joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405f21
Capabilities:
Get number of processors
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x4d0]
add edx, 1
mov dword [ebp - 0x4d0], edx
push ecx
call 0x405ddd
add byte [edx], dh
xor al, 0x4d
cmp byte [ebx + 0x47], cl
add esp, 4
pop ecx
push ebx
jmp 0x405de8
xor ebx, 0x16c06
and ebx, 0x10b4
pop ebx
push esi
push esi
add esp, 4
add esi, 0x1599b
pop esi
mov eax, dword [ebp - 0x4d0]
sub eax, dword [ebp - 0x3b8]
cmp eax, 0xffffffff
jb 0x405e49
push ecx
or ecx, 0x88f4
call 0x405e27
add byte [ecx + 0x42], cl
inc edx
inc eax
aas
dec eax
push eax
add esp, 4
sub ecx, 0xdd40
pop ecx
push eax
push edx
add esp, 4
add eax, 0xf2e3
jmp 0x405e43
pop eax
jmp 0x406077
mov dword [ebp - 0xc34], 7
mov ecx, dword [ebp - 0x4d0]
mov dword [ebp - 0xa8c], ecx
push esi
sub esi, 0x11b46
pop esi
push eax
push ebx
add esp, 4
jmp 0x405e71
sub eax, 0xe164
xor eax, 0x135d4
pop eax
push ebx
jmp 0x405e85
pop ebx
push edx
jmp 0x405e90
pop edx
mov edx, dword [ebp - 0x154c]
mov dword [ebp - 0xa88], edx
mov dword [ebp - 0xc38], 0
mov eax, dword [ebp - 0x4d0]
cmp eax, dword [ebp - 0x154c]
jne 0x405ef8
push esi
push edi
add esp, 4
jmp 0x405ebf
or esi, 0x14c45
pop esi
push edi
push edx
add esp, 4
jmp 0x405ed4
and edi, 0xe023
pop edi
push esi
push eax
add esp, 4
sub esi, 0x38a
pop esi
mov ecx, dword [ebp - 0xc38]
mov dword [ebp - 0x1554], ecx
jmp 0x406029
cmp dword [ebp - 0xc34], 0
jle 0x40601d
push ecx
and ecx, 0x15e34
pop ecx
push edi
xor edi, 0xb870
call 0x405f21
add byte [ebx], bh
inc eax
inc edi
dec ebx
dec ebp
xor al, 0x3c
add esp, 4
pop edi
push eax
push esi
add esp, 4
and eax, 0xa169
push edi
or edi, 0x6fc7
pop edi
push eax
or eax, 0xe9e7
and eax, 0x11737
and eax, 0x1761c
sbb al, 0x76
add dword [eax], eax
sbb al, 0x76
add dword [eax], eax
pop eax
push ebx
xor ebx, 0xbce9
jmp 0x405fe4
and ebx, 0x77f4
pop ebx
mov edx, dword [ebp - 0xc34]
inc dword [ebx - 0x6a76fe16]
int3
invalid
invalid
dec dword [ebx - 0xa8b7b]
inc dword [ebx - 0x7a76fe40]
je 0x405ffc
invalid
invalid
invalid
invalid
invalid

Function at 0x405f30
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add eax, 0xf0d6
pop eax
mov edx, dword [ebp - 0xa8c]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0xa88]
movzx edx, byte [ecx]
cmp eax, edx
je 0x405fb9
push esi
push edx
add esp, 4
invalid
invalid
Function at 0x405fd0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x4d0]
add edx, 1
mov dword [ebp - 0x4d0], edx
push ecx
call 0x405ddd
add byte [edx], dh
xor al, 0x4d
cmp byte [ebx + 0x47], cl
add esp, 4
pop ecx
push ebx
jmp 0x405de8
xor ebx, 0x16c06
and ebx, 0x10b4
pop ebx
push esi
push esi
add esp, 4
add esi, 0x1599b
pop esi
mov eax, dword [ebp - 0x4d0]
sub eax, dword [ebp - 0x3b8]
cmp eax, 0xffffffff
jb 0x405e49
push ecx
or ecx, 0x88f4
call 0x405e27
add byte [ecx + 0x42], cl
inc edx
inc eax
aas
dec eax
push eax
add esp, 4
sub ecx, 0xdd40
pop ecx
push eax
push edx
add esp, 4
add eax, 0xf2e3
jmp 0x405e43
pop eax
jmp 0x406077
mov dword [ebp - 0xc34], 7
mov ecx, dword [ebp - 0x4d0]
mov dword [ebp - 0xa8c], ecx
push esi
sub esi, 0x11b46
pop esi
push eax
push ebx
add esp, 4
jmp 0x405e71
sub eax, 0xe164
xor eax, 0x135d4
pop eax
push ebx
jmp 0x405e85
pop ebx
push edx
jmp 0x405e90
pop edx
mov edx, dword [ebp - 0x154c]
mov dword [ebp - 0xa88], edx
mov dword [ebp - 0xc38], 0
mov eax, dword [ebp - 0x4d0]
cmp eax, dword [ebp - 0x154c]
jne 0x405ef8
push esi
push edi
add esp, 4
jmp 0x405ebf
or esi, 0x14c45
pop esi
push edi
push edx
add esp, 4
jmp 0x405ed4
and edi, 0xe023
pop edi
push esi
push eax
add esp, 4
sub esi, 0x38a
pop esi
mov ecx, dword [ebp - 0xc38]
mov dword [ebp - 0x1554], ecx
jmp 0x406029
cmp dword [ebp - 0xc34], 0
jle 0x40601d
push ecx
and ecx, 0x15e34
pop ecx
push edi
xor edi, 0xb870
call 0x405f21
add byte [ebx], bh
inc eax
inc edi
dec ebx
dec ebp
xor al, 0x3c
add esp, 4
pop edi
push eax
push esi
add esp, 4
and eax, 0xa169
push edi
or edi, 0x6fc7
pop edi
push eax
or eax, 0xe9e7
and eax, 0x11737
and eax, 0x1761c
sbb al, 0x76
add dword [eax], eax
sbb al, 0x76
add dword [eax], eax
pop eax
push ebx
xor ebx, 0xbce9
jmp 0x405fe4
and ebx, 0x77f4
pop ebx
mov edx, dword [ebp - 0xc34]
inc dword [ebx - 0x6a76fe16]
int3
invalid
invalid
dec dword [ebx - 0xa8b7b]
inc dword [ebx - 0x7a76fe40]
je 0x405ffc
invalid
invalid
invalid
invalid
invalid
Function at 0x4061a0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 0x4d4], ecx
jmp 0x4061b7
push ecx
and ecx, 0x9e8b
pop ecx
push esi
push esi
add esp, 4
and esi, 0x8a9
add byte [eax], al
add esi, 0xdbef
pop esi
push esi
jmp 0x4061d7
xor esi, 0x37e5
add esi, 0x2e98
jmp 0x4061e8
pop esi
mov eax, dword [ebp - 0x4d4]
sub eax, dword [ebp - 0x3b8]
cmp eax, 0xffffffff
jb 0x406231
push esi
push ecx
add esp, 4
and esi, 0x12362
or esi, 0xa186
and esi, 0xe903
pop esi
push eax
xor eax, 0xcca7
or eax, 0x17c7c
jmp 0x406225
add eax, 0x11f6c
pop eax
jmp 0x40645f
mov dword [ebp - 0xc3c], 7
mov ecx, dword [ebp - 0x4d4]
mov dword [ebp - 0xa84], ecx
push eax
and eax, 0x72aa
or eax, 0x10f5
call 0x406262
add byte [esi], bh
dec edi
cmp bh, byte [edx]
aaa
cmp esi, dword [edx]
add esp, 4
call 0x406275
add byte [esp + esi + 0x32], al
inc eax
xor eax, 0x3c474533
cmp al, byte [ebx - 0x74a7fb3c]
xchg ebp, eax
test al, 0xea
invalid
push eax
xor eax, 0x17e71
call 0x406472
add byte [edx], dh
dec edx
xor al, byte [ecx + 0x40]
inc edx
add esp, 4
pop eax
push eax
and eax, 0xf0ae
call 0x40648d
add byte [edx], dh
dec esp
inc ebp
aas
dec esi
dec edx
aaa
cmp eax, 0xc4834b34
add al, 0x58
mov dword [ebp - 0xa7c], 0
push ecx
push edi
add esp, 4
and ecx, 0xdb79
jmp 0x4064ac
pop ecx
push edi
push edi
add esp, 4
xor edi, 0x115e7
pop edi
push eax
sub eax, 0x8eae
and eax, 0x154f7
and eax, 0xdb09
pop eax
mov byte [ebp - 0x854], 0x45
mov byte [ebp - 0x853], 0x78
mov byte [ebp - 0x852], 0x69
mov byte [ebp - 0x851], 0x74
mov byte [ebp - 0x850], 0x50
mov byte [ebp - 0x84f], 0x72
mov byte [ebp - 0x84e], 0x6f
mov byte [ebp - 0x84d], 0x63
mov byte [ebp - 0x84c], 0x65
mov byte [ebp - 0x84b], 0x73
mov byte [ebp - 0x84a], 0x73
mov byte [ebp - 0x849], 0
push ecx
sub ecx, 0xa484
pop ecx
push edi
push edx
add esp, 4
sub edi, 0xdb9f
sub edi, 0xba36
call 0x406547
add byte [ebx + 0x44], cl
aas
cmp byte [ebx], bh
cmp dh, byte [edx]
add esp, 4
jmp 0x406552
pop edi
mov ecx, 0x6b
mov word [ebp - 0x1670], cx
mov edx, 0x65
mov word [ebp - 0x166e], dx
mov eax, 0x72
mov word [ebp - 0x166c], ax
mov ecx, 0x6e
mov word [ebp - 0x166a], cx
mov edx, 0x65
mov word [ebp - 0x1668], dx
mov eax, 0x6c
mov word [ebp - 0x1666], ax
mov ecx, 0x33
mov word [ebp - 0x1664], cx
mov edx, 0x32
mov word [ebp - 0x1662], dx
mov eax, 0x2e
mov word [ebp - 0x1660], ax
mov ecx, 0x64
mov word [ebp - 0x165e], cx
mov edx, 0x6c
mov word [ebp - 0x165c], dx
mov eax, 0x6c
invalid
invalid
invalid
cmpsb byte [esi], byte es:[edi]
Function at 0x406262
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 0x4d4], ecx
jmp 0x4061b7
push ecx
and ecx, 0x9e8b
pop ecx
push esi
push esi
add esp, 4
and esi, 0x8a9
add byte [eax], al
add esi, 0xdbef
pop esi
push esi
jmp 0x4061d7
xor esi, 0x37e5
add esi, 0x2e98
jmp 0x4061e8
pop esi
mov eax, dword [ebp - 0x4d4]
sub eax, dword [ebp - 0x3b8]
cmp eax, 0xffffffff
jb 0x406231
push esi
push ecx
add esp, 4
and esi, 0x12362
or esi, 0xa186
and esi, 0xe903
pop esi
push eax
xor eax, 0xcca7
or eax, 0x17c7c
jmp 0x406225
add eax, 0x11f6c
pop eax
jmp 0x40645f
mov dword [ebp - 0xc3c], 7
mov ecx, dword [ebp - 0x4d4]
mov dword [ebp - 0xa84], ecx
push eax
and eax, 0x72aa
or eax, 0x10f5
call 0x406262
add byte [esi], bh
dec edi
cmp bh, byte [edx]
aaa
cmp esi, dword [edx]
add esp, 4
call 0x406275
add byte [esp + esi + 0x32], al
inc eax
xor eax, 0x3c474533
cmp al, byte [ebx - 0x74a7fb3c]
xchg ebp, eax
test al, 0xea
invalid
push eax
xor eax, 0x17e71
call 0x406472
add byte [edx], dh
dec edx
xor al, byte [ecx + 0x40]
inc edx
add esp, 4
pop eax
push eax
and eax, 0xf0ae
call 0x40648d
add byte [edx], dh
dec esp
inc ebp
aas
dec esi
dec edx
aaa
cmp eax, 0xc4834b34
add al, 0x58
mov dword [ebp - 0xa7c], 0
push ecx
push edi
add esp, 4
and ecx, 0xdb79
jmp 0x4064ac
pop ecx
push edi
push edi
add esp, 4
xor edi, 0x115e7
pop edi
push eax
sub eax, 0x8eae
and eax, 0x154f7
and eax, 0xdb09
pop eax
mov byte [ebp - 0x854], 0x45
mov byte [ebp - 0x853], 0x78
mov byte [ebp - 0x852], 0x69
mov byte [ebp - 0x851], 0x74
mov byte [ebp - 0x850], 0x50
mov byte [ebp - 0x84f], 0x72
mov byte [ebp - 0x84e], 0x6f
mov byte [ebp - 0x84d], 0x63
mov byte [ebp - 0x84c], 0x65
mov byte [ebp - 0x84b], 0x73
mov byte [ebp - 0x84a], 0x73
mov byte [ebp - 0x849], 0
push ecx
sub ecx, 0xa484
pop ecx
push edi
push edx
add esp, 4
sub edi, 0xdb9f
sub edi, 0xba36
call 0x406547
add byte [ebx + 0x44], cl
aas
cmp byte [ebx], bh
cmp dh, byte [edx]
add esp, 4
jmp 0x406552
pop edi
mov ecx, 0x6b
mov word [ebp - 0x1670], cx
mov edx, 0x65
mov word [ebp - 0x166e], dx
mov eax, 0x72
mov word [ebp - 0x166c], ax
mov ecx, 0x6e
mov word [ebp - 0x166a], cx
mov edx, 0x65
mov word [ebp - 0x1668], dx
mov eax, 0x6c
mov word [ebp - 0x1666], ax
mov ecx, 0x33
mov word [ebp - 0x1664], cx
mov edx, 0x32
mov word [ebp - 0x1662], dx
mov eax, 0x2e
mov word [ebp - 0x1660], ax
mov ecx, 0x64
mov word [ebp - 0x165e], cx
mov edx, 0x6c
mov word [ebp - 0x165c], dx
mov eax, 0x6c
invalid
invalid
invalid
cmpsb byte [esi], byte es:[edi]
Function at 0x406275
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 0x4d4], ecx
jmp 0x4061b7
push ecx
and ecx, 0x9e8b
pop ecx
push esi
push esi
add esp, 4
and esi, 0x8a9
add byte [eax], al
add esi, 0xdbef
pop esi
push esi
jmp 0x4061d7
xor esi, 0x37e5
add esi, 0x2e98
jmp 0x4061e8
pop esi
mov eax, dword [ebp - 0x4d4]
sub eax, dword [ebp - 0x3b8]
cmp eax, 0xffffffff
jb 0x406231
push esi
push ecx
add esp, 4
and esi, 0x12362
or esi, 0xa186
and esi, 0xe903
pop esi
push eax
xor eax, 0xcca7
or eax, 0x17c7c
jmp 0x406225
add eax, 0x11f6c
pop eax
jmp 0x40645f
mov dword [ebp - 0xc3c], 7
mov ecx, dword [ebp - 0x4d4]
mov dword [ebp - 0xa84], ecx
push eax
and eax, 0x72aa
or eax, 0x10f5
call 0x406262
add byte [esi], bh
dec edi
cmp bh, byte [edx]
aaa
cmp esi, dword [edx]
add esp, 4
call 0x406275
add byte [esp + esi + 0x32], al
inc eax
xor eax, 0x3c474533
cmp al, byte [ebx - 0x74a7fb3c]
xchg ebp, eax
test al, 0xea
invalid
push eax
xor eax, 0x17e71
call 0x406472
add byte [edx], dh
dec edx
xor al, byte [ecx + 0x40]
inc edx
add esp, 4
pop eax
push eax
and eax, 0xf0ae
call 0x40648d
add byte [edx], dh
dec esp
inc ebp
aas
dec esi
dec edx
aaa
cmp eax, 0xc4834b34
add al, 0x58
mov dword [ebp - 0xa7c], 0
push ecx
push edi
add esp, 4
and ecx, 0xdb79
jmp 0x4064ac
pop ecx
push edi
push edi
add esp, 4
xor edi, 0x115e7
pop edi
push eax
sub eax, 0x8eae
and eax, 0x154f7
and eax, 0xdb09
pop eax
mov byte [ebp - 0x854], 0x45
mov byte [ebp - 0x853], 0x78
mov byte [ebp - 0x852], 0x69
mov byte [ebp - 0x851], 0x74
mov byte [ebp - 0x850], 0x50
mov byte [ebp - 0x84f], 0x72
mov byte [ebp - 0x84e], 0x6f
mov byte [ebp - 0x84d], 0x63
mov byte [ebp - 0x84c], 0x65
mov byte [ebp - 0x84b], 0x73
mov byte [ebp - 0x84a], 0x73
mov byte [ebp - 0x849], 0
push ecx
sub ecx, 0xa484
pop ecx
push edi
push edx
add esp, 4
sub edi, 0xdb9f
sub edi, 0xba36
call 0x406547
add byte [ebx + 0x44], cl
aas
cmp byte [ebx], bh
cmp dh, byte [edx]
add esp, 4
jmp 0x406552
pop edi
mov ecx, 0x6b
mov word [ebp - 0x1670], cx
mov edx, 0x65
mov word [ebp - 0x166e], dx
mov eax, 0x72
mov word [ebp - 0x166c], ax
mov ecx, 0x6e
mov word [ebp - 0x166a], cx
mov edx, 0x65
mov word [ebp - 0x1668], dx
mov eax, 0x6c
mov word [ebp - 0x1666], ax
mov ecx, 0x33
mov word [ebp - 0x1664], cx
mov edx, 0x32
mov word [ebp - 0x1662], dx
mov eax, 0x2e
mov word [ebp - 0x1660], ax
mov ecx, 0x64
mov word [ebp - 0x165e], cx
mov edx, 0x6c
mov word [ebp - 0x165c], dx
mov eax, 0x6c
invalid
invalid
invalid
cmpsb byte [esi], byte es:[edi]

Function at 0x4062b0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, 0x5900010c
push ebx
xor ebx, 0x9926
sub ebx, 0xddc7
or ebx, 0x8d17
or ebx, 0xc1db
pop ebx
mov ecx, dword [ebp - 0xc40]
mov dword [ebp - 0x1560], ecx
jmp 0x406411
Function at 0x406300
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x4d4]
add edx, 1
mov dword [ebp - 0x4d4], edx
cmp dword [ebp - 0xc3c], 0
jle 0x406405
push ecx
and ecx, 0x12ce0
sub ecx, 0x10de6
and ecx, 0x168b1
pop ecx
push ebx
push ebx
add esp, 4
add ebx, 0x16014
adc al, 0x60
add dword [eax], eax
or ebx, 0x104a8
jmp 0x406318
and ebx, 0x16e0e
pop ebx
mov edx, dword [ebp - 0xa84]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0xa80]
movzx edx, byte [ecx]
cmp eax, edx
je 0x4063a1
push edi
push edi
add esp, 4
call fcn.00406349
add byte [edi], dh
cmp byte [edi], bh
xor eax, dword [ebx + 0x49]
inc ebx
dec edx
xor eax, 0x8104c483
add esp, 4
invalid
out 0xf, eax
jbe 0x406351
add byte [ecx + 0x7023e7], al
add byte [edi + 0x53], bl
pop edi
push ebx
or ebx, 0xe10d
xor ebx, 0x13248
pop ebx
mov eax, dword [ebp - 0xa84]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0xa80]
movzx eax, byte [edx]
cmp ecx, eax
jle 0x406389
mov dword [ebp - 0x155c], 1
jmp 0x406393
mov dword [ebp - 0x155c], 0xffffffff
mov ecx, dword [ebp - 0x155c]
mov dword [ebp - 0xc40], ecx
jmp 0x406405
push edi
add edi, 0x1260c
xor edi, 0x12d9c
call fcn.004063bd
add byte [eax], bh
cmp ecx, dword [esi + 0x4f]
xor al, byte [edx + 0x44]
push eax
xor al, byte [ebx + 0x515f04c4]
add esp, 4
pop edi
push ecx
push esi
add esp, 4
xor ecx, 0x784
jmp 0x4063d2
pop ecx
mov edx, dword [ebp - 0xc3c]
sub edx, 1
mov dword [ebp - 0xc3c], edx
mov eax, dword [ebp - 0xa84]
add eax, 1
mov dword [ebp - 0xa84], eax
mov ecx, dword [ebp - 0xa80]
add ecx, 1
mov dword [ebp - 0xa80], ecx
jmp 0x4062e0
mov edx, dword [ebp - 0xc40]
mov dword [ebp - 0x1560], edx
cmp dword [ebp - 0x1560], 0
jne 0x40645a
push esi
jmp 0x406423
add esi, 0x1470c
call 0x406436
add byte [ebx], dh
cmp al, 0x44
inc esi
inc edi
dec edi
aaa
add esp, 4
sub esi, 0x862
pop esi
push esi
push edi
add esp, 4
or esi, 0x704d
pop esi
mov eax, dword [ebp - 0x4d4]
mov dword [ebp - 0xa7c], eax
jmp 0x40649b
jmp 0x4061a8

Function at 0x406349
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
and edi, 0x760f
and edi, 0x7023
Function at 0x406436
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x4d4]
add edx, 1
mov dword [ebp - 0x4d4], edx
cmp dword [ebp - 0xc3c], 0
jle 0x406405
push ecx
and ecx, 0x12ce0
sub ecx, 0x10de6
and ecx, 0x168b1
pop ecx
push ebx
push ebx
add esp, 4
add ebx, 0x16014
adc al, 0x60
add dword [eax], eax
or ebx, 0x104a8
jmp 0x406318
and ebx, 0x16e0e
pop ebx
mov edx, dword [ebp - 0xa84]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0xa80]
movzx edx, byte [ecx]
cmp eax, edx
je 0x4063a1
push edi
push edi
add esp, 4
call fcn.00406349
add byte [edi], dh
cmp byte [edi], bh
xor eax, dword [ebx + 0x49]
inc ebx
dec edx
xor eax, 0x8104c483
add esp, 4
invalid
out 0xf, eax
jbe 0x406351
add byte [ecx + 0x7023e7], al
add byte [edi + 0x53], bl
pop edi
push ebx
or ebx, 0xe10d
xor ebx, 0x13248
pop ebx
mov eax, dword [ebp - 0xa84]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0xa80]
movzx eax, byte [edx]
cmp ecx, eax
jle 0x406389
mov dword [ebp - 0x155c], 1
jmp 0x406393
mov dword [ebp - 0x155c], 0xffffffff
mov ecx, dword [ebp - 0x155c]
mov dword [ebp - 0xc40], ecx
jmp 0x406405
push edi
add edi, 0x1260c
xor edi, 0x12d9c
call fcn.004063bd
add byte [eax], bh
cmp ecx, dword [esi + 0x4f]
xor al, byte [edx + 0x44]
push eax
xor al, byte [ebx + 0x515f04c4]
add esp, 4
pop edi
push ecx
push esi
add esp, 4
xor ecx, 0x784
jmp 0x4063d2
pop ecx
mov edx, dword [ebp - 0xc3c]
sub edx, 1
mov dword [ebp - 0xc3c], edx
mov eax, dword [ebp - 0xa84]
add eax, 1
mov dword [ebp - 0xa84], eax
mov ecx, dword [ebp - 0xa80]
add ecx, 1
mov dword [ebp - 0xa80], ecx
jmp 0x4062e0
mov edx, dword [ebp - 0xc40]
mov dword [ebp - 0x1560], edx
cmp dword [ebp - 0x1560], 0
jne 0x40645a
push esi
jmp 0x406423
add esi, 0x1470c
call 0x406436
add byte [ebx], dh
cmp al, 0x44
inc esi
inc edi
dec edi
aaa
add esp, 4
sub esi, 0x862
pop esi
push esi
push edi
add esp, 4
or esi, 0x704d
pop esi
mov eax, dword [ebp - 0x4d4]
mov dword [ebp - 0xa7c], eax
jmp 0x40649b
jmp 0x4061a8
Function at 0x406472
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 0x4d4], ecx
jmp 0x4061b7
push ecx
and ecx, 0x9e8b
pop ecx
push esi
push esi
add esp, 4
and esi, 0x8a9
add byte [eax], al
add esi, 0xdbef
pop esi
push esi
jmp 0x4061d7
xor esi, 0x37e5
add esi, 0x2e98
jmp 0x4061e8
pop esi
mov eax, dword [ebp - 0x4d4]
sub eax, dword [ebp - 0x3b8]
cmp eax, 0xffffffff
jb 0x406231
push esi
push ecx
add esp, 4
and esi, 0x12362
or esi, 0xa186
and esi, 0xe903
pop esi
push eax
xor eax, 0xcca7
or eax, 0x17c7c
jmp 0x406225
add eax, 0x11f6c
pop eax
jmp 0x40645f
mov dword [ebp - 0xc3c], 7
mov ecx, dword [ebp - 0x4d4]
mov dword [ebp - 0xa84], ecx
push eax
and eax, 0x72aa
or eax, 0x10f5
call 0x406262
add byte [esi], bh
dec edi
cmp bh, byte [edx]
aaa
cmp esi, dword [edx]
add esp, 4
call 0x406275
add byte [esp + esi + 0x32], al
inc eax
xor eax, 0x3c474533
cmp al, byte [ebx - 0x74a7fb3c]
xchg ebp, eax
test al, 0xea
invalid
push eax
xor eax, 0x17e71
call 0x406472
add byte [edx], dh
dec edx
xor al, byte [ecx + 0x40]
inc edx
add esp, 4
pop eax
push eax
and eax, 0xf0ae
call 0x40648d
add byte [edx], dh
dec esp
inc ebp
aas
dec esi
dec edx
aaa
cmp eax, 0xc4834b34
add al, 0x58
mov dword [ebp - 0xa7c], 0
push ecx
push edi
add esp, 4
and ecx, 0xdb79
jmp 0x4064ac
pop ecx
push edi
push edi
add esp, 4
xor edi, 0x115e7
pop edi
push eax
sub eax, 0x8eae
and eax, 0x154f7
and eax, 0xdb09
pop eax
mov byte [ebp - 0x854], 0x45
mov byte [ebp - 0x853], 0x78
mov byte [ebp - 0x852], 0x69
mov byte [ebp - 0x851], 0x74
mov byte [ebp - 0x850], 0x50
mov byte [ebp - 0x84f], 0x72
mov byte [ebp - 0x84e], 0x6f
mov byte [ebp - 0x84d], 0x63
mov byte [ebp - 0x84c], 0x65
mov byte [ebp - 0x84b], 0x73
mov byte [ebp - 0x84a], 0x73
mov byte [ebp - 0x849], 0
push ecx
sub ecx, 0xa484
pop ecx
push edi
push edx
add esp, 4
sub edi, 0xdb9f
sub edi, 0xba36
call 0x406547
add byte [ebx + 0x44], cl
aas
cmp byte [ebx], bh
cmp dh, byte [edx]
add esp, 4
jmp 0x406552
pop edi
mov ecx, 0x6b
mov word [ebp - 0x1670], cx
mov edx, 0x65
mov word [ebp - 0x166e], dx
mov eax, 0x72
mov word [ebp - 0x166c], ax
mov ecx, 0x6e
mov word [ebp - 0x166a], cx
mov edx, 0x65
mov word [ebp - 0x1668], dx
mov eax, 0x6c
mov word [ebp - 0x1666], ax
mov ecx, 0x33
mov word [ebp - 0x1664], cx
mov edx, 0x32
mov word [ebp - 0x1662], dx
mov eax, 0x2e
mov word [ebp - 0x1660], ax
mov ecx, 0x64
mov word [ebp - 0x165e], cx
mov edx, 0x6c
mov word [ebp - 0x165c], dx
mov eax, 0x6c
invalid
invalid
invalid
cmpsb byte [esi], byte es:[edi]
Function at 0x40648d
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 0x4d4], ecx
jmp 0x4061b7
push ecx
and ecx, 0x9e8b
pop ecx
push esi
push esi
add esp, 4
and esi, 0x8a9
add byte [eax], al
add esi, 0xdbef
pop esi
push esi
jmp 0x4061d7
xor esi, 0x37e5
add esi, 0x2e98
jmp 0x4061e8
pop esi
mov eax, dword [ebp - 0x4d4]
sub eax, dword [ebp - 0x3b8]
cmp eax, 0xffffffff
jb 0x406231
push esi
push ecx
add esp, 4
and esi, 0x12362
or esi, 0xa186
and esi, 0xe903
pop esi
push eax
xor eax, 0xcca7
or eax, 0x17c7c
jmp 0x406225
add eax, 0x11f6c
pop eax
jmp 0x40645f
mov dword [ebp - 0xc3c], 7
mov ecx, dword [ebp - 0x4d4]
mov dword [ebp - 0xa84], ecx
push eax
and eax, 0x72aa
or eax, 0x10f5
call 0x406262
add byte [esi], bh
dec edi
cmp bh, byte [edx]
aaa
cmp esi, dword [edx]
add esp, 4
call 0x406275
add byte [esp + esi + 0x32], al
inc eax
xor eax, 0x3c474533
cmp al, byte [ebx - 0x74a7fb3c]
xchg ebp, eax
test al, 0xea
invalid
push eax
xor eax, 0x17e71
call 0x406472
add byte [edx], dh
dec edx
xor al, byte [ecx + 0x40]
inc edx
add esp, 4
pop eax
push eax
and eax, 0xf0ae
call 0x40648d
add byte [edx], dh
dec esp
inc ebp
aas
dec esi
dec edx
aaa
cmp eax, 0xc4834b34
add al, 0x58
mov dword [ebp - 0xa7c], 0
push ecx
push edi
add esp, 4
and ecx, 0xdb79
jmp 0x4064ac
pop ecx
push edi
push edi
add esp, 4
xor edi, 0x115e7
pop edi
push eax
sub eax, 0x8eae
and eax, 0x154f7
and eax, 0xdb09
pop eax
mov byte [ebp - 0x854], 0x45
mov byte [ebp - 0x853], 0x78
mov byte [ebp - 0x852], 0x69
mov byte [ebp - 0x851], 0x74
mov byte [ebp - 0x850], 0x50
mov byte [ebp - 0x84f], 0x72
mov byte [ebp - 0x84e], 0x6f
mov byte [ebp - 0x84d], 0x63
mov byte [ebp - 0x84c], 0x65
mov byte [ebp - 0x84b], 0x73
mov byte [ebp - 0x84a], 0x73
mov byte [ebp - 0x849], 0
push ecx
sub ecx, 0xa484
pop ecx
push edi
push edx
add esp, 4
sub edi, 0xdb9f
sub edi, 0xba36
call 0x406547
add byte [ebx + 0x44], cl
aas
cmp byte [ebx], bh
cmp dh, byte [edx]
add esp, 4
jmp 0x406552
pop edi
mov ecx, 0x6b
mov word [ebp - 0x1670], cx
mov edx, 0x65
mov word [ebp - 0x166e], dx
mov eax, 0x72
mov word [ebp - 0x166c], ax
mov ecx, 0x6e
mov word [ebp - 0x166a], cx
mov edx, 0x65
mov word [ebp - 0x1668], dx
mov eax, 0x6c
mov word [ebp - 0x1666], ax
mov ecx, 0x33
mov word [ebp - 0x1664], cx
mov edx, 0x32
mov word [ebp - 0x1662], dx
mov eax, 0x2e
mov word [ebp - 0x1660], ax
mov ecx, 0x64
mov word [ebp - 0x165e], cx
mov edx, 0x6c
mov word [ebp - 0x165c], dx
mov eax, 0x6c
invalid
invalid
invalid
cmpsb byte [esi], byte es:[edi]
Function at 0x406547
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 0x4d4], ecx
jmp 0x4061b7
push ecx
and ecx, 0x9e8b
pop ecx
push esi
push esi
add esp, 4
and esi, 0x8a9
add byte [eax], al
add esi, 0xdbef
pop esi
push esi
jmp 0x4061d7
xor esi, 0x37e5
add esi, 0x2e98
jmp 0x4061e8
pop esi
mov eax, dword [ebp - 0x4d4]
sub eax, dword [ebp - 0x3b8]
cmp eax, 0xffffffff
jb 0x406231
push esi
push ecx
add esp, 4
and esi, 0x12362
or esi, 0xa186
and esi, 0xe903
pop esi
push eax
xor eax, 0xcca7
or eax, 0x17c7c
jmp 0x406225
add eax, 0x11f6c
pop eax
jmp 0x40645f
mov dword [ebp - 0xc3c], 7
mov ecx, dword [ebp - 0x4d4]
mov dword [ebp - 0xa84], ecx
push eax
and eax, 0x72aa
or eax, 0x10f5
call 0x406262
add byte [esi], bh
dec edi
cmp bh, byte [edx]
aaa
cmp esi, dword [edx]
add esp, 4
call 0x406275
add byte [esp + esi + 0x32], al
inc eax
xor eax, 0x3c474533
cmp al, byte [ebx - 0x74a7fb3c]
xchg ebp, eax
test al, 0xea
invalid
push eax
xor eax, 0x17e71
call 0x406472
add byte [edx], dh
dec edx
xor al, byte [ecx + 0x40]
inc edx
add esp, 4
pop eax
push eax
and eax, 0xf0ae
call 0x40648d
add byte [edx], dh
dec esp
inc ebp
aas
dec esi
dec edx
aaa
cmp eax, 0xc4834b34
add al, 0x58
mov dword [ebp - 0xa7c], 0
push ecx
push edi
add esp, 4
and ecx, 0xdb79
jmp 0x4064ac
pop ecx
push edi
push edi
add esp, 4
xor edi, 0x115e7
pop edi
push eax
sub eax, 0x8eae
and eax, 0x154f7
and eax, 0xdb09
pop eax
mov byte [ebp - 0x854], 0x45
mov byte [ebp - 0x853], 0x78
mov byte [ebp - 0x852], 0x69
mov byte [ebp - 0x851], 0x74
mov byte [ebp - 0x850], 0x50
mov byte [ebp - 0x84f], 0x72
mov byte [ebp - 0x84e], 0x6f
mov byte [ebp - 0x84d], 0x63
mov byte [ebp - 0x84c], 0x65
mov byte [ebp - 0x84b], 0x73
mov byte [ebp - 0x84a], 0x73
mov byte [ebp - 0x849], 0
push ecx
sub ecx, 0xa484
pop ecx
push edi
push edx
add esp, 4
sub edi, 0xdb9f
sub edi, 0xba36
call 0x406547
add byte [ebx + 0x44], cl
aas
cmp byte [ebx], bh
cmp dh, byte [edx]
add esp, 4
jmp 0x406552
pop edi
mov ecx, 0x6b
mov word [ebp - 0x1670], cx
mov edx, 0x65
mov word [ebp - 0x166e], dx
mov eax, 0x72
mov word [ebp - 0x166c], ax
mov ecx, 0x6e
mov word [ebp - 0x166a], cx
mov edx, 0x65
mov word [ebp - 0x1668], dx
mov eax, 0x6c
mov word [ebp - 0x1666], ax
mov ecx, 0x33
mov word [ebp - 0x1664], cx
mov edx, 0x32
mov word [ebp - 0x1662], dx
mov eax, 0x2e
mov word [ebp - 0x1660], ax
mov ecx, 0x64
mov word [ebp - 0x165e], cx
mov edx, 0x6c
mov word [ebp - 0x165c], dx
mov eax, 0x6c
invalid
invalid
invalid
cmpsb byte [esi], byte es:[edi]