joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40bc70
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x5547bb
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5973cc]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x14], 1
mov dword [esi], eax
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
push eax
call fcn.004077a0
add eax, 0x10
mov dword [esi + 4], eax
mov byte [esp + 0x18], 2
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
push eax
call fcn.004077a0
add eax, 0x10
add esp, 8
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 5
jne 0x40bce3
xor eax, eax
jmp 0x40bcf5
mov eax, dword [esp + 0x28]
neg eax
sbb eax, eax
and eax, 0xffffff00
add eax, 0x200
mov dword [esi + 0xc], eax
mov byte [esp + 0x14], 0
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40bd1d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x14], 0xffffffff
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40bd45
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x10

Function at 0x40bd60
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 4]
lea ecx, [esp + 4]
push ecx
or edx, 1
push edx
push 0
push eax
mov eax, dword [esi]
push eax
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40bdc4
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov esi, dword [esi + 8]
push ecx
mov ecx, dword [esp + 8]
push edx
push eax
push 0
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [esp + 4]
mov esi, eax
neg esi
sbb esi, esi
push edx
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ecx
ret
xor eax, eax
pop esi
pop ecx
ret

Function at 0x40bef0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0x59d620]
test eax, eax
jne 0x40bf4b
push eax
push 1
push 0x59d61c
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
jne 0x40bf20
call fcn.0040c140
mov dword [0x59d620], eax
mov dword [0x59d61c], 2
ret
mov eax, dword [0x59d61c]
cmp eax, 2
je 0x40bf41
push esi
cmp eax, dword [ecx]
add al, ch
or dword [eax], eax
add byte [eax], al

Function at 0x40bf2b
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28f4
push ebx
push esi
push edi
push ebx
xor ebx, 0x959f
and ebx, 0x13bee
call fcn.0040bf52
add byte [edx], dh
inc ebx
dec ebx
cmp byte [ecx + 0x38], al
Function at 0x40bf52
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ebx
push eax
xor eax, 0x17fcd
jmp 0x40bf62
sub eax, 0x1593a
pop eax
mov eax, 0x4d
mov word [ebp - 0x1e4c], ax
mov ecx, 0x42
mov word [ebp - 0x1e4a], cx
mov edx, 0x53
mov word [ebp - 0x1e48], dx
mov eax, 0x65
mov word [ebp - 0x1e46], ax
mov ecx, 0x72
mov word [ebp - 0x1e44], cx
mov edx, 0x76
mov word [ebp - 0x1e42], dx
mov eax, 0x69
mov word [ebp - 0x1e40], ax
mov ecx, 0x63
mov word [ebp - 0x1e3e], cx
mov edx, 0x65
mov word [ebp - 0x1e3c], dx
mov eax, 0x2e
mov word [ebp - 0x1e3a], ax
mov ecx, 0x65
mov word [ebp - 0x1e38], cx
mov edx, 0x78
mov word [ebp - 0x1e36], dx
mov eax, 0x65
mov word [ebp - 0x1e34], ax
xor ecx, ecx
mov word [ebp - 0x1e32], cx
push edi
push ecx
add esp, 4
xor edi, 0x16703
pop edi
push edx
push edi
add esp, 4
and edx, 0x12d17
sub edx, 0x13c41
and edx, 0x583c
add byte [edx + 0x53], bl
or ebx, 0xeab7
add ebx, 0xf85b
pop ebx
mov byte [ebp - 0xdec], 0x43
mov byte [ebp - 0xdeb], 0x72
mov byte [ebp - 0xdea], 0x65
mov byte [ebp - 0xde9], 0x61
mov byte [ebp - 0xde8], 0x74
mov byte [ebp - 0xde7], 0x65
mov byte [ebp - 0xde6], 0x54
mov byte [ebp - 0xde5], 0x6f
mov byte [ebp - 0xde4], 0x6f
mov byte [ebp - 0xde3], 0x6c
mov byte [ebp - 0xde2], 0x68
mov byte [ebp - 0xde1], 0x65
mov byte [ebp - 0xde0], 0x6c
mov byte [ebp - 0xddf], 0x70
mov byte [ebp - 0xdde], 0x33
mov byte [ebp - 0xddd], 0x32
mov byte [ebp - 0xddc], 0x53
mov byte [ebp - 0xddb], 0x6e
mov byte [ebp - 0xdda], 0x61
mov byte [ebp - 0xdd9], 0x70
mov byte [ebp - 0xdd8], 0x73
mov byte [ebp - 0xdd7], 0x68
mov byte [ebp - 0xdd6], 0x6f
mov byte [ebp - 0xdd5], 0x74
mov byte [ebp - 0xdd4], 0
mov byte [ebp - 0xbec], 0x50
mov byte [ebp - 0xbeb], 0x72
mov byte [ebp - 0xbea], 0x6f
mov byte [ebp - 0xbe9], 0x63
mov byte [ebp - 0xbe8], 0x65
mov byte [ebp - 0xbe7], 0x73
mov byte [ebp - 0xbe6], 0x73
mov byte [ebp - 0xbe5], 0x33
mov byte [ebp - 0xbe4], 0x32
mov byte [ebp - 0xbe3], 0x46
mov byte [ebp - 0xbe2], 0x69
invalid
test dword [edi], ebx
hlt

Function at 0x40bf60
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
dec ebp
cmp byte [ecx + 0x1593ae8], al
add byte [eax - 0x48], bl
dec ebp
add byte [eax], al
add byte [esi - 0x77], ah
test dword [ecx + 0x42b9ffff], esi
add byte [eax], al
add byte [esi - 0x77], ah
lea esi, [esi - 0x4500001f]
push ebx
add byte [eax], al
add byte [esi - 0x77], ah
xchg ebp, eax
mov eax, 0xb8ffffe1
add byte gs:[eax], al
add byte [esi - 0x77], ah
test dword [edx - 0x4600001f], edi
jb 0x40bf9c
add byte [eax], al
and ebx, 0xfb
and ebx, 0xf49e
pop ebx
push edx
call 0x40c36f
add byte [eax + 0x36], al
dec ebx
aaa
cmp dword [esi + 0x4b], eax
dec esi
inc ecx
inc esi
add esp, 4
les eax, [ecx + eax*4]
ljmp 0x695a
test dword [eax - 0xd], edi
invalid
invalid
inc byte [eax]
add byte [eax], al
add byte [0x56f3663b], al
imul ecx, dword [ebp - 0xc88], 0xfe
sub eax, ecx
xor eax, 0
imul eax, dword [ebp - 0xc88]
invalid
xchg ebp, eax
Function at 0x40c29a
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push eax
mov byte [ebp - 0xbbb], 0x72
mov byte [ebp - 0xbba], 0x6f
mov byte [ebp - 0xbb9], 0x63
mov byte [ebp - 0xbb8], 0x65
mov byte [ebp - 0xbb7], 0x73
mov byte [ebp - 0xbb6], 0x73
mov byte [ebp - 0xbb5], 0x33
mov byte [ebp - 0xbb4], 0x32
mov byte [ebp - 0xbb3], 0x4e
mov byte [ebp - 0xbb2], 0x65
mov byte [ebp - 0xbb1], 0x78
mov byte [ebp - 0xbb0], 0x74
mov byte [ebp - 0xbaf], 0
push edi
or edi, 0xdd1d
add edi, 0x8f26
sub edi, 0x13bb4
or edi, 0x1b5a
iretd
pop edx
sbb eax, dword [eax]
add byte [edi + 0x56], bl
push esi
add esp, 4
and esi, 0x11ca2
or esi, 0x61ef
xor esi, 0x16a5c
pop esi
mov byte [ebp - 0xa1c], 0x43
mov byte [ebp - 0xa1b], 0x6c
mov byte [ebp - 0xa1a], 0x6f
mov byte [ebp - 0xa19], 0x73
mov byte [ebp - 0xa18], 0x65
mov byte [ebp - 0xa17], 0x48
mov byte [ebp - 0xa16], 0x61
mov byte [ebp - 0xa15], 0x6e
mov byte [ebp - 0xa14], 0x64
mov byte [ebp - 0xa13], 0x6c
mov byte [ebp - 0xa12], 0x65
mov byte [ebp - 0xa11], 0
push edi
sub edi, 0x4b30
and edi, 0x2f08
pop edi
push ecx
push edi
add esp, 4
xor ecx, 0x615
call 0x40c29a
add byte [0x3249354a], bh
xor esi, dword [edx]
dec eax
add esp, 4
and ecx, 0x48a8
dec eax
add byte [eax], al
pop ecx
mov edx, 0x6b
mov word [ebp - 0x14d4], dx
mov eax, 0x65
mov word [ebp - 0x14d2], ax
mov ecx, 0x72
mov word [ebp - 0x14d0], cx
mov edx, 0x6e
mov word [ebp - 0x14ce], dx
mov eax, 0x65
mov word [ebp - 0x14cc], ax
mov ecx, 0x6c
mov word [ebp - 0x14ca], cx
mov edx, 0x33
mov word [ebp - 0x14c8], dx
mov eax, 0x32
mov word [ebp - 0x14c6], ax
mov ecx, 0x2e
mov word [ebp - 0x14c4], cx
mov edx, 0x64
mov word [ebp - 0x14c2], dx
mov eax, 0x6c
mov word [ebp - 0x14c0], ax
mov ecx, 0x6c
mov word [ebp - 0x14be], cx
inc edx
jmp 0x40c332
push dword [ebx]
shl byte [esi - 0x77], cl
xchg ebp, eax
inc esp
jmp 0x40c33b
inc edi
test dword [eax - 0xd], edi
invalid
inc dword [ecx]
add byte [eax], al
add byte [ebx - 0x15], dl
pop es
Function at 0x40c350
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
inc esi
xor al, 0x81
jecxz 0x40c34f
add byte [eax], al
add byte [ecx + 0xf49ee3], al
add byte [ebx + 0x52], bl
mov ecx, dword [ebp - 0xef0]
mov dword [ebp - 0x22fc], ecx
mov edx, dword [ebp - 0xef0]
sub edx, 1
mov dword [ebp - 0xef0], edx
cmp dword [ebp - 0x22fc], 0
je 0x40c468
push ecx
call 0x40c42d
add byte [edi], dh
inc edx
cmp byte [ebp + 0x4a], al
inc ecx
dec ebx
xor edi, dword [eax]
inc ecx
add esp, 4
and ecx, 0x6dc8
sub ecx, 0xd8d7
or ecx, 0x857c
pop ecx
push edx
jmp 0x40c44d
pop edx
mov eax, dword [ebp - 0xef4]
mov byte [eax], 0
mov ecx, dword [ebp - 0xef4]
add ecx, 1
mov dword [ebp - 0xef4], ecx
jmp 0x40c3f8
push edi
or edi, 0x8947
pop edi
push ecx
push eax
add esp, 4
and ecx, 0x1c7b
call 0x40c489
add byte [esi], dh
inc edx
inc edx
dec edx
inc ebx
dec ecx
dec esi
add esp, 4
pop ecx
push ebx
push ebx
add esp, 4
jmp 0x40c499
pop ebx
mov dword [ebp - 0x28f4], 0x22c
mov edx, dword [ebp - 0x2644]
mov dword [ebp - 0xc74], edx
push ebx
xor ebx, 0x6a2e
sub ebx, 0x16b78
sub ebx, 0x2240
and al, byte [eax]
add byte [ecx + 0x1d21cb], al
add byte [ebx + 0x53], bl
push eax
add esp, 4
and ebx, 0xe039
add ebx, 0x13f50
sub ebx, 0x102a1
pop ebx
mov eax, dword fs:[0x18]
mov dword [ebp - 0x23f4], eax
mov ecx, dword [ebp - 0x23f4]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x23f8], edx
mov eax, dword [ebp - 0x23f8]
mov dword [ebp - 0x19d8], eax
push ebx
push eax
add esp, 4
add ebx, 0x934d
dec ebp
xchg ebx, eax
add byte [eax], al
and ebx, 0x10e2
xor ebx, 0x5a64
xor ebx, 0xef39
pop ebx
push edi
xor edi, 0x3258
pop edi
push ecx
push eax
add esp, 4
sub ecx, 0x8cac
pop ecx
cmp dword [ebp - 0x19d8], 0
jne 0x40c553
mov dword [ebp - 0x38c], 0
jmp 0x40c80f
mov ecx, dword [ebp - 0x19d8]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xf00], eax
test dword [eax], eax
int1
invalid
call dword [eax + 0x50]
add esp, 4
and eax, 0x939
pop eax
push ecx
push ecx
add esp, 4
sub ecx, 0x8fba
or ecx, 0x6b53
add byte [eax], al
pop ecx
push ecx
sub ecx, 0x7bf7
sub ecx, 0x2879
xor ecx, 0x12541
pop ecx
cmp dword [ebp - 0xf00], 0
jne 0x40c5af
mov dword [ebp - 0x38c], 0
jmp 0x40c80f
mov ecx, dword [ebp - 0xf00]
mov dword [ebp - 0x5e8], ecx
Function at 0x40c36f
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
dec ebp
cmp byte [ecx + 0x1593ae8], al
add byte [eax - 0x48], bl
dec ebp
add byte [eax], al
add byte [esi - 0x77], ah
test dword [ecx + 0x42b9ffff], esi
add byte [eax], al
add byte [esi - 0x77], ah
lea esi, [esi - 0x4500001f]
push ebx
add byte [eax], al
add byte [esi - 0x77], ah
xchg ebp, eax
mov eax, 0xb8ffffe1
add byte gs:[eax], al
add byte [esi - 0x77], ah
test dword [edx - 0x4600001f], edi
jb 0x40bf9c
add byte [eax], al
and ebx, 0xfb
and ebx, 0xf49e
pop ebx
push edx
call 0x40c36f
add byte [eax + 0x36], al
dec ebx
aaa
cmp dword [esi + 0x4b], eax
dec esi
inc ecx
inc esi
add esp, 4
les eax, [ecx + eax*4]
ljmp 0x695a
test dword [eax - 0xd], edi
invalid
invalid
inc byte [eax]
add byte [eax], al
add byte [0x56f3663b], al
imul ecx, dword [ebp - 0xc88], 0xfe
sub eax, ecx
xor eax, 0
imul eax, dword [ebp - 0xc88]
invalid
xchg ebp, eax

Function at 0x40c370
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
les eax, [ecx + eax*4]
ljmp 0x695a

Function at 0x40c380
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
dec ebp
cmp byte [ecx + 0x1593ae8], al
add byte [eax - 0x48], bl
dec ebp
add byte [eax], al
add byte [esi - 0x77], ah
test dword [ecx + 0x42b9ffff], esi
add byte [eax], al
add byte [esi - 0x77], ah
lea esi, [esi - 0x4500001f]
push ebx
add byte [eax], al
add byte [esi - 0x77], ah
xchg ebp, eax
mov eax, 0xb8ffffe1
add byte gs:[eax], al
add byte [esi - 0x77], ah
test dword [edx - 0x4600001f], edi
jb 0x40bf9c
add byte [eax], al
and ebx, 0xfb
and ebx, 0xf49e
pop ebx
push edx
call 0x40c36f
add byte [eax + 0x36], al
dec ebx
aaa
cmp dword [esi + 0x4b], eax
dec esi
inc ecx
inc esi
add esp, 4
les eax, [ecx + eax*4]
ljmp 0x695a
test dword [eax - 0xd], edi
invalid
invalid
inc byte [eax]
add byte [eax], al
add byte [0x56f3663b], al
imul ecx, dword [ebp - 0xc88], 0xfe
sub eax, ecx
xor eax, 0
imul eax, dword [ebp - 0xc88]
invalid
xchg ebp, eax

Function at 0x40c3a0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
lock add byte [edi], cl
scasd eax, dword es:[edi]
test dword [eax - 0xd], edi
invalid
js 0x40c395
invalid
Function at 0x40c489
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
inc esi
xor al, 0x81
jecxz 0x40c34f
add byte [eax], al
add byte [ecx + 0xf49ee3], al
add byte [ebx + 0x52], bl
mov ecx, dword [ebp - 0xef0]
mov dword [ebp - 0x22fc], ecx
mov edx, dword [ebp - 0xef0]
sub edx, 1
mov dword [ebp - 0xef0], edx
cmp dword [ebp - 0x22fc], 0
je 0x40c468
push ecx
call 0x40c42d
add byte [edi], dh
inc edx
cmp byte [ebp + 0x4a], al
inc ecx
dec ebx
xor edi, dword [eax]
inc ecx
add esp, 4
and ecx, 0x6dc8
sub ecx, 0xd8d7
or ecx, 0x857c
pop ecx
push edx
jmp 0x40c44d
pop edx
mov eax, dword [ebp - 0xef4]
mov byte [eax], 0
mov ecx, dword [ebp - 0xef4]
add ecx, 1
mov dword [ebp - 0xef4], ecx
jmp 0x40c3f8
push edi
or edi, 0x8947
pop edi
push ecx
push eax
add esp, 4
and ecx, 0x1c7b
call 0x40c489
add byte [esi], dh
inc edx
inc edx
dec edx
inc ebx
dec ecx
dec esi
add esp, 4
pop ecx
push ebx
push ebx
add esp, 4
jmp 0x40c499
pop ebx
mov dword [ebp - 0x28f4], 0x22c
mov edx, dword [ebp - 0x2644]
mov dword [ebp - 0xc74], edx
push ebx
xor ebx, 0x6a2e
sub ebx, 0x16b78
sub ebx, 0x2240
and al, byte [eax]
add byte [ecx + 0x1d21cb], al
add byte [ebx + 0x53], bl
push eax
add esp, 4
and ebx, 0xe039
add ebx, 0x13f50
sub ebx, 0x102a1
pop ebx
mov eax, dword fs:[0x18]
mov dword [ebp - 0x23f4], eax
mov ecx, dword [ebp - 0x23f4]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x23f8], edx
mov eax, dword [ebp - 0x23f8]
mov dword [ebp - 0x19d8], eax
push ebx
push eax
add esp, 4
add ebx, 0x934d
dec ebp
xchg ebx, eax
add byte [eax], al
and ebx, 0x10e2
xor ebx, 0x5a64
xor ebx, 0xef39
pop ebx
push edi
xor edi, 0x3258
pop edi
push ecx
push eax
add esp, 4
sub ecx, 0x8cac
pop ecx
cmp dword [ebp - 0x19d8], 0
jne 0x40c553
mov dword [ebp - 0x38c], 0
jmp 0x40c80f
mov ecx, dword [ebp - 0x19d8]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xf00], eax
test dword [eax], eax
int1
invalid
call dword [eax + 0x50]
add esp, 4
and eax, 0x939
pop eax
push ecx
push ecx
add esp, 4
sub ecx, 0x8fba
or ecx, 0x6b53
add byte [eax], al
pop ecx
push ecx
sub ecx, 0x7bf7
sub ecx, 0x2879
xor ecx, 0x12541
pop ecx
cmp dword [ebp - 0xf00], 0
jne 0x40c5af
mov dword [ebp - 0x38c], 0
jmp 0x40c80f
mov ecx, dword [ebp - 0xf00]
mov dword [ebp - 0x5e8], ecx

Function at 0x40c4c0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
and al, byte [eax]
add byte [ecx + 0x1d21cb], al
add byte [ebx + 0x53], bl
Function at 0x40c7e0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add cl, byte [ecx - 0x5e77b]
dec dword [ebx - 0x5e773]
invalid
Function at 0x40c880
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
add byte [esi - 0x77], ah
lea esp, [esp]
invalid

Function at 0x40c900
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
movsb byte es:[edi], byte [esi]
cmp dword [ecx], eax
add byte [esi + 0x52], bl
push ecx
add esp, 4
or edx, 0x36bb

Function at 0x40c910
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
jmp 0x40c918
pop edx
mov byte [ebp - 0xb4c], 0x4c

Function at 0x40c920
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov byte [ebp - 0xb4b], 0x6f
mov byte [ebp - 0xb4a], 0x61
mov byte [ebp - 0xb49], 0x64
mov byte [ebp - 0xb48], 0x4c
invalid
invalid
invalid
hlt

Function at 0x40c9c4
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or edx, 0xac06
pop edx
invalid
invalid
Function at 0x40cd00
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
jmp 0x40cd08
and eax, 0x1645a
pop eax
mov dword [ebp - 0xc74], 0
jmp 0x40d846
Function at 0x40ced0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x8b8]
add eax, 1
mov dword [ebp - 0x8b8], eax
mov ecx, dword [ebp - 0x8b4]
mov edx, dword [ebp - 0x8b8]
cmp edx, dword [ecx + 0x18]
jae 0x40d074
mov eax, dword [ebp - 0x8b8]
mov ecx, dword [ebp - 0x2404]
mov edx, dword [ebp - 0x3f4]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x8bc], edx
mov eax, dword [ebp - 0x8b8]
mov ecx, dword [ebp - 0x2408]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x240c]
mov ecx, dword [ebp - 0x3f4]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x2410], ecx
mov dword [ebp - 0x1f8], 0
jmp 0x40ced8
mov edx, dword [ebp - 0x1f8]
add edx, 1
ret 0x8901
xchg ebp, eax
or dh, bh
invalid
invalid
mov eax, dword [ebp - 0x8bc]
add eax, dword [ebp - 0x1f8]
movsx ecx, byte [eax]
test ecx, ecx
je 0x40cf8a
mov edx, dword [ebp - 0x1f8]
movsx eax, byte [ebp + edx - 0xb4c]
test eax, eax
je 0x40cf8a
invalid
test dword [eax], eax
add byte [eax], al
test byte [ebp + 0x51000000], al
push ecx
push eax
add esp, 4
call 0x40cf18
add byte [ebx + 0x3b], cl
xor eax, 0x4e473e4f
inc ebx
add esp, 4
pop ecx
push ebx
jmp 0x40cf24
add ebx, 0x3215
or ebx, 0x7c8c

Function at 0x40cf18
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x8b8]
add eax, 1
mov dword [ebp - 0x8b8], eax
mov ecx, dword [ebp - 0x8b4]
mov edx, dword [ebp - 0x8b8]
cmp edx, dword [ecx + 0x18]
jae 0x40d074
mov eax, dword [ebp - 0x8b8]
mov ecx, dword [ebp - 0x2404]
mov edx, dword [ebp - 0x3f4]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x8bc], edx
mov eax, dword [ebp - 0x8b8]
mov ecx, dword [ebp - 0x2408]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x240c]
mov ecx, dword [ebp - 0x3f4]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x2410], ecx
mov dword [ebp - 0x1f8], 0
jmp 0x40ced8
mov edx, dword [ebp - 0x1f8]
add edx, 1
ret 0x8901
xchg ebp, eax
or dh, bh
invalid
invalid
mov eax, dword [ebp - 0x8bc]
add eax, dword [ebp - 0x1f8]
movsx ecx, byte [eax]
test ecx, ecx
je 0x40cf8a
mov edx, dword [ebp - 0x1f8]
movsx eax, byte [ebp + edx - 0xb4c]
test eax, eax
je 0x40cf8a
invalid
test dword [eax], eax
add byte [eax], al
test byte [ebp + 0x51000000], al
push ecx
push eax
add esp, 4
call 0x40cf18
add byte [ebx + 0x3b], cl
xor eax, 0x4e473e4f
inc ebx
add esp, 4
pop ecx
push ebx
jmp 0x40cf24
add ebx, 0x3215
or ebx, 0x7c8c

Function at 0x40cf20
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
inc ebp
inc edx
inc edx
inc edi
jmp 0x40cec9

Function at 0x40cf30
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add ebx, 0x54e8
pop ebx
mov ecx, dword [ebp - 0x8bc]
add ecx, dword [ebp - 0x1f8]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x1f8]
movsx ecx, byte [ebp + eax - 0xb4c]
cmp edx, ecx
je 0x40cf7c
mov edx, dword [ebp - 0x8bc]
invalid
xchg ebp, eax
Function at 0x40d4c0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [ebx], dh
push eax
xor al, byte [ecx + 0x3c]
inc ebp
inc ebp
add esp, 4
and ecx, 0xfd94
xor ecx, 0x1186
pop ecx
mov ecx, dword [ebp - 0x38c]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x3f0], edx
push ebx
push edx
add esp, 4
or ebx, 0xb373
add byte [eax], al
and ebx, 0x1795a
and ebx, 0x8bd4
pop ebx
push ecx
sub ecx, 0x48e
pop ecx
push ebx
push esi
add esp, 4
xor ebx, 0x10d7b
add ebx, 0x306f
pop ebx
mov dword [ebp - 0x8d0], 0
mov eax, dword [ebp - 0x3f0]
mov dword [ebp - 0x1a08], eax
cmp dword [ebp - 0x1a08], 0
mov ebp, 0xffffe5f8
add byte [ebp + 0x11], dh
mov ecx, dword [ebp - 0x8d0]
mov dword [ebp - 0x5f4], ecx
jmp 0x40d83a
mov edx, dword [ebp - 0x1a08]
mov eax, dword [ebp - 0x3f0]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x1a0c], eax
jne 0x40d571
mov ecx, dword [ebp - 0x8d0]
mov dword [ebp - 0x5f4], ecx
jmp 0x40d83a
invalid
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x1a0c]
mov edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x19d4], edx
cmp dword [ebp - 0x19d4], 0
jne 0x40d5a3
mov eax, dword [ebp - 0x8d0]
mov dword [ebp - 0x5f4], eax
jmp 0x40d83a
mov ecx, dword [ebp - 0x3f0]
add ecx, dword [ebp - 0x19d4]
mov dword [ebp - 0x8c4], ecx
jne 0x40d5c8
mov edx, dword [ebp - 0x8d0]
mov dword [ebp - 0x5f4], edx
jmp 0x40d83a
mov eax, dword [ebp - 0x8c4]
mov ecx, dword [ebp - 0x3f0]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x2424], ecx
mov edx, dword [ebp - 0x8c4]
mov eax, dword [ebp - 0x3f0]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x2428], eax
mov ecx, dword [ebp - 0x8c4]
mov edx, dword [ebp - 0x3f0]
add edx, dword [ecx + 0x1c]
sbb al, 0x89
xchg ebp, eax
rcr bl, 1
invalid
inc edi
test dword [eax], edi
idiv edi
inc dword [eax]
add byte [eax], al
add bl, ch
invalid
Function at 0x40d4c8
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [ebx], dh
push eax
xor al, byte [ecx + 0x3c]
inc ebp
inc ebp
add esp, 4
and ecx, 0xfd94
xor ecx, 0x1186
pop ecx
mov ecx, dword [ebp - 0x38c]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x3f0], edx
push ebx
push edx
add esp, 4
or ebx, 0xb373
add byte [eax], al
and ebx, 0x1795a
and ebx, 0x8bd4
pop ebx
push ecx
sub ecx, 0x48e
pop ecx
push ebx
push esi
add esp, 4
xor ebx, 0x10d7b
add ebx, 0x306f
pop ebx
mov dword [ebp - 0x8d0], 0
mov eax, dword [ebp - 0x3f0]
mov dword [ebp - 0x1a08], eax
cmp dword [ebp - 0x1a08], 0
mov ebp, 0xffffe5f8
add byte [ebp + 0x11], dh
mov ecx, dword [ebp - 0x8d0]
mov dword [ebp - 0x5f4], ecx
jmp 0x40d83a
mov edx, dword [ebp - 0x1a08]
mov eax, dword [ebp - 0x3f0]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x1a0c], eax
jne 0x40d571
mov ecx, dword [ebp - 0x8d0]
mov dword [ebp - 0x5f4], ecx
jmp 0x40d83a
invalid
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x1a0c]
mov edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x19d4], edx
cmp dword [ebp - 0x19d4], 0
jne 0x40d5a3
mov eax, dword [ebp - 0x8d0]
mov dword [ebp - 0x5f4], eax
jmp 0x40d83a
mov ecx, dword [ebp - 0x3f0]
add ecx, dword [ebp - 0x19d4]
mov dword [ebp - 0x8c4], ecx
jne 0x40d5c8
mov edx, dword [ebp - 0x8d0]
mov dword [ebp - 0x5f4], edx
jmp 0x40d83a
mov eax, dword [ebp - 0x8c4]
mov ecx, dword [ebp - 0x3f0]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x2424], ecx
mov edx, dword [ebp - 0x8c4]
mov eax, dword [ebp - 0x3f0]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x2428], eax
mov ecx, dword [ebp - 0x8c4]
mov edx, dword [ebp - 0x3f0]
add edx, dword [ecx + 0x1c]
sbb al, 0x89
xchg ebp, eax
rcr bl, 1
invalid
inc edi
test dword [eax], edi
idiv edi
inc dword [eax]
add byte [eax], al
add bl, ch
invalid