joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41928f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004138d7
and dword [ebp - 4], 0
cmp dword [0x42d2b8], 0
mov ebx, eax
jne 0x419340
push 0x423f24
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x4193f1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push edi
call esi
test eax, eax
je 0x4193f1
push eax
call fcn.00413865
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x42d2b8], eax
call esi
push eax
call fcn.00413865
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x42d2bc], eax
call esi
push eax
call fcn.00413865
mov dword [esp], str.GetUserObjectInformationW
push edi
mov dword [0x42d2c0], eax
call esi
push eax
call fcn.00413865
pop ecx
mov dword [0x42d2c8], eax
test eax, eax
je 0x419340
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00413865
pop ecx
mov dword [0x42d2c4], eax
mov eax, dword [0x42d2c4]
cmp eax, ebx
je 0x419398
cmp dword [0x42d2c8], ebx
je 0x419398
push eax
call fcn.004138e0
push dword [0x42d2c8]
mov esi, eax
call fcn.004138e0
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x419398
test edi, edi
je 0x419398
call esi
test eax, eax
je 0x41938f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41938f
test byte [ebp - 0xc], 1
jne 0x419398
or dword [ebp + 0x10], 0x200000
jmp 0x4193d1
mov eax, dword [0x42d2bc]
cmp eax, ebx
je 0x4193d1
push eax
call fcn.004138e0
pop ecx
test eax, eax
je 0x4193d1
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4193d1
mov eax, dword [0x42d2c0]
cmp eax, ebx
je 0x4193d1
push eax
call fcn.004138e0
pop ecx
test eax, eax
je 0x4193d1
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42d2b8]
call fcn.004138e0
pop ecx
test eax, eax
je 0x4193f1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4193f3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41d115
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004138d7
and dword [ebp - 4], 0
cmp dword [0x42d438], 0
mov ebx, eax
jne 0x41d1c6
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41d277
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x424358
push edi
call esi
test eax, eax
je 0x41d277
push eax
call fcn.00413865
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x42d438], eax
call esi
push eax
call fcn.00413865
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x42d43c], eax
call esi
push eax
call fcn.00413865
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42d440], eax
call esi
push eax
call fcn.00413865
pop ecx
mov dword [0x42d448], eax
test eax, eax
je 0x41d1c6
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00413865
pop ecx
mov dword [0x42d444], eax
mov eax, dword [0x42d444]
cmp eax, ebx
je 0x41d21e
cmp dword [0x42d448], ebx
je 0x41d21e
push eax
call fcn.004138e0
push dword [0x42d448]
mov esi, eax
call fcn.004138e0
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41d21e
test edi, edi
je 0x41d21e
call esi
test eax, eax
je 0x41d215
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41d215
test byte [ebp - 0xc], 1
jne 0x41d21e
or dword [ebp + 0x10], 0x200000
jmp 0x41d257
mov eax, dword [0x42d43c]
cmp eax, ebx
je 0x41d257
push eax
call fcn.004138e0
pop ecx
test eax, eax
je 0x41d257
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41d257
mov eax, dword [0x42d440]
cmp eax, ebx
je 0x41d257
push eax
call fcn.004138e0
pop ecx
test eax, eax
je 0x41d257
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42d438]
call fcn.004138e0
pop ecx
test eax, eax
je 0x41d277
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41d279
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40c006
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ecx, 0xcbf
mov ebx, edx
xor word [eax], dx
lea edx, [ebx + edx]
xchg dh, dl
lea eax, [eax + 2]
loop 0x40c00e
pop ebx
ret
Function at 0x407e30
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407f09
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407e68
mov eax, dword [ebp - 4]
call fcn.00407220
jmp 0x407e70
mov eax, dword [ebp - 4]
call fcn.00407c1c
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407ebc
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407ea6
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.00407220
jmp 0x407eb8
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407c1c
inc ebx
dec esi
jne 0x407e80
push 1
push dword [ebp - 4]
push 0x407f20
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f84
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407f10
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x74256d24
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4330d2
mov ebx, 0x4304d8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
mov esi, 0x26bc2336
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x401ac0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1d500
call fcn.0040c070
mov eax, dword [0x413004]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x1d4e0], 0
push eax
push eax
push eax
mov word [ebp - 0x1d4cc], ax
lea eax, [ebp - 0x1d4dc]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x1d4e0]
mov dword [ebp - 0x1d4dc], 0x10001
push eax
mov dword [ebp - 0x1d4d8], 0xfa0
mov dword [ebp - 0x1d4d4], 0xfa0
mov dword [ebp - 0x1d4d0], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0x1d4c0
lea eax, [ebp - 0x1d4c8]
push 0
push eax
call fcn.004030b0
add esp, 0xc
xor eax, eax
mov edx, eax
movsx ecx, al
shr edx, 6
xor dl, al
movsx edx, dl
imul edx, ecx
mov byte [ebp + eax - 0x1d4c8], dl
inc eax
cmp eax, 0x1d4c0
jb 0x401b43
lea eax, [ebp - 0x1d4c8]
mov dword [ebp - 0x1d4fc], 0x1d4c0
mov dword [ebp - 0x1d500], eax
lea eax, [ebp - 0x1d500]
push 0x20
push eax
push dword [ebp - 0x1d4e0]
mov dword [ebp - 0x1d4f8], 0
mov dword [ebp - 0x1d4f4], 0
mov dword [ebp - 0x1d4f0], 0
mov dword [ebp - 0x1d4ec], 0
mov dword [ebp - 0x1d4e8], 0
mov dword [ebp - 0x1d4e4], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0x1d500]
push eax
push dword [ebp - 0x1d4e0]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0x1d500]
push eax
push dword [ebp - 0x1d4e0]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0x1d4e0]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004022f6
mov esp, ebp
pop ebp
ret
Function at 0x401ed0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x50950
call fcn.0040c070
mov eax, dword [0x413004]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x50930], 0
push eax
push eax
push eax
mov word [ebp - 0x5091c], ax
lea eax, [ebp - 0x5092c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x50930]
mov dword [ebp - 0x5092c], 0x10001
push eax
mov dword [ebp - 0x50928], 0x2af8
mov dword [ebp - 0x50924], 0x2af8
mov dword [ebp - 0x50920], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0x50910
lea eax, [ebp - 0x50918]
push 0
push eax
call fcn.004030b0
add esp, 0xc
xor eax, eax
mov edx, eax
mov ecx, eax
shr edx, 9
xor dl, al
shr ecx, 7
movsx ecx, cl
movsx edx, dl
imul edx, ecx
mov byte [ebp + eax - 0x50918], dl
inc eax
cmp eax, 0x50910
jb 0x401f53
lea eax, [ebp - 0x50918]
mov dword [ebp - 0x5094c], 0x50910
mov dword [ebp - 0x50950], eax
lea eax, [ebp - 0x50950]
push 0x20
push eax
push dword [ebp - 0x50930]
mov dword [ebp - 0x50948], 0
mov dword [ebp - 0x50944], 0
mov dword [ebp - 0x50940], 0
mov dword [ebp - 0x5093c], 0
mov dword [ebp - 0x50938], 0
mov dword [ebp - 0x50934], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0x50950]
push eax
push dword [ebp - 0x50930]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0x50950]
push eax
push dword [ebp - 0x50930]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0x50930]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004022f6
mov esp, ebp
pop ebp
ret
Function at 0x402190
Capabilities:
Create thread
Terminate process
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_MessageBoxW]
push edi
push 0x34
push str.Pandemonium2.0.exe
push str.This_is_a_safety_version_run_
push 0
call esi
cmp eax, 7
jne 0x4021bd
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x34
push str.Pandemonium2.0.exe
push str.Are_you_sure__It_will_still_move_your_mouse_and_window_and_it_contains_flashing_lights
push 0
call esi
cmp eax, 7
jne 0x4021da
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1b58
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x401350
push 0
push 0
call ebx
push 0
push 0
push 0
push 0x401380
push 0
push 0
call ebx
mov esi, eax
call fcn.00401ac0
push 0x7530
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0
push esi
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call edi
push 0
push 0
push 0
push 0x401490
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
call fcn.00401c10
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call ebx
push esi
call edi
push 0
push 0
push 0
push 0x401600
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
call fcn.00401d70
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call ebx
push esi
call edi
push 0
push 0
push 0
push 0x4017e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
call fcn.00401ed0
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call ebx
push esi
call edi
push 0
push 0
push 0
push 0x401880
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
call fcn.00402030
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call ebx
push esi
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4010e5
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edx
push esi
push edi
add esp, 4
xor esi, 0x14d95
pop esi
mov eax, 0x4d
mov word [ebp - 0x2030], ax
mov ecx, 0x42
mov word [ebp - 0x202e], cx
mov edx, 0x53
mov word [ebp - 0x202c], dx
mov eax, 0x65
mov word [ebp - 0x202a], ax
mov ecx, 0x72
mov word [ebp - 0x2028], cx
mov edx, 0x76
mov word [ebp - 0x2026], dx
mov eax, 0x69
mov word [ebp - 0x2024], ax
mov ecx, 0x63
mov word [ebp - 0x2022], cx
mov edx, 0x65
mov word [ebp - 0x2020], dx
mov eax, 0x2e
mov word [ebp - 0x201e], ax
mov ecx, 0x65
mov word [ebp - 0x201c], cx
mov edx, 0x78
mov word [ebp - 0x201a], dx
mov eax, 0x65
mov word [ebp - 0x2018], ax
xor ecx, ecx
mov word [ebp - 0x2016], cx
mov dword [ebp - 0x1064], 1
push eax
or eax, 0xa2e7
jmp 0x4011b1
add eax, 0x6193
pop eax
push eax
push esi
add esp, 4
and eax, 0x105c1
add eax, 0x4aa4
or eax, 0xe1bc
or eax, 0x97c5
pop eax
imul edx, dword [ebp - 0x1064], 0x138
add edx, 0x55f3663b
imul eax, dword [ebp - 0x1064], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0x1064]
imul ecx, dword [ebp - 0x1064], 0x138
sub edx, ecx
mov dword [ebp - 0x1068], edx
push edx
push edx
add esp, 4
xor edx, 0x1b56
call 0x401228
add byte [edx], dh
inc ecx
inc esp
cmp al, byte [ebx + eax*4 - 0x3c]
add al, 0xe8
or dword [eax], eax
add byte [eax], al
add byte [esi], bh
inc edx
inc esi
push eax
aaa
inc ebp
dec ecx
cmp byte [ebx - 0x157efb3c], al
jmp 0x5a401288

Function at 0x401228
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edx
push esi
push edi
add esp, 4
xor esi, 0x14d95
pop esi
mov eax, 0x4d
mov word [ebp - 0x2030], ax
mov ecx, 0x42
mov word [ebp - 0x202e], cx
mov edx, 0x53
mov word [ebp - 0x202c], dx
mov eax, 0x65
mov word [ebp - 0x202a], ax
mov ecx, 0x72
mov word [ebp - 0x2028], cx
mov edx, 0x76
mov word [ebp - 0x2026], dx
mov eax, 0x69
mov word [ebp - 0x2024], ax
mov ecx, 0x63
mov word [ebp - 0x2022], cx
mov edx, 0x65
mov word [ebp - 0x2020], dx
mov eax, 0x2e
mov word [ebp - 0x201e], ax
mov ecx, 0x65
mov word [ebp - 0x201c], cx
mov edx, 0x78
mov word [ebp - 0x201a], dx
mov eax, 0x65
mov word [ebp - 0x2018], ax
xor ecx, ecx
mov word [ebp - 0x2016], cx
mov dword [ebp - 0x1064], 1
push eax
or eax, 0xa2e7
jmp 0x4011b1
add eax, 0x6193
pop eax
push eax
push esi
add esp, 4
and eax, 0x105c1
add eax, 0x4aa4
or eax, 0xe1bc
or eax, 0x97c5
pop eax
imul edx, dword [ebp - 0x1064], 0x138
add edx, 0x55f3663b
imul eax, dword [ebp - 0x1064], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0x1064]
imul ecx, dword [ebp - 0x1064], 0x138
sub edx, ecx
mov dword [ebp - 0x1068], edx
push edx
push edx
add esp, 4
xor edx, 0x1b56
call 0x401228
add byte [edx], dh
inc ecx
inc esp
cmp al, byte [ebx + eax*4 - 0x3c]
add al, 0xe8
or dword [eax], eax
add byte [eax], al
add byte [esi], bh
inc edx
inc esi
push eax
aaa
inc ebp
dec ecx
cmp byte [ebx - 0x157efb3c], al
jmp 0x5a401288
Function at 0x401239
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edx
push esi
push edi
add esp, 4
xor esi, 0x14d95
pop esi
mov eax, 0x4d
mov word [ebp - 0x2030], ax
mov ecx, 0x42
mov word [ebp - 0x202e], cx
mov edx, 0x53
mov word [ebp - 0x202c], dx
mov eax, 0x65
mov word [ebp - 0x202a], ax
mov ecx, 0x72
mov word [ebp - 0x2028], cx
mov edx, 0x76
mov word [ebp - 0x2026], dx
mov eax, 0x69
mov word [ebp - 0x2024], ax
mov ecx, 0x63
mov word [ebp - 0x2022], cx
mov edx, 0x65
mov word [ebp - 0x2020], dx
mov eax, 0x2e
mov word [ebp - 0x201e], ax
mov ecx, 0x65
mov word [ebp - 0x201c], cx
mov edx, 0x78
mov word [ebp - 0x201a], dx
mov eax, 0x65
mov word [ebp - 0x2018], ax
xor ecx, ecx
mov word [ebp - 0x2016], cx
mov dword [ebp - 0x1064], 1
push eax
or eax, 0xa2e7
jmp 0x4011b1
add eax, 0x6193
pop eax
push eax
push esi
add esp, 4
and eax, 0x105c1
add eax, 0x4aa4
or eax, 0xe1bc
or eax, 0x97c5
pop eax
imul edx, dword [ebp - 0x1064], 0x138
add edx, 0x55f3663b
imul eax, dword [ebp - 0x1064], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0x1064]
imul ecx, dword [ebp - 0x1064], 0x138
sub edx, ecx
mov dword [ebp - 0x1068], edx
push edx
push edx
add esp, 4
xor edx, 0x1b56
call 0x401228
add byte [edx], dh
inc ecx
inc esp
cmp al, byte [ebx + eax*4 - 0x3c]
add al, 0xe8
or dword [eax], eax
add byte [eax], al
add byte [esi], bh
inc edx
inc esi
push eax
aaa
inc ebp
dec ecx
cmp byte [ebx - 0x157efb3c], al
jmp 0x5a401288
Function at 0x4013ea
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x4013fd
add byte [esi + 0x46], al
dec ecx
dec eax
xor edi, dword [edx]
cmp byte [esi], dh
xor al, 0x48
add esp, 4
pop esi
mov edx, dword [ebp - 0x1d98]
add edx, 1
mov dword [ebp - 0x15a4], edx
push edi
jmp 0x40141a
sub edi, 0x97c6
add edi, 0x14da8
pop edi
push edx
or edx, 0x8464
call 0x40143e
add byte [edi], dh
inc edi
xor dh, byte [edx]
dec esi
dec edi
inc ecx
dec esi
inc ebx
dec esp
add esp, 4
pop edx
push eax
push edi
add esp, 4
call 0x401453
add byte [eax + 0x3e], cl
cmp eax, 0x833a4449
les eax, [ecx + eax*4]
call fcn.0041417f
call 0x401468
add byte [edi], dh
inc ebp
cmp edi, dword [eax]
dec esi
aas
add esp, 4
jmp 0x401473
pop eax
imul eax, dword [ebp - 0x2c], 0x138
add eax, 0x55f3663b
imul ecx, dword [ebp - 0x2c], 0x138
sub eax, ecx
xor eax, dword [ebp - 0x15a4]
imul eax, dword [ebp - 0x2c]
imul edx, dword [ebp - 0x2c], 0x138
sub eax, edx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x15a4]
imul eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1e5c], eax
mov dword [ebp - 0x1630], 1
push ebx
push ecx
add esp, 4
xor ebx, 0x101d4
sub ebx, 0x14e66
pop ebx
push esi
push eax
add esp, 4
or esi, 0x467a
or esi, 0x13c81
and esi, 0x70aa
pop esi
push edi
sub edi, 0x14ca6
pop edi
imul ecx, dword [ebp - 0x1630], 0x138
add ecx, 0x55f3663b
imul edx, dword [ebp - 0x1630], 0x138
sub ecx, edx
xor ecx, dword [ebp - 0x1e5c]
imul ecx, dword [ebp - 0x1630]
imul eax, dword [ebp - 0x1630], 0x138
sub ecx, eax
mov dword [ebp - 0x1634], ecx

Function at 0x4013fd
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x4013fd
add byte [esi + 0x46], al
dec ecx
dec eax
xor edi, dword [edx]
cmp byte [esi], dh
xor al, 0x48
add esp, 4
pop esi
mov edx, dword [ebp - 0x1d98]
add edx, 1
mov dword [ebp - 0x15a4], edx
push edi
jmp 0x40141a
sub edi, 0x97c6
add edi, 0x14da8
pop edi
push edx
or edx, 0x8464
call 0x40143e
add byte [edi], dh
inc edi
xor dh, byte [edx]
dec esi
dec edi
inc ecx
dec esi
inc ebx
dec esp
add esp, 4
pop edx
push eax
push edi
add esp, 4
call 0x401453
add byte [eax + 0x3e], cl
cmp eax, 0x833a4449
les eax, [ecx + eax*4]
call fcn.0041417f
call 0x401468
add byte [edi], dh
inc ebp
cmp edi, dword [eax]
dec esi
aas
add esp, 4
jmp 0x401473
pop eax
imul eax, dword [ebp - 0x2c], 0x138
add eax, 0x55f3663b
imul ecx, dword [ebp - 0x2c], 0x138
sub eax, ecx
xor eax, dword [ebp - 0x15a4]
imul eax, dword [ebp - 0x2c]
imul edx, dword [ebp - 0x2c], 0x138
sub eax, edx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x15a4]
imul eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1e5c], eax
mov dword [ebp - 0x1630], 1
push ebx
push ecx
add esp, 4
xor ebx, 0x101d4
sub ebx, 0x14e66
pop ebx
push esi
push eax
add esp, 4
or esi, 0x467a
or esi, 0x13c81
and esi, 0x70aa
pop esi
push edi
sub edi, 0x14ca6
pop edi
imul ecx, dword [ebp - 0x1630], 0x138
add ecx, 0x55f3663b
imul edx, dword [ebp - 0x1630], 0x138
sub ecx, edx
xor ecx, dword [ebp - 0x1e5c]
imul ecx, dword [ebp - 0x1630]
imul eax, dword [ebp - 0x1630], 0x138
sub ecx, eax
mov dword [ebp - 0x1634], ecx
Function at 0x40143e
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x4013fd
add byte [esi + 0x46], al
dec ecx
dec eax
xor edi, dword [edx]
cmp byte [esi], dh
xor al, 0x48
add esp, 4
pop esi
mov edx, dword [ebp - 0x1d98]
add edx, 1
mov dword [ebp - 0x15a4], edx
push edi
jmp 0x40141a
sub edi, 0x97c6
add edi, 0x14da8
pop edi
push edx
or edx, 0x8464
call 0x40143e
add byte [edi], dh
inc edi
xor dh, byte [edx]
dec esi
dec edi
inc ecx
dec esi
inc ebx
dec esp
add esp, 4
pop edx
push eax
push edi
add esp, 4
call 0x401453
add byte [eax + 0x3e], cl
cmp eax, 0x833a4449
les eax, [ecx + eax*4]
call fcn.0041417f
call 0x401468
add byte [edi], dh
inc ebp
cmp edi, dword [eax]
dec esi
aas
add esp, 4
jmp 0x401473
pop eax
imul eax, dword [ebp - 0x2c], 0x138
add eax, 0x55f3663b
imul ecx, dword [ebp - 0x2c], 0x138
sub eax, ecx
xor eax, dword [ebp - 0x15a4]
imul eax, dword [ebp - 0x2c]
imul edx, dword [ebp - 0x2c], 0x138
sub eax, edx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x15a4]
imul eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1e5c], eax
mov dword [ebp - 0x1630], 1
push ebx
push ecx
add esp, 4
xor ebx, 0x101d4
sub ebx, 0x14e66
pop ebx
push esi
push eax
add esp, 4
or esi, 0x467a
or esi, 0x13c81
and esi, 0x70aa
pop esi
push edi
sub edi, 0x14ca6
pop edi
imul ecx, dword [ebp - 0x1630], 0x138
add ecx, 0x55f3663b
imul edx, dword [ebp - 0x1630], 0x138
sub ecx, edx
xor ecx, dword [ebp - 0x1e5c]
imul ecx, dword [ebp - 0x1630]
imul eax, dword [ebp - 0x1630], 0x138
sub ecx, eax
mov dword [ebp - 0x1634], ecx

Function at 0x401453
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x4013fd
add byte [esi + 0x46], al
dec ecx
dec eax
xor edi, dword [edx]
cmp byte [esi], dh
xor al, 0x48
add esp, 4
pop esi
mov edx, dword [ebp - 0x1d98]
add edx, 1
mov dword [ebp - 0x15a4], edx
push edi
jmp 0x40141a
sub edi, 0x97c6
add edi, 0x14da8
pop edi
push edx
or edx, 0x8464
call 0x40143e
add byte [edi], dh
inc edi
xor dh, byte [edx]
dec esi
dec edi
inc ecx
dec esi
inc ebx
dec esp
add esp, 4
pop edx
push eax
push edi
add esp, 4
call 0x401453
add byte [eax + 0x3e], cl
cmp eax, 0x833a4449
les eax, [ecx + eax*4]
call fcn.0041417f
call 0x401468
add byte [edi], dh
inc ebp
cmp edi, dword [eax]
dec esi
aas
add esp, 4
jmp 0x401473
pop eax
imul eax, dword [ebp - 0x2c], 0x138
add eax, 0x55f3663b
imul ecx, dword [ebp - 0x2c], 0x138
sub eax, ecx
xor eax, dword [ebp - 0x15a4]
imul eax, dword [ebp - 0x2c]
imul edx, dword [ebp - 0x2c], 0x138
sub eax, edx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x15a4]
imul eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1e5c], eax
mov dword [ebp - 0x1630], 1
push ebx
push ecx
add esp, 4
xor ebx, 0x101d4
sub ebx, 0x14e66
pop ebx
push esi
push eax
add esp, 4
or esi, 0x467a
or esi, 0x13c81
and esi, 0x70aa
pop esi
push edi
sub edi, 0x14ca6
pop edi
imul ecx, dword [ebp - 0x1630], 0x138
add ecx, 0x55f3663b
imul edx, dword [ebp - 0x1630], 0x138
sub ecx, edx
xor ecx, dword [ebp - 0x1e5c]
imul ecx, dword [ebp - 0x1630]
imul eax, dword [ebp - 0x1630], 0x138
sub ecx, eax
mov dword [ebp - 0x1634], ecx
Function at 0x401468
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x4013fd
add byte [esi + 0x46], al
dec ecx
dec eax
xor edi, dword [edx]
cmp byte [esi], dh
xor al, 0x48
add esp, 4
pop esi
mov edx, dword [ebp - 0x1d98]
add edx, 1
mov dword [ebp - 0x15a4], edx
push edi
jmp 0x40141a
sub edi, 0x97c6
add edi, 0x14da8
pop edi
push edx
or edx, 0x8464
call 0x40143e
add byte [edi], dh
inc edi
xor dh, byte [edx]
dec esi
dec edi
inc ecx
dec esi
inc ebx
dec esp
add esp, 4
pop edx
push eax
push edi
add esp, 4
call 0x401453
add byte [eax + 0x3e], cl
cmp eax, 0x833a4449
les eax, [ecx + eax*4]
call fcn.0041417f
call 0x401468
add byte [edi], dh
inc ebp
cmp edi, dword [eax]
dec esi
aas
add esp, 4
jmp 0x401473
pop eax
imul eax, dword [ebp - 0x2c], 0x138
add eax, 0x55f3663b
imul ecx, dword [ebp - 0x2c], 0x138
sub eax, ecx
xor eax, dword [ebp - 0x15a4]
imul eax, dword [ebp - 0x2c]
imul edx, dword [ebp - 0x2c], 0x138
sub eax, edx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x15a4]
imul eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1e5c], eax
mov dword [ebp - 0x1630], 1
push ebx
push ecx
add esp, 4
xor ebx, 0x101d4
sub ebx, 0x14e66
pop ebx
push esi
push eax
add esp, 4
or esi, 0x467a
or esi, 0x13c81
and esi, 0x70aa
pop esi
push edi
sub edi, 0x14ca6
pop edi
imul ecx, dword [ebp - 0x1630], 0x138
add ecx, 0x55f3663b
imul edx, dword [ebp - 0x1630], 0x138
sub ecx, edx
xor ecx, dword [ebp - 0x1e5c]
imul ecx, dword [ebp - 0x1630]
imul eax, dword [ebp - 0x1630], 0x138
sub ecx, eax
mov dword [ebp - 0x1634], ecx