joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4927a4
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4927d2
mov eax, ebx
call fcn.00493258
cmp dword [ebx + 0x40], 0
je 0x4927cb
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x492843
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x492835
cmp dword [ebx + 8], 0
je 0x4927f4
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x492806
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x492835
cmp dword [ebx + 8], 0
je 0x4927e7
cmp eax, 3
je 0x492819
dec eax
jne 0x4927e7
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4927e7
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4927e7
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x492861
cmp dword [ebx + 0x14], 0xcc
je 0x492861
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0049286c
pop ebx
ret

Function at 0x4a3304
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4a3395
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0x10
mov eax, dword [ebp - 4]
call fcn.00402b34
mov ebx, eax
lea eax, [ebp - 4]
push eax
push ebx
call sub.kernel32.dll_GetComputerNameA
test eax, eax
jne 0x4a3356
mov ecx, 0x4a33ac
mov dl, 1
mov eax, dword [0x4081b4]
call fcn.0040d208
call fcn.00404490
push esi
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00404c90
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, 1
call fcn.00404fb8
mov eax, esi
call fcn.00404fa8
mov eax, ebx
call fcn.00402b64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a339c
lea eax, [ebp - 8]
call fcn.00404a98
ret
Function at 0x4a35d8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404f48
xor eax, eax
push ebp
push 0x4a369a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040352c
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 0x41
test bl, bl
je 0x4a3623
mov word [ebp - 0x18], 0
jmp 0x4a3629
mov word [ebp - 0x18], 1
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0x20
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404f58
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x4a3684
jmp 0x4a366c
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x4a8d7c]
mov eax, dword [eax]
call fcn.0045f190
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
test eax, eax
jne 0x4a3659
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a36a1
lea eax, [ebp - 4]
call fcn.00404a98
ret

Function at 0x4a4260
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x104], eax
xor eax, eax
push ebp
push 0x4a4352
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
xor edx, edx
mov eax, 0x4a436c
call fcn.004a3f30
mov dl, 1
mov eax, dword [0x41ac2c]
call fcn.00403cc0
mov esi, eax
push 0
mov eax, dword [0x4a8d7c]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_GetWindow
mov ebx, eax
test ebx, ebx
je 0x4a4326
push 0xff
lea eax, [ebp - 0x100]
push eax
push ebx
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 0x104]
lea edx, [ebp - 0x100]
mov ecx, pe_nt_image_headers32
call fcn.00404d08
mov eax, dword [ebp - 0x104]
call fcn.004a3288
test al, al
jne 0x4a4318
lea eax, [ebp - 0x108]
lea edx, [ebp - 0x100]
mov ecx, pe_nt_image_headers32
call fcn.00404d08
mov edx, dword [ebp - 0x108]
mov ecx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x3c]
push 2
push ebx
call sub.user32.dll_GetWindow
mov ebx, eax
test ebx, ebx
jne 0x4a42bc
xor ecx, ecx
xor edx, edx
mov eax, 0x4a4394
call fcn.004a3f30
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a4359
lea eax, [ebp - 0x108]
mov edx, 2
call fcn.00404abc
ret
Function at 0x40c050
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, eax
mov eax, dword [edi]
test eax, eax
je 0x40c099
mov ecx, dword [ebp + 8]
xor eax, eax
mov edx, ebx
test ebx, ebx
jle 0x40c08e
nop
movzx esi, byte [ecx]
movzx esi, byte [esi + 0x4b1fe0]
lea ebx, [eax*8]
xor esi, ebx
dec edx
xor eax, esi
inc ecx
test edx, edx
jg 0x40c070
mov ebx, dword [ebp + 0xc]
xor edx, edx
div dword [edi]
mov esi, edx
mov dword [ebp - 4], esi
jmp 0x40c0a3
mov dword [ebp - 4], 0
mov esi, dword [ebp - 4]
mov eax, dword [ebp + 8]
push ebx
push eax
mov edx, esi
mov eax, edi
call fcn.0040bef0
add esp, 8
test eax, eax
je 0x40c0e6
mov ecx, dword [ebp + 0x10]
mov ebx, dword [eax + 8]
test ecx, ecx
jne 0x40c0d4
mov edx, esi
mov ecx, edi
call fcn.0040bf90
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [eax + 8], ecx
mov ecx, dword [ebp + 8]
mov dword [eax + 0xc], ecx
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0x10], 0
je 0x40c17a
push 0x14
call fcn.00408240
mov esi, eax
mov eax, dword [ebp + 0x10]
add esp, 4
test esi, esi
je 0x40c17c
mov edx, dword [ebp + 8]
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], ebx
mov dword [esi + 8], eax
inc dword [edi + 4]
mov eax, dword [edi + 4]
cmp eax, 0xa
jb 0x40c144
mov ecx, dword [edi]
add ecx, ecx
cmp eax, ecx
jbe 0x40c144
lea edx, [eax + eax]
push edx
push edi
call fcn.0040bda0
add esp, 8
test eax, eax
je 0x40c144
mov edx, dword [ebp + 8]
mov ecx, ebx
call fcn.0040bd10
xor edx, edx
div dword [edi]
mov dword [ebp - 4], edx
mov eax, dword [edi + 0xc]
test eax, eax
je 0x40c161
mov ecx, dword [ebp - 4]
lea edx, [eax + ecx*8]
mov eax, esi
call fcn.0040bd40
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [edi + 8]
mov dword [esi], edx
mov eax, dword [edi + 8]
test eax, eax
je 0x40c170
mov dword [eax + 4], esi
mov dword [esi + 4], 0
mov dword [edi + 8], esi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x414770
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1fbc
push ebx
push esi
push edi
push edx
or edx, 0x51b0
jmp 0x414788
call fcn.00414796
add byte [esi], dh
xor al, 0x3e
inc esi
inc edx
inc eax
inc ebx
dec esp
Function at 0x414796
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edx
push esi
push ecx
add esp, 4
jmp 0x4147a6
jmp 0x4147ad
pop esi
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
mov word [ebp - 0x1ee4], dx
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push ecx
add ecx, 0xc252
xor ecx, 0x14a71
and ecx, 0x8d5c
sub ecx, 0xdd5a
pop ecx
push edi
push edi
add esp, 4
or edi, 0x8219
xor edi, 0x1440d
add edi, 0x10ad0
pop edi
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push edi
add edi, 0x606
add edi, 0xf138
xor edi, 0x33bb
pop edi
push ebx
or ebx, 0x11df8
call 0x4148f2
add byte [eax], bh
inc ecx
dec ebp
inc eax
inc edi
inc edx
aaa
add esp, 4
xor ebx, 0x9ebb
pop ebx
mov dword [ebp - 0x10], 1
push eax
or eax, 0x11002
call 0x414919
add byte [eax + 0x41], al
aaa
aas
inc eax
dec eax
inc esi
dec esp
add esp, 4
and eax, 0xa09f
pop eax
push eax
push edi
add esp, 4
add eax, 0x165c3
sub eax, 0x14d8
pop eax
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push ebx
jmp 0x41496b
call 0x414977
add byte [esi + 0x44], al
dec ebp
dec ecx
inc ebx
aas
add esp, 4
pop ebx
push ebx
add ebx, 0x399e
call 0x41498f
add byte [ebp + 0x4c], cl
xor al, 0x38
cmp al, 0x36
aaa
add esp, 4
pop ebx
push edi
push ebx
add esp, 4
sub edi, 0x146f6
pop edi
push ebx
sub ebx, 0x35e2
xor ebx, 0xc379
pop ebx
push ecx
push eax
add esp, 4
sub ecx, 0x4fc5
add ecx, 0x14a16
or ecx, 0x173c0
pop ecx
mov dword [ebp - 0x2c], 1
push edi
add edi, 0x13a6b
and edi, 0xf9f6
call 0x4149e5
add byte [esi + 0x32], al
aaa
dec ebx
cmp al, 0x41
add esp, 4
jmp 0x4149ef
pop edi
push ebx
xor ebx, 0x1179c
and ebx, 0x2e21
pop ebx
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x138
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x414bdf
Function at 0x4148f2
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edx
push esi
push ecx
add esp, 4
jmp 0x4147a6
jmp 0x4147ad
pop esi
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
mov word [ebp - 0x1ee4], dx
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push ecx
add ecx, 0xc252
xor ecx, 0x14a71
and ecx, 0x8d5c
sub ecx, 0xdd5a
pop ecx
push edi
push edi
add esp, 4
or edi, 0x8219
xor edi, 0x1440d
add edi, 0x10ad0
pop edi
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push edi
add edi, 0x606
add edi, 0xf138
xor edi, 0x33bb
pop edi
push ebx
or ebx, 0x11df8
call 0x4148f2
add byte [eax], bh
inc ecx
dec ebp
inc eax
inc edi
inc edx
aaa
add esp, 4
xor ebx, 0x9ebb
pop ebx
mov dword [ebp - 0x10], 1
push eax
or eax, 0x11002
call 0x414919
add byte [eax + 0x41], al
aaa
aas
inc eax
dec eax
inc esi
dec esp
add esp, 4
and eax, 0xa09f
pop eax
push eax
push edi
add esp, 4
add eax, 0x165c3
sub eax, 0x14d8
pop eax
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push ebx
jmp 0x41496b
call 0x414977
add byte [esi + 0x44], al
dec ebp
dec ecx
inc ebx
aas
add esp, 4
pop ebx
push ebx
add ebx, 0x399e
call 0x41498f
add byte [ebp + 0x4c], cl
xor al, 0x38
cmp al, 0x36
aaa
add esp, 4
pop ebx
push edi
push ebx
add esp, 4
sub edi, 0x146f6
pop edi
push ebx
sub ebx, 0x35e2
xor ebx, 0xc379
pop ebx
push ecx
push eax
add esp, 4
sub ecx, 0x4fc5
add ecx, 0x14a16
or ecx, 0x173c0
pop ecx
mov dword [ebp - 0x2c], 1
push edi
add edi, 0x13a6b
and edi, 0xf9f6
call 0x4149e5
add byte [esi + 0x32], al
aaa
dec ebx
cmp al, 0x41
add esp, 4
jmp 0x4149ef
pop edi
push ebx
xor ebx, 0x1179c
and ebx, 0x2e21
pop ebx
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x138
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x414bdf
Function at 0x414919
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edx
push esi
push ecx
add esp, 4
jmp 0x4147a6
jmp 0x4147ad
pop esi
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
mov word [ebp - 0x1ee4], dx
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push ecx
add ecx, 0xc252
xor ecx, 0x14a71
and ecx, 0x8d5c
sub ecx, 0xdd5a
pop ecx
push edi
push edi
add esp, 4
or edi, 0x8219
xor edi, 0x1440d
add edi, 0x10ad0
pop edi
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push edi
add edi, 0x606
add edi, 0xf138
xor edi, 0x33bb
pop edi
push ebx
or ebx, 0x11df8
call 0x4148f2
add byte [eax], bh
inc ecx
dec ebp
inc eax
inc edi
inc edx
aaa
add esp, 4
xor ebx, 0x9ebb
pop ebx
mov dword [ebp - 0x10], 1
push eax
or eax, 0x11002
call 0x414919
add byte [eax + 0x41], al
aaa
aas
inc eax
dec eax
inc esi
dec esp
add esp, 4
and eax, 0xa09f
pop eax
push eax
push edi
add esp, 4
add eax, 0x165c3
sub eax, 0x14d8
pop eax
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push ebx
jmp 0x41496b
call 0x414977
add byte [esi + 0x44], al
dec ebp
dec ecx
inc ebx
aas
add esp, 4
pop ebx
push ebx
add ebx, 0x399e
call 0x41498f
add byte [ebp + 0x4c], cl
xor al, 0x38
cmp al, 0x36
aaa
add esp, 4
pop ebx
push edi
push ebx
add esp, 4
sub edi, 0x146f6
pop edi
push ebx
sub ebx, 0x35e2
xor ebx, 0xc379
pop ebx
push ecx
push eax
add esp, 4
sub ecx, 0x4fc5
add ecx, 0x14a16
or ecx, 0x173c0
pop ecx
mov dword [ebp - 0x2c], 1
push edi
add edi, 0x13a6b
and edi, 0xf9f6
call 0x4149e5
add byte [esi + 0x32], al
aaa
dec ebx
cmp al, 0x41
add esp, 4
jmp 0x4149ef
pop edi
push ebx
xor ebx, 0x1179c
and ebx, 0x2e21
pop ebx
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x138
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x414bdf
Function at 0x414977
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edx
push esi
push ecx
add esp, 4
jmp 0x4147a6
jmp 0x4147ad
pop esi
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
mov word [ebp - 0x1ee4], dx
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push ecx
add ecx, 0xc252
xor ecx, 0x14a71
and ecx, 0x8d5c
sub ecx, 0xdd5a
pop ecx
push edi
push edi
add esp, 4
or edi, 0x8219
xor edi, 0x1440d
add edi, 0x10ad0
pop edi
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push edi
add edi, 0x606
add edi, 0xf138
xor edi, 0x33bb
pop edi
push ebx
or ebx, 0x11df8
call 0x4148f2
add byte [eax], bh
inc ecx
dec ebp
inc eax
inc edi
inc edx
aaa
add esp, 4
xor ebx, 0x9ebb
pop ebx
mov dword [ebp - 0x10], 1
push eax
or eax, 0x11002
call 0x414919
add byte [eax + 0x41], al
aaa
aas
inc eax
dec eax
inc esi
dec esp
add esp, 4
and eax, 0xa09f
pop eax
push eax
push edi
add esp, 4
add eax, 0x165c3
sub eax, 0x14d8
pop eax
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push ebx
jmp 0x41496b
call 0x414977
add byte [esi + 0x44], al
dec ebp
dec ecx
inc ebx
aas
add esp, 4
pop ebx
push ebx
add ebx, 0x399e
call 0x41498f
add byte [ebp + 0x4c], cl
xor al, 0x38
cmp al, 0x36
aaa
add esp, 4
pop ebx
push edi
push ebx
add esp, 4
sub edi, 0x146f6
pop edi
push ebx
sub ebx, 0x35e2
xor ebx, 0xc379
pop ebx
push ecx
push eax
add esp, 4
sub ecx, 0x4fc5
add ecx, 0x14a16
or ecx, 0x173c0
pop ecx
mov dword [ebp - 0x2c], 1
push edi
add edi, 0x13a6b
and edi, 0xf9f6
call 0x4149e5
add byte [esi + 0x32], al
aaa
dec ebx
cmp al, 0x41
add esp, 4
jmp 0x4149ef
pop edi
push ebx
xor ebx, 0x1179c
and ebx, 0x2e21
pop ebx
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x138
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x414bdf
Function at 0x41498f
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edx
push esi
push ecx
add esp, 4
jmp 0x4147a6
jmp 0x4147ad
pop esi
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
mov word [ebp - 0x1ee4], dx
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push ecx
add ecx, 0xc252
xor ecx, 0x14a71
and ecx, 0x8d5c
sub ecx, 0xdd5a
pop ecx
push edi
push edi
add esp, 4
or edi, 0x8219
xor edi, 0x1440d
add edi, 0x10ad0
pop edi
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push edi
add edi, 0x606
add edi, 0xf138
xor edi, 0x33bb
pop edi
push ebx
or ebx, 0x11df8
call 0x4148f2
add byte [eax], bh
inc ecx
dec ebp
inc eax
inc edi
inc edx
aaa
add esp, 4
xor ebx, 0x9ebb
pop ebx
mov dword [ebp - 0x10], 1
push eax
or eax, 0x11002
call 0x414919
add byte [eax + 0x41], al
aaa
aas
inc eax
dec eax
inc esi
dec esp
add esp, 4
and eax, 0xa09f
pop eax
push eax
push edi
add esp, 4
add eax, 0x165c3
sub eax, 0x14d8
pop eax
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push ebx
jmp 0x41496b
call 0x414977
add byte [esi + 0x44], al
dec ebp
dec ecx
inc ebx
aas
add esp, 4
pop ebx
push ebx
add ebx, 0x399e
call 0x41498f
add byte [ebp + 0x4c], cl
xor al, 0x38
cmp al, 0x36
aaa
add esp, 4
pop ebx
push edi
push ebx
add esp, 4
sub edi, 0x146f6
pop edi
push ebx
sub ebx, 0x35e2
xor ebx, 0xc379
pop ebx
push ecx
push eax
add esp, 4
sub ecx, 0x4fc5
add ecx, 0x14a16
or ecx, 0x173c0
pop ecx
mov dword [ebp - 0x2c], 1
push edi
add edi, 0x13a6b
and edi, 0xf9f6
call 0x4149e5
add byte [esi + 0x32], al
aaa
dec ebx
cmp al, 0x41
add esp, 4
jmp 0x4149ef
pop edi
push ebx
xor ebx, 0x1179c
and ebx, 0x2e21
pop ebx
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x138
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x414bdf
Function at 0x4149e5
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edx
push esi
push ecx
add esp, 4
jmp 0x4147a6
jmp 0x4147ad
pop esi
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
mov word [ebp - 0x1ee4], dx
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push ecx
add ecx, 0xc252
xor ecx, 0x14a71
and ecx, 0x8d5c
sub ecx, 0xdd5a
pop ecx
push edi
push edi
add esp, 4
or edi, 0x8219
xor edi, 0x1440d
add edi, 0x10ad0
pop edi
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push edi
add edi, 0x606
add edi, 0xf138
xor edi, 0x33bb
pop edi
push ebx
or ebx, 0x11df8
call 0x4148f2
add byte [eax], bh
inc ecx
dec ebp
inc eax
inc edi
inc edx
aaa
add esp, 4
xor ebx, 0x9ebb
pop ebx
mov dword [ebp - 0x10], 1
push eax
or eax, 0x11002
call 0x414919
add byte [eax + 0x41], al
aaa
aas
inc eax
dec eax
inc esi
dec esp
add esp, 4
and eax, 0xa09f
pop eax
push eax
push edi
add esp, 4
add eax, 0x165c3
sub eax, 0x14d8
pop eax
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push ebx
jmp 0x41496b
call 0x414977
add byte [esi + 0x44], al
dec ebp
dec ecx
inc ebx
aas
add esp, 4
pop ebx
push ebx
add ebx, 0x399e
call 0x41498f
add byte [ebp + 0x4c], cl
xor al, 0x38
cmp al, 0x36
aaa
add esp, 4
pop ebx
push edi
push ebx
add esp, 4
sub edi, 0x146f6
pop edi
push ebx
sub ebx, 0x35e2
xor ebx, 0xc379
pop ebx
push ecx
push eax
add esp, 4
sub ecx, 0x4fc5
add ecx, 0x14a16
or ecx, 0x173c0
pop ecx
mov dword [ebp - 0x2c], 1
push edi
add edi, 0x13a6b
and edi, 0xf9f6
call 0x4149e5
add byte [esi + 0x32], al
aaa
dec ebx
cmp al, 0x41
add esp, 4
jmp 0x4149ef
pop edi
push ebx
xor ebx, 0x1179c
and ebx, 0x2e21
pop ebx
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x138
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x414bdf