joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41951d
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop esi
mov ecx, dword [ebp - 0x4d8]
mov dword [ebp - 0x6ec], ecx
jmp 0x419597

Function at 0x419555
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ecx
push edi
sub edi, 0x7222
pop edi
mov edx, dword [ebp - 0x4d8]
mov eax, dword [edx]
mov dword [ebp - 0x4d8], eax
mov ecx, dword [ebp - 0x4d8]
cmp ecx, dword [ebp - 0xc2c]
je 0x41958d
mov edx, dword [ebp - 0x4d8]
cmp dword [edx + 0x30], 0
jne 0x419343
mov dword [ebp - 0x6ec], 0
Function at 0x4195ab
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
add ecx, 0x224a
sub ecx, 0x994c
pop ecx
movzx eax, word [ebp - 0x104]
test eax, eax
jne 0x419483
movzx ecx, word [ebp - 0x1fc]
movzx edx, word [ebp - 0x104]
sub ecx, edx
mov dword [ebp - 0x14e4], ecx
jmp 0x4194e6
movzx eax, word [ebp - 0x1fc]
movzx ecx, word [ebp - 0x104]
cmp eax, ecx
je 0x4193a2
movzx edx, word [ebp - 0x1fc]
xor edx, 0x20
movzx eax, word [ebp - 0x104]
cmp edx, eax
je 0x4193a2
movzx ecx, word [ebp - 0x1fc]
movzx edx, word [ebp - 0x104]
cmp ecx, edx
jge 0x4194d0
mov dword [ebp - 0x14e0], 0xffffffff
jmp 0x4194da
mov dword [ebp - 0x14e0], 1
mov eax, dword [ebp - 0x14e0]
mov dword [ebp - 0x14e4], eax
cmp dword [ebp - 0x14e4], 0
jne 0x41952f
push edx
push edi
add esp, 4
and edx, 0x652f
xor edx, 0x15dc0
add edx, 0x5f2f
add edx, 0xaa8
pop edx
push esi
call fcn.0041951d
add byte [edx + 0x47], al
cmp byte [eax], bh
inc ecx
inc eax
xor eax, 0xc483454f
add esp, 4
pop esi
push eax
add eax, 0x527a
pop eax
push ecx
push edx
add esp, 4
sub ecx, 0xcae9
pop ecx
push ecx
push edx
add esp, 4
call fcn.00419555
add byte [edx + 0x38], cl
inc ecx
cmp byte [esi + 0x50], cl
push edx
push ecx
add esp, 4
call 0x4195ab
add byte [edx + 0x32], cl
inc eax
cmp al, 0x47
dec ebx
inc esi
xor al, 0x4f
add esp, 4
call 0x4195bd
add byte [edi + 0x42], cl
dec ecx
dec esp
inc ebx
aaa
dec edx
inc edx
cmp al, 0x83
les eax, [edx + ebx*2]
push ebx
add ebx, 0x86ec
pop ebx
cmp dword [ebp - 0x6ec], 0
jne 0x419613
push esi
add esi, 0x184f8
sub esi, 0x140e4
add esi, 0x1568f
add esi, 0xea04
pop esi
push eax
push esi
add esp, 4
xor eax, 0x3c2b
xor eax, 0xf408
or eax, 0x4618
pop eax
mov dword [ebp - 0x738], 0
jmp 0x41a13a
push ebx
or ebx, 0x1d7c
sub ebx, 0x10ef8
xor ebx, 0x6fac
and ebx, 0xd7e0
pop ebx
push ebx
push edi
add esp, 4
add ebx, 0x180a1
jmp 0x41963d
jmp 0x419644
pop ebx
mov eax, dword [ebp - 0x6ec]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x2f8], ecx
mov dword [ebp - 0x6fc], 0
mov edx, dword [ebp - 0x2f8]
mov dword [ebp - 0x14e8], edx
cmp dword [ebp - 0x14e8], 0
jne 0x419684
mov eax, dword [ebp - 0x6fc]
mov dword [ebp - 0x3c4], eax
jmp 0x419975
mov ecx, dword [ebp - 0x14e8]
mov edx, dword [ebp - 0x2f8]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x14ec], edx
jne 0x4196ac
mov eax, dword [ebp - 0x6fc]
mov dword [ebp - 0x3c4], eax
jmp 0x419975
mov ecx, 8
imul edx, ecx, 0
mov eax, dword [ebp - 0x14ec]
mov ecx, dword [eax + edx + 0x78]
mov dword [ebp - 0x14f0], ecx
cmp dword [ebp - 0x14f0], 0
jne 0x4196de
mov edx, dword [ebp - 0x6fc]
mov dword [ebp - 0x3c4], edx
jmp 0x419975
mov eax, dword [ebp - 0x2f8]
add eax, dword [ebp - 0x14f0]
mov dword [ebp - 0x6f0], eax
jne 0x419703
mov ecx, dword [ebp - 0x6fc]
mov dword [ebp - 0x3c4], ecx
jmp 0x419975
mov edx, dword [ebp - 0x6f0]
mov eax, dword [ebp - 0x2f8]
add eax, dword [edx + 0x20]
mov dword [ebp - 0x18a0], eax
mov ecx, dword [ebp - 0x6f0]
mov edx, dword [ebp - 0x2f8]
add edx, dword [ecx + 0x24]
mov dword [ebp - 0x18a4], edx
mov eax, dword [ebp - 0x6f0]
mov ecx, dword [ebp - 0x2f8]
add ecx, dword [eax + 0x1c]
mov dword [ebp - 0x18a8], ecx
mov dword [ebp - 0x6f4], 0
jmp 0x41975d
Function at 0x4195bd
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
add ecx, 0x224a
sub ecx, 0x994c
pop ecx
movzx eax, word [ebp - 0x104]
test eax, eax
jne 0x419483
movzx ecx, word [ebp - 0x1fc]
movzx edx, word [ebp - 0x104]
sub ecx, edx
mov dword [ebp - 0x14e4], ecx
jmp 0x4194e6
movzx eax, word [ebp - 0x1fc]
movzx ecx, word [ebp - 0x104]
cmp eax, ecx
je 0x4193a2
movzx edx, word [ebp - 0x1fc]
xor edx, 0x20
movzx eax, word [ebp - 0x104]
cmp edx, eax
je 0x4193a2
movzx ecx, word [ebp - 0x1fc]
movzx edx, word [ebp - 0x104]
cmp ecx, edx
jge 0x4194d0
mov dword [ebp - 0x14e0], 0xffffffff
jmp 0x4194da
mov dword [ebp - 0x14e0], 1
mov eax, dword [ebp - 0x14e0]
mov dword [ebp - 0x14e4], eax
cmp dword [ebp - 0x14e4], 0
jne 0x41952f
push edx
push edi
add esp, 4
and edx, 0x652f
xor edx, 0x15dc0
add edx, 0x5f2f
add edx, 0xaa8
pop edx
push esi
call fcn.0041951d
add byte [edx + 0x47], al
cmp byte [eax], bh
inc ecx
inc eax
xor eax, 0xc483454f
add esp, 4
pop esi
push eax
add eax, 0x527a
pop eax
push ecx
push edx
add esp, 4
sub ecx, 0xcae9
pop ecx
push ecx
push edx
add esp, 4
call fcn.00419555
add byte [edx + 0x38], cl
inc ecx
cmp byte [esi + 0x50], cl
push edx
push ecx
add esp, 4
call 0x4195ab
add byte [edx + 0x32], cl
inc eax
cmp al, 0x47
dec ebx
inc esi
xor al, 0x4f
add esp, 4
call 0x4195bd
add byte [edi + 0x42], cl
dec ecx
dec esp
inc ebx
aaa
dec edx
inc edx
cmp al, 0x83
les eax, [edx + ebx*2]
push ebx
add ebx, 0x86ec
pop ebx
cmp dword [ebp - 0x6ec], 0
jne 0x419613
push esi
add esi, 0x184f8
sub esi, 0x140e4
add esi, 0x1568f
add esi, 0xea04
pop esi
push eax
push esi
add esp, 4
xor eax, 0x3c2b
xor eax, 0xf408
or eax, 0x4618
pop eax
mov dword [ebp - 0x738], 0
jmp 0x41a13a
push ebx
or ebx, 0x1d7c
sub ebx, 0x10ef8
xor ebx, 0x6fac
and ebx, 0xd7e0
pop ebx
push ebx
push edi
add esp, 4
add ebx, 0x180a1
jmp 0x41963d
jmp 0x419644
pop ebx
mov eax, dword [ebp - 0x6ec]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x2f8], ecx
mov dword [ebp - 0x6fc], 0
mov edx, dword [ebp - 0x2f8]
mov dword [ebp - 0x14e8], edx
cmp dword [ebp - 0x14e8], 0
jne 0x419684
mov eax, dword [ebp - 0x6fc]
mov dword [ebp - 0x3c4], eax
jmp 0x419975
mov ecx, dword [ebp - 0x14e8]
mov edx, dword [ebp - 0x2f8]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x14ec], edx
jne 0x4196ac
mov eax, dword [ebp - 0x6fc]
mov dword [ebp - 0x3c4], eax
jmp 0x419975
mov ecx, 8
imul edx, ecx, 0
mov eax, dword [ebp - 0x14ec]
mov ecx, dword [eax + edx + 0x78]
mov dword [ebp - 0x14f0], ecx
cmp dword [ebp - 0x14f0], 0
jne 0x4196de
mov edx, dword [ebp - 0x6fc]
mov dword [ebp - 0x3c4], edx
jmp 0x419975
mov eax, dword [ebp - 0x2f8]
add eax, dword [ebp - 0x14f0]
mov dword [ebp - 0x6f0], eax
jne 0x419703
mov ecx, dword [ebp - 0x6fc]
mov dword [ebp - 0x3c4], ecx
jmp 0x419975
mov edx, dword [ebp - 0x6f0]
mov eax, dword [ebp - 0x2f8]
add eax, dword [edx + 0x20]
mov dword [ebp - 0x18a0], eax
mov ecx, dword [ebp - 0x6f0]
mov edx, dword [ebp - 0x2f8]
add edx, dword [ecx + 0x24]
mov dword [ebp - 0x18a4], edx
mov eax, dword [ebp - 0x6f0]
mov ecx, dword [ebp - 0x2f8]
add ecx, dword [eax + 0x1c]
mov dword [ebp - 0x18a8], ecx
mov dword [ebp - 0x6f4], 0
jmp 0x41975d
Function at 0x419ba0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
dec eax
xor byte [ecx - 0xc3373], cl
push dword [ebx]
shl byte [esi - 0x77], cl
xchg ebp, eax
add dh, bh
invalid

Function at 0x419d06
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
sub edx, 0x16595
pop edx
push edi
push eax
add esp, 4
jmp 0x419d1b
jmp 0x419d23
pop edi
mov ecx, dword [ebp - 0x4dc]
mov dword [ebp - 0x2e0], ecx
jmp 0x419d9a
push ecx
push edi
add esp, 4
or ecx, 0x7c4f
sub ecx, 0x10a7a
and ecx, 0x7d70
pop ecx
push eax
push edx
add esp, 4
add eax, 0x15c98
or eax, 0x7a9f
pop eax
push edx
sub edx, 0x87e4
pop edx
mov eax, dword [ebp - 0x2e0]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x2fc], ecx
push esi
push edx
add esp, 4
and esi, 0x10550
or esi, 0x15e5b
pop esi
push eax
and eax, 0xd15b
call fcn.00419e03
add byte [ecx + 0x3c], al
inc edx
push eax
cmp dword [ebp + 0x45], ecx
inc ebp

Function at 0x419e03
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
add eax, 0x14a44
pop eax
mov dword [ebp - 0x70c], 0
mov edx, dword [ebp - 0x2fc]
mov dword [ebp - 0x1500], edx
cmp dword [ebp - 0x1500], 0
jne 0x419e3d
mov eax, dword [ebp - 0x70c]
mov dword [ebp - 0x4e0], eax
jmp 0x41a12e
mov ecx, dword [ebp - 0x1500]
mov edx, dword [ebp - 0x2fc]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x1504], edx
jne 0x419e65
mov eax, dword [ebp - 0x70c]
mov dword [ebp - 0x4e0], eax
jmp 0x41a12e
mov ecx, 8
imul edx, ecx, 0
mov eax, dword [ebp - 0x1504]
mov ecx, dword [eax + edx + 0x78]
mov dword [ebp - 0x1508], ecx
cmp dword [ebp - 0x1508], 0
jne 0x419e97
mov edx, dword [ebp - 0x70c]
mov dword [ebp - 0x4e0], edx
jmp 0x41a12e
mov eax, dword [ebp - 0x2fc]
add eax, dword [ebp - 0x1508]
mov dword [ebp - 0x700], eax
jne 0x419ebc
mov ecx, dword [ebp - 0x70c]
mov dword [ebp - 0x4e0], ecx
jmp 0x41a12e
mov edx, dword [ebp - 0x700]
mov eax, dword [ebp - 0x2fc]
add eax, dword [edx + 0x20]
invalid
test dword [eax - 0x19], eax
invalid

Function at 0x419ed0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
dec dword [ebx - 0x6ff73]
dec dword [ebx - 0x2fb6b]
inc dword [ebx]
push ecx
and al, 0x89
xchg ebp, eax
cmp al, 0xe7
invalid
Function at 0x419f40
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x704]
add edx, 1
mov dword [ebp - 0x704], edx
mov dword [ebp - 0x708], ecx
mov edx, dword [ebp - 0x704]
mov eax, dword [ebp - 0x18c4]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x18c8]
mov eax, dword [ebp - 0x2fc]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x18cc], eax
mov dword [ebp - 0x184], 0
jmp 0x419f86
mov ecx, dword [ebp - 0x184]
add ecx, 1
mov dword [ebp - 0x184], ecx
mov edx, dword [ebp - 0x708]
add edx, dword [ebp - 0x184]
movsx eax, byte [edx]
test eax, eax
je 0x41a038
mov ecx, dword [ebp - 0x184]
movsx edx, byte [ebp + ecx - 0x804]
test edx, edx
je 0x41a038
push eax
push esi
add esp, 4
and eax, 0x126cb
pop eax
push eax
jmp 0x419fc5
call 0x419fd5
add byte [ebx + 0x38], al
dec eax
cmp esi, dword [edx]
xor al, byte [edi + 0x3d]
dec esp
inc eax
add esp, 4
and eax, 0x7c1b
xor eax, 0x58ef
pop eax
mov eax, dword [ebp - 0x708]
invalid
test dword [esi + edi*8 - 1], edi

Function at 0x419fd5
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x704]
add edx, 1
mov dword [ebp - 0x704], edx
mov dword [ebp - 0x708], ecx
mov edx, dword [ebp - 0x704]
mov eax, dword [ebp - 0x18c4]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x18c8]
mov eax, dword [ebp - 0x2fc]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x18cc], eax
mov dword [ebp - 0x184], 0
jmp 0x419f86
mov ecx, dword [ebp - 0x184]
add ecx, 1
mov dword [ebp - 0x184], ecx
mov edx, dword [ebp - 0x708]
add edx, dword [ebp - 0x184]
movsx eax, byte [edx]
test eax, eax
je 0x41a038
mov ecx, dword [ebp - 0x184]
movsx edx, byte [ebp + ecx - 0x804]
test edx, edx
je 0x41a038
push eax
push esi
add esp, 4
and eax, 0x126cb
pop eax
push eax
jmp 0x419fc5
call 0x419fd5
add byte [ebx + 0x38], al
dec eax
cmp esi, dword [edx]
xor al, byte [edi + 0x3d]
dec esp
inc eax
add esp, 4
and eax, 0x7c1b
xor eax, 0x58ef
pop eax
mov eax, dword [ebp - 0x708]
invalid
test dword [esi + edi*8 - 1], edi

Function at 0x41a32f
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
and ecx, 0x1a1f
pop ecx
mov eax, dword fs:[0x18]
mov dword [ebp - 0x1c34], eax
mov ecx, dword [ebp - 0x1c34]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x18d4], edx
mov eax, dword [ebp - 0x18d4]
mov dword [ebp - 0x150c], eax
push edx
push edx
add esp, 4
or edx, 0x181bf
xor edx, 0x12f82
call 0x41a381
add byte [ecx + 0x3d], cl
inc esp
cmp al, byte [eax + 0x35]
inc edx
inc esp
dec edx
add esp, 4
pop edx
push esi
push edi
add esp, 4
jmp 0x41a391
pop esi
cmp dword [ebp - 0x150c], 0
jne 0x41a3aa
mov dword [ebp - 0x2a8], 0
jmp 0x41a651
mov ecx, dword [ebp - 0x150c]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xc4c], eax
push eax
call 0x41a3cc
push ebx
xor ebx, 0x172bd
and ebx, 0xa416
pop ebx
push ebx
or ebx, 0x169a0
pop ebx
push esi
jmp 0x41a66d
call 0x41a679
add byte [edx + 0x32], cl
inc esp
inc esp
cmp al, byte [ebx - 0x7d]
les eax, [ecx + eax*4]
invalid
Function at 0x41a381
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
and ecx, 0x1a1f
pop ecx
mov eax, dword fs:[0x18]
mov dword [ebp - 0x1c34], eax
mov ecx, dword [ebp - 0x1c34]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x18d4], edx
mov eax, dword [ebp - 0x18d4]
mov dword [ebp - 0x150c], eax
push edx
push edx
add esp, 4
or edx, 0x181bf
xor edx, 0x12f82
call 0x41a381
add byte [ecx + 0x3d], cl
inc esp
cmp al, byte [eax + 0x35]
inc edx
inc esp
dec edx
add esp, 4
pop edx
push esi
push edi
add esp, 4
jmp 0x41a391
pop esi
cmp dword [ebp - 0x150c], 0
jne 0x41a3aa
mov dword [ebp - 0x2a8], 0
jmp 0x41a651
mov ecx, dword [ebp - 0x150c]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xc4c], eax
push eax
call 0x41a3cc
push ebx
xor ebx, 0x172bd
and ebx, 0xa416
pop ebx
push ebx
or ebx, 0x169a0
pop ebx
push esi
jmp 0x41a66d
call 0x41a679
add byte [edx + 0x32], cl
inc esp
inc esp
cmp al, byte [ebx - 0x7d]
les eax, [ecx + eax*4]
invalid

Function at 0x41a3a0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
inc dword [eax]
add byte [eax], al
add cl, ch
cmpsd dword [esi], dword es:[edi]
add al, byte [eax]
add byte [ebx - 0x150b73], cl
dec dword [ebx + 0x428b0c51]
or al, 0x89
test dword [ebx + esi*8 - 0x17af0001], esi
or al, byte [eax]
add byte [eax], al
add byte [eax], bh
aaa
dec ebx
dec edx
inc ebp
cmp dh, byte [esi]
inc ebp
dec esp
add esp, 4
pop eax
push edx
push eax
add esp, 4
xor edx, 0x64c0
or edx, 0x1148e
pop edx
push eax
push eax
add esp, 4
jmp 0x41a3ed
pop eax
cmp dword [ebp - 0xc4c], 0
jne 0x41a406
mov dword [ebp - 0x2a8], 0
jmp 0x41a651
mov ecx, dword [ebp - 0xc4c]
mov dword [ebp - 0x4e4], ecx
push edi
push ecx
add esp, 4
jmp 0x41a41e
or edi, 0x6119
pop edi
push esi
call 0x41a434
add byte [edi + 0x4b], cl
dec esp
dec eax
inc edx
inc ebp
inc edx
aaa
add esp, 4
pop esi
push esi
push edx
add esp, 4
or esi, 0x2825
pop esi
lea edx, [ebp - 0x1628]
mov dword [ebp - 0xc48], edx
mov eax, dword [ebp - 0x4e4]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc44], ecx
xor edx, edx
mov word [ebp - 0x204], dx
xor eax, eax
mov word [ebp - 0x38], ax
push esi
and esi, 0x14671
call 0x41a485
add byte [eax], bh
dec esi
inc eax
xor edi, dword [edi]
push eax
dec edx
inc esi
cmp al, 0x3c
add esp, 4
and esi, 0x13b92
call 0x41a49c
add byte [edi + 0x4f], al
dec ebp
inc esi
xor al, 0x45
dec edx
inc ebp
add esp, 4
pop esi
mov ecx, dword [ebp - 0xc44]
mov dx, word [ecx]
mov word [ebp - 0xf8a], dx
mov eax, dword [ebp - 0xc44]
add eax, 2
mov dword [ebp - 0xc44], eax
mov cx, word [ebp - 0xf8a]
mov word [ebp - 0x204], cx
mov edx, dword [ebp - 0xc48]
mov ax, word [edx]
mov word [ebp - 0xf8c], ax
mov ecx, dword [ebp - 0xc48]
add ecx, 2
mov dword [ebp - 0xc48], ecx
invalid
invalid
xchg ebp, eax
invalid
Function at 0x41a3cc
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
inc dword [eax]
add byte [eax], al
add cl, ch
cmpsd dword [esi], dword es:[edi]
add al, byte [eax]
add byte [ebx - 0x150b73], cl
dec dword [ebx + 0x428b0c51]
or al, 0x89
test dword [ebx + esi*8 - 0x17af0001], esi
or al, byte [eax]
add byte [eax], al
add byte [eax], bh
aaa
dec ebx
dec edx
inc ebp
cmp dh, byte [esi]
inc ebp
dec esp
add esp, 4
pop eax
push edx
push eax
add esp, 4
xor edx, 0x64c0
or edx, 0x1148e
pop edx
push eax
push eax
add esp, 4
jmp 0x41a3ed
pop eax
cmp dword [ebp - 0xc4c], 0
jne 0x41a406
mov dword [ebp - 0x2a8], 0
jmp 0x41a651
mov ecx, dword [ebp - 0xc4c]
mov dword [ebp - 0x4e4], ecx
push edi
push ecx
add esp, 4
jmp 0x41a41e
or edi, 0x6119
pop edi
push esi
call 0x41a434
add byte [edi + 0x4b], cl
dec esp
dec eax
inc edx
inc ebp
inc edx
aaa
add esp, 4
pop esi
push esi
push edx
add esp, 4
or esi, 0x2825
pop esi
lea edx, [ebp - 0x1628]
mov dword [ebp - 0xc48], edx
mov eax, dword [ebp - 0x4e4]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc44], ecx
xor edx, edx
mov word [ebp - 0x204], dx
xor eax, eax
mov word [ebp - 0x38], ax
push esi
and esi, 0x14671
call 0x41a485
add byte [eax], bh
dec esi
inc eax
xor edi, dword [edi]
push eax
dec edx
inc esi
cmp al, 0x3c
add esp, 4
and esi, 0x13b92
call 0x41a49c
add byte [edi + 0x4f], al
dec ebp
inc esi
xor al, 0x45
dec edx
inc ebp
add esp, 4
pop esi
mov ecx, dword [ebp - 0xc44]
mov dx, word [ecx]
mov word [ebp - 0xf8a], dx
mov eax, dword [ebp - 0xc44]
add eax, 2
mov dword [ebp - 0xc44], eax
mov cx, word [ebp - 0xf8a]
mov word [ebp - 0x204], cx
mov edx, dword [ebp - 0xc48]
mov ax, word [edx]
mov word [ebp - 0xf8c], ax
mov ecx, dword [ebp - 0xc48]
add ecx, 2
mov dword [ebp - 0xc48], ecx
invalid
invalid
xchg ebp, eax
invalid
Function at 0x41a434
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
inc dword [eax]
add byte [eax], al
add cl, ch
cmpsd dword [esi], dword es:[edi]
add al, byte [eax]
add byte [ebx - 0x150b73], cl
dec dword [ebx + 0x428b0c51]
or al, 0x89
test dword [ebx + esi*8 - 0x17af0001], esi
or al, byte [eax]
add byte [eax], al
add byte [eax], bh
aaa
dec ebx
dec edx
inc ebp
cmp dh, byte [esi]
inc ebp
dec esp
add esp, 4
pop eax
push edx
push eax
add esp, 4
xor edx, 0x64c0
or edx, 0x1148e
pop edx
push eax
push eax
add esp, 4
jmp 0x41a3ed
pop eax
cmp dword [ebp - 0xc4c], 0
jne 0x41a406
mov dword [ebp - 0x2a8], 0
jmp 0x41a651
mov ecx, dword [ebp - 0xc4c]
mov dword [ebp - 0x4e4], ecx
push edi
push ecx
add esp, 4
jmp 0x41a41e
or edi, 0x6119
pop edi
push esi
call 0x41a434
add byte [edi + 0x4b], cl
dec esp
dec eax
inc edx
inc ebp
inc edx
aaa
add esp, 4
pop esi
push esi
push edx
add esp, 4
or esi, 0x2825
pop esi
lea edx, [ebp - 0x1628]
mov dword [ebp - 0xc48], edx
mov eax, dword [ebp - 0x4e4]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc44], ecx
xor edx, edx
mov word [ebp - 0x204], dx
xor eax, eax
mov word [ebp - 0x38], ax
push esi
and esi, 0x14671
call 0x41a485
add byte [eax], bh
dec esi
inc eax
xor edi, dword [edi]
push eax
dec edx
inc esi
cmp al, 0x3c
add esp, 4
and esi, 0x13b92
call 0x41a49c
add byte [edi + 0x4f], al
dec ebp
inc esi
xor al, 0x45
dec edx
inc ebp
add esp, 4
pop esi
mov ecx, dword [ebp - 0xc44]
mov dx, word [ecx]
mov word [ebp - 0xf8a], dx
mov eax, dword [ebp - 0xc44]
add eax, 2
mov dword [ebp - 0xc44], eax
mov cx, word [ebp - 0xf8a]
mov word [ebp - 0x204], cx
mov edx, dword [ebp - 0xc48]
mov ax, word [edx]
mov word [ebp - 0xf8c], ax
mov ecx, dword [ebp - 0xc48]
add ecx, 2
mov dword [ebp - 0xc48], ecx
invalid
invalid
xchg ebp, eax
invalid
Function at 0x41a485
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
inc dword [eax]
add byte [eax], al
add cl, ch
cmpsd dword [esi], dword es:[edi]
add al, byte [eax]
add byte [ebx - 0x150b73], cl
dec dword [ebx + 0x428b0c51]
or al, 0x89
test dword [ebx + esi*8 - 0x17af0001], esi
or al, byte [eax]
add byte [eax], al
add byte [eax], bh
aaa
dec ebx
dec edx
inc ebp
cmp dh, byte [esi]
inc ebp
dec esp
add esp, 4
pop eax
push edx
push eax
add esp, 4
xor edx, 0x64c0
or edx, 0x1148e
pop edx
push eax
push eax
add esp, 4
jmp 0x41a3ed
pop eax
cmp dword [ebp - 0xc4c], 0
jne 0x41a406
mov dword [ebp - 0x2a8], 0
jmp 0x41a651
mov ecx, dword [ebp - 0xc4c]
mov dword [ebp - 0x4e4], ecx
push edi
push ecx
add esp, 4
jmp 0x41a41e
or edi, 0x6119
pop edi
push esi
call 0x41a434
add byte [edi + 0x4b], cl
dec esp
dec eax
inc edx
inc ebp
inc edx
aaa
add esp, 4
pop esi
push esi
push edx
add esp, 4
or esi, 0x2825
pop esi
lea edx, [ebp - 0x1628]
mov dword [ebp - 0xc48], edx
mov eax, dword [ebp - 0x4e4]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc44], ecx
xor edx, edx
mov word [ebp - 0x204], dx
xor eax, eax
mov word [ebp - 0x38], ax
push esi
and esi, 0x14671
call 0x41a485
add byte [eax], bh
dec esi
inc eax
xor edi, dword [edi]
push eax
dec edx
inc esi
cmp al, 0x3c
add esp, 4
and esi, 0x13b92
call 0x41a49c
add byte [edi + 0x4f], al
dec ebp
inc esi
xor al, 0x45
dec edx
inc ebp
add esp, 4
pop esi
mov ecx, dword [ebp - 0xc44]
mov dx, word [ecx]
mov word [ebp - 0xf8a], dx
mov eax, dword [ebp - 0xc44]
add eax, 2
mov dword [ebp - 0xc44], eax
mov cx, word [ebp - 0xf8a]
mov word [ebp - 0x204], cx
mov edx, dword [ebp - 0xc48]
mov ax, word [edx]
mov word [ebp - 0xf8c], ax
mov ecx, dword [ebp - 0xc48]
add ecx, 2
mov dword [ebp - 0xc48], ecx
invalid
invalid
xchg ebp, eax
invalid
Function at 0x41a49c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
inc dword [eax]
add byte [eax], al
add cl, ch
cmpsd dword [esi], dword es:[edi]
add al, byte [eax]
add byte [ebx - 0x150b73], cl
dec dword [ebx + 0x428b0c51]
or al, 0x89
test dword [ebx + esi*8 - 0x17af0001], esi
or al, byte [eax]
add byte [eax], al
add byte [eax], bh
aaa
dec ebx
dec edx
inc ebp
cmp dh, byte [esi]
inc ebp
dec esp
add esp, 4
pop eax
push edx
push eax
add esp, 4
xor edx, 0x64c0
or edx, 0x1148e
pop edx
push eax
push eax
add esp, 4
jmp 0x41a3ed
pop eax
cmp dword [ebp - 0xc4c], 0
jne 0x41a406
mov dword [ebp - 0x2a8], 0
jmp 0x41a651
mov ecx, dword [ebp - 0xc4c]
mov dword [ebp - 0x4e4], ecx
push edi
push ecx
add esp, 4
jmp 0x41a41e
or edi, 0x6119
pop edi
push esi
call 0x41a434
add byte [edi + 0x4b], cl
dec esp
dec eax
inc edx
inc ebp
inc edx
aaa
add esp, 4
pop esi
push esi
push edx
add esp, 4
or esi, 0x2825
pop esi
lea edx, [ebp - 0x1628]
mov dword [ebp - 0xc48], edx
mov eax, dword [ebp - 0x4e4]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc44], ecx
xor edx, edx
mov word [ebp - 0x204], dx
xor eax, eax
mov word [ebp - 0x38], ax
push esi
and esi, 0x14671
call 0x41a485
add byte [eax], bh
dec esi
inc eax
xor edi, dword [edi]
push eax
dec edx
inc esi
cmp al, 0x3c
add esp, 4
and esi, 0x13b92
call 0x41a49c
add byte [edi + 0x4f], al
dec ebp
inc esi
xor al, 0x45
dec edx
inc ebp
add esp, 4
pop esi
mov ecx, dword [ebp - 0xc44]
mov dx, word [ecx]
mov word [ebp - 0xf8a], dx
mov eax, dword [ebp - 0xc44]
add eax, 2
mov dword [ebp - 0xc44], eax
mov cx, word [ebp - 0xf8a]
mov word [ebp - 0x204], cx
mov edx, dword [ebp - 0xc48]
mov ax, word [edx]
mov word [ebp - 0xf8c], ax
mov ecx, dword [ebp - 0xc48]
add ecx, 2
mov dword [ebp - 0xc48], ecx
invalid
invalid
xchg ebp, eax
invalid

Function at 0x41a5d7
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ecx
mov ecx, dword [ebp - 0x4e4]
mov dword [ebp - 0x2a8], ecx
jmp 0x41a651

Function at 0x41a5f9
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor eax, 0xb0a7
sub eax, 0x11760
pop eax
push ecx
push eax
add esp, 4
and ecx, 0x2c45
xor ecx, 0xd727
pop ecx
mov edx, dword [ebp - 0x4e4]
mov eax, dword [edx]
mov dword [ebp - 0x4e4], eax
mov ecx, dword [ebp - 0x4e4]
cmp ecx, dword [ebp - 0xc4c]
je 0x41a647
mov edx, dword [ebp - 0x4e4]
cmp dword [edx + 0x30], 0
add byte [edi], cl
test ebx, ecx
std
invalid
invalid
mov dword [ebp - 0x2a8], 0
Function at 0x41a679
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
and ecx, 0x1a1f
pop ecx
mov eax, dword fs:[0x18]
mov dword [ebp - 0x1c34], eax
mov ecx, dword [ebp - 0x1c34]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x18d4], edx
mov eax, dword [ebp - 0x18d4]
mov dword [ebp - 0x150c], eax
push edx
push edx
add esp, 4
or edx, 0x181bf
xor edx, 0x12f82
call 0x41a381
add byte [ecx + 0x3d], cl
inc esp
cmp al, byte [eax + 0x35]
inc edx
inc esp
dec edx
add esp, 4
pop edx
push esi
push edi
add esp, 4
jmp 0x41a391
pop esi
cmp dword [ebp - 0x150c], 0
jne 0x41a3aa
mov dword [ebp - 0x2a8], 0
jmp 0x41a651
mov ecx, dword [ebp - 0x150c]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xc4c], eax
push eax
call 0x41a3cc
push ebx
xor ebx, 0x172bd
and ebx, 0xa416
pop ebx
push ebx
or ebx, 0x169a0
pop ebx
push esi
jmp 0x41a66d
call 0x41a679
add byte [edx + 0x32], cl
inc esp
inc esp
cmp al, byte [ebx - 0x7d]
les eax, [ecx + eax*4]
invalid