joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406688
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add al, 0x81
test byte [edi + 0x23], 0
add byte [esi + 0x57], bl
sub edi, 0x14c7e
xor edi, 0x17c5c
or edi, 0xc872
add edi, 0x15ed7
pop edi
cmp dword [ebp - 0x1564], 0
jne 0x4066c2
mov dword [ebp - 0x2bc], 0
jmp 0x40697e
mov eax, dword [ebp - 0x1564]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xc4c], edx
push edi
or edi, 0xa81e
pop edi
push ebx
call 0x4066ea
add byte [edx], bh
inc eax
cmp eax, 0x3937393b
add esp, 4
add ebx, 0x154de
pop ebx
push eax
push edx
add esp, 4
and eax, 0x50b8
jmp 0x406705
pop eax
cmp dword [ebp - 0xc4c], 0
jne 0x40671e
mov dword [ebp - 0x2bc], 0
jmp 0x40697e
mov eax, dword [ebp - 0xc4c]
mov dword [ebp - 0x4d8], eax
push esi
push ebx
add esp, 4
jmp 0x406988
xor esi, 0x4ef2
call 0x40699b
add byte [0x41324843], dh
dec ecx
add esp, 4
jmp 0x4069a7
pop esi
push edx
jmp 0x4069af
pop edx
cmp dword [ebp - 0x2bc], 0
jne 0x4072b4
mov edx, 0x6b
mov word [ebp - 0x16ac], dx
mov eax, 0x65
invalid
invalid
test dword [esi - 0x17], edx
invalid

Function at 0x4066ea
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add al, 0x81
test byte [edi + 0x23], 0
add byte [esi + 0x57], bl
sub edi, 0x14c7e
xor edi, 0x17c5c
or edi, 0xc872
add edi, 0x15ed7
pop edi
cmp dword [ebp - 0x1564], 0
jne 0x4066c2
mov dword [ebp - 0x2bc], 0
jmp 0x40697e
mov eax, dword [ebp - 0x1564]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xc4c], edx
push edi
or edi, 0xa81e
pop edi
push ebx
call 0x4066ea
add byte [edx], bh
inc eax
cmp eax, 0x3937393b
add esp, 4
add ebx, 0x154de
pop ebx
push eax
push edx
add esp, 4
and eax, 0x50b8
jmp 0x406705
pop eax
cmp dword [ebp - 0xc4c], 0
jne 0x40671e
mov dword [ebp - 0x2bc], 0
jmp 0x40697e
mov eax, dword [ebp - 0xc4c]
mov dword [ebp - 0x4d8], eax
push esi
push ebx
add esp, 4
jmp 0x406988
xor esi, 0x4ef2
call 0x40699b
add byte [0x41324843], dh
dec ecx
add esp, 4
jmp 0x4069a7
pop esi
push edx
jmp 0x4069af
pop edx
cmp dword [ebp - 0x2bc], 0
jne 0x4072b4
mov edx, 0x6b
mov word [ebp - 0x16ac], dx
mov eax, 0x65
invalid
invalid
test dword [esi - 0x17], edx
invalid
Function at 0x40673d
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push eax
push eax
add esp, 4
call 0x40673d
add byte [ecx], bh
cmp edi, dword [eax]
dec edi
inc esi
dec edi
inc edx
add esp, 4
add eax, 0x133aa
pop eax
push edx
push edx
add esp, 4
call 0x406758
add byte [ecx], bh
inc ebx
cmp byte ss:[eax], bh
inc edx
add esp, 4
pop edx
lea ecx, [ebp - 0x1670]
mov dword [ebp - 0xc48], ecx
mov edx, dword [ebp - 0x4d8]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xc44], eax
xor ecx, ecx
mov word [ebp - 0x1c4], cx
xor edx, edx
mov word [ebp - 0x110], dx
push ecx
and ecx, 0x11fc8
xor ecx, 0xe35d
pop ecx
push edx
push eax
add esp, 4
add edx, 0x171e6
call 0x4067b1
add byte [eax + 0x48], dl
cmp byte ss:[eax + 0x37], dl
inc ecx
dec edi
xor eax, 0x8104c483
add eax, 0x5a00013d
mov eax, dword [ebp - 0xc44]
mov cx, word [eax]
mov word [ebp - 0xfe6], cx
mov edx, dword [ebp - 0xc44]
add edx, 2
mov dword [ebp - 0xc44], edx
mov ax, word [ebp - 0xfe6]
mov word [ebp - 0x1c4], ax
mov ecx, dword [ebp - 0xc48]
mov dx, word [ecx]
mov word [ebp - 0xfe8], dx
mov eax, dword [ebp - 0xc48]
add eax, 2
mov dword [ebp - 0xc48], eax
mov cx, word [ebp - 0xfe8]
mov word [ebp - 0x110], cx
push edx
push edx
add esp, 4
add edx, 0x1420b
add edx, 0x831a
or edx, 0xfbc7
xor edx, 0x14ac9
pop edx
push ecx
and ecx, 0xe782
jmp 0x406840
and ecx, 0x6c5b
pop ecx
movzx edx, word [ebp - 0x110]
test edx, edx
jne 0x40686a
movzx eax, word [ebp - 0x1c4]
movzx ecx, word [ebp - 0x110]
sub eax, ecx
mov dword [ebp - 0x156c], eax
jmp 0x4068cd
movzx edx, word [ebp - 0x1c4]
movzx eax, word [ebp - 0x110]
cmp edx, eax
je 0x406789
movzx ecx, word [ebp - 0x1c4]
xor ecx, 0x20
movzx edx, word [ebp - 0x110]
cmp ecx, edx
je 0x406789
movzx eax, word [ebp - 0x1c4]
movzx ecx, word [ebp - 0x110]
cmp eax, ecx
jge 0x4068b7
mov dword [ebp - 0x1568], 0xffffffff
jmp 0x4068c1
mov dword [ebp - 0x1568], 1
mov edx, dword [ebp - 0x1568]
mov dword [ebp - 0x156c], edx
cmp dword [ebp - 0x156c], 0
jne 0x406916
push edi
push ebx
add esp, 4
and edi, 0x7e7f
pop edi
push esi
push ebx
add esp, 4
jmp 0x4068ec
add esi, 0x8406
jmp 0x4068f9
add esi, 0xdb7d
pop esi
push esi
and esi, 0x38dd
pop esi
invalid
test dword [eax], ebp
sti
Function at 0x406758
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push eax
push eax
add esp, 4
call 0x40673d
add byte [ecx], bh
cmp edi, dword [eax]
dec edi
inc esi
dec edi
inc edx
add esp, 4
add eax, 0x133aa
pop eax
push edx
push edx
add esp, 4
call 0x406758
add byte [ecx], bh
inc ebx
cmp byte ss:[eax], bh
inc edx
add esp, 4
pop edx
lea ecx, [ebp - 0x1670]
mov dword [ebp - 0xc48], ecx
mov edx, dword [ebp - 0x4d8]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xc44], eax
xor ecx, ecx
mov word [ebp - 0x1c4], cx
xor edx, edx
mov word [ebp - 0x110], dx
push ecx
and ecx, 0x11fc8
xor ecx, 0xe35d
pop ecx
push edx
push eax
add esp, 4
add edx, 0x171e6
call 0x4067b1
add byte [eax + 0x48], dl
cmp byte ss:[eax + 0x37], dl
inc ecx
dec edi
xor eax, 0x8104c483
add eax, 0x5a00013d
mov eax, dword [ebp - 0xc44]
mov cx, word [eax]
mov word [ebp - 0xfe6], cx
mov edx, dword [ebp - 0xc44]
add edx, 2
mov dword [ebp - 0xc44], edx
mov ax, word [ebp - 0xfe6]
mov word [ebp - 0x1c4], ax
mov ecx, dword [ebp - 0xc48]
mov dx, word [ecx]
mov word [ebp - 0xfe8], dx
mov eax, dword [ebp - 0xc48]
add eax, 2
mov dword [ebp - 0xc48], eax
mov cx, word [ebp - 0xfe8]
mov word [ebp - 0x110], cx
push edx
push edx
add esp, 4
add edx, 0x1420b
add edx, 0x831a
or edx, 0xfbc7
xor edx, 0x14ac9
pop edx
push ecx
and ecx, 0xe782
jmp 0x406840
and ecx, 0x6c5b
pop ecx
movzx edx, word [ebp - 0x110]
test edx, edx
jne 0x40686a
movzx eax, word [ebp - 0x1c4]
movzx ecx, word [ebp - 0x110]
sub eax, ecx
mov dword [ebp - 0x156c], eax
jmp 0x4068cd
movzx edx, word [ebp - 0x1c4]
movzx eax, word [ebp - 0x110]
cmp edx, eax
je 0x406789
movzx ecx, word [ebp - 0x1c4]
xor ecx, 0x20
movzx edx, word [ebp - 0x110]
cmp ecx, edx
je 0x406789
movzx eax, word [ebp - 0x1c4]
movzx ecx, word [ebp - 0x110]
cmp eax, ecx
jge 0x4068b7
mov dword [ebp - 0x1568], 0xffffffff
jmp 0x4068c1
mov dword [ebp - 0x1568], 1
mov edx, dword [ebp - 0x1568]
mov dword [ebp - 0x156c], edx
cmp dword [ebp - 0x156c], 0
jne 0x406916
push edi
push ebx
add esp, 4
and edi, 0x7e7f
pop edi
push esi
push ebx
add esp, 4
jmp 0x4068ec
add esi, 0x8406
jmp 0x4068f9
add esi, 0xdb7d
pop esi
push esi
and esi, 0x38dd
pop esi
invalid
test dword [eax], ebp
sti
Function at 0x4067b1
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push eax
push eax
add esp, 4
call 0x40673d
add byte [ecx], bh
cmp edi, dword [eax]
dec edi
inc esi
dec edi
inc edx
add esp, 4
add eax, 0x133aa
pop eax
push edx
push edx
add esp, 4
call 0x406758
add byte [ecx], bh
inc ebx
cmp byte ss:[eax], bh
inc edx
add esp, 4
pop edx
lea ecx, [ebp - 0x1670]
mov dword [ebp - 0xc48], ecx
mov edx, dword [ebp - 0x4d8]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xc44], eax
xor ecx, ecx
mov word [ebp - 0x1c4], cx
xor edx, edx
mov word [ebp - 0x110], dx
push ecx
and ecx, 0x11fc8
xor ecx, 0xe35d
pop ecx
push edx
push eax
add esp, 4
add edx, 0x171e6
call 0x4067b1
add byte [eax + 0x48], dl
cmp byte ss:[eax + 0x37], dl
inc ecx
dec edi
xor eax, 0x8104c483
add eax, 0x5a00013d
mov eax, dword [ebp - 0xc44]
mov cx, word [eax]
mov word [ebp - 0xfe6], cx
mov edx, dword [ebp - 0xc44]
add edx, 2
mov dword [ebp - 0xc44], edx
mov ax, word [ebp - 0xfe6]
mov word [ebp - 0x1c4], ax
mov ecx, dword [ebp - 0xc48]
mov dx, word [ecx]
mov word [ebp - 0xfe8], dx
mov eax, dword [ebp - 0xc48]
add eax, 2
mov dword [ebp - 0xc48], eax
mov cx, word [ebp - 0xfe8]
mov word [ebp - 0x110], cx
push edx
push edx
add esp, 4
add edx, 0x1420b
add edx, 0x831a
or edx, 0xfbc7
xor edx, 0x14ac9
pop edx
push ecx
and ecx, 0xe782
jmp 0x406840
and ecx, 0x6c5b
pop ecx
movzx edx, word [ebp - 0x110]
test edx, edx
jne 0x40686a
movzx eax, word [ebp - 0x1c4]
movzx ecx, word [ebp - 0x110]
sub eax, ecx
mov dword [ebp - 0x156c], eax
jmp 0x4068cd
movzx edx, word [ebp - 0x1c4]
movzx eax, word [ebp - 0x110]
cmp edx, eax
je 0x406789
movzx ecx, word [ebp - 0x1c4]
xor ecx, 0x20
movzx edx, word [ebp - 0x110]
cmp ecx, edx
je 0x406789
movzx eax, word [ebp - 0x1c4]
movzx ecx, word [ebp - 0x110]
cmp eax, ecx
jge 0x4068b7
mov dword [ebp - 0x1568], 0xffffffff
jmp 0x4068c1
mov dword [ebp - 0x1568], 1
mov edx, dword [ebp - 0x1568]
mov dword [ebp - 0x156c], edx
cmp dword [ebp - 0x156c], 0
jne 0x406916
push edi
push ebx
add esp, 4
and edi, 0x7e7f
pop edi
push esi
push ebx
add esp, 4
jmp 0x4068ec
add esi, 0x8406
jmp 0x4068f9
add esi, 0xdb7d
pop esi
push esi
and esi, 0x38dd
pop esi
invalid
test dword [eax], ebp
sti
Function at 0x406868
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push eax
push eax
add esp, 4
call 0x40673d
add byte [ecx], bh
cmp edi, dword [eax]
dec edi
inc esi
dec edi
inc edx
add esp, 4
add eax, 0x133aa
pop eax
push edx
push edx
add esp, 4
call 0x406758
add byte [ecx], bh
inc ebx
cmp byte ss:[eax], bh
inc edx
add esp, 4
pop edx
lea ecx, [ebp - 0x1670]
mov dword [ebp - 0xc48], ecx
mov edx, dword [ebp - 0x4d8]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xc44], eax
xor ecx, ecx
mov word [ebp - 0x1c4], cx
xor edx, edx
mov word [ebp - 0x110], dx
push ecx
and ecx, 0x11fc8
xor ecx, 0xe35d
pop ecx
push edx
push eax
add esp, 4
add edx, 0x171e6
call 0x4067b1
add byte [eax + 0x48], dl
cmp byte ss:[eax + 0x37], dl
inc ecx
dec edi
xor eax, 0x8104c483
add eax, 0x5a00013d
mov eax, dword [ebp - 0xc44]
mov cx, word [eax]
mov word [ebp - 0xfe6], cx
mov edx, dword [ebp - 0xc44]
add edx, 2
mov dword [ebp - 0xc44], edx
mov ax, word [ebp - 0xfe6]
mov word [ebp - 0x1c4], ax
mov ecx, dword [ebp - 0xc48]
mov dx, word [ecx]
mov word [ebp - 0xfe8], dx
mov eax, dword [ebp - 0xc48]
add eax, 2
mov dword [ebp - 0xc48], eax
mov cx, word [ebp - 0xfe8]
mov word [ebp - 0x110], cx
push edx
push edx
add esp, 4
add edx, 0x1420b
add edx, 0x831a
or edx, 0xfbc7
xor edx, 0x14ac9
pop edx
push ecx
and ecx, 0xe782
jmp 0x406840
and ecx, 0x6c5b
pop ecx
movzx edx, word [ebp - 0x110]
test edx, edx
jne 0x40686a
movzx eax, word [ebp - 0x1c4]
movzx ecx, word [ebp - 0x110]
sub eax, ecx
mov dword [ebp - 0x156c], eax
jmp 0x4068cd
movzx edx, word [ebp - 0x1c4]
movzx eax, word [ebp - 0x110]
cmp edx, eax
je 0x406789
movzx ecx, word [ebp - 0x1c4]
xor ecx, 0x20
movzx edx, word [ebp - 0x110]
cmp ecx, edx
je 0x406789
movzx eax, word [ebp - 0x1c4]
movzx ecx, word [ebp - 0x110]
cmp eax, ecx
jge 0x4068b7
mov dword [ebp - 0x1568], 0xffffffff
jmp 0x4068c1
mov dword [ebp - 0x1568], 1
mov edx, dword [ebp - 0x1568]
mov dword [ebp - 0x156c], edx
cmp dword [ebp - 0x156c], 0
jne 0x406916
push edi
push ebx
add esp, 4
and edi, 0x7e7f
pop edi
push esi
push ebx
add esp, 4
jmp 0x4068ec
add esi, 0x8406
jmp 0x4068f9
add esi, 0xdb7d
pop esi
push esi
and esi, 0x38dd
pop esi
invalid
test dword [eax], ebp
sti
Function at 0x40699b
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add al, 0x81
test byte [edi + 0x23], 0
add byte [esi + 0x57], bl
sub edi, 0x14c7e
xor edi, 0x17c5c
or edi, 0xc872
add edi, 0x15ed7
pop edi
cmp dword [ebp - 0x1564], 0
jne 0x4066c2
mov dword [ebp - 0x2bc], 0
jmp 0x40697e
mov eax, dword [ebp - 0x1564]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xc4c], edx
push edi
or edi, 0xa81e
pop edi
push ebx
call 0x4066ea
add byte [edx], bh
inc eax
cmp eax, 0x3937393b
add esp, 4
add ebx, 0x154de
pop ebx
push eax
push edx
add esp, 4
and eax, 0x50b8
jmp 0x406705
pop eax
cmp dword [ebp - 0xc4c], 0
jne 0x40671e
mov dword [ebp - 0x2bc], 0
jmp 0x40697e
mov eax, dword [ebp - 0xc4c]
mov dword [ebp - 0x4d8], eax
push esi
push ebx
add esp, 4
jmp 0x406988
xor esi, 0x4ef2
call 0x40699b
add byte [0x41324843], dh
dec ecx
add esp, 4
jmp 0x4069a7
pop esi
push edx
jmp 0x4069af
pop edx
cmp dword [ebp - 0x2bc], 0
jne 0x4072b4
mov edx, 0x6b
mov word [ebp - 0x16ac], dx
mov eax, 0x65
invalid
invalid
test dword [esi - 0x17], edx
invalid

Function at 0x406b38
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ebx
cmp dword [ebp - 0x1570], 0
jne 0x406b54
mov dword [ebp - 0x73c], 0
jmp 0x406dfb
mov ecx, dword [ebp - 0x1570]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xc58], eax
push edi
or edi, 0x14b46
or edi, 0xe8f4
xor edi, 0x7621
sub edi, 0x5d2e
pop edi
push ebx
push ebx
add esp, 4
add ebx, 0x168dc
sub ebx, 0x10aba
and ebx, 0x1505
pop ebx
cmp dword [ebp - 0xc58], 0
jne 0x406bb0
mov dword [ebp - 0x73c], 0
jmp 0x406dfb
mov ecx, dword [ebp - 0xc58]
mov dword [ebp - 0x4dc], ecx

Function at 0x406c24
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
or ecx, 0xebf2
or ecx, 0x11c57
xor ecx, 0x10bb
pop ecx
push edi
push esi
add esp, 4
sub edi, 0x17ddd
or edi, 0x1090
pop edi
mov ecx, dword [ebp - 0xc50]
Function at 0x406c50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edx
xor edx, 0xbf94
and edx, 0xacdf
and edx, 0x11930
and edx, 0x14306
pop edx
push ebx
push edx
add esp, 4
sub ebx, 0x9ad2
add ebx, 0x8946
add ebx, 0x3c6e
pop ebx
lea edx, [ebp - 0x16ac]
mov dword [ebp - 0xc54], edx
mov eax, dword [ebp - 0x4dc]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc50], ecx
xor edx, edx
mov word [ebp - 0x1c8], dx
xor eax, eax
mov word [ebp - 0x2c], ax
push esi
push ecx
add esp, 4
sub esi, 0x464a
pop esi
mov dx, word [ecx]
mov word [ebp - 0xfea], dx
mov eax, dword [ebp - 0xc50]
add eax, 2
mov dword [ebp - 0xc50], eax
mov cx, word [ebp - 0xfea]
mov word [ebp - 0x1c8], cx
mov edx, dword [ebp - 0xc54]
mov ax, word [edx]
mov word [ebp - 0xfec], ax
mov ecx, dword [ebp - 0xc54]
add ecx, 2
mov dword [ebp - 0xc54], ecx
mov dx, word [ebp - 0xfec]
mov word [ebp - 0x2c], dx
push ecx
push eax
add esp, 4
add ecx, 0x1514b
add ecx, 0x17a21
jmp 0x406cba
pop ecx
push ecx
push ecx
add esp, 4
or ecx, 0x655f
sub ecx, 0x141de
sub ecx, 0x8adc
pop ecx
movzx eax, word [ebp - 0x2c]
test eax, eax
jne 0x406cf0
movzx ecx, word [ebp - 0x1c8]
movzx edx, word [ebp - 0x2c]
sub ecx, edx
mov dword [ebp - 0x1578], ecx
jmp 0x406d4a
movzx eax, word [ebp - 0x1c8]
movzx ecx, word [ebp - 0x2c]
cmp eax, ecx
je 0x406c18
movzx edx, word [ebp - 0x1c8]
xor edx, 0x20
movzx eax, word [ebp - 0x2c]
cmp edx, eax
je 0x406c18
movzx ecx, word [ebp - 0x1c8]
movzx edx, word [ebp - 0x2c]
cmp ecx, edx
jge 0x406d34
mov dword [ebp - 0x1574], 0xffffffff
jmp 0x406d3e
mov dword [ebp - 0x1574], 1
mov eax, dword [ebp - 0x1574]
mov dword [ebp - 0x1578], eax
cmp dword [ebp - 0x1578], 0
jne 0x406d93
push edx
add edx, 0x15ed5
jmp 0x406d60
pop edx
push esi
push edx
add esp, 4
call 0x406d76
add byte [ecx + eax*2], dh
xor ecx, dword [edi + 0x3d]
cmp eax, 0x323e4a4e
add esp, 4
pop esi
push ecx
jmp 0x406d84
pop ecx
mov ecx, dword [ebp - 0x4dc]
mov dword [ebp - 0x73c], ecx
jmp 0x406dfb
push edi
push ebx
add esp, 4
jmp 0x406da1
add edi, 0x28ca
pop edi
push esi
xor esi, 0xabbe
call 0x406dbb
add byte [esi], dh
dec ebx
aas
xor eax, 0xc483394d
add al, 0x81
out dx, al
pop esi
sgdt [eax]
pop esi
mov edx, dword [ebp - 0x4dc]
mov eax, dword [edx]
mov dword [ebp - 0x4dc], eax
mov ecx, dword [ebp - 0x4dc]
cmp ecx, dword [ebp - 0xc58]
je 0x406df1
mov edx, dword [ebp - 0x4dc]
cmp dword [edx + 0x30], 0
jne 0x406bbc
mov dword [ebp - 0x73c], 0
push edx
or edx, 0xe8c2
call 0x406e0f
add byte [ecx], bh
cmp byte [ecx + 0x43], cl
dec edx
inc edi
xor eax, 0x8104c483
retf 0xa4a6
Function at 0x406d76
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edx
xor edx, 0xbf94
and edx, 0xacdf
and edx, 0x11930
and edx, 0x14306
pop edx
push ebx
push edx
add esp, 4
sub ebx, 0x9ad2
add ebx, 0x8946
add ebx, 0x3c6e
pop ebx
lea edx, [ebp - 0x16ac]
mov dword [ebp - 0xc54], edx
mov eax, dword [ebp - 0x4dc]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc50], ecx
xor edx, edx
mov word [ebp - 0x1c8], dx
xor eax, eax
mov word [ebp - 0x2c], ax
push esi
push ecx
add esp, 4
sub esi, 0x464a
pop esi
mov dx, word [ecx]
mov word [ebp - 0xfea], dx
mov eax, dword [ebp - 0xc50]
add eax, 2
mov dword [ebp - 0xc50], eax
mov cx, word [ebp - 0xfea]
mov word [ebp - 0x1c8], cx
mov edx, dword [ebp - 0xc54]
mov ax, word [edx]
mov word [ebp - 0xfec], ax
mov ecx, dword [ebp - 0xc54]
add ecx, 2
mov dword [ebp - 0xc54], ecx
mov dx, word [ebp - 0xfec]
mov word [ebp - 0x2c], dx
push ecx
push eax
add esp, 4
add ecx, 0x1514b
add ecx, 0x17a21
jmp 0x406cba
pop ecx
push ecx
push ecx
add esp, 4
or ecx, 0x655f
sub ecx, 0x141de
sub ecx, 0x8adc
pop ecx
movzx eax, word [ebp - 0x2c]
test eax, eax
jne 0x406cf0
movzx ecx, word [ebp - 0x1c8]
movzx edx, word [ebp - 0x2c]
sub ecx, edx
mov dword [ebp - 0x1578], ecx
jmp 0x406d4a
movzx eax, word [ebp - 0x1c8]
movzx ecx, word [ebp - 0x2c]
cmp eax, ecx
je 0x406c18
movzx edx, word [ebp - 0x1c8]
xor edx, 0x20
movzx eax, word [ebp - 0x2c]
cmp edx, eax
je 0x406c18
movzx ecx, word [ebp - 0x1c8]
movzx edx, word [ebp - 0x2c]
cmp ecx, edx
jge 0x406d34
mov dword [ebp - 0x1574], 0xffffffff
jmp 0x406d3e
mov dword [ebp - 0x1574], 1
mov eax, dword [ebp - 0x1574]
mov dword [ebp - 0x1578], eax
cmp dword [ebp - 0x1578], 0
jne 0x406d93
push edx
add edx, 0x15ed5
jmp 0x406d60
pop edx
push esi
push edx
add esp, 4
call 0x406d76
add byte [ecx + eax*2], dh
xor ecx, dword [edi + 0x3d]
cmp eax, 0x323e4a4e
add esp, 4
pop esi
push ecx
jmp 0x406d84
pop ecx
mov ecx, dword [ebp - 0x4dc]
mov dword [ebp - 0x73c], ecx
jmp 0x406dfb
push edi
push ebx
add esp, 4
jmp 0x406da1
add edi, 0x28ca
pop edi
push esi
xor esi, 0xabbe
call 0x406dbb
add byte [esi], dh
dec ebx
aas
xor eax, 0xc483394d
add al, 0x81
out dx, al
pop esi
sgdt [eax]
pop esi
mov edx, dword [ebp - 0x4dc]
mov eax, dword [edx]
mov dword [ebp - 0x4dc], eax
mov ecx, dword [ebp - 0x4dc]
cmp ecx, dword [ebp - 0xc58]
je 0x406df1
mov edx, dword [ebp - 0x4dc]
cmp dword [edx + 0x30], 0
jne 0x406bbc
mov dword [ebp - 0x73c], 0
push edx
or edx, 0xe8c2
call 0x406e0f
add byte [ecx], bh
cmp byte [ecx + 0x43], cl
dec edx
inc edi
xor eax, 0x8104c483
retf 0xa4a6
Function at 0x406dbb
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edx
xor edx, 0xbf94
and edx, 0xacdf
and edx, 0x11930
and edx, 0x14306
pop edx
push ebx
push edx
add esp, 4
sub ebx, 0x9ad2
add ebx, 0x8946
add ebx, 0x3c6e
pop ebx
lea edx, [ebp - 0x16ac]
mov dword [ebp - 0xc54], edx
mov eax, dword [ebp - 0x4dc]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc50], ecx
xor edx, edx
mov word [ebp - 0x1c8], dx
xor eax, eax
mov word [ebp - 0x2c], ax
push esi
push ecx
add esp, 4
sub esi, 0x464a
pop esi
mov dx, word [ecx]
mov word [ebp - 0xfea], dx
mov eax, dword [ebp - 0xc50]
add eax, 2
mov dword [ebp - 0xc50], eax
mov cx, word [ebp - 0xfea]
mov word [ebp - 0x1c8], cx
mov edx, dword [ebp - 0xc54]
mov ax, word [edx]
mov word [ebp - 0xfec], ax
mov ecx, dword [ebp - 0xc54]
add ecx, 2
mov dword [ebp - 0xc54], ecx
mov dx, word [ebp - 0xfec]
mov word [ebp - 0x2c], dx
push ecx
push eax
add esp, 4
add ecx, 0x1514b
add ecx, 0x17a21
jmp 0x406cba
pop ecx
push ecx
push ecx
add esp, 4
or ecx, 0x655f
sub ecx, 0x141de
sub ecx, 0x8adc
pop ecx
movzx eax, word [ebp - 0x2c]
test eax, eax
jne 0x406cf0
movzx ecx, word [ebp - 0x1c8]
movzx edx, word [ebp - 0x2c]
sub ecx, edx
mov dword [ebp - 0x1578], ecx
jmp 0x406d4a
movzx eax, word [ebp - 0x1c8]
movzx ecx, word [ebp - 0x2c]
cmp eax, ecx
je 0x406c18
movzx edx, word [ebp - 0x1c8]
xor edx, 0x20
movzx eax, word [ebp - 0x2c]
cmp edx, eax
je 0x406c18
movzx ecx, word [ebp - 0x1c8]
movzx edx, word [ebp - 0x2c]
cmp ecx, edx
jge 0x406d34
mov dword [ebp - 0x1574], 0xffffffff
jmp 0x406d3e
mov dword [ebp - 0x1574], 1
mov eax, dword [ebp - 0x1574]
mov dword [ebp - 0x1578], eax
cmp dword [ebp - 0x1578], 0
jne 0x406d93
push edx
add edx, 0x15ed5
jmp 0x406d60
pop edx
push esi
push edx
add esp, 4
call 0x406d76
add byte [ecx + eax*2], dh
xor ecx, dword [edi + 0x3d]
cmp eax, 0x323e4a4e
add esp, 4
pop esi
push ecx
jmp 0x406d84
pop ecx
mov ecx, dword [ebp - 0x4dc]
mov dword [ebp - 0x73c], ecx
jmp 0x406dfb
push edi
push ebx
add esp, 4
jmp 0x406da1
add edi, 0x28ca
pop edi
push esi
xor esi, 0xabbe
call 0x406dbb
add byte [esi], dh
dec ebx
aas
xor eax, 0xc483394d
add al, 0x81
out dx, al
pop esi
sgdt [eax]
pop esi
mov edx, dword [ebp - 0x4dc]
mov eax, dword [edx]
mov dword [ebp - 0x4dc], eax
mov ecx, dword [ebp - 0x4dc]
cmp ecx, dword [ebp - 0xc58]
je 0x406df1
mov edx, dword [ebp - 0x4dc]
cmp dword [edx + 0x30], 0
jne 0x406bbc
mov dword [ebp - 0x73c], 0
push edx
or edx, 0xe8c2
call 0x406e0f
add byte [ecx], bh
cmp byte [ecx + 0x43], cl
dec edx
inc edi
xor eax, 0x8104c483
retf 0xa4a6
Function at 0x406e0f
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edx
xor edx, 0xbf94
and edx, 0xacdf
and edx, 0x11930
and edx, 0x14306
pop edx
push ebx
push edx
add esp, 4
sub ebx, 0x9ad2
add ebx, 0x8946
add ebx, 0x3c6e
pop ebx
lea edx, [ebp - 0x16ac]
mov dword [ebp - 0xc54], edx
mov eax, dword [ebp - 0x4dc]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc50], ecx
xor edx, edx
mov word [ebp - 0x1c8], dx
xor eax, eax
mov word [ebp - 0x2c], ax
push esi
push ecx
add esp, 4
sub esi, 0x464a
pop esi
mov dx, word [ecx]
mov word [ebp - 0xfea], dx
mov eax, dword [ebp - 0xc50]
add eax, 2
mov dword [ebp - 0xc50], eax
mov cx, word [ebp - 0xfea]
mov word [ebp - 0x1c8], cx
mov edx, dword [ebp - 0xc54]
mov ax, word [edx]
mov word [ebp - 0xfec], ax
mov ecx, dword [ebp - 0xc54]
add ecx, 2
mov dword [ebp - 0xc54], ecx
mov dx, word [ebp - 0xfec]
mov word [ebp - 0x2c], dx
push ecx
push eax
add esp, 4
add ecx, 0x1514b
add ecx, 0x17a21
jmp 0x406cba
pop ecx
push ecx
push ecx
add esp, 4
or ecx, 0x655f
sub ecx, 0x141de
sub ecx, 0x8adc
pop ecx
movzx eax, word [ebp - 0x2c]
test eax, eax
jne 0x406cf0
movzx ecx, word [ebp - 0x1c8]
movzx edx, word [ebp - 0x2c]
sub ecx, edx
mov dword [ebp - 0x1578], ecx
jmp 0x406d4a
movzx eax, word [ebp - 0x1c8]
movzx ecx, word [ebp - 0x2c]
cmp eax, ecx
je 0x406c18
movzx edx, word [ebp - 0x1c8]
xor edx, 0x20
movzx eax, word [ebp - 0x2c]
cmp edx, eax
je 0x406c18
movzx ecx, word [ebp - 0x1c8]
movzx edx, word [ebp - 0x2c]
cmp ecx, edx
jge 0x406d34
mov dword [ebp - 0x1574], 0xffffffff
jmp 0x406d3e
mov dword [ebp - 0x1574], 1
mov eax, dword [ebp - 0x1574]
mov dword [ebp - 0x1578], eax
cmp dword [ebp - 0x1578], 0
jne 0x406d93
push edx
add edx, 0x15ed5
jmp 0x406d60
pop edx
push esi
push edx
add esp, 4
call 0x406d76
add byte [ecx + eax*2], dh
xor ecx, dword [edi + 0x3d]
cmp eax, 0x323e4a4e
add esp, 4
pop esi
push ecx
jmp 0x406d84
pop ecx
mov ecx, dword [ebp - 0x4dc]
mov dword [ebp - 0x73c], ecx
jmp 0x406dfb
push edi
push ebx
add esp, 4
jmp 0x406da1
add edi, 0x28ca
pop edi
push esi
xor esi, 0xabbe
call 0x406dbb
add byte [esi], dh
dec ebx
aas
xor eax, 0xc483394d
add al, 0x81
out dx, al
pop esi
sgdt [eax]
pop esi
mov edx, dword [ebp - 0x4dc]
mov eax, dword [edx]
mov dword [ebp - 0x4dc], eax
mov ecx, dword [ebp - 0x4dc]
cmp ecx, dword [ebp - 0xc58]
je 0x406df1
mov edx, dword [ebp - 0x4dc]
cmp dword [edx + 0x30], 0
jne 0x406bbc
mov dword [ebp - 0x73c], 0
push edx
or edx, 0xe8c2
call 0x406e0f
add byte [ecx], bh
cmp byte [ecx + 0x43], cl
dec edx
inc edi
xor eax, 0x8104c483
retf 0xa4a6