joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47d198
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x515c10]
cmp dword [eax + 0x30], 0
je 0x47d242
cmp dword [ebx + 0x94], 0
jne 0x47d23c
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x47d128
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x47d23c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x47d202
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x47d23c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041cba0
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x47d211
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x47dda4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x47ddd9
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404380
jmp 0x47dde6
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004042e4
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x47eef0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x47ef31
mov eax, esi
call fcn.00464400
test al, al
je 0x47ef31
mov eax, dword [ebx + 0x84]
call fcn.004640fc
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x47ef31
push 0
mov eax, dword [ebx + 0x84]
call fcn.004640fc
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x481524
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x481784
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x481587
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.00480fec
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040d720
cmp al, 1
jne 0x481587
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.00481304
test al, al
je 0x481713
cmp dword [ebp - 8], 0
jge 0x4815a5
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.00480fec
mov eax, dword [ebp - 0x210]
call fcn.00404550
cmp ebx, eax
jge 0x4815ef
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.00480fec
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x5143c8]
and eax, 0xff
bt dword [edx], eax
jae 0x4815ef
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x481603
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00481500
cmp ebx, dword [ebp - 8]
je 0x481705
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x48162f
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004036fc
and eax, 0x7f
movzx eax, word [eax*2 + 0x512290]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x4816f2
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004036fc
and eax, 0x7f
movzx eax, word [eax*2 + 0x512290]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.004640fc
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004036fc
and eax, 0x7f
movzx eax, word [eax*2 + 0x512290]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.004640fc
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4816f9
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x481766
cmp dword [ebp - 8], 0
jge 0x48171e
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.00480fec
mov eax, dword [ebp - 0x218]
call fcn.00404550
cmp eax, dword [ebp - 8]
jg 0x481758
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.00480fec
mov eax, dword [ebp - 0x21c]
call fcn.00404550
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00481500
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48178b
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.004042b4
ret
Function at 0x4c1e43
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x5131e6
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4c1e9b
movzx edx, word [ebp + 8]
mov dword [ebp - 8], edx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push 0
push 0
push 0x513207
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x4c1e91
mov bx, 0x2a04
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey_1
jmp 0x4c1e9f
mov bx, 0x2a04
mov eax, ebx
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x4e7c80
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffe00
mov ebx, eax
lea eax, [esp + 0x100]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathA
push esp
push 0
push 0x4e7cc4
lea eax, [esp + 0x10c]
push eax
call sub.kernel32.dll_GetTempFileNameA
mov edx, ebx
mov eax, esp
call fcn.004096d0
add esp, 0x200
pop ebx
ret

Function at 0x4edfe0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, dword [esi + 0x40]
mov edi, dword [eax + 8]
dec edi
test edi, edi
jl 0x4ee01b
inc edi
xor ebx, ebx
mov edx, ebx
mov eax, dword [esi + 0x40]
call fcn.0041cba0
mov al, byte [eax + 0x2a8]
xor al, 1
push eax
mov edx, ebx
mov eax, dword [esi + 0x40]
call fcn.0041cba0
pop edx
mov byte [eax + 0x2a8], dl
inc ebx
dec edi
jne 0x4edff3
pop edi
pop esi
pop ebx
ret
Function at 0x401900
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20bc
push ebx
push esi
push edi
push eax
push esi
add esp, 4
add eax, 0x13c8a
call fcn.00401924
add byte [ecx + edi], bh
cmp al, 0x3e
inc esp
inc ebp
inc esi

Function at 0x401924
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x40192f
xor eax, 0x1670a
pop eax
push ebx
xor ebx, 0x15ed4
pop ebx
mov eax, 0x4d
mov word [ebp - 0x1ff8], ax
test dword [eax], ecx
loopne 0x401948
invalid
mov ecx, 0x42
mov word [ebp - 0x1ff6], cx
mov edx, 0x53
mov word [ebp - 0x1ff4], dx
mov eax, 0x65
mov word [ebp - 0x1ff2], ax
mov ecx, 0x72
mov word [ebp - 0x1ff0], cx
mov edx, 0x76
mov word [ebp - 0x1fee], dx
mov eax, 0x69
mov word [ebp - 0x1fec], ax
mov ecx, 0x63
mov word [ebp - 0x1fea], cx
invalid

Function at 0x401a7f
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esi, 0x1854
and esi, 0xb1a2
pop esi
mov dword [ebp - 0x10], 1
push eax
push edx
add esp, 4
add eax, 0x14056
add eax, 0x6eb
jmp 0x401aaa
pop eax
push ebx
add ebx, 0x972b
sub ebx, 0x2d9c
pop ebx
push edx
push edx
add esp, 4
sub edx, 0xb3a1
pop edx
imul edx, dword [ebp - 0x10], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x10], 0xfe
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0xfe
sub edx, ecx
mov dword [ebp - 0x14], edx
push edi
call 0x401b01
add byte [edx + 0x32], al
dec esi
dec ebx
inc ebp
inc eax
cmp al, 0x3e
add esp, 4
add al, 0x81
out 0x28, eax
xor al, byte [eax]
add byte [edi + 0x57], bl
push edx
add esp, 4
jmp 0x401b16
pop edi
push edi
push edi
add esp, 4
add edi, 0x44ef
pop edi
push ecx
sub ecx, 0x1336e
add ecx, 0x9bf
xor ecx, 0xeaa7
call 0x401b45
add byte [esi], dh
dec ebx
inc eax
dec ebx
cmp bh, byte [ebx]
dec edx
inc edi
xor al, 0x83
les eax, [ecx + ebx*2]
push edx
push edx
add esp, 4
xor edx, 0x1002d
pop edx
mov dword [ebp - 0x2c], 1
push ebx
push edx
add esp, 4
jmp 0x401b67
xor ebx, 0xb2f8
add ebx, 0x15217
pop ebx
push esi
or esi, 0x15e5c
pop esi
push esi
push ebx
add esp, 4
and esi, 0x914a
xor esi, 0xf532
pop esi
imul edx, dword [ebp - 0x2c], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x2c], 0xfe
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0xfe
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x401d6f
Function at 0x401b01
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esi, 0x1854
and esi, 0xb1a2
pop esi
mov dword [ebp - 0x10], 1
push eax
push edx
add esp, 4
add eax, 0x14056
add eax, 0x6eb
jmp 0x401aaa
pop eax
push ebx
add ebx, 0x972b
sub ebx, 0x2d9c
pop ebx
push edx
push edx
add esp, 4
sub edx, 0xb3a1
pop edx
imul edx, dword [ebp - 0x10], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x10], 0xfe
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0xfe
sub edx, ecx
mov dword [ebp - 0x14], edx
push edi
call 0x401b01
add byte [edx + 0x32], al
dec esi
dec ebx
inc ebp
inc eax
cmp al, 0x3e
add esp, 4
add al, 0x81
out 0x28, eax
xor al, byte [eax]
add byte [edi + 0x57], bl
push edx
add esp, 4
jmp 0x401b16
pop edi
push edi
push edi
add esp, 4
add edi, 0x44ef
pop edi
push ecx
sub ecx, 0x1336e
add ecx, 0x9bf
xor ecx, 0xeaa7
call 0x401b45
add byte [esi], dh
dec ebx
inc eax
dec ebx
cmp bh, byte [ebx]
dec edx
inc edi
xor al, 0x83
les eax, [ecx + ebx*2]
push edx
push edx
add esp, 4
xor edx, 0x1002d
pop edx
mov dword [ebp - 0x2c], 1
push ebx
push edx
add esp, 4
jmp 0x401b67
xor ebx, 0xb2f8
add ebx, 0x15217
pop ebx
push esi
or esi, 0x15e5c
pop esi
push esi
push ebx
add esp, 4
and esi, 0x914a
xor esi, 0xf532
pop esi
imul edx, dword [ebp - 0x2c], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x2c], 0xfe
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0xfe
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x401d6f

Function at 0x401b03
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esi, 0x1854
and esi, 0xb1a2
pop esi
mov dword [ebp - 0x10], 1
push eax
push edx
add esp, 4
add eax, 0x14056
add eax, 0x6eb
jmp 0x401aaa
pop eax
push ebx
add ebx, 0x972b
sub ebx, 0x2d9c
pop ebx
push edx
push edx
add esp, 4
sub edx, 0xb3a1
pop edx
imul edx, dword [ebp - 0x10], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x10], 0xfe
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0xfe
sub edx, ecx
mov dword [ebp - 0x14], edx
push edi
call 0x401b01
add byte [edx + 0x32], al
dec esi
dec ebx
inc ebp
inc eax
cmp al, 0x3e
add esp, 4
add al, 0x81
out 0x28, eax
xor al, byte [eax]
add byte [edi + 0x57], bl
push edx
add esp, 4
jmp 0x401b16
pop edi
push edi
push edi
add esp, 4
add edi, 0x44ef
pop edi
push ecx
sub ecx, 0x1336e
add ecx, 0x9bf
xor ecx, 0xeaa7
call 0x401b45
add byte [esi], dh
dec ebx
inc eax
dec ebx
cmp bh, byte [ebx]
dec edx
inc edi
xor al, 0x83
les eax, [ecx + ebx*2]
push edx
push edx
add esp, 4
xor edx, 0x1002d
pop edx
mov dword [ebp - 0x2c], 1
push ebx
push edx
add esp, 4
jmp 0x401b67
xor ebx, 0xb2f8
add ebx, 0x15217
pop ebx
push esi
or esi, 0x15e5c
pop esi
push esi
push ebx
add esp, 4
and esi, 0x914a
xor esi, 0xf532
pop esi
imul edx, dword [ebp - 0x2c], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x2c], 0xfe
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0xfe
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x401d6f
Function at 0x401b45
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esi, 0x1854
and esi, 0xb1a2
pop esi
mov dword [ebp - 0x10], 1
push eax
push edx
add esp, 4
add eax, 0x14056
add eax, 0x6eb
jmp 0x401aaa
pop eax
push ebx
add ebx, 0x972b
sub ebx, 0x2d9c
pop ebx
push edx
push edx
add esp, 4
sub edx, 0xb3a1
pop edx
imul edx, dword [ebp - 0x10], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x10], 0xfe
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0xfe
sub edx, ecx
mov dword [ebp - 0x14], edx
push edi
call 0x401b01
add byte [edx + 0x32], al
dec esi
dec ebx
inc ebp
inc eax
cmp al, 0x3e
add esp, 4
add al, 0x81
out 0x28, eax
xor al, byte [eax]
add byte [edi + 0x57], bl
push edx
add esp, 4
jmp 0x401b16
pop edi
push edi
push edi
add esp, 4
add edi, 0x44ef
pop edi
push ecx
sub ecx, 0x1336e
add ecx, 0x9bf
xor ecx, 0xeaa7
call 0x401b45
add byte [esi], dh
dec ebx
inc eax
dec ebx
cmp bh, byte [ebx]
dec edx
inc edi
xor al, 0x83
les eax, [ecx + ebx*2]
push edx
push edx
add esp, 4
xor edx, 0x1002d
pop edx
mov dword [ebp - 0x2c], 1
push ebx
push edx
add esp, 4
jmp 0x401b67
xor ebx, 0xb2f8
add ebx, 0x15217
pop ebx
push esi
or esi, 0x15e5c
pop esi
push esi
push ebx
add esp, 4
and esi, 0x914a
xor esi, 0xf532
pop esi
imul edx, dword [ebp - 0x2c], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x2c], 0xfe
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0xfe
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x401d6f
Function at 0x4054cc
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x4054d6
xor edx, 0x838d
pop edx
push ebx
push edx
add esp, 4
xor ebx, 0x16de7
call 0x4054f8
add byte [edi + 0x36], al
inc edi
xor eax, dword [esi + 0x50]
dec ecx
inc esi
xor al, byte [ebx - 0x7d]
les eax, [eax + ebp*8]
or eax, dword [eax]
add byte [eax], al
add byte [ebx + 0x4c], cl
dec edx
aas
inc esp
inc edx
dec edi
xor eax, dword [eax + 0x39]
add esp, 4
pop ebx
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xbe4]
mov dword [ebp - 0x15d0], eax
push eax
sub eax, 0x11646
pop eax
push ebx
push edi
add esp, 4
xor ebx, 0x15528
call 0x405546
add byte [ecx], bh
dec eax
xor al, byte [eax + 0x3e]
dec eax
dec eax
dec ecx
dec ecx
add esp, 4
pop ebx
push eax
push edi
add esp, 4
sub eax, 0xc9bf
pop eax
mov dword [ebp - 0x20a4], 0xffffffff
push esi
push ebx
add esp, 4
xor esi, 0xaedc
add esi, 0x152d9
or esi, 0x179f9
pop esi
push ebx
xor ebx, 0xd3fb
and ebx, 0xbe7f
and ebx, 0x4e76
sub ebx, 0x165ea
pop ebx
invalid
invalid

Function at 0x4054f8
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x4054d6
xor edx, 0x838d
pop edx
push ebx
push edx
add esp, 4
xor ebx, 0x16de7
call 0x4054f8
add byte [edi + 0x36], al
inc edi
xor eax, dword [esi + 0x50]
dec ecx
inc esi
xor al, byte [ebx - 0x7d]
les eax, [eax + ebp*8]
or eax, dword [eax]
add byte [eax], al
add byte [ebx + 0x4c], cl
dec edx
aas
inc esp
inc edx
dec edi
xor eax, dword [eax + 0x39]
add esp, 4
pop ebx
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xbe4]
mov dword [ebp - 0x15d0], eax
push eax
sub eax, 0x11646
pop eax
push ebx
push edi
add esp, 4
xor ebx, 0x15528
call 0x405546
add byte [ecx], bh
dec eax
xor al, byte [eax + 0x3e]
dec eax
dec eax
dec ecx
dec ecx
add esp, 4
pop ebx
push eax
push edi
add esp, 4
sub eax, 0xc9bf
pop eax
mov dword [ebp - 0x20a4], 0xffffffff
push esi
push ebx
add esp, 4
xor esi, 0xaedc
add esi, 0x152d9
or esi, 0x179f9
pop esi
push ebx
xor ebx, 0xd3fb
and ebx, 0xbe7f
and ebx, 0x4e76
sub ebx, 0x165ea
pop ebx
invalid
invalid

Function at 0x40550b
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x4054d6
xor edx, 0x838d
pop edx
push ebx
push edx
add esp, 4
xor ebx, 0x16de7
call 0x4054f8
add byte [edi + 0x36], al
inc edi
xor eax, dword [esi + 0x50]
dec ecx
inc esi
xor al, byte [ebx - 0x7d]
les eax, [eax + ebp*8]
or eax, dword [eax]
add byte [eax], al
add byte [ebx + 0x4c], cl
dec edx
aas
inc esp
inc edx
dec edi
xor eax, dword [eax + 0x39]
add esp, 4
pop ebx
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xbe4]
mov dword [ebp - 0x15d0], eax
push eax
sub eax, 0x11646
pop eax
push ebx
push edi
add esp, 4
xor ebx, 0x15528
call 0x405546
add byte [ecx], bh
dec eax
xor al, byte [eax + 0x3e]
dec eax
dec eax
dec ecx
dec ecx
add esp, 4
pop ebx
push eax
push edi
add esp, 4
sub eax, 0xc9bf
pop eax
mov dword [ebp - 0x20a4], 0xffffffff
push esi
push ebx
add esp, 4
xor esi, 0xaedc
add esi, 0x152d9
or esi, 0x179f9
pop esi
push ebx
xor ebx, 0xd3fb
and ebx, 0xbe7f
and ebx, 0x4e76
sub ebx, 0x165ea
pop ebx
invalid
invalid
Function at 0x405546
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x4054d6
xor edx, 0x838d
pop edx
push ebx
push edx
add esp, 4
xor ebx, 0x16de7
call 0x4054f8
add byte [edi + 0x36], al
inc edi
xor eax, dword [esi + 0x50]
dec ecx
inc esi
xor al, byte [ebx - 0x7d]
les eax, [eax + ebp*8]
or eax, dword [eax]
add byte [eax], al
add byte [ebx + 0x4c], cl
dec edx
aas
inc esp
inc edx
dec edi
xor eax, dword [eax + 0x39]
add esp, 4
pop ebx
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xbe4]
mov dword [ebp - 0x15d0], eax
push eax
sub eax, 0x11646
pop eax
push ebx
push edi
add esp, 4
xor ebx, 0x15528
call 0x405546
add byte [ecx], bh
dec eax
xor al, byte [eax + 0x3e]
dec eax
dec eax
dec ecx
dec ecx
add esp, 4
pop ebx
push eax
push edi
add esp, 4
sub eax, 0xc9bf
pop eax
mov dword [ebp - 0x20a4], 0xffffffff
push esi
push ebx
add esp, 4
xor esi, 0xaedc
add esi, 0x152d9
or esi, 0x179f9
pop esi
push ebx
xor ebx, 0xd3fb
and ebx, 0xbe7f
and ebx, 0x4e76
sub ebx, 0x165ea
pop ebx
invalid
invalid
Function at 0x406cd7
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x768]
add edx, 1
mov dword [ebp - 0x768], edx
add esp, 4
pop edi
mov edx, dword [ebp - 0x76c]
add edx, dword [ebp - 0x19c]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x19c]
movsx edx, byte [ebp + ecx - 0x878]
cmp eax, edx
jne 0x406d08
mov dword [ebp - 0xcb8], 0
jmp 0x406d77
push edi
push edx
add esp, 4
sub edi, 0x6d19
pop edi
push edx
sub edx, 0x11f98
pop edx
push edx
push eax
add esp, 4
or edx, 0x1599
xor edx, 0xdf7a
add edx, 0x990f
and edx, 0x15bc9
pop edx
mov eax, dword [ebp - 0x76c]
add eax, dword [ebp - 0x19c]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x19c]
movsx eax, byte [ebp + edx - 0x878]
or eax, 0x20
cmp ecx, eax
jge 0x406d6d
mov dword [ebp - 0xcb8], 0xffffffff
jmp 0x406d77
mov dword [ebp - 0xcb8], 1
cmp dword [ebp - 0xcb8], 0
jne 0x406d8e
mov ecx, dword [ebp - 0x198c]
mov dword [ebp - 0x510], ecx
jmp 0x406d9f
jmp 0x406b78
Function at 0x407d75
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
jmp 0x407d67
call 0x407d75
add byte [edi + 0x4c484640], dh
xor edi, dword [edx]
add esp, 4
pop eax
push ecx
xor ecx, 0x12502
xor ecx, 0xa44f
and ecx, 0x2bed
and ecx, 0xed97
pop ecx
mov edx, dword [ebp - 0xcd8]
mov ax, word [edx]
mov word [ebp - 0x1046], ax
mov ecx, dword [ebp - 0xcd8]
add ecx, 2
mov dword [ebp - 0xcd8], ecx
mov dx, word [ebp - 0x1046]
mov word [ebp - 0x224], dx
mov eax, dword [ebp - 0xcdc]
mov cx, word [eax]
mov word [ebp - 0x1048], cx
mov edx, dword [ebp - 0xcdc]
add edx, 2
mov dword [ebp - 0xcdc], edx
mov ax, word [ebp - 0x1048]
mov word [ebp - 0x40], ax
push edi
add edi, 0xc392
and edi, 0x10747
pop edi
push edi
push esi
add esp, 4
call fcn.00407e0a
add byte [esi], dh
dec esp
xor eax, 0x4544333d
add esp, 4
add edi, 0xf114
pop edi
push edx
and edx, 0xa917
pop edx
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x407e39
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x1684], edx
jmp 0x407e93
movzx ecx, word [ebp - 0x224]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x407d61
movzx eax, word [ebp - 0x224]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x407d61
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x407e7d
mov dword [ebp - 0x1680], 0xffffffff
jmp 0x407e87
mov dword [ebp - 0x1680], 1
mov ecx, dword [ebp - 0x1680]
mov dword [ebp - 0x1684], ecx
cmp dword [ebp - 0x1684], 0
jne 0x407edc
push edi
or edi, 0xeefb
pop edi
push edx
push ecx
add esp, 4
jmp 0x407eaf
call 0x407ebe
add byte [eax + 0x49], cl
xor ecx, dword [ebp + 0x3c]
inc edi
dec esp
inc esi
dec ebp
add esp, 4
sub edx, 0x6c70
and edx, 0xd573
pop edx
mov edx, dword [ebp - 0x51c]
mov dword [ebp - 0x2fc], edx
jmp 0x407f44
push esi
xor esi, 0x155a9
pop esi
push esi
push eax
add esp, 4
xor esi, 0x5161
pop esi
push edi
push eax
add esp, 4
xor edi, 0x47c9
xor edi, 0x244f
xor edi, 0x4ed9
xor edi, 0xb469
pop edi
mov eax, dword [ebp - 0x51c]
mov ecx, dword [eax]
mov dword [ebp - 0x51c], ecx
mov edx, dword [ebp - 0x51c]
cmp edx, dword [ebp - 0xce0]
je 0x407f3a
mov eax, dword [ebp - 0x51c]
cmp dword [eax + 0x30], 0
jne 0x407d05
mov dword [ebp - 0x2fc], 0
Function at 0x407e0a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
jmp 0x407d67
call 0x407d75
add byte [edi + 0x4c484640], dh
xor edi, dword [edx]
add esp, 4
pop eax
push ecx
xor ecx, 0x12502
xor ecx, 0xa44f
and ecx, 0x2bed
and ecx, 0xed97
pop ecx
mov edx, dword [ebp - 0xcd8]
mov ax, word [edx]
mov word [ebp - 0x1046], ax
mov ecx, dword [ebp - 0xcd8]
add ecx, 2
mov dword [ebp - 0xcd8], ecx
mov dx, word [ebp - 0x1046]
mov word [ebp - 0x224], dx
mov eax, dword [ebp - 0xcdc]
mov cx, word [eax]
mov word [ebp - 0x1048], cx
mov edx, dword [ebp - 0xcdc]
add edx, 2
mov dword [ebp - 0xcdc], edx
mov ax, word [ebp - 0x1048]
mov word [ebp - 0x40], ax
push edi
add edi, 0xc392
and edi, 0x10747
pop edi
push edi
push esi
add esp, 4
call fcn.00407e0a
add byte [esi], dh
dec esp
xor eax, 0x4544333d
add esp, 4
add edi, 0xf114
pop edi
push edx
and edx, 0xa917
pop edx
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x407e39
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x1684], edx
jmp 0x407e93
movzx ecx, word [ebp - 0x224]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x407d61
movzx eax, word [ebp - 0x224]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x407d61
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x407e7d
mov dword [ebp - 0x1680], 0xffffffff
jmp 0x407e87
mov dword [ebp - 0x1680], 1
mov ecx, dword [ebp - 0x1680]
mov dword [ebp - 0x1684], ecx
cmp dword [ebp - 0x1684], 0
jne 0x407edc
push edi
or edi, 0xeefb
pop edi
push edx
push ecx
add esp, 4
jmp 0x407eaf
call 0x407ebe
add byte [eax + 0x49], cl
xor ecx, dword [ebp + 0x3c]
inc edi
dec esp
inc esi
dec ebp
add esp, 4
sub edx, 0x6c70
and edx, 0xd573
pop edx
mov edx, dword [ebp - 0x51c]
mov dword [ebp - 0x2fc], edx
jmp 0x407f44
push esi
xor esi, 0x155a9
pop esi
push esi
push eax
add esp, 4
xor esi, 0x5161
pop esi
push edi
push eax
add esp, 4
xor edi, 0x47c9
xor edi, 0x244f
xor edi, 0x4ed9
xor edi, 0xb469
pop edi
mov eax, dword [ebp - 0x51c]
mov ecx, dword [eax]
mov dword [ebp - 0x51c], ecx
mov edx, dword [ebp - 0x51c]
cmp edx, dword [ebp - 0xce0]
je 0x407f3a
mov eax, dword [ebp - 0x51c]
cmp dword [eax + 0x30], 0
jne 0x407d05
mov dword [ebp - 0x2fc], 0