joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405abf
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edx
push eax
add esp, 4
and edx, 0x10e62
sub edx, 0xeebb
add edx, 0x3664
add edx, 0x13fd3
pop edx
push edi
push eax
add esp, 4
jmp 0x405a5b
jmp 0x405a63
pop edi
lea edx, [ebp - 0x1774]
mov dword [ebp - 0xca0], edx
mov eax, dword [ebp - 0x508]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc9c], ecx
xor edx, edx
mov word [ebp - 0x214], dx
xor eax, eax
mov word [ebp - 0x110], ax
push eax
jmp 0x405a99
sub eax, 0xf85d
pop eax
push ebx
push edx
add esp, 4
jmp 0x405aaa
jmp 0x405ab1
call 0x405abf
add byte [edi + 0x35], cl
dec ebp
dec ebp
xor dh, byte ss:[edx]
push eax
add esp, 4
pop ebx
mov ecx, dword [ebp - 0xc9c]
mov dx, word [ecx]
mov word [ebp - 0x1036], dx
mov eax, dword [ebp - 0xc9c]
add eax, 2
mov dword [ebp - 0xc9c], eax
mov cx, word [ebp - 0x1036]
mov word [ebp - 0x214], cx
mov edx, dword [ebp - 0xca0]
mov ax, word [edx]
mov word [ebp - 0x1038], ax
mov ecx, dword [ebp - 0xca0]
add ecx, 2
mov dword [ebp - 0xca0], ecx
mov dx, word [ebp - 0x1038]
mov word [ebp - 0x110], dx
push esi
push ecx
add esp, 4
call 0x405b32
add byte [ebp + esi + 0x4c], cl
inc eax
xor al, 0x36
dec esp
inc ebx
cmp byte [ebx + 0x575e04c4], al
push esi
add esp, 4
and edi, 0x11946
jmp 0x405b48
sub edi, 0xe07a
pop edi
movzx eax, word [ebp - 0x110]
test eax, eax
jne 0x405b72
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
sub ecx, edx
mov dword [ebp - 0x15ec], ecx
jmp 0x405bd5
movzx eax, word [ebp - 0x214]
movzx ecx, word [ebp - 0x110]
cmp eax, ecx
je 0x405a91
movzx edx, word [ebp - 0x214]
xor edx, 0x20
movzx eax, word [ebp - 0x110]
cmp edx, eax
je 0x405a91
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
cmp ecx, edx
jge 0x405bbf
mov dword [ebp - 0x15e8], 0xffffffff
jmp 0x405bc9
mov dword [ebp - 0x15e8], 1
add byte [ebx - 0x15e77b], cl
dec dword [ecx - 0x15eb7b]
inc dword [ebx - 0x15eb43]
inc dword [eax]
mov eax, dword [ebp - 0x15e8]
mov dword [ebp - 0x15ec], eax
cmp dword [ebp - 0x15ec], 0
jne 0x405c1e
push edi
push esi
add esp, 4
and edi, 0x14552
pop edi
push esi
or esi, 0x9f78
pop esi
push edi
push ebx
add esp, 4
add edi, 0x8df4
sub edi, 0x415d
or edi, 0x7877
and edi, 0x9263
pop edi
mov ecx, dword [ebp - 0x508]
mov dword [ebp - 0x750], ecx
jmp 0x405c86
push ebx
push edx
add esp, 4
and ebx, 0x3d48
sub ebx, 0x2dbb
xor ebx, 0x1bf3
xor ebx, 0x1391f
pop ebx
push ebx
add ebx, 0xeee0
or ebx, 0x8759
add ebx, 0x90a2
pop ebx
mov edx, dword [ebp - 0x508]
mov eax, dword [edx]
mov dword [ebp - 0x508], eax
mov ecx, dword [ebp - 0x508]
cmp ecx, dword [ebp - 0xca4]
je 0x405c7c
mov edx, dword [ebp - 0x508]
cmp dword [edx + 0x30], 0
jne 0x405a32
mov dword [ebp - 0x750], 0
push esi
Function at 0x405b32
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edx
push eax
add esp, 4
and edx, 0x10e62
sub edx, 0xeebb
add edx, 0x3664
add edx, 0x13fd3
pop edx
push edi
push eax
add esp, 4
jmp 0x405a5b
jmp 0x405a63
pop edi
lea edx, [ebp - 0x1774]
mov dword [ebp - 0xca0], edx
mov eax, dword [ebp - 0x508]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc9c], ecx
xor edx, edx
mov word [ebp - 0x214], dx
xor eax, eax
mov word [ebp - 0x110], ax
push eax
jmp 0x405a99
sub eax, 0xf85d
pop eax
push ebx
push edx
add esp, 4
jmp 0x405aaa
jmp 0x405ab1
call 0x405abf
add byte [edi + 0x35], cl
dec ebp
dec ebp
xor dh, byte ss:[edx]
push eax
add esp, 4
pop ebx
mov ecx, dword [ebp - 0xc9c]
mov dx, word [ecx]
mov word [ebp - 0x1036], dx
mov eax, dword [ebp - 0xc9c]
add eax, 2
mov dword [ebp - 0xc9c], eax
mov cx, word [ebp - 0x1036]
mov word [ebp - 0x214], cx
mov edx, dword [ebp - 0xca0]
mov ax, word [edx]
mov word [ebp - 0x1038], ax
mov ecx, dword [ebp - 0xca0]
add ecx, 2
mov dword [ebp - 0xca0], ecx
mov dx, word [ebp - 0x1038]
mov word [ebp - 0x110], dx
push esi
push ecx
add esp, 4
call 0x405b32
add byte [ebp + esi + 0x4c], cl
inc eax
xor al, 0x36
dec esp
inc ebx
cmp byte [ebx + 0x575e04c4], al
push esi
add esp, 4
and edi, 0x11946
jmp 0x405b48
sub edi, 0xe07a
pop edi
movzx eax, word [ebp - 0x110]
test eax, eax
jne 0x405b72
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
sub ecx, edx
mov dword [ebp - 0x15ec], ecx
jmp 0x405bd5
movzx eax, word [ebp - 0x214]
movzx ecx, word [ebp - 0x110]
cmp eax, ecx
je 0x405a91
movzx edx, word [ebp - 0x214]
xor edx, 0x20
movzx eax, word [ebp - 0x110]
cmp edx, eax
je 0x405a91
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
cmp ecx, edx
jge 0x405bbf
mov dword [ebp - 0x15e8], 0xffffffff
jmp 0x405bc9
mov dword [ebp - 0x15e8], 1
add byte [ebx - 0x15e77b], cl
dec dword [ecx - 0x15eb7b]
inc dword [ebx - 0x15eb43]
inc dword [eax]
mov eax, dword [ebp - 0x15e8]
mov dword [ebp - 0x15ec], eax
cmp dword [ebp - 0x15ec], 0
jne 0x405c1e
push edi
push esi
add esp, 4
and edi, 0x14552
pop edi
push esi
or esi, 0x9f78
pop esi
push edi
push ebx
add esp, 4
add edi, 0x8df4
sub edi, 0x415d
or edi, 0x7877
and edi, 0x9263
pop edi
mov ecx, dword [ebp - 0x508]
mov dword [ebp - 0x750], ecx
jmp 0x405c86
push ebx
push edx
add esp, 4
and ebx, 0x3d48
sub ebx, 0x2dbb
xor ebx, 0x1bf3
xor ebx, 0x1391f
pop ebx
push ebx
add ebx, 0xeee0
or ebx, 0x8759
add ebx, 0x90a2
pop ebx
mov edx, dword [ebp - 0x508]
mov eax, dword [edx]
mov dword [ebp - 0x508], eax
mov ecx, dword [ebp - 0x508]
cmp ecx, dword [ebp - 0xca4]
je 0x405c7c
mov edx, dword [ebp - 0x508]
cmp dword [edx + 0x30], 0
jne 0x405a32
mov dword [ebp - 0x750], 0
push esi
Function at 0x405bc8
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edx
push eax
add esp, 4
and edx, 0x10e62
sub edx, 0xeebb
add edx, 0x3664
add edx, 0x13fd3
pop edx
push edi
push eax
add esp, 4
jmp 0x405a5b
jmp 0x405a63
pop edi
lea edx, [ebp - 0x1774]
mov dword [ebp - 0xca0], edx
mov eax, dword [ebp - 0x508]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc9c], ecx
xor edx, edx
mov word [ebp - 0x214], dx
xor eax, eax
mov word [ebp - 0x110], ax
push eax
jmp 0x405a99
sub eax, 0xf85d
pop eax
push ebx
push edx
add esp, 4
jmp 0x405aaa
jmp 0x405ab1
call 0x405abf
add byte [edi + 0x35], cl
dec ebp
dec ebp
xor dh, byte ss:[edx]
push eax
add esp, 4
pop ebx
mov ecx, dword [ebp - 0xc9c]
mov dx, word [ecx]
mov word [ebp - 0x1036], dx
mov eax, dword [ebp - 0xc9c]
add eax, 2
mov dword [ebp - 0xc9c], eax
mov cx, word [ebp - 0x1036]
mov word [ebp - 0x214], cx
mov edx, dword [ebp - 0xca0]
mov ax, word [edx]
mov word [ebp - 0x1038], ax
mov ecx, dword [ebp - 0xca0]
add ecx, 2
mov dword [ebp - 0xca0], ecx
mov dx, word [ebp - 0x1038]
mov word [ebp - 0x110], dx
push esi
push ecx
add esp, 4
call 0x405b32
add byte [ebp + esi + 0x4c], cl
inc eax
xor al, 0x36
dec esp
inc ebx
cmp byte [ebx + 0x575e04c4], al
push esi
add esp, 4
and edi, 0x11946
jmp 0x405b48
sub edi, 0xe07a
pop edi
movzx eax, word [ebp - 0x110]
test eax, eax
jne 0x405b72
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
sub ecx, edx
mov dword [ebp - 0x15ec], ecx
jmp 0x405bd5
movzx eax, word [ebp - 0x214]
movzx ecx, word [ebp - 0x110]
cmp eax, ecx
je 0x405a91
movzx edx, word [ebp - 0x214]
xor edx, 0x20
movzx eax, word [ebp - 0x110]
cmp edx, eax
je 0x405a91
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
cmp ecx, edx
jge 0x405bbf
mov dword [ebp - 0x15e8], 0xffffffff
jmp 0x405bc9
mov dword [ebp - 0x15e8], 1
add byte [ebx - 0x15e77b], cl
dec dword [ecx - 0x15eb7b]
inc dword [ebx - 0x15eb43]
inc dword [eax]
mov eax, dword [ebp - 0x15e8]
mov dword [ebp - 0x15ec], eax
cmp dword [ebp - 0x15ec], 0
jne 0x405c1e
push edi
push esi
add esp, 4
and edi, 0x14552
pop edi
push esi
or esi, 0x9f78
pop esi
push edi
push ebx
add esp, 4
add edi, 0x8df4
sub edi, 0x415d
or edi, 0x7877
and edi, 0x9263
pop edi
mov ecx, dword [ebp - 0x508]
mov dword [ebp - 0x750], ecx
jmp 0x405c86
push ebx
push edx
add esp, 4
and ebx, 0x3d48
sub ebx, 0x2dbb
xor ebx, 0x1bf3
xor ebx, 0x1391f
pop ebx
push ebx
add ebx, 0xeee0
or ebx, 0x8759
add ebx, 0x90a2
pop ebx
mov edx, dword [ebp - 0x508]
mov eax, dword [edx]
mov dword [ebp - 0x508], eax
mov ecx, dword [ebp - 0x508]
cmp ecx, dword [ebp - 0xca4]
je 0x405c7c
mov edx, dword [ebp - 0x508]
cmp dword [edx + 0x30], 0
jne 0x405a32
mov dword [ebp - 0x750], 0
push esi

Function at 0x405c87
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edi
add esp, 4
call 0x405c9a
add byte [edx], bh
cmp dword [edx], esi
dec esi
cmp dword [edi], esi
dec edi
dec esi
inc ecx
add esp, 4
jmp 0x405ca3
pop esi
push edi
sub edi, 0x8e28
add edi, 0x6679
Function at 0x405c9a
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edi
add esp, 4
call 0x405c9a
add byte [edx], bh
cmp dword [edx], esi
dec esi
cmp dword [edi], esi
dec edi
dec esi
inc ecx
add esp, 4
jmp 0x405ca3
pop esi
push edi
sub edi, 0x8e28
add edi, 0x6679
Function at 0x405df7
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
dec dword [ebx - 0x31f7b]
inc dword [ebx]
inc edx
and byte [ecx - 0x19637b], cl
dec dword [ebx - 0x75373]
dec dword [ebx - 0x31f6b]
inc dword [ebx]
push ecx
and al, 0x89
xchg ebp, eax
cwde
out 0xff, al
dec dword [ebx - 0x7537b]
dec dword [ebx - 0x31f73]
inc dword [ebx]
dec eax
sbb al, 0x89
lea edx, [esi - 0x7a380001]
test al, 0xf8
invalid

Function at 0x405e9b
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x758]
add edx, 1
mov dword [ebp - 0x758], edx
invalid
mov dword [ebp - 0x1970], eax
mov dword [ebp - 0x198], 0
jmp 0x405ebc

Function at 0x405eb6
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ebp - 0x198]
add ecx, 1
mov dword [ebp - 0x198], ecx
mov edx, dword [ebp - 0x75c]
add edx, dword [ebp - 0x198]
movsx eax, byte [edx]
test eax, eax
je 0x405f6e
invalid
invalid
invalid

Function at 0x405f50
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push 0xffffffe
mov esi, 0xf76c058c
invalid

Function at 0x405fd8
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add dword [eax], eax
add eax, 0x4630
add eax, 0x8333
pop eax
push edx
push esi
add esp, 4
add edx, 0x16224
ret 0x6224
add dword [eax], eax
or edx, 0xb22
add edx, 0x4ce4
pop edx
mov eax, dword [ebp - 0x75c]
add eax, dword [ebp - 0x198]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x198]
movsx eax, byte [ebp + edx - 0x894]
or eax, 0x20
cmp ecx, eax
jge 0x406032
mov dword [ebp - 0xca8], 0xffffffff
jmp 0x40603c
mov dword [ebp - 0xca8], 1
cmp dword [ebp - 0xca8], 0
jne 0x406053
mov ecx, dword [ebp - 0x1970]
mov dword [ebp - 0x3f4], ecx
jmp 0x406064
jmp 0x405e3d

Function at 0x406091
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or edi, 0x79ec
pop edi
push edx
or edx, 0xf97e
pop edx
mov eax, dword [ebp - 0x3f4]
mov dword [ebp - 0x1974], eax
push esi
push esi
add esp, 4
and esi, 0x13f48
xor esi, 0xd827
add byte [eax], al
add esi, 0xaabc
pop esi
push eax
or eax, 0x7def
call 0x4060dd
add byte [ebx], bh
dec edx
xor al, 0x3e
push eax
cmp al, byte [ebx + 0x50]
dec ebx
add esp, 4
pop eax
mov ecx, dword [ebp - 0x1974]
mov dword [ebp - 0x1978], ecx
lea edx, [ebp - 0x1738]
push edx
call dword [ebp - 0x1978]
test eax, eax
jne 0x40613f
push ecx
and ecx, 0x16e2d
jmp 0x40610c
jmp 0x406114
call 0x406124
add byte [eax + 0x47], cl
cmp ecx, dword [edi + 0x48]
xor eax, 0x464d3934
add esp, 4
pop ecx
push ebx
xor ebx, 0x12680
pop ebx
mov dword [ebp - 0x79c], 0
jmp 0x406829
Function at 0x4060be
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or edi, 0x79ec
pop edi
push edx
or edx, 0xf97e
pop edx
mov eax, dword [ebp - 0x3f4]
mov dword [ebp - 0x1974], eax
push esi
push esi
add esp, 4
and esi, 0x13f48
xor esi, 0xd827
add byte [eax], al
add esi, 0xaabc
pop esi
push eax
or eax, 0x7def
call 0x4060dd
add byte [ebx], bh
dec edx
xor al, 0x3e
push eax
cmp al, byte [ebx + 0x50]
dec ebx
add esp, 4
pop eax
mov ecx, dword [ebp - 0x1974]
mov dword [ebp - 0x1978], ecx
lea edx, [ebp - 0x1738]
push edx
call dword [ebp - 0x1978]
test eax, eax
jne 0x40613f
push ecx
and ecx, 0x16e2d
jmp 0x40610c
jmp 0x406114
call 0x406124
add byte [eax + 0x47], cl
cmp ecx, dword [edi + 0x48]
xor eax, 0x464d3934
add esp, 4
pop ecx
push ebx
xor ebx, 0x12680
pop ebx
mov dword [ebp - 0x79c], 0
jmp 0x406829

Function at 0x4060dd
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or edi, 0x79ec
pop edi
push edx
or edx, 0xf97e
pop edx
mov eax, dword [ebp - 0x3f4]
mov dword [ebp - 0x1974], eax
push esi
push esi
add esp, 4
and esi, 0x13f48
xor esi, 0xd827
add byte [eax], al
add esi, 0xaabc
pop esi
push eax
or eax, 0x7def
call 0x4060dd
add byte [ebx], bh
dec edx
xor al, 0x3e
push eax
cmp al, byte [ebx + 0x50]
dec ebx
add esp, 4
pop eax
mov ecx, dword [ebp - 0x1974]
mov dword [ebp - 0x1978], ecx
lea edx, [ebp - 0x1738]
push edx
call dword [ebp - 0x1978]
test eax, eax
jne 0x40613f
push ecx
and ecx, 0x16e2d
jmp 0x40610c
jmp 0x406114
call 0x406124
add byte [eax + 0x47], cl
cmp ecx, dword [edi + 0x48]
xor eax, 0x464d3934
add esp, 4
pop ecx
push ebx
xor ebx, 0x12680
pop ebx
mov dword [ebp - 0x79c], 0
jmp 0x406829

Function at 0x406124
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or edi, 0x79ec
pop edi
push edx
or edx, 0xf97e
pop edx
mov eax, dword [ebp - 0x3f4]
mov dword [ebp - 0x1974], eax
push esi
push esi
add esp, 4
and esi, 0x13f48
xor esi, 0xd827
add byte [eax], al
add esi, 0xaabc
pop esi
push eax
or eax, 0x7def
call 0x4060dd
add byte [ebx], bh
dec edx
xor al, 0x3e
push eax
cmp al, byte [ebx + 0x50]
dec ebx
add esp, 4
pop eax
mov ecx, dword [ebp - 0x1974]
mov dword [ebp - 0x1978], ecx
lea edx, [ebp - 0x1738]
push edx
call dword [ebp - 0x1978]
test eax, eax
jne 0x40613f
push ecx
and ecx, 0x16e2d
jmp 0x40610c
jmp 0x406114
call 0x406124
add byte [eax + 0x47], cl
cmp ecx, dword [edi + 0x48]
xor eax, 0x464d3934
add esp, 4
pop ecx
push ebx
xor ebx, 0x12680
pop ebx
mov dword [ebp - 0x79c], 0
jmp 0x406829
Function at 0x40640f
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x40640f
add byte [ebp + 0x37], cl
xor al, 0x36
dec ebx
inc esi
cmp dword [0xc483463f], esi
add al, 0x5a
mov ecx, dword [ebp - 0x50c]
mov dword [ebp - 0x31c], ecx
jmp 0x406489
Function at 0x406afb
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 0x514], ecx
push eax
push edx
add esp, 4
add eax, 0x9413
pop eax
push edx
or edx, 0xec41
or edx, 0xbeaf
call 0x406b29
add byte [esi + 0x33], cl
dec esi
dec ebx
cmp esi, dword [edi]
inc esp
dec edi
cmp al, byte [ebx - 0xd7efb3c]
add al, 0x81
nop
add al, byte [eax]
add byte [edx - 0x73], bl
xchg ebp, eax
enter 0xffffffffffffffe8, 0xffffffffffffffff
mov dword [ebp - 0xcc0], edx
mov eax, dword [ebp - 0x514]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcbc], ecx
xor edx, edx
mov word [ebp - 0x21c], dx
xor eax, eax
mov word [ebp - 0x38], ax
push edx
push ebx
add esp, 4
call 0x406b70
add byte [esi + 0x4f], al
dec eax
cmp ecx, dword [eax + 0x42]
cmp al, 0x33
add esp, 4
or edx, 0x178f3
pop edx
push ebx
push esi
add esp, 4
call 0x406b8b
add byte [ebx], bh
xor eax, 0x39394d43
add esp, 4
pop ebx
mov ecx, dword [ebp - 0xcbc]
mov dx, word [ecx]
mov word [ebp - 0x103e], dx
mov eax, dword [ebp - 0xcbc]
add eax, 2
mov dword [ebp - 0xcbc], eax
mov cx, word [ebp - 0x103e]
mov word [ebp - 0x21c], cx
mov edx, dword [ebp - 0xcc0]
mov ax, word [edx]
mov word [ebp - 0x1040], ax
mov ecx, dword [ebp - 0xcc0]
add ecx, 2
mov dword [ebp - 0xcc0], ecx
mov dx, word [ebp - 0x1040]
mov word [ebp - 0x38], dx
push eax
and eax, 0x4f9e
pop eax
push eax
push esi
add esp, 4
xor eax, 0x81b7
pop eax
push edi
push eax
add esp, 4
or edi, 0x7331
or edi, 0x10dcf
and edi, 0x46c2
and edi, 0x13e71
pop edi
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x406c35
movzx ecx, word [ebp - 0x21c]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x161c], ecx
jmp 0x406c8f
movzx eax, word [ebp - 0x21c]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x406b5d
movzx edx, word [ebp - 0x21c]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x406b5d
movzx ecx, word [ebp - 0x21c]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x406c79
mov dword [ebp - 0x1618], 0xffffffff
jmp 0x406c83
mov dword [ebp - 0x1618], 1
mov eax, dword [ebp - 0x1618]
mov dword [ebp - 0x161c], eax
cmp dword [ebp - 0x161c], 0
jne 0x406cd8
push edi
push ebx
add esp, 4
sub edi, 0x5ff2
sub edi, 0xb0aa
jmp 0x406caf
xor edi, 0x109fc
pop edi
push ecx
sub ecx, 0x14e27
or ecx, 0x109a6
and ecx, 0x1658e
pop ecx
mov ecx, dword [ebp - 0x514]
mov dword [ebp - 0x2fc], ecx
jmp 0x406d40
push ecx
push ebx
add esp, 4
jmp 0x406ce6
pop ecx
push eax
or eax, 0xbd25
xor eax, 0x149db
jmp 0x406cfd
pop eax
push edx
push ecx
add esp, 4
and edx, 0xd944
pop edx
mov edx, dword [ebp - 0x514]
mov eax, dword [edx]
mov dword [ebp - 0x514], eax
mov ecx, dword [ebp - 0x514]
cmp ecx, dword [ebp - 0xcc4]
je 0x406d36
mov edx, dword [ebp - 0x514]
cmp dword [edx + 0x30], 0
jne 0x406b01
mov dword [ebp - 0x2fc], 0
Function at 0x406b29
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 0x514], ecx
push eax
push edx
add esp, 4
add eax, 0x9413
pop eax
push edx
or edx, 0xec41
or edx, 0xbeaf
call 0x406b29
add byte [esi + 0x33], cl
dec esi
dec ebx
cmp esi, dword [edi]
inc esp
dec edi
cmp al, byte [ebx - 0xd7efb3c]
add al, 0x81
nop
add al, byte [eax]
add byte [edx - 0x73], bl
xchg ebp, eax
enter 0xffffffffffffffe8, 0xffffffffffffffff
mov dword [ebp - 0xcc0], edx
mov eax, dword [ebp - 0x514]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcbc], ecx
xor edx, edx
mov word [ebp - 0x21c], dx
xor eax, eax
mov word [ebp - 0x38], ax
push edx
push ebx
add esp, 4
call 0x406b70
add byte [esi + 0x4f], al
dec eax
cmp ecx, dword [eax + 0x42]
cmp al, 0x33
add esp, 4
or edx, 0x178f3
pop edx
push ebx
push esi
add esp, 4
call 0x406b8b
add byte [ebx], bh
xor eax, 0x39394d43
add esp, 4
pop ebx
mov ecx, dword [ebp - 0xcbc]
mov dx, word [ecx]
mov word [ebp - 0x103e], dx
mov eax, dword [ebp - 0xcbc]
add eax, 2
mov dword [ebp - 0xcbc], eax
mov cx, word [ebp - 0x103e]
mov word [ebp - 0x21c], cx
mov edx, dword [ebp - 0xcc0]
mov ax, word [edx]
mov word [ebp - 0x1040], ax
mov ecx, dword [ebp - 0xcc0]
add ecx, 2
mov dword [ebp - 0xcc0], ecx
mov dx, word [ebp - 0x1040]
mov word [ebp - 0x38], dx
push eax
and eax, 0x4f9e
pop eax
push eax
push esi
add esp, 4
xor eax, 0x81b7
pop eax
push edi
push eax
add esp, 4
or edi, 0x7331
or edi, 0x10dcf
and edi, 0x46c2
and edi, 0x13e71
pop edi
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x406c35
movzx ecx, word [ebp - 0x21c]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x161c], ecx
jmp 0x406c8f
movzx eax, word [ebp - 0x21c]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x406b5d
movzx edx, word [ebp - 0x21c]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x406b5d
movzx ecx, word [ebp - 0x21c]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x406c79
mov dword [ebp - 0x1618], 0xffffffff
jmp 0x406c83
mov dword [ebp - 0x1618], 1
mov eax, dword [ebp - 0x1618]
mov dword [ebp - 0x161c], eax
cmp dword [ebp - 0x161c], 0
jne 0x406cd8
push edi
push ebx
add esp, 4
sub edi, 0x5ff2
sub edi, 0xb0aa
jmp 0x406caf
xor edi, 0x109fc
pop edi
push ecx
sub ecx, 0x14e27
or ecx, 0x109a6
and ecx, 0x1658e
pop ecx
mov ecx, dword [ebp - 0x514]
mov dword [ebp - 0x2fc], ecx
jmp 0x406d40
push ecx
push ebx
add esp, 4
jmp 0x406ce6
pop ecx
push eax
or eax, 0xbd25
xor eax, 0x149db
jmp 0x406cfd
pop eax
push edx
push ecx
add esp, 4
and edx, 0xd944
pop edx
mov edx, dword [ebp - 0x514]
mov eax, dword [edx]
mov dword [ebp - 0x514], eax
mov ecx, dword [ebp - 0x514]
cmp ecx, dword [ebp - 0xcc4]
je 0x406d36
mov edx, dword [ebp - 0x514]
cmp dword [edx + 0x30], 0
jne 0x406b01
mov dword [ebp - 0x2fc], 0
Function at 0x406b70
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 0x514], ecx
push eax
push edx
add esp, 4
add eax, 0x9413
pop eax
push edx
or edx, 0xec41
or edx, 0xbeaf
call 0x406b29
add byte [esi + 0x33], cl
dec esi
dec ebx
cmp esi, dword [edi]
inc esp
dec edi
cmp al, byte [ebx - 0xd7efb3c]
add al, 0x81
nop
add al, byte [eax]
add byte [edx - 0x73], bl
xchg ebp, eax
enter 0xffffffffffffffe8, 0xffffffffffffffff
mov dword [ebp - 0xcc0], edx
mov eax, dword [ebp - 0x514]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcbc], ecx
xor edx, edx
mov word [ebp - 0x21c], dx
xor eax, eax
mov word [ebp - 0x38], ax
push edx
push ebx
add esp, 4
call 0x406b70
add byte [esi + 0x4f], al
dec eax
cmp ecx, dword [eax + 0x42]
cmp al, 0x33
add esp, 4
or edx, 0x178f3
pop edx
push ebx
push esi
add esp, 4
call 0x406b8b
add byte [ebx], bh
xor eax, 0x39394d43
add esp, 4
pop ebx
mov ecx, dword [ebp - 0xcbc]
mov dx, word [ecx]
mov word [ebp - 0x103e], dx
mov eax, dword [ebp - 0xcbc]
add eax, 2
mov dword [ebp - 0xcbc], eax
mov cx, word [ebp - 0x103e]
mov word [ebp - 0x21c], cx
mov edx, dword [ebp - 0xcc0]
mov ax, word [edx]
mov word [ebp - 0x1040], ax
mov ecx, dword [ebp - 0xcc0]
add ecx, 2
mov dword [ebp - 0xcc0], ecx
mov dx, word [ebp - 0x1040]
mov word [ebp - 0x38], dx
push eax
and eax, 0x4f9e
pop eax
push eax
push esi
add esp, 4
xor eax, 0x81b7
pop eax
push edi
push eax
add esp, 4
or edi, 0x7331
or edi, 0x10dcf
and edi, 0x46c2
and edi, 0x13e71
pop edi
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x406c35
movzx ecx, word [ebp - 0x21c]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x161c], ecx
jmp 0x406c8f
movzx eax, word [ebp - 0x21c]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x406b5d
movzx edx, word [ebp - 0x21c]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x406b5d
movzx ecx, word [ebp - 0x21c]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x406c79
mov dword [ebp - 0x1618], 0xffffffff
jmp 0x406c83
mov dword [ebp - 0x1618], 1
mov eax, dword [ebp - 0x1618]
mov dword [ebp - 0x161c], eax
cmp dword [ebp - 0x161c], 0
jne 0x406cd8
push edi
push ebx
add esp, 4
sub edi, 0x5ff2
sub edi, 0xb0aa
jmp 0x406caf
xor edi, 0x109fc
pop edi
push ecx
sub ecx, 0x14e27
or ecx, 0x109a6
and ecx, 0x1658e
pop ecx
mov ecx, dword [ebp - 0x514]
mov dword [ebp - 0x2fc], ecx
jmp 0x406d40
push ecx
push ebx
add esp, 4
jmp 0x406ce6
pop ecx
push eax
or eax, 0xbd25
xor eax, 0x149db
jmp 0x406cfd
pop eax
push edx
push ecx
add esp, 4
and edx, 0xd944
pop edx
mov edx, dword [ebp - 0x514]
mov eax, dword [edx]
mov dword [ebp - 0x514], eax
mov ecx, dword [ebp - 0x514]
cmp ecx, dword [ebp - 0xcc4]
je 0x406d36
mov edx, dword [ebp - 0x514]
cmp dword [edx + 0x30], 0
jne 0x406b01
mov dword [ebp - 0x2fc], 0