 0x33

Function at 0x413402
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x41334e
add byte [0x3a48483d], dh
xor al, 0x83
les eax, [ecx + eax*4]
into
mov word [ebx], ss
add dword [eax], eax
and esi, 0x102ba
pop esi
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0x31c], eax
jmp 0x4133d4
push eax
or eax, 0x15e2c
pop eax
push esi
push edx
add esp, 4
xor esi, 0x15a04
and esi, 0xa546
or esi, 0x38ef
call 0x413402
add byte [eax + 0x32], al
inc edx
inc ebp
dec ebx
dec ecx
dec ebx
inc esi
dec ebp
add esp, 4
pop esi
cmp dword [ebp - 0x31c], 0
jne 0x413d1f
mov edx, 0x6b
mov word [ebp - 0x1774], dx
mov eax, 0x65
mov word [ebp - 0x1772], ax
mov ecx, 0x72
mov word [ebp - 0x1770], cx
mov edx, 0x6e
mov word [ebp - 0x176e], dx
mov eax, 0x65
mov word [ebp - 0x176c], ax
mov ecx, 0x6c
mov word [ebp - 0x176a], cx
mov edx, 0x33
Function at 0x413621
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov word [ebp - 0x1768], dx
mov eax, 0x32
mov word [ebp - 0x1766], ax
mov ecx, 0x2e
mov word [ebp - 0x1764], cx
mov edx, 0x64
mov word [ebp - 0x1762], dx
mov eax, 0x6c
mov word [ebp - 0x1760], ax
mov ecx, 0x6c
mov word [ebp - 0x175e], cx
xor edx, edx
mov word [ebp - 0x175c], dx
push eax
push ebx
add esp, 4
xor eax, 0x143d4
or eax, 0x70d1
pop eax
push edi
push ecx
add esp, 4
xor edi, 0x47a6
xor edi, 0xc1c9
jmp 0x4134d8
jmp 0x4134dd
pop edi
mov byte [ebp - 0x894], 0x4c
mov byte [ebp - 0x893], 0x6f
mov byte [ebp - 0x892], 0x61
mov byte [ebp - 0x891], 0x64
mov byte [ebp - 0x890], 0x4c
mov byte [ebp - 0x88f], 0x69
mov byte [ebp - 0x88e], 0x62
mov byte [ebp - 0x88d], 0x72
mov byte [ebp - 0x88c], 0x61
mov byte [ebp - 0x88b], 0x72
mov byte [ebp - 0x88a], 0x79
mov byte [ebp - 0x889], 0x57
mov byte [ebp - 0x888], 0
mov eax, dword fs:[0x18]
mov dword [ebp - 0x195c], eax
mov ecx, dword [ebp - 0x195c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x1960], edx
mov eax, dword [ebp - 0x1960]
mov dword [ebp - 0x15e4], eax
push edx
push edi
add esp, 4
xor edx, 0xd714
sub edx, 0x9461
pop edx
push ebx
push ecx
add esp, 4
add ebx, 0x79ad
pop ebx
push edx
sub edx, 0xac07
pop edx
push ecx
push eax
add esp, 4
or ecx, 0x17fd2
pop ecx
cmp dword [ebp - 0x15e4], 0
jne 0x4135aa
mov dword [ebp - 0x750], 0
jmp 0x413866
mov ecx, dword [ebp - 0x15e4]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xca4], eax
push ecx
sub ecx, 0x9f08
add ecx, 0xb163
xor ecx, 0x7740
pop ecx
push eax
push eax
add esp, 4
and eax, 0x16677
add eax, 0x16691
sub eax, 0x153d1
sub eax, 0x159d7
pop eax
cmp dword [ebp - 0xca4], 0
jne 0x413606
mov dword [ebp - 0x750], 0
jmp 0x413866
mov ecx, dword [ebp - 0xca4]
mov dword [ebp - 0x508], ecx
push ebx
call 0x413621
add byte [eax + ecx*2], dh
inc ebx
cmp eax, dword [esi + 0x43]
dec ebp
xor eax, 0x8104c483
ret
push edx
sub edx, 0x15a1f
pop edx
push ecx
push esi
add esp, 4
add ecx, 0x9862
jmp 0x413881
pop ecx
push esi
or esi, 0xa04d
pop esi
push eax
or eax, 0xa9b2
or eax, 0x5c06
pop eax
cmp dword [ebp - 0x750], 0
jne 0x4138e2
push esi
push edi
add esp, 4
add esi, 0x4b70
and esi, 0x1628e
jmp 0x4138b8
pop esi
push edi
push eax
add esp, 4
jmp 0x4138c4
jmp 0x4138cc
sub edi, 0x6aab
pop edi
mov dword [ebp - 0x79c], 0
jmp 0x414409
push ecx
push eax
add esp, 4
xor ecx, 0x2289
pop ecx
push edi
push ecx
add esp, 4
or edi, 0xf15c
pop edi
push eax
jmp 0x413900
and eax, 0x3ce0
sub eax, 0x2369
jmp 0x413913
pop eax
mov eax, dword [ebp - 0x750]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x320], ecx
mov dword [ebp - 0x760], 0
mov edx, dword [ebp - 0x320]
mov dword [ebp - 0x15f0], edx
cmp dword [ebp - 0x15f0], 0

Function at 0x4137cc
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edi
push esi
push esi
add esp, 4
sub esi, 0x5ea6
or esi, 0x4369
add esi, 0x15bf1
pop esi
push esi
and esi, 0x1486c
pop esi
mov ecx, dword [ebp - 0x508]
mov dword [ebp - 0x750], ecx
jmp 0x413866