joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408144
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
inc esi
inc ebx
cmp bh, byte [esi]
cmp al, byte [ecx + 0x12772e9]
add byte [ecx + 0x51], bl
mov edx, 0x6b
mov word [ebp - 0x1754], dx
mov eax, 0x65
mov word [ebp - 0x1752], ax
mov ecx, 0x72
mov word [ebp - 0x1750], cx
mov edx, 0x6e
mov word [ebp - 0x174e], dx
mov eax, 0x65
mov word [ebp - 0x174c], ax
mov ecx, 0x6c
mov word [ebp - 0x174a], cx
mov edx, 0x33
mov word [ebp - 0x1748], dx
mov eax, 0x32
invalid
invalid

Function at 0x4081cc
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
test dword [edx - 0x46000018], edi
add byte cs:[eax], al
add byte [esi - 0x77], ah
lea edi, [eax + ebp*8 + 0x64baffff]
add byte [eax], al
add byte [esi - 0x77], ah

Function at 0x4081e4
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
xchg ebp, eax
mov esi, 0xb8ffffe8
insb byte es:[edi], dx
add byte [eax], al
add byte [esi - 0x77], ah
test eax, eax
call 0x6cfa81f6
add byte [eax], al
add byte [esi - 0x77], ah
invalid

Function at 0x408284
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
jb 0x408261
invalid
jae 0x408268
invalid
je 0x40826f
invalid
jne 0x408276
invalid
jbe 0x40827d
invalid

Function at 0x40829c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [ecx - 0x19ab7b], cl
dec dword [ebx - 0x19ab73]
dec dword [ebx - 0x6a76cfaf]
mov dword [ebp - 0x19b0], edx
mov eax, dword [ebp - 0x19b0]
mov dword [ebp - 0x15e4], eax
push edi
push edi

Function at 0x4082ac
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 0x19b0], edx
mov eax, dword [ebp - 0x19b0]
mov dword [ebp - 0x15e4], eax
push edi
push edi
add esp, 4
or edi, 0x634b
jmp 0x4082d2
pop edi
push edi
jmp 0x4082dd
sub edi, 0x15b50
and edi, 0x97a1
add edi, 0x11d97
pop edi
cmp dword [ebp - 0x15e4], 0
jne 0x408308
mov dword [ebp - 0x750], 0
jmp 0x4085c4
mov ecx, dword [ebp - 0x15e4]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
invalid
invalid
pop esp
invalid

Function at 0x40833c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
aaa
dec ebp
dec edi
add esp, 4
add edi, 0x11fa
sub edi, 0x3f9a
pop edi

Function at 0x40834c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp dword [ebp - 0xca4], 0
jne 0x408364
mov dword [ebp - 0x750], 0
jmp 0x4085c4
mov ecx, dword [ebp - 0xca4]
mov dword [ebp - 0x508], ecx
push ecx
push eax
add esp, 4
add ecx, 0xf154
sub ecx, 0x69bb
pop ecx
push edx
push ecx
add esp, 4
sub edx, 0x3f58
pop edx
push edi
push ecx
add esp, 4
jmp 0x408399
jmp 0x4083a1
pop edi
lea edx, [ebp - 0x1754]
mov dword [ebp - 0xca0], edx
mov eax, dword [ebp - 0x508]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc9c], ecx
xor edx, edx
mov word [ebp - 0x214], dx
xor eax, eax
mov word [ebp - 0x110], ax
push ebx
call 0x4085d5
add byte [eax], bh
Function at 0x4083d0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
xor ebx, 0x22
call 0x4083e5
add byte [eax], al
add byte [eax], al
xor bh, byte [edx]
inc ebx
xor eax, 0x3c4c3949
cmp dword [ebx - 0x347efb3c], eax
sahf
push es
add dword [eax], eax
jmp 0x4083f4
pop ebx
push esi
push edi
add esp, 4
or esi, 0x5177
pop esi
mov ecx, dword [ebp - 0xc9c]
mov dx, word [ecx]
mov word [ebp - 0x1036], dx
mov eax, dword [ebp - 0xc9c]
add eax, 2
mov dword [ebp - 0xc9c], eax
mov cx, word [ebp - 0x1036]
mov word [ebp - 0x214], cx
mov edx, dword [ebp - 0xca0]
mov ax, word [edx]
mov word [ebp - 0x1038], ax
mov ecx, dword [ebp - 0xca0]
add ecx, 2
mov dword [ebp - 0xca0], ecx
mov dx, word [ebp - 0x1038]
mov word [ebp - 0x110], dx
push ecx
push edx
add esp, 4
or ecx, 0xd7eb
add ecx, 0x9f8
pop ecx
push esi
push edi
add esp, 4
jmp 0x408478
pop esi
push esi
xor esi, 0x15a83
or esi, 0x1f6a
or esi, 0x115ab
pop esi
movzx eax, word [ebp - 0x110]
test eax, eax
jne 0x4084b0
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
sub ecx, edx
mov dword [ebp - 0x15ec], ecx
jmp 0x408513
movzx eax, word [ebp - 0x214]
movzx ecx, word [ebp - 0x110]
cmp eax, ecx
je 0x4083cf
movzx edx, word [ebp - 0x214]
xor edx, 0x20
movzx eax, word [ebp - 0x110]
cmp edx, eax
je 0x4083cf
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
cmp ecx, edx
jge 0x4084fd
invalid
mov dword [ebp - 0x15e8], 0xffffffff
jmp 0x408507
mov dword [ebp - 0x15e8], 1
mov eax, dword [ebp - 0x15e8]
mov dword [ebp - 0x15ec], eax
cmp dword [ebp - 0x15ec], 0
jne 0x40855c
push ebx
or ebx, 0xd841
pop ebx
push edi
push edi
add esp, 4
sub edi, 0x1afd
pop edi
push edi
or edi, 0x891a
or edi, 0xbb51
sub edi, 0x1707b
pop edi
push esi
call 0x40857e
add byte [edx], dh
cmp byte [eax + 0x39], al
cmp dh, byte [0x4c4833e]
xor esi, 0x6d74
and esi, 0x4c2b
out 0x2b, al
dec esp
add byte [eax], al
pop esi
mov edx, dword [ebp - 0x508]
mov eax, dword [edx]
mov dword [ebp - 0x508], eax
mov ecx, dword [ebp - 0x508]
cmp ecx, dword [ebp - 0xca4]

Function at 0x4083d8
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
add byte [eax], al
xor bh, byte [edx]
inc ebx
xor eax, 0x3c4c3949
cmp dword [ebx - 0x347efb3c], eax
sahf
push es
add dword [eax], eax

Function at 0x4083e5
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
add byte [eax], al
xor bh, byte [edx]
inc ebx
xor eax, 0x3c4c3949
cmp dword [ebx - 0x347efb3c], eax
sahf
push es
add dword [eax], eax

Function at 0x408530
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
add esp, 4
xor edi, 0x9c61
xor edi, 0x1020a
pop edi
push edx
push ebx
add esp, 4
jmp 0x40854d
pop edx
mov ecx, dword [ebp - 0x508]
mov dword [ebp - 0x750], ecx
jmp 0x4085c4
Function at 0x40857e
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
xor ebx, 0x22
call 0x4083e5
add byte [eax], al
add byte [eax], al
xor bh, byte [edx]
inc ebx
xor eax, 0x3c4c3949
cmp dword [ebx - 0x347efb3c], eax
sahf
push es
add dword [eax], eax
jmp 0x4083f4
pop ebx
push esi
push edi
add esp, 4
or esi, 0x5177
pop esi
mov ecx, dword [ebp - 0xc9c]
mov dx, word [ecx]
mov word [ebp - 0x1036], dx
mov eax, dword [ebp - 0xc9c]
add eax, 2
mov dword [ebp - 0xc9c], eax
mov cx, word [ebp - 0x1036]
mov word [ebp - 0x214], cx
mov edx, dword [ebp - 0xca0]
mov ax, word [edx]
mov word [ebp - 0x1038], ax
mov ecx, dword [ebp - 0xca0]
add ecx, 2
mov dword [ebp - 0xca0], ecx
mov dx, word [ebp - 0x1038]
mov word [ebp - 0x110], dx
push ecx
push edx
add esp, 4
or ecx, 0xd7eb
add ecx, 0x9f8
pop ecx
push esi
push edi
add esp, 4
jmp 0x408478
pop esi
push esi
xor esi, 0x15a83
or esi, 0x1f6a
or esi, 0x115ab
pop esi
movzx eax, word [ebp - 0x110]
test eax, eax
jne 0x4084b0
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
sub ecx, edx
mov dword [ebp - 0x15ec], ecx
jmp 0x408513
movzx eax, word [ebp - 0x214]
movzx ecx, word [ebp - 0x110]
cmp eax, ecx
je 0x4083cf
movzx edx, word [ebp - 0x214]
xor edx, 0x20
movzx eax, word [ebp - 0x110]
cmp edx, eax
je 0x4083cf
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
cmp ecx, edx
jge 0x4084fd
invalid
mov dword [ebp - 0x15e8], 0xffffffff
jmp 0x408507
mov dword [ebp - 0x15e8], 1
mov eax, dword [ebp - 0x15e8]
mov dword [ebp - 0x15ec], eax
cmp dword [ebp - 0x15ec], 0
jne 0x40855c
push ebx
or ebx, 0xd841
pop ebx
push edi
push edi
add esp, 4
sub edi, 0x1afd
pop edi
push edi
or edi, 0x891a
or edi, 0xbb51
sub edi, 0x1707b
pop edi
push esi
call 0x40857e
add byte [edx], dh
cmp byte [eax + 0x39], al
cmp dh, byte [0x4c4833e]
xor esi, 0x6d74
and esi, 0x4c2b
out 0x2b, al
dec esp
add byte [eax], al
pop esi
mov edx, dword [ebp - 0x508]
mov eax, dword [edx]
mov dword [ebp - 0x508], eax
mov ecx, dword [ebp - 0x508]
cmp ecx, dword [ebp - 0xca4]

Function at 0x4085a8
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
je 0x4085ba
mov edx, dword [ebp - 0x508]
cmp dword [edx + 0x30], 0
jne 0x408370
invalid
invalid
Function at 0x4087a4
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
dec dword [ebx - 0x19b37b]
dec dword [ebx - 0x31f73]
inc dword [ebx]
or al, 0x90
Function at 0x40888c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ebp - 0x198]
add ecx, 1
mov dword [ebp - 0x198], ecx
mov eax, dword [ebp - 0x198]
movsx ecx, byte [ebp + eax - 0x894]
cmp edx, ecx
jne 0x4088a5
jmp 0x4087eb
jmp 0x4088ac
Function at 0x408a15
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor edx, 0x17847
pop edx
mov ecx, dword [ebp - 0x19c4]
mov dword [ebp - 0x19c8], ecx
lea edx, [ebp - 0x1738]
push edx
call dword [ebp - 0x19c8]
test eax, eax
jne 0x408a7d
push ebx
push eax
add esp, 4
jmp 0x408a47
pop ebx
push ebx
push edi
add esp, 4
call 0x408a5c
add byte [ecx*2 + 0x45464237], bh
inc esp
cmp dword [edx - 0x7d], eax
les eax, [ebx + ebx*2]
push edx
sub edx, 0x529
or edx, 0xbdd3
pop edx
mov dword [ebp - 0x79c], 0
jmp 0x409167

Function at 0x408a5c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor edx, 0x17847
pop edx
mov ecx, dword [ebp - 0x19c4]
mov dword [ebp - 0x19c8], ecx
lea edx, [ebp - 0x1738]
push edx
call dword [ebp - 0x19c8]
test eax, eax
jne 0x408a7d
push ebx
push eax
add esp, 4
jmp 0x408a47
pop ebx
push ebx
push edi
add esp, 4
call 0x408a5c
add byte [ecx*2 + 0x45464237], bh
inc esp
cmp dword [edx - 0x7d], eax
les eax, [ebx + ebx*2]
push edx
sub edx, 0x529
or edx, 0xbdd3
pop edx
mov dword [ebp - 0x79c], 0
jmp 0x409167
Function at 0x408b94
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ecx
push edx
add esp, 4
add ecx, 0xd122
pop ecx
push eax
sub eax, 0x49a7
jmp 0x408ba1
call 0x408bb0
add byte [edx + eax*2], dh
dec esp
inc ebp
inc edi
xor ecx, dword [eax - 0x7d]
les eax, [ecx + eax*4]
enter 0x1a67, 0
add byte [eax - 0x73], bl
xchg ebp, eax
enter 0xffffffffffffffe8, 0xffffffffffffffff
mov dword [ebp - 0xcb0], edx
mov eax, dword [ebp - 0x50c]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcac], ecx
xor edx, edx
mov word [ebp - 0x218], dx
xor eax, eax
mov word [ebp - 0x34], ax
push edi
jmp 0x408bea
pop edi
push esi
push eax
add esp, 4
xor esi, 0x147cb
jmp 0x408bfb
pop esi
push ecx
sub ecx, 0xe8a6
and ecx, 0x1556
sub ecx, 0x11854
or ecx, 0xf216
pop ecx
mov ecx, dword [ebp - 0xcac]
mov dx, word [ecx]
mov word [ebp - 0x103a], dx
mov eax, dword [ebp - 0xcac]
add eax, 2
mov dword [ebp - 0xcac], eax
mov cx, word [ebp - 0x103a]
mov word [ebp - 0x218], cx
mov edx, dword [ebp - 0xcb0]
mov ax, word [edx]
mov word [ebp - 0x103c], ax
mov ecx, dword [ebp - 0xcb0]
add ecx, 2
mov dword [ebp - 0xcb0], ecx
mov dx, word [ebp - 0x103c]
mov word [ebp - 0x34], dx
push edi
push esi
add esp, 4
sub edi, 0xc912
or edi, 0xe74e
pop edi
push esi
push edx
add esp, 4
sub esi, 0x10902
pop esi
push esi
and esi, 0xc03e
add esi, 0xf93
xor esi, 0x438f
pop esi
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x408cbc
movzx ecx, word [ebp - 0x218]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x1604], ecx
jmp 0x408d16
movzx eax, word [ebp - 0x218]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x408be4
movzx edx, word [ebp - 0x218]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x408be4
movzx ecx, word [ebp - 0x218]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x408d00
mov dword [ebp - 0x1600], 0xffffffff
jmp 0x408d0a
mov dword [ebp - 0x1600], 1
mov eax, dword [ebp - 0x1600]
mov dword [ebp - 0x1604], eax
cmp dword [ebp - 0x1604], 0
jne 0x408d5f
push eax
call 0x408d30
add byte [ecx], bh
push eax
inc esp
dec ebp
aas
inc edi
dec ebp
xor al, byte [eax - 0x7d]
les eax, [eax + ebx*2]
push edx
add edx, 0xe39d
jmp 0x408d44
sub edx, 0x11fb0
xor edx, 0x135b9
pop edx
mov ecx, dword [ebp - 0x50c]
mov dword [ebp - 0x31c], ecx
jmp 0x408dc7
push edi
push edx
add esp, 4
or edi, 0x8d36
sub edi, 0x792a
call 0x408d7e
add byte [esi], dh
cmp al, 0x33
dec eax
dec ecx
inc esp
inc edx
inc edi
add esp, 4
call 0x408d8d
add byte [eax + eax*2], dh
dec eax
xor dh, byte [esi + edi]
add esp, 4
pop edi
mov edx, dword [ebp - 0x50c]
mov eax, dword [edx]
mov dword [ebp - 0x50c], eax
mov ecx, dword [ebp - 0x50c]
cmp ecx, dword [ebp - 0xcb4]
invalid
Function at 0x408bb0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ecx
push edx
add esp, 4
add ecx, 0xd122
pop ecx
push eax
sub eax, 0x49a7
jmp 0x408ba1
call 0x408bb0
add byte [edx + eax*2], dh
dec esp
inc ebp
inc edi
xor ecx, dword [eax - 0x7d]
les eax, [ecx + eax*4]
enter 0x1a67, 0
add byte [eax - 0x73], bl
xchg ebp, eax
enter 0xffffffffffffffe8, 0xffffffffffffffff
mov dword [ebp - 0xcb0], edx
mov eax, dword [ebp - 0x50c]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcac], ecx
xor edx, edx
mov word [ebp - 0x218], dx
xor eax, eax
mov word [ebp - 0x34], ax
push edi
jmp 0x408bea
pop edi
push esi
push eax
add esp, 4
xor esi, 0x147cb
jmp 0x408bfb
pop esi
push ecx
sub ecx, 0xe8a6
and ecx, 0x1556
sub ecx, 0x11854
or ecx, 0xf216
pop ecx
mov ecx, dword [ebp - 0xcac]
mov dx, word [ecx]
mov word [ebp - 0x103a], dx
mov eax, dword [ebp - 0xcac]
add eax, 2
mov dword [ebp - 0xcac], eax
mov cx, word [ebp - 0x103a]
mov word [ebp - 0x218], cx
mov edx, dword [ebp - 0xcb0]
mov ax, word [edx]
mov word [ebp - 0x103c], ax
mov ecx, dword [ebp - 0xcb0]
add ecx, 2
mov dword [ebp - 0xcb0], ecx
mov dx, word [ebp - 0x103c]
mov word [ebp - 0x34], dx
push edi
push esi
add esp, 4
sub edi, 0xc912
or edi, 0xe74e
pop edi
push esi
push edx
add esp, 4
sub esi, 0x10902
pop esi
push esi
and esi, 0xc03e
add esi, 0xf93
xor esi, 0x438f
pop esi
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x408cbc
movzx ecx, word [ebp - 0x218]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x1604], ecx
jmp 0x408d16
movzx eax, word [ebp - 0x218]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x408be4
movzx edx, word [ebp - 0x218]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x408be4
movzx ecx, word [ebp - 0x218]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x408d00
mov dword [ebp - 0x1600], 0xffffffff
jmp 0x408d0a
mov dword [ebp - 0x1600], 1
mov eax, dword [ebp - 0x1600]
mov dword [ebp - 0x1604], eax
cmp dword [ebp - 0x1604], 0
jne 0x408d5f
push eax
call 0x408d30
add byte [ecx], bh
push eax
inc esp
dec ebp
aas
inc edi
dec ebp
xor al, byte [eax - 0x7d]
les eax, [eax + ebx*2]
push edx
add edx, 0xe39d
jmp 0x408d44
sub edx, 0x11fb0
xor edx, 0x135b9
pop edx
mov ecx, dword [ebp - 0x50c]
mov dword [ebp - 0x31c], ecx
jmp 0x408dc7
push edi
push edx
add esp, 4
or edi, 0x8d36
sub edi, 0x792a
call 0x408d7e
add byte [esi], dh
cmp al, 0x33
dec eax
dec ecx
inc esp
inc edx
inc edi
add esp, 4
call 0x408d8d
add byte [eax + eax*2], dh
dec eax
xor dh, byte [esi + edi]
add esp, 4
pop edi
mov edx, dword [ebp - 0x50c]
mov eax, dword [edx]
mov dword [ebp - 0x50c], eax
mov ecx, dword [ebp - 0x50c]
cmp ecx, dword [ebp - 0xcb4]
invalid
Function at 0x408d1c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ecx
push edx
add esp, 4
add ecx, 0xd122
pop ecx
push eax
sub eax, 0x49a7
jmp 0x408ba1
call 0x408bb0
add byte [edx + eax*2], dh
dec esp
inc ebp
inc edi
xor ecx, dword [eax - 0x7d]
les eax, [ecx + eax*4]
enter 0x1a67, 0
add byte [eax - 0x73], bl
xchg ebp, eax
enter 0xffffffffffffffe8, 0xffffffffffffffff
mov dword [ebp - 0xcb0], edx
mov eax, dword [ebp - 0x50c]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcac], ecx
xor edx, edx
mov word [ebp - 0x218], dx
xor eax, eax
mov word [ebp - 0x34], ax
push edi
jmp 0x408bea
pop edi
push esi
push eax
add esp, 4
xor esi, 0x147cb
jmp 0x408bfb
pop esi
push ecx
sub ecx, 0xe8a6
and ecx, 0x1556
sub ecx, 0x11854
or ecx, 0xf216
pop ecx
mov ecx, dword [ebp - 0xcac]
mov dx, word [ecx]
mov word [ebp - 0x103a], dx
mov eax, dword [ebp - 0xcac]
add eax, 2
mov dword [ebp - 0xcac], eax
mov cx, word [ebp - 0x103a]
mov word [ebp - 0x218], cx
mov edx, dword [ebp - 0xcb0]
mov ax, word [edx]
mov word [ebp - 0x103c], ax
mov ecx, dword [ebp - 0xcb0]
add ecx, 2
mov dword [ebp - 0xcb0], ecx
mov dx, word [ebp - 0x103c]
mov word [ebp - 0x34], dx
push edi
push esi
add esp, 4
sub edi, 0xc912
or edi, 0xe74e
pop edi
push esi
push edx
add esp, 4
sub esi, 0x10902
pop esi
push esi
and esi, 0xc03e
add esi, 0xf93
xor esi, 0x438f
pop esi
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x408cbc
movzx ecx, word [ebp - 0x218]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x1604], ecx
jmp 0x408d16
movzx eax, word [ebp - 0x218]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x408be4
movzx edx, word [ebp - 0x218]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x408be4
movzx ecx, word [ebp - 0x218]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x408d00
mov dword [ebp - 0x1600], 0xffffffff
jmp 0x408d0a
mov dword [ebp - 0x1600], 1
mov eax, dword [ebp - 0x1600]
mov dword [ebp - 0x1604], eax
cmp dword [ebp - 0x1604], 0
jne 0x408d5f
push eax
call 0x408d30
add byte [ecx], bh
push eax
inc esp
dec ebp
aas
inc edi
dec ebp
xor al, byte [eax - 0x7d]
les eax, [eax + ebx*2]
push edx
add edx, 0xe39d
jmp 0x408d44
sub edx, 0x11fb0
xor edx, 0x135b9
pop edx
mov ecx, dword [ebp - 0x50c]
mov dword [ebp - 0x31c], ecx
jmp 0x408dc7
push edi
push edx
add esp, 4
or edi, 0x8d36
sub edi, 0x792a
call 0x408d7e
add byte [esi], dh
cmp al, 0x33
dec eax
dec ecx
inc esp
inc edx
inc edi
add esp, 4
call 0x408d8d
add byte [eax + eax*2], dh
dec eax
xor dh, byte [esi + edi]
add esp, 4
pop edi
mov edx, dword [ebp - 0x50c]
mov eax, dword [edx]
mov dword [ebp - 0x50c], eax
mov ecx, dword [ebp - 0x50c]
cmp ecx, dword [ebp - 0xcb4]
invalid
Function at 0x408d30
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ecx
push edx
add esp, 4
add ecx, 0xd122
pop ecx
push eax
sub eax, 0x49a7
jmp 0x408ba1
call 0x408bb0
add byte [edx + eax*2], dh
dec esp
inc ebp
inc edi
xor ecx, dword [eax - 0x7d]
les eax, [ecx + eax*4]
enter 0x1a67, 0
add byte [eax - 0x73], bl
xchg ebp, eax
enter 0xffffffffffffffe8, 0xffffffffffffffff
mov dword [ebp - 0xcb0], edx
mov eax, dword [ebp - 0x50c]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcac], ecx
xor edx, edx
mov word [ebp - 0x218], dx
xor eax, eax
mov word [ebp - 0x34], ax
push edi
jmp 0x408bea
pop edi
push esi
push eax
add esp, 4
xor esi, 0x147cb
jmp 0x408bfb
pop esi
push ecx
sub ecx, 0xe8a6
and ecx, 0x1556
sub ecx, 0x11854
or ecx, 0xf216
pop ecx
mov ecx, dword [ebp - 0xcac]
mov dx, word [ecx]
mov word [ebp - 0x103a], dx
mov eax, dword [ebp - 0xcac]
add eax, 2
mov dword [ebp - 0xcac], eax
mov cx, word [ebp - 0x103a]
mov word [ebp - 0x218], cx
mov edx, dword [ebp - 0xcb0]
mov ax, word [edx]
mov word [ebp - 0x103c], ax
mov ecx, dword [ebp - 0xcb0]
add ecx, 2
mov dword [ebp - 0xcb0], ecx
mov dx, word [ebp - 0x103c]
mov word [ebp - 0x34], dx
push edi
push esi
add esp, 4
sub edi, 0xc912
or edi, 0xe74e
pop edi
push esi
push edx
add esp, 4
sub esi, 0x10902
pop esi
push esi
and esi, 0xc03e
add esi, 0xf93
xor esi, 0x438f
pop esi
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x408cbc
movzx ecx, word [ebp - 0x218]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x1604], ecx
jmp 0x408d16
movzx eax, word [ebp - 0x218]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x408be4
movzx edx, word [ebp - 0x218]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x408be4
movzx ecx, word [ebp - 0x218]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x408d00
mov dword [ebp - 0x1600], 0xffffffff
jmp 0x408d0a
mov dword [ebp - 0x1600], 1
mov eax, dword [ebp - 0x1600]
mov dword [ebp - 0x1604], eax
cmp dword [ebp - 0x1604], 0
jne 0x408d5f
push eax
call 0x408d30
add byte [ecx], bh
push eax
inc esp
dec ebp
aas
inc edi
dec ebp
xor al, byte [eax - 0x7d]
les eax, [eax + ebx*2]
push edx
add edx, 0xe39d
jmp 0x408d44
sub edx, 0x11fb0
xor edx, 0x135b9
pop edx
mov ecx, dword [ebp - 0x50c]
mov dword [ebp - 0x31c], ecx
jmp 0x408dc7
push edi
push edx
add esp, 4
or edi, 0x8d36
sub edi, 0x792a
call 0x408d7e
add byte [esi], dh
cmp al, 0x33
dec eax
dec ecx
inc esp
inc edx
inc edi
add esp, 4
call 0x408d8d
add byte [eax + eax*2], dh
dec eax
xor dh, byte [esi + edi]
add esp, 4
pop edi
mov edx, dword [ebp - 0x50c]
mov eax, dword [edx]
mov dword [ebp - 0x50c], eax
mov ecx, dword [ebp - 0x50c]
cmp ecx, dword [ebp - 0xcb4]
invalid
Function at 0x408d7e
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ecx
push edx
add esp, 4
add ecx, 0xd122
pop ecx
push eax
sub eax, 0x49a7
jmp 0x408ba1
call 0x408bb0
add byte [edx + eax*2], dh
dec esp
inc ebp
inc edi
xor ecx, dword [eax - 0x7d]
les eax, [ecx + eax*4]
enter 0x1a67, 0
add byte [eax - 0x73], bl
xchg ebp, eax
enter 0xffffffffffffffe8, 0xffffffffffffffff
mov dword [ebp - 0xcb0], edx
mov eax, dword [ebp - 0x50c]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcac], ecx
xor edx, edx
mov word [ebp - 0x218], dx
xor eax, eax
mov word [ebp - 0x34], ax
push edi
jmp 0x408bea
pop edi
push esi
push eax
add esp, 4
xor esi, 0x147cb
jmp 0x408bfb
pop esi
push ecx
sub ecx, 0xe8a6
and ecx, 0x1556
sub ecx, 0x11854
or ecx, 0xf216
pop ecx
mov ecx, dword [ebp - 0xcac]
mov dx, word [ecx]
mov word [ebp - 0x103a], dx
mov eax, dword [ebp - 0xcac]
add eax, 2
mov dword [ebp - 0xcac], eax
mov cx, word [ebp - 0x103a]
mov word [ebp - 0x218], cx
mov edx, dword [ebp - 0xcb0]
mov ax, word [edx]
mov word [ebp - 0x103c], ax
mov ecx, dword [ebp - 0xcb0]
add ecx, 2
mov dword [ebp - 0xcb0], ecx
mov dx, word [ebp - 0x103c]
mov word [ebp - 0x34], dx
push edi
push esi
add esp, 4
sub edi, 0xc912
or edi, 0xe74e
pop edi
push esi
push edx
add esp, 4
sub esi, 0x10902
pop esi
push esi
and esi, 0xc03e
add esi, 0xf93
xor esi, 0x438f
pop esi
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x408cbc
movzx ecx, word [ebp - 0x218]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x1604], ecx
jmp 0x408d16
movzx eax, word [ebp - 0x218]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x408be4
movzx edx, word [ebp - 0x218]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x408be4
movzx ecx, word [ebp - 0x218]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x408d00
mov dword [ebp - 0x1600], 0xffffffff
jmp 0x408d0a
mov dword [ebp - 0x1600], 1
mov eax, dword [ebp - 0x1600]
mov dword [ebp - 0x1604], eax
cmp dword [ebp - 0x1604], 0
jne 0x408d5f
push eax
call 0x408d30
add byte [ecx], bh
push eax
inc esp
dec ebp
aas
inc edi
dec ebp
xor al, byte [eax - 0x7d]
les eax, [eax + ebx*2]
push edx
add edx, 0xe39d
jmp 0x408d44
sub edx, 0x11fb0
xor edx, 0x135b9
pop edx
mov ecx, dword [ebp - 0x50c]
mov dword [ebp - 0x31c], ecx
jmp 0x408dc7
push edi
push edx
add esp, 4
or edi, 0x8d36
sub edi, 0x792a
call 0x408d7e
add byte [esi], dh
cmp al, 0x33
dec eax
dec ecx
inc esp
inc edx
inc edi
add esp, 4
call 0x408d8d
add byte [eax + eax*2], dh
dec eax
xor dh, byte [esi + edi]
add esp, 4
pop edi
mov edx, dword [ebp - 0x50c]
mov eax, dword [edx]
mov dword [ebp - 0x50c], eax
mov ecx, dword [ebp - 0x50c]
cmp ecx, dword [ebp - 0xcb4]
invalid