joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100011d0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
movzx ecx, word [eax + 0x14]
mov edx, dword [edi + 0x30]
mov esi, dword [ecx + eax + 0x20]
dec edx
lea ecx, [ecx + eax + 0x18]
not edx
and edx, esi
mov dword [ebp - 0x1c], esi
mov esi, dword [ecx + 0x10]
mov dword [ebp - 0x18], edx
test esi, esi
jne 0x10001213
mov ebx, dword [ecx + 0x24]
test bl, 0x40
je 0x1000120c
mov esi, dword [eax + 0x20]
jmp 0x10001213
test bl, bl
jns 0x10001213
mov esi, dword [eax + 0x24]
mov dword [ebp - 0x14], esi
mov esi, dword [ecx + 0x24]
mov dword [ebp - 0x10], esi
mov esi, 1
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 1
cmp si, word [eax + 6]
jae 0x100012e0
lea ebx, [ecx + 0x4c]
lea esp, [esp]
mov esi, dword [edi + 0x30]
mov ecx, dword [ebx - 0x1c]
mov edi, dword [ebx - 0x14]
dec esi
not esi
and esi, ecx
mov dword [ebp - 4], ecx
test edi, edi
jne 0x10001268
mov ecx, dword [ebx]
test cl, 0x40
je 0x10001261
mov edi, dword [eax + 0x20]
jmp 0x10001268
test cl, cl
jns 0x10001268
mov edi, dword [eax + 0x24]
cmp edx, esi
je 0x10001297
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x1c]
cmp eax, esi
ja 0x10001297
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x1c]
call fcn.10001120
test eax, eax
je 0x10001300
mov edx, dword [ebp - 4]
mov eax, dword [ebx]
mov dword [ebp - 0x1c], edx
mov edx, esi
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x10], eax
jmp 0x100012bf
mov eax, dword [ebx]
test eax, 0x2000000
je 0x100012ae
test dword [ebp - 0x10], 0x2000000
je 0x100012ae
or dword [ebp - 0x10], eax
jmp 0x100012b9
or eax, dword [ebp - 0x10]
and eax, 0xfdffffff
mov dword [ebp - 0x10], eax
sub edi, dword [ebp - 0x1c]
add edi, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov ecx, dword [ebp - 8]
movzx esi, word [eax + 6]
inc ecx
add ebx, 0x28
mov dword [ebp - 0x14], edi
mov edi, dword [ebp + 8]
mov dword [ebp - 8], ecx
cmp ecx, esi
jl 0x10001240
lea ecx, [ebp - 0x1c]
mov edx, edi
mov dword [ebp - 0xc], 1
call fcn.10001120
neg eax
pop edi
sbb eax, eax
pop esi
neg eax
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10001b10
Capabilities:
Accept command line arguments
Create thread
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [0x10012570], eax
mov dword [0x1001256c], eax
mov eax, dword [ebp + 0xc]
dec eax
mov dword [ebp - 0x64], 0
jne 0x10001c20
push ebx
mov ecx, 0x10003140
push esi
sub ecx, 0x3161c27e
lea eax, [ebp - 0x1c]
call fcn.10001c40
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
mov ebx, 1
call esi
test eax, eax
jne 0x10001b88
mov ecx, 0x1000314c
sub ecx, 0x29bcd4b9
lea eax, [ebp - 0x10]
call fcn.10001cd0
push eax
mov ebx, 3
call esi
test eax, eax
jne 0x10001b88
xor cl, cl
jmp 0x10001b8a
mov cl, 1
test bl, 2
je 0x10001ba1
and ebx, 0xfffffffd
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov word [ebp - 8], ax
mov byte [ebp - 6], al
test bl, 1
je 0x10001bb5
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov word [ebp - 0x14], ax
mov byte [ebp - 0x12], al
test cl, cl
je 0x10001bce
push 0
push 0
push 0
push 0x10001930
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 0xbd
xor eax, eax
mov dl, byte [eax + 0x10003158]
xor dl, cl
inc ecx
mov byte [ebp + eax - 0x60], dl
inc eax
and ecx, 0xff
cmp eax, 0x43
jb 0x10001bd5
mov byte [ebp - 0x1d], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea ecx, [ebp - 0x60]
push ecx
push eax
call dword [sym.imp.MSVCR100.dll_strstr]
push 0x44
lea edx, [ebp - 0x60]
push 0
push edx
mov esi, eax
call sub.MSVCR100.dll_memset
add esp, 0x14
test esi, esi
pop esi
pop ebx
jne 0x10001c20
call fcn.100015b0
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
call fcn.10001dbb
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10001dbb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x10001dc5
repz ret
jmp fcn.10002267
Function at 0x100014a1
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call fcn.10001570
mov dword [ebp - 4], esp
mov eax, 0
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x10005a65
push 0
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop
nop
cmp dword [ebp - 4], esp
je 0x100014fd
push 0x38
push 0x4010001
push 6
call fcn.10005bf1
add esp, 0xc
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push dword [ebp - 0xc]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x1000152c
push 0x38
push 0x4010001
push 6
call fcn.10005bf1
add esp, 0xc
mov dword [ebp - 4], esp
push 0x2710
xor eax, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
nop
nop
cmp dword [ebp - 4], esp
je 0x1000155a
push 0x91
push 0x4010001
push 6
call fcn.10005bf1
add esp, 0xc
mov eax, 0
jmp 0x10001564
mov esp, ebp
pop ebp
ret
Function at 0x10005958
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 0
jne 0x100059aa
mov dword [ebp - 0xc], esp
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x100059a2
push 0x4f
push 0x404b9f4
push 6
call fcn.10005bf1
add esp, 0xc
mov dword [ebp - 4], eax
jmp 0x100059e3
mov dword [ebp - 0xc], esp
push dword [ebp + 8]
push 0
push 1
xor eax, eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x100059e0
push 0x7d
push 0x404b9f4
push 6
call fcn.10005bf1
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100059f7
mov eax, 0
jmp 0x10005a5f
mov dword [ebp - 0xc], esp
push 0
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x10005a28
push 0x113
push 0x404b9f4
push 6
call fcn.10005bf1
add esp, 0xc
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x10005a57
push 0x137
push 0x404b9f4
push 6
call fcn.10005bf1
add esp, 0xc
mov eax, dword [ebp - 8]
jmp 0x10005a5f
mov esp, ebp
pop ebp
ret 8

Function at 0x10006410
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x400
call fcn.10007e7f
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x40]
mov ecx, dword [esp + 0x28]
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x30]
push ebx
push 0x400
push esi
push ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, 0x3ff
jl 0x1000647a
push esi
lea edi, [eax + 0x400]
call fcn.10007e74
push edi
call fcn.10007e7f
mov edx, dword [esp + 0x38]
add esp, 8
mov esi, eax
mov eax, dword [esp + 0x24]
push ebx
push edi
push esi
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
dec edi
cmp eax, edi
jge 0x1000644a
push esi
xor edi, edi
call dword [0x10013c44]
add esp, 4
test eax, eax
je 0x10006496
push eax
push esi
call fcn.10007850
add esp, 8
mov edi, eax
push esi
call fcn.10007e74
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x401340
Capabilities:
Get file system object information
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x4f1eac
mov eax, dword fs:[0]
push eax
sub esp, 0x2bc
mov eax, dword [0x52e028]
xor eax, esp
mov dword [esp + 0x2b8], eax
push esi
mov eax, dword [0x52e028]
xor eax, esp
push eax
lea eax, [esp + 0x2c4]
mov dword fs:[0], eax
lea ecx, [esp + 8]
call dword [0x4fff58]
mov dword [esp + 0x2cc], 0
push 0x104
push 0x104
lea ecx, [esp + 0x10]
call dword [0x4fff30]
push eax
push 0x5003c0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0xffffffffffffffff
lea ecx, [esp + 0xc]
call dword [0x4ffef8]
mov ecx, dword [esp + 8]
push 0x4001
push 0x2b4
lea eax, [esp + 0x14]
push eax
push 0
push ecx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push eax
call fcn.004ef11a
mov esi, eax
mov dword [esp + 0x2cc], 0xffffffff
lea ecx, [esp + 8]
call dword [0x4fff34]
mov eax, esi
mov ecx, dword [esp + 0x2c4]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x2b8]
xor ecx, esp
call fcn.004efe2a
add esp, 0x2c8
ret
Function at 0x401c6b
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add esp, 4
sub ecx, 0x1857a
pop ecx
mov eax, 0x4d
mov word [ebp - 0x204c], ax
mov ecx, 0x42
mov word [ebp - 0x204a], cx
mov edx, 0x53
mov word [ebp - 0x2048], dx
mov eax, 0x65
mov word [ebp - 0x2046], ax
mov ecx, 0x72
mov word [ebp - 0x2044], cx
mov edx, 0x76
mov word [ebp - 0x2042], dx
mov eax, 0x69
mov word [ebp - 0x2040], ax
mov ecx, 0x63
mov word [ebp - 0x203e], cx
mov edx, 0x65
mov word [ebp - 0x203c], dx
mov eax, 0x2e
mov word [ebp - 0x203a], ax
mov ecx, 0x65
mov word [ebp - 0x2038], cx
mov edx, 0x78
mov word [ebp - 0x2036], dx
mov eax, 0x65
mov word [ebp - 0x2034], ax
xor ecx, ecx
mov word [ebp - 0x2032], cx
mov dword [ebp - 0x1060], 1
push edx
push edi
add esp, 4
and edx, 0x15925
jmp 0x401d37
pop edx
push ebx
or ebx, 0x113de
xor ebx, 0xac1b
call 0x401d52
add byte [eax + 0x40], cl
inc ebx
dec esi
cmp dl, byte ds:[eax - 0x7d]
les eax, [ebx + ebx*2]
imul edx, dword [ebp - 0x1060], 0x70
add edx, 0x44f3663b
imul eax, dword [ebp - 0x1060], 0x70
sub edx, eax
xor edx, 0xaa6272
imul edx, dword [ebp - 0x1060]
imul ecx, dword [ebp - 0x1060], 0x70
sub edx, ecx
mov dword [ebp - 0x1064], edx
push ebx
or ebx, 0x166
and ebx, 0x5587
pop ebx
push ebx
jmp 0x401d9e
and ebx, 0x2a51
jmp 0x401dab
pop ebx
push edx
add edx, 0x497d
and edx, 0x14366
pop edx
mov dword [ebp - 0x10], 1
push edi
push ebx
add esp, 4
and edi, 0x5bdf
pop edi
push edx
add edx, 0xe45a
add edx, 0xa6e4
call 0x401de9
add byte [ebx + 0x37], cl
inc ebp
push eax
cmp al, 0x38
inc esp
inc ebx
inc edx
add esp, 4
sub edx, 0x1623f
pop edx
imul edx, dword [ebp - 0x10], 0x70
add edx, 0x44f3663b
imul eax, dword [ebp - 0x10], 0x70
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x70
sub edx, ecx
mov dword [ebp - 0x14], edx
push esi
and esi, 0xfb91
xor esi, 0x534
add esi, 0xb87f
pop esi
push esi
push esi
add esp, 4
sub esi, 0x183c5
xor esi, 0x9131
and esi, 0xe15f
or esi, 0x2bb6
pop esi
push esi
jmp 0x401e51
jmp 0x401e56
call 0x401e64
add byte [edi + 0x4e], cl
cmp dl, byte [eax + 0x38]
cmp byte ss:[edi - 0x7d], cl
les eax, [esi + ebx*2]
push ebx
push ecx
add esp, 4
and ebx, 0x949b
add ebx, 0x6126
pop ebx
mov dword [ebp - 0x2c], 1
push esi
and esi, 0x10a6a
and esi, 0x9114
call 0x401e9d
add byte [eax + 0x4a], dl
cmp dword [eax + 0x3a], eax
inc edi
aaa
cmp esi, dword [0x8104c483]
invalid
Function at 0x401d52
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
sub ecx, 0x1857a
pop ecx
mov eax, 0x4d
mov word [ebp - 0x204c], ax
mov ecx, 0x42
mov word [ebp - 0x204a], cx
mov edx, 0x53
mov word [ebp - 0x2048], dx
mov eax, 0x65
mov word [ebp - 0x2046], ax
mov ecx, 0x72
mov word [ebp - 0x2044], cx
mov edx, 0x76
mov word [ebp - 0x2042], dx
mov eax, 0x69
mov word [ebp - 0x2040], ax
mov ecx, 0x63
mov word [ebp - 0x203e], cx
mov edx, 0x65
mov word [ebp - 0x203c], dx
mov eax, 0x2e
mov word [ebp - 0x203a], ax
mov ecx, 0x65
mov word [ebp - 0x2038], cx
mov edx, 0x78
mov word [ebp - 0x2036], dx
mov eax, 0x65
mov word [ebp - 0x2034], ax
xor ecx, ecx
mov word [ebp - 0x2032], cx
mov dword [ebp - 0x1060], 1
push edx
push edi
add esp, 4
and edx, 0x15925
jmp 0x401d37
pop edx
push ebx
or ebx, 0x113de
xor ebx, 0xac1b
call 0x401d52
add byte [eax + 0x40], cl
inc ebx
dec esi
cmp dl, byte ds:[eax - 0x7d]
les eax, [ebx + ebx*2]
imul edx, dword [ebp - 0x1060], 0x70
add edx, 0x44f3663b
imul eax, dword [ebp - 0x1060], 0x70
sub edx, eax
xor edx, 0xaa6272
imul edx, dword [ebp - 0x1060]
imul ecx, dword [ebp - 0x1060], 0x70
sub edx, ecx
mov dword [ebp - 0x1064], edx
push ebx
or ebx, 0x166
and ebx, 0x5587
pop ebx
push ebx
jmp 0x401d9e
and ebx, 0x2a51
jmp 0x401dab
pop ebx
push edx
add edx, 0x497d
and edx, 0x14366
pop edx
mov dword [ebp - 0x10], 1
push edi
push ebx
add esp, 4
and edi, 0x5bdf
pop edi
push edx
add edx, 0xe45a
add edx, 0xa6e4
call 0x401de9
add byte [ebx + 0x37], cl
inc ebp
push eax
cmp al, 0x38
inc esp
inc ebx
inc edx
add esp, 4
sub edx, 0x1623f
pop edx
imul edx, dword [ebp - 0x10], 0x70
add edx, 0x44f3663b
imul eax, dword [ebp - 0x10], 0x70
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x70
sub edx, ecx
mov dword [ebp - 0x14], edx
push esi
and esi, 0xfb91
xor esi, 0x534
add esi, 0xb87f
pop esi
push esi
push esi
add esp, 4
sub esi, 0x183c5
xor esi, 0x9131
and esi, 0xe15f
or esi, 0x2bb6
pop esi
push esi
jmp 0x401e51
jmp 0x401e56
call 0x401e64
add byte [edi + 0x4e], cl
cmp dl, byte [eax + 0x38]
cmp byte ss:[edi - 0x7d], cl
les eax, [esi + ebx*2]
push ebx
push ecx
add esp, 4
and ebx, 0x949b
add ebx, 0x6126
pop ebx
mov dword [ebp - 0x2c], 1
push esi
and esi, 0x10a6a
and esi, 0x9114
call 0x401e9d
add byte [eax + 0x4a], dl
cmp dword [eax + 0x3a], eax
inc edi
aaa
cmp esi, dword [0x8104c483]
invalid
Function at 0x401de9
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
sub ecx, 0x1857a
pop ecx
mov eax, 0x4d
mov word [ebp - 0x204c], ax
mov ecx, 0x42
mov word [ebp - 0x204a], cx
mov edx, 0x53
mov word [ebp - 0x2048], dx
mov eax, 0x65
mov word [ebp - 0x2046], ax
mov ecx, 0x72
mov word [ebp - 0x2044], cx
mov edx, 0x76
mov word [ebp - 0x2042], dx
mov eax, 0x69
mov word [ebp - 0x2040], ax
mov ecx, 0x63
mov word [ebp - 0x203e], cx
mov edx, 0x65
mov word [ebp - 0x203c], dx
mov eax, 0x2e
mov word [ebp - 0x203a], ax
mov ecx, 0x65
mov word [ebp - 0x2038], cx
mov edx, 0x78
mov word [ebp - 0x2036], dx
mov eax, 0x65
mov word [ebp - 0x2034], ax
xor ecx, ecx
mov word [ebp - 0x2032], cx
mov dword [ebp - 0x1060], 1
push edx
push edi
add esp, 4
and edx, 0x15925
jmp 0x401d37
pop edx
push ebx
or ebx, 0x113de
xor ebx, 0xac1b
call 0x401d52
add byte [eax + 0x40], cl
inc ebx
dec esi
cmp dl, byte ds:[eax - 0x7d]
les eax, [ebx + ebx*2]
imul edx, dword [ebp - 0x1060], 0x70
add edx, 0x44f3663b
imul eax, dword [ebp - 0x1060], 0x70
sub edx, eax
xor edx, 0xaa6272
imul edx, dword [ebp - 0x1060]
imul ecx, dword [ebp - 0x1060], 0x70
sub edx, ecx
mov dword [ebp - 0x1064], edx
push ebx
or ebx, 0x166
and ebx, 0x5587
pop ebx
push ebx
jmp 0x401d9e
and ebx, 0x2a51
jmp 0x401dab
pop ebx
push edx
add edx, 0x497d
and edx, 0x14366
pop edx
mov dword [ebp - 0x10], 1
push edi
push ebx
add esp, 4
and edi, 0x5bdf
pop edi
push edx
add edx, 0xe45a
add edx, 0xa6e4
call 0x401de9
add byte [ebx + 0x37], cl
inc ebp
push eax
cmp al, 0x38
inc esp
inc ebx
inc edx
add esp, 4
sub edx, 0x1623f
pop edx
imul edx, dword [ebp - 0x10], 0x70
add edx, 0x44f3663b
imul eax, dword [ebp - 0x10], 0x70
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x70
sub edx, ecx
mov dword [ebp - 0x14], edx
push esi
and esi, 0xfb91
xor esi, 0x534
add esi, 0xb87f
pop esi
push esi
push esi
add esp, 4
sub esi, 0x183c5
xor esi, 0x9131
and esi, 0xe15f
or esi, 0x2bb6
pop esi
push esi
jmp 0x401e51
jmp 0x401e56
call 0x401e64
add byte [edi + 0x4e], cl
cmp dl, byte [eax + 0x38]
cmp byte ss:[edi - 0x7d], cl
les eax, [esi + ebx*2]
push ebx
push ecx
add esp, 4
and ebx, 0x949b
add ebx, 0x6126
pop ebx
mov dword [ebp - 0x2c], 1
push esi
and esi, 0x10a6a
and esi, 0x9114
call 0x401e9d
add byte [eax + 0x4a], dl
cmp dword [eax + 0x3a], eax
inc edi
aaa
cmp esi, dword [0x8104c483]
invalid
Function at 0x401e64
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
sub ecx, 0x1857a
pop ecx
mov eax, 0x4d
mov word [ebp - 0x204c], ax
mov ecx, 0x42
mov word [ebp - 0x204a], cx
mov edx, 0x53
mov word [ebp - 0x2048], dx
mov eax, 0x65
mov word [ebp - 0x2046], ax
mov ecx, 0x72
mov word [ebp - 0x2044], cx
mov edx, 0x76
mov word [ebp - 0x2042], dx
mov eax, 0x69
mov word [ebp - 0x2040], ax
mov ecx, 0x63
mov word [ebp - 0x203e], cx
mov edx, 0x65
mov word [ebp - 0x203c], dx
mov eax, 0x2e
mov word [ebp - 0x203a], ax
mov ecx, 0x65
mov word [ebp - 0x2038], cx
mov edx, 0x78
mov word [ebp - 0x2036], dx
mov eax, 0x65
mov word [ebp - 0x2034], ax
xor ecx, ecx
mov word [ebp - 0x2032], cx
mov dword [ebp - 0x1060], 1
push edx
push edi
add esp, 4
and edx, 0x15925
jmp 0x401d37
pop edx
push ebx
or ebx, 0x113de
xor ebx, 0xac1b
call 0x401d52
add byte [eax + 0x40], cl
inc ebx
dec esi
cmp dl, byte ds:[eax - 0x7d]
les eax, [ebx + ebx*2]
imul edx, dword [ebp - 0x1060], 0x70
add edx, 0x44f3663b
imul eax, dword [ebp - 0x1060], 0x70
sub edx, eax
xor edx, 0xaa6272
imul edx, dword [ebp - 0x1060]
imul ecx, dword [ebp - 0x1060], 0x70
sub edx, ecx
mov dword [ebp - 0x1064], edx
push ebx
or ebx, 0x166
and ebx, 0x5587
pop ebx
push ebx
jmp 0x401d9e
and ebx, 0x2a51
jmp 0x401dab
pop ebx
push edx
add edx, 0x497d
and edx, 0x14366
pop edx
mov dword [ebp - 0x10], 1
push edi
push ebx
add esp, 4
and edi, 0x5bdf
pop edi
push edx
add edx, 0xe45a
add edx, 0xa6e4
call 0x401de9
add byte [ebx + 0x37], cl
inc ebp
push eax
cmp al, 0x38
inc esp
inc ebx
inc edx
add esp, 4
sub edx, 0x1623f
pop edx
imul edx, dword [ebp - 0x10], 0x70
add edx, 0x44f3663b
imul eax, dword [ebp - 0x10], 0x70
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x70
sub edx, ecx
mov dword [ebp - 0x14], edx
push esi
and esi, 0xfb91
xor esi, 0x534
add esi, 0xb87f
pop esi
push esi
push esi
add esp, 4
sub esi, 0x183c5
xor esi, 0x9131
and esi, 0xe15f
or esi, 0x2bb6
pop esi
push esi
jmp 0x401e51
jmp 0x401e56
call 0x401e64
add byte [edi + 0x4e], cl
cmp dl, byte [eax + 0x38]
cmp byte ss:[edi - 0x7d], cl
les eax, [esi + ebx*2]
push ebx
push ecx
add esp, 4
and ebx, 0x949b
add ebx, 0x6126
pop ebx
mov dword [ebp - 0x2c], 1
push esi
and esi, 0x10a6a
and esi, 0x9114
call 0x401e9d
add byte [eax + 0x4a], dl
cmp dword [eax + 0x3a], eax
inc edi
aaa
cmp esi, dword [0x8104c483]
invalid
Function at 0x401e9d
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
sub ecx, 0x1857a
pop ecx
mov eax, 0x4d
mov word [ebp - 0x204c], ax
mov ecx, 0x42
mov word [ebp - 0x204a], cx
mov edx, 0x53
mov word [ebp - 0x2048], dx
mov eax, 0x65
mov word [ebp - 0x2046], ax
mov ecx, 0x72
mov word [ebp - 0x2044], cx
mov edx, 0x76
mov word [ebp - 0x2042], dx
mov eax, 0x69
mov word [ebp - 0x2040], ax
mov ecx, 0x63
mov word [ebp - 0x203e], cx
mov edx, 0x65
mov word [ebp - 0x203c], dx
mov eax, 0x2e
mov word [ebp - 0x203a], ax
mov ecx, 0x65
mov word [ebp - 0x2038], cx
mov edx, 0x78
mov word [ebp - 0x2036], dx
mov eax, 0x65
mov word [ebp - 0x2034], ax
xor ecx, ecx
mov word [ebp - 0x2032], cx
mov dword [ebp - 0x1060], 1
push edx
push edi
add esp, 4
and edx, 0x15925
jmp 0x401d37
pop edx
push ebx
or ebx, 0x113de
xor ebx, 0xac1b
call 0x401d52
add byte [eax + 0x40], cl
inc ebx
dec esi
cmp dl, byte ds:[eax - 0x7d]
les eax, [ebx + ebx*2]
imul edx, dword [ebp - 0x1060], 0x70
add edx, 0x44f3663b
imul eax, dword [ebp - 0x1060], 0x70
sub edx, eax
xor edx, 0xaa6272
imul edx, dword [ebp - 0x1060]
imul ecx, dword [ebp - 0x1060], 0x70
sub edx, ecx
mov dword [ebp - 0x1064], edx
push ebx
or ebx, 0x166
and ebx, 0x5587
pop ebx
push ebx
jmp 0x401d9e
and ebx, 0x2a51
jmp 0x401dab
pop ebx
push edx
add edx, 0x497d
and edx, 0x14366
pop edx
mov dword [ebp - 0x10], 1
push edi
push ebx
add esp, 4
and edi, 0x5bdf
pop edi
push edx
add edx, 0xe45a
add edx, 0xa6e4
call 0x401de9
add byte [ebx + 0x37], cl
inc ebp
push eax
cmp al, 0x38
inc esp
inc ebx
inc edx
add esp, 4
sub edx, 0x1623f
pop edx
imul edx, dword [ebp - 0x10], 0x70
add edx, 0x44f3663b
imul eax, dword [ebp - 0x10], 0x70
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x70
sub edx, ecx
mov dword [ebp - 0x14], edx
push esi
and esi, 0xfb91
xor esi, 0x534
add esi, 0xb87f
pop esi
push esi
push esi
add esp, 4
sub esi, 0x183c5
xor esi, 0x9131
and esi, 0xe15f
or esi, 0x2bb6
pop esi
push esi
jmp 0x401e51
jmp 0x401e56
call 0x401e64
add byte [edi + 0x4e], cl
cmp dl, byte [eax + 0x38]
cmp byte ss:[edi - 0x7d], cl
les eax, [esi + ebx*2]
push ebx
push ecx
add esp, 4
and ebx, 0x949b
add ebx, 0x6126
pop ebx
mov dword [ebp - 0x2c], 1
push esi
and esi, 0x10a6a
and esi, 0x9114
call 0x401e9d
add byte [eax + 0x4a], dl
cmp dword [eax + 0x3a], eax
inc edi
aaa
cmp esi, dword [0x8104c483]
invalid
Function at 0x4066f6
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop esi
push ecx
push esi
add esp, 4
xor ecx, 0x850e
pop ecx
mov dword [ebp - 0x79c], 0
jmp 0x406dff
Function at 0x406fe0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or edx, 0xdedc
sub edx, 0x74fc
xor edx, 0xb83e
pop edx
push ecx
xor ecx, 0x117c8
pop ecx
mov eax, dword fs:[0x18]
mov dword [ebp - 0x19f8], eax
mov ecx, dword [ebp - 0x19f8]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x19fc], edx
mov eax, dword [ebp - 0x19fc]
mov dword [ebp - 0x1618], eax
push edx
xor edx, 0x13396
sub edx, 0xe9c0
call 0x407041
add byte [edx + 0x44], cl
xor ecx, dword ds:[edi + 0x41]
xor dl, byte [eax + 0x4e]
add esp, 4
pop edx
push edi
push ecx
add esp, 4
add edi, 0xc324
sub edi, 0xdc63
pop edi
cmp dword [ebp - 0x1618], 0
jne 0x40706f
mov dword [ebp - 0x2fc], 0
jmp 0x407316
invalid

Function at 0x407041
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or edx, 0xdedc
sub edx, 0x74fc
xor edx, 0xb83e
pop edx
push ecx
xor ecx, 0x117c8
pop ecx
mov eax, dword fs:[0x18]
mov dword [ebp - 0x19f8], eax
mov ecx, dword [ebp - 0x19f8]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x19fc], edx
mov eax, dword [ebp - 0x19fc]
mov dword [ebp - 0x1618], eax
push edx
xor edx, 0x13396
sub edx, 0xe9c0
call 0x407041
add byte [edx + 0x44], cl
xor ecx, dword ds:[edi + 0x41]
xor dl, byte [eax + 0x4e]
add esp, 4
pop edx
push edi
push ecx
add esp, 4
add edi, 0xc324
sub edi, 0xdc63
pop edi
cmp dword [ebp - 0x1618], 0
jne 0x40706f
mov dword [ebp - 0x2fc], 0
jmp 0x407316
invalid
Function at 0x407470
Capabilities:
Resolve function by parsing pe exports

Disassembly:
idiv edi
call dword [edi - 0x3a]
test dword [eax - 9], ebp
invalid