joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4057d0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0
jmp 0x4057f5
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0xc]
jae 0x405868
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 8]
xor ecx, edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 8]
shr eax, 8
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
jmp 0x40582a
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 8
jge 0x40585d
mov edx, dword [ebp - 0x10]
and edx, 1
neg edx
sbb edx, edx
neg edx
mov byte [ebp - 0x15], dl
mov eax, dword [ebp - 0x10]
shr eax, 1
mov dword [ebp - 0x10], eax
movzx ecx, byte [ebp - 0x15]
test ecx, ecx
je 0x40585b
mov edx, dword [ebp - 0x10]
xor edx, 0xedb88320
mov dword [ebp - 0x10], edx
jmp 0x405821
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x4057ec
mov eax, dword [ebp - 8]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x401230
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x3a8
sub eax, 1
push ebx
push edi
jne 0x4012c5
push 0x3a4
push eax
lea ebx, [eax + 1]
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x14], 0x3a8
call fcn.004131f0
mov eax, dword [esp + 0x3c0]
add esp, 0xc
call fcn.00401e70
cmp byte [0x497292], 0
je 0x4012ae
cmp byte [0x497294], 0
mov edi, dword [esp + 0x3b4]
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], 2
jne 0x42aa61
cmp byte [edi + 9], 0
jne 0x42aaac
cmp byte [edi + 0x184], bl
je 0x42aaf8
push ebx
push esi
call dword [sym.imp.USER32.dll_KillTimer]
push 0
push 0x2ee
push ebx
push esi
call dword [sym.imp.USER32.dll_SetTimer]
pop edi
pop ebx
add esp, 0x3a8
ret 4
add al, 0x59
Function at 0x401be0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, esi
call fcn.00402ae0
mov eax, dword [esi + 4]
cmp edi, eax
jae 0x42a5b1
mov eax, dword [esi]
lea eax, [eax + edi*2]
ret
add byte [eax], al
add byte [eax], al
cmp dword [ebp + 0x46], eax

Function at 0x401e70
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4b8
cmp byte [0x497292], 0
push esi
push edi
je 0x401f6e
mov esi, eax
mov eax, 0x104
lea ecx, [esp + 8]
call fcn.00401400
cmp byte [0x497294], 1
je 0x42a9a0
xor edx, edx
mov word [esp + 0x18], dx
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0xc]
call fcn.004021e0
cmp byte [0x497291], 0
jne 0x42a9cd
cmp dword [esi + 0x60], 0
jne 0x42a9bb
mov edi, dword [0x4a7cf8]
lea eax, [esp + 8]
call fcn.0040d330
push 0x3a4
lea ecx, [esp + 0x120]
push 0
push ecx
call fcn.004131f0
mov eax, dword [esp + 0x14]
mov edx, dword [0x4972c0]
push 0x7f
push eax
lea ecx, [esp + 0x2c]
push ecx
mov dword [esp + 0x130], 0x3a8
mov dword [esp + 0x134], edx
mov dword [esp + 0x138], 1
mov dword [esp + 0x13c], 4
call fcn.0041326a
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x14c]
xor edx, edx
push ecx
mov word [esp + 0x136], dx
call fcn.00411691
add esp, 0x20
lea edx, [esp + 0x118]
push edx
push 1
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
lea ecx, [esp + 8]
call fcn.00402620
pop edi
pop esi
mov esp, ebp
pop ebp
ret
invalid
add al, 0xfe
invalid

Function at 0x4021e0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
push edi
mov esi, eax
test ebp, ebp
je 0x42a598
push ebp
call fcn.004112d5
mov ecx, dword [esi + 0xc]
add esp, 4
mov dword [esi + 4], eax
cmp dword [ecx], 1
jg 0x402226
mov edi, eax
call fcn.00404020
mov eax, dword [esi + 4]
mov edx, dword [esi]
lea ecx, [eax + eax + 2]
push ecx
push ebp
push edx
call fcn.00410f70
add esp, 0xc
pop edi
pop esi
pop ebp
ret 4
dec dword [ecx]
call int.004013e0
mov eax, dword [esi + 4]
add eax, 1
je 0x42a5a7
add eax, 7
shr eax, 3
add eax, eax
add eax, eax
add eax, eax
xor ecx, ecx
mov dword [esi + 8], eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041171a
add esp, 4
mov dword [esi], eax
jmp 0x40220c
jb 0x42a59a
add byte [edi + 0x56], bl
add byte [eax], al

Function at 0x402650
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
movzx eax, word [edi + 8]
cmp ax, 0x30
jl 0x40266a
cmp ax, 0x3f
jg 0x40266a
mov eax, dword [edi]
test eax, eax
jne 0x429e50
push 0x10
call fcn.0041171a
add esp, 4
test eax, eax
je 0x429e5b
mov ecx, dword [esi]
mov dword [eax], ecx
mov edx, dword [esi + 4]
mov dword [eax + 4], edx
mov ecx, dword [esi + 8]
mov dword [eax + 8], ecx
mov ecx, dword [esi + 0xc]
mov dword [eax + 0xc], ecx
inc dword [ecx]
mov dword [edi], eax
mov eax, edi
ret
add byte [edx - 0x75], bl
lea eax, [eax - 4]
invalid
sti
invalid
Function at 0x402940
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x2028
call fcn.00425210
push ebx
push ebp
push esi
mov ebx, ecx
push edi
lea edi, [ebx + 0x14]
mov dword [esp + 0x1c], edi
call fcn.00401a30
mov eax, dword [esp + 0x203c]
xor ebp, ebp
mov dword [ebx], ebp
add ebx, 4
push eax
mov eax, ebx
call fcn.004021e0
mov dword [esp + 0x14], ebp
mov byte [esp + 0x12], 0
mov dword [esp + 0x18], ebp
mov byte [esp + 0x13], 0
mov edi, ebp
mov esi, ebx
call fcn.00401be0
movzx eax, word [eax]
cmp ax, 0x20
je 0x42a5b7
cmp ax, 9
je 0x42a5b7
mov eax, ebx
call fcn.00402ae0
mov eax, dword [ebx + 4]
cmp ebp, eax
jae 0x402a70
mov ecx, dword [ebx]
lea eax, [ecx + ebp*2]
movzx eax, word [eax]
mov ecx, dword [esp + 0x14]
test ax, ax
je 0x402a8c
inc ebp
cmp ecx, 0x1000
jge 0x402a8c
cmp ax, 0x20
je 0x402a17
cmp ax, 9
je 0x402a17
cmp ax, 0x22
je 0x4029f6
mov word [esp + ecx*2 + 0x30], ax
inc ecx
mov dword [esp + 0x14], ecx
jmp 0x4029a4
mov edi, ebp
mov esi, ebx
call fcn.00401be0
cmp word [eax], 0x22
je 0x42a5bd
cmp byte [esp + 0x12], 0
je 0x402a7a
mov byte [esp + 0x12], 0
jmp 0x4029a4
cmp byte [esp + 0x12], 1
je 0x4029ea
xor edx, edx
lea edi, [esp + 0x30]
lea esi, [esp + 0x20]
mov word [esp + ecx*2 + 0x30], dx
call fcn.00401b70
mov edi, esi
mov esi, dword [esp + 0x1c]
call fcn.0040d970
mov ecx, edi
call fcn.00402620
mov dword [esp + 0x14], 0
mov byte [esp + 0x13], 0
mov edi, ebp
mov esi, ebx
call fcn.00401be0
movzx eax, word [eax]
cmp ax, 0x20
je 0x402a6d
cmp ax, 9
jne 0x4029a4
inc ebp
jmp 0x402a51
mov edx, dword [ebx]
lea eax, [edx + eax*2]
jmp 0x4029bb
mov byte [esp + 0x12], 1
mov eax, dword [esp + 0x14]
mov dword [esp + 0x18], eax
jmp 0x4029a4
test ecx, ecx
je 0x42a5ed
cmp byte [esp + 0x12], 0
jne 0x42a603
xor edx, edx
lea edi, [esp + 0x30]
lea esi, [esp + 0x20]
mov word [esp + ecx*2 + 0x30], dx
call fcn.00401b70
mov edi, esi
mov esi, dword [esp + 0x1c]
call fcn.0040d970
mov ecx, edi
call fcn.00402620
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2028
ret 4
sti
invalid

Function at 0x402ae0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, eax
mov eax, dword [esi + 0xc]
cmp dword [eax], 1
jg 0x42a06a
pop esi
ret

Function at 0x402b00
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
movzx eax, word [esi + 8]
cmp ax, 0x30
jl 0x402b38
cmp ax, 0x3f
jg 0x402b38
push ebx
mov ebx, dword [esi]
test ebx, ebx
je 0x402b31
mov eax, dword [ebx + 0xc]
dec dword [eax]
mov eax, dword [ebx + 0xc]
cmp dword [eax], 0
je 0x429e26
push ebx
call fcn.004112ef
add esp, 4
mov dword [esi], 0
pop ebx
cmp di, 0x3f
mov word [esi + 8], di
jle 0x402b5d
cmp di, 0x10
je 0x429e3f
cmp di, 0x20
je 0x429e4b
mov dword [esi], 0
ret
cmp di, 0x30
jge 0x402b56
jmp 0x402b42
add byte [ecx + 0xa126ef], al
add byte [ecx + 0x383be7], al
add byte [edi + 0x52], bl
Function at 0x402b70
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov esi, ebp
mov edi, eax
mov ebx, ecx
call fcn.00403770
mov eax, dword [edi]
movzx esi, word [ebx + eax*2]
cmp si, 0x5a
jbe 0x402ba7
cmp si, 0x61
jb 0x402baf
cmp si, 0x7a
ja 0x402baf
push esi
mov eax, ebp
call fcn.00403470
inc dword [edi]
jmp 0x402b83
cmp si, 0x41
jae 0x402b9b
jmp 0x402b8f
cmp si, 0x30
jae 0x402c54
cmp si, 0x5f
je 0x402b9b
mov eax, ebp
call fcn.00402ae0
mov ecx, dword [ebp + 4]
mov edx, dword [ebp]
push ecx
push edx
call dword [sym.imp.USER32.dll_CharUpperBuffW]
xor ebx, ebx
jmp 0x402be0
mov eax, dword [ebp]
push eax
mov eax, dword [ebx*4 + 0x492670]
push eax
call fcn.004133e4
add esp, 8
test eax, eax
je 0x402c36
inc ebx
cmp ebx, 0x2b
jl 0x402be0
cmp si, 0x28
jne 0x42ab1a
mov eax, dword [ebp]
mov ecx, dword [0x4a8e84]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test eax, eax
jl 0x402c63
mov esi, dword [esp + 0x14]
mov edi, 1
mov ebx, eax
call fcn.00402b00
mov dword [esi], ebx
pop edi
pop esi
pop ebp
pop ebx
ret 8
test ebx, ebx
jl 0x402bfe
cmp si, 0x20
jne 0x402c83
mov esi, dword [esp + 0x14]
xor edi, edi
call fcn.00402b00
pop edi
mov dword [esi], ebx
pop esi
pop ebp
pop ebx
ret 8
cmp si, 0x39
jbe 0x402b9b
jmp 0x402bb9
mov ebx, dword [esp + 0x14]
mov edi, 0x34
mov esi, ebx
call fcn.00402b00
mov esi, ebp
mov edi, ebx
call fcn.00402650
pop edi
pop esi
pop ebp
pop ebx
ret 8
cmp si, 9
je 0x402c40
cmp si, 0x2c
je 0x402c40
cmp si, 0x3d
je 0x402c40
cmp si, 0x28
je 0x402c40
cmp si, 0x29
je 0x402c40
cmp si, 0x5d
je 0x402c40
test si, si
je 0x402c40
jmp 0x42ab2e
aas
Function at 0x402cc0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [edi + 0xc]
push ebp
mov ebp, dword [esp + 8]
push esi
cmp dword [edi + 8], eax
je 0x402d71
push 0xc
call fcn.0041171a
add esp, 4
test eax, eax
je 0x42a03c
mov esi, eax
mov ax, word [ebp + 8]
mov word [esi + 8], ax
mov cx, word [ebp + 0xa]
movzx eax, ax
cmp ax, 0x3f
mov word [esi + 0xa], cx
jle 0x402d29
cmp ax, 0x10
je 0x42a022
cmp ax, 0x20
je 0x42a032
mov edx, dword [ebp]
mov dword [esi], edx
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
mov dword [ecx + eax*4], esi
inc dword [edi + 8]
pop esi
pop ebp
ret 4
cmp ax, 0x30
jl 0x402cff
push 0x10
call fcn.0041171a
add esp, 4
test eax, eax
je 0x42a01b
mov ebp, dword [ebp]
mov edx, dword [ebp]
mov dword [eax], edx
mov ecx, dword [ebp + 4]
mov dword [eax + 4], ecx
mov edx, dword [ebp + 8]
mov dword [eax + 8], edx
mov ebp, dword [ebp + 0xc]
mov dword [eax + 0xc], ebp
inc dword [ebp]
mov dword [esi], eax
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
mov dword [ecx + eax*4], esi
inc dword [edi + 8]
pop esi
pop ebp
ret 4
add eax, eax
mov dword [edi + 0xc], eax
cmp eax, 4
jb 0x402dbc
xor ecx, ecx
mov dword [edi + 0xc], eax
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041171a
mov ecx, dword [edi + 4]
mov esi, eax
mov eax, dword [edi + 8]
add eax, eax
add eax, eax
push eax
push ecx
push esi
call fcn.00410f70
mov edx, dword [edi + 4]
push edx
call fcn.004112ef
add esp, 0x14
mov dword [edi + 4], esi
jmp 0x402cd2
mov eax, 4
jmp 0x402d7b
cmc
invalid
enter 0xc7e, 0xffffffffffffffc7
test dword [ebx + ebp*8], esi
invalid
add byte [eax], al
add bl, ch
or al, bh
test dword [ebx + ebp*8], esi
Function at 0x4034b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc eax
sub esp, 0xc
cmp dword [esi + 8], eax
jb 0x4034bd
add esp, 0xc
ret
cmp eax, 0x41c2
jae 0x42a0ba
add eax, eax
mov dword [esi + 8], eax
mov eax, dword [esi + 8]
test eax, eax
je 0x42a18b
add eax, 7
shr eax, 3
add eax, eax
add eax, eax
add eax, eax
xor ecx, ecx
mov dword [esi + 8], eax
mov edx, 2
mul edx
seto cl
push edi
neg ecx
or ecx, eax
push ecx
call fcn.0041171a
mov edi, eax
mov eax, dword [esi]
add esp, 4
test eax, eax
je 0x403523
mov ecx, dword [esi + 4]
lea edx, [ecx + ecx + 2]
push edx
push eax
push edi
call fcn.00410f70
mov eax, dword [esi]
push eax
call fcn.004112ef
add esp, 0x10
mov dword [esi], edi
pop edi
add esp, 0xc
ret
invalid
inc ebp

Function at 0x403530
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push ebp
push esi
mov esi, eax
call fcn.00403770
mov ecx, dword [edi]
cmp word [ebx + ecx*2 + 2], 0
lea eax, [ecx + 1]
mov dword [edi], eax
je 0x42b3da
movzx edx, word [ebx + ecx*2]
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], edx
jmp 0x403564
mov edx, dword [esp + 0xc]
mov eax, dword [edi]
lea ecx, [ebx + eax*2]
movzx eax, word [ecx]
cmp ax, dx
je 0x4035b0
movzx ebp, ax
mov eax, dword [esi + 0xc]
cmp dword [eax], 1
jg 0x42b384
mov eax, dword [esi + 4]
inc eax
call fcn.004034b0
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov word [ecx + eax*2], bp
inc dword [esi + 4]
mov eax, dword [esi + 4]
mov edx, dword [esi]
xor ecx, ecx
inc dword [edi]
mov word [edx + eax*2], cx
mov edx, dword [edi]
cmp word [ebx + edx*2], 0
jne 0x403560
jmp fcn.0042b3d6
cmp word [ecx + 2], dx
je 0x42b374
inc dword [edi]
xor eax, eax
pop esi
pop ebp
add esp, 0x10
ret 4
adc dword [ebx - 0x70b7b], ecx
dec dword [ecx - 0x4df7b]
invalid
Function at 0x4035d0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, eax
call fcn.00403770
mov eax, dword [edi]
cmp word [ebp + eax*2], 0x30
je 0x4036f0
mov byte [esp + 0x1c], 0
mov esi, eax
mov ebx, 0x17
mov edx, dword [edi]
movzx edx, word [ebp + edx*2]
movzx ecx, dx
mov eax, ecx
cmp eax, 0x2b
jl case.0x403625.44
cmp eax, 0x31
je case.0x403625.48
sub eax, 0x2b
cmp eax, 0x3a
ja case.0x403625.44
movzx eax, byte [eax + 0x403730]
jmp dword [eax*4 + 0x40371c]
and ebx, 0xffffffef
or ebx, 0x20
test bl, 0x20
je 0x403667
mov eax, dword [edi]
movzx ecx, word [ebp + eax*2]
inc eax
mov dword [edi], eax
mov eax, dword [esp + 0x24]
push ecx
call fcn.00403470
and ebx, 0xffffffdf
jmp 0x403600
and ecx, 0xffffffdf
cmp ecx, 0x41
jge 0x4036e2
cmp dx, 0x5f
jne 0x403632
jmp 0x42abf7
test bl, 0x10
jne 0x42abb0
cmp byte [esp + 0x1c], 0
jne 0x42ac0d
mov edi, dword [esp + 0x24]
mov eax, dword [edi]
push eax
call fcn.0041343c
mov ebx, eax
add esp, 4
mov ecx, ebx
add ecx, 0x80000000
mov ebp, edx
adc edx, 0
test edx, edx
ja 0x42ac48
jb 0x4036ac
cmp ecx, 0xffffffff
ja 0x42ac48
mov esi, dword [esp + 0x20]
movzx eax, word [esi + 8]
cmp ax, 0x3f
jle 0x403710
mov eax, 5
mov word [esi + 8], ax
mov dword [esi], 0
mov edi, dword [edi]
push edi
call fcn.00413431
add esp, 4
mov dword [esi], eax
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
cmp ecx, 0x5a
jg 0x40365c
jmp 0x42abf7
movzx ecx, word [ebp + eax*2 + 2]
mov ebx, esi
cmp cx, 0x78
je 0x42ab41
cmp cx, 0x58
jne 0x4035f4
jmp 0x42ab41
cmp ax, 0x30
jl 0x4036ba
jmp 0x42ac31
or eax, dword [eax]
add byte [ebx + 0x52], dl
sbb bl, ch
invalid
adc dword [ebx - 0x6fb7b], ecx
dec dword [ecx - 0x3c37b]
invalid
add byte [ebx - 0x14eb7b], cl
dec dword [ebx - 0x7687efb4]
lea edx, [eax]
jmp 0x42abf3
invalid
adc bl, ch
invalid
add byte [eax], al
add al, byte [eax]
add byte [ebx - 0x6ef6b], cl
dec dword [ebx - 0x2f77b]
inc dword [ebx]
inc edx
and byte [ecx - 0x189f7b], cl
dec dword [ebx - 0x6ef73]
dec dword [ebx - 0x2f76b]
inc dword [ebx]
push ecx
and al, 0x89
xchg ebp, eax
pop esp
out 0xff, eax
dec dword [ebx - 0x6ef7b]
dec dword [ebx - 0x2f773]
inc dword [ebx]
dec eax
sbb al, 0x89
lea ebx, [eax - 0x19]
invalid
Function at 0x403bd0
Capabilities:
Get number of processors
Read file on windows
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, eax
mov eax, dword [edi + 0xc]
cmp dword [eax], 1
jg 0x429e62
mov eax, dword [edi]
xor ebx, ebx
mov dword [edi + 4], ebx
mov byte [eax], bl
mov byte [esp + 0xd], bl
cmp dword [esi + 8], ebx
je 0x429e82
xor ebp, ebp
lea esp, [esp]
mov ecx, dword [esi + 0xc]
cmp ecx, dword [esi + 8]
je 0x403cf4
mov eax, dword [esi + 0xc]
mov edx, dword [esi + 4]
mov cl, byte [eax + edx]
mov byte [esp + ebp + 0xc], cl
inc ebp
inc eax
mov dword [esi + 0xc], eax
cmp ebp, 1
jb 0x403c00
add dword [esi + 0x10], ebp
adc dword [esi + 0x14], ebx
cmp ebp, ebx
je 0x403d1d
mov bl, byte [esp + 0xc]
cmp bl, 0xd
je 0x403c76
cmp bl, 0xa
je 0x403c94
mov eax, dword [edi + 0xc]
cmp dword [eax], 1
mov byte [esp + 0xd], 1
jg 0x429e9e
mov eax, dword [edi + 4]
add eax, 2
cmp dword [edi + 8], eax
jb 0x403c9d
mov eax, dword [edi + 4]
mov ecx, dword [edi]
mov byte [eax + ecx], bl
inc dword [edi + 4]
mov eax, dword [edi + 4]
mov edx, dword [edi]
mov byte [eax + edx], 0
xor ebx, ebx
jmp 0x403bf1
lea eax, [esp + 0xc]
push eax
mov ebx, 1
call fcn.00403d40
test eax, eax
je 0x403c94
cmp byte [esp + 0xc], 0xa
jne 0x429fab
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x10
ret
cmp eax, 0x41c2
jae 0x429ed0
lea edx, [eax + eax]
mov dword [edi + 8], edx
mov eax, dword [edi + 8]
test eax, eax
je 0x429fa1
add eax, 0xf
shr eax, 4
shl eax, 4
push eax
mov dword [edi + 8], eax
call fcn.0041171a
mov ebp, eax
mov eax, dword [edi]
add esp, 4
test eax, eax
je 0x403ced
mov ecx, dword [edi + 4]
inc ecx
push ecx
push eax
push ebp
call fcn.00410f70
mov edx, dword [edi]
push edx
call fcn.004112ef
add esp, 0x10
mov dword [edi], ebp
jmp 0x403c5b
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push ebx
lea edx, [esp + 0x14]
push edx
push 0x10000
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x403c23
jmp 0x429e93
cmp byte [esp + 0xd], 0
jne 0x403c94
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x10
ret
xor bl, bh
invalid
pop es
pop edx
add dword [eax], eax
add byte [eax], al
sbb byte [ecx], al
add byte [eax], al
ret 0x5547

Function at 0x403d40
Capabilities:
Read file on windows

Disassembly:
cmp dword [esi + 8], 0
push ebp
mov ebp, dword [esp + 8]
push edi
je 0x403da9
xor edi, edi
test ebx, ebx
jbe 0x403d6e
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 8]
je 0x403d7c
mov edx, dword [esi + 0xc]
mov ecx, dword [esi + 4]
mov al, byte [ecx + edx]
mov byte [edi + ebp], al
inc dword [esi + 0xc]
inc edi
cmp edi, ebx
jb 0x403d52
add dword [esi + 0x10], edi
mov eax, edi
pop edi
adc dword [esi + 0x14], 0
pop ebp
ret 4
mov edx, dword [esi + 4]
mov eax, dword [esi]
push 0
lea ecx, [esp + 0x10]
push ecx
push 0x10000
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x403d6e
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0
jmp 0x403d5a
push esi
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
call fcn.0040e190
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
jmp 0x403d4c
Function at 0x403fb0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebp
push esi
push edi
mov edi, eax
mov esi, ecx
test edi, edi
je 0x404001
cmp edi, 0xffffffff
je 0x404001
mov ebp, dword [esp + 0x10]
test ebp, ebp
je 0x404001
mov eax, dword [esi + 0xc]
cmp dword [eax], 1
jg 0x42ac60
call fcn.00404020
mov eax, dword [esp + 0x14]
mov edx, dword [esi]
mov dword [esi + 4], edi
add edi, edi
push edi
lea ecx, [ebp + eax*2]
push ecx
push edx
call fcn.00410f70
mov eax, dword [esi]
add esp, 0xc
xor ecx, ecx
mov word [edi + eax], cx
pop edi
pop esi
pop ebp
ret 8
or eax, 0xffffffff
xor edi, edi
call fcn.0040c740
pop edi
pop esi
pop ebp
ret 8
adc cl, bh
invalid

Function at 0x404260
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
mov ebx, eax
push edi
push ebx
call fcn.004042f0
test al, al
jne 0x42bff9
push esi
push 0x20
and ebp, 0xff00
call fcn.0041171a
add esp, 4
test eax, eax
je 0x4042db
mov esi, eax
mov ecx, esi
call fcn.0040c060
cmp esi, ebx
je 0x4042a2
mov eax, ebx
mov ecx, esi
call fcn.00404080
push 0x10
mov dword [esi + 0x10], ebp
call fcn.0041171a
xor ebp, ebp
add esp, 4
cmp eax, ebp
je 0x4042df
mov ebx, eax
mov eax, dword [esp + 0x10]
call fcn.0040bd50
mov dword [esi + 0x14], eax
mov dword [esi + 0x1c], ebp
mov dword [esi + 0x18], ebp
mov edx, dword [edi]
push edx
mov eax, esi
call fcn.004041f0
pop esi
pop ebp
mov dword [edi], eax
pop ebx
ret 8
xor esi, esi
jmp 0x404295
xor eax, eax
jmp 0x4042c0
clc
invalid
Function at 0x4092c0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edi
mov edi, dword [esi + 0xc]
test edi, edi
jne 0x409307
mov eax, dword [esi + 8]
pop edi
cmp eax, 8
je 0x429da6
cmp eax, 0xa
je 0x429dc7
cmp eax, 5
je 0x429ddc
cmp eax, 0xb
je 0x429de8
cmp eax, 0xc
je 0x429e03
mov dword [esi + 8], 1
mov dword [esi], 0
ret
mov eax, dword [edi + 0xc]
dec dword [eax]
mov eax, dword [edi + 0xc]
cmp dword [eax], 0
je 0x409326
push edi
call fcn.004112ef
add esp, 4
mov dword [esi + 0xc], 0
jmp 0x4092c8
mov ecx, dword [edi]
push ecx
call fcn.004112ef
mov edx, dword [edi + 0xc]
push edx
call fcn.004112ef
add esp, 8
jmp 0x409314
add byte [ecx + 0x10e55c0], al
add byte [eax - 0x47], bl
add dword [eax], eax
add byte [eax], al
invalid
jns 0x429deb
add al, ch
or byte [eax], al
add byte [eax], al
fimul dword [ecx + eax]
add byte [edx + 0x50], bl
Function at 0x40b800
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x40b8af
mov eax, dword [esi + 0x18]
push edi
mov edi, ecx
test eax, eax
je 0x40b81d
push eax
call fcn.0040b800
mov eax, dword [esi + 0x1c]
test eax, eax
jne 0x40b8d5
cmp byte [esi + 0x10], 0
jne 0x40b884
mov edi, dword [esi + 0x14]
test edi, edi
je 0x40b884
push ebx
mov ebx, dword [edi + 0xc]
test ebx, ebx
jne 0x40b8b3
mov eax, dword [edi + 8]
pop ebx
cmp eax, 8
je 0x42ba02
cmp eax, 0xa
je 0x42ba23
cmp eax, 5
je 0x40b8f8
cmp eax, 0xb
je 0x42ba38
cmp eax, 0xc
je 0x42ba53
push edi
mov dword [edi + 8], 1
mov dword [edi], 0
call fcn.004112ef
add esp, 4
mov eax, dword [esi + 0xc]
dec dword [eax]
mov ecx, dword [esi + 0xc]
cmp dword [ecx], 0
pop edi
jne 0x40b8a6
mov edx, dword [esi]
push edx
call fcn.004112ef
mov eax, dword [esi + 0xc]
push eax
call fcn.004112ef
add esp, 8
push esi
call fcn.004112ef
add esp, 4
pop esi
ret 4
mov eax, dword [ebx + 0xc]
dec dword [eax]
mov eax, dword [ebx + 0xc]
cmp dword [eax], 0
je 0x40b8e2
push ebx
call fcn.004112ef
add esp, 4
mov dword [edi + 0xc], 0
jmp 0x40b83d
push eax
mov ecx, edi
call fcn.0040b800
jmp 0x40b828
mov ecx, dword [ebx]
push ecx
call fcn.004112ef
mov edx, dword [ebx + 0xc]
push edx
call fcn.004112ef
add esp, 8
jmp 0x40b8c0
mov eax, edi
call fcn.0040e380
jmp 0x40b86e
invalid
jmp dword [esi - 0x77]
inc eax

Function at 0x40b910
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov edi, eax
mov eax, dword [esi + 8]
cmp eax, 1
jne 0x40b99f
mov ecx, dword [edi + 8]
cmp ecx, eax
jne 0x40b967
mov eax, dword [edi]
mov ebx, dword [esi]
lea ebp, [eax + ebx]
cdq
mov ecx, eax
mov edi, edx
mov eax, ebx
cdq
add ecx, eax
adc edi, edx
mov eax, ebp
cdq
cmp eax, ecx
jne 0x42b7cf
cmp edx, edi
jne 0x42b7cf
mov dword [esi], ebp
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x42b7f9
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
cmp ecx, 2
je 0x42b7e0
cmp eax, 3
je case.0x40b9a7.3
mov ecx, esi
call fcn.0040be90
fstp qword [esp + 0x10]
call fcn.004092c0
fld qword [esp + 0x10]
fstp qword [esi]
mov dword [esi + 8], 3
mov ecx, edi
call fcn.0040be90
fadd qword [esi]
fstp qword [esi]
jmp case.0x40b9a7.5
sub eax, 2
cmp eax, 9
ja case.0x40b9a7.5
jmp dword [eax*4 + 0x40b9b0]
inc edx
inc edx
cmp al, 0x5a
int1
cmp eax, 0x81000142
int1
sub bl, byte [ecx - 0x74a70000]
xchg ebp, eax
enter 0xfffffffffffffff8, 0xffffffffffffffff
xchg ebp, eax
xor bh, ah
invalid
idiv bh
push dword [edx - 0x3a]
test dword [ebx + 0x74fffff6], esp