joyce8/EMBER2024-capa huggingface dataset:
Function at 0x442784
Capabilities:
Set environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x4705d0]
xor eax, ebp
mov dword [ebp + 0x88], eax
push ebx
push esi
mov esi, dword [ebp + 0x94]
push edi
mov edi, dword [ebp + 0x98]
xor ebx, ebx
push 0xff
lea eax, [ebp - 0x77]
push ebx
push eax
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x80], ebx
mov byte [ebp - 0x78], bl
call fcn.004464f0
add esp, 0xc
cmp esi, ebx
je 0x4428ca
cmp byte [esi], bl
je 0x4428ca
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
call esi
mov ecx, eax
inc ecx
mov eax, 0xff
cmp ecx, eax
jg 0x4427f6
push dword [ebp - 0x7c]
call esi
inc eax
push eax
push dword [ebp - 0x7c]
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push ebx
push ebx
push 0x4597fe
push 0x459858
lea eax, [ebp - 0x78]
push eax
call fcn.0043fa75
cmp edi, ebx
je 0x442865
cmp byte [edi], bl
je 0x442865
push edi
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x78]
push eax
push str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSession_ManagerEnvironment_s
push edi
call esi
push eax
push edi
push 1
push 2
call fcn.0044129f
add esp, 0x18
lea eax, [ebp - 0x78]
push eax
push str.HKEY_CURRENT_USEREnvironment_s
push edi
call esi
push eax
push edi
push 1
push 2
call fcn.0044129f
add esp, 0x18
jmp 0x44289c
push ebx
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x78]
push eax
push str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSession_ManagerEnvironment_s
push ebx
push ebx
push ebx
push 4
call fcn.0044129f
lea eax, [ebp - 0x78]
push eax
push str.HKEY_CURRENT_USEREnvironment_s
push ebx
push ebx
push ebx
push 4
call fcn.0044129f
add esp, 0x30
lea eax, [ebp - 0x80]
push eax
push 0x1388
push 2
push str.Environment
push ebx
push 0x1a
push 0xffff
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x7c]
jmp 0x4428cc
xor eax, eax
mov ecx, dword [ebp + 0x88]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004464bf
add ebp, 0x8c
leave
ret 8
Function at 0x442ad6
Capabilities:
Log keystrokes
Terminate process

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
push ebp
push esi
push edi
xor edi, edi
mov ebx, 0xfa
cmp eax, ebx
mov dword [esp + 0x10], edi
jge 0x442af0
mov eax, ebx
mov esi, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
push ecx
push eax
push 2
push edi
push edi
push 0x10
push esi
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
test eax, eax
jne 0x442b39
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [esp + 0x10]
push edi
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebp, eax
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp ebp, edi
je 0x442b39
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
call ebp
cmp esi, edi
je 0x442b5c
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x442b5c
push edi
push edi
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
push ebx
call ebp
cmp esi, edi
je 0x442b75
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x442b75
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
push ebx
call ebp
cmp esi, edi
je 0x442bc1
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x442bc1
push edi
push esi
call fcn.00440998
mov esi, dword [sym.imp.USER32.dll_keybd_event]
push edi
push edi
push edi
push 0x12
call esi
mov ebx, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push edi
push edi
push edi
push 0x73
pop ebp
push ebp
call ebx
push eax
push ebp
call esi
push edi
push 2
push edi
push ebp
call ebx
push eax
push ebp
call esi
push edi
push 2
push edi
push 0x12
call esi
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
pop ecx
ret 8
Function at 0x44498e
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
mov dword [0x4778d8], eax
mov eax, dword [esp + 0xc]
push esi
push edi
mov edi, dword [esp + 0x20]
test al, 0x10
je 0x4449cc
push ebp
call fcn.004464e4
mov esi, eax
xor ebx, ebx
pop ecx
cmp esi, ebx
je 0x4449f5
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4449f5
mov eax, esi
jmp 0x444b15
xor ebx, ebx
cmp edi, ebx
jne 0x4449f9
test eax, 0x4000
je 0x4449f9
test al, 0x21
jne 0x4449e5
test al, 2
je 0x4449f9
push ebx
push ebp
jmp 0x4449e7
push ebp
push ebx
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, ebx
jne 0x444b15
mov eax, dword [esp + 0x14]
mov dword [0x477714], eax
mov dword [0x477608], ebx
mov dword [0x4775f8], ebx
mov dword [0x4775fc], ebx
mov dword [0x4778c0], ebx
cmp edi, ebx
je 0x444a2b
push edi
call dword [sym.imp.USER32.dll_IsWindow]
mov dword [0x47760c], edi
test eax, eax
jne 0x444a31
mov dword [0x47760c], ebx
cmp ebp, ebx
jne 0x444a48
test dword [0x477714], 0x700
jne 0x444a48
xor eax, eax
jmp 0x444b15
mov al, byte [0x477714]
xor edi, edi
mov byte [0x477718], bl
mov esi, 0x45b88c
test al, 0x21
je 0x444a95
push ebx
push 1
mov edi, 0x477610
push 0x103
test al, 0x20
je 0x444a76
push 0x477718
jmp 0x444a77
push edi
push ebx
push esi
push ebp
call fcn.004432d3
push ebx
push 1
push 0x4597fe
push 0x45d508
push edi
call fcn.0043fa75
xor edi, edi
inc edi
test byte [0x477714], 2
je 0x444ab1
push ebx
push 1
push 0x3f
push 0x477820
push edi
push esi
push ebp
call fcn.004432d3
inc edi
test byte [0x477714], 4
je 0x444acd
push ebx
push 1
push 0x1f
push 0x477860
push edi
push esi
push ebp
call fcn.004432d3
inc edi
test byte [0x477714], 8
je 0x444ae9
push ebx
push 1
push 0x1f
push 0x477880
push edi
push esi
push ebp
call fcn.004432d3
inc edi
test byte [0x477714], 0x10
je 0x444b04
push ebx
push 1
push 0x1f
push 0x4778a0
push edi
push esi
push ebp
call fcn.004432d3
push ebp
push 0x444929
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [0x477608]
pop edi
pop esi
pop ebp
pop ebx
ret 0x10

Function at 0x444b1c
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
xor esi, esi
push esi
call fcn.0043f04b
cmp eax, 2
mov dword [ebp - 8], eax
jl 0x444b7d
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x444b4e
xor al, al
jmp 0x444bab
lea eax, [ebp - 0x14]
push eax
push str.SeShutdownPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push esi
push esi
push esi
lea eax, [ebp - 0x18]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xc], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
cmp dword [ebp - 8], 1
jl 0x444b9c
test byte [ebp + 8], 4
je 0x444b9c
xor dword [ebp + 8], 4
push esi
push dword [ebp + 0xc]
push esi
push 0x400
call fcn.0044498e
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
setne al
pop esi
leave
ret 8
Function at 0x4464bf
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4705d0]
jne 0x4464c9
repz ret
jmp fcn.0044c621

Function at 0x457b55
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0044bf4a
and dword [ebp - 4], 0
cmp dword [0x4783cc], 0
mov ebx, eax
jne 0x457c06
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x457cb7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x45df84
push edi
call esi
test eax, eax
je 0x457cb7
push eax
call fcn.0044bed8
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4783cc], eax
call esi
push eax
call fcn.0044bed8
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4783d0], eax
call esi
push eax
call fcn.0044bed8
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4783d4], eax
call esi
push eax
call fcn.0044bed8
pop ecx
mov dword [0x4783dc], eax
test eax, eax
je 0x457c06
push 0x46d380
push edi
call esi
push eax
call fcn.0044bed8
pop ecx
mov dword [0x4783d8], eax
mov eax, dword [0x4783d8]
cmp eax, ebx
je 0x457c5e
cmp dword [0x4783dc], ebx
je 0x457c5e
push eax
call fcn.0044bf53
push dword [0x4783dc]
mov esi, eax
call fcn.0044bf53
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x457c5e
test edi, edi
je 0x457c5e
call esi
test eax, eax
je 0x457c55
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x457c55
test byte [ebp - 0xc], 1
jne 0x457c5e
or dword [ebp + 0x10], 0x200000
jmp 0x457c97
mov eax, dword [0x4783d0]
cmp eax, ebx
je 0x457c97
push eax
call fcn.0044bf53
pop ecx
test eax, eax
je 0x457c97
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x457c97
mov eax, dword [0x4783d4]
cmp eax, ebx
je 0x457c97
push eax
call fcn.0044bf53
pop ecx
test eax, eax
je 0x457c97
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4783cc]
call fcn.0044bf53
pop ecx
test eax, eax
je 0x457cb7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x457cb9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40574c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
and esi, 0x4481
and esi, 0xe705
sub esi, 0x90c6
jmp 0x405764
pop esi
push ebx
and ebx, 0xa414
or ebx, 0x97d3
add ebx, 0x1b83
pop ebx
mov eax, dword [ebp - 0x4cc]
mov dword [ebp - 0x3cc], eax
jmp 0x4057c8
Function at 0x405984
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x4d0]
add edx, 1
mov dword [ebp - 0x4d0], edx
push eax
push esi
add esp, 4
and eax, 0x18f
add eax, 0xbc20
add eax, 0x11f43
pop eax
push ebx
push eax
add esp, 4
add ebx, 0x938
pop ebx
push eax
add eax, 0x1119e
sub eax, 0x2a93
pop eax
mov eax, dword [ebp - 0x4d0]
sub eax, dword [ebp - 0x3c0]
cmp eax, 0xffffffff
jb 0x405946
push ecx
and ecx, 0xbc7a
or ecx, 0xbd9f
xor ecx, 0xddd3
pop ecx
push ecx
push ecx
add esp, 4
add ecx, 0x14df9
pop ecx
push ecx
push ebx
add esp, 4
and ecx, 0xb52b
sub ecx, 0xf02b
pop ecx
jmp 0x405b74
mov dword [ebp - 0xc10], 7
mov ecx, dword [ebp - 0x4d0]
mov dword [ebp - 0xa60], ecx
push eax
push eax
add esp, 4
or eax, 0x5b00
add eax, 0x7c7b
pop eax
push edx
jmp fcn.00405978
call 0x405984
add byte [edx], bh
xor eax, 0x4c344538
add esp, 4
or edx, 0x3d49
pop edx
mov edx, dword [ebp - 0x14c8]
mov dword [ebp - 0x9f0], edx
mov dword [ebp - 0xc14], 0
mov eax, dword [ebp - 0x4d0]
cmp eax, dword [ebp - 0x14c8]
jne 0x4059f5
push ecx
push edx
add esp, 4
sub ecx, 0x14d6b
and ecx, 0x3215
sub ecx, 0x9480
pop ecx
push edi
xor edi, 0xd49b
xor edi, 0x9e88
pop edi
push ecx
push ebx
add esp, 4
sub ecx, 0xb344
pop ecx
mov ecx, dword [ebp - 0xc14]
mov dword [ebp - 0x14d0], ecx
jmp 0x405b26
cmp dword [ebp - 0xc10], 0
jle 0x405b1a
push esi
or esi, 0x11a09
sub esi, 0x155aa
or esi, 0x6991
or esi, 0x7cec
pop esi
push ebx
push eax
add esp, 4
sub ebx, 0x147ce
pop ebx
push eax
push ecx
add esp, 4
sub eax, 0x14f44
pop eax
mov edx, dword [ebp - 0xc14]
mov dword [ebp - 0x14d0], edx
cmp dword [ebp - 0x14d0], 0
jne 0x405b6f
push esi
jmp 0x4058bd
push ecx
or ecx, 0x3074
and ecx, 0xcee3
loope 0x405b61
into
add byte [eax], al
pop ecx
push ebx
push edi
add esp, 4
add ebx, 0x5fa
add ebx, 0x6643
call 0x405ba2
add byte [ebx], bh
dec eax
push eax
inc ecx
inc edi
inc esp
cmp al, 0x4d
xor eax, dword [ebx - 0x38a4fb3c]
test dword [ebp + esi*8 + 0xffff], esp
add byte [eax], al
push ecx
xor ecx, 0xee67
or ecx, 0x806b
add ecx, 0xbf37
pop ecx
push ebx
push ecx
add esp, 4
add ebx, 0x143ea
add ebx, 0xb99f
sub ebx, 0x9395
add ebx, 0xe988
pop ebx
mov byte [ebp - 0x804], 0x45
mov byte [ebp - 0x803], 0x78
idiv edi
invalid
js 0x405bb7
test esi, edi
idiv edi
jmp [ecx - 0x3a]
test edi, edi
idiv edi
push dword [esi + eax*8 - 0x7b]
add al, bh
invalid
call dword [eax - 0x3a]
test dword [ecx], eax
clc
invalid
push dword [edx - 0x3a]
test dword [edx], eax
clc
invalid
jmp [edi - 0x3a]
test dword [ebx], eax
clc
invalid
jmp dword [ebx - 0x3a]
test dword [eax + edi*8], eax
invalid
jmp dword [ebp - 0x3a]
test dword [0x73fffff8], eax
mov byte [ebp - 0x7fa], 0x73
mov byte [ebp - 0x7f9], 0
push ecx
call 0x405c45
add byte [esp + eax*2], bh
dec ebx
push eax
dec ebx
inc eax
inc esp
cmp al, 0x83
les eax, [ecx + ebx*2]
push ebx
jmp 0x405c50
xor ebx, 0x1f5a
call 0x405c64
add byte [0x3d3f3a35], bh
dec edx
dec eax
cmp byte [ebx - 0x46a4fb3c], al
imul eax, dword [eax], 0
add byte [esi - 0x77], ah
invalid
Function at 0x405a34
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0xa60]
movzx eax, byte [edx]
add cl, byte [ebx - 0x9ef73]
dec dword [edi]
mov dh, 0x11
cmp eax, edx
je 0x405ab6
push ebx
push edx
push edi
push edx
add esp, 4
call 0x405ac7
add byte [ebx], bh
inc esp
cmp byte [ebx + 0x35], cl
dec ebx
xor eax, 0x4c4834c
add edi, 0x86f0
lock xchg byte [eax], al
add byte [edi + 0x50], bl
add eax, 0x11b96
sub eax, 0x16c4d
pop eax
push ecx
jmp 0x405ae7
pop ecx
mov edx, dword [ebp - 0xc10]
sub edx, 1
mov dword [ebp - 0xc10], edx
mov eax, dword [ebp - 0xa60]
add eax, 1
mov dword [ebp - 0xa60], eax
mov ecx, dword [ebp - 0x9f0]
add ecx, 1
mov dword [ebp - 0x9f0], ecx
jmp 0x4059f5

Function at 0x405a3c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add cl, byte [ebx - 0x9ef73]
dec dword [edi]
mov dh, 0x11

Function at 0x405a4c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or ebx, 0x10aba
call 0x405a61
add byte [edi + 0x38], al
inc esi
inc esp
dec esi
add esp, 4
pop ebx
push ecx
xor ecx, 0x10dcc
xor ecx, 0xa3eb
pop ecx
push esi
jmp 0x405a7b
pop esi
mov eax, dword [ebp - 0xa60]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x9f0]
movzx eax, byte [edx]
cmp ecx, eax
jle 0x405a9e
mov dword [ebp - 0x14cc], 1
jmp 0x405aa8
mov dword [ebp - 0x14cc], 0xffffffff
mov ecx, dword [ebp - 0x14cc]
mov dword [ebp - 0xc14], ecx
jmp 0x405b1a

Function at 0x405a61
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or ebx, 0x10aba
call 0x405a61
add byte [edi + 0x38], al
inc esi
inc esp
dec esi
add esp, 4
pop ebx
push ecx
xor ecx, 0x10dcc
xor ecx, 0xa3eb
pop ecx
push esi
jmp 0x405a7b
pop esi
mov eax, dword [ebp - 0xa60]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x9f0]
movzx eax, byte [edx]
cmp ecx, eax
jle 0x405a9e
mov dword [ebp - 0x14cc], 1
jmp 0x405aa8
mov dword [ebp - 0x14cc], 0xffffffff
mov ecx, dword [ebp - 0x14cc]
mov dword [ebp - 0xc14], ecx
jmp 0x405b1a

Function at 0x405acc
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0xa60]
movzx eax, byte [edx]
add cl, byte [ebx - 0x9ef73]
dec dword [edi]
mov dh, 0x11
cmp eax, edx
je 0x405ab6
push ebx
push edx
push edi
push edx
add esp, 4
call 0x405ac7
add byte [ebx], bh
inc esp
cmp byte [ebx + 0x35], cl
dec ebx
xor eax, 0x4c4834c
add edi, 0x86f0
lock xchg byte [eax], al
add byte [edi + 0x50], bl
add eax, 0x11b96
sub eax, 0x16c4d
pop eax
push ecx
jmp 0x405ae7
pop ecx
mov edx, dword [ebp - 0xc10]
sub edx, 1
mov dword [ebp - 0xc10], edx
mov eax, dword [ebp - 0xa60]
add eax, 1
mov dword [ebp - 0xa60], eax
mov ecx, dword [ebp - 0x9f0]
add ecx, 1
mov dword [ebp - 0x9f0], ecx
jmp 0x4059f5
Function at 0x405b30
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push eax
add esp, 4
or esi, 0x16850
sub esi, 0x8eb0
pop esi
push ecx
push edi
add esp, 4
and ecx, 0xd16e
jmp 0x405b54
sub ecx, 0x99fe
or ecx, 0xdd77
pop ecx
mov eax, dword [ebp - 0x4d0]
mov dword [ebp - 0xa5c], eax
jmp 0x405bb0
Function at 0x405ba2
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x4d0]
add edx, 1
mov dword [ebp - 0x4d0], edx
push eax
push esi
add esp, 4
and eax, 0x18f
add eax, 0xbc20
add eax, 0x11f43
pop eax
push ebx
push eax
add esp, 4
add ebx, 0x938
pop ebx
push eax
add eax, 0x1119e
sub eax, 0x2a93
pop eax
mov eax, dword [ebp - 0x4d0]
sub eax, dword [ebp - 0x3c0]
cmp eax, 0xffffffff
jb 0x405946
push ecx
and ecx, 0xbc7a
or ecx, 0xbd9f
xor ecx, 0xddd3
pop ecx
push ecx
push ecx
add esp, 4
add ecx, 0x14df9
pop ecx
push ecx
push ebx
add esp, 4
and ecx, 0xb52b
sub ecx, 0xf02b
pop ecx
jmp 0x405b74
mov dword [ebp - 0xc10], 7
mov ecx, dword [ebp - 0x4d0]
mov dword [ebp - 0xa60], ecx
push eax
push eax
add esp, 4
or eax, 0x5b00
add eax, 0x7c7b
pop eax
push edx
jmp fcn.00405978
call 0x405984
add byte [edx], bh
xor eax, 0x4c344538
add esp, 4
or edx, 0x3d49
pop edx
mov edx, dword [ebp - 0x14c8]
mov dword [ebp - 0x9f0], edx
mov dword [ebp - 0xc14], 0
mov eax, dword [ebp - 0x4d0]
cmp eax, dword [ebp - 0x14c8]
jne 0x4059f5
push ecx
push edx
add esp, 4
sub ecx, 0x14d6b
and ecx, 0x3215
sub ecx, 0x9480
pop ecx
push edi
xor edi, 0xd49b
xor edi, 0x9e88
pop edi
push ecx
push ebx
add esp, 4
sub ecx, 0xb344
pop ecx
mov ecx, dword [ebp - 0xc14]
mov dword [ebp - 0x14d0], ecx
jmp 0x405b26
cmp dword [ebp - 0xc10], 0
jle 0x405b1a
push esi
or esi, 0x11a09
sub esi, 0x155aa
or esi, 0x6991
or esi, 0x7cec
pop esi
push ebx
push eax
add esp, 4
sub ebx, 0x147ce
pop ebx
push eax
push ecx
add esp, 4
sub eax, 0x14f44
pop eax
mov edx, dword [ebp - 0xc14]
mov dword [ebp - 0x14d0], edx
cmp dword [ebp - 0x14d0], 0
jne 0x405b6f
push esi
jmp 0x4058bd
push ecx
or ecx, 0x3074
and ecx, 0xcee3
loope 0x405b61
into
add byte [eax], al
pop ecx
push ebx
push edi
add esp, 4
add ebx, 0x5fa
add ebx, 0x6643
call 0x405ba2
add byte [ebx], bh
dec eax
push eax
inc ecx
inc edi
inc esp
cmp al, 0x4d
xor eax, dword [ebx - 0x38a4fb3c]
test dword [ebp + esi*8 + 0xffff], esp
add byte [eax], al
push ecx
xor ecx, 0xee67
or ecx, 0x806b
add ecx, 0xbf37
pop ecx
push ebx
push ecx
add esp, 4
add ebx, 0x143ea
add ebx, 0xb99f
sub ebx, 0x9395
add ebx, 0xe988
pop ebx
mov byte [ebp - 0x804], 0x45
mov byte [ebp - 0x803], 0x78
idiv edi
invalid
js 0x405bb7
test esi, edi
idiv edi
jmp [ecx - 0x3a]
test edi, edi
idiv edi
push dword [esi + eax*8 - 0x7b]
add al, bh
invalid
call dword [eax - 0x3a]
test dword [ecx], eax
clc
invalid
push dword [edx - 0x3a]
test dword [edx], eax
clc
invalid
jmp [edi - 0x3a]
test dword [ebx], eax
clc
invalid
jmp dword [ebx - 0x3a]
test dword [eax + edi*8], eax
invalid
jmp dword [ebp - 0x3a]
test dword [0x73fffff8], eax
mov byte [ebp - 0x7fa], 0x73
mov byte [ebp - 0x7f9], 0
push ecx
call 0x405c45
add byte [esp + eax*2], bh
dec ebx
push eax
dec ebx
inc eax
inc esp
cmp al, 0x83
les eax, [ecx + ebx*2]
push ebx
jmp 0x405c50
xor ebx, 0x1f5a
call 0x405c64
add byte [0x3d3f3a35], bh
dec edx
dec eax
cmp byte [ebx - 0x46a4fb3c], al
imul eax, dword [eax], 0
add byte [esi - 0x77], ah
invalid
Function at 0x405c45
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x4d0]
add edx, 1
mov dword [ebp - 0x4d0], edx
push eax
push esi
add esp, 4
and eax, 0x18f
add eax, 0xbc20
add eax, 0x11f43
pop eax
push ebx
push eax
add esp, 4
add ebx, 0x938
pop ebx
push eax
add eax, 0x1119e
sub eax, 0x2a93
pop eax
mov eax, dword [ebp - 0x4d0]
sub eax, dword [ebp - 0x3c0]
cmp eax, 0xffffffff
jb 0x405946
push ecx
and ecx, 0xbc7a
or ecx, 0xbd9f
xor ecx, 0xddd3
pop ecx
push ecx
push ecx
add esp, 4
add ecx, 0x14df9
pop ecx
push ecx
push ebx
add esp, 4
and ecx, 0xb52b
sub ecx, 0xf02b
pop ecx
jmp 0x405b74
mov dword [ebp - 0xc10], 7
mov ecx, dword [ebp - 0x4d0]
mov dword [ebp - 0xa60], ecx
push eax
push eax
add esp, 4
or eax, 0x5b00
add eax, 0x7c7b
pop eax
push edx
jmp fcn.00405978
call 0x405984
add byte [edx], bh
xor eax, 0x4c344538
add esp, 4
or edx, 0x3d49
pop edx
mov edx, dword [ebp - 0x14c8]
mov dword [ebp - 0x9f0], edx
mov dword [ebp - 0xc14], 0
mov eax, dword [ebp - 0x4d0]
cmp eax, dword [ebp - 0x14c8]
jne 0x4059f5
push ecx
push edx
add esp, 4
sub ecx, 0x14d6b
and ecx, 0x3215
sub ecx, 0x9480
pop ecx
push edi
xor edi, 0xd49b
xor edi, 0x9e88
pop edi
push ecx
push ebx
add esp, 4
sub ecx, 0xb344
pop ecx
mov ecx, dword [ebp - 0xc14]
mov dword [ebp - 0x14d0], ecx
jmp 0x405b26
cmp dword [ebp - 0xc10], 0
jle 0x405b1a
push esi
or esi, 0x11a09
sub esi, 0x155aa
or esi, 0x6991
or esi, 0x7cec
pop esi
push ebx
push eax
add esp, 4
sub ebx, 0x147ce
pop ebx
push eax
push ecx
add esp, 4
sub eax, 0x14f44
pop eax
mov edx, dword [ebp - 0xc14]
mov dword [ebp - 0x14d0], edx
cmp dword [ebp - 0x14d0], 0
jne 0x405b6f
push esi
jmp 0x4058bd
push ecx
or ecx, 0x3074
and ecx, 0xcee3
loope 0x405b61
into
add byte [eax], al
pop ecx
push ebx
push edi
add esp, 4
add ebx, 0x5fa
add ebx, 0x6643
call 0x405ba2
add byte [ebx], bh
dec eax
push eax
inc ecx
inc edi
inc esp
cmp al, 0x4d
xor eax, dword [ebx - 0x38a4fb3c]
test dword [ebp + esi*8 + 0xffff], esp
add byte [eax], al
push ecx
xor ecx, 0xee67
or ecx, 0x806b
add ecx, 0xbf37
pop ecx
push ebx
push ecx
add esp, 4
add ebx, 0x143ea
add ebx, 0xb99f
sub ebx, 0x9395
add ebx, 0xe988
pop ebx
mov byte [ebp - 0x804], 0x45
mov byte [ebp - 0x803], 0x78
idiv edi
invalid
js 0x405bb7
test esi, edi
idiv edi
jmp [ecx - 0x3a]
test edi, edi
idiv edi
push dword [esi + eax*8 - 0x7b]
add al, bh
invalid
call dword [eax - 0x3a]
test dword [ecx], eax
clc
invalid
push dword [edx - 0x3a]
test dword [edx], eax
clc
invalid
jmp [edi - 0x3a]
test dword [ebx], eax
clc
invalid
jmp dword [ebx - 0x3a]
test dword [eax + edi*8], eax
invalid
jmp dword [ebp - 0x3a]
test dword [0x73fffff8], eax
mov byte [ebp - 0x7fa], 0x73
mov byte [ebp - 0x7f9], 0
push ecx
call 0x405c45
add byte [esp + eax*2], bh
dec ebx
push eax
dec ebx
inc eax
inc esp
cmp al, 0x83
les eax, [ecx + ebx*2]
push ebx
jmp 0x405c50
xor ebx, 0x1f5a
call 0x405c64
add byte [0x3d3f3a35], bh
dec edx
dec eax
cmp byte [ebx - 0x46a4fb3c], al
imul eax, dword [eax], 0
add byte [esi - 0x77], ah
invalid