joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1c71690
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov esi, ecx
mov edi, dword [ebp + 0x14]
mov eax, dword [0x1cda44c]
xor eax, ebp
mov dword [esp + 0x68], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
mov dword [esp + 0x64], 0xffffffff
mov dword [esp + 0x60], 0xffffffff
lea ebx, [esp + 0x10]
push 0x73
push str..._.._base_files_file_win.cc
push str.Write
push ebx
call fcn.01c4fd80
add esp, 0x10
lea ecx, [esp + 0x30]
push 0
push ebx
call fcn.01c676b0
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x28], 0
call fcn.01c74680
test al, al
je 0x1c71726
mov eax, edi
sar eax, 0x1f
lea ecx, [esp + 0x28]
push eax
push edi
push esi
push str.File::Write
call fcn.01c74700
pxor xmm0, xmm0
movdqa xmmword [esp + 0x10], xmm0
mov dword [esp + 0x20], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x18], eax
mov dword [esp + 0xc], 0xffffffff
lea eax, [esp + 0xc]
push ebx
push eax
push edi
push dword [ebp + 0x10]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor esi, esi
cmp eax, 1
sbb esi, esi
or esi, dword [esp + 0xc]
lea ecx, [esp + 0x28]
call fcn.01c746e0
lea ecx, [esp + 0x30]
call fcn.01c67720
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.01c92b01
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10

Function at 0x1c717a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, ecx
mov edi, dword [ebp + 0xc]
mov eax, dword [0x1cda44c]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
mov dword [esp + 0x54], 0xffffffff
mov dword [esp + 0x50], 0xffffffff
lea ebx, [esp + 0x10]
push 0x88
push str..._.._base_files_file_win.cc
push str.WriteAtCurrentPos
push ebx
call fcn.01c4fd80
add esp, 0x10
lea ecx, [esp + 0x20]
push 0
push ebx
call fcn.01c676b0
test edi, edi
js 0x1c7186b
mov ebx, dword [ebp + 8]
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x10], 0
call fcn.01c74680
test al, al
je 0x1c7183c
lea ecx, [esp + 0x10]
push 0
push edi
push esi
push str.File::WriteAtCurrentPos
call fcn.01c74700
mov dword [esp + 0xc], 0xffffffff
lea eax, [esp + 0xc]
push 0
push eax
push edi
push ebx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor esi, esi
cmp eax, 1
sbb esi, esi
or esi, dword [esp + 0xc]
lea ecx, [esp + 0x10]
call fcn.01c746e0
jmp 0x1c71870
mov esi, 0xffffffff
lea ecx, [esp + 0x20]
call fcn.01c67720
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.01c92b01
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x1c71940
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov edi, ecx
mov ebx, dword [ebp + 0xc]
mov eax, dword [0x1cda44c]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
mov dword [esp + 0x54], 0xffffffff
mov dword [esp + 0x50], 0xffffffff
lea esi, [esp + 0x10]
push 0x15a
push str..._.._base_files_file_win.cc
push str.DoInitialize
push esi
call fcn.01c4fd80
add esp, 0x10
lea ecx, [esp + 0x20]
push 0
push esi
call fcn.01c676b0
mov eax, ebx
and eax, 1
neg eax
and eax, 3
test bl, 2
mov ecx, 1
cmove ecx, eax
test bl, 4
mov edx, 4
cmovne ecx, edx
test bl, 8
mov esi, 2
cmove esi, ecx
test bl, 0x10
mov eax, 5
cmove eax, esi
test eax, eax
je 0x1c71b0c
mov dword [esp + 4], eax
mov dword [esp + 8], edi
mov ecx, ebx
and ecx, 0x40
shl ecx, 0x18
test bl, bl
cmovns edx, ecx
mov ecx, ebx
rol ecx, 0x1a
mov esi, ebx
shl esi, 0xb
and esi, 0x20000000
mov edi, ebx
shr edi, 4
and edi, 0x10000
and ecx, 0x80000100
or ecx, esi
or ecx, edi
or ecx, edx
mov esi, ebx
shr esi, 8
and esi, 3
mov edx, ebx
shr edx, 0xd
and edx, 4
or edx, esi
mov esi, ebx
and esi, 0x400
mov eax, ebx
mov dword [esp + 0xc], esi
mov ebx, esi
shl ebx, 0x14
mov esi, eax
shr esi, 3
and esi, 0x100
or esi, ebx
mov edi, eax
shr edi, 0xb
and edi, 2
or edi, esi
mov esi, eax
shl esi, 0xd
and esi, 0x4000000
or esi, edi
mov edi, eax
shl edi, 8
mov ebx, edi
and ebx, 0x2000000
or ebx, esi
and edi, 0x8000000
or edi, ebx
mov esi, dword [ebp + 8]
xor edx, 3
cmp byte [esi + 0xb], 0
jns 0x1c71a92
mov esi, dword [esi]
mov ebx, dword [esp + 8]
mov eax, dword [esp + 4]
push 0
push edi
push eax
push 0
push edx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp dword [ebx], eax
je 0x1c71af0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebx]
add eax, 1
cmp eax, 2
jb 0x1c71ad6
call fcn.01c4fdb0
push dword [ebx]
call fcn.01c4fdc0
add esp, 4
mov dword [ebx], 0
mov eax, edi
add eax, 1
cmp eax, 2
jb 0x1c71ae7
mov dword [ebx], edi
call fcn.01c4fdb0
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebx]
add edi, 1
cmp edi, 2
jae 0x1c71b1d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.01c71890
add esp, 4
mov dword [ebx + 0x14], eax
jmp 0x1c71b4e
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [edi + 0x14], 0xffffffff
jmp 0x1c71b4e
mov eax, dword [esp + 0xc]
shr eax, 0xa
mov dword [ebx + 0x14], 0
mov byte [ebx + 0x19], al
mov eax, dword [ebp + 0xc]
test al, 4
jne 0x1c71b3f
test al, 0xa
je 0x1c71b4e
mov byte [ebx + 0x18], 1
jmp 0x1c71b4e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
setne byte [ebx + 0x18]
lea ecx, [esp + 0x20]
call fcn.01c67720
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.01c92b01
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x1c756e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1cf6d88]
mov ecx, dword [0x1cf5970]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c7570b
mov ecx, 0x1cf6d80
pop ebp
jmp fcn.01c66db0
push 0x1cf6d88
call fcn.01c92b47
add esp, 4
cmp dword [0x1cf6d88], 0xffffffff
jne 0x1c75700
mov dword [0x1cf6d84], 0
mov dword [0x1cf6d80], 0
mov ecx, 0x1cf6d80
push 0
call fcn.01c66e20
push 0x1cf6d88
call fcn.01c92bbd
add esp, 4
jmp 0x1c75700

Function at 0x1c76270
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x1cda44c]
xor eax, ebp
mov dword [esp + 0x18], eax
mov edi, dword [ecx + 0x38]
test edi, edi
jne 0x1c76313
mov esi, ecx
mov dword [esp + 0x10], 0
mov byte [esp + 0x13], 9
mov dword [esp + 0xc], 0x65647261
mov dword [esp + 8], 0x63736964
mov word [esp + 0x10], 0x64
push 0x40
call fcn.01c92a8c
add esp, 4
mov ebx, eax
lea eax, [esp + 8]
mov edi, esp
mov ecx, esi
push eax
push edi
call fcn.01c761e0
mov ecx, ebx
push edi
push dword [esi + 0x28]
lea eax, [esp + 0x10]
push eax
call fcn.01c77960
mov edi, dword [esi + 0x38]
mov dword [esi + 0x38], ebx
test edi, edi
je 0x1c762fd
mov ecx, edi
call fcn.01c779b0
push edi
call fcn.01c92abc
add esp, 4
cmp byte [esp + 0x13], 0
jns 0x1c76310
push dword [esp + 8]
call fcn.01c92abc
add esp, 4
mov edi, dword [esi + 0x38]
mov ecx, dword [esp + 0x18]
xor ecx, ebp
call fcn.01c92b01
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1c82c90
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
test ebx, ebx
je 0x1c82d09
mov ecx, dword [ebp + 0xc]
cmp ebx, 1
jne 0x1c82cac
xor esi, esi
jmp 0x1c82cee
and ebx, 0xfffffffe
xor esi, esi
nop word cs:[eax + eax]
nop dword [eax + eax]
movzx edi, al
movzx edx, byte [ecx + esi]
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x1ccb834]
movzx edx, al
movzx edi, byte [ecx + esi + 1]
xor edi, edx
shr eax, 8
xor eax, dword [edi*4 + 0x1ccb834]
add esi, 2
cmp ebx, esi
jne 0x1c82cc0
mov edx, dword [ebp + 0x10]
test dl, 1
je 0x1c82d09
movzx edx, al
movzx ecx, byte [ecx + esi]
xor ecx, edx
shr eax, 8
xor eax, dword [ecx*4 + 0x1ccb834]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1c86d70
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x1cda44c]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
cmp eax, 3
jne 0x1c86e29
mov dword [ebp - 0x14], 0x1c86e50
lea eax, [ebp - 0x14]
push 0
push eax
push 0x1c86d50
push 0x1cf6e40
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x1c86e3d
cmp dword [0x1cf6e44], 0
jne 0x1c86e29
push dword [0x1cf6e48]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x1c86e29
mov esi, eax
push 0x1cf6e4c
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov edi, dword [0x1cf6e50]
mov ebx, dword [0x1cf6e54]
mov eax, dword [0x1cf6e58]
mov dword [ebp - 0x18], eax
push 0x1cf6e4c
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
test edi, edi
je 0x1c86e05
push dword [esi]
call edi
add esp, 4
test ebx, ebx
je 0x1c86e11
push dword [esi + 4]
call ebx
add esp, 4
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1c86e20
push dword [esi + 8]
call eax
add esp, 4
push esi
call fcn.01c86270
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c92b01
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
call fcn.01ca55d7
int3
Function at 0x1cb3fd1
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.01cb421a

Function at 0x1cb7205
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.01cb7210

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x407340
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x15], 0
mov ebx, ecx
mov esi, edi
jne 0x407390
mov eax, dword [esi + 8]
push eax
mov ecx, ebx
call fcn.00407340
mov eax, dword [edi + 0x55]
push ebp
mov ebp, esp
sub esp, 0x4b8
push ebx
push esi
push edi
push eax
push edx
add esp, 4
jmp 0x407379
xor eax, 0x5dfd
jmp 0x407387
xor eax, 0xf61c
pop eax
push ebx
jmp 0x407397
push es
inc edx
dec ebp
inc esp
push eax
inc edx
dec esp
add ebx, 0xd119
pop ebx
invalid
invalid

Function at 0x407360
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x15], 0
mov ebx, ecx
mov esi, edi
jne 0x407390
mov eax, dword [esi + 8]
push eax
mov ecx, ebx
call fcn.00407340
mov eax, dword [edi + 0x55]
push ebp
mov ebp, esp
sub esp, 0x4b8
push ebx
push esi
push edi
push eax
push edx
add esp, 4
jmp 0x407379
xor eax, 0x5dfd
jmp 0x407387
xor eax, 0xf61c
pop eax
push ebx
jmp 0x407397
push es
inc edx
dec ebp
inc esp
push eax
inc edx
dec esp
add ebx, 0xd119
pop ebx
invalid
invalid

Function at 0x4073a0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
add byte [esi - 0x77], ah
test dword [eax - 3], edx
invalid

Function at 0x407400
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
add byte [esi - 0x77], ah
xchg ebp, eax
pushal
std
invalid

Function at 0x407460
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
rol byte [ecx + 0x525e0001], 0x81
ljmp 0xe281

Function at 0x40760e
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x407620
add byte [eax + 0x37], dl
inc ebx
cmp eax, dword [eax + 0x33]
aaa
inc ebp
xor al, byte [ebx + 0x4eb04c4]
cmp byte [eax + 0x4c], dl
dec eax
jmp 0x40762e
pop edx
mov dword [ebp - 0x6c], 0
jmp 0x4079c7
cmp dword [ebp - 0x6c], 0
jne 0x40867c
push ebx
and ebx, 0x12798
call fcn.004079e5
add byte [ebp + 0x48], al

Function at 0x407620
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x407620
add byte [eax + 0x37], dl
inc ebx
cmp eax, dword [eax + 0x33]
aaa
inc ebp
xor al, byte [ebx + 0x4eb04c4]
cmp byte [eax + 0x4c], dl
dec eax
jmp 0x40762e
pop edx
mov dword [ebp - 0x6c], 0
jmp 0x4079c7
cmp dword [ebp - 0x6c], 0
jne 0x40867c
push ebx
and ebx, 0x12798
call fcn.004079e5
add byte [ebp + 0x48], al

Function at 0x4076a8
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edx
push esi
and esi, 0x6c2c
xor esi, 0xd5c1
pop esi
mov dword [ebp - 0x6c], 0
jmp 0x4079c7
Function at 0x409928
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop eax
push eax
push esi
add esp, 4
and eax, 0x9921
sub eax, 0x16c82
pop eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0x224], 4
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0x1a4]
mov dword [ebp - 0x2e0], eax
push edx
push eax
add esp, 4
call 0x409977
add byte [esi], dh
dec edi
cmp dword [eax + 0x4e], eax
inc eax
add esp, 4
jmp 0x40997f
add edx, 0xc18d
or edx, 0x2179
pop edx
push ecx
push ecx
add esp, 4
sub ecx, 0x7d49
pop ecx
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x1a0], ecx
push edi
push edx
add esp, 4
or edi, 0x63bb
pop edi
push ebx
add ebx, 0x60
or ebx, 0xcf7e
xor ebx, 0x8345
xor ebx, 0xb76f
pop ebx
push edx
push edx
add esp, 4
or edx, 0xcf09
pop edx
mov edx, dword [ebp - 0x2e0]
mov dword [ebp - 0x19c], edx
mov dword [ebp - 0x228], 0
push ebx
push edx
add esp, 4
call 0x4099fd
add byte [0x43434144], dh
inc edi
cmp eax, 0xc483413c
add al, 0x81
retf

Function at 0x409977
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop eax
push eax
push esi
add esp, 4
and eax, 0x9921
sub eax, 0x16c82
pop eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0x224], 4
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0x1a4]
mov dword [ebp - 0x2e0], eax
push edx
push eax
add esp, 4
call 0x409977
add byte [esi], dh
dec edi
cmp dword [eax + 0x4e], eax
inc eax
add esp, 4
jmp 0x40997f
add edx, 0xc18d
or edx, 0x2179
pop edx
push ecx
push ecx
add esp, 4
sub ecx, 0x7d49
pop ecx
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x1a0], ecx
push edi
push edx
add esp, 4
or edi, 0x63bb
pop edi
push ebx
add ebx, 0x60
or ebx, 0xcf7e
xor ebx, 0x8345
xor ebx, 0xb76f
pop ebx
push edx
push edx
add esp, 4
or edx, 0xcf09
pop edx
mov edx, dword [ebp - 0x2e0]
mov dword [ebp - 0x19c], edx
mov dword [ebp - 0x228], 0
push ebx
push edx
add esp, 4
call 0x4099fd
add byte [0x43434144], dh
inc edi
cmp eax, 0xc483413c
add al, 0x81
retf

Function at 0x4099fd
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop eax
push eax
push esi
add esp, 4
and eax, 0x9921
sub eax, 0x16c82
pop eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0x224], 4
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0x1a4]
mov dword [ebp - 0x2e0], eax
push edx
push eax
add esp, 4
call 0x409977
add byte [esi], dh
dec edi
cmp dword [eax + 0x4e], eax
inc eax
add esp, 4
jmp 0x40997f
add edx, 0xc18d
or edx, 0x2179
pop edx
push ecx
push ecx
add esp, 4
sub ecx, 0x7d49
pop ecx
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x1a0], ecx
push edi
push edx
add esp, 4
or edi, 0x63bb
pop edi
push ebx
add ebx, 0x60
or ebx, 0xcf7e
xor ebx, 0x8345
xor ebx, 0xb76f
pop ebx
push edx
push edx
add esp, 4
or edx, 0xcf09
pop edx
mov edx, dword [ebp - 0x2e0]
mov dword [ebp - 0x19c], edx
mov dword [ebp - 0x228], 0
push ebx
push edx
add esp, 4
call 0x4099fd
add byte [0x43434144], dh
inc edi
cmp eax, 0xc483413c
add al, 0x81
retf
Function at 0x409ae6
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or ebx, 0x2b65
pop ebx
mov eax, dword [ebp - 0x1a0]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x19c]
movzx eax, byte [edx]
cmp ecx, eax
jle 0x409b12
mov dword [ebp - 0x2e4], 1
jmp 0x409b1c
mov dword [ebp - 0x2e4], 0xffffffff
mov ecx, dword [ebp - 0x2e4]
mov dword [ebp - 0x228], ecx
jmp 0x409bc3
push ecx
jmp 0x409bcd
or ecx, 0x10a5b
pop ecx
push ecx
add ecx, 0x1f0c
jmp 0x409be2
pop ecx
push ebx
push ecx
add esp, 4
sub ebx, 0x166c7
or ebx, 0x7c45
pop ebx
mov edx, dword [ebp - 0x228]
mov dword [ebp - 0x2e8], edx
cmp dword [ebp - 0x2e8], 0
je 0x409c7c
push edx
or edx, 0xe15
call 0x409c1e
add byte [edx], bh
inc ecx
aas
dec ecx
inc eax
inc eax
inc ecx
add esp, 4
pop edx
push ebx
xor ebx, 0xaef2
or ebx, 0x5b5a
pop ebx
push ebx
push eax
add esp, 4
jmp 0x409c3b
pop ebx
mov eax, dword [ebp - 0x34]
add eax, 1
mov dword [ebp - 0x34], eax
push eax
push edi
add esp, 4
call 0x409c5a
add byte [edx], dh
dec esi
dec ebx
xor al, 0x38
dec esp
inc ebx
inc esp
inc ecx
add esp, 4
and eax, 0xb24a
call 0x409c73
add byte [edi], bh
xor al, 0x37
cmp bh, byte [ebx]
dec ebx
dec edi
inc ecx
push eax
cmp byte [ebx - 0x16a7fb3c], al
retf
push edx
sub edx, 0xfd4a
or edx, 0xb2f
call 0x409c99
add byte [ebp + 0x4a], al
cmp edi, dword [edi]
inc esi
cmp eax, dword [ebp + 0x3f]
inc ebp
cmp al, 0x83
les eax, [ecx + eax*4]
retf 0x235

Function at 0x409c99
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or ebx, 0x2b65
pop ebx
mov eax, dword [ebp - 0x1a0]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x19c]
movzx eax, byte [edx]
cmp ecx, eax
jle 0x409b12
mov dword [ebp - 0x2e4], 1
jmp 0x409b1c
mov dword [ebp - 0x2e4], 0xffffffff
mov ecx, dword [ebp - 0x2e4]
mov dword [ebp - 0x228], ecx
jmp 0x409bc3
push ecx
jmp 0x409bcd
or ecx, 0x10a5b
pop ecx
push ecx
add ecx, 0x1f0c
jmp 0x409be2
pop ecx
push ebx
push ecx
add esp, 4
sub ebx, 0x166c7
or ebx, 0x7c45
pop ebx
mov edx, dword [ebp - 0x228]
mov dword [ebp - 0x2e8], edx
cmp dword [ebp - 0x2e8], 0
je 0x409c7c
push edx
or edx, 0xe15
call 0x409c1e
add byte [edx], bh
inc ecx
aas
dec ecx
inc eax
inc eax
inc ecx
add esp, 4
pop edx
push ebx
xor ebx, 0xaef2
or ebx, 0x5b5a
pop ebx
push ebx
push eax
add esp, 4
jmp 0x409c3b
pop ebx
mov eax, dword [ebp - 0x34]
add eax, 1
mov dword [ebp - 0x34], eax
push eax
push edi
add esp, 4
call 0x409c5a
add byte [edx], dh
dec esi
dec ebx
xor al, 0x38
dec esp
inc ebx
inc esp
inc ecx
add esp, 4
and eax, 0xb24a
call 0x409c73
add byte [edi], bh
xor al, 0x37
cmp bh, byte [ebx]
dec ebx
dec edi
inc ecx
push eax
cmp byte [ebx - 0x16a7fb3c], al
retf
push edx
sub edx, 0xfd4a
or edx, 0xb2f
call 0x409c99
add byte [ebp + 0x4a], al
cmp edi, dword [edi]
inc esi
cmp eax, dword [ebp + 0x3f]
inc ebp
cmp al, 0x83
les eax, [ecx + eax*4]
retf 0x235
Function at 0x409ff9
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor esi, 0x7219
pop esi
xor eax, eax
mov word [ebp - 0x60], ax
xor ecx, ecx
mov word [ebp - 0x14], cx
push esi
push ebx
add esp, 4
jmp 0x40a01a
pop esi
push ecx
push esi
add esp, 4
and ecx, 0xa6a1
add ecx, 0x15529
pop ecx
push eax
xor eax, 0x16ae9
pop eax
push edx
push ebx
add esp, 4
or edx, 0xda1c
pop edx
mov edx, dword [ebp - 0x230]
mov ax, word [edx]
mov word [ebp - 0x1ca], ax
mov ecx, dword [ebp - 0x230]
add ecx, 2
mov dword [ebp - 0x230], ecx
mov dx, word [ebp - 0x1ca]
mov word [ebp - 0x60], dx
push esi
or esi, 0xc561
pop esi
push edx
add edx, 0x2ff2
pop edx
push edi
push ebx
add esp, 4
or edi, 0x28ad
jmp 0x40a08f
and edi, 0xb266
jmp 0x40a09c
pop edi
mov eax, dword [ebp - 0x234]
mov cx, word [eax]
mov word [ebp - 0x1cc], cx
mov edx, dword [ebp - 0x234]
add edx, 2
mov dword [ebp - 0x234], edx
mov ax, word [ebp - 0x1cc]
mov word [ebp - 0x14], ax
push ecx
push ebx
add esp, 4
sub ecx, 0xaf3d
or ecx, 0x8425
pop ecx
push edi
jmp 0x40a0e3
call 0x40a0ef
add byte [ebx], bh
inc esp
aaa
dec ebp
xor eax, 0x4c48340
add edi, 0x3c92
pop edi
movzx ecx, word [ebp - 0x14]
test ecx, ecx
jne 0x40a116
movzx edx, word [ebp - 0x60]
movzx eax, word [ebp - 0x14]
sub edx, eax
mov dword [ebp - 0x2f4], edx
jmp 0x40a199
movzx ecx, word [ebp - 0x60]
movzx edx, word [ebp - 0x14]
cmp ecx, edx
je 0x40a00f
movzx eax, word [ebp - 0x60]
xor eax, 0x20
movzx ecx, word [ebp - 0x14]
cmp eax, ecx
je 0x40a00f
push esi
jmp 0x40a143
jmp 0x40a14b
pop esi
push esi
push esi
add esp, 4
add esi, 0xc59a
sub esi, 0x14021
pop esi
push ecx
sub ecx, 0x109a7
jmp 0x40a16a
pop ecx
movzx edx, word [ebp - 0x60]
movzx eax, word [ebp - 0x14]
cmp edx, eax
jge 0x40a183
mov dword [ebp - 0x2f0], 0xffffffff
jmp 0x40a18d
mov dword [ebp - 0x2f0], 1
mov ecx, dword [ebp - 0x2f0]
mov dword [ebp - 0x2f4], ecx
cmp dword [ebp - 0x2f4], 0
jne 0x40a1e2
push edx
push ecx
add esp, 4
call 0x40a1b6
add byte [edi], dh
dec edi
inc ebp
xor cl, byte [edi + 0x32]
cmp dh, byte [ecx + edi]
add esp, 4
pop edx
push edx
or edx, 0x8618
call 0x40a1d0
add byte [esi], bh
inc ebp
cmp al, 0x34
inc esp
cmp byte [esp + esi + 0x3f], cl
add esp, 4
pop edx
mov edx, dword [ebp - 0xa0]
mov dword [ebp - 0x70], edx
jmp 0x40a279
mov eax, dword [ebp - 0xa0]
mov ecx, dword [eax]
mov dword [ebp - 0xa0], ecx
push edx
push ebx
add esp, 4
and edx, 0x131dd
pop edx
push edi
push esi
add esp, 4
call 0x40a20f
add byte [edi], bh
inc ebp
inc ebp
dec ecx
xor al, 0x4b
inc esp
dec edx
add esp, 4
call 0x40a21e
add byte [ecx], bh
xor al, 0x35
aas
dec eax
xor eax, dword [ebx - 0x74a0fb3c]
xchg ebp, eax
pushal
invalid