joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408479
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x264]
add eax, 1
mov dword [ebp - 0x264], eax
jle 0x40835a
mov dword [ebp - 0xb40], 1
jmp 0x408364
mov dword [ebp - 0xb40], 0xffffffff
mov edx, dword [ebp - 0xb40]
mov dword [ebp - 0x69c], edx
jmp 0x4083d6
mov eax, dword [ebp - 0x69c]
mov dword [ebp - 0xb44], eax
cmp dword [ebp - 0xb44], 0
jne 0x40842b
push eax
push ecx
add esp, 4
add eax, 0x7ac3
sub eax, 0xfbe5
pop eax
push esi
push eax
add esp, 4
xor esi, 0x541e
xor esi, 0x5389
sub esi, 0x177a7
pop esi
push ecx
xor ecx, 0xf392
pop ecx
mov ecx, dword [ebp - 0x264]
mov dword [ebp - 0x228], ecx
jmp 0x40846c
jmp 0x4081ab
push edi
call 0x408479
add byte [esi], bh
inc esi
inc esp
dec eax
push eax
cmp byte [ebx + 0x7e804c4], al
add byte [eax], al
add byte [eax], al
inc eax
cmp byte [esi], bh
cmp al, byte [eax + 0x3e]
add esp, 4
add edi, 0x87a6
pop edi
push ecx
push eax
add esp, 4
add ecx, 0x2077
pop ecx
push ecx
push ebx
add esp, 4
or ecx, 0x15bc9
call 0x4084b9
add byte [ebp + 0x34], al
inc ebp
cmp cl, byte [eax + eax*2 + 0x4e]
cmp al, byte [eax + 0x49]
add esp, 4
pop ecx
push esi
push edi
add esp, 4
jmp 0x4084c9
jmp 0x4084cf
pop esi
mov edx, 1
imul eax, edx, 0
lea ecx, [ebp + eax - 0x658]
mov dword [ebp - 0xb48], ecx
push ecx
and ecx, 0x12e00

Function at 0x408488
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x264]
add eax, 1
mov dword [ebp - 0x264], eax
jle 0x40835a
mov dword [ebp - 0xb40], 1
jmp 0x408364
mov dword [ebp - 0xb40], 0xffffffff
mov edx, dword [ebp - 0xb40]
mov dword [ebp - 0x69c], edx
jmp 0x4083d6
mov eax, dword [ebp - 0x69c]
mov dword [ebp - 0xb44], eax
cmp dword [ebp - 0xb44], 0
jne 0x40842b
push eax
push ecx
add esp, 4
add eax, 0x7ac3
sub eax, 0xfbe5
pop eax
push esi
push eax
add esp, 4
xor esi, 0x541e
xor esi, 0x5389
sub esi, 0x177a7
pop esi
push ecx
xor ecx, 0xf392
pop ecx
mov ecx, dword [ebp - 0x264]
mov dword [ebp - 0x228], ecx
jmp 0x40846c
jmp 0x4081ab
push edi
call 0x408479
add byte [esi], bh
inc esi
inc esp
dec eax
push eax
cmp byte [ebx + 0x7e804c4], al
add byte [eax], al
add byte [eax], al
inc eax
cmp byte [esi], bh
cmp al, byte [eax + 0x3e]
add esp, 4
add edi, 0x87a6
pop edi
push ecx
push eax
add esp, 4
add ecx, 0x2077
pop ecx
push ecx
push ebx
add esp, 4
or ecx, 0x15bc9
call 0x4084b9
add byte [ebp + 0x34], al
inc ebp
cmp cl, byte [eax + eax*2 + 0x4e]
cmp al, byte [eax + 0x49]
add esp, 4
pop ecx
push esi
push edi
add esp, 4
jmp 0x4084c9
jmp 0x4084cf
pop esi
mov edx, 1
imul eax, edx, 0
lea ecx, [ebp + eax - 0x658]
mov dword [ebp - 0xb48], ecx
push ecx
and ecx, 0x12e00
Function at 0x4084b9
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x264]
add eax, 1
mov dword [ebp - 0x264], eax
jle 0x40835a
mov dword [ebp - 0xb40], 1
jmp 0x408364
mov dword [ebp - 0xb40], 0xffffffff
mov edx, dword [ebp - 0xb40]
mov dword [ebp - 0x69c], edx
jmp 0x4083d6
mov eax, dword [ebp - 0x69c]
mov dword [ebp - 0xb44], eax
cmp dword [ebp - 0xb44], 0
jne 0x40842b
push eax
push ecx
add esp, 4
add eax, 0x7ac3
sub eax, 0xfbe5
pop eax
push esi
push eax
add esp, 4
xor esi, 0x541e
xor esi, 0x5389
sub esi, 0x177a7
pop esi
push ecx
xor ecx, 0xf392
pop ecx
mov ecx, dword [ebp - 0x264]
mov dword [ebp - 0x228], ecx
jmp 0x40846c
jmp 0x4081ab
push edi
call 0x408479
add byte [esi], bh
inc esi
inc esp
dec eax
push eax
cmp byte [ebx + 0x7e804c4], al
add byte [eax], al
add byte [eax], al
inc eax
cmp byte [esi], bh
cmp al, byte [eax + 0x3e]
add esp, 4
add edi, 0x87a6
pop edi
push ecx
push eax
add esp, 4
add ecx, 0x2077
pop ecx
push ecx
push ebx
add esp, 4
or ecx, 0x15bc9
call 0x4084b9
add byte [ebp + 0x34], al
inc ebp
cmp cl, byte [eax + eax*2 + 0x4e]
cmp al, byte [eax + 0x49]
add esp, 4
pop ecx
push esi
push edi
add esp, 4
jmp 0x4084c9
jmp 0x4084cf
pop esi
mov edx, 1
imul eax, edx, 0
lea ecx, [ebp + eax - 0x658]
mov dword [ebp - 0xb48], ecx
push ecx
and ecx, 0x12e00

Function at 0x4084ec
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
jmp 0x4084f3
pop ecx
push edi
and edi, 0xee08
sub edi, 0x10707
add byte [ecx + 0xd9b3c7], al
add al, ch
pop es
add byte [eax], al
add byte [eax], al
dec esp
dec ebp
invalid

Function at 0x408500
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
jmp 0x4084f3
pop ecx
push edi
and edi, 0xee08
sub edi, 0x10707
add byte [ecx + 0xd9b3c7], al
add al, ch
pop es
add byte [eax], al
add byte [eax], al
dec esp
dec ebp
invalid

Function at 0x408510
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
dec eax
xor eax, dword [edx - 0x7d]
les eax, [edi + ebx*2]
invalid
test esp, edx
in eax, dx
invalid
invalid
invalid
invalid
invalid

Function at 0x408513
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
dec eax
xor eax, dword [edx - 0x7d]
les eax, [edi + ebx*2]
invalid
test esp, edx
in eax, dx
invalid
invalid
invalid
invalid
invalid

Function at 0x4085a8
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x260]
add eax, 1
mov dword [ebp - 0x260], eax
push edi
push ecx
add esp, 4
or edi, 0x124c3
add edi, 0xe3a2
sub edi, 0x6a41
pop edi
push eax
and eax, 0x6236
bound eax, qword [eax]
add byte [eax + 0x50], bl
push ecx
add esp, 4
and eax, 0x17507
or eax, 0xac1
pop eax
mov ecx, dword [ebp - 0x260]
sub ecx, dword [ebp - 0x238]
cmp ecx, 0xffffffff
jb 0x4085ea
push edi
push ebx
add esp, 4
call 0x4085c4
add byte [eax + 0x3f], dl
inc ebp
xor eax, 0xc4834d4a
add al, 0xe8
invalid
invalid
Function at 0x4085c4
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x260]
add eax, 1
mov dword [ebp - 0x260], eax
push edi
push ecx
add esp, 4
or edi, 0x124c3
add edi, 0xe3a2
sub edi, 0x6a41
pop edi
push eax
and eax, 0x6236
bound eax, qword [eax]
add byte [eax + 0x50], bl
push ecx
add esp, 4
and eax, 0x17507
or eax, 0xac1
pop eax
mov ecx, dword [ebp - 0x260]
sub ecx, dword [ebp - 0x238]
cmp ecx, 0xffffffff
jb 0x4085ea
push edi
push ebx
add esp, 4
call 0x4085c4
add byte [eax + 0x3f], dl
inc ebp
xor eax, 0xc4834d4a
add al, 0xe8
invalid
invalid

Function at 0x4085c8
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
or dword [eax], eax
add byte [eax], al
add byte [eax + 0x4d], cl
inc eax
inc eax
cmp al, 0x4a
inc edx
dec ebp
add esp, 4
and edi, 0x8c7b
add byte [eax], al
add edi, 0xad01
pop edi
jmp 0x4087e6
push ebx
and ebx, 0x10271
sub ebx, 0xa820
xor ebx, 0xf893
pop ebx
push eax
push edx
add esp, 4
and eax, 0x2427
add eax, 0x43e7
xor eax, 0xaf91
sub eax, 0xb82b
pop eax
mov dword [ebp - 0x614], 0
push ebx
push edx
add esp, 4
and ebx, 0x16ed
pop ebx
push ebx
push eax
add esp, 4
jmp 0x40883b
add ebx, 0xb285
call 0x408850
add byte [esi], bh
xor al, 0x40
cmp byte [edi], bh
push eax
dec ebx
push eax
aas
add esp, 4
pop ebx
mov byte [ebp - 0x494], 0x45
mov byte [ebp - 0x493], 0x78
mov byte [ebp - 0x492], 0x69
mov byte [ebp - 0x491], 0x74
invalid
test dword [eax - 5], esi

Function at 0x4085d5
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
or dword [eax], eax
add byte [eax], al
add byte [eax + 0x4d], cl
inc eax
inc eax
cmp al, 0x4a
inc edx
dec ebp
add esp, 4
and edi, 0x8c7b
add byte [eax], al
add edi, 0xad01
pop edi
jmp 0x4087e6
push ebx
and ebx, 0x10271
sub ebx, 0xa820
xor ebx, 0xf893
pop ebx
push eax
push edx
add esp, 4
and eax, 0x2427
add eax, 0x43e7
xor eax, 0xaf91
sub eax, 0xb82b
pop eax
mov dword [ebp - 0x614], 0
push ebx
push edx
add esp, 4
and ebx, 0x16ed
pop ebx
push ebx
push eax
add esp, 4
jmp 0x40883b
add ebx, 0xb285
call 0x408850
add byte [esi], bh
xor al, 0x40
cmp byte [edi], bh
push eax
dec ebx
push eax
aas
add esp, 4
pop ebx
mov byte [ebp - 0x494], 0x45
mov byte [ebp - 0x493], 0x78
mov byte [ebp - 0x492], 0x69
mov byte [ebp - 0x491], 0x74
invalid
test dword [eax - 5], esi

Function at 0x4087c4
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
sub edx, 0x11398
pop edx
push ebx
xor ebx, 0xc63e
pop ebx
mov ecx, dword [ebp - 0x260]
mov dword [ebp - 0x614], ecx
jmp 0x408822
Function at 0x408850
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
or dword [eax], eax
add byte [eax], al
add byte [eax + 0x4d], cl
inc eax
inc eax
cmp al, 0x4a
inc edx
dec ebp
add esp, 4
and edi, 0x8c7b
add byte [eax], al
add edi, 0xad01
pop edi
jmp 0x4087e6
push ebx
and ebx, 0x10271
sub ebx, 0xa820
xor ebx, 0xf893
pop ebx
push eax
push edx
add esp, 4
and eax, 0x2427
add eax, 0x43e7
xor eax, 0xaf91
sub eax, 0xb82b
pop eax
mov dword [ebp - 0x614], 0
push ebx
push edx
add esp, 4
and ebx, 0x16ed
pop ebx
push ebx
push eax
add esp, 4
jmp 0x40883b
add ebx, 0xb285
call 0x408850
add byte [esi], bh
xor al, 0x40
cmp byte [edi], bh
push eax
dec ebx
push eax
aas
add esp, 4
pop ebx
mov byte [ebp - 0x494], 0x45
mov byte [ebp - 0x493], 0x78
mov byte [ebp - 0x492], 0x69
mov byte [ebp - 0x491], 0x74
invalid
test dword [eax - 5], esi

Function at 0x40899b
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x6c
mov word [ebp - 0xc3c], ax
mov ecx, 0x6c
mov word [ebp - 0xc3a], cx
xor edx, edx
mov word [ebp - 0xc38], dx
push ebx
push eax
add esp, 4
sub ebx, 0x8b65
pop ebx
push edi
sub edi, 0x2ff8
sub edi, 0x12319
call 0x40899b
add byte [edx + 0x4c], cl
dec ebx
cmp eax, 0x443d4d43
xor al, 0x83
les eax, [ecx + eax*4]
out dx, eax
bound ebx, qword [ebp + 1]
add byte [edi + 0x64], bl
mov eax, dword [0x18]
mov dword [ebp - 0xe28], eax
mov ecx, dword [ebp - 0xe28]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xe2c], edx
mov eax, dword [ebp - 0xe2c]
mov dword [ebp - 0xb54], eax
push eax
call 0x4089dd
add byte [eax + 0x37], cl
dec esi
dec esi
dec ebp
inc esi
inc ebx
aas
inc esp
add esp, 4
add eax, 0x1394f
call 0x4089f4
add byte [ecx], bh
dec ebp
inc ebp
aaa
cmp al, 0x3b
cmp cl, byte [esi - 0x7d]
les eax, [ecx + eax*4]
ror byte [0x580000ae], 0x83
mov ebp, 0xfffff4ac
add byte [ebp + 0xf], dh
mov dword [ebp - 0x188], 0
jmp 0x408cbd

Function at 0x4089dd
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x6c
mov word [ebp - 0xc3c], ax
mov ecx, 0x6c
mov word [ebp - 0xc3a], cx
xor edx, edx
mov word [ebp - 0xc38], dx
push ebx
push eax
add esp, 4
sub ebx, 0x8b65
pop ebx
push edi
sub edi, 0x2ff8
sub edi, 0x12319
call 0x40899b
add byte [edx + 0x4c], cl
dec ebx
cmp eax, 0x443d4d43
xor al, 0x83
les eax, [ecx + eax*4]
out dx, eax
bound ebx, qword [ebp + 1]
add byte [edi + 0x64], bl
mov eax, dword [0x18]
mov dword [ebp - 0xe28], eax
mov ecx, dword [ebp - 0xe28]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xe2c], edx
mov eax, dword [ebp - 0xe2c]
mov dword [ebp - 0xb54], eax
push eax
call 0x4089dd
add byte [eax + 0x37], cl
dec esi
dec esi
dec ebp
inc esi
inc ebx
aas
inc esp
add esp, 4
add eax, 0x1394f
call 0x4089f4
add byte [ecx], bh
dec ebp
inc ebp
aaa
cmp al, 0x3b
cmp cl, byte [esi - 0x7d]
les eax, [ecx + eax*4]
ror byte [0x580000ae], 0x83
mov ebp, 0xfffff4ac
add byte [ebp + 0xf], dh
mov dword [ebp - 0x188], 0
jmp 0x408cbd
Function at 0x4089f4
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x6c
mov word [ebp - 0xc3c], ax
mov ecx, 0x6c
mov word [ebp - 0xc3a], cx
xor edx, edx
mov word [ebp - 0xc38], dx
push ebx
push eax
add esp, 4
sub ebx, 0x8b65
pop ebx
push edi
sub edi, 0x2ff8
sub edi, 0x12319
call 0x40899b
add byte [edx + 0x4c], cl
dec ebx
cmp eax, 0x443d4d43
xor al, 0x83
les eax, [ecx + eax*4]
out dx, eax
bound ebx, qword [ebp + 1]
add byte [edi + 0x64], bl
mov eax, dword [0x18]
mov dword [ebp - 0xe28], eax
mov ecx, dword [ebp - 0xe28]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xe2c], edx
mov eax, dword [ebp - 0xe2c]
mov dword [ebp - 0xb54], eax
push eax
call 0x4089dd
add byte [eax + 0x37], cl
dec esi
dec esi
dec ebp
inc esi
inc ebx
aas
inc esp
add esp, 4
add eax, 0x1394f
call 0x4089f4
add byte [ecx], bh
dec ebp
inc ebp
aaa
cmp al, 0x3b
cmp cl, byte [esi - 0x7d]
les eax, [ecx + eax*4]
ror byte [0x580000ae], 0x83
mov ebp, 0xfffff4ac
add byte [ebp + 0xf], dh
mov dword [ebp - 0x188], 0
jmp 0x408cbd

Function at 0x408abc
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x25c]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x6a8], ecx
xor edx, edx
mov word [ebp - 0x114], dx
xor eax, eax
mov word [ebp - 0x28], ax
push eax
and eax, 0xf20
call fcn.00408af0
add byte [ebx], bh
inc eax
inc eax
cmp eax, dword [ecx + 0x37]
cmp al, 0x32

Function at 0x408af0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push eax
push ecx
add esp, 4
sub eax, 0x35e7
add eax, 0x5557
or eax, 0x1550e
sub eax, 0x160bd
pop eax
push edi
and edi, 0x17c24
xor edi, 0x5c8
sub edi, 0x122ea
pop edi
lea edx, [ebp - 0xc50]
mov dword [ebp - 0x6ac], edx
add esp, 4
pop eax
push edi
push eax
add esp, 4
or edi, 0xfd98
and edi, 0x14e07
sub edi, 0x13bb7
pop edi
mov ecx, dword [ebp - 0x6a8]
mov dx, word [ecx]
mov word [ebp - 0x87a], dx
mov eax, dword [ebp - 0x6a8]
add eax, 2
mov dword [ebp - 0x6a8], eax
mov cx, word [ebp - 0x87a]
mov word [ebp - 0x114], cx
mov edx, dword [ebp - 0x6ac]
mov ax, word [edx]
mov word [ebp - 0x92c], ax
mov ecx, dword [ebp - 0x6ac]
add ecx, 2
mov dword [ebp - 0x6ac], ecx
mov dx, word [ebp - 0x92c]
mov word [ebp - 0x28], dx
push ecx
push ecx
add esp, 4
xor ecx, 0x6dbe
add ecx, 0x4d7c
and ecx, 0x777
pop ecx
push eax
push edi
add esp, 4
add eax, 0x29aa
pop eax
push esi
or esi, 0x3b5
add byte [eax], al
xor esi, 0x2add
pop esi
movzx eax, word [ebp - 0x28]
test eax, eax
jne 0x408bb2
invalid
mov bh, 0x8d

Function at 0x408c90
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
test dword [ebp + edi*8 - 0x72740001], esp
movsb byte es:[edi], byte [esi]
std
invalid
Function at 0x408cd9
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
movzx eax, word [ebp - 0x114]
movzx ecx, word [ebp - 0x28]
cmp eax, ecx
je 0x408ada
movzx edx, word [ebp - 0x114]
xor edx, 0x20
movzx eax, word [ebp - 0x28]
cmp edx, eax
je 0x408ada
movzx ecx, word [ebp - 0x114]
movzx edx, word [ebp - 0x28]
cmp ecx, edx
jge 0x408bf6
mov dword [ebp - 0xb58], 0xffffffff
jmp 0x408c00
mov dword [ebp - 0xb58], 1
mov eax, dword [ebp - 0xb58]
mov dword [ebp - 0xb5c], eax
cmp dword [ebp - 0xb5c], 0
jne 0x408c55
push esi
push edx
add esp, 4
or esi, 0x3b17
pop esi
push edi
jmp 0x408c29
jmp 0x408c32
sub edi, 0x6ae4
pop edi
push edx
or edx, 0x404b
xor edx, 0x116d4
pop edx
mov ecx, dword [ebp - 0x25c]
mov dword [ebp - 0x188], ecx
jmp 0x408cbd
push ebx
xor ebx, 0x1431c
sub ebx, 0x8dca
and ebx, 0x338a
pop ebx
push ecx
push edi
add esp, 4
and ecx, 0x10e8b
pop ecx
push ebx
push ebx
add esp, 4
and ebx, 0xfce8
xor ebx, 0x542f
pop ebx
mov edx, dword [ebp - 0x25c]
mov eax, dword [edx]
mov dword [ebp - 0x25c], eax
test dword [ebp + edi*8 - 0x72740001], esp
movsb byte es:[edi], byte [esi]
std
invalid
invalid
cmp ecx, dword [ebp - 0x6b0]
je 0x408cb3
mov edx, dword [ebp - 0x25c]
cmp dword [edx + 0x30], 0
jne 0x408a7e
mov dword [ebp - 0x188], 0
push ebx
sub ebx, 0xf748
xor ebx, 0x94eb
pop ebx
push ebx
call 0x408cd9
add byte [esi + 0x35], al
dec edx
inc ebx
dec esi
dec ebx
add esp, 4
pop ebx
push ecx
call 0x408ceb
add byte [edi], bh
dec edx
inc ebp
inc ecx
inc edx
dec ebp
inc eax
add esp, 4
pop ecx
cmp dword [ebp - 0x188], 0
jne 0x4095c2
mov eax, 0x6b
mov word [ebp - 0xca8], ax
push edi
sub edi, 0x17cc1
xor edi, 0x8303
add dword [eax], 0
pop edi
push edi
push ecx
add esp, 4
sub edi, 0xa184
call 0x4095ea
add byte [ebx], dh
dec edi
inc ebp
inc ebx
cmp byte [esi], dh
cmp al, 0x39
cmp al, 0x83
les eax, [ecx + eax*4]
iretd
Function at 0x408ceb
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
movzx eax, word [ebp - 0x114]
movzx ecx, word [ebp - 0x28]
cmp eax, ecx
je 0x408ada
movzx edx, word [ebp - 0x114]
xor edx, 0x20
movzx eax, word [ebp - 0x28]
cmp edx, eax
je 0x408ada
movzx ecx, word [ebp - 0x114]
movzx edx, word [ebp - 0x28]
cmp ecx, edx
jge 0x408bf6
mov dword [ebp - 0xb58], 0xffffffff
jmp 0x408c00
mov dword [ebp - 0xb58], 1
mov eax, dword [ebp - 0xb58]
mov dword [ebp - 0xb5c], eax
cmp dword [ebp - 0xb5c], 0
jne 0x408c55
push esi
push edx
add esp, 4
or esi, 0x3b17
pop esi
push edi
jmp 0x408c29
jmp 0x408c32
sub edi, 0x6ae4
pop edi
push edx
or edx, 0x404b
xor edx, 0x116d4
pop edx
mov ecx, dword [ebp - 0x25c]
mov dword [ebp - 0x188], ecx
jmp 0x408cbd
push ebx
xor ebx, 0x1431c
sub ebx, 0x8dca
and ebx, 0x338a
pop ebx
push ecx
push edi
add esp, 4
and ecx, 0x10e8b
pop ecx
push ebx
push ebx
add esp, 4
and ebx, 0xfce8
xor ebx, 0x542f
pop ebx
mov edx, dword [ebp - 0x25c]
mov eax, dword [edx]
mov dword [ebp - 0x25c], eax
test dword [ebp + edi*8 - 0x72740001], esp
movsb byte es:[edi], byte [esi]
std
invalid
invalid
cmp ecx, dword [ebp - 0x6b0]
je 0x408cb3
mov edx, dword [ebp - 0x25c]
cmp dword [edx + 0x30], 0
jne 0x408a7e
mov dword [ebp - 0x188], 0
push ebx
sub ebx, 0xf748
xor ebx, 0x94eb
pop ebx
push ebx
call 0x408cd9
add byte [esi + 0x35], al
dec edx
inc ebx
dec esi
dec ebx
add esp, 4
pop ebx
push ecx
call 0x408ceb
add byte [edi], bh
dec edx
inc ebp
inc ecx
inc edx
dec ebp
inc eax
add esp, 4
pop ecx
cmp dword [ebp - 0x188], 0
jne 0x4095c2
mov eax, 0x6b
mov word [ebp - 0xca8], ax
push edi
sub edi, 0x17cc1
xor edi, 0x8303
add dword [eax], 0
pop edi
push edi
push ecx
add esp, 4
sub edi, 0xa184
call 0x4095ea
add byte [ebx], dh
dec edi
inc ebp
inc ebx
cmp byte [esi], dh
cmp al, 0x39
cmp al, 0x83
les eax, [ecx + eax*4]
iretd
Function at 0x408d08
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, 0x65
mov word [ebp - 0xca6], cx
mov edx, 0x72
mov word [ebp - 0xca4], dx
mov eax, 0x6e
mov word [ebp - 0xca2], ax
mov ecx, 0x65
mov word [ebp - 0xca0], cx
mov edx, 0x6c
mov word [ebp - 0xc9e], dx
mov eax, 0x33
mov word [ebp - 0xc9c], ax
mov ecx, 0x32
mov word [ebp - 0xc9a], cx
mov edx, 0x2e
mov word [ebp - 0xc98], dx
mov eax, 0x64
mov word [ebp - 0xc96], ax
mov ecx, 0x6c
mov word [ebp - 0xc94], cx
mov edx, 0x6c
mov word [ebp - 0xc92], dx
xor eax, eax
mov word [ebp - 0xc90], ax
push eax
push ebx
add esp, 4
jmp 0x408da1
xor eax, 0xac61
jmp 0x408db0
sub eax, 0x10113
pop eax
push eax
add eax, 0x97f8
pop eax
push ebx
xor ebx, 0xab02
pop ebx
mov byte [ebp - 0x4c0], 0x4c
mov byte [ebp - 0x4bf], 0x6f
mov byte [ebp - 0x4be], 0x61
mov byte [ebp - 0x4bd], 0x64
mov byte [ebp - 0x4bc], 0x4c
mov byte [ebp - 0x4bb], 0x69
mov byte [ebp - 0x4ba], 0x62
mov byte [ebp - 0x4b9], 0x72
mov byte [ebp - 0x4b8], 0x61
mov byte [ebp - 0x4b7], 0x72
mov byte [ebp - 0x4b6], 0x79
mov byte [ebp - 0x4b5], 0x57
mov byte [ebp - 0x4b4], 0
mov ecx, dword fs:[0x18]
or eax, 0x18
mov dword [ebp - 0xe30], ecx
mov edx, dword [ebp - 0xe30]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xe34], eax
mov ecx, dword [ebp - 0xe34]
mov dword [ebp - 0xb60], ecx
push edi
add edi, 0xa33e
pop edi
push ecx
call 0x408e60
add byte [edx + 0x4a], cl
xor eax, 0x423c3343
add esp, 4
pop ecx
push esi
push ecx
add esp, 4
sub esi, 0x53d2
xor esi, 0x9421
sub esi, 0x767f
pop esi
cmp dword [ebp - 0xb60], 0
jne 0x408e94
mov dword [ebp - 0x3cc], 0
jmp 0x40913b
mov edx, dword [ebp - 0xb60]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x6bc], ecx
push edx
or edx, 0xcdff
pop edx
push edi
jmp 0x408eb5
jmp 0x408ebb
pop edi
push edi
add edi, 0x128fa
add edi, 0x712d
pop edi
push esi
or esi, 0x92d7
add esi, 0x6c31
pop esi
cmp dword [ebp - 0x6bc], 0
jne 0x408ef0
mov dword [ebp - 0x3cc], 0
jmp 0x40913b
mov edx, dword [ebp - 0x6bc]
mov dword [ebp - 0x258], edx
push edi
sub edi, 0x173a0
xor edi, 0xd178
call 0x408f19
add byte [ebx + 0x3f], cl
aaa
dec esi
xor eax, 0x4b34414c
dec edi
add esp, 4
call 0x408f2a
add byte [ebx], dh
push eax
cmp byte [esi + 0x3e], cl
dec eax
dec esp
aaa
add esp, 4
pop edi
lea eax, [ebp - 0xca8]
mov dword [ebp - 0x6b8], eax
mov ecx, dword [ebp - 0x258]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x6b4], edx
xor eax, eax
mov word [ebp - 0x118], ax
xor ecx, ecx
mov word [ebp - 0x2c], cx
push edi
invalid
out dx, eax
invalid
Function at 0x408e24
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, 0x65
mov word [ebp - 0xca6], cx
mov edx, 0x72
mov word [ebp - 0xca4], dx
mov eax, 0x6e
mov word [ebp - 0xca2], ax
mov ecx, 0x65
mov word [ebp - 0xca0], cx
mov edx, 0x6c
mov word [ebp - 0xc9e], dx
mov eax, 0x33
mov word [ebp - 0xc9c], ax
mov ecx, 0x32
mov word [ebp - 0xc9a], cx
mov edx, 0x2e
mov word [ebp - 0xc98], dx
mov eax, 0x64
mov word [ebp - 0xc96], ax
mov ecx, 0x6c
mov word [ebp - 0xc94], cx
mov edx, 0x6c
mov word [ebp - 0xc92], dx
xor eax, eax
mov word [ebp - 0xc90], ax
push eax
push ebx
add esp, 4
jmp 0x408da1
xor eax, 0xac61
jmp 0x408db0
sub eax, 0x10113
pop eax
push eax
add eax, 0x97f8
pop eax
push ebx
xor ebx, 0xab02
pop ebx
mov byte [ebp - 0x4c0], 0x4c
mov byte [ebp - 0x4bf], 0x6f
mov byte [ebp - 0x4be], 0x61
mov byte [ebp - 0x4bd], 0x64
mov byte [ebp - 0x4bc], 0x4c
mov byte [ebp - 0x4bb], 0x69
mov byte [ebp - 0x4ba], 0x62
mov byte [ebp - 0x4b9], 0x72
mov byte [ebp - 0x4b8], 0x61
mov byte [ebp - 0x4b7], 0x72
mov byte [ebp - 0x4b6], 0x79
mov byte [ebp - 0x4b5], 0x57
mov byte [ebp - 0x4b4], 0
mov ecx, dword fs:[0x18]
or eax, 0x18
mov dword [ebp - 0xe30], ecx
mov edx, dword [ebp - 0xe30]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xe34], eax
mov ecx, dword [ebp - 0xe34]
mov dword [ebp - 0xb60], ecx
push edi
add edi, 0xa33e
pop edi
push ecx
call 0x408e60
add byte [edx + 0x4a], cl
xor eax, 0x423c3343
add esp, 4
pop ecx
push esi
push ecx
add esp, 4
sub esi, 0x53d2
xor esi, 0x9421
sub esi, 0x767f
pop esi
cmp dword [ebp - 0xb60], 0
jne 0x408e94
mov dword [ebp - 0x3cc], 0
jmp 0x40913b
mov edx, dword [ebp - 0xb60]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x6bc], ecx
push edx
or edx, 0xcdff
pop edx
push edi
jmp 0x408eb5
jmp 0x408ebb
pop edi
push edi
add edi, 0x128fa
add edi, 0x712d
pop edi
push esi
or esi, 0x92d7
add esi, 0x6c31
pop esi
cmp dword [ebp - 0x6bc], 0
jne 0x408ef0
mov dword [ebp - 0x3cc], 0
jmp 0x40913b
mov edx, dword [ebp - 0x6bc]
mov dword [ebp - 0x258], edx
push edi
sub edi, 0x173a0
xor edi, 0xd178
call 0x408f19
add byte [ebx + 0x3f], cl
aaa
dec esi
xor eax, 0x4b34414c
dec edi
add esp, 4
call 0x408f2a
add byte [ebx], dh
push eax
cmp byte [esi + 0x3e], cl
dec eax
dec esp
aaa
add esp, 4
pop edi
lea eax, [ebp - 0xca8]
mov dword [ebp - 0x6b8], eax
mov ecx, dword [ebp - 0x258]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x6b4], edx
xor eax, eax
mov word [ebp - 0x118], ax
xor ecx, ecx
mov word [ebp - 0x2c], cx
push edi
invalid
out dx, eax
invalid