joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4042cf
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 8
test eax, eax
je 0x4041b8
test edi, edi
je 0x4041b8
cmp dword [ebp + 0xc], 0
je 0x4041b8
movsx eax, byte [eax]
push ebx
push esi
xor ebx, ebx
xor esi, esi
mov dword [ebp - 4], eax
test eax, eax
je 0x4040f9
mov dword [ebp - 8], 1
mov edi, edi
inc dword [ebp + 8]
cmp eax, 0x80
jae 0x40400e
push eax
call fcn.0048b843
add esp, 4
test eax, eax
jne 0x4040e8
mov eax, dword [ebp - 4]
cmp eax, 0x3d
je 0x404105
push eax
push str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
call fcn.0048b910
add esp, 8
test eax, eax
je 0x4041a3
cmp ebx, 3
ja 0x4040e3
jmp dword [ebx*4 + 0x4041c0]
call fcn.0048b9ce
mov eax, dword [ebp + 8]
movsx eax, byte [eax]
mov dword [ebp - 4], eax
test eax, eax
jne 0x403ff0
inc dword [ebp + 8]
cmp eax, 0x3d
jne 0x4041ac
mov ecx, dword [ebp + 8]
movsx eax, byte [ecx]
inc ecx
mov dword [ebp - 4], eax
mov dword [ebp + 8], ecx
cmp ebx, 3
ja 0x4041b0
jmp dword [ebx*4 + 0x4041d0]
add bl, ch
add al, 0x33
dec esp
add dword [eax], eax
pop esi
push ebx
push ecx
add esp, 4
jmp 0x4042a1
pop ebx
push edx
push ebx
add esp, 4
and edx, 0xb90
jmp 0x4042b6
pop edx
mov dword [ebp - 0x1e48], 0xe
push ecx
call 0x4042cf
add byte [edi + edi + 0x43], cl
dec ebx
inc ebx
inc eax
cmp eax, dword [ebx + 0x6eb04c4]
cmp dh, byte ds:[0x814b3744]
jmp 0x40797f
add dh, byte [edi - 0x37]
mov byte [ebp + 0x30202fd], dl
mov esp, 0x3030367
imul ecx, dword [eax + edx*4 + 0x202ec07], 0x30368bd
add ebp, dword [ecx - 0x74]
cwde
or esp, ebp
add al, byte [edx]
mov ebx, 0x3030364
imul ecx, dword [eax + ecx*4 + 0x202ec0b], 0x30366bc
add ebp, dword [ecx - 0x74]
nop
or eax, 0xbd0202ec
imul eax, dword [ebx], 0x8c690303
cwde
paddsb mm0, qword [edx]
add bh, byte [ebx + 0x3030377]
imul ecx, dword [eax + ecx*4 + 0x202ec11], 0x30336bc
add ebp, dword [ecx - 0x74]
nop
adc ebp, esp
add al, byte [edx]
mov ebp, 0x3030333
imul ecx, dword [eax + ebx*4 + 0x202ec15], 0x8c69c336
mov byte [edi], dl
in al, dx
add al, byte [edx]
add dl, byte [esi - 0x7c]
into
and byte [ebx + 4], ch
add eax, dword [esi + eax*8 + 0x304319a]
test dh, al
inc ebp
cmp al, 4
add ebx, dword [esi + 0x53]
pop edx
xchg bh, al
pop es
test bl, cl
shl byte [eax - 0xc7bfcfd], 1
fist dword [esi + 4]
add eax, dword [ebx + ecx*8 + 0x3044f59]
test bl, cl
das
dec eax
add al, 3
pop ebx
mov esp, 0x3030367
imul ecx, dword [eax + edx*4 + 0x202ebf3], 0x30368bd
add ebp, dword [ecx - 0x74]
cwde
cmc
jmp 0x407a3c
add eax, dword fs:[ebx]
add ebp, dword [ecx - 0x74]
mov bh, dh
jmp 0x407a48
add ax, word [ebx]
add ebp, dword [ecx - 0x74]
nop
stc
jmp 0x407a54
imul eax, dword [ebx], 0x8c690303
cwde
sti
jmp 0x407a60
ja 0x407a65
add eax, dword [ebx]
imul ecx, dword [eax + ecx*4 + 0x202ebfd], 0x30336bc
add ebp, dword [ecx - 0x74]
nop
invalid
mov word [eax + 0x202ebfd], cs
mov esp, 0x3030336
imul ecx, dword [eax + edx*4 + 0x202ebff], 0x30334bd
add ebp, dword [ecx - 0x74]
cwde
add ebx, ebp
add al, byte [edx]
ret
Function at 0x404317
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or esi, 0x474
pop esi
push eax
xor eax, 0x3290
jmp 0x40432d
add eax, 0x11047
add eax, 0xde47
pop eax
mov dword [ebp - 0x1e7c], 0xffffffff
push eax
push ecx
add esp, 4
add eax, 0x5d58
jmp 0x404357
push es
add eax, 0x15b80
sub eax, 0x14664
pop eax
push esi
push esi
add esp, 4
and esi, 0x1302a
sub esi, 0x10a32
pop esi
mov eax, dword [ebp - 0x77c]
mov dword [ebp - 0x4f4], eax
jmp 0x404393
Function at 0x4046f0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ecx
sub ecx, 0x9c05
sub ecx, 0xd37c
xor ecx, 0x157be
jmp 0x404709
pop ecx
push ebx
push edi
add esp, 4
and ebx, 0x4079
and ebx, 0xf2b7
sub ebx, 0x11628
pop ebx
mov dword [ebp - 0x1e80], 0xffffffff
push edi
push eax
add esp, 4
add edi, 0x7f8e
and edi, 0x10808
xor edi, 0x7fef
pop edi
push edx
xor edx, 0x6548
xor edx, 0xd9c5
xor edx, 0x16fd5
sub edx, 0x4c92
pop edx
mov eax, dword [ebp - 0x77c]
mov dword [ebp - 0x4f8], eax
jmp 0x40477b
push eax
push ebx
add esp, 4
and eax, 0x1597f
or eax, 0x1007
and eax, 0x6ed9
pop eax
push ebx
sub ebx, 0x1344b
and ebx, 0x4db1
sub ebx, 0x633f
and ebx, 0x9224
pop ebx
invalid
xchg ebp, eax
invalid

Function at 0x4047e0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x4047e9
xor edi, 0xa524
pop edi
jmp 0x404a23
push ebx
push ecx
add esp, 4
sub ebx, 0x9872
sub ebx, 0x16982
and ebx, 0x13b3a
and ebx, 0x1d02
pop ebx
push edx
and edx, 0x5b9
sub edx, 0x17532
xor edx, 0xc4a7
pop edx
mov dword [ebp - 0xad8], 0

Function at 0x404810
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
or edi, 0xafd2
sub edi, 0x138ca
pop edi
push edi
push edi
add esp, 4
or edi, 0x137da
sub edi, 0x535d
or edi, 0xc633
or edi, 0xf68
pop edi
mov ecx, dword [ebp - 0x15e4]
ljmp 0xf520
invalid
inc edi
test dword [eax], edi
invalid
invalid
inc dword [eax]
add byte [eax], al
add byte [ebx - 0x4f76b], cl
invalid
cmp edx, dword [ebp - 0x15e4]
jne 0x4048a4
push esi
push edx
add esp, 4
sub esi, 0xce0f
sub esi, 0xcce4
sub esi, 0xbc9a
add esi, 0xdbb5
pop esi
push eax
or eax, 0x3843
xor eax, 0x16768
add eax, 0x9368
pop eax
mov eax, dword [ebp - 0xcc8]
mov dword [ebp - 0x15ec], eax
jmp 0x4049d5
xor dword [ecx], eax
add byte [eax], al
cmp dword [ebp - 0xcc4], 0
jle 0x4049c9
push ebx
push ebx
add esp, 4
sub ebx, 0x1394d
sub ebx, 0x761f
sub ebx, 0x8ea
sub ebx, 0x671d
pop ebx
push ebx
mov ecx, dword [ebp - 0xcc8]
mov dword [ebp - 0x15ec], ecx
cmp dword [ebp - 0x15ec], 0
jne 0x404a1e
push edx
sub edx, 0xaf60
add edx, 0xfeec
xor edx, 0x1822
add edx, 0x1073c
pop edx
push ebx
push esi
add esp, 4
xor ebx, 0x8af0
or ebx, 0x108f8
xor ebx, 0x1649
pop ebx
jmp 0x40476c

Function at 0x404900
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
pop ecx
push esi
push edx
add esp, 4
jmp 0x40490e
pop esi
push edi
jmp 0x404918
sub edi, 0x11bfc
pop edi
push ecx
push edx
add esp, 4
and ecx, 0x8b29
pop ecx
mov edx, dword [ebp - 0xae4]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0xae0]
movzx edx, byte [ecx]
cmp eax, edx
invalid

Function at 0x4049a0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 0xcc4], ecx
mov edx, dword [ebp - 0xae4]
add edx, 1
mov dword [ebp - 0xae4], edx
mov eax, dword [ebp - 0xae0]
add eax, 1
mov dword [ebp - 0xae0], eax
jmp 0x4048a4
Function at 0x404a10
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x4f8]
mov dword [ebp - 0xad8], edx
jmp 0x404a5f
push edi

Function at 0x404a60
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push eax
add esp, 4
and edi, 0xf18e
xor edi, 0x15b50
pop edi
push eax
push eax
add esp, 4
or eax, 0x8c09
and eax, 0xa816
pop eax
push ecx
sub ecx, 0x9d82
xor ecx, 0xbb86
pop ecx
mov byte [ebp - 0x898], 0x45
mov byte [ebp - 0x897], 0x78
mov byte [ebp - 0x896], 0x69
mov byte [ebp - 0x895], 0x74
mov byte [ebp - 0x894], 0x50
mov byte [ebp - 0x893], 0x72
mov byte [ebp - 0x892], 0x6f
mov byte [ebp - 0x891], 0x63
mov byte [ebp - 0x890], 0x65
mov byte [ebp - 0x88f], 0x73
mov byte [ebp - 0x88e], 0x73
mov byte [ebp - 0x88d], 0
push ebx
add ebx, 0x63ed
sub ebx, 0x7609
pop ebx
push ebx
sub ebx, 0x9432
pop ebx
push eax
push ecx
add esp, 4

Function at 0x404b00
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add eax, 0x49c4
pop eax
push edx
and edx, 0x12ccf
jmp 0x404b16
pop edx
mov eax, 0x6b
mov word [ebp - 0x16c0], ax
mov ecx, 0x65
mov word [ebp - 0x16be], cx
mov edx, 0x72
mov word [ebp - 0x16bc], dx
mov eax, 0x6e
mov word [ebp - 0x16ba], ax
mov ecx, 0x65
mov word [ebp - 0x16b8], cx
mov edx, 0x6c
mov word [ebp - 0x16b6], dx
mov eax, 0x33
mov word [ebp - 0x16b4], ax
mov ecx, 0x32
mov word [ebp - 0x16b2], cx
mov edx, 0x2e
mov word [ebp - 0x16b0], dx
mov eax, 0x64
mov word [ebp - 0x16ae], ax
mov ecx, 0x6c
mov word [ebp - 0x16ac], cx
mov edx, 0x6c
mov word [ebp - 0x16aa], dx
xor eax, eax
mov word [ebp - 0x16a8], ax
push esi
or esi, 0x1636c
and esi, 0xdfe3
and esi, 0x10208
pop esi
push edi
add edi, 0x12974
add edi, 0x5eda
pop edi
push ebx
or ebx, 0x12860
pop ebx
push edi
and edi, 0x6b0a
pop edi
push eax
or eax, 0x160f9
or eax, 0x9a0f
call 0x404bfd
add byte [ebp + 0x4a], al
dec edx
dec ebx
dec edx
cmp bh, byte [edi]
dec eax
add esp, 4
call 0x404c10
add byte [eax + 0x49], dl
dec ebx
cmp byte [ebx], bh
inc edi
inc esp
dec esp
dec ebx
add esp, 4
pop eax
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x1b4c], ecx
mov edx, dword [ebp - 0x1b4c]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x1d1c], eax
mov ecx, dword [ebp - 0x1d1c]
mov dword [ebp - 0x15f0], ecx
push ecx
add ecx, 0x8fec
and ecx, 0x9e9
pop ecx
push ebx
push edx
add esp, 4
and ebx, 0x11b7b
and ebx, 0xc245
pop ebx
push ebx
push ecx
add esp, 4
sub ebx, 0x126d8
xor ebx, 0x3432
pop ebx
cmp dword [ebp - 0x15f0], 0
jne 0x404c86
mov dword [ebp - 0x2bc], 0
jmp 0x404f42
mov edx, dword [ebp - 0x15f0]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xcd4], ecx
push edx
push ebx
add esp, 4
call 0x404cad
add byte [edx], dh
dec edi
inc ecx
aaa
xor eax, 0x47384239
add esp, 4
Function at 0x404bfd
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add eax, 0x49c4
pop eax
push edx
and edx, 0x12ccf
jmp 0x404b16
pop edx
mov eax, 0x6b
mov word [ebp - 0x16c0], ax
mov ecx, 0x65
mov word [ebp - 0x16be], cx
mov edx, 0x72
mov word [ebp - 0x16bc], dx
mov eax, 0x6e
mov word [ebp - 0x16ba], ax
mov ecx, 0x65
mov word [ebp - 0x16b8], cx
mov edx, 0x6c
mov word [ebp - 0x16b6], dx
mov eax, 0x33
mov word [ebp - 0x16b4], ax
mov ecx, 0x32
mov word [ebp - 0x16b2], cx
mov edx, 0x2e
mov word [ebp - 0x16b0], dx
mov eax, 0x64
mov word [ebp - 0x16ae], ax
mov ecx, 0x6c
mov word [ebp - 0x16ac], cx
mov edx, 0x6c
mov word [ebp - 0x16aa], dx
xor eax, eax
mov word [ebp - 0x16a8], ax
push esi
or esi, 0x1636c
and esi, 0xdfe3
and esi, 0x10208
pop esi
push edi
add edi, 0x12974
add edi, 0x5eda
pop edi
push ebx
or ebx, 0x12860
pop ebx
push edi
and edi, 0x6b0a
pop edi
push eax
or eax, 0x160f9
or eax, 0x9a0f
call 0x404bfd
add byte [ebp + 0x4a], al
dec edx
dec ebx
dec edx
cmp bh, byte [edi]
dec eax
add esp, 4
call 0x404c10
add byte [eax + 0x49], dl
dec ebx
cmp byte [ebx], bh
inc edi
inc esp
dec esp
dec ebx
add esp, 4
pop eax
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x1b4c], ecx
mov edx, dword [ebp - 0x1b4c]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x1d1c], eax
mov ecx, dword [ebp - 0x1d1c]
mov dword [ebp - 0x15f0], ecx
push ecx
add ecx, 0x8fec
and ecx, 0x9e9
pop ecx
push ebx
push edx
add esp, 4
and ebx, 0x11b7b
and ebx, 0xc245
pop ebx
push ebx
push ecx
add esp, 4
sub ebx, 0x126d8
xor ebx, 0x3432
pop ebx
cmp dword [ebp - 0x15f0], 0
jne 0x404c86
mov dword [ebp - 0x2bc], 0
jmp 0x404f42
mov edx, dword [ebp - 0x15f0]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xcd4], ecx
push edx
push ebx
add esp, 4
call 0x404cad
add byte [edx], dh
dec edi
inc ecx
aaa
xor eax, 0x47384239
add esp, 4
Function at 0x404c10
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add eax, 0x49c4
pop eax
push edx
and edx, 0x12ccf
jmp 0x404b16
pop edx
mov eax, 0x6b
mov word [ebp - 0x16c0], ax
mov ecx, 0x65
mov word [ebp - 0x16be], cx
mov edx, 0x72
mov word [ebp - 0x16bc], dx
mov eax, 0x6e
mov word [ebp - 0x16ba], ax
mov ecx, 0x65
mov word [ebp - 0x16b8], cx
mov edx, 0x6c
mov word [ebp - 0x16b6], dx
mov eax, 0x33
mov word [ebp - 0x16b4], ax
mov ecx, 0x32
mov word [ebp - 0x16b2], cx
mov edx, 0x2e
mov word [ebp - 0x16b0], dx
mov eax, 0x64
mov word [ebp - 0x16ae], ax
mov ecx, 0x6c
mov word [ebp - 0x16ac], cx
mov edx, 0x6c
mov word [ebp - 0x16aa], dx
xor eax, eax
mov word [ebp - 0x16a8], ax
push esi
or esi, 0x1636c
and esi, 0xdfe3
and esi, 0x10208
pop esi
push edi
add edi, 0x12974
add edi, 0x5eda
pop edi
push ebx
or ebx, 0x12860
pop ebx
push edi
and edi, 0x6b0a
pop edi
push eax
or eax, 0x160f9
or eax, 0x9a0f
call 0x404bfd
add byte [ebp + 0x4a], al
dec edx
dec ebx
dec edx
cmp bh, byte [edi]
dec eax
add esp, 4
call 0x404c10
add byte [eax + 0x49], dl
dec ebx
cmp byte [ebx], bh
inc edi
inc esp
dec esp
dec ebx
add esp, 4
pop eax
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x1b4c], ecx
mov edx, dword [ebp - 0x1b4c]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x1d1c], eax
mov ecx, dword [ebp - 0x1d1c]
mov dword [ebp - 0x15f0], ecx
push ecx
add ecx, 0x8fec
and ecx, 0x9e9
pop ecx
push ebx
push edx
add esp, 4
and ebx, 0x11b7b
and ebx, 0xc245
pop ebx
push ebx
push ecx
add esp, 4
sub ebx, 0x126d8
xor ebx, 0x3432
pop ebx
cmp dword [ebp - 0x15f0], 0
jne 0x404c86
mov dword [ebp - 0x2bc], 0
jmp 0x404f42
mov edx, dword [ebp - 0x15f0]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xcd4], ecx
push edx
push ebx
add esp, 4
call 0x404cad
add byte [edx], dh
dec edi
inc ecx
aaa
xor eax, 0x47384239
add esp, 4
Function at 0x404cad
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add eax, 0x49c4
pop eax
push edx
and edx, 0x12ccf
jmp 0x404b16
pop edx
mov eax, 0x6b
mov word [ebp - 0x16c0], ax
mov ecx, 0x65
mov word [ebp - 0x16be], cx
mov edx, 0x72
mov word [ebp - 0x16bc], dx
mov eax, 0x6e
mov word [ebp - 0x16ba], ax
mov ecx, 0x65
mov word [ebp - 0x16b8], cx
mov edx, 0x6c
mov word [ebp - 0x16b6], dx
mov eax, 0x33
mov word [ebp - 0x16b4], ax
mov ecx, 0x32
mov word [ebp - 0x16b2], cx
mov edx, 0x2e
mov word [ebp - 0x16b0], dx
mov eax, 0x64
mov word [ebp - 0x16ae], ax
mov ecx, 0x6c
mov word [ebp - 0x16ac], cx
mov edx, 0x6c
mov word [ebp - 0x16aa], dx
xor eax, eax
mov word [ebp - 0x16a8], ax
push esi
or esi, 0x1636c
and esi, 0xdfe3
and esi, 0x10208
pop esi
push edi
add edi, 0x12974
add edi, 0x5eda
pop edi
push ebx
or ebx, 0x12860
pop ebx
push edi
and edi, 0x6b0a
pop edi
push eax
or eax, 0x160f9
or eax, 0x9a0f
call 0x404bfd
add byte [ebp + 0x4a], al
dec edx
dec ebx
dec edx
cmp bh, byte [edi]
dec eax
add esp, 4
call 0x404c10
add byte [eax + 0x49], dl
dec ebx
cmp byte [ebx], bh
inc edi
inc esp
dec esp
dec ebx
add esp, 4
pop eax
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x1b4c], ecx
mov edx, dword [ebp - 0x1b4c]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x1d1c], eax
mov ecx, dword [ebp - 0x1d1c]
mov dword [ebp - 0x15f0], ecx
push ecx
add ecx, 0x8fec
and ecx, 0x9e9
pop ecx
push ebx
push edx
add esp, 4
and ebx, 0x11b7b
and ebx, 0xc245
pop ebx
push ebx
push ecx
add esp, 4
sub ebx, 0x126d8
xor ebx, 0x3432
pop ebx
cmp dword [ebp - 0x15f0], 0
jne 0x404c86
mov dword [ebp - 0x2bc], 0
jmp 0x404f42
mov edx, dword [ebp - 0x15f0]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xcd4], ecx
push edx
push ebx
add esp, 4
call 0x404cad
add byte [edx], dh
dec edi
inc ecx
aaa
xor eax, 0x47384239
add esp, 4
Function at 0x404cb0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
or edx, 0xc11e
call 0x404cc6
add byte [edi], bh
dec ebx
inc eax
dec ebx
aas
dec edx
dec ebp
inc esi
cmp eax, dword [ecx - 0x7d]
les eax, [edx + ebx*2]
cmp dword [ebp - 0xcd4], 0
jne 0x404ce2
mov dword [ebp - 0x2bc], 0
jmp 0x404f42
mov edx, dword [ebp - 0xcd4]
mov dword [ebp - 0x4fc], edx
push ecx
and ecx, 0x16fb
call 0x404d02
add byte [ecx + 0x4b], cl
inc ebp
dec edx
cmp al, 0x3c
dec eax
add esp, 4
sub ecx, 0x14770
pop ecx
push edi
and edi, 0x1395d
add edi, 0x7792
sub edi, 0x6dd9
pop edi
lea eax, [ebp - 0x16c0]
mov dword [ebp - 0xcd0], eax
mov ecx, dword [ebp - 0x4fc]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xccc], edx
xor eax, eax
mov word [ebp - 0x1c0], ax
xor ecx, ecx
mov word [ebp - 0x10c], cx
push edi
push edi
add esp, 4
and edi, 0x10509
add edi, 0x5fa2
or edi, 0xd728
pop edi
push eax
push edx
add esp, 4
sub eax, 0x1e64
pop eax
push ebx
xor ebx, 0x6ce6
xor ebx, 0x16bd6
pop ebx
mov edx, dword [ebp - 0xccc]
mov ax, word [edx]
mov word [ebp - 0x109a], ax
mov ecx, dword [ebp - 0xccc]
add ecx, 2
mov dword [ebp - 0xccc], ecx
mov dx, word [ebp - 0x109a]
mov word [ebp - 0x1c0], dx
mov eax, dword [ebp - 0xcd0]
mov cx, word [eax]
mov word [ebp - 0x109c], cx
mov edx, dword [ebp - 0xcd0]
add edx, 2
mov dword [ebp - 0xcd0], edx
mov ax, word [ebp - 0x109c]
mov word [ebp - 0x10c], ax
push esi
push ebx
add esp, 4
add esi, 0xc861
and esi, 0x177b8
add esi, 0x122d0
or esi, 0x14c9d
pop esi
push edi
and edi, 0x16149
invalid
invalid

Function at 0x404cc6
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
or edx, 0xc11e
call 0x404cc6
add byte [edi], bh
dec ebx
inc eax
dec ebx
aas
dec edx
dec ebp
inc esi
cmp eax, dword [ecx - 0x7d]
les eax, [edx + ebx*2]
cmp dword [ebp - 0xcd4], 0
jne 0x404ce2
mov dword [ebp - 0x2bc], 0
jmp 0x404f42
mov edx, dword [ebp - 0xcd4]
mov dword [ebp - 0x4fc], edx
push ecx
and ecx, 0x16fb
call 0x404d02
add byte [ecx + 0x4b], cl
inc ebp
dec edx
cmp al, 0x3c
dec eax
add esp, 4
sub ecx, 0x14770
pop ecx
push edi
and edi, 0x1395d
add edi, 0x7792
sub edi, 0x6dd9
pop edi
lea eax, [ebp - 0x16c0]
mov dword [ebp - 0xcd0], eax
mov ecx, dword [ebp - 0x4fc]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xccc], edx
xor eax, eax
mov word [ebp - 0x1c0], ax
xor ecx, ecx
mov word [ebp - 0x10c], cx
push edi
push edi
add esp, 4
and edi, 0x10509
add edi, 0x5fa2
or edi, 0xd728
pop edi
push eax
push edx
add esp, 4
sub eax, 0x1e64
pop eax
push ebx
xor ebx, 0x6ce6
xor ebx, 0x16bd6
pop ebx
mov edx, dword [ebp - 0xccc]
mov ax, word [edx]
mov word [ebp - 0x109a], ax
mov ecx, dword [ebp - 0xccc]
add ecx, 2
mov dword [ebp - 0xccc], ecx
mov dx, word [ebp - 0x109a]
mov word [ebp - 0x1c0], dx
mov eax, dword [ebp - 0xcd0]
mov cx, word [eax]
mov word [ebp - 0x109c], cx
mov edx, dword [ebp - 0xcd0]
add edx, 2
mov dword [ebp - 0xcd0], edx
mov ax, word [ebp - 0x109c]
mov word [ebp - 0x10c], ax
push esi
push ebx
add esp, 4
add esi, 0xc861
and esi, 0x177b8
add esi, 0x122d0
or esi, 0x14c9d
pop esi
push edi
and edi, 0x16149
invalid
invalid
Function at 0x404d02
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
or edx, 0xc11e
call 0x404cc6
add byte [edi], bh
dec ebx
inc eax
dec ebx
aas
dec edx
dec ebp
inc esi
cmp eax, dword [ecx - 0x7d]
les eax, [edx + ebx*2]
cmp dword [ebp - 0xcd4], 0
jne 0x404ce2
mov dword [ebp - 0x2bc], 0
jmp 0x404f42
mov edx, dword [ebp - 0xcd4]
mov dword [ebp - 0x4fc], edx
push ecx
and ecx, 0x16fb
call 0x404d02
add byte [ecx + 0x4b], cl
inc ebp
dec edx
cmp al, 0x3c
dec eax
add esp, 4
sub ecx, 0x14770
pop ecx
push edi
and edi, 0x1395d
add edi, 0x7792
sub edi, 0x6dd9
pop edi
lea eax, [ebp - 0x16c0]
mov dword [ebp - 0xcd0], eax
mov ecx, dword [ebp - 0x4fc]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xccc], edx
xor eax, eax
mov word [ebp - 0x1c0], ax
xor ecx, ecx
mov word [ebp - 0x10c], cx
push edi
push edi
add esp, 4
and edi, 0x10509
add edi, 0x5fa2
or edi, 0xd728
pop edi
push eax
push edx
add esp, 4
sub eax, 0x1e64
pop eax
push ebx
xor ebx, 0x6ce6
xor ebx, 0x16bd6
pop ebx
mov edx, dword [ebp - 0xccc]
mov ax, word [edx]
mov word [ebp - 0x109a], ax
mov ecx, dword [ebp - 0xccc]
add ecx, 2
mov dword [ebp - 0xccc], ecx
mov dx, word [ebp - 0x109a]
mov word [ebp - 0x1c0], dx
mov eax, dword [ebp - 0xcd0]
mov cx, word [eax]
mov word [ebp - 0x109c], cx
mov edx, dword [ebp - 0xcd0]
add edx, 2
mov dword [ebp - 0xcd0], edx
mov ax, word [ebp - 0x109c]
mov word [ebp - 0x10c], ax
push esi
push ebx
add esp, 4
add esi, 0xc861
and esi, 0x177b8
add esi, 0x122d0
or esi, 0x14c9d
pop esi
push edi
and edi, 0x16149
invalid
invalid

Function at 0x404ea0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mul dword [ecx - 0x17fffed0]
or al, byte [eax]
add byte [eax], al

Function at 0x404f00
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
ret

Function at 0x404f40
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
push esi
and esi, 0x212
add esi, 0x13de9
add esi, 0x153fb
pop esi
push esi
push ebx
add esp, 4
jmp 0x404f62
jmp 0x404f67
sub esi, 0x7857
or esi, 0x12187
pop esi
cmp dword [ebp - 0x2bc], 0
jne 0x405879
mov ecx, 0x6b
mov word [ebp - 0x172c], cx
mov edx, 0x65
mov word [ebp - 0x172a], dx
mov eax, 0x72
mov word [ebp - 0x1728], ax
mov ecx, 0x6e
mov word [ebp - 0x1726], cx
mov edx, 0x65
mov word [ebp - 0x1724], dx
mov eax, 0x6c
mov word [ebp - 0x1722], ax
mov ecx, 0x33
mov word [ebp - 0x1720], cx
mov edx, 0x32
mov word [ebp - 0x171e], dx
mov eax, 0x2e
mov word [ebp - 0x171c], ax
mov ecx, 0x64
mov word [ebp - 0x171a], cx
mov edx, 0x6c
mov word [ebp - 0x1718], dx
mov eax, 0x6c
mov word [ebp - 0x1716], ax
xor ecx, ecx
mov word [ebp - 0x1714], cx
push edi
push ebx
add esp, 4
call 0x40502d
add byte [edx], bh
dec edi
inc ecx
cmp dword [ebp + 0x37], ecx
dec edi
inc ebp
add esp, 4
add edi, 0x7bbb
add edi, 0x4481
call 0x405048
add byte [eax], al
dec ecx
inc esp
Function at 0x40502d
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
push esi
and esi, 0x212
add esi, 0x13de9
add esi, 0x153fb
pop esi
push esi
push ebx
add esp, 4
jmp 0x404f62
jmp 0x404f67
sub esi, 0x7857
or esi, 0x12187
pop esi
cmp dword [ebp - 0x2bc], 0
jne 0x405879
mov ecx, 0x6b
mov word [ebp - 0x172c], cx
mov edx, 0x65
mov word [ebp - 0x172a], dx
mov eax, 0x72
mov word [ebp - 0x1728], ax
mov ecx, 0x6e
mov word [ebp - 0x1726], cx
mov edx, 0x65
mov word [ebp - 0x1724], dx
mov eax, 0x6c
mov word [ebp - 0x1722], ax
mov ecx, 0x33
mov word [ebp - 0x1720], cx
mov edx, 0x32
mov word [ebp - 0x171e], dx
mov eax, 0x2e
mov word [ebp - 0x171c], ax
mov ecx, 0x64
mov word [ebp - 0x171a], cx
mov edx, 0x6c
mov word [ebp - 0x1718], dx
mov eax, 0x6c
mov word [ebp - 0x1716], ax
xor ecx, ecx
mov word [ebp - 0x1714], cx
push edi
push ebx
add esp, 4
call 0x40502d
add byte [edx], bh
dec edi
inc ecx
cmp dword [ebp + 0x37], ecx
dec edi
inc ebp
add esp, 4
add edi, 0x7bbb
add edi, 0x4481
call 0x405048
add byte [eax], al
dec ecx
inc esp

Function at 0x405040
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
dec ecx
inc esp
dec edx
inc esp
add esp, 4
pop edi
mov byte [ebp - 0x8b4], 0x4c
mov byte [ebp - 0x8b3], 0x6f
mov byte [ebp - 0x8b2], 0x61
mov byte [ebp - 0x8b1], 0x64
mov byte [ebp - 0x8b0], 0x4c
mov byte [ebp - 0x8af], 0x69
mov byte [ebp - 0x8ae], 0x62
mov byte [ebp - 0x8ad], 0x72
mov byte [ebp - 0x8ac], 0x61
mov byte [ebp - 0x8ab], 0x72
mov byte [ebp - 0x8aa], 0x79
mov byte [ebp - 0x8a9], 0x57
mov byte [ebp - 0x8a8], 0
mov edx, dword fs:[0x18]
mov dword [ebp - 0x1d20], edx
mov eax, dword [ebp - 0x1d20]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x1d24], ecx
mov edx, dword [ebp - 0x1d24]
mov dword [ebp - 0x1600], edx
push ecx
or ecx, 0x1666a
jmp 0x4050df
or ecx, 0xd917
pop ecx
push ecx
and ecx, 0x12f41
pop ecx
push eax
add eax, 0x7517
xor eax, 0x6b50
jmp 0x405100
pop eax
cmp dword [ebp - 0x1600], 0
jne 0x405119
mov dword [ebp - 0x780], 0
jmp 0x4053c0
mov eax, dword [ebp - 0x1600]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xce0], edx
push ebx
call 0x40513a
add byte [esi], dh
cmp dword [ecx + ecx*2 + 0x48], eax
inc ebp
dec ebp
dec ebp
add esp, 4
sub ebx, 0x149a5
pop ebx
push edx
jmp 0x40514b
jmp 0x405150
sub edx, 0xec24
xor edx, 0xd766
pop edx
invalid
invalid
invalid