joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431820
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esi]
push 0
mov byte [esp + 0x16], al
push 3
lea eax, [esp + 0x18]
push eax
push dword [esi + 0x134]
mov byte [esp + 0x20], 0xff
mov byte [esp + 0x21], bl
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x43186c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push edi
call fcn.00422760
add esp, 0xc
push dword [esp + 0x18]
push ebx
push str.SENT
push dword [esi]
call fcn.00431140
add esp, 0x10
pop edi
pop esi
pop ebx
ret

Function at 0x431950
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
cmp dword [esp + 0xc], 0x1f
mov eax, dword [esp + 8]
push ebx
mov eax, dword [eax]
mov dword [esp + 4], eax
mov ebx, dword [eax + 0x8f0c]
jne 0x431a9b
push ebp
push edi
lea ebp, [ebx + 0x1cb0]
lea edi, [ebx + 0x1eb0]
mov dword [edi], ebp
cmp ebp, edi
jae 0x431987
mov byte [ebp], 0xff
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x431992
mov byte [eax], 0xfa
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x43199d
mov byte [eax], 0x1f
inc dword [edi]
movzx eax, word [ebx + 0x1ca8]
push esi
mov esi, dword [sym.imp.WS2_32.dll_htons]
push eax
call esi
movzx eax, ax
mov dword [esp + 0x1c], eax
movzx eax, word [ebx + 0x1caa]
push eax
call esi
mov ecx, dword [esp + 0x1c]
movzx edx, ax
mov eax, dword [edi]
cmp eax, edi
jae 0x4319d0
mov byte [eax], cl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x4319da
mov byte [eax], ch
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x4319e4
mov byte [eax], dl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x4319ee
mov byte [eax], dh
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x4319f9
mov byte [eax], 0xff
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x431a04
mov byte [eax], 0xf0
inc dword [edi]
mov eax, dword [edi]
mov esi, dword [esp + 0x10]
mov dword [ebx + 0x1eb4], eax
sub eax, ebp
sub eax, 2
push eax
lea eax, [ebx + 0x1cb2]
push eax
push 0x3e
push esi
mov dword [edi], ebp
call fcn.00431250
mov edi, dword [esp + 0x28]
add esp, 0x10
push 0
push 3
push ebp
push dword [edi + 0x134]
call dword [sym.imp.WS2_32.dll_send]
mov ebp, dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jns 0x431a5a
call ebp
push eax
push str.Sending_data_failed___d_
push esi
call fcn.00422760
add esp, 0xc
push 4
lea eax, [ebx + 0x1cb3]
push eax
push edi
call fcn.00431890
add esp, 0xc
lea eax, [ebx + 0x1cb7]
push 0
push 2
push eax
push dword [edi + 0x134]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x431a98
call ebp
push eax
push str.Sending_data_failed___d_
push esi
call fcn.00422760
add esp, 0xc
pop esi
pop edi
pop ebp
pop ebx
pop ecx
ret
Function at 0x431aa0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x90c
mov eax, dword [0x481b08]
xor eax, esp
mov dword [esp + 0x908], eax
push ebx
mov ebx, dword [esp + 0x914]
push ebp
mov ebp, dword [ebx]
push esi
mov esi, dword [ebp + 0x8f0c]
mov dword [esp + 0x10], ebx
mov eax, dword [esi + 0x1eb4]
sub eax, dword [esi + 0x1eb0]
mov dword [esp + 0xc], ebp
add eax, 2
push eax
lea eax, [esi + 0x1cb0]
push eax
push 0x3c
push ebp
call fcn.00431250
mov eax, dword [esi + 0x1eb0]
inc eax
movzx ecx, byte [eax - 1]
add esp, 0x10
mov dword [esi + 0x1eb0], eax
cmp ecx, 0x18
je 0x431c88
cmp ecx, 0x23
je 0x431c5f
cmp ecx, 0x27
jne 0x431d19
push edi
push 0
push ecx
push 0xfa
push 0xff
push str._c_c_c_c
lea eax, [esp + 0x12c]
push 0x800
push eax
call fcn.00424480
mov esi, dword [esi + 0x1cac]
add esp, 0x1c
mov edi, 4
mov eax, 0x800
test esi, esi
je 0x431bd8
mov ebp, eax
mov edi, edi
mov edx, dword [esi]
mov ecx, edx
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x431b67
sub ecx, ebx
lea ebx, [edi + 1]
add ebx, ecx
cmp ebx, 0x7fa
jae 0x431bc4
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x9c]
push eax
push str._127_____127s
push edx
call fcn.0044b40a
lea eax, [esp + 0x28]
push eax
push 1
lea eax, [esp + 0xb0]
push eax
push 0
mov eax, ebp
sub eax, edi
push str._c_s_c_s
push eax
lea eax, [esp + 0x140]
add eax, edi
push eax
call fcn.00424480
add esp, 0x2c
mov edi, ebx
mov esi, dword [esi + 4]
test esi, esi
jne 0x431b60
mov ebp, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov eax, 0x800
push 0xf0
push 0xff
sub eax, edi
push 0x472090
push eax
lea eax, [esp + 0x128]
add eax, edi
push eax
call fcn.00424480
add esp, 0x14
add edi, 2
push 0
push edi
lea eax, [esp + 0x120]
push eax
push dword [ebx + 0x134]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x431c2f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push ebp
call fcn.00422760
add esp, 0xc
lea eax, [edi - 2]
push eax
lea eax, [esp + 0x11e]
push eax
push 0x3e
push ebp
call fcn.00431250
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x908]
xor ecx, esp
call fcn.00449824
add esp, 0x90c
ret
lea edx, [esi + 0x1c28]
mov ecx, edx
lea esi, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x431c70
push 0xf0
push 0xff
push edx
push 0
push 0x23
jmp 0x431ca9
lea edx, [esi + 0x1c08]
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x431c93
push 0xf0
push 0xff
push edx
push 0
push 0x18
push 0xfa
push 0xff
push str._c_c_c_c_s_c_c
sub ecx, esi
lea eax, [esp + 0x134]
push 0x800
push eax
lea esi, [ecx + 6]
call fcn.00424480
add esp, 0x28
lea eax, [esp + 0x114]
push 0
push esi
push eax
push dword [ebx + 0x134]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x431d02
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push ebp
call fcn.00422760
add esp, 0xc
lea eax, [esi - 2]
push eax
lea eax, [esp + 0x11a]
push eax
push 0x3e
push ebp
call fcn.00431250
add esp, 0x10
mov ecx, dword [esp + 0x914]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00449824
add esp, 0x90c
ret
Function at 0x43ff00
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x481b08]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
call fcn.0044ea7a
add esp, 4
mov byte [esp], 0
test eax, eax
je 0x43ff65
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [esp], 0
je 0x43ff65
lea eax, [esp]
push eax
call dword [0x481878]
add esp, 4
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.00449824
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor ecx, esp
xor eax, eax
call fcn.00449824
add esp, 0x108
ret
Function at 0x4455e0
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
sub esp, 0xc
lea eax, [esp + 4]
push 0xf0000000
push 1
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x445615
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x8003
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
push esi
mov esi, dword [esp + 0x18]
mov ecx, esi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x445620
sub ecx, edx
push ecx
call fcn.00419dc0
add esp, 4
push 0
push eax
push esi
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
mov esi, dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push 0
lea eax, [esp + 8]
push eax
push 0
push 2
push dword [esp + 0x1c]
call esi
cmp dword [esp + 4], 0x10
jne 0x445671
push 0
lea eax, [esp + 8]
push eax
push dword [esp + 0x1c]
push 2
push dword [esp + 0x1c]
call esi
mov eax, dword [esp + 0xc]
pop esi
test eax, eax
je 0x445681
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [esp + 4]
test eax, eax
je 0x445692
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
add esp, 0xc
ret
Function at 0x460856
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x481b08]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.00450696
mov dword [ebp - 0x14], eax
cmp dword [0x4841d4], edi
jne 0x460947
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x4608d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x460a27
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x460a27
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x460a27
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x4841d4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x4841d8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x4841dc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4841e4], eax
test eax, eax
je 0x460944
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4841e0], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x46096c
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x46095f
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x460981
push 4
pop eax
jmp 0x460a29
cmp dword [ebp - 0x14], edi
je 0x460981
push dword [0x4841d4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x460966
mov eax, dword [0x4841e0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x4609df
cmp dword [0x4841e4], esi
je 0x4609df
push eax
call ebx
push dword [0x4841e4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4609df
test eax, eax
je 0x4609df
call ecx
test eax, eax
je 0x4609d4
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4609d4
test byte [ebp - 8], 1
jne 0x4609df
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x460a0f
mov eax, dword [0x4841d8]
cmp eax, esi
je 0x460a0c
push eax
call ebx
test eax, eax
je 0x460a0c
call eax
mov edi, eax
test edi, edi
je 0x460a0c
mov eax, dword [0x4841dc]
cmp eax, esi
je 0x460a0c
push eax
call ebx
test eax, eax
je 0x460a0c
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x4841d4]
call ebx
test eax, eax
je 0x460a27
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x460a29
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00449824
leave
ret
Function at 0x464640
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.00454131
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x464678
xor eax, eax
jmp 0x4646a4
cmp esi, dword [ebp - 4]
je 0x4646a1
cmp dword [ebp + 0xc], 0
je 0x4646a1
push dword [edi + 0x9c]
call fcn.0046424e
push dword [edi + 0x9c]
mov esi, eax
call fcn.00450a3c
pop ecx
pop ecx
cmp esi, eax
je 0x464674
xor eax, eax
inc eax
pop edi
pop esi
leave
ret
Function at 0x403c5e
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x209c
push ebx
push esi
push edi
mov dword [ebp - 0x1078], 1
push eax
add eax, 0x11f15
pop eax
push ecx
sub ecx, 0x7025
call fcn.00403c90
add byte [0x3a47454e], dh
cmp eax, dword ss:[ebx + 0x575904c4]
add esp, 4
pop ecx
push edi

Function at 0x403c90
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ecx
push edi
push edx
add esp, 4
add edi, 0x1603e
and edi, 0x154c6
pop edi
imul eax, dword [ebp - 0x1078], 0x932
add eax, 0x16f3673a
imul ecx, dword [ebp - 0x1078], 0x932
sub eax, ecx
xor eax, 0x8a134
imul eax, dword [ebp - 0x1078]
imul edx, dword [ebp - 0x1078], 0x932
sub eax, edx
mov dword [ebp - 0x107c], eax
push ebx
jmp 0x403ce5
or ebx, 0x12824
jmp 0x403cf4
pop ebx
push edi
and edi, 0x166e6
sub edi, 0x10c32
xor edi, 0x11448
pop edi
push esi
or esi, 0x1320d
pop esi
mov dword [ebp - 0x11c], 1
push esi
push ebx
add esp, 4
xor esi, 0x28c1
add esi, 0x6721
and esi, 0x10a18
pop esi
push ecx
push edx
add esp, 4
and ecx, 0x6e05
add ecx, 0x1605b
jmp 0x403d4c
pop ecx
imul eax, dword [ebp - 0x11c], 0x932
add eax, 0x16f3673a
imul ecx, dword [ebp - 0x11c], 0x932
sub eax, ecx
xor eax, 0x1154
imul eax, dword [ebp - 0x11c]
imul edx, dword [ebp - 0x11c], 0x932
sub eax, edx
mov dword [ebp - 0x120], eax
push ecx
and ecx, 0x182cf
xor ecx, 0x936d
and ecx, 0x2397
xor ecx, 0x13c9d
pop ecx
push esi
push esi
add esp, 4
add esi, 0x61b
and esi, 0x1360b
and esi, 0x14f37
pop esi
push ebx
jmp 0x403dc2
jmp 0x403dcb
pop ebx
push edi
push edx
add esp, 4
add edi, 0x128b4
and edi, 0x17fc3
or edi, 0x12790
xor edi, 0xd2aa
pop edi
mov dword [ebp - 0x34], 1
push ebx
xor ebx, 0x1776b
or ebx, 0x930f
pop ebx
push esi
push edi
add esp, 4
sub esi, 0x4555
xor esi, 0xfdac
xor esi, 0x135ed
pop esi
push esi
push edx
add esp, 4
and esi, 0x1d39
pop esi
imul eax, dword [ebp - 0x34], 0x932
add eax, 0x16f3673a
imul ecx, dword [ebp - 0x34], 0x932
sub eax, ecx
xor eax, 0
imul eax, dword [ebp - 0x34]
imul edx, dword [ebp - 0x34], 0x932
sub eax, edx
mov dword [ebp - 0x38], eax
jmp 0x404004
Function at 0x4078d5
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
sar dword [edx], 0x67
push ss
imul edx, dword [ebp - 0x11c], 0x932
sub ecx, edx
xor eax, ecx
imul eax, dword [ebp - 0x11c]
mov dword [ebp - 0x15bc], eax
mov eax, dword [ebp - 0x3f4]
mov dword [ebp - 0x1964], eax
mov ecx, dword [ebp - 0x1964]
add ecx, dword [ebp - 0x15bc]
mov dword [ebp - 0x3f4], ecx
push esi
sub esi, 0x679c
call 0x4078d5
add byte [ebx], bh
dec esp
dec edi
inc esp
cmp dword [ebx + 0x3f], ecx
inc edx
xor eax, 0xe804c483
pop es
add byte [eax], al
add byte [eax], al
dec eax
inc edx

Function at 0x4078e4
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
inc edx
dec esi
push eax
cmp eax, dword [ebx + 0x525e04c4]
add edx, 0x1554
pop edx
push eax
call 0x4078fe
add byte [edx + 0x3b], al
cmp byte [esi], bh
inc edi
dec edx
xor al, byte [ebx + 0x505804c4]
xor eax, 0x140d8
pop eax
push ecx
push ebx
add esp, 4
add ecx, 0x157f9
xor ecx, 0x5a05
and ecx, 0x1058d
pop ecx
mov byte [ebp - 0xbf0], 0x51
mov byte [ebp - 0xbef], 0xb9
mov byte [ebp - 0xbee], 0x10
mov byte [ebp - 0xbed], 0x10
mov byte [ebp - 0xbec], 0x10
mov byte [ebp - 0xbeb], 0x10
mov byte [ebp - 0xbea], 0x59
push edi
jmp 0x40795c

Function at 0x4078fe
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
inc edx
dec esi
push eax
cmp eax, dword [ebx + 0x525e04c4]
add edx, 0x1554
pop edx
push eax
call 0x4078fe
add byte [edx + 0x3b], al
cmp byte [esi], bh
inc edi
dec edx
xor al, byte [ebx + 0x505804c4]
xor eax, 0x140d8
pop eax
push ecx
push ebx
add esp, 4
add ecx, 0x157f9
xor ecx, 0x5a05
and ecx, 0x1058d
pop ecx
mov byte [ebp - 0xbf0], 0x51
mov byte [ebp - 0xbef], 0xb9
mov byte [ebp - 0xbee], 0x10
mov byte [ebp - 0xbed], 0x10
mov byte [ebp - 0xbec], 0x10
mov byte [ebp - 0xbeb], 0x10
mov byte [ebp - 0xbea], 0x59
push edi
jmp 0x40795c
Function at 0x407958
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
dec esi
inc ecx
dec ebx
inc edi
xor edi, 0x131a0
or edi, 0x532f
pop edi
push edx
push edx
add esp, 4
call 0x40797b
add byte [esi], dh
aaa
xor al, 0x40
inc ebp
xor al, 0x38
add esp, 4
or edx, 0x752d
pop edx
push eax
call 0x407993
add byte [edx], dh
dec edx
dec ecx
dec esi
cmp al, 0x4c
inc ecx
add esp, 4
and eax, 0x12ff9
pop eax
push esi
sub esi, 0x4bb4
jmp 0x4079aa
add esi, 0x140cf
or esi, 0x81cc
pop esi
mov byte [ebp - 0xbf8], 0x51
mov byte [ebp - 0xbf7], 0xb9
mov byte [ebp - 0xbf6], 0x20
mov byte [ebp - 0xbf5], 0x20
mov byte [ebp - 0xbf4], 0x20
mov byte [ebp - 0xbf3], 0x20
mov byte [ebp - 0xbf2], 0x59
push eax
push edx
add esp, 4
add eax, 0x99b4
sub eax, 0xdac3
add eax, 0x54df
pop eax
push esi
push edx
add esp, 4
jmp 0x407a0b
pop esi
push esi
and esi, 0xc82c
sub esi, 0x37ad
pop esi
push edi
push edi
add esp, 4
jmp 0x407a25
invalid
and edi, 0x12e65
add edi, 0xfd76
pop edi
push esi
or esi, 0x14884
or esi, 0x11371
xor esi, 0x9822
add byte [ecx + 0x112d8ce], al
add byte [esi - 0x39], bl
test eax, ebp
invalid
invalid
dec dword [esi]
add byte [eax], al
add byte [ecx - 0x7f], dl
jmp 0x409343
pop ecx
push esi
push eax
add esp, 4
sub esi, 0x3d33
add byte [esi + 0x50], bl
push edx
add esp, 4
sub eax, 0x6327
or eax, 0xbe1e
xor eax, 0x7846
add byte [ecx + 0xdabec8], al
add byte [eax - 0x46], bl
add dword [eax], eax
add byte [eax], al

Function at 0x40797b
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
dec esi
inc ecx
dec ebx
inc edi
xor edi, 0x131a0
or edi, 0x532f
pop edi
push edx
push edx
add esp, 4
call 0x40797b
add byte [esi], dh
aaa
xor al, 0x40
inc ebp
xor al, 0x38
add esp, 4
or edx, 0x752d
pop edx
push eax
call 0x407993
add byte [edx], dh
dec edx
dec ecx
dec esi
cmp al, 0x4c
inc ecx
add esp, 4
and eax, 0x12ff9
pop eax
push esi
sub esi, 0x4bb4
jmp 0x4079aa
add esi, 0x140cf
or esi, 0x81cc
pop esi
mov byte [ebp - 0xbf8], 0x51
mov byte [ebp - 0xbf7], 0xb9
mov byte [ebp - 0xbf6], 0x20
mov byte [ebp - 0xbf5], 0x20
mov byte [ebp - 0xbf4], 0x20
mov byte [ebp - 0xbf3], 0x20
mov byte [ebp - 0xbf2], 0x59
push eax
push edx
add esp, 4
add eax, 0x99b4
sub eax, 0xdac3
add eax, 0x54df
pop eax
push esi
push edx
add esp, 4
jmp 0x407a0b
pop esi
push esi
and esi, 0xc82c
sub esi, 0x37ad
pop esi
push edi
push edi
add esp, 4
jmp 0x407a25
invalid
and edi, 0x12e65
add edi, 0xfd76
pop edi
push esi
or esi, 0x14884
or esi, 0x11371
xor esi, 0x9822
add byte [ecx + 0x112d8ce], al
add byte [esi - 0x39], bl
test eax, ebp
invalid
invalid
dec dword [esi]
add byte [eax], al
add byte [ecx - 0x7f], dl
jmp 0x409343
pop ecx
push esi
push eax
add esp, 4
sub esi, 0x3d33
add byte [esi + 0x50], bl
push edx
add esp, 4
sub eax, 0x6327
or eax, 0xbe1e
xor eax, 0x7846
add byte [ecx + 0xdabec8], al
add byte [eax - 0x46], bl
add dword [eax], eax
add byte [eax], al
Function at 0x407993
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
dec esi
inc ecx
dec ebx
inc edi
xor edi, 0x131a0
or edi, 0x532f
pop edi
push edx
push edx
add esp, 4
call 0x40797b
add byte [esi], dh
aaa
xor al, 0x40
inc ebp
xor al, 0x38
add esp, 4
or edx, 0x752d
pop edx
push eax
call 0x407993
add byte [edx], dh
dec edx
dec ecx
dec esi
cmp al, 0x4c
inc ecx
add esp, 4
and eax, 0x12ff9
pop eax
push esi
sub esi, 0x4bb4
jmp 0x4079aa
add esi, 0x140cf
or esi, 0x81cc
pop esi
mov byte [ebp - 0xbf8], 0x51
mov byte [ebp - 0xbf7], 0xb9
mov byte [ebp - 0xbf6], 0x20
mov byte [ebp - 0xbf5], 0x20
mov byte [ebp - 0xbf4], 0x20
mov byte [ebp - 0xbf3], 0x20
mov byte [ebp - 0xbf2], 0x59
push eax
push edx
add esp, 4
add eax, 0x99b4
sub eax, 0xdac3
add eax, 0x54df
pop eax
push esi
push edx
add esp, 4
jmp 0x407a0b
pop esi
push esi
and esi, 0xc82c
sub esi, 0x37ad
pop esi
push edi
push edi
add esp, 4
jmp 0x407a25
invalid
and edi, 0x12e65
add edi, 0xfd76
pop edi
push esi
or esi, 0x14884
or esi, 0x11371
xor esi, 0x9822
add byte [ecx + 0x112d8ce], al
add byte [esi - 0x39], bl
test eax, ebp
invalid
invalid
dec dword [esi]
add byte [eax], al
add byte [ecx - 0x7f], dl
jmp 0x409343
pop ecx
push esi
push eax
add esp, 4
sub esi, 0x3d33
add byte [esi + 0x50], bl
push edx
add esp, 4
sub eax, 0x6327
or eax, 0xbe1e
xor eax, 0x7846
add byte [ecx + 0xdabec8], al
add byte [eax - 0x46], bl
add dword [eax], eax
add byte [eax], al

Function at 0x407a80
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [ecx + 0xdabec8], al
add byte [eax - 0x46], bl
add dword [eax], eax
add byte [eax], al
imul eax, edx, 0
lea ecx, [ebp + eax - 0xbf0]
mov dword [ebp - 0x15c0], ecx
push edi
push edi
add esp, 4
jmp 0x407aa7
add edi, 0x184ec
xor edi, 0x3910
pop edi
push esi
sub esi, 0xc7b2
add esi, 0x16243
jmp 0x407ac8
and esi, 0xfc20
pop esi
mov dword [ebp - 0x2034], 0xffffffff
push eax
push esi
add esp, 4
add eax, 0x14952
and eax, 0x893c
and eax, 0x184f9
add eax, 0xf01e
pop eax
push eax
push ecx
add esp, 4
jmp 0x407b03
jmp 0x407b0a
pop eax
mov edx, dword [ebp - 0x3f4]
mov dword [ebp - 0x4f8], edx
jmp 0x407b28
Function at 0x407e74
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
inc ebp
inc esi
cmp eax, dword [ecx + 0x36]
add esp, 4
jmp 0x407e84
pop ebx
mov dword [ebp - 0x2038], 0xffffffff
push eax
push ecx
add esp, 4
call 0x407ea4
add byte [edi], dh
dec esp

Function at 0x407e79
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
inc ebp
inc esi
cmp eax, dword [ecx + 0x36]
add esp, 4
jmp 0x407e84
pop ebx
mov dword [ebp - 0x2038], 0xffffffff
push eax
push ecx
add esp, 4
call 0x407ea4
add byte [edi], dh
dec esp

Function at 0x407e9c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
inc edx
inc edx
cmp eax, 0x34343934
push eax
add esp, 4
sub eax, 0x1312b
call 0x407ebd
add byte [esi + 0x41], al
aaa
dec ebp
xor esi, dword [edi]
xor edi, dword ds:[ebx]
add esp, 4
pop eax
mov edx, dword [ebp - 0x3f4]
mov dword [ebp - 0x4fc], edx
jmp 0x407ede
push ecx
sub ecx, 0x16e30
pop ecx
push esi
push ebx
add esp, 4
xor esi, 0x10c8e
pop esi
push edi
push esi
add esp, 4
sub edi, 0x13586
pop edi
push ebx
push ecx
add esp, 4
invalid

Function at 0x407ea4
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
inc edx
inc edx
cmp eax, 0x34343934
push eax
add esp, 4
sub eax, 0x1312b
call 0x407ebd
add byte [esi + 0x41], al
aaa
dec ebp
xor esi, dword [edi]
xor edi, dword ds:[ebx]
add esp, 4
pop eax
mov edx, dword [ebp - 0x3f4]
mov dword [ebp - 0x4fc], edx
jmp 0x407ede
push ecx
sub ecx, 0x16e30
pop ecx
push esi
push ebx
add esp, 4
xor esi, 0x10c8e
pop esi
push edi
push esi
add esp, 4
sub edi, 0x13586
pop edi
push ebx
push ecx
add esp, 4
invalid

Function at 0x407ebd
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
inc edx
inc edx
cmp eax, 0x34343934
push eax
add esp, 4
sub eax, 0x1312b
call 0x407ebd
add byte [esi + 0x41], al
aaa
dec ebp
xor esi, dword [edi]
xor edi, dword ds:[ebx]
add esp, 4
pop eax
mov edx, dword [ebp - 0x3f4]
mov dword [ebp - 0x4fc], edx
jmp 0x407ede
push ecx
sub ecx, 0x16e30
pop ecx
push esi
push ebx
add esp, 4
xor esi, 0x10c8e
pop esi
push edi
push esi
add esp, 4
sub edi, 0x13586
pop edi
push ebx
push ecx
add esp, 4
invalid

Function at 0x40803c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [ecx + 0x51], bl
or ecx, 0x130cc
or ecx, 0x1578a
call fcn.00408058
add byte [ebp + 0x3c], al
inc ecx
inc esp
xor esi, dword [esp + edi]

Function at 0x408058
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x4fc]
add eax, 1
mov dword [ebp - 0x4fc], eax
add esp, 4
pop ecx
mov ecx, dword [ebp - 0xae0]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0xadc]
movzx ecx, byte [eax]
cmp edx, ecx
jle 0x40807e
mov dword [ebp - 0x15d0], 1
jmp 0x408088
mov dword [ebp - 0x15d0], 0xffffffff
mov edx, dword [ebp - 0x15d0]
mov dword [ebp - 0xc9c], edx
jmp 0x4080fa
invalid
invalid