joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4117ea
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x4117f9
add byte [0x3f3f5049], bh
add esp, 4
pop ebx
movzx edx, word [ebp - 0x10c]
test edx, edx
jne 0x411820
movzx eax, word [ebp - 0x210]
movzx ecx, word [ebp - 0x10c]
sub eax, ecx
mov dword [ebp - 0x15e0], eax
jmp 0x411883
movzx edx, word [ebp - 0x210]
movzx eax, word [ebp - 0x10c]
cmp edx, eax
je 0x41173f
movzx ecx, word [ebp - 0x210]
xor ecx, 0x20
movzx edx, word [ebp - 0x10c]
cmp ecx, edx
je 0x41173f
movzx eax, word [ebp - 0x210]
movzx ecx, word [ebp - 0x10c]
cmp eax, ecx
jge 0x41186d
mov dword [ebp - 0x15dc], 0xffffffff
jmp 0x411877
mov dword [ebp - 0x15dc], 1
mov edx, dword [ebp - 0x15dc]
mov dword [ebp - 0x15e0], edx
cmp dword [ebp - 0x15e0], 0
jne 0x4118cc
push edx
push edi
add esp, 4
or edx, 0x10496
pop edx
push eax
add eax, 0x13571
pop eax
push ebx
push esi
add esp, 4
xor ebx, 0x9f41
pop ebx
push edx
call 0x4118ba
add byte [0x3a423d38], bh
xor edx, dword [eax - 0x7d]
les eax, [edx + ebx*2]
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0x31c], eax
jmp 0x411934
push ebx
push ecx
add esp, 4
sub ebx, 0xe3b1
pop ebx
push edi
and edi, 0x6a25
sub edi, 0xa0c3
xor edi, 0x404d
pop edi
push ecx
push edx
add esp, 4
sub ecx, 0x7cdc
add ecx, 0x82
pop ecx
mov ecx, dword [ebp - 0x504]
mov edx, dword [ecx]
mov dword [ebp - 0x504], edx
mov eax, dword [ebp - 0x504]
cmp eax, dword [ebp - 0xc98]
je 0x41192a
mov ecx, dword [ebp - 0x504]
cmp dword [ecx + 0x30], 0
jne 0x4116e0
mov dword [ebp - 0x31c], 0

Function at 0x4117f9
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x4117f9
add byte [0x3f3f5049], bh
add esp, 4
pop ebx
movzx edx, word [ebp - 0x10c]
test edx, edx
jne 0x411820
movzx eax, word [ebp - 0x210]
movzx ecx, word [ebp - 0x10c]
sub eax, ecx
mov dword [ebp - 0x15e0], eax
jmp 0x411883
movzx edx, word [ebp - 0x210]
movzx eax, word [ebp - 0x10c]
cmp edx, eax
je 0x41173f
movzx ecx, word [ebp - 0x210]
xor ecx, 0x20
movzx edx, word [ebp - 0x10c]
cmp ecx, edx
je 0x41173f
movzx eax, word [ebp - 0x210]
movzx ecx, word [ebp - 0x10c]
cmp eax, ecx
jge 0x41186d
mov dword [ebp - 0x15dc], 0xffffffff
jmp 0x411877
mov dword [ebp - 0x15dc], 1
mov edx, dword [ebp - 0x15dc]
mov dword [ebp - 0x15e0], edx
cmp dword [ebp - 0x15e0], 0
jne 0x4118cc
push edx
push edi
add esp, 4
or edx, 0x10496
pop edx
push eax
add eax, 0x13571
pop eax
push ebx
push esi
add esp, 4
xor ebx, 0x9f41
pop ebx
push edx
call 0x4118ba
add byte [0x3a423d38], bh
xor edx, dword [eax - 0x7d]
les eax, [edx + ebx*2]
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0x31c], eax
jmp 0x411934
push ebx
push ecx
add esp, 4
sub ebx, 0xe3b1
pop ebx
push edi
and edi, 0x6a25
sub edi, 0xa0c3
xor edi, 0x404d
pop edi
push ecx
push edx
add esp, 4
sub ecx, 0x7cdc
add ecx, 0x82
pop ecx
mov ecx, dword [ebp - 0x504]
mov edx, dword [ecx]
mov dword [ebp - 0x504], edx
mov eax, dword [ebp - 0x504]
cmp eax, dword [ebp - 0xc98]
je 0x41192a
mov ecx, dword [ebp - 0x504]
cmp dword [ecx + 0x30], 0
jne 0x4116e0
mov dword [ebp - 0x31c], 0
Function at 0x4118ba
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x4117f9
add byte [0x3f3f5049], bh
add esp, 4
pop ebx
movzx edx, word [ebp - 0x10c]
test edx, edx
jne 0x411820
movzx eax, word [ebp - 0x210]
movzx ecx, word [ebp - 0x10c]
sub eax, ecx
mov dword [ebp - 0x15e0], eax
jmp 0x411883
movzx edx, word [ebp - 0x210]
movzx eax, word [ebp - 0x10c]
cmp edx, eax
je 0x41173f
movzx ecx, word [ebp - 0x210]
xor ecx, 0x20
movzx edx, word [ebp - 0x10c]
cmp ecx, edx
je 0x41173f
movzx eax, word [ebp - 0x210]
movzx ecx, word [ebp - 0x10c]
cmp eax, ecx
jge 0x41186d
mov dword [ebp - 0x15dc], 0xffffffff
jmp 0x411877
mov dword [ebp - 0x15dc], 1
mov edx, dword [ebp - 0x15dc]
mov dword [ebp - 0x15e0], edx
cmp dword [ebp - 0x15e0], 0
jne 0x4118cc
push edx
push edi
add esp, 4
or edx, 0x10496
pop edx
push eax
add eax, 0x13571
pop eax
push ebx
push esi
add esp, 4
xor ebx, 0x9f41
pop ebx
push edx
call 0x4118ba
add byte [0x3a423d38], bh
xor edx, dword [eax - 0x7d]
les eax, [edx + ebx*2]
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0x31c], eax
jmp 0x411934
push ebx
push ecx
add esp, 4
sub ebx, 0xe3b1
pop ebx
push edi
and edi, 0x6a25
sub edi, 0xa0c3
xor edi, 0x404d
pop edi
push ecx
push edx
add esp, 4
sub ecx, 0x7cdc
add ecx, 0x82
pop ecx
mov ecx, dword [ebp - 0x504]
mov edx, dword [ecx]
mov dword [ebp - 0x504], edx
mov eax, dword [ebp - 0x504]
cmp eax, dword [ebp - 0xc98]
je 0x41192a
mov ecx, dword [ebp - 0x504]
cmp dword [ecx + 0x30], 0
jne 0x4116e0
mov dword [ebp - 0x31c], 0

Function at 0x412215
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
xor edi, dword [ebx]
inc esp
cmp al, 0x39
add esp, 4
pop ecx
push ebx
and ebx, 0x28c6
pop ebx
mov ecx, dword [ebp - 0x1974]
mov dword [ebp - 0x1978], ecx
lea edx, [ebp - 0x1738]
push edx
call dword [ebp - 0x1978]
test eax, eax
jne 0x41227f
push esi
and esi, 0x12d43
jmp 0x41224e
pop esi
push edi
push esi
add esp, 4
xor edi, 0x1a0
jmp 0x412263
or edi, 0x2455
and edi, 0x143fa
pop edi
mov dword [ebp - 0x79c], 0
jmp 0x412969
push ecx
push ecx
add esp, 4
add ecx, 0x64ed
sub ecx, 0x130c1
sub ecx, 0x133a5
add ecx, 0xef87
pop ecx
push eax
sub eax, 0xe44
add eax, 0x2e02
sub eax, 0x5227
pop eax
push ecx
push edx
add esp, 4
and ecx, 0xf254
xor ecx, 0x15d01
pop ecx
push edx
or edx, 0xed90
xor edx, 0x5dfe
and edx, 0x14f6
pop edx
push edx
push ebx
add esp, 4
and edx, 0xdffd
pop edx
mov ecx, dword [ebp - 0x3e8]
add ecx, 0xe
mov dword [ebp - 0x19dc], ecx
push esi
or esi, 0xac55
call 0x4129c0
add byte [esi], dh
inc esi
inc esp
aaa
dec esi
cmp byte [ebx + eax*2 + 0x44], cl
add esp, 4
xor esi, 0x4071
call 0x4129d8
add byte [0x3a4d4b45], dh
aaa
inc edx
cmp byte [ecx - 0x7d], cl
les eax, [esi + ebx*2]
cmp dword [ebp - 0x3e8], 0
je 0x4129ee
cmp dword [ebp - 0xab8], 0
jne 0x412a34
push esi
push edx
add esp, 4
add esi, 0x5ff3
jmp 0x4129ff
pop esi
push ebx
push ecx
add esp, 4
and ebx, 0x4aa9
or ebx, 0x232c
xor ebx, 0x144df
pop ebx
push ebx
or ebx, 0xed44
pop ebx
mov edx, dword [ebp - 0x79c]
mov dword [ebp - 0x1990], edx
push 0
call dword [ebp - 0x1990]
mov dword [ebp - 0x20a8], 0xa
push edx
push edi
Function at 0x4129c0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
xor edi, dword [ebx]
inc esp
cmp al, 0x39
add esp, 4
pop ecx
push ebx
and ebx, 0x28c6
pop ebx
mov ecx, dword [ebp - 0x1974]
mov dword [ebp - 0x1978], ecx
lea edx, [ebp - 0x1738]
push edx
call dword [ebp - 0x1978]
test eax, eax
jne 0x41227f
push esi
and esi, 0x12d43
jmp 0x41224e
pop esi
push edi
push esi
add esp, 4
xor edi, 0x1a0
jmp 0x412263
or edi, 0x2455
and edi, 0x143fa
pop edi
mov dword [ebp - 0x79c], 0
jmp 0x412969
push ecx
push ecx
add esp, 4
add ecx, 0x64ed
sub ecx, 0x130c1
sub ecx, 0x133a5
add ecx, 0xef87
pop ecx
push eax
sub eax, 0xe44
add eax, 0x2e02
sub eax, 0x5227
pop eax
push ecx
push edx
add esp, 4
and ecx, 0xf254
xor ecx, 0x15d01
pop ecx
push edx
or edx, 0xed90
xor edx, 0x5dfe
and edx, 0x14f6
pop edx
push edx
push ebx
add esp, 4
and edx, 0xdffd
pop edx
mov ecx, dword [ebp - 0x3e8]
add ecx, 0xe
mov dword [ebp - 0x19dc], ecx
push esi
or esi, 0xac55
call 0x4129c0
add byte [esi], dh
inc esi
inc esp
aaa
dec esi
cmp byte [ebx + eax*2 + 0x44], cl
add esp, 4
xor esi, 0x4071
call 0x4129d8
add byte [0x3a4d4b45], dh
aaa
inc edx
cmp byte [ecx - 0x7d], cl
les eax, [esi + ebx*2]
cmp dword [ebp - 0x3e8], 0
je 0x4129ee
cmp dword [ebp - 0xab8], 0
jne 0x412a34
push esi
push edx
add esp, 4
add esi, 0x5ff3
jmp 0x4129ff
pop esi
push ebx
push ecx
add esp, 4
and ebx, 0x4aa9
or ebx, 0x232c
xor ebx, 0x144df
pop ebx
push ebx
or ebx, 0xed44
pop ebx
mov edx, dword [ebp - 0x79c]
mov dword [ebp - 0x1990], edx
push 0
call dword [ebp - 0x1990]
mov dword [ebp - 0x20a8], 0xa
push edx
push edi
Function at 0x4129d8
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
xor edi, dword [ebx]
inc esp
cmp al, 0x39
add esp, 4
pop ecx
push ebx
and ebx, 0x28c6
pop ebx
mov ecx, dword [ebp - 0x1974]
mov dword [ebp - 0x1978], ecx
lea edx, [ebp - 0x1738]
push edx
call dword [ebp - 0x1978]
test eax, eax
jne 0x41227f
push esi
and esi, 0x12d43
jmp 0x41224e
pop esi
push edi
push esi
add esp, 4
xor edi, 0x1a0
jmp 0x412263
or edi, 0x2455
and edi, 0x143fa
pop edi
mov dword [ebp - 0x79c], 0
jmp 0x412969
push ecx
push ecx
add esp, 4
add ecx, 0x64ed
sub ecx, 0x130c1
sub ecx, 0x133a5
add ecx, 0xef87
pop ecx
push eax
sub eax, 0xe44
add eax, 0x2e02
sub eax, 0x5227
pop eax
push ecx
push edx
add esp, 4
and ecx, 0xf254
xor ecx, 0x15d01
pop ecx
push edx
or edx, 0xed90
xor edx, 0x5dfe
and edx, 0x14f6
pop edx
push edx
push ebx
add esp, 4
and edx, 0xdffd
pop edx
mov ecx, dword [ebp - 0x3e8]
add ecx, 0xe
mov dword [ebp - 0x19dc], ecx
push esi
or esi, 0xac55
call 0x4129c0
add byte [esi], dh
inc esi
inc esp
aaa
dec esi
cmp byte [ebx + eax*2 + 0x44], cl
add esp, 4
xor esi, 0x4071
call 0x4129d8
add byte [0x3a4d4b45], dh
aaa
inc edx
cmp byte [ecx - 0x7d], cl
les eax, [esi + ebx*2]
cmp dword [ebp - 0x3e8], 0
je 0x4129ee
cmp dword [ebp - 0xab8], 0
jne 0x412a34
push esi
push edx
add esp, 4
add esi, 0x5ff3
jmp 0x4129ff
pop esi
push ebx
push ecx
add esp, 4
and ebx, 0x4aa9
or ebx, 0x232c
xor ebx, 0x144df
pop ebx
push ebx
or ebx, 0xed44
pop ebx
mov edx, dword [ebp - 0x79c]
mov dword [ebp - 0x1990], edx
push 0
call dword [ebp - 0x1990]
mov dword [ebp - 0x20a8], 0xa
push edx
push edi
Function at 0x412a40
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x412a52
add byte [0x4c453a3b], bh
dec eax
cmp byte [eax + 0x41], dl
add esp, 4
jmp 0x412a5b
pop edx
push esi
add esi, 0x9642
and esi, 0x91c8
and esi, 0x9f02
pop esi
mov eax, dword [ebp - 0x3e8]
mov cl, byte [eax + 0xa]
mov byte [ebp - 0x3ae], cl
mov edx, dword [ebp - 0xab8]
sub edx, dword [ebp - 0x3e8]
mov dword [ebp - 0x1694], edx
mov dword [ebp - 0xce8], 0
push esi
push ebx
add esp, 4
sub esi, 0x78c1
pop esi
push esi
add esi, 0x125f8
pop esi
push esi
push edx
add esp, 4
and esi, 0x139eb
xor esi, 0x135b8
add esi, 0x4db5
sub esi, 0xd298
pop esi
mov byte [ebp - 0x9d4], 0x56
mov byte [ebp - 0x9d3], 0x69
mov byte [ebp - 0x9d2], 0x72
mov byte [ebp - 0x9d1], 0x74
mov byte [ebp - 0x9d0], 0x75
mov byte [ebp - 0x9cf], 0x61
mov byte [ebp - 0x9ce], 0x6c
mov byte [ebp - 0x9cd], 0x50
mov byte [ebp - 0x9cc], 0x72
mov byte [ebp - 0x9cb], 0x6f
mov byte [ebp - 0x9ca], 0x74
mov byte [ebp - 0x9c9], 0x65
mov byte [ebp - 0x9c8], 0x63
mov byte [ebp - 0x9c7], 0x74
mov byte [ebp - 0x9c6], 0
push ecx
xor ecx, 0xf11
xor ecx, 0x1529c
pop ecx
push edi
call 0x412b52
add byte [ecx], bh
cmp al, 0x42
aas
inc edi
aaa
add esp, 4
or edi, 0xc7b
add edi, 0x1556b
add edi, 0x94c7
pop edi
mov eax, dword fs:[0x18]
mov dword [ebp - 0x1994], eax
mov ecx, dword [ebp - 0x1994]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x1998], edx
mov eax, dword [ebp - 0x1998]
mov dword [ebp - 0x1614], eax
push edx
call 0x412b9e
add byte [ebp + 0x4d], cl
dec edx
dec esi
dec esi
inc eax
cmp eax, dword ds:[ebx + 0xbe804c4]
add byte [eax], al
add byte [eax], al
xor dh, byte [esi]
dec eax
xor edi, dword [0x344e4238]
cmp al, 0x83
les eax, [ecx + eax*4]
ljmp 0xc281
Function at 0x412a52
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x412a52
add byte [0x4c453a3b], bh
dec eax
cmp byte [eax + 0x41], dl
add esp, 4
jmp 0x412a5b
pop edx
push esi
add esi, 0x9642
and esi, 0x91c8
and esi, 0x9f02
pop esi
mov eax, dword [ebp - 0x3e8]
mov cl, byte [eax + 0xa]
mov byte [ebp - 0x3ae], cl
mov edx, dword [ebp - 0xab8]
sub edx, dword [ebp - 0x3e8]
mov dword [ebp - 0x1694], edx
mov dword [ebp - 0xce8], 0
push esi
push ebx
add esp, 4
sub esi, 0x78c1
pop esi
push esi
add esi, 0x125f8
pop esi
push esi
push edx
add esp, 4
and esi, 0x139eb
xor esi, 0x135b8
add esi, 0x4db5
sub esi, 0xd298
pop esi
mov byte [ebp - 0x9d4], 0x56
mov byte [ebp - 0x9d3], 0x69
mov byte [ebp - 0x9d2], 0x72
mov byte [ebp - 0x9d1], 0x74
mov byte [ebp - 0x9d0], 0x75
mov byte [ebp - 0x9cf], 0x61
mov byte [ebp - 0x9ce], 0x6c
mov byte [ebp - 0x9cd], 0x50
mov byte [ebp - 0x9cc], 0x72
mov byte [ebp - 0x9cb], 0x6f
mov byte [ebp - 0x9ca], 0x74
mov byte [ebp - 0x9c9], 0x65
mov byte [ebp - 0x9c8], 0x63
mov byte [ebp - 0x9c7], 0x74
mov byte [ebp - 0x9c6], 0
push ecx
xor ecx, 0xf11
xor ecx, 0x1529c
pop ecx
push edi
call 0x412b52
add byte [ecx], bh
cmp al, 0x42
aas
inc edi
aaa
add esp, 4
or edi, 0xc7b
add edi, 0x1556b
add edi, 0x94c7
pop edi
mov eax, dword fs:[0x18]
mov dword [ebp - 0x1994], eax
mov ecx, dword [ebp - 0x1994]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x1998], edx
mov eax, dword [ebp - 0x1998]
mov dword [ebp - 0x1614], eax
push edx
call 0x412b9e
add byte [ebp + 0x4d], cl
dec edx
dec esi
dec esi
inc eax
cmp eax, dword ds:[ebx + 0xbe804c4]
add byte [eax], al
add byte [eax], al
xor dh, byte [esi]
dec eax
xor edi, dword [0x344e4238]
cmp al, 0x83
les eax, [ecx + eax*4]
ljmp 0xc281
Function at 0x412b52
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x412a52
add byte [0x4c453a3b], bh
dec eax
cmp byte [eax + 0x41], dl
add esp, 4
jmp 0x412a5b
pop edx
push esi
add esi, 0x9642
and esi, 0x91c8
and esi, 0x9f02
pop esi
mov eax, dword [ebp - 0x3e8]
mov cl, byte [eax + 0xa]
mov byte [ebp - 0x3ae], cl
mov edx, dword [ebp - 0xab8]
sub edx, dword [ebp - 0x3e8]
mov dword [ebp - 0x1694], edx
mov dword [ebp - 0xce8], 0
push esi
push ebx
add esp, 4
sub esi, 0x78c1
pop esi
push esi
add esi, 0x125f8
pop esi
push esi
push edx
add esp, 4
and esi, 0x139eb
xor esi, 0x135b8
add esi, 0x4db5
sub esi, 0xd298
pop esi
mov byte [ebp - 0x9d4], 0x56
mov byte [ebp - 0x9d3], 0x69
mov byte [ebp - 0x9d2], 0x72
mov byte [ebp - 0x9d1], 0x74
mov byte [ebp - 0x9d0], 0x75
mov byte [ebp - 0x9cf], 0x61
mov byte [ebp - 0x9ce], 0x6c
mov byte [ebp - 0x9cd], 0x50
mov byte [ebp - 0x9cc], 0x72
mov byte [ebp - 0x9cb], 0x6f
mov byte [ebp - 0x9ca], 0x74
mov byte [ebp - 0x9c9], 0x65
mov byte [ebp - 0x9c8], 0x63
mov byte [ebp - 0x9c7], 0x74
mov byte [ebp - 0x9c6], 0
push ecx
xor ecx, 0xf11
xor ecx, 0x1529c
pop ecx
push edi
call 0x412b52
add byte [ecx], bh
cmp al, 0x42
aas
inc edi
aaa
add esp, 4
or edi, 0xc7b
add edi, 0x1556b
add edi, 0x94c7
pop edi
mov eax, dword fs:[0x18]
mov dword [ebp - 0x1994], eax
mov ecx, dword [ebp - 0x1994]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x1998], edx
mov eax, dword [ebp - 0x1998]
mov dword [ebp - 0x1614], eax
push edx
call 0x412b9e
add byte [ebp + 0x4d], cl
dec edx
dec esi
dec esi
inc eax
cmp eax, dword ds:[ebx + 0xbe804c4]
add byte [eax], al
add byte [eax], al
xor dh, byte [esi]
dec eax
xor edi, dword [0x344e4238]
cmp al, 0x83
les eax, [ecx + eax*4]
ljmp 0xc281
Function at 0x412b9e
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x412a52
add byte [0x4c453a3b], bh
dec eax
cmp byte [eax + 0x41], dl
add esp, 4
jmp 0x412a5b
pop edx
push esi
add esi, 0x9642
and esi, 0x91c8
and esi, 0x9f02
pop esi
mov eax, dword [ebp - 0x3e8]
mov cl, byte [eax + 0xa]
mov byte [ebp - 0x3ae], cl
mov edx, dword [ebp - 0xab8]
sub edx, dword [ebp - 0x3e8]
mov dword [ebp - 0x1694], edx
mov dword [ebp - 0xce8], 0
push esi
push ebx
add esp, 4
sub esi, 0x78c1
pop esi
push esi
add esi, 0x125f8
pop esi
push esi
push edx
add esp, 4
and esi, 0x139eb
xor esi, 0x135b8
add esi, 0x4db5
sub esi, 0xd298
pop esi
mov byte [ebp - 0x9d4], 0x56
mov byte [ebp - 0x9d3], 0x69
mov byte [ebp - 0x9d2], 0x72
mov byte [ebp - 0x9d1], 0x74
mov byte [ebp - 0x9d0], 0x75
mov byte [ebp - 0x9cf], 0x61
mov byte [ebp - 0x9ce], 0x6c
mov byte [ebp - 0x9cd], 0x50
mov byte [ebp - 0x9cc], 0x72
mov byte [ebp - 0x9cb], 0x6f
mov byte [ebp - 0x9ca], 0x74
mov byte [ebp - 0x9c9], 0x65
mov byte [ebp - 0x9c8], 0x63
mov byte [ebp - 0x9c7], 0x74
mov byte [ebp - 0x9c6], 0
push ecx
xor ecx, 0xf11
xor ecx, 0x1529c
pop ecx
push edi
call 0x412b52
add byte [ecx], bh
cmp al, 0x42
aas
inc edi
aaa
add esp, 4
or edi, 0xc7b
add edi, 0x1556b
add edi, 0x94c7
pop edi
mov eax, dword fs:[0x18]
mov dword [ebp - 0x1994], eax
mov ecx, dword [ebp - 0x1994]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x1998], edx
mov eax, dword [ebp - 0x1998]
mov dword [ebp - 0x1614], eax
push edx
call 0x412b9e
add byte [ebp + 0x4d], cl
dec edx
dec esi
dec esi
inc eax
cmp eax, dword ds:[ebx + 0xbe804c4]
add byte [eax], al
add byte [eax], al
xor dh, byte [esi]
dec eax
xor edi, dword [0x344e4238]
cmp al, 0x83
les eax, [ecx + eax*4]
ljmp 0xc281
Function at 0x412bb1
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x412a52
add byte [0x4c453a3b], bh
dec eax
cmp byte [eax + 0x41], dl
add esp, 4
jmp 0x412a5b
pop edx
push esi
add esi, 0x9642
and esi, 0x91c8
and esi, 0x9f02
pop esi
mov eax, dword [ebp - 0x3e8]
mov cl, byte [eax + 0xa]
mov byte [ebp - 0x3ae], cl
mov edx, dword [ebp - 0xab8]
sub edx, dword [ebp - 0x3e8]
mov dword [ebp - 0x1694], edx
mov dword [ebp - 0xce8], 0
push esi
push ebx
add esp, 4
sub esi, 0x78c1
pop esi
push esi
add esi, 0x125f8
pop esi
push esi
push edx
add esp, 4
and esi, 0x139eb
xor esi, 0x135b8
add esi, 0x4db5
sub esi, 0xd298
pop esi
mov byte [ebp - 0x9d4], 0x56
mov byte [ebp - 0x9d3], 0x69
mov byte [ebp - 0x9d2], 0x72
mov byte [ebp - 0x9d1], 0x74
mov byte [ebp - 0x9d0], 0x75
mov byte [ebp - 0x9cf], 0x61
mov byte [ebp - 0x9ce], 0x6c
mov byte [ebp - 0x9cd], 0x50
mov byte [ebp - 0x9cc], 0x72
mov byte [ebp - 0x9cb], 0x6f
mov byte [ebp - 0x9ca], 0x74
mov byte [ebp - 0x9c9], 0x65
mov byte [ebp - 0x9c8], 0x63
mov byte [ebp - 0x9c7], 0x74
mov byte [ebp - 0x9c6], 0
push ecx
xor ecx, 0xf11
xor ecx, 0x1529c
pop ecx
push edi
call 0x412b52
add byte [ecx], bh
cmp al, 0x42
aas
inc edi
aaa
add esp, 4
or edi, 0xc7b
add edi, 0x1556b
add edi, 0x94c7
pop edi
mov eax, dword fs:[0x18]
mov dword [ebp - 0x1994], eax
mov ecx, dword [ebp - 0x1994]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x1998], edx
mov eax, dword [ebp - 0x1998]
mov dword [ebp - 0x1614], eax
push edx
call 0x412b9e
add byte [ebp + 0x4d], cl
dec edx
dec esi
dec esi
inc eax
cmp eax, dword ds:[ebx + 0xbe804c4]
add byte [eax], al
add byte [eax], al
xor dh, byte [esi]
dec eax
xor edi, dword [0x344e4238]
cmp al, 0x83
les eax, [ecx + eax*4]
ljmp 0xc281
Function at 0x413370
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc dword [eax]
add byte [eax], al
add cl, ch
sub byte [ebx], cl
add byte [eax], al
push esi
push ebx
add esp, 4
and esi, 0x45c7
xor esi, 0x11816
sub esi, 0x16c90
pop esi
push eax
or eax, 0xd91
and eax, 0x62a7
add eax, 0x10d34
and eax, 0xe23
pop eax
mov ecx, dword [ebp - 0x774]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x3a4], edx
mov dword [ebp - 0x784], 0
mov eax, dword [ebp - 0x3a4]
mov dword [ebp - 0x166c], eax
inc dword [ebx - 0x166b43]
inc dword [eax]
jne 0x4133eb
mov ecx, dword [ebp - 0x784]
mov dword [ebp - 0x3f8], ecx
jmp 0x4136dc
mov edx, dword [ebp - 0x166c]
mov eax, dword [ebp - 0x3a4]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x1670], eax
jne 0x413413
mov ecx, dword [ebp - 0x784]
mov dword [ebp - 0x3f8], ecx
jmp 0x4136dc
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x1670]
mov edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x1678], edx
cmp dword [ebp - 0x1678], 0
jne 0x413445
mov eax, dword [ebp - 0x784]
mov dword [ebp - 0x3f8], eax
jmp 0x4136dc
mov ecx, dword [ebp - 0x3a4]
add ecx, dword [ebp - 0x1678]
mov dword [ebp - 0x778], ecx
jne 0x41346a
mov edx, dword [ebp - 0x784]
mov dword [ebp - 0x3f8], edx
jmp 0x4136dc
mov eax, dword [ebp - 0x778]
cmp dword [ebp - 0x3f8], 0
je 0x4137b7
push eax
push esi
add esp, 4
jmp 0x4136f6
or eax, 0x10698
add eax, 0x5a07
pop eax
push edx
push eax
add esp, 4
and edx, 0x4cbf
sub edx, 0x40cc
or edx, 0x182d9
pop edx
mov ecx, dword [ebp - 0x3f8]
mov dword [ebp - 0x19b4], ecx
push eax
xor eax, 0x4556
add eax, 0x78d2
sar byte [eax], cl
add byte [ecx + 0x287ac0], al
add byte [eax + 0x51], bl
push eax
add esp, 4
add ecx, 0x7811
or ecx, 0x1145e
sub ecx, 0xe17c
add ecx, 0x59ff
pop ecx
mov edx, dword [ebp - 0x19b4]
mov dword [ebp - 0x19b8], edx
lea eax, [ebp - 0x1738]
push eax
invalid
xchg ebp, eax
dec eax
invalid

Function at 0x413470
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ebp - 0x3a4]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x19a4], ecx
mov edx, dword [ebp - 0x778]
mov eax, dword [ebp - 0x3a4]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x19a8], eax
mov ecx, dword [ebp - 0x778]
mov edx, dword [ebp - 0x3a4]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0x19ac], edx
mov dword [ebp - 0x77c], 0
jmp 0x4134c4
mov ecx, dword [ebp - 0x778]
mov edx, dword [ebp - 0x77c]
cmp edx, dword [ecx + 0x18]
jae 0x4136d0
mov eax, dword [ebp - 0x77c]
mov ecx, dword [ebp - 0x19a4]
mov edx, dword [ebp - 0x3a4]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x780], edx
mov eax, dword [ebp - 0x77c]
mov ecx, dword [ebp - 0x19a8]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x19ac]
mov ecx, dword [ebp - 0x3a4]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x19b0], ecx
mov dword [ebp - 0x1a0], 0
jmp 0x413534
mov edx, dword [ebp - 0x1a0]
add edx, 1
invalid
xchg ebp, eax
Function at 0x413614
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edx
push edi
push eax
add esp, 4
jmp 0x413586
add edi, 0x3a79
sub edi, 0x5c69
pop edi
mov ecx, dword [ebp - 0x780]
add ecx, dword [ebp - 0x1a0]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x1a0]
movsx ecx, byte [ebp + eax - 0x8a4]
cmp edx, ecx
je 0x4135d8
mov edx, dword [ebp - 0x780]
add edx, dword [ebp - 0x1a0]
movsx eax, byte [edx]
xor eax, 0x20
mov ecx, dword [ebp - 0x1a0]
movsx edx, byte [ebp + ecx - 0x8a4]
cmp eax, edx
jne 0x4135df
jmp 0x413525
jmp 0x4135e6
push esi
push ecx
add esp, 4
xor esi, 0x6b7c
pop esi
push esi
or esi, 0x108b5
add esi, 0x7d4c
sub esi, 0x7a6f
pop esi
push esi
call 0x413614
add byte [ebp + esi + 0x45], cl
dec ecx
inc esi
cmp al, byte [ebx - 0x74a1fb3c]
test dword [eax + 0x3fffff8], eax
test dword [eax - 2], esp
invalid

Function at 0x413670
Capabilities:
Resolve function by parsing pe exports

Disassembly:
or eax, 0x10309
pop eax
mov ecx, dword [ebp - 0x780]
add ecx, dword [ebp - 0x1a0]
movsx edx, byte [ecx]
or edx, 0x20
mov eax, dword [ebp - 0x1a0]
movsx ecx, byte [ebp + eax - 0x8a4]
or ecx, 0x20
cmp edx, ecx
jge 0x4136aa
mov dword [ebp - 0xcd4], 0xffffffff
jmp 0x4136b4
mov dword [ebp - 0xcd4], 1

Function at 0x4136f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc edx
inc edx
dec ebx
dec ecx
dec edi
inc edi
push ebx
push edx
add esp, 4
call 0x41378a
add byte [edi], dh
inc ecx
xor edi, dword [edx]
dec ebx
cmp bh, byte [ecx]
dec ebp
add esp, 4
or ebx, 0x5ede
pop ebx
push edi
and edi, 0x902e
jmp 0x4137a1
xor edi, 0x12c51
pop edi
mov dword [ebp - 0xab4], 0
jmp 0x413ea2
push esi
push ecx
add esp, 4
jmp 0x4137c5
or esi, 0x9a9e
call 0x4137d9
add byte [ebx + 0x32], cl
inc ebp
dec ecx
dec esi
inc ecx
xor al, byte ds:[ebx + 0x575e04c4]
push edi
add esp, 4
add edi, 0x5dd4
pop edi
mov ecx, dword fs:[0x18]