joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406975
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ebp - 0x100]
add ecx, 1
invalid
invalid
cmp dword [ebp - 0x2c4], 0
jle 0x406903
push edi
and edi, 0x2148
or edi, 0x38f5
and edi, 0x7a3d
pop edi
push edi
push eax
add esp, 4
sub edi, 0x4f22
call 0x406819
add byte [0x43474e35], dh
cmp ecx, dword [edi + 0x37]
aaa
add esp, 4
pop edi
mov ecx, dword [ebp - 0x260]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0x264]
movzx ecx, byte [eax]
cmp edx, ecx
invalid
je 0x40689f
push eax
call 0x406841
add byte [ebx + ecx*2 + 0x37], cl
inc edx
inc edx
inc esi
inc ebp
add esp, 4
and eax, 0xfa03
sub eax, 0x9b3c
pop eax
push ecx
jmp 0x406858
sub ecx, 0x254c
or ecx, 0xe68d
pop ecx
mov edx, dword [ebp - 0x260]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x264]
movzx edx, byte [ecx]
cmp eax, edx
jle 0x406887
mov dword [ebp - 0x4ac], 1
jmp 0x406891
mov dword [ebp - 0x4ac], 0xffffffff
mov eax, dword [ebp - 0x4ac]
mov dword [ebp - 0x2c8], eax
jmp 0x406903
push edx
call 0x4068b0
add byte [ecx + 0x39], cl
inc edi
aaa
cmp byte [esi + 0x40], cl
aas
inc ebx
cmp al, byte [ebx - 0x357efb3c]
xor byte [ecx], al
add byte [edx + 0x56], bl
jmp 0x4068c4
xor esi, 0xbf24
sub esi, 0x18359
pop esi
mov ecx, dword [ebp - 0x2c4]
sub ecx, 1
mov dword [ebp - 0x2c4], ecx
mov edx, dword [ebp - 0x260]
add edx, 1
mov dword [ebp - 0x260], edx
mov eax, dword [ebp - 0x264]
add eax, 1
mov dword [ebp - 0x264], eax
jmp 0x4067de
mov ecx, dword [ebp - 0x2c8]
mov dword [ebp - 0x4b0], ecx
cmp dword [ebp - 0x4b0], 0
jne 0x406958
push ebx
sub ebx, 0x154a5
and ebx, 0xc273
xor ebx, 0x463e
pop ebx
push ecx
push esi
add esp, 4
sub ecx, 0x18478
xor ecx, 0x10f44
sub ecx, 0x89a1
or ecx, 0x1357f
pop ecx
mov edx, dword [ebp - 0x100]
mov dword [ebp - 0x268], edx
jmp 0x406967
jmp 0x40670a
push edi
call 0x406975
add byte [eax + 0x3d], dl
dec ebx
dec edi
cmp byte [ebx + eax*4 - 0x3c], cl
add al, 0x81
invalid
Function at 0x406b70
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
sub ecx, 0xaeb2
pop ecx
push ecx
and ecx, 0xcaf
call fcn.00406b8e
add byte [esi + 0x41], cl
inc edx
inc ecx
cmp cl, byte [ebp + 0x44]

Function at 0x406b8e
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x406b99
xor ecx, 0x6fc2
pop ecx
cmp dword [ebp - 0x2d4], 0
jne 0x406bb8
mov dword [ebp - 0xa8], 0
jmp 0x406dde
mov edx, dword [ebp - 0x2d4]
mov dword [ebp - 0xfc], edx
push edi
or edi, 0xf3ff
pop edi
push ecx
push ebx
add esp, 4
sub ecx, 0xa07a
pop ecx
push edi
push esi
add esp, 4
sub edi, 0x11b2
xor edi, 0x11324
jmp 0x406bef
sub edi, 0x9ac2
pop edi
lea eax, [ebp - 0x55c]
mov dword [ebp - 0x2d0], eax
mov ecx, dword [ebp - 0xfc]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x2cc], edx
push dword [ebx]
shl byte [esi - 0x77], 0x45
xor byte [ebx], 0xc9
mov word [ebp - 0x44], cx
push esi
add esi, 0x885c
jmp 0x406c29
jmp 0x406c31
pop esi
push ebx
xor ebx, 0xe535
call 0x406c45
add byte [eax + eax*2], bh
inc eax
dec ebp
dec edx
dec ebp
add esp, 4
xor ebx, 0x17517
pop ebx
mov edx, dword [ebp - 0x2cc]
mov ax, word [edx]
mov word [ebp - 0x322], ax
mov ecx, dword [ebp - 0x2cc]
add ecx, 2
mov dword [ebp - 0x2cc], ecx
mov dx, word [ebp - 0x322]
mov word [ebp - 0x80], dx
mov eax, dword [ebp - 0x2d0]
mov cx, word [eax]
mov word [ebp - 0x386], cx
mov edx, dword [ebp - 0x2d0]
add edx, 2
mov dword [ebp - 0x2d0], edx
mov ax, word [ebp - 0x386]
mov word [ebp - 0x44], ax
push eax
xor eax, 0x110f7
xor eax, 0x168b0
jmp 0x406cb6
pop eax
push ebx
push ebx
add esp, 4
xor ebx, 0x11ce9
and ebx, 0xb8f1
xor ebx, 0x143f3
xor ebx, 0x744b
pop ebx
movzx ecx, word [ebp - 0x44]
test ecx, ecx
jne 0x406cef
invalid
mov bh, 0x55
Function at 0x406c10
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x406b99
xor ecx, 0x6fc2
pop ecx
cmp dword [ebp - 0x2d4], 0
jne 0x406bb8
mov dword [ebp - 0xa8], 0
jmp 0x406dde
mov edx, dword [ebp - 0x2d4]
mov dword [ebp - 0xfc], edx
push edi
or edi, 0xf3ff
pop edi
push ecx
push ebx
add esp, 4
sub ecx, 0xa07a
pop ecx
push edi
push esi
add esp, 4
sub edi, 0x11b2
xor edi, 0x11324
jmp 0x406bef
sub edi, 0x9ac2
pop edi
lea eax, [ebp - 0x55c]
mov dword [ebp - 0x2d0], eax
mov ecx, dword [ebp - 0xfc]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x2cc], edx
push dword [ebx]
shl byte [esi - 0x77], 0x45
xor byte [ebx], 0xc9
mov word [ebp - 0x44], cx
push esi
add esi, 0x885c
jmp 0x406c29
jmp 0x406c31
pop esi
push ebx
xor ebx, 0xe535
call 0x406c45
add byte [eax + eax*2], bh
inc eax
dec ebp
dec edx
dec ebp
add esp, 4
xor ebx, 0x17517
pop ebx
mov edx, dword [ebp - 0x2cc]
mov ax, word [edx]
mov word [ebp - 0x322], ax
mov ecx, dword [ebp - 0x2cc]
add ecx, 2
mov dword [ebp - 0x2cc], ecx
mov dx, word [ebp - 0x322]
mov word [ebp - 0x80], dx
mov eax, dword [ebp - 0x2d0]
mov cx, word [eax]
mov word [ebp - 0x386], cx
mov edx, dword [ebp - 0x2d0]
add edx, 2
mov dword [ebp - 0x2d0], edx
mov ax, word [ebp - 0x386]
mov word [ebp - 0x44], ax
push eax
xor eax, 0x110f7
xor eax, 0x168b0
jmp 0x406cb6
pop eax
push ebx
push ebx
add esp, 4
xor ebx, 0x11ce9
and ebx, 0xb8f1
xor ebx, 0x143f3
xor ebx, 0x744b
pop ebx
movzx ecx, word [ebp - 0x44]
test ecx, ecx
jne 0x406cef
invalid
mov bh, 0x55

Function at 0x406c45
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x406b99
xor ecx, 0x6fc2
pop ecx
cmp dword [ebp - 0x2d4], 0
jne 0x406bb8
mov dword [ebp - 0xa8], 0
jmp 0x406dde
mov edx, dword [ebp - 0x2d4]
mov dword [ebp - 0xfc], edx
push edi
or edi, 0xf3ff
pop edi
push ecx
push ebx
add esp, 4
sub ecx, 0xa07a
pop ecx
push edi
push esi
add esp, 4
sub edi, 0x11b2
xor edi, 0x11324
jmp 0x406bef
sub edi, 0x9ac2
pop edi
lea eax, [ebp - 0x55c]
mov dword [ebp - 0x2d0], eax
mov ecx, dword [ebp - 0xfc]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x2cc], edx
push dword [ebx]
shl byte [esi - 0x77], 0x45
xor byte [ebx], 0xc9
mov word [ebp - 0x44], cx
push esi
add esi, 0x885c
jmp 0x406c29
jmp 0x406c31
pop esi
push ebx
xor ebx, 0xe535
call 0x406c45
add byte [eax + eax*2], bh
inc eax
dec ebp
dec edx
dec ebp
add esp, 4
xor ebx, 0x17517
pop ebx
mov edx, dword [ebp - 0x2cc]
mov ax, word [edx]
mov word [ebp - 0x322], ax
mov ecx, dword [ebp - 0x2cc]
add ecx, 2
mov dword [ebp - 0x2cc], ecx
mov dx, word [ebp - 0x322]
mov word [ebp - 0x80], dx
mov eax, dword [ebp - 0x2d0]
mov cx, word [eax]
mov word [ebp - 0x386], cx
mov edx, dword [ebp - 0x2d0]
add edx, 2
mov dword [ebp - 0x2d0], edx
mov ax, word [ebp - 0x386]
mov word [ebp - 0x44], ax
push eax
xor eax, 0x110f7
xor eax, 0x168b0
jmp 0x406cb6
pop eax
push ebx
push ebx
add esp, 4
xor ebx, 0x11ce9
and ebx, 0xb8f1
xor ebx, 0x143f3
xor ebx, 0x744b
pop ebx
movzx ecx, word [ebp - 0x44]
test ecx, ecx
jne 0x406cef
invalid
mov bh, 0x55
Function at 0x406fe0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
sub ecx, 0x9d94
pop ecx
push eax
add eax, 0x725a
sub eax, 0x16b7d
pop eax
cmp dword [ebp - 0x2e0], 0
jne fcn.00407010
mov dword [ebp - 0x194], 0
jmp 0x407245

Function at 0x407129
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov word [ebp - 0x84], cx
mov edx, dword [ebp - 0x2dc]
mov ax, word [edx]
mov word [ebp - 0x38a], ax
mov ecx, dword [ebp - 0x2dc]
add ecx, 2
mov dword [ebp - 0x2dc], ecx
mov dx, word [ebp - 0x38a]
mov word [ebp - 0x48], dx
push edi
push eax
add esp, 4
and edi, 0x436e
or edi, 0x10ce5
pop edi
push esi
or esi, 0x41dd
call 0x407129
add byte [edi + 0x48], al
dec ecx
cmp al, 0x3b
inc edx
xor al, 0x32
xor al, byte [ebx - 0x317efb3c]
loope 0x4070d8
xchg ebp, eax
and al, 0xfd
invalid

Function at 0x40727c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
jecxz 0x4072dd
pop esi
add byte [eax], al
jmp 0x40726e
call 0x40727c
add byte [ebx], dh
cmp edi, dword [esi]
xor al, 0x3e
dec ebp
xor eax, 0x4c48349
pop ebx
mov dword [ebp - 0x1e0], 0
jmp 0x407ce7
invalid
push eax
sub eax, 0xd132
or eax, 0x14dd
pop eax
push ecx
push eax
add esp, 4
xor ecx, 0x1379f
pop ecx
push esi
push ebx
add esp, 4
call 0x407d15
add byte [esi + 0x3e], cl
dec esp
dec esi
Function at 0x407400
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x19c]
add eax, 1
mov dword [ebp - 0x19c], eax
mov ecx, dword [ebp - 0x198]
mov edx, dword [ebp - 0x19c]
cmp edx, dword [ecx + 0x18]
jae 0x4075ba
mov eax, dword [ebp - 0x19c]
mov ecx, dword [ebp - 0x6e0]
mov edx, dword [ebp - 0xbc]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x1a0], edx
mov eax, dword [ebp - 0x19c]
mov ecx, dword [ebp - 0x6e4]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x6e8]
mov ecx, dword [ebp - 0xbc]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x6ec], ecx
mov dword [ebp - 0x14], 0
jmp 0x407440
mov eax, dword [ebp - 0x1a0]
add eax, dword [ebp - 0x14]
movsx ecx, byte [eax]
test ecx, ecx
je 0x4074dc
mov edx, dword [ebp - 0x14]
movsx eax, byte [ebp + edx - 0x214]
test eax, eax
je 0x4074dc
push ecx
call fcn.00407471
add byte [eax + 0x41], dl
cmp al, 0x44
dec edi
inc eax
dec eax
push edi
jmp 0x4074e4
sub edi, 0x6fe7
pop edi
push eax
call 0x4074f8
add byte [eax], bh
dec esp
cmp al, 0x33
add esp, 4
or eax, 0x9b85
and eax, 0x11f3a
xor eax, 0x8254
pop eax
mov eax, dword [ebp - 0x1a0]
add eax, dword [ebp - 0x14]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x14]
movsx eax, byte [ebp + edx - 0x214]
cmp ecx, eax
jne 0x407535
mov dword [ebp - 0x2e4], 0
jmp 0x40759e
push esi
add esi, 0x64e5
add esi, 0x15455
and esi, 0x2990
pop esi
push esi
push edi
add esp, 4
and esi, 0x1227e
pop esi
push edi
push ecx
add esp, 4
and edi, 0x166a8
jmp 0x407566
pop edi
mov ecx, dword [ebp - 0x1a0]
add ecx, dword [ebp - 0x14]
movsx edx, byte [ecx]
or edx, 0x20
mov eax, dword [ebp - 0x14]
movsx ecx, byte [ebp + eax - 0x214]
or ecx, 0x20
cmp edx, ecx
jge 0x407594
mov dword [ebp - 0x2e4], 0xffffffff
jmp 0x40759e
mov dword [ebp - 0x2e4], 1
cmp dword [ebp - 0x2e4], 0
jne 0x4075b5
mov edx, dword [ebp - 0x6ec]
mov dword [ebp - 0xe4], edx
jmp 0x4075c6
jmp 0x4073ca
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0
je 0x40766f
push esi
push ebx
add esp, 4
xor esi, 0x21f
or esi, 0x420
xor esi, 0xd528
sub esi, 0x1687d
pop esi
push eax
sub eax, 0xbcfe
pop eax
push ebx
push edx
add esp, 4
or ebx, 0x8b6e
pop ebx
mov ecx, dword [ebp - 0xe4]
mov dword [ebp - 0x6f0], ecx
mov edx, dword [ebp - 0x6f0]
mov dword [ebp - 0x6f4], edx
lea eax, [ebp - 0x55c]
push eax
call dword [ebp - 0x6f4]
test eax, eax
jne 0x40766f
push eax
xor eax, 0x2c98
call 0x407642
add byte [ecx + 0x35], cl
inc esi
push eax
xor eax, 0xc483393d
add al, 0x81
invalid
Function at 0x407471
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
add esp, 4
pop ecx
push ebx
push ecx
add esp, 4
sub ebx, 0x6417
pop ebx
push edx
or edx, 0x1bf9
or edx, 0x9633
add edx, 0xfdc3
pop edx
mov ecx, dword [ebp - 0x1a0]
add ecx, dword [ebp - 0x14]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x14]
movsx ecx, byte [ebp + eax - 0x214]
cmp edx, ecx
je 0x4074ce
mov edx, dword [ebp - 0x1a0]
add edx, dword [ebp - 0x14]
movsx eax, byte [edx]
xor eax, 0x20
mov ecx, dword [ebp - 0x14]
movsx edx, byte [ebp + ecx - 0x214]
cmp eax, edx
jne 0x4074d5
jmp 0x407437
jmp 0x4074dc
Function at 0x4074f8
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x19c]
add eax, 1
mov dword [ebp - 0x19c], eax
mov ecx, dword [ebp - 0x198]
mov edx, dword [ebp - 0x19c]
cmp edx, dword [ecx + 0x18]
jae 0x4075ba
mov eax, dword [ebp - 0x19c]
mov ecx, dword [ebp - 0x6e0]
mov edx, dword [ebp - 0xbc]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x1a0], edx
mov eax, dword [ebp - 0x19c]
mov ecx, dword [ebp - 0x6e4]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x6e8]
mov ecx, dword [ebp - 0xbc]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x6ec], ecx
mov dword [ebp - 0x14], 0
jmp 0x407440
mov eax, dword [ebp - 0x1a0]
add eax, dword [ebp - 0x14]
movsx ecx, byte [eax]
test ecx, ecx
je 0x4074dc
mov edx, dword [ebp - 0x14]
movsx eax, byte [ebp + edx - 0x214]
test eax, eax
je 0x4074dc
push ecx
call fcn.00407471
add byte [eax + 0x41], dl
cmp al, 0x44
dec edi
inc eax
dec eax
push edi
jmp 0x4074e4
sub edi, 0x6fe7
pop edi
push eax
call 0x4074f8
add byte [eax], bh
dec esp
cmp al, 0x33
add esp, 4
or eax, 0x9b85
and eax, 0x11f3a
xor eax, 0x8254
pop eax
mov eax, dword [ebp - 0x1a0]
add eax, dword [ebp - 0x14]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x14]
movsx eax, byte [ebp + edx - 0x214]
cmp ecx, eax
jne 0x407535
mov dword [ebp - 0x2e4], 0
jmp 0x40759e
push esi
add esi, 0x64e5
add esi, 0x15455
and esi, 0x2990
pop esi
push esi
push edi
add esp, 4
and esi, 0x1227e
pop esi
push edi
push ecx
add esp, 4
and edi, 0x166a8
jmp 0x407566
pop edi
mov ecx, dword [ebp - 0x1a0]
add ecx, dword [ebp - 0x14]
movsx edx, byte [ecx]
or edx, 0x20
mov eax, dword [ebp - 0x14]
movsx ecx, byte [ebp + eax - 0x214]
or ecx, 0x20
cmp edx, ecx
jge 0x407594
mov dword [ebp - 0x2e4], 0xffffffff
jmp 0x40759e
mov dword [ebp - 0x2e4], 1
cmp dword [ebp - 0x2e4], 0
jne 0x4075b5
mov edx, dword [ebp - 0x6ec]
mov dword [ebp - 0xe4], edx
jmp 0x4075c6
jmp 0x4073ca
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0
je 0x40766f
push esi
push ebx
add esp, 4
xor esi, 0x21f
or esi, 0x420
xor esi, 0xd528
sub esi, 0x1687d
pop esi
push eax
sub eax, 0xbcfe
pop eax
push ebx
push edx
add esp, 4
or ebx, 0x8b6e
pop ebx
mov ecx, dword [ebp - 0xe4]
mov dword [ebp - 0x6f0], ecx
mov edx, dword [ebp - 0x6f0]
mov dword [ebp - 0x6f4], edx
lea eax, [ebp - 0x55c]
push eax
call dword [ebp - 0x6f4]
test eax, eax
jne 0x40766f
push eax
xor eax, 0x2c98
call 0x407642
add byte [ecx + 0x35], cl
inc esi
push eax
xor eax, 0xc483393d
add al, 0x81
invalid
Function at 0x407642
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x19c]
add eax, 1
mov dword [ebp - 0x19c], eax
mov ecx, dword [ebp - 0x198]
mov edx, dword [ebp - 0x19c]
cmp edx, dword [ecx + 0x18]
jae 0x4075ba
mov eax, dword [ebp - 0x19c]
mov ecx, dword [ebp - 0x6e0]
mov edx, dword [ebp - 0xbc]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x1a0], edx
mov eax, dword [ebp - 0x19c]
mov ecx, dword [ebp - 0x6e4]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x6e8]
mov ecx, dword [ebp - 0xbc]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x6ec], ecx
mov dword [ebp - 0x14], 0
jmp 0x407440
mov eax, dword [ebp - 0x1a0]
add eax, dword [ebp - 0x14]
movsx ecx, byte [eax]
test ecx, ecx
je 0x4074dc
mov edx, dword [ebp - 0x14]
movsx eax, byte [ebp + edx - 0x214]
test eax, eax
je 0x4074dc
push ecx
call fcn.00407471
add byte [eax + 0x41], dl
cmp al, 0x44
dec edi
inc eax
dec eax
push edi
jmp 0x4074e4
sub edi, 0x6fe7
pop edi
push eax
call 0x4074f8
add byte [eax], bh
dec esp
cmp al, 0x33
add esp, 4
or eax, 0x9b85
and eax, 0x11f3a
xor eax, 0x8254
pop eax
mov eax, dword [ebp - 0x1a0]
add eax, dword [ebp - 0x14]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x14]
movsx eax, byte [ebp + edx - 0x214]
cmp ecx, eax
jne 0x407535
mov dword [ebp - 0x2e4], 0
jmp 0x40759e
push esi
add esi, 0x64e5
add esi, 0x15455
and esi, 0x2990
pop esi
push esi
push edi
add esp, 4
and esi, 0x1227e
pop esi
push edi
push ecx
add esp, 4
and edi, 0x166a8
jmp 0x407566
pop edi
mov ecx, dword [ebp - 0x1a0]
add ecx, dword [ebp - 0x14]
movsx edx, byte [ecx]
or edx, 0x20
mov eax, dword [ebp - 0x14]
movsx ecx, byte [ebp + eax - 0x214]
or ecx, 0x20
cmp edx, ecx
jge 0x407594
mov dword [ebp - 0x2e4], 0xffffffff
jmp 0x40759e
mov dword [ebp - 0x2e4], 1
cmp dword [ebp - 0x2e4], 0
jne 0x4075b5
mov edx, dword [ebp - 0x6ec]
mov dword [ebp - 0xe4], edx
jmp 0x4075c6
jmp 0x4073ca
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0
je 0x40766f
push esi
push ebx
add esp, 4
xor esi, 0x21f
or esi, 0x420
xor esi, 0xd528
sub esi, 0x1687d
pop esi
push eax
sub eax, 0xbcfe
pop eax
push ebx
push edx
add esp, 4
or ebx, 0x8b6e
pop ebx
mov ecx, dword [ebp - 0xe4]
mov dword [ebp - 0x6f0], ecx
mov edx, dword [ebp - 0x6f0]
mov dword [ebp - 0x6f4], edx
lea eax, [ebp - 0x55c]
push eax
call dword [ebp - 0x6f4]
test eax, eax
jne 0x40766f
push eax
xor eax, 0x2c98
call 0x407642
add byte [ecx + 0x35], cl
inc esi
push eax
xor eax, 0xc483393d
add al, 0x81
invalid
Function at 0x407cb0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
add byte [ebx - 0x2f343], al
inc dword [eax]

Function at 0x407d15
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp dword [edi + eax*2 + 0x50], ecx
inc ebp
add esp, 4
pop esi
mov eax, dword [ebp - 0xec]
add eax, 0xe
mov dword [ebp - 0x75c], eax
push ebx
push eax
add esp, 4
call fcn.00407d3c
add byte [eax], al
add byte [ebx + 0x47], cl
xor al, 0x3d
xor edi, dword [esi]
dec ebx
inc ebp
dec ebx

Function at 0x407d30
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
mov eax, dword [ebp - 0x4f0]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x300], edx
push ebx
push ebx
add esp, 4
add ebx, 0x14525
add ebx, 0xc392
xor ebx, 0x10a72
pop ebx
push eax
and eax, 0x1569d
or eax, 0xca0
or eax, 0x154a3
and eax, 0x1546f
pop eax
cmp dword [ebp - 0x300], 0
jne 0x407fb4
mov dword [ebp - 0xac], 0
jmp 0x4081e9
mov eax, dword [ebp - 0x300]
mov dword [ebp - 0x134], eax
Function at 0x407d3c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
sub ebx, 0x12150
sub ebx, 0x2dec
xor ebx, 0x11d81
pop ebx
push ebx
or ebx, 0xca85
pop ebx
cmp dword [ebp - 0xec], 0
je 0x407d6c
cmp dword [ebp - 0x268], 0
jne 0x407db2
push ecx
add ecx, 0x3de1
or ecx, 0x10008
or ecx, 0xd06f
pop ecx
push ebx
push edi
add esp, 4
add ebx, 0x1c15
xor ebx, 0x8dff
and ebx, 0x82ff
sub ebx, 0xa521
pop ebx
mov ecx, dword [ebp - 0x1e0]
and dh, bh
invalid
dec dword [ecx - 0x70f73]
jmp [edx]
call dword [ebp - 0x710]
mov dword [ebp - 0x7a4], 0xa
push edi
xor edi, 0xe701
out 0, eax
add byte [ecx + 0x526dcf], al
add byte [ecx + 0xaef6ef], al
add byte [edi + 0x56], bl
or esi, 0x14ec6
sub esi, 0x12533
call 0x407dea
add byte [edi + ecx*2 + 0x35], al
inc ecx
dec ecx
dec ecx
dec esp
add esp, 4
pop esi
mov edx, dword [ebp - 0xec]
mov al, byte [edx + 0xa]
mov byte [ebp - 0xde], al
mov ecx, dword [ebp - 0x268]
sub ecx, dword [ebp - 0xec]
mov dword [ebp - 0x410], ecx
mov dword [ebp - 0x3f4], 0
push edi
push ebx
add esp, 4
or edi, 0x10063
jmp 0x407e2d
pop edi
push ebx
add ebx, 0xc968
and ebx, 0x11e27
call 0x407e47
add byte [esi + 0x40], cl
dec edx
cmp eax, dword [eax + 0x4f]
add esp, 4
pop ebx
mov byte [ebp - 0x254], 0x56
mov byte [ebp - 0x253], 0x69
mov byte [ebp - 0x252], 0x72
mov byte [ebp - 0x251], 0x74
mov byte [ebp - 0x250], 0x75
mov byte [ebp - 0x24f], 0x61
mov byte [ebp - 0x24e], 0x6c
mov byte [ebp - 0x24d], 0x50
mov byte [ebp - 0x24c], 0x72
mov byte [ebp - 0x24b], 0x6f
outsd dx, dword [esi]
mov byte [ebp - 0x24a], 0x74
mov byte [ebp - 0x249], 0x65
mov byte [ebp - 0x248], 0x63
mov byte [ebp - 0x247], 0x74
mov byte [ebp - 0x246], 0
push eax
push esi
add esp, 4
call 0x407ec8
add byte [ebp + ecx*2 + 0x37], al
dec ebp
dec ebx
inc ebp
cmp al, 0x40
xor eax, dword [ebx + 0x4eb04c4]
cmp ecx, dword [ebx + 0x32]
xor eax, 0x7662c081
add dword [eax], eax
pop eax
push edx
xor edx, 0x55e
xor edx, 0xcc67
pop edx
mov edx, dword fs:[0x18]
mov dword [ebp - 0x714], edx
mov eax, dword [ebp - 0x714]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x718], ecx
mov edx, dword [ebp - 0x718]
mov dword [ebp - 0x4f0], edx
push ebx
or ebx, 0x11ca
call 0x407f22
add byte [edi], bh
cmp dl, byte [eax + 0x3e]
inc eax
inc eax
inc edx
add esp, 4
add ebx, 0xf6e3
pop ebx
push edi
and edi, 0xfcc7
xor edi, 0x10960
and edi, 0x9658
pop edi
cmp dword [ebp - 0x4f0], 0
jne 0x407f58
invalid
test dword [edi + edi*8 - 1], edx
inc dword [eax]
Function at 0x407dc0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
sub ebx, 0x12150
sub ebx, 0x2dec
xor ebx, 0x11d81
pop ebx
push ebx
or ebx, 0xca85
pop ebx
cmp dword [ebp - 0xec], 0
je 0x407d6c
cmp dword [ebp - 0x268], 0
jne 0x407db2
push ecx
add ecx, 0x3de1
or ecx, 0x10008
or ecx, 0xd06f
pop ecx
push ebx
push edi
add esp, 4
add ebx, 0x1c15
xor ebx, 0x8dff
and ebx, 0x82ff
sub ebx, 0xa521
pop ebx
mov ecx, dword [ebp - 0x1e0]
and dh, bh
invalid
dec dword [ecx - 0x70f73]
jmp [edx]
call dword [ebp - 0x710]
mov dword [ebp - 0x7a4], 0xa
push edi
xor edi, 0xe701
out 0, eax
add byte [ecx + 0x526dcf], al
add byte [ecx + 0xaef6ef], al
add byte [edi + 0x56], bl
or esi, 0x14ec6
sub esi, 0x12533
call 0x407dea
add byte [edi + ecx*2 + 0x35], al
inc ecx
dec ecx
dec ecx
dec esp
add esp, 4
pop esi
mov edx, dword [ebp - 0xec]
mov al, byte [edx + 0xa]
mov byte [ebp - 0xde], al
mov ecx, dword [ebp - 0x268]
sub ecx, dword [ebp - 0xec]
mov dword [ebp - 0x410], ecx
mov dword [ebp - 0x3f4], 0
push edi
push ebx
add esp, 4
or edi, 0x10063
jmp 0x407e2d
pop edi
push ebx
add ebx, 0xc968
and ebx, 0x11e27
call 0x407e47
add byte [esi + 0x40], cl
dec edx
cmp eax, dword [eax + 0x4f]
add esp, 4
pop ebx
mov byte [ebp - 0x254], 0x56
mov byte [ebp - 0x253], 0x69
mov byte [ebp - 0x252], 0x72
mov byte [ebp - 0x251], 0x74
mov byte [ebp - 0x250], 0x75
mov byte [ebp - 0x24f], 0x61
mov byte [ebp - 0x24e], 0x6c
mov byte [ebp - 0x24d], 0x50
mov byte [ebp - 0x24c], 0x72
mov byte [ebp - 0x24b], 0x6f
outsd dx, dword [esi]
mov byte [ebp - 0x24a], 0x74
mov byte [ebp - 0x249], 0x65
mov byte [ebp - 0x248], 0x63
mov byte [ebp - 0x247], 0x74
mov byte [ebp - 0x246], 0
push eax
push esi
add esp, 4
call 0x407ec8
add byte [ebp + ecx*2 + 0x37], al
dec ebp
dec ebx
inc ebp
cmp al, 0x40
xor eax, dword [ebx + 0x4eb04c4]
cmp ecx, dword [ebx + 0x32]
xor eax, 0x7662c081
add dword [eax], eax
pop eax
push edx
xor edx, 0x55e
xor edx, 0xcc67
pop edx
mov edx, dword fs:[0x18]
mov dword [ebp - 0x714], edx
mov eax, dword [ebp - 0x714]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x718], ecx
mov edx, dword [ebp - 0x718]
mov dword [ebp - 0x4f0], edx
push ebx
or ebx, 0x11ca
call 0x407f22
add byte [edi], bh
cmp dl, byte [eax + 0x3e]
inc eax
inc eax
inc edx
add esp, 4
add ebx, 0xf6e3
pop ebx
push edi
and edi, 0xfcc7
xor edi, 0x10960
and edi, 0x9658
pop edi
cmp dword [ebp - 0x4f0], 0
jne 0x407f58
invalid
test dword [edi + edi*8 - 1], edx
inc dword [eax]