joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408350
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c3e30
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x599224]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x3c]
and ecx, 1
je 0x408428
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x20]
mov ecx, dword [eax]
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], 0
je 0x4083ad
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x30]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x20]
mov ecx, dword [edx]
add ecx, dword [eax]
mov dword [ebp - 0x18], ecx
jmp 0x4083c0
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x2c]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x1c]
mov ecx, dword [edx]
add ecx, dword [eax]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x1000
jb 0x408411
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x1c]
push ecx
call fcn.00401fc0
add esp, 8
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call fcn.0046fbb6
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0xc]
mov dword [edx], 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x1c]
mov dword [ecx], 0
xor edx, edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x2c]
mov dword [ecx], edx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x10]
mov dword [eax], 0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x20]
mov dword [edx], 0
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x30]
mov dword [edx], eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x38], 0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x3c]
and edx, 0xfffffffe
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x3c], edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x413c20
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
xor edx, 0x17455
call 0x413c37
Function at 0x414172
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
jmp 0x41415a
xor ebx, 0x13328
jmp 0x414166
call 0x414172
add byte [edi + 0x43], al
aaa
dec ebp
aas
add esp, 4
pop ebx
push edx
xor edx, 0x18c
sub edx, 0x5427
pop edx
lea ecx, [ebp - 0x15e8]
mov dword [ebp - 0xc48], ecx
mov edx, dword [ebp - 0x4c8]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xc44], eax
xor ecx, ecx
mov word [ebp - 0x1b4], cx
xor edx, edx
mov word [ebp - 0x28], dx
push ecx
xor ecx, 0x2208
and ecx, 0x3b1f
pop ecx
push edi
call 0x4141cc
add byte [esi + 0x4c], al
cmp dword [esi], edi
dec ebx
xor eax, 0x8344333f
les eax, [eax + ebp*8]
or byte [eax], al
add byte [eax], al
add byte [0x37484e4b], dh
cmp dword [eax], edi
add esp, 4
pop edi
mov eax, dword [ebp - 0xc44]
mov cx, word [eax]
mov word [ebp - 0xfd6], cx
mov edx, dword [ebp - 0xc44]
add edx, 2
mov dword [ebp - 0xc44], edx
mov ax, word [ebp - 0xfd6]
mov word [ebp - 0x1b4], ax
mov ecx, dword [ebp - 0xc48]
mov dx, word [ecx]
mov word [ebp - 0xfd8], dx
mov eax, dword [ebp - 0xc48]
add eax, 2
mov dword [ebp - 0xc48], eax
mov cx, word [ebp - 0xfd8]
mov word [ebp - 0x28], cx
push ecx
call 0x414245
add byte [ecx + 0x4f], cl
inc eax
cmp eax, 0x834c384c
les eax, [ecx + ebx*2]
push edx
push ebx
add esp, 4
and edx, 0x179ff
pop edx
push edi
xor edi, 0x1014f
xor edi, 0x8fa6
sub edi, 0x142b4
pop edi
movzx edx, word [ebp - 0x28]
test edx, edx
jne 0x414286
movzx eax, word [ebp - 0x1b4]
movzx ecx, word [ebp - 0x28]
sub eax, ecx
mov dword [ebp - 0x1548], eax
mov eax, 0xebffffea
pop edx
movzx edx, word [ebp - 0x1b4]
movzx eax, word [ebp - 0x28]
cmp edx, eax
je 0x4141ae
movzx ecx, word [ebp - 0x1b4]
xor ecx, 0x20
movzx edx, word [ebp - 0x28]
cmp ecx, edx
je 0x4141ae
movzx eax, word [ebp - 0x1b4]
movzx ecx, word [ebp - 0x28]
cmp eax, ecx
jge 0x4142ca
mov dword [ebp - 0x1544], 0xffffffff
jmp 0x4142d4
mov dword [ebp - 0x1544], 1
mov edx, dword [ebp - 0x1544]
mov dword [ebp - 0x1548], edx
cmp dword [ebp - 0x1548], 0
jne 0x414329
push eax
xor eax, 0xc6a0
pop eax
push ecx
push edx
add esp, 4
sub ecx, 0x1483f
add ecx, 0x16a57
pop ecx
push esi
push ebx
add esp, 4
sub esi, 0x5a79
pop esi
push edx
push edi
add edi, 0x6d49
pop edi
push edx
push edi
add esp, 4
call 0x414343
add byte [edx + 0x4c], al
dec edi
dec esp
dec ecx
aaa
dec ebx
add esp, 4
xor edx, 0xda62
or edx, 0x17f47
pop edx
push ecx
sub ecx, 0xf8c7
pop ecx
mov ecx, dword [ebp - 0x4c8]
mov edx, dword [ecx]
mov dword [ebp - 0x4c8], edx
mov eax, dword [ebp - 0x4c8]
cmp eax, dword [ebp - 0xc4c]
je 0x414387
mov ecx, dword [ebp - 0x4c8]
cmp dword [ecx + 0x30], 0
jne 0x414152
mov dword [ebp - 0x29c], 0
Function at 0x4141cc
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
jmp 0x41415a
xor ebx, 0x13328
jmp 0x414166
call 0x414172
add byte [edi + 0x43], al
aaa
dec ebp
aas
add esp, 4
pop ebx
push edx
xor edx, 0x18c
sub edx, 0x5427
pop edx
lea ecx, [ebp - 0x15e8]
mov dword [ebp - 0xc48], ecx
mov edx, dword [ebp - 0x4c8]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xc44], eax
xor ecx, ecx
mov word [ebp - 0x1b4], cx
xor edx, edx
mov word [ebp - 0x28], dx
push ecx
xor ecx, 0x2208
and ecx, 0x3b1f
pop ecx
push edi
call 0x4141cc
add byte [esi + 0x4c], al
cmp dword [esi], edi
dec ebx
xor eax, 0x8344333f
les eax, [eax + ebp*8]
or byte [eax], al
add byte [eax], al
add byte [0x37484e4b], dh
cmp dword [eax], edi
add esp, 4
pop edi
mov eax, dword [ebp - 0xc44]
mov cx, word [eax]
mov word [ebp - 0xfd6], cx
mov edx, dword [ebp - 0xc44]
add edx, 2
mov dword [ebp - 0xc44], edx
mov ax, word [ebp - 0xfd6]
mov word [ebp - 0x1b4], ax
mov ecx, dword [ebp - 0xc48]
mov dx, word [ecx]
mov word [ebp - 0xfd8], dx
mov eax, dword [ebp - 0xc48]
add eax, 2
mov dword [ebp - 0xc48], eax
mov cx, word [ebp - 0xfd8]
mov word [ebp - 0x28], cx
push ecx
call 0x414245
add byte [ecx + 0x4f], cl
inc eax
cmp eax, 0x834c384c
les eax, [ecx + ebx*2]
push edx
push ebx
add esp, 4
and edx, 0x179ff
pop edx
push edi
xor edi, 0x1014f
xor edi, 0x8fa6
sub edi, 0x142b4
pop edi
movzx edx, word [ebp - 0x28]
test edx, edx
jne 0x414286
movzx eax, word [ebp - 0x1b4]
movzx ecx, word [ebp - 0x28]
sub eax, ecx
mov dword [ebp - 0x1548], eax
mov eax, 0xebffffea
pop edx
movzx edx, word [ebp - 0x1b4]
movzx eax, word [ebp - 0x28]
cmp edx, eax
je 0x4141ae
movzx ecx, word [ebp - 0x1b4]
xor ecx, 0x20
movzx edx, word [ebp - 0x28]
cmp ecx, edx
je 0x4141ae
movzx eax, word [ebp - 0x1b4]
movzx ecx, word [ebp - 0x28]
cmp eax, ecx
jge 0x4142ca
mov dword [ebp - 0x1544], 0xffffffff
jmp 0x4142d4
mov dword [ebp - 0x1544], 1
mov edx, dword [ebp - 0x1544]
mov dword [ebp - 0x1548], edx
cmp dword [ebp - 0x1548], 0
jne 0x414329
push eax
xor eax, 0xc6a0
pop eax
push ecx
push edx
add esp, 4
sub ecx, 0x1483f
add ecx, 0x16a57
pop ecx
push esi
push ebx
add esp, 4
sub esi, 0x5a79
pop esi
push edx
push edi
add edi, 0x6d49
pop edi
push edx
push edi
add esp, 4
call 0x414343
add byte [edx + 0x4c], al
dec edi
dec esp
dec ecx
aaa
dec ebx
add esp, 4
xor edx, 0xda62
or edx, 0x17f47
pop edx
push ecx
sub ecx, 0xf8c7
pop ecx
mov ecx, dword [ebp - 0x4c8]
mov edx, dword [ecx]
mov dword [ebp - 0x4c8], edx
mov eax, dword [ebp - 0x4c8]
cmp eax, dword [ebp - 0xc4c]
je 0x414387
mov ecx, dword [ebp - 0x4c8]
cmp dword [ecx + 0x30], 0
jne 0x414152
mov dword [ebp - 0x29c], 0
Function at 0x4141dc
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
jmp 0x41415a
xor ebx, 0x13328
jmp 0x414166
call 0x414172
add byte [edi + 0x43], al
aaa
dec ebp
aas
add esp, 4
pop ebx
push edx
xor edx, 0x18c
sub edx, 0x5427
pop edx
lea ecx, [ebp - 0x15e8]
mov dword [ebp - 0xc48], ecx
mov edx, dword [ebp - 0x4c8]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xc44], eax
xor ecx, ecx
mov word [ebp - 0x1b4], cx
xor edx, edx
mov word [ebp - 0x28], dx
push ecx
xor ecx, 0x2208
and ecx, 0x3b1f
pop ecx
push edi
call 0x4141cc
add byte [esi + 0x4c], al
cmp dword [esi], edi
dec ebx
xor eax, 0x8344333f
les eax, [eax + ebp*8]
or byte [eax], al
add byte [eax], al
add byte [0x37484e4b], dh
cmp dword [eax], edi
add esp, 4
pop edi
mov eax, dword [ebp - 0xc44]
mov cx, word [eax]
mov word [ebp - 0xfd6], cx
mov edx, dword [ebp - 0xc44]
add edx, 2
mov dword [ebp - 0xc44], edx
mov ax, word [ebp - 0xfd6]
mov word [ebp - 0x1b4], ax
mov ecx, dword [ebp - 0xc48]
mov dx, word [ecx]
mov word [ebp - 0xfd8], dx
mov eax, dword [ebp - 0xc48]
add eax, 2
mov dword [ebp - 0xc48], eax
mov cx, word [ebp - 0xfd8]
mov word [ebp - 0x28], cx
push ecx
call 0x414245
add byte [ecx + 0x4f], cl
inc eax
cmp eax, 0x834c384c
les eax, [ecx + ebx*2]
push edx
push ebx
add esp, 4
and edx, 0x179ff
pop edx
push edi
xor edi, 0x1014f
xor edi, 0x8fa6
sub edi, 0x142b4
pop edi
movzx edx, word [ebp - 0x28]
test edx, edx
jne 0x414286
movzx eax, word [ebp - 0x1b4]
movzx ecx, word [ebp - 0x28]
sub eax, ecx
mov dword [ebp - 0x1548], eax
mov eax, 0xebffffea
pop edx
movzx edx, word [ebp - 0x1b4]
movzx eax, word [ebp - 0x28]
cmp edx, eax
je 0x4141ae
movzx ecx, word [ebp - 0x1b4]
xor ecx, 0x20
movzx edx, word [ebp - 0x28]
cmp ecx, edx
je 0x4141ae
movzx eax, word [ebp - 0x1b4]
movzx ecx, word [ebp - 0x28]
cmp eax, ecx
jge 0x4142ca
mov dword [ebp - 0x1544], 0xffffffff
jmp 0x4142d4
mov dword [ebp - 0x1544], 1
mov edx, dword [ebp - 0x1544]
mov dword [ebp - 0x1548], edx
cmp dword [ebp - 0x1548], 0
jne 0x414329
push eax
xor eax, 0xc6a0
pop eax
push ecx
push edx
add esp, 4
sub ecx, 0x1483f
add ecx, 0x16a57
pop ecx
push esi
push ebx
add esp, 4
sub esi, 0x5a79
pop esi
push edx
push edi
add edi, 0x6d49
pop edi
push edx
push edi
add esp, 4
call 0x414343
add byte [edx + 0x4c], al
dec edi
dec esp
dec ecx
aaa
dec ebx
add esp, 4
xor edx, 0xda62
or edx, 0x17f47
pop edx
push ecx
sub ecx, 0xf8c7
pop ecx
mov ecx, dword [ebp - 0x4c8]
mov edx, dword [ecx]
mov dword [ebp - 0x4c8], edx
mov eax, dword [ebp - 0x4c8]
cmp eax, dword [ebp - 0xc4c]
je 0x414387
mov ecx, dword [ebp - 0x4c8]
cmp dword [ecx + 0x30], 0
jne 0x414152
mov dword [ebp - 0x29c], 0
Function at 0x414240
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
jmp 0x41415a
xor ebx, 0x13328
jmp 0x414166
call 0x414172
add byte [edi + 0x43], al
aaa
dec ebp
aas
add esp, 4
pop ebx
push edx
xor edx, 0x18c
sub edx, 0x5427
pop edx
lea ecx, [ebp - 0x15e8]
mov dword [ebp - 0xc48], ecx
mov edx, dword [ebp - 0x4c8]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xc44], eax
xor ecx, ecx
mov word [ebp - 0x1b4], cx
xor edx, edx
mov word [ebp - 0x28], dx
push ecx
xor ecx, 0x2208
and ecx, 0x3b1f
pop ecx
push edi
call 0x4141cc
add byte [esi + 0x4c], al
cmp dword [esi], edi
dec ebx
xor eax, 0x8344333f
les eax, [eax + ebp*8]
or byte [eax], al
add byte [eax], al
add byte [0x37484e4b], dh
cmp dword [eax], edi
add esp, 4
pop edi
mov eax, dword [ebp - 0xc44]
mov cx, word [eax]
mov word [ebp - 0xfd6], cx
mov edx, dword [ebp - 0xc44]
add edx, 2
mov dword [ebp - 0xc44], edx
mov ax, word [ebp - 0xfd6]
mov word [ebp - 0x1b4], ax
mov ecx, dword [ebp - 0xc48]
mov dx, word [ecx]
mov word [ebp - 0xfd8], dx
mov eax, dword [ebp - 0xc48]
add eax, 2
mov dword [ebp - 0xc48], eax
mov cx, word [ebp - 0xfd8]
mov word [ebp - 0x28], cx
push ecx
call 0x414245
add byte [ecx + 0x4f], cl
inc eax
cmp eax, 0x834c384c
les eax, [ecx + ebx*2]
push edx
push ebx
add esp, 4
and edx, 0x179ff
pop edx
push edi
xor edi, 0x1014f
xor edi, 0x8fa6
sub edi, 0x142b4
pop edi
movzx edx, word [ebp - 0x28]
test edx, edx
jne 0x414286
movzx eax, word [ebp - 0x1b4]
movzx ecx, word [ebp - 0x28]
sub eax, ecx
mov dword [ebp - 0x1548], eax
mov eax, 0xebffffea
pop edx
movzx edx, word [ebp - 0x1b4]
movzx eax, word [ebp - 0x28]
cmp edx, eax
je 0x4141ae
movzx ecx, word [ebp - 0x1b4]
xor ecx, 0x20
movzx edx, word [ebp - 0x28]
cmp ecx, edx
je 0x4141ae
movzx eax, word [ebp - 0x1b4]
movzx ecx, word [ebp - 0x28]
cmp eax, ecx
jge 0x4142ca
mov dword [ebp - 0x1544], 0xffffffff
jmp 0x4142d4
mov dword [ebp - 0x1544], 1
mov edx, dword [ebp - 0x1544]
mov dword [ebp - 0x1548], edx
cmp dword [ebp - 0x1548], 0
jne 0x414329
push eax
xor eax, 0xc6a0
pop eax
push ecx
push edx
add esp, 4
sub ecx, 0x1483f
add ecx, 0x16a57
pop ecx
push esi
push ebx
add esp, 4
sub esi, 0x5a79
pop esi
push edx
push edi
add edi, 0x6d49
pop edi
push edx
push edi
add esp, 4
call 0x414343
add byte [edx + 0x4c], al
dec edi
dec esp
dec ecx
aaa
dec ebx
add esp, 4
xor edx, 0xda62
or edx, 0x17f47
pop edx
push ecx
sub ecx, 0xf8c7
pop ecx
mov ecx, dword [ebp - 0x4c8]
mov edx, dword [ecx]
mov dword [ebp - 0x4c8], edx
mov eax, dword [ebp - 0x4c8]
cmp eax, dword [ebp - 0xc4c]
je 0x414387
mov ecx, dword [ebp - 0x4c8]
cmp dword [ecx + 0x30], 0
jne 0x414152
mov dword [ebp - 0x29c], 0
Function at 0x414245
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
jmp 0x41415a
xor ebx, 0x13328
jmp 0x414166
call 0x414172
add byte [edi + 0x43], al
aaa
dec ebp
aas
add esp, 4
pop ebx
push edx
xor edx, 0x18c
sub edx, 0x5427
pop edx
lea ecx, [ebp - 0x15e8]
mov dword [ebp - 0xc48], ecx
mov edx, dword [ebp - 0x4c8]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xc44], eax
xor ecx, ecx
mov word [ebp - 0x1b4], cx
xor edx, edx
mov word [ebp - 0x28], dx
push ecx
xor ecx, 0x2208
and ecx, 0x3b1f
pop ecx
push edi
call 0x4141cc
add byte [esi + 0x4c], al
cmp dword [esi], edi
dec ebx
xor eax, 0x8344333f
les eax, [eax + ebp*8]
or byte [eax], al
add byte [eax], al
add byte [0x37484e4b], dh
cmp dword [eax], edi
add esp, 4
pop edi
mov eax, dword [ebp - 0xc44]
mov cx, word [eax]
mov word [ebp - 0xfd6], cx
mov edx, dword [ebp - 0xc44]
add edx, 2
mov dword [ebp - 0xc44], edx
mov ax, word [ebp - 0xfd6]
mov word [ebp - 0x1b4], ax
mov ecx, dword [ebp - 0xc48]
mov dx, word [ecx]
mov word [ebp - 0xfd8], dx
mov eax, dword [ebp - 0xc48]
add eax, 2
mov dword [ebp - 0xc48], eax
mov cx, word [ebp - 0xfd8]
mov word [ebp - 0x28], cx
push ecx
call 0x414245
add byte [ecx + 0x4f], cl
inc eax
cmp eax, 0x834c384c
les eax, [ecx + ebx*2]
push edx
push ebx
add esp, 4
and edx, 0x179ff
pop edx
push edi
xor edi, 0x1014f
xor edi, 0x8fa6
sub edi, 0x142b4
pop edi
movzx edx, word [ebp - 0x28]
test edx, edx
jne 0x414286
movzx eax, word [ebp - 0x1b4]
movzx ecx, word [ebp - 0x28]
sub eax, ecx
mov dword [ebp - 0x1548], eax
mov eax, 0xebffffea
pop edx
movzx edx, word [ebp - 0x1b4]
movzx eax, word [ebp - 0x28]
cmp edx, eax
je 0x4141ae
movzx ecx, word [ebp - 0x1b4]
xor ecx, 0x20
movzx edx, word [ebp - 0x28]
cmp ecx, edx
je 0x4141ae
movzx eax, word [ebp - 0x1b4]
movzx ecx, word [ebp - 0x28]
cmp eax, ecx
jge 0x4142ca
mov dword [ebp - 0x1544], 0xffffffff
jmp 0x4142d4
mov dword [ebp - 0x1544], 1
mov edx, dword [ebp - 0x1544]
mov dword [ebp - 0x1548], edx
cmp dword [ebp - 0x1548], 0
jne 0x414329
push eax
xor eax, 0xc6a0
pop eax
push ecx
push edx
add esp, 4
sub ecx, 0x1483f
add ecx, 0x16a57
pop ecx
push esi
push ebx
add esp, 4
sub esi, 0x5a79
pop esi
push edx
push edi
add edi, 0x6d49
pop edi
push edx
push edi
add esp, 4
call 0x414343
add byte [edx + 0x4c], al
dec edi
dec esp
dec ecx
aaa
dec ebx
add esp, 4
xor edx, 0xda62
or edx, 0x17f47
pop edx
push ecx
sub ecx, 0xf8c7
pop ecx
mov ecx, dword [ebp - 0x4c8]
mov edx, dword [ecx]
mov dword [ebp - 0x4c8], edx
mov eax, dword [ebp - 0x4c8]
cmp eax, dword [ebp - 0xc4c]
je 0x414387
mov ecx, dword [ebp - 0x4c8]
cmp dword [ecx + 0x30], 0
jne 0x414152
mov dword [ebp - 0x29c], 0
Function at 0x414343
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
jmp 0x41415a
xor ebx, 0x13328
jmp 0x414166
call 0x414172
add byte [edi + 0x43], al
aaa
dec ebp
aas
add esp, 4
pop ebx
push edx
xor edx, 0x18c
sub edx, 0x5427
pop edx
lea ecx, [ebp - 0x15e8]
mov dword [ebp - 0xc48], ecx
mov edx, dword [ebp - 0x4c8]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xc44], eax
xor ecx, ecx
mov word [ebp - 0x1b4], cx
xor edx, edx
mov word [ebp - 0x28], dx
push ecx
xor ecx, 0x2208
and ecx, 0x3b1f
pop ecx
push edi
call 0x4141cc
add byte [esi + 0x4c], al
cmp dword [esi], edi
dec ebx
xor eax, 0x8344333f
les eax, [eax + ebp*8]
or byte [eax], al
add byte [eax], al
add byte [0x37484e4b], dh
cmp dword [eax], edi
add esp, 4
pop edi
mov eax, dword [ebp - 0xc44]
mov cx, word [eax]
mov word [ebp - 0xfd6], cx
mov edx, dword [ebp - 0xc44]
add edx, 2
mov dword [ebp - 0xc44], edx
mov ax, word [ebp - 0xfd6]
mov word [ebp - 0x1b4], ax
mov ecx, dword [ebp - 0xc48]
mov dx, word [ecx]
mov word [ebp - 0xfd8], dx
mov eax, dword [ebp - 0xc48]
add eax, 2
mov dword [ebp - 0xc48], eax
mov cx, word [ebp - 0xfd8]
mov word [ebp - 0x28], cx
push ecx
call 0x414245
add byte [ecx + 0x4f], cl
inc eax
cmp eax, 0x834c384c
les eax, [ecx + ebx*2]
push edx
push ebx
add esp, 4
and edx, 0x179ff
pop edx
push edi
xor edi, 0x1014f
xor edi, 0x8fa6
sub edi, 0x142b4
pop edi
movzx edx, word [ebp - 0x28]
test edx, edx
jne 0x414286
movzx eax, word [ebp - 0x1b4]
movzx ecx, word [ebp - 0x28]
sub eax, ecx
mov dword [ebp - 0x1548], eax
mov eax, 0xebffffea
pop edx
movzx edx, word [ebp - 0x1b4]
movzx eax, word [ebp - 0x28]
cmp edx, eax
je 0x4141ae
movzx ecx, word [ebp - 0x1b4]
xor ecx, 0x20
movzx edx, word [ebp - 0x28]
cmp ecx, edx
je 0x4141ae
movzx eax, word [ebp - 0x1b4]
movzx ecx, word [ebp - 0x28]
cmp eax, ecx
jge 0x4142ca
mov dword [ebp - 0x1544], 0xffffffff
jmp 0x4142d4
mov dword [ebp - 0x1544], 1
mov edx, dword [ebp - 0x1544]
mov dword [ebp - 0x1548], edx
cmp dword [ebp - 0x1548], 0
jne 0x414329
push eax
xor eax, 0xc6a0
pop eax
push ecx
push edx
add esp, 4
sub ecx, 0x1483f
add ecx, 0x16a57
pop ecx
push esi
push ebx
add esp, 4
sub esi, 0x5a79
pop esi
push edx
push edi
add edi, 0x6d49
pop edi
push edx
push edi
add esp, 4
call 0x414343
add byte [edx + 0x4c], al
dec edi
dec esp
dec ecx
aaa
dec ebx
add esp, 4
xor edx, 0xda62
or edx, 0x17f47
pop edx
push ecx
sub ecx, 0xf8c7
pop ecx
mov ecx, dword [ebp - 0x4c8]
mov edx, dword [ecx]
mov dword [ebp - 0x4c8], edx
mov eax, dword [ebp - 0x4c8]
cmp eax, dword [ebp - 0xc4c]
je 0x414387
mov ecx, dword [ebp - 0x4c8]
cmp dword [ecx + 0x30], 0
jne 0x414152
mov dword [ebp - 0x29c], 0
Function at 0x4145c0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x154]
add eax, 1
mov dword [ebp - 0x154], eax
call 0x4145cc
add byte [ecx + 0x3d], al
cmp al, 0x43
cmp ecx, dword [esi - 0x7d]
les eax, [ecx + eax*4]
out 0xf3, al
test dword [eax], 0xecf68100
sub eax, dword [eax]
add byte [esi - 0x75], bl
xchg ebp, eax
enter 0xfffffffffffffff8, 0xffffffffffffffff
add edx, dword [ebp - 0x154]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x154]
movsx edx, byte [ebp + ecx - 0x824]
cmp eax, edx
je 0x414621
mov eax, dword [ebp - 0x738]
add eax, dword [ebp - 0x154]
movsx ecx, byte [eax]
xor ecx, 0x20
mov edx, dword [ebp - 0x154]
movsx eax, byte [ebp + edx - 0x824]
cmp ecx, eax
jne 0x414628
jmp 0x41456e
jmp 0x41462f

Function at 0x4145cc
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x154]
add eax, 1
mov dword [ebp - 0x154], eax
call 0x4145cc
add byte [ecx + 0x3d], al
cmp al, 0x43
cmp ecx, dword [esi - 0x7d]
les eax, [ecx + eax*4]
out 0xf3, al
test dword [eax], 0xecf68100
sub eax, dword [eax]
add byte [esi - 0x75], bl
xchg ebp, eax
enter 0xfffffffffffffff8, 0xffffffffffffffff
add edx, dword [ebp - 0x154]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x154]
movsx edx, byte [ebp + ecx - 0x824]
cmp eax, edx
je 0x414621
mov eax, dword [ebp - 0x738]
add eax, dword [ebp - 0x154]
movsx ecx, byte [eax]
xor ecx, 0x20
mov edx, dword [ebp - 0x154]
movsx eax, byte [ebp + edx - 0x824]
cmp ecx, eax
jne 0x414628
jmp 0x41456e
jmp 0x41462f
Function at 0x414c69
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp eax, dword [ebp + 0x49]
cmp al, 0x3a
xor al, 0x42
dec esp
dec ebx
add esp, 4
and ecx, 0x6855
pop ecx
push ebx
and ebx, 0x17fb8
pop ebx
cmp dword [ebp - 0x2a0], 0
jne 0x41557f
mov edx, 0x6b
mov word [ebp - 0x1670], dx
mov eax, 0x65
mov word [ebp - 0x166e], ax
mov ecx, 0x72
mov word [ebp - 0x166c], cx
mov edx, 0x6e
mov word [ebp - 0x166a], dx
mov eax, 0x65
mov word [ebp - 0x1668], ax
mov ecx, 0x6c
mov word [ebp - 0x1666], cx
mov edx, 0x33
mov word [ebp - 0x1664], dx
mov eax, 0x32
mov word [ebp - 0x1662], ax
mov ecx, 0x2e
mov word [ebp - 0x1660], cx
mov edx, 0x64
mov word [ebp - 0x165e], dx
push ecx
or ecx, 0x296d
pop ecx
push eax
xor eax, 0x8c2a
or eax, 0xe23b
pop eax
push edi
add edi, 0x167e4
jmp 0x4155a4
and edi, 0xd34
add edi, 0x122a5
pop edi
mov eax, dword fs:[0x18]
mov dword [ebp - 0x1c54], eax
mov ecx, dword [ebp - 0x1c54]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x1c58], edx
mov eax, dword [ebp - 0x1c58]
mov dword [ebp - 0x157c], eax
push eax
sub eax, 0x17ec4
jmp 0x4155e8
or eax, 0x43f3
xor eax, 0x6bf7
pop eax
push esi
push eax
add esp, 4
jmp 0x415603
jmp 0x415609
pop esi
cmp dword [ebp - 0x157c], 0
jne 0x415622
mov dword [ebp - 0x2a0], 0
jmp 0x4158c9
add byte [eax], al
Function at 0x4153c4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
sub edi, 0x9c60

Function at 0x415425
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x6c4]
add edx, 1
mov dword [ebp - 0x6c4], edx
mov eax, dword [ebp - 0x744]
mov ecx, dword [ebp - 0x6c4]
cmp ecx, dword [eax + 0x18]
jae 0x415498
mov edx, dword [ebp - 0x6c4]
mov eax, dword [ebp - 0x1c3c]
mov ecx, dword [ebp - 0x354]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x74c], ecx
mov edx, dword [ebp - 0x6c4]
invalid
dec dword [ebx - 0x1c3f7b]
dec dword [edi]
mov bh, 0xc
push eax
mov edx, dword [ebp - 0x1c44]
mov eax, dword [ebp - 0x354]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x1c48], eax
mov dword [ebp - 0x158], 0
jmp 0x4152fc
mov ecx, dword [ebp - 0x158]
add ecx, 1
mov dword [ebp - 0x158], ecx
mov edx, dword [ebp - 0x74c]
add edx, dword [ebp - 0x158]
movsx eax, byte [edx]
test eax, eax
je 0x4153ae
mov ecx, dword [ebp - 0x158]
movsx edx, byte [ebp + ecx - 0x850]
test edx, edx
je 0x4153ae
push ebx
push eax
add esp, 4
add ebx, 0x17c4
and ebx, 0xb690
add ebx, 0x17dc
and ebx, 0x8e6a
pop ebx
push ecx
and ecx, 0x159af
sub ecx, 0xe881
add ecx, 0x143c0
pop ecx
mov eax, dword [ebp - 0x74c]
add eax, dword [ebp - 0x158]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x158]
movsx eax, byte [ebp + edx - 0x850]
cmp ecx, eax
je 0x4153a0
mov ecx, dword [ebp - 0x74c]
add ecx, dword [ebp - 0x158]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x158]
movsx ecx, byte [ebp + eax - 0x850]
cmp edx, ecx
jne 0x4153a7
jmp 0x4152ed
jmp 0x4153ae
push edi
or edi, 0x16c97
call fcn.004153c4
add byte [eax], bh
cmp al, byte [edi + 0x3c]
xor dh, byte [edx]
dec eax
xor cl, byte [eax - 0x7d]
add esp, 4
sub edi, 0x9c60
and edi, 0x4b4f
pop edi
push ebx
push ecx
add esp, 4
add ebx, 0xbdf
pop ebx
mov edx, dword [ebp - 0x74c]
add edx, dword [ebp - 0x158]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x158]
movsx edx, byte [ebp + ecx - 0x850]
cmp eax, edx
jne 0x41540d
mov dword [ebp - 0xc6c], 0
jmp 0x41547c
push eax
push esi
add esp, 4
xor eax, 0x48a0
call 0x415425
add byte [eax], bh
cmp al, 0x41
inc edx
xor eax, 0xc4833434
add al, 0xeb
add al, 0x49
cmp byte [ecx + eax*2 + 0x58], cl
push edx
sub edx, 0x15ac5
jmp 0x41543e
pop edx
mov eax, dword [ebp - 0x74c]
add eax, dword [ebp - 0x158]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x158]
movsx eax, byte [ebp + edx - 0x850]
or eax, 0x20
cmp ecx, eax
jge 0x415472
mov dword [ebp - 0xc6c], 0xffffffff
jmp 0x41547c
mov dword [ebp - 0xc6c], 1
cmp dword [ebp - 0xc6c], 0
jne 0x415493
mov ecx, dword [ebp - 0x1c48]
mov dword [ebp - 0x39c], ecx
jmp 0x4154a4
jmp 0x41527d
mov edx, dword [ebp - 0x750]
mov dword [ebp - 0x39c], edx
cmp dword [ebp - 0x39c], 0
je 0x41557f
push edx
push ebx
add esp, 4
call 0x4154c3
add byte [esp + ecx*2], bh
inc ecx
inc ecx
cmp esi, dword [0x8104c483]
ret 0x7b00