joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x2de3561b
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e3d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x35e56411
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x401230
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x3a8
sub eax, 1
push ebx
push edi
jne 0x4012c5
push 0x3a4
push eax
lea ebx, [eax + 1]
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x14], 0x3a8
call fcn.004131f0
mov eax, dword [esp + 0x3c0]
add esp, 0xc
call fcn.00401e70
cmp byte [0x497292], 0
je 0x4012ae
cmp byte [0x497294], 0
mov edi, dword [esp + 0x3b4]
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], 2
jne 0x42aa61
cmp byte [edi + 9], 0
jne 0x42aaac
cmp byte [edi + 0x184], bl
je 0x42aaf8
push ebx
push esi
call dword [sym.imp.USER32.dll_KillTimer]
push 0
push 0x2ee
push ebx
push esi
call dword [sym.imp.USER32.dll_SetTimer]
pop edi
pop ebx
add esp, 0x3a8
ret 4
add byte [ecx + 0x181e5cf], al
add byte [ecx + 0x8c74ef], al
add byte [edi + 0x57], bl
push es
cmp byte [edx], dh
inc edx
dec esi
aas
pop ecx

Function at 0x401440
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x214
call fcn.004027d0
test al, al
je 0x42c2c1
call fcn.004014f0
test eax, eax
jne 0x42c2c1
call fcn.0040d5d0
test eax, eax
jne 0x42c2c1
mov edx, dword [esp + 0x218]
lea eax, [esp]
push eax
lea ecx, [esp + 8]
push ecx
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
lea eax, [esp + 4]
push eax
mov eax, 0x4a7fe8
call fcn.004021e0
mov ecx, dword [esp]
push ecx
mov eax, 0x4a7fd8
call fcn.004021e0
mov eax, dword [esp]
xor edx, edx
mov word [eax - 2], dx
cmp word [esp + 8], dx
je 0x42c2cb
lea edx, [esp + 4]
push edx
mov eax, 0x4a7ff8
call fcn.004021e0
mov eax, dword [esp + 0x21c]
mov dword [0x4a7fd4], eax
xor eax, eax
add esp, 0x214
ret 8
test dword [ebx + edi*8], esp
invalid
invalid
Function at 0x4019e0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edi
test eax, eax
jne 0x401a03
cmp dword [0x4a7cdc], eax
jne 0x42c03e
mov edi, 0x4a7ccc
push ecx
push edx
mov eax, esi
call fcn.00404260
mov al, 1
pop edi
ret
sub eax, 1
jne 0x42c01c
push ecx
push edx
cmp dword [0x4a7cdc], eax
jne 0x42c040
mov edi, 0x4a7ccc
mov eax, esi
call fcn.00404260
mov al, 1
pop edi
ret
jmp 0x42c087
add byte [eax], al
add byte [eax], al
cmp byte [eax], al
add byte [eax - 0x7d], bl
mov ebp, 0xfffff3c4
add byte [ebp + 0xf], dh

Function at 0x401e70
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4b8
cmp byte [0x497292], 0
push esi
push edi
je 0x401f6e
mov esi, eax
mov eax, 0x104
lea ecx, [esp + 8]
call fcn.00401400
cmp byte [0x497294], 1
je 0x42a9a0
xor edx, edx
mov word [esp + 0x18], dx
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0xc]
call fcn.004021e0
cmp byte [0x497291], 0
jne 0x42a9cd
cmp dword [esi + 0x60], 0
jne 0x42a9bb
mov edi, dword [0x4a7cf8]
lea eax, [esp + 8]
call fcn.0040d330
push 0x3a4
lea ecx, [esp + 0x120]
push 0
push ecx
call fcn.004131f0
mov eax, dword [esp + 0x14]
mov edx, dword [0x4972c0]
push 0x7f
push eax
lea ecx, [esp + 0x2c]
push ecx
mov dword [esp + 0x130], 0x3a8
mov dword [esp + 0x134], edx
mov dword [esp + 0x138], 1
mov dword [esp + 0x13c], 4
call fcn.0041326a
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x14c]
xor edx, edx
push ecx
mov word [esp + 0x136], dx
call fcn.00411691
add esp, 0x20
lea edx, [esp + 0x118]
push edx
push 1
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
lea ecx, [esp + 8]
call fcn.00402620
pop edi
pop esi
mov esp, ebp
pop ebp
ret
add al, 0x81
ret 0x2b59
Function at 0x401f80
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x50
push ebx
push ebp
push esi
push edi
lea esi, [esp + 0x3c]
call fcn.0040e680
mov eax, dword [esp + 0x64]
xor ebp, ebp
push eax
mov ecx, esi
mov dword [esp + 0x18], ebp
call fcn.00402940
push 0x104
push 0x4a7d14
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, 0x4a7d14
call fcn.0040ff90
lea esi, [esp + 0x40]
lea edi, [esp + 0x28]
mov bl, al
mov dword [0x4a7cf8], 0x4a7d14
call fcn.004107b0
mov edi, str.CMDLINERAW
lea esi, [esp + 0x18]
call fcn.00401b70
xor eax, eax
lea ecx, [ebp + 1]
lea edx, [esp + 0x28]
call fcn.004019e0
mov ecx, esi
call fcn.00402620
lea esi, [esp + 0x28]
call fcn.004092c0
mov edi, str.CMDLINE
lea esi, [esp + 0x18]
mov dword [esp + 0x30], 1
mov dword [esp + 0x28], ebp
call fcn.00401b70
xor eax, eax
mov ecx, 0x100
lea edx, [esp + 0x28]
call fcn.004019e0
mov ecx, esi
call fcn.00402620
lea esi, [esp + 0x18]
call fcn.00401b70
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x68]
push edx
xor ecx, ecx
call fcn.0040c3e0
mov ecx, esi
call fcn.00402620
mov ebp, dword [esp + 0x58]
lea ecx, [esp + 0x18]
call fcn.0040c060
lea ecx, [esp + 0x18]
lea eax, [esp + 0x3c]
call fcn.00401a70
mov esi, dword [esp + 0x18]
push esi
push str._ErrorStdOut
call fcn.004115d0
add esp, 8
test eax, eax
je 0x42c174
push esi
push str._AutoIt3OutputDebug
call fcn.004115d0
add esp, 8
test eax, eax
je 0x42c192
push esi
push str._AutoIt3ExecuteLine
call fcn.004115d0
add esp, 8
test eax, eax
je 0x42c1b0
push esi
push str._AutoIt3ExecuteScript
call fcn.004115d0
add esp, 8
test eax, eax
jne 0x40210b
test bl, bl
jne 0x42c20a
mov dword [0x4a7cfc], 3
lea ecx, [esp + 0x18]
lea eax, [esp + 0x3c]
call fcn.00401a70
mov edx, dword [esp + 0x18]
push edx
push 0x4a7d14
call fcn.00411691
add esp, 8
lea ecx, [esp + 0x18]
lea eax, [esp + 0x3c]
sub ebp, 2
call fcn.00401a70
mov esi, dword [esp + 0x18]
cmp word [0x4a7d14], 0
je 0x42c219
test ebp, ebp
jl 0x42c243
mov edi, dword [esp + 0x64]
lea eax, [ebp + 1]
push eax
push 1
mov eax, edi
call fcn.0040e7e0
push 0
push 1
push 0
push edi
call fcn.0040d030
add esp, 0x18
mov esi, eax
call fcn.004092c0
mov dword [esi + 8], 1
mov dword [esi], ebp
test ebp, ebp
jle 0x402184
xor ebx, ebx
inc ebx
push ebx
push 1
push 0
push edi
call fcn.0040d030
add esp, 0x10
lea edi, [esp + 0x18]
mov esi, eax
call fcn.0040e640
mov ecx, edi
lea eax, [esp + 0x3c]
call fcn.00401a70
cmp ebx, ebp
jl 0x42c23a
lea ecx, [esp + 0x18]
call fcn.00402620
lea esi, [esp + 0x28]
call fcn.004092c0
lea edi, [esp + 0x50]
call fcn.00401a30
mov dword [esp + 0x3c], 0
mov dword [esp + 0x50], 0x4848ec
call fcn.00401a30
mov ecx, dword [esp + 0x54]
push ecx
call fcn.004112ef
add esp, 4
lea ecx, [esp + 0x40]
call fcn.00402620
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret 4
mov dword [ebp - 0xf88], eax
push ebp
int3
add byte [ecx + 0x51], bl
invalid
jmp 0x42c23b
invalid
add byte [ebp + 0x40], dh
Function at 0x4027d0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebx
push ebp
xor ebp, ebp
push esi
push edi
cmp dword [0x4a8ec4], ebp
jne 0x402929
mov eax, dword [0x4a8e90]
cmp eax, ebp
je 0x42c16d
mov esi, dword [0x4a8e88]
xor ecx, ecx
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041171a
mov edx, dword [0x4a8e90]
add esp, 4
cmp edx, ebp
mov dword [0x4a8e94], eax
jle 0x40283c
xor ecx, ecx
jmp 0x40282c
mov esi, dword [esi + 0xc]
mov eax, dword [0x4a8e94]
mov edx, dword [esi]
mov dword [eax + ecx*4], edx
mov edx, dword [0x4a8e90]
inc ecx
cmp ecx, edx
jl 0x402824
lea edi, [edx + 1]
xor ecx, ecx
mov eax, edi
mov edx, 0x10
mul edx
seto cl
mov esi, 1
mov dword [esp + 0x10], 0x485234
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
push eax
call fcn.0041171a
add esp, 4
cmp eax, ebp
je 0x42c15d
lea ecx, [edi - 1]
cmp ecx, ebp
mov dword [eax], edi
lea edx, [eax + 4]
jl 0x4028b6
mov eax, edx
jmp 0x4028a0
mov dword [eax], 0x485234
mov dword [eax + 4], ebp
mov dword [eax + 8], ebp
mov dword [eax + 0xc], ebp
add eax, 0x10
sub ecx, esi
jns 0x4028a0
mov eax, edx
mov dword [0x4a8ec4], eax
mov edi, 0x10
cmp esi, dword [0x4a8e90]
mov eax, dword [0x4a8e94]
jg 0x40290b
cmp eax, ebp
je 0x40290b
cmp esi, ebp
jle 0x40290b
mov ebx, dword [eax + esi*4 - 4]
cmp ebx, ebp
je 0x40290b
lea ecx, [esp + 0x10]
push ecx
push esi
call fcn.00402dd0
test eax, eax
jne 0x42c164
mov eax, dword [0x4a8ec4]
lea edx, [esp + 0x10]
push edx
lea ecx, [edi + eax]
push ecx
call fcn.004026a0
inc esi
add edi, 0x10
jmp 0x4028c2
lea ebx, [esp + 0x10]
mov dword [esp + 0x10], 0x485234
call fcn.0040d1e0
mov edx, dword [esp + 0x14]
push edx
call fcn.004112ef
add esp, 4
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov ecx, dword [ebp - 0xf86]
mov dword [ebp - 0x200], ecx
invalid
Function at 0x402b70
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov esi, ebp
mov edi, eax
mov ebx, ecx
call fcn.00403770
mov eax, dword [edi]
movzx esi, word [ebx + eax*2]
cmp si, 0x5a
jbe 0x402ba7
cmp si, 0x61
jb 0x402baf
cmp si, 0x7a
ja 0x402baf
push esi
mov eax, ebp
call fcn.00403470
inc dword [edi]
jmp 0x402b83
cmp si, 0x41
jae 0x402b9b
jmp 0x402b8f
cmp si, 0x30
jae 0x402c54
cmp si, 0x5f
je 0x402b9b
mov eax, ebp
call fcn.00402ae0
mov ecx, dword [ebp + 4]
mov edx, dword [ebp]
push ecx
push edx
call dword [sym.imp.USER32.dll_CharUpperBuffW]
xor ebx, ebx
jmp 0x402be0
mov eax, dword [ebp]
push eax
mov eax, dword [ebx*4 + 0x492670]
push eax
call fcn.004133e4
add esp, 8
test eax, eax
je 0x402c36
inc ebx
cmp ebx, 0x2b
jl 0x402be0
cmp si, 0x28
jne 0x42ab1a
mov eax, dword [ebp]
mov ecx, dword [0x4a8e84]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test eax, eax
jl 0x402c63
mov esi, dword [esp + 0x14]
mov edi, 1
mov ebx, eax
call fcn.00402b00
mov dword [esi], ebx
pop edi
pop esi
pop ebp
pop ebx
ret 8
test ebx, ebx
jl 0x402bfe
cmp si, 0x20
jne 0x402c83
mov esi, dword [esp + 0x14]
xor edi, edi
call fcn.00402b00
pop edi
mov dword [esi], ebx
pop esi
pop ebp
pop ebx
ret 8
cmp si, 0x39
jbe 0x402b9b
jmp 0x402bb9
mov ebx, dword [esp + 0x14]
mov edi, 0x34
mov esi, ebx
call fcn.00402b00
mov esi, ebp
mov edi, ebx
call fcn.00402650
pop edi
pop esi
pop ebp
pop ebx
ret 8
cmp si, 9
je 0x402c40
cmp si, 0x2c
je 0x402c40
cmp si, 0x3d
je 0x402c40
cmp si, 0x28
je 0x402c40
cmp si, 0x29
je 0x402c40
cmp si, 0x5d
je 0x402c40
test si, si
je 0x402c40
jmp 0x42ab2e
pop es
fadd qword [eax]
add byte [edi - 0x17], bl
add al, byte cs:[eax]
add bh, al
test eax, edi
invalid
Function at 0x403530
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push ebp
push esi
mov esi, eax
call fcn.00403770
mov ecx, dword [edi]
cmp word [ebx + ecx*2 + 2], 0
lea eax, [ecx + 1]
mov dword [edi], eax
je 0x42b3da
movzx edx, word [ebx + ecx*2]
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], edx
jmp 0x403564
mov edx, dword [esp + 0xc]
mov eax, dword [edi]
lea ecx, [ebx + eax*2]
movzx eax, word [ecx]
cmp ax, dx
je 0x4035b0
movzx ebp, ax
mov eax, dword [esi + 0xc]
cmp dword [eax], 1
jg 0x42b384
mov eax, dword [esi + 4]
inc eax
call fcn.004034b0
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov word [ecx + eax*2], bp
inc dword [esi + 4]
mov eax, dword [esi + 4]
mov edx, dword [esi]
xor ecx, ecx
inc dword [edi]
mov word [edx + eax*2], cx
mov edx, dword [edi]
cmp word [ebx + edx*2], 0
jne 0x403560
jmp 0x42b3d6
cmp word [ecx + 2], dx
je 0x42b374
inc dword [edi]
xor eax, eax
pop esi
pop ebp
add esp, 0x10
ret 4
xor esi, dword [edi]

Function at 0x4035d0
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, eax
call fcn.00403770
mov eax, dword [edi]
cmp word [ebp + eax*2], 0x30
je 0x4036f0
mov byte [esp + 0x1c], 0
mov esi, eax
mov ebx, 0x17
mov edx, dword [edi]
movzx edx, word [ebp + edx*2]
movzx ecx, dx
mov eax, ecx
cmp eax, 0x2b
jl case.0x403625.44
cmp eax, 0x31
je case.0x403625.48
sub eax, 0x2b
cmp eax, 0x3a
ja case.0x403625.44
movzx eax, byte [eax + 0x403730]
jmp dword [eax*4 + 0x40371c]
and ebx, 0xffffffef
or ebx, 0x20
test bl, 0x20
je 0x403667
mov eax, dword [edi]
movzx ecx, word [ebp + eax*2]
inc eax
mov dword [edi], eax
mov eax, dword [esp + 0x24]
push ecx
call fcn.00403470
and ebx, 0xffffffdf
jmp 0x403600
and ecx, 0xffffffdf
cmp ecx, 0x41
jge 0x4036e2
cmp dx, 0x5f
jne 0x403632
jmp 0x42abf7
test bl, 0x10
jne 0x42abb0
cmp byte [esp + 0x1c], 0
jne 0x42ac0d
mov edi, dword [esp + 0x24]
mov eax, dword [edi]
push eax
call fcn.0041343c
mov ebx, eax
add esp, 4
mov ecx, ebx
add ecx, 0x80000000
mov ebp, edx
adc edx, 0
test edx, edx
ja 0x42ac48
jb 0x4036ac
cmp ecx, 0xffffffff
ja 0x42ac48
mov esi, dword [esp + 0x20]
movzx eax, word [esi + 8]
cmp ax, 0x3f
jle 0x403710
mov eax, 5
mov word [esi + 8], ax
mov dword [esi], 0
mov edi, dword [edi]
push edi
call fcn.00413431
add esp, 4
mov dword [esi], eax
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
cmp ecx, 0x5a
jg 0x40365c
jmp 0x42abf7
movzx ecx, word [ebp + eax*2 + 2]
mov ebx, esi
cmp cx, 0x78
je 0x42ab41
cmp cx, 0x58
jne 0x4035f4
jmp 0x42ab41
cmp ax, 0x30
jl 0x4036ba
jmp 0x42ac31
invalid
jno fcn.0042ab4e
add byte [eax], al
jmp 0x42abcc
invalid
add al, 0x81
mul ch
add dword ss:[eax], eax
inc ebp
retf
mov edx, 0x8100003e
loopne 0x42ac7e
jnp 0x42ac3b
add bl, ch
add esi, dword [esi]
dec ebp
cmp dword [eax + 0x51], ebx
inc eax
jmp 0x42ac80
Function at 0x403bd0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, eax
mov eax, dword [edi + 0xc]
cmp dword [eax], 1
jg 0x429e62
mov eax, dword [edi]
xor ebx, ebx
mov dword [edi + 4], ebx
mov byte [eax], bl
mov byte [esp + 0xd], bl
cmp dword [esi + 8], ebx
je 0x429e82
xor ebp, ebp
lea esp, [esp]
mov ecx, dword [esi + 0xc]
cmp ecx, dword [esi + 8]
je 0x403cf4
mov eax, dword [esi + 0xc]
mov edx, dword [esi + 4]
mov cl, byte [eax + edx]
mov byte [esp + ebp + 0xc], cl
inc ebp
inc eax
mov dword [esi + 0xc], eax
cmp ebp, 1
jb 0x403c00
add dword [esi + 0x10], ebp
adc dword [esi + 0x14], ebx
cmp ebp, ebx
je 0x403d1d
mov bl, byte [esp + 0xc]
cmp bl, 0xd
je 0x403c76
cmp bl, 0xa
je 0x403c94
mov eax, dword [edi + 0xc]
cmp dword [eax], 1
mov byte [esp + 0xd], 1
jg 0x429e9e
mov eax, dword [edi + 4]
add eax, 2
cmp dword [edi + 8], eax
jb 0x403c9d
mov eax, dword [edi + 4]
mov ecx, dword [edi]
mov byte [eax + ecx], bl
inc dword [edi + 4]
mov eax, dword [edi + 4]
mov edx, dword [edi]
mov byte [eax + edx], 0
xor ebx, ebx
jmp 0x403bf1
lea eax, [esp + 0xc]
push eax
mov ebx, 1
call fcn.00403d40
test eax, eax
je 0x403c94
cmp byte [esp + 0xc], 0xa
jne 0x429fab
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x10
ret
cmp eax, 0x41c2
jae 0x429ed0
lea edx, [eax + eax]
mov dword [edi + 8], edx
mov eax, dword [edi + 8]
test eax, eax
je 0x429fa1
add eax, 0xf
shr eax, 4
shl eax, 4
push eax
mov dword [edi + 8], eax
call fcn.0041171a
mov ebp, eax
mov eax, dword [edi]
add esp, 4
test eax, eax
je 0x403ced
mov ecx, dword [edi + 4]
inc ecx
push ecx
push eax
push ebp
call fcn.00410f70
mov edx, dword [edi]
push edx
call fcn.004112ef
add esp, 0x10
mov dword [edi], ebp
jmp 0x403c5b
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push ebx
lea edx, [esp + 0x14]
push edx
push 0x10000
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x403c23
jmp 0x429e93
cmp byte [esp + 0xd], 0
jne 0x403c94
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x10
ret
add byte [eax], al
lea eax, [eax - 3]
invalid
add byte [edx + 0x52], bl
add byte [edx - 0x75], bl
xchg ebp, eax
and cl, 0xff
inc dword [ebx - 0x6a76fe16]
push eax
jmp 0x429fb0
add dword [ecx - 0x14af6b], ecx
call dword [edi - 0x7f]
invalid
invalid

Function at 0x403d40
Capabilities:
Read file on windows

Disassembly:
cmp dword [esi + 8], 0
push ebp
mov ebp, dword [esp + 8]
push edi
je 0x403da9
xor edi, edi
test ebx, ebx
jbe 0x403d6e
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 8]
je 0x403d7c
mov edx, dword [esi + 0xc]
mov ecx, dword [esi + 4]
mov al, byte [ecx + edx]
mov byte [edi + ebp], al
inc dword [esi + 0xc]
inc edi
cmp edi, ebx
jb 0x403d52
add dword [esi + 0x10], edi
mov eax, edi
pop edi
adc dword [esi + 0x14], 0
pop ebp
ret 4
mov edx, dword [esi + 4]
mov eax, dword [esi]
push 0
lea ecx, [esp + 0x10]
push ecx
push 0x10000
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x403d6e
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0
jmp 0x403d5a
push esi
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
call fcn.0040e190
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
jmp 0x403d4c
Function at 0x403f40
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push esi
push edi
push 0
mov esi, eax
mov edi, dword [esi + 4]
mov eax, dword [esi]
push 0
inc edi
push edi
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x42b366
push ebx
xor ecx, ecx
push ebp
mov ebp, eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041171a
mov esi, dword [esi]
add esp, 4
push ebp
mov ebx, eax
push ebx
push edi
push esi
push 1
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, dword [esp + 0x14]
push 0
dec eax
push ebx
call fcn.00403fb0
push ebx
call fcn.004112ef
add esp, 4
pop ebp
pop ebx
pop edi
pop esi
ret 4
dec edx
fild word [eax]
add byte [ecx + 0xc7e3], al
add byte [ebx + 0x51], bl

Function at 0x403fb0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebp
push esi
push edi
mov edi, eax
mov esi, ecx
test edi, edi
je 0x404001
cmp edi, 0xffffffff
je 0x404001
mov ebp, dword [esp + 0x10]
test ebp, ebp
je 0x404001
mov eax, dword [esi + 0xc]
cmp dword [eax], 1
jg 0x42ac60
call fcn.00404020
mov eax, dword [esp + 0x14]
mov edx, dword [esi]
mov dword [esi + 4], edi
add edi, edi
push edi
lea ecx, [ebp + eax*2]
push ecx
push edx
call fcn.00410f70
mov eax, dword [esi]
add esp, 0xc
xor ecx, ecx
mov word [edi + eax], cx
pop edi
pop esi
pop ebp
ret 8
or eax, 0xffffffff
xor edi, edi
call fcn.0040c740
pop edi
pop esi
pop ebp
ret 8

Function at 0x404260
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
mov ebx, eax
push edi
push ebx
call fcn.004042f0
test al, al
jne 0x42bff9
push esi
push 0x20
and ebp, 0xff00
call fcn.0041171a
add esp, 4
test eax, eax
je 0x4042db
mov esi, eax
mov ecx, esi
call fcn.0040c060
cmp esi, ebx
je 0x4042a2
mov eax, ebx
mov ecx, esi
call fcn.00404080
push 0x10
mov dword [esi + 0x10], ebp
call fcn.0041171a
xor ebp, ebp
add esp, 4
cmp eax, ebp
je 0x4042df
mov ebx, eax
mov eax, dword [esp + 0x10]
call fcn.0040bd50
mov dword [esi + 0x14], eax
mov dword [esi + 0x1c], ebp
mov dword [esi + 0x18], ebp
mov edx, dword [edi]
push edx
mov eax, esi
call fcn.004041f0
pop esi
pop ebp
mov dword [edi], eax
pop ebx
ret 8
xor esi, esi
jmp 0x404295
xor eax, eax
jmp 0x4042c0
or al, 0xeb
invalid
Function at 0x409030
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x1c
mov ecx, dword [eax]
push ebp
push esi
mov esi, dword [edx + 4]
xor ebp, ebp
mov dword [esp + 0x14], 0x487630
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov ecx, dword [esi + ecx*4]
mov esi, dword [ecx]
movsx ecx, word [ecx + 0xa]
push edi
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x10]
push ecx
push edx
push ebx
lea edi, [esp + 0x24]
call fcn.00409110
test eax, eax
jne 0x42ceb6
push esi
lea edi, [ebx + 0x47c]
push edi
call fcn.004045e0
mov edx, dword [esp + 0x10]
cmp edx, dword [eax + 0x18]
jl 0x42cea9
push esi
push edi
call fcn.004045e0
mov ecx, dword [esp + 0x10]
cmp ecx, dword [eax + 0x1c]
jg 0x42cea9
mov edx, dword [esp + 0x2c]
push edx
lea eax, [esp + 0x1c]
push eax
push esi
mov ecx, ebx
call fcn.00404160
test eax, eax
jne 0x42ceb6
mov dword [esp + 0x18], 0x487630
cmp dword [esp + 0x20], ebp
jbe 0x4090f0
xor edi, edi
mov edi, edi
mov ecx, dword [esp + 0x1c]
mov esi, dword [ecx + edi*4]
cmp esi, ebp
je 0x4090e9
call fcn.004092c0
push esi
call fcn.004112ef
add esp, 4
inc edi
cmp edi, dword [esp + 0x20]
jb 0x4090d0
mov edx, dword [esp + 0x1c]
push edx
mov dword [esp + 0x24], ebp
call fcn.004112ef
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x1c
ret 4
mov dword [ebp - 0xf90], ecx
ret 0x8902

Function at 0x409110
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
inc dword [eax]
mov ecx, dword [eax]
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x24]
mov edx, dword [ebp + 4]
lea edx, [edx + ecx*4]
push esi
mov esi, dword [edx]
cmp word [esi + 8], 0x47
jne 0x42c051
mov edx, dword [esp + 0x24]
mov dword [esp + 0x28], ecx
mov dword [esp + 0xc], ecx
lea ecx, [esp + 0xc]
push ecx
push edx
lea edx, [esp + 0x30]
mov esi, ebp
call fcn.0040c2a0
test eax, eax
jne 0x42c065
mov ebx, dword [esp + 0xc]
mov ecx, dword [esp + 0x2c]
mov dword [ecx], eax
cmp dword [esp + 0x28], ebx
jae 0x409204
jmp 0x409172
xor eax, eax
lea edx, [esp + 0x10]
push edx
mov esi, edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x20], eax
call fcn.0040be00
mov ecx, dword [edi + 4]
mov eax, dword [edi + 8]
mov eax, dword [ecx + eax*4 - 4]
mov esi, dword [esp + 0x24]
push ebx
push eax
lea edx, [esp + 0x30]
push edx
push ebp
mov ecx, esi
call fcn.0040ab50
test eax, eax
jne 0x42c082
mov eax, dword [esp + 0x2c]
inc dword [eax]
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0x4091fb
mov ecx, dword [ebp + 4]
mov edx, dword [ecx + eax*4]
cmp word [edx + 8], 0x40
jne 0x42c06f
lea ecx, [eax + 1]
cmp ecx, ebx
je 0x42c06f
lea esi, [esp + 0x10]
mov dword [esp + 0x28], ecx
call fcn.004092c0
cmp dword [esp + 0x28], ebx
jb 0x409170
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0xc
lea esi, [esp + 0x10]
call fcn.004092c0
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0xc
inc edx
or al, 0x89
test esp, eax
invalid
add byte [eax], al
add byte [eax], al
cmp ecx, dword [edi + 0x32]
cmp dword [eax + 0x4b], eax
add dword [eax], eax