joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42c000
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x427015
lea edi, [esi - 0x26015]
push edi
or ebp, 0xffffffff
jmp 0x42c022
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x42c029
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x42c018
mov eax, 1
add ebx, ebx
jne 0x42c03b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x42c030
jne 0x42c04c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42c030
xor ecx, ecx
sub eax, 3
jb 0x42c060
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42c0d2
mov ebp, eax
add ebx, ebx
jne 0x42c06b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x42c078
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x42c09c
inc ecx
add ebx, ebx
jne 0x42c088
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x42c07d
jne 0x42c099
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42c07d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x42c0bc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x42c0ad
jmp 0x42c01e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42c0bc
add edi, ecx
jmp 0x42c01e
pop esi
mov edi, esi
mov ecx, 0x227
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x42c0da
cmp byte [edi], 6
jne 0x42c0da
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x42c0df
lea edi, [esi + 0x2a000]
mov eax, dword [edi]
or eax, eax
je 0x42c14e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x48ed8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x48f9c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x42c10c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x48fa4]
or eax, eax
je 0x42c148
mov dword [ebx], eax
add ebx, 4
jmp 0x42c129
call dword [esi + 0x48fa0]
mov ebp, dword [esi + 0x48fa8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42c182
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x4068db
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4068ff
xor eax, eax
test eax, eax
je 0x406912
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x406912
xor ecx, ecx
jmp 0x406915
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406a38
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43110c], 0
push esi
jne 0x406a6f
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406a49
mov dword [ecx*4 + 0x431108], eax
inc ecx
cmp ecx, 0x100
jl 0x406a44
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406aa0
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431108]
xor eax, esi
inc ecx
dec edx
jne 0x406a82
pop edi
not eax
pop esi
ret 0xc

Function at 0x4015a0
Capabilities:
Terminate process

Disassembly:
call fcn.00401940
jmp fcn.004012d0

Function at 0x4015b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x403008]
jne 0x4015ba
repz ret
jmp fcn.004019f0
Function at 0x40b110
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b5478
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x4fb008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x24], vtable.StringStorage.0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 0
push eax
push 1
mov ecx, eax
call fcn.00404970
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push 0x4cc34c
push ecx
call fcn.0049ae40
add esp, 0xc
mov dword [ebp - 4], 1
cmp byte [ebp + 8], 0
je 0x40b1a8
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x24]
push str.TightVNC_Service_Control
call dword [eax + 4]
jmp 0x40b1c7
lea ecx, [ebx + 0x30]
call int.0041e3d0
push eax
push str.TightVNC_Application_Control
lea eax, [ebp - 0x24]
push 0x4cc7e4
push eax
call fcn.00404740
add esp, 0x10
cmp byte [ebp + 0xc], 0
mov ecx, 1
mov eax, 0xa
cmovne ecx, eax
mov eax, ecx
dec ecx
mov dword [ebp + 8], ecx
test eax, eax
jle 0x40b21f
mov byte [ebp - 4], 2
mov edi, dword [ebp - 0x20]
push 0xc
call fcn.00497c14
mov esi, eax
add esp, 4
mov dword [ebp + 0xc], esi
xor edx, edx
mov byte [ebp - 4], 3
mov ecx, edi
call fcn.0041e100
mov dword [esi], vtable.NamedPipeTransport.0
mov dword [esi + 4], eax
mov dword [esi + 8], 0
mov dword [ebx + 0x140], esi
mov byte [ebp - 4], 1
push 0x2c
call fcn.00497c14
mov esi, eax
add esp, 4
mov dword [ebp + 8], esi
mov byte [ebp - 4], 5
mov ecx, dword [ebx + 0x140]
mov edx, dword [ecx]
call dword [edx + 4]
mov dword [esi], vtable.DataInputStream.0
mov dword [esi + 4], eax
test eax, eax
je 0x40b27c
add eax, 4
jmp 0x40b27e
inc edx
inc ebp
dec esi
inc ebp
Function at 0x40b26b
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20bc
push ebx
push esi
push edi
push edx
jmp 0x40b280
add edx, 0xc035
and edx, 0x132f4
pop edx
push ecx
and ecx, 0x1ec
pop ecx
push ebx
xor ebx, 0x14dae
add ebx, 0x18357
and ebx, 0xa0
pop ebx
mov eax, 0x4d
mov word [ebp - 0x1ff8], ax
mov ecx, 0x42
mov word [ebp - 0x1ff6], cx
mov edx, 0x53
mov word [ebp - 0x1ff4], dx
mov eax, 0x65
mov word [ebp - 0x1ff2], ax
mov ecx, 0x72
mov word [ebp - 0x1ff0], cx
mov edx, 0x76
mov word [ebp - 0x1fee], dx
mov eax, 0x69
mov word [ebp - 0x1fec], ax
mov ecx, 0x63
mov word [ebp - 0x1fea], cx
mov edx, 0x65
mov word [ebp - 0x1fe8], dx
mov eax, 0x2e
mov word [ebp - 0x1fe6], ax
mov ecx, 0x65
mov word [ebp - 0x1fe4], cx
mov edx, 0x78
mov word [ebp - 0x1fe2], dx
mov eax, 0x65
mov word [ebp - 0x1fe0], ax
xor ecx, ecx
mov word [ebp - 0x1fde], cx
mov dword [ebp - 0x1060], 1
push esi
push esi
add esp, 4
or esi, 0xc91c
leave
add byte [eax], al
and esi, 0xa44f
add esi, 0x122fe
call 0x40b37e
add byte [esi + 0x4d], cl
dec eax
inc ebp
cmp al, byte [ebx + 0x35]
cmp eax, 0x4c48340
pop esi
push ecx
or ecx, 0xd3a0
pop ecx
imul edx, dword [ebp - 0x1060], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x1060], 0xfe
sub edx, eax
xor edx, 0xaa6272
imul edx, dword [ebp - 0x1060]
imul ecx, dword [ebp - 0x1060], 0xfe
sub edx, ecx
mov dword [ebp - 0x1064], edx
push ecx
or ecx, 0x174b1
call 0x40b3db
add byte [ebp + edi + 0x3a], al
cmp byte [0x35414941], dh
add esp, 4
call 0x40b3ed
add byte [edi], bh
cmp eax, 0x3c383638
cmp ecx, dword [eax + edx*2 - 0x7d]
les eax, [ecx + eax*4]
loope 0x40b472
push ebp
add byte [eax], al
pop ecx
mov dword [ebp - 0x10], 1
push esi
push eax
add esp, 4
sub esi, 0x14883
or esi, 0x114dc
or esi, 0xc30c
pop esi
push edi
push eax
add esp, 4
jmp 0x40b423
pop edi
push edi
push ebx
add esp, 4
or edi, 0x1676e
pop edi
imul edx, dword [ebp - 0x10], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x10], 0xfe
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0xfe
sub edx, ecx
mov dword [ebp - 0x14], edx
push edi
and edi, 0x176e7
pop edi
push edi
push ebx
add esp, 4
and edi, 0x17b07
pop edi
push edi
jmp 0x40b478
add eax, 0x45503a42
notrack jmp 0x40b47f
jmp 0x40b47f
add edi, 0x14ed
pop edi
push ebx
add ebx, 0xec9e
pop ebx
push edx
and edx, 0xdce2
pop edx
push ecx
add ecx, 0x1014
add ecx, 0xac91
pop ecx
push edx
xor edx, 0x16785
xor edx, 0xe2de
pop edx
push esi
xor esi, 0x6762
and esi, 0x1305e
pop esi
mov dword [ebp - 0x2c], 1
push edx
jmp 0x40b4d0
pop edx
push ebx
push edx
add esp, 4
add ebx, 0x3c0b
pop ebx
push edx
or edx, 0x1690c
jmp 0x40b4eb
jmp 0x40b4f2
sub edx, 0x6fce
pop edx
imul edx, dword [ebp - 0x2c], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x2c], 0xfe
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0xfe
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x40b6da
Function at 0x40b37e
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20bc
push ebx
push esi
push edi
push edx
jmp 0x40b280
add edx, 0xc035
and edx, 0x132f4
pop edx
push ecx
and ecx, 0x1ec
pop ecx
push ebx
xor ebx, 0x14dae
add ebx, 0x18357
and ebx, 0xa0
pop ebx
mov eax, 0x4d
mov word [ebp - 0x1ff8], ax
mov ecx, 0x42
mov word [ebp - 0x1ff6], cx
mov edx, 0x53
mov word [ebp - 0x1ff4], dx
mov eax, 0x65
mov word [ebp - 0x1ff2], ax
mov ecx, 0x72
mov word [ebp - 0x1ff0], cx
mov edx, 0x76
mov word [ebp - 0x1fee], dx
mov eax, 0x69
mov word [ebp - 0x1fec], ax
mov ecx, 0x63
mov word [ebp - 0x1fea], cx
mov edx, 0x65
mov word [ebp - 0x1fe8], dx
mov eax, 0x2e
mov word [ebp - 0x1fe6], ax
mov ecx, 0x65
mov word [ebp - 0x1fe4], cx
mov edx, 0x78
mov word [ebp - 0x1fe2], dx
mov eax, 0x65
mov word [ebp - 0x1fe0], ax
xor ecx, ecx
mov word [ebp - 0x1fde], cx
mov dword [ebp - 0x1060], 1
push esi
push esi
add esp, 4
or esi, 0xc91c
leave
add byte [eax], al
and esi, 0xa44f
add esi, 0x122fe
call 0x40b37e
add byte [esi + 0x4d], cl
dec eax
inc ebp
cmp al, byte [ebx + 0x35]
cmp eax, 0x4c48340
pop esi
push ecx
or ecx, 0xd3a0
pop ecx
imul edx, dword [ebp - 0x1060], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x1060], 0xfe
sub edx, eax
xor edx, 0xaa6272
imul edx, dword [ebp - 0x1060]
imul ecx, dword [ebp - 0x1060], 0xfe
sub edx, ecx
mov dword [ebp - 0x1064], edx
push ecx
or ecx, 0x174b1
call 0x40b3db
add byte [ebp + edi + 0x3a], al
cmp byte [0x35414941], dh
add esp, 4
call 0x40b3ed
add byte [edi], bh
cmp eax, 0x3c383638
cmp ecx, dword [eax + edx*2 - 0x7d]
les eax, [ecx + eax*4]
loope 0x40b472
push ebp
add byte [eax], al
pop ecx
mov dword [ebp - 0x10], 1
push esi
push eax
add esp, 4
sub esi, 0x14883
or esi, 0x114dc
or esi, 0xc30c
pop esi
push edi
push eax
add esp, 4
jmp 0x40b423
pop edi
push edi
push ebx
add esp, 4
or edi, 0x1676e
pop edi
imul edx, dword [ebp - 0x10], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x10], 0xfe
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0xfe
sub edx, ecx
mov dword [ebp - 0x14], edx
push edi
and edi, 0x176e7
pop edi
push edi
push ebx
add esp, 4
and edi, 0x17b07
pop edi
push edi
jmp 0x40b478
add eax, 0x45503a42
notrack jmp 0x40b47f
jmp 0x40b47f
add edi, 0x14ed
pop edi
push ebx
add ebx, 0xec9e
pop ebx
push edx
and edx, 0xdce2
pop edx
push ecx
add ecx, 0x1014
add ecx, 0xac91
pop ecx
push edx
xor edx, 0x16785
xor edx, 0xe2de
pop edx
push esi
xor esi, 0x6762
and esi, 0x1305e
pop esi
mov dword [ebp - 0x2c], 1
push edx
jmp 0x40b4d0
pop edx
push ebx
push edx
add esp, 4
add ebx, 0x3c0b
pop ebx
push edx
or edx, 0x1690c
jmp 0x40b4eb
jmp 0x40b4f2
sub edx, 0x6fce
pop edx
imul edx, dword [ebp - 0x2c], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x2c], 0xfe
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0xfe
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x40b6da
Function at 0x40b3db
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20bc
push ebx
push esi
push edi
push edx
jmp 0x40b280
add edx, 0xc035
and edx, 0x132f4
pop edx
push ecx
and ecx, 0x1ec
pop ecx
push ebx
xor ebx, 0x14dae
add ebx, 0x18357
and ebx, 0xa0
pop ebx
mov eax, 0x4d
mov word [ebp - 0x1ff8], ax
mov ecx, 0x42
mov word [ebp - 0x1ff6], cx
mov edx, 0x53
mov word [ebp - 0x1ff4], dx
mov eax, 0x65
mov word [ebp - 0x1ff2], ax
mov ecx, 0x72
mov word [ebp - 0x1ff0], cx
mov edx, 0x76
mov word [ebp - 0x1fee], dx
mov eax, 0x69
mov word [ebp - 0x1fec], ax
mov ecx, 0x63
mov word [ebp - 0x1fea], cx
mov edx, 0x65
mov word [ebp - 0x1fe8], dx
mov eax, 0x2e
mov word [ebp - 0x1fe6], ax
mov ecx, 0x65
mov word [ebp - 0x1fe4], cx
mov edx, 0x78
mov word [ebp - 0x1fe2], dx
mov eax, 0x65
mov word [ebp - 0x1fe0], ax
xor ecx, ecx
mov word [ebp - 0x1fde], cx
mov dword [ebp - 0x1060], 1
push esi
push esi
add esp, 4
or esi, 0xc91c
leave
add byte [eax], al
and esi, 0xa44f
add esi, 0x122fe
call 0x40b37e
add byte [esi + 0x4d], cl
dec eax
inc ebp
cmp al, byte [ebx + 0x35]
cmp eax, 0x4c48340
pop esi
push ecx
or ecx, 0xd3a0
pop ecx
imul edx, dword [ebp - 0x1060], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x1060], 0xfe
sub edx, eax
xor edx, 0xaa6272
imul edx, dword [ebp - 0x1060]
imul ecx, dword [ebp - 0x1060], 0xfe
sub edx, ecx
mov dword [ebp - 0x1064], edx
push ecx
or ecx, 0x174b1
call 0x40b3db
add byte [ebp + edi + 0x3a], al
cmp byte [0x35414941], dh
add esp, 4
call 0x40b3ed
add byte [edi], bh
cmp eax, 0x3c383638
cmp ecx, dword [eax + edx*2 - 0x7d]
les eax, [ecx + eax*4]
loope 0x40b472
push ebp
add byte [eax], al
pop ecx
mov dword [ebp - 0x10], 1
push esi
push eax
add esp, 4
sub esi, 0x14883
or esi, 0x114dc
or esi, 0xc30c
pop esi
push edi
push eax
add esp, 4
jmp 0x40b423
pop edi
push edi
push ebx
add esp, 4
or edi, 0x1676e
pop edi
imul edx, dword [ebp - 0x10], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x10], 0xfe
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0xfe
sub edx, ecx
mov dword [ebp - 0x14], edx
push edi
and edi, 0x176e7
pop edi
push edi
push ebx
add esp, 4
and edi, 0x17b07
pop edi
push edi
jmp 0x40b478
add eax, 0x45503a42
notrack jmp 0x40b47f
jmp 0x40b47f
add edi, 0x14ed
pop edi
push ebx
add ebx, 0xec9e
pop ebx
push edx
and edx, 0xdce2
pop edx
push ecx
add ecx, 0x1014
add ecx, 0xac91
pop ecx
push edx
xor edx, 0x16785
xor edx, 0xe2de
pop edx
push esi
xor esi, 0x6762
and esi, 0x1305e
pop esi
mov dword [ebp - 0x2c], 1
push edx
jmp 0x40b4d0
pop edx
push ebx
push edx
add esp, 4
add ebx, 0x3c0b
pop ebx
push edx
or edx, 0x1690c
jmp 0x40b4eb
jmp 0x40b4f2
sub edx, 0x6fce
pop edx
imul edx, dword [ebp - 0x2c], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x2c], 0xfe
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0xfe
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x40b6da
Function at 0x40b3ed
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20bc
push ebx
push esi
push edi
push edx
jmp 0x40b280
add edx, 0xc035
and edx, 0x132f4
pop edx
push ecx
and ecx, 0x1ec
pop ecx
push ebx
xor ebx, 0x14dae
add ebx, 0x18357
and ebx, 0xa0
pop ebx
mov eax, 0x4d
mov word [ebp - 0x1ff8], ax
mov ecx, 0x42
mov word [ebp - 0x1ff6], cx
mov edx, 0x53
mov word [ebp - 0x1ff4], dx
mov eax, 0x65
mov word [ebp - 0x1ff2], ax
mov ecx, 0x72
mov word [ebp - 0x1ff0], cx
mov edx, 0x76
mov word [ebp - 0x1fee], dx
mov eax, 0x69
mov word [ebp - 0x1fec], ax
mov ecx, 0x63
mov word [ebp - 0x1fea], cx
mov edx, 0x65
mov word [ebp - 0x1fe8], dx
mov eax, 0x2e
mov word [ebp - 0x1fe6], ax
mov ecx, 0x65
mov word [ebp - 0x1fe4], cx
mov edx, 0x78
mov word [ebp - 0x1fe2], dx
mov eax, 0x65
mov word [ebp - 0x1fe0], ax
xor ecx, ecx
mov word [ebp - 0x1fde], cx
mov dword [ebp - 0x1060], 1
push esi
push esi
add esp, 4
or esi, 0xc91c
leave
add byte [eax], al
and esi, 0xa44f
add esi, 0x122fe
call 0x40b37e
add byte [esi + 0x4d], cl
dec eax
inc ebp
cmp al, byte [ebx + 0x35]
cmp eax, 0x4c48340
pop esi
push ecx
or ecx, 0xd3a0
pop ecx
imul edx, dword [ebp - 0x1060], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x1060], 0xfe
sub edx, eax
xor edx, 0xaa6272
imul edx, dword [ebp - 0x1060]
imul ecx, dword [ebp - 0x1060], 0xfe
sub edx, ecx
mov dword [ebp - 0x1064], edx
push ecx
or ecx, 0x174b1
call 0x40b3db
add byte [ebp + edi + 0x3a], al
cmp byte [0x35414941], dh
add esp, 4
call 0x40b3ed
add byte [edi], bh
cmp eax, 0x3c383638
cmp ecx, dword [eax + edx*2 - 0x7d]
les eax, [ecx + eax*4]
loope 0x40b472
push ebp
add byte [eax], al
pop ecx
mov dword [ebp - 0x10], 1
push esi
push eax
add esp, 4
sub esi, 0x14883
or esi, 0x114dc
or esi, 0xc30c
pop esi
push edi
push eax
add esp, 4
jmp 0x40b423
pop edi
push edi
push ebx
add esp, 4
or edi, 0x1676e
pop edi
imul edx, dword [ebp - 0x10], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x10], 0xfe
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0xfe
sub edx, ecx
mov dword [ebp - 0x14], edx
push edi
and edi, 0x176e7
pop edi
push edi
push ebx
add esp, 4
and edi, 0x17b07
pop edi
push edi
jmp 0x40b478
add eax, 0x45503a42
notrack jmp 0x40b47f
jmp 0x40b47f
add edi, 0x14ed
pop edi
push ebx
add ebx, 0xec9e
pop ebx
push edx
and edx, 0xdce2
pop edx
push ecx
add ecx, 0x1014
add ecx, 0xac91
pop ecx
push edx
xor edx, 0x16785
xor edx, 0xe2de
pop edx
push esi
xor esi, 0x6762
and esi, 0x1305e
pop esi
mov dword [ebp - 0x2c], 1
push edx
jmp 0x40b4d0
pop edx
push ebx
push edx
add esp, 4
add ebx, 0x3c0b
pop ebx
push edx
or edx, 0x1690c
jmp 0x40b4eb
jmp 0x40b4f2
sub edx, 0x6fce
pop edx
imul edx, dword [ebp - 0x2c], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x2c], 0xfe
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0xfe
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x40b6da
Function at 0x40e90c
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
xor eax, 0x813d4f35
out dx, eax
ja 0x40e933
add dword [eax], eax
pop edi
push edi
sub edi, 0x76dc
add edi, 0x8ea2
pop edi
push edi
sub edi, 0x1784a
and edi, 0xe548
pop edi
mov ecx, dword [ebp - 0x2098]
mov dword [ebp - 0x15c0], ecx
push eax
push ebx
add esp, 4
jmp 0x40e8f0
pop eax
push esi
or esi, 0x175dc
or esi, 0x1177f
call 0x40e90c
add byte [edi + 0x38], cl
aaa
aaa
inc edi
inc edx
cmp dword [esi], esi
add esp, 4
sub esi, 0xea87
pop esi
mov edx, dword [ebp - 0x14]
add edx, 0xfe
imul eax, dword [ebp - 0x10], 0xfe
add eax, 0x56f3663b
imul ecx, dword [ebp - 0x10], 0xfe
sub eax, ecx
xor edx, eax
sal dword [ebx], 0xd0
imul edx, dword [ebp - 0x10]
mov dword [ebp - 0x15c0], edx
mov edx, dword [ebp - 0x3f0]
mov dword [ebp - 0x1ffc], edx
mov eax, dword [ebp - 0x1ffc]
add eax, dword [ebp - 0x15c0]
mov dword [ebp - 0x3f0], eax
push edx
push edi
add esp, 4
and edx, 0x27aa
or edx, 0xc29f
pop edx

Function at 0x40e970
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebx
push ecx
add esp, 4
or ebx, 0x5868
xor ebx, 0x1013f
jmp 0x40e989
add ebx, 0x1636b
pop ebx
mov byte [ebp - 0xbec], 0x52
mov byte [ebp - 0xbeb], 0xb9
mov byte [ebp - 0xbea], 0x10
mov byte [ebp - 0xbe9], 0x10
mov byte [ebp - 0xbe8], 0x10
mov byte [ebp - 0xbe7], 0x10
mov byte [ebp - 0xbe6], 0x5a
push esi
push edx
add esp, 4
xor esi, 0x163de
pop esi
push eax
sub eax, 0xab84
xor eax, 0x1945
and eax, 0x12ff1
call 0x40e9ef
add byte [edx], bh
aas
cmp dword [edi + 0x47], ecx
inc ecx
cmp edi, dword [edx]
aas
add esp, 4
pop eax
mov byte [ebp - 0xbe4], 0x52
mov byte [ebp - 0xbe3], 0xb9
mov byte [ebp - 0xbe2], 0x20
mov byte [ebp - 0xbe1], 0x20
mov byte [ebp - 0xbe0], 0x20
mov byte [ebp - 0xbdf], 0x20
mov byte [ebp - 0xbde], 0x5a
push ebx
push ecx
add esp, 4
or ebx, 0x28f1
add ebx, 0x141a
or ebx, 0x1fe1
jmp 0x40ea43
pop ebx
push eax
push edx
add esp, 4
and eax, 0x2d19
or eax, 0xef93
pop eax
mov dword [ebp - 0x209c], 0xe

Function at 0x40e9ef
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebx
push ecx
add esp, 4
or ebx, 0x5868
xor ebx, 0x1013f
jmp 0x40e989
add ebx, 0x1636b
pop ebx
mov byte [ebp - 0xbec], 0x52
mov byte [ebp - 0xbeb], 0xb9
mov byte [ebp - 0xbea], 0x10
mov byte [ebp - 0xbe9], 0x10
mov byte [ebp - 0xbe8], 0x10
mov byte [ebp - 0xbe7], 0x10
mov byte [ebp - 0xbe6], 0x5a
push esi
push edx
add esp, 4
xor esi, 0x163de
pop esi
push eax
sub eax, 0xab84
xor eax, 0x1945
and eax, 0x12ff1
call 0x40e9ef
add byte [edx], bh
aas
cmp dword [edi + 0x47], ecx
inc ecx
cmp edi, dword [edx]
aas
add esp, 4
pop eax
mov byte [ebp - 0xbe4], 0x52
mov byte [ebp - 0xbe3], 0xb9
mov byte [ebp - 0xbe2], 0x20
mov byte [ebp - 0xbe1], 0x20
mov byte [ebp - 0xbe0], 0x20
mov byte [ebp - 0xbdf], 0x20
mov byte [ebp - 0xbde], 0x5a
push ebx
push ecx
add esp, 4
or ebx, 0x28f1
add ebx, 0x141a
or ebx, 0x1fe1
jmp 0x40ea43
pop ebx
push eax
push edx
add esp, 4
and eax, 0x2d19
or eax, 0xef93
pop eax
mov dword [ebp - 0x209c], 0xe
Function at 0x40fadc
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
add eax, 0xe88b
call 0x40faf3
add byte [0x3c324143], bh
cmp bh, byte [ebx + edi]
add esp, 4
and eax, 0x3ac5
pop eax
mov ecx, dword [ebp - 0x508]
mov dword [ebp - 0x750], ecx
jmp 0x40fb73

Function at 0x40faf3
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
add eax, 0xe88b
call 0x40faf3
add byte [0x3c324143], bh
cmp bh, byte [ebx + edi]
add esp, 4
and eax, 0x3ac5
pop eax
mov ecx, dword [ebp - 0x508]
mov dword [ebp - 0x750], ecx
jmp 0x40fb73

Function at 0x40fb20
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x40fb33
add byte [ecx], bh
push eax
inc esi
cmp al, byte [ebp + 0x3b]
dec esi
xor al, 0x4d
aas
add esp, 4
or edx, 0xd0df
pop edx
mov edx, dword [ebp - 0x508]
mov eax, dword [edx]
mov dword [ebp - 0x508], eax
mov ecx, dword [ebp - 0x508]
cmp ecx, dword [ebp - 0xca4]
je 0x40fb69
mov edx, dword [ebp - 0x508]
cmp dword [edx + 0x30], 0
jne 0x40f91f
mov dword [ebp - 0x750], 0

Function at 0x40fb33
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x40fb33
add byte [ecx], bh
push eax
inc esi
cmp al, byte [ebp + 0x3b]
dec esi
xor al, 0x4d
aas
add esp, 4
or edx, 0xd0df
pop edx
mov edx, dword [ebp - 0x508]
mov eax, dword [edx]
mov dword [ebp - 0x508], eax
mov ecx, dword [ebp - 0x508]
cmp ecx, dword [ebp - 0xca4]
je 0x40fb69
mov edx, dword [ebp - 0x508]
cmp dword [edx + 0x30], 0
jne 0x40f91f
mov dword [ebp - 0x750], 0