joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4093b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x417bcc]
jne 0x4093ba
repz ret
jmp fcn.0041298c

Function at 0x40ba0b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x417bcc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00404cb7
and dword [ebp - 0x14], 0
cmp dword [0x4991e4], 0
mov dword [ebp - 0x18], eax
jne 0x40babe
push 0x402adc
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40bb66
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402ad0
push ebx
call edi
test eax, eax
je 0x40bb66
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x402ac0
push ebx
mov dword [0x4991e4], eax
call edi
push eax
call esi
push 0x402aac
push ebx
mov dword [0x4991e8], eax
call edi
push eax
call esi
push 0x402a90
push ebx
mov dword [0x4991ec], eax
call edi
push eax
call esi
mov dword [0x4991f4], eax
test eax, eax
je 0x40babe
push 0x402a78
push ebx
call edi
push eax
call esi
mov dword [0x4991f0], eax
mov eax, dword [0x4991f0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40bb17
cmp dword [0x4991f4], ecx
je 0x40bb17
push eax
call esi
push dword [0x4991f4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40bb17
test ebx, ebx
je 0x40bb17
call edi
test eax, eax
je 0x40bb0e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40bb0e
test byte [ebp - 8], 1
jne 0x40bb17
or dword [ebp + 0x10], 0x200000
jmp 0x40bb4a
mov eax, dword [0x4991e8]
cmp eax, dword [ebp - 0x18]
je 0x40bb4a
push eax
call esi
test eax, eax
je 0x40bb4a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40bb4a
mov eax, dword [0x4991ec]
cmp eax, dword [ebp - 0x18]
je 0x40bb4a
push eax
call esi
test eax, eax
je 0x40bb4a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4991e4]
call esi
test eax, eax
je 0x40bb66
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40bb68
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004093b0
leave
ret

Function at 0x414710
Capabilities:
Delete file
Get uefi variable

Disassembly:
sub esp, 0xc18
cmp dword [0x2bc2d3c], 0x37
jne 0x414778
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessId]
push 0
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
push 0
lea eax, [esp + 0x1c]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFirmwareEnvironmentVariableW]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0xc]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
push 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0
lea eax, [esp + 0x41c]
push eax
push 0x403418
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
mov ecx, dword [0x2bc3150]
mov eax, dword [0x2bc2820]
mov dl, byte [ecx + esi + 0x38d6]
mov byte [eax + esi], dl
add esp, 0xc18
ret
Function at 0x4068fb
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x40691f
xor eax, eax
test eax, eax
je 0x406932
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x406932
xor ecx, ecx
jmp 0x406935
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406a58
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43110c], 0
push esi
jne 0x406a8f
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406a69
mov dword [ecx*4 + 0x431108], eax
inc ecx
cmp ecx, 0x100
jl 0x406a64
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406ac0
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431108]
xor eax, esi
inc ecx
dec edx
jne 0x406aa2
pop edi
not eax
pop esi
ret 0xc

Function at 0x5ea325
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x5ea340
add esi, 0x1000
lea eax, [ebp - 0x2bc]
push edx
push 0x1c
push eax
push esi
call dword [edx + 0x124af565]
pop edx
test eax, eax
je 0x5ea412
cmp dword [ebp - 0x2ac], 0x1000
jne 0x5ea401
test dword [ebp - 0x2a8], 1
jne 0x5ea401
and dword [ebp - 0x2a8], 0x100
jne 0x5ea401
push esi
push edx
push 4
push esi
call dword [edx + 0x122d2edf]
pop edx
pop esi
test eax, eax
je 0x5ea3a4
jmp 0x5ea401
cmp word [esi], 0x5a4d
jne 0x5ea401
mov eax, esi
push ebx
mov ebx, dword [esi + 0x3c]
add eax, ebx
pop ebx
cmp dword [eax], 0x4550
jne 0x5ea401
lea eax, [ebp - 0x28c]
push edx
push 0x28a
push eax
push esi
call dword [edx + 0x122d2fcf]
pop edx
test eax, eax
je 0x5ea401
lea eax, [ebp - 0x28c]
push eax
call fcn.005ea281
test eax, eax
jne 0x5ea3fa
jmp 0x5ea401
mov eax, esi
jmp 0x5ea412
mov esi, dword [ebp - 0x2b0]
add esi, dword [ebp - 0x2bc]
jmp 0x5ea340
pop esi
leave
ret 4
Function at 0x406624
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x406648
xor eax, eax
test eax, eax
je 0x40665b
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x40665b
xor ecx, ecx
jmp 0x40665e
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406787
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4698ec], 0
push esi
jne 0x4067be
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406798
mov dword [ecx*4 + 0x4698e8], eax
inc ecx
cmp ecx, 0x100
jl 0x406793
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4067ef
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4698e8]
xor eax, esi
inc ecx
dec edx
jne 0x4067d1
pop edi
not eax
pop esi
ret 0xc

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call
Read file on windows

Disassembly:
push ebx
push esi
mov ebx, 0x10003028
xor esi, esi
push edi
cmp ebx, 0x10002034
jne 0x1000116a
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov word [0x1000302e], ax
movzx ecx, word [eax + 0x10002038]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, si
jne 0x10001172
push 1
push esi
push esi
push ebx
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov word [0x1000302e], ax
movzx ecx, word [eax + 0x1000203c]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, si
jne 0x1000119d
push 0x40
mov eax, 0x1000
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x10003018], eax
lea edi, [ebx - 2]
mov ax, word [edi + 2]
add edi, 2
cmp ax, si
jne 0x100011cb
push 5
pop ecx
mov esi, str.sktop.ini
rep movsd dword es:[edi], dword [esi]
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000301c], eax
cmp eax, 0xffffffff
je 0x10001222
push esi
push 0x10003020
push 0x1000
push dword [0x10003018]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [0x10003018]
pop edi
pop esi
pop ebx
ret 0x10
Function at 0x401034
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe0
movzx eax, word [ebp + 8]
push esi
push edi
push eax
mov edi, ecx
push dword [0x4570f4]
mov dword [ebp - 0x30], edi
call dword [ebp - 0x75]
push ebp
mov ebp, esp
sub esp, 0x1fbc
push ebx
push esi
push edi
push ebx
push esi
add esp, 4
sub ebx, 0xc7e8
sub ebx, 0x7c42
call fcn.0040107c
add byte [ebp + 0x36], al
dec edx
inc ebx
dec eax
dec edx
inc edx
xor eax, 0x4c4834f
add esp, 4

Function at 0x401050
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe0
movzx eax, word [ebp + 8]
push esi
push edi
push eax
mov edi, ecx
push dword [0x4570f4]
mov dword [ebp - 0x30], edi
call dword [ebp - 0x75]
push ebp
mov ebp, esp
sub esp, 0x1fbc
push ebx
push esi
push edi
push ebx
push esi
add esp, 4
sub ebx, 0xc7e8
sub ebx, 0x7c42
call fcn.0040107c
add byte [ebp + 0x36], al
dec edx
inc ebx
dec eax
dec edx
inc edx
xor eax, 0x4c4834f
add esp, 4
Function at 0x404945
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x4cc]
add edx, 1
mov dword [ebp - 0x4cc], edx
push edi
jmp 0x40491e
pop edi
push ebx
push eax
add esp, 4
sub ebx, 0x17dd3
jmp 0x404933
jmp 0x404939
call 0x404945
add byte [esi + eax*2], bh
inc esi
inc esi
xor eax, 0x4c48332
pop ebx
mov eax, dword [ebp - 0x4cc]
sub eax, dword [ebp - 0x3c0]
cmp eax, 0xffffffff
jb 0x404991
push eax
call fcn.00404969
add byte [ebx + 0x33], cl
cmp cl, byte [eax + 0x4b]
cmp bh, byte [esi]
cmp al, byte [ebx + 0x535804c4]
add esp, 4
pop eax
push ebx
mov dword [ebp - 0xc08], 7
mov ecx, dword [ebp - 0x4cc]
mov dword [ebp - 0xa68], ecx
push esi
or esi, 0xf725
and esi, 0x83db
and esi, 0x1069a
pop esi
push eax
push ebx
add esp, 4
sub eax, 0xcf05
and eax, 0x4fb2
sub eax, 0x1ce9
sub eax, 0xc635
pop eax
mov edx, dword [ebp - 0x14bc]
mov dword [ebp - 0xa64], edx
mov dword [ebp - 0xc0c], 0
mov eax, dword [ebp - 0x4cc]
cmp eax, dword [ebp - 0x14bc]
jne 0x404a40
push ecx
add ecx, 0xa0a9
or ecx, 0x55b1
and ecx, 0x17560
pop ecx
push esi
push edi
add esp, 4
add esi, 0x7085
pop esi
push eax
push ebx
add esp, 4
or eax, 0x14759
add eax, 0x3e2d
pop eax
mov ecx, dword [ebp - 0xc0c]
mov dword [ebp - 0x14c4], ecx
jmp 0x404b71
cmp dword [ebp - 0xc08], 0
jle 0x404b65
push ecx
and ecx, 0x18371
and ecx, 0xecf0
or ecx, 0x15aee
pop ecx
push esi
and esi, 0xc1d5
jmp 0x404a6d
call fcn.00404a7b
add byte [edi], dh
aaa
inc edi
inc esp
cmp eax, dword [edx + 0x3d]
add esp, 4
pop esi
mov edx, dword [ebp - 0xa68]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0xa64]
movzx edx, byte [ecx]
cmp eax, edx
je 0x404b01
push edx
call 0x404aa5
add byte [esi + esi + 0x4d], cl
inc ecx
dec esp
inc eax
xor al, 0x43
aas
add esp, 4
sub edx, 0x4255
call 0x404abd
add byte [ebx], dh
cmp al, byte ss:[ebx + 0x49]
dec ebx
inc edx
cmp dword [ebx], esi
add esp, 4
or edx, 0x154d0
pop edx
mov eax, dword [ebp - 0xa68]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0xa64]
movzx eax, byte [edx]
cmp ecx, eax
jle 0x404ae9
mov dword [ebp - 0x14c0], 1
jmp 0x404af3
mov dword [ebp - 0x14c0], 0xffffffff
mov ecx, dword [ebp - 0x14c0]
mov dword [ebp - 0xc0c], ecx
jmp 0x404b65
push esi
add esi, 0x141b9
jmp 0x404b11
or esi, 0xbcca
call 0x404b27
add byte [eax + 0x40], cl
dec edx
dec ebx
aas
cmp al, 0x32
cmp bh, byte [edx]
cmp al, byte [ebx + 0x505e04c4]
xor eax, 0xb7d2
pop eax
mov edx, dword [ebp - 0xc08]
sub edx, 1
mov dword [ebp - 0xc08], edx
mov eax, dword [ebp - 0xa68]
add eax, 1
mov dword [ebp - 0xa68], eax
mov ecx, dword [ebp - 0xa64]
add ecx, 1
mov dword [ebp - 0xa64], ecx
jmp 0x404a40
mov edx, dword [ebp - 0xc0c]
mov dword [ebp - 0x14c4], edx
cmp dword [ebp - 0x14c4], 0
jne 0x404bba
push esi
or esi, 0xe6fa
pop esi
push edi
push edi
add esp, 4
add edi, 0xa5f5
add edi, 0x5410
and edi, 0x146d9
pop edi
push edi
push eax
add esp, 4
xor edi, 0x548c
xor edi, 0x399d
pop edi
mov eax, dword [ebp - 0x4cc]
mov dword [ebp - 0x3cc], eax
jmp 0x404bfb
jmp 0x404908
Function at 0x404a7b
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x4cc]
add edx, 1
mov dword [ebp - 0x4cc], edx
push edi
jmp 0x40491e
pop edi
push ebx
push eax
add esp, 4
sub ebx, 0x17dd3
jmp 0x404933
jmp 0x404939
call 0x404945
add byte [esi + eax*2], bh
inc esi
inc esi
xor eax, 0x4c48332
pop ebx
mov eax, dword [ebp - 0x4cc]
sub eax, dword [ebp - 0x3c0]
cmp eax, 0xffffffff
jb 0x404991
push eax
call fcn.00404969
add byte [ebx + 0x33], cl
cmp cl, byte [eax + 0x4b]
cmp bh, byte [esi]
cmp al, byte [ebx + 0x535804c4]
add esp, 4
pop eax
push ebx
mov dword [ebp - 0xc08], 7
mov ecx, dword [ebp - 0x4cc]
mov dword [ebp - 0xa68], ecx
push esi
or esi, 0xf725
and esi, 0x83db
and esi, 0x1069a
pop esi
push eax
push ebx
add esp, 4
sub eax, 0xcf05
and eax, 0x4fb2
sub eax, 0x1ce9
sub eax, 0xc635
pop eax
mov edx, dword [ebp - 0x14bc]
mov dword [ebp - 0xa64], edx
mov dword [ebp - 0xc0c], 0
mov eax, dword [ebp - 0x4cc]
cmp eax, dword [ebp - 0x14bc]
jne 0x404a40
push ecx
add ecx, 0xa0a9
or ecx, 0x55b1
and ecx, 0x17560
pop ecx
push esi
push edi
add esp, 4
add esi, 0x7085
pop esi
push eax
push ebx
add esp, 4
or eax, 0x14759
add eax, 0x3e2d
pop eax
mov ecx, dword [ebp - 0xc0c]
mov dword [ebp - 0x14c4], ecx
jmp 0x404b71
cmp dword [ebp - 0xc08], 0
jle 0x404b65
push ecx
and ecx, 0x18371
and ecx, 0xecf0
or ecx, 0x15aee
pop ecx
push esi
and esi, 0xc1d5
jmp 0x404a6d
call fcn.00404a7b
add byte [edi], dh
aaa
inc edi
inc esp
cmp eax, dword [edx + 0x3d]
add esp, 4
pop esi
mov edx, dword [ebp - 0xa68]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0xa64]
movzx edx, byte [ecx]
cmp eax, edx
je 0x404b01
push edx
call 0x404aa5
add byte [esi + esi + 0x4d], cl
inc ecx
dec esp
inc eax
xor al, 0x43
aas
add esp, 4
sub edx, 0x4255
call 0x404abd
add byte [ebx], dh
cmp al, byte ss:[ebx + 0x49]
dec ebx
inc edx
cmp dword [ebx], esi
add esp, 4
or edx, 0x154d0
pop edx
mov eax, dword [ebp - 0xa68]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0xa64]
movzx eax, byte [edx]
cmp ecx, eax
jle 0x404ae9
mov dword [ebp - 0x14c0], 1
jmp 0x404af3
mov dword [ebp - 0x14c0], 0xffffffff
mov ecx, dword [ebp - 0x14c0]
mov dword [ebp - 0xc0c], ecx
jmp 0x404b65
push esi
add esi, 0x141b9
jmp 0x404b11
or esi, 0xbcca
call 0x404b27
add byte [eax + 0x40], cl
dec edx
dec ebx
aas
cmp al, 0x32
cmp bh, byte [edx]
cmp al, byte [ebx + 0x505e04c4]
xor eax, 0xb7d2
pop eax
mov edx, dword [ebp - 0xc08]
sub edx, 1
mov dword [ebp - 0xc08], edx
mov eax, dword [ebp - 0xa68]
add eax, 1
mov dword [ebp - 0xa68], eax
mov ecx, dword [ebp - 0xa64]
add ecx, 1
mov dword [ebp - 0xa64], ecx
jmp 0x404a40
mov edx, dword [ebp - 0xc0c]
mov dword [ebp - 0x14c4], edx
cmp dword [ebp - 0x14c4], 0
jne 0x404bba
push esi
or esi, 0xe6fa
pop esi
push edi
push edi
add esp, 4
add edi, 0xa5f5
add edi, 0x5410
and edi, 0x146d9
pop edi
push edi
push eax
add esp, 4
xor edi, 0x548c
xor edi, 0x399d
pop edi
mov eax, dword [ebp - 0x4cc]
mov dword [ebp - 0x3cc], eax
jmp 0x404bfb
jmp 0x404908
Function at 0x404aa5
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x4cc]
add edx, 1
mov dword [ebp - 0x4cc], edx
push edi
jmp 0x40491e
pop edi
push ebx
push eax
add esp, 4
sub ebx, 0x17dd3
jmp 0x404933
jmp 0x404939
call 0x404945
add byte [esi + eax*2], bh
inc esi
inc esi
xor eax, 0x4c48332
pop ebx
mov eax, dword [ebp - 0x4cc]
sub eax, dword [ebp - 0x3c0]
cmp eax, 0xffffffff
jb 0x404991
push eax
call fcn.00404969
add byte [ebx + 0x33], cl
cmp cl, byte [eax + 0x4b]
cmp bh, byte [esi]
cmp al, byte [ebx + 0x535804c4]
add esp, 4
pop eax
push ebx
mov dword [ebp - 0xc08], 7
mov ecx, dword [ebp - 0x4cc]
mov dword [ebp - 0xa68], ecx
push esi
or esi, 0xf725
and esi, 0x83db
and esi, 0x1069a
pop esi
push eax
push ebx
add esp, 4
sub eax, 0xcf05
and eax, 0x4fb2
sub eax, 0x1ce9
sub eax, 0xc635
pop eax
mov edx, dword [ebp - 0x14bc]
mov dword [ebp - 0xa64], edx
mov dword [ebp - 0xc0c], 0
mov eax, dword [ebp - 0x4cc]
cmp eax, dword [ebp - 0x14bc]
jne 0x404a40
push ecx
add ecx, 0xa0a9
or ecx, 0x55b1
and ecx, 0x17560
pop ecx
push esi
push edi
add esp, 4
add esi, 0x7085
pop esi
push eax
push ebx
add esp, 4
or eax, 0x14759
add eax, 0x3e2d
pop eax
mov ecx, dword [ebp - 0xc0c]
mov dword [ebp - 0x14c4], ecx
jmp 0x404b71
cmp dword [ebp - 0xc08], 0
jle 0x404b65
push ecx
and ecx, 0x18371
and ecx, 0xecf0
or ecx, 0x15aee
pop ecx
push esi
and esi, 0xc1d5
jmp 0x404a6d
call fcn.00404a7b
add byte [edi], dh
aaa
inc edi
inc esp
cmp eax, dword [edx + 0x3d]
add esp, 4
pop esi
mov edx, dword [ebp - 0xa68]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0xa64]
movzx edx, byte [ecx]
cmp eax, edx
je 0x404b01
push edx
call 0x404aa5
add byte [esi + esi + 0x4d], cl
inc ecx
dec esp
inc eax
xor al, 0x43
aas
add esp, 4
sub edx, 0x4255
call 0x404abd
add byte [ebx], dh
cmp al, byte ss:[ebx + 0x49]
dec ebx
inc edx
cmp dword [ebx], esi
add esp, 4
or edx, 0x154d0
pop edx
mov eax, dword [ebp - 0xa68]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0xa64]
movzx eax, byte [edx]
cmp ecx, eax
jle 0x404ae9
mov dword [ebp - 0x14c0], 1
jmp 0x404af3
mov dword [ebp - 0x14c0], 0xffffffff
mov ecx, dword [ebp - 0x14c0]
mov dword [ebp - 0xc0c], ecx
jmp 0x404b65
push esi
add esi, 0x141b9
jmp 0x404b11
or esi, 0xbcca
call 0x404b27
add byte [eax + 0x40], cl
dec edx
dec ebx
aas
cmp al, 0x32
cmp bh, byte [edx]
cmp al, byte [ebx + 0x505e04c4]
xor eax, 0xb7d2
pop eax
mov edx, dword [ebp - 0xc08]
sub edx, 1
mov dword [ebp - 0xc08], edx
mov eax, dword [ebp - 0xa68]
add eax, 1
mov dword [ebp - 0xa68], eax
mov ecx, dword [ebp - 0xa64]
add ecx, 1
mov dword [ebp - 0xa64], ecx
jmp 0x404a40
mov edx, dword [ebp - 0xc0c]
mov dword [ebp - 0x14c4], edx
cmp dword [ebp - 0x14c4], 0
jne 0x404bba
push esi
or esi, 0xe6fa
pop esi
push edi
push edi
add esp, 4
add edi, 0xa5f5
add edi, 0x5410
and edi, 0x146d9
pop edi
push edi
push eax
add esp, 4
xor edi, 0x548c
xor edi, 0x399d
pop edi
mov eax, dword [ebp - 0x4cc]
mov dword [ebp - 0x3cc], eax
jmp 0x404bfb
jmp 0x404908
Function at 0x404abd
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x4cc]
add edx, 1
mov dword [ebp - 0x4cc], edx
push edi
jmp 0x40491e
pop edi
push ebx
push eax
add esp, 4
sub ebx, 0x17dd3
jmp 0x404933
jmp 0x404939
call 0x404945
add byte [esi + eax*2], bh
inc esi
inc esi
xor eax, 0x4c48332
pop ebx
mov eax, dword [ebp - 0x4cc]
sub eax, dword [ebp - 0x3c0]
cmp eax, 0xffffffff
jb 0x404991
push eax
call fcn.00404969
add byte [ebx + 0x33], cl
cmp cl, byte [eax + 0x4b]
cmp bh, byte [esi]
cmp al, byte [ebx + 0x535804c4]
add esp, 4
pop eax
push ebx
mov dword [ebp - 0xc08], 7
mov ecx, dword [ebp - 0x4cc]
mov dword [ebp - 0xa68], ecx
push esi
or esi, 0xf725
and esi, 0x83db
and esi, 0x1069a
pop esi
push eax
push ebx
add esp, 4
sub eax, 0xcf05
and eax, 0x4fb2
sub eax, 0x1ce9
sub eax, 0xc635
pop eax
mov edx, dword [ebp - 0x14bc]
mov dword [ebp - 0xa64], edx
mov dword [ebp - 0xc0c], 0
mov eax, dword [ebp - 0x4cc]
cmp eax, dword [ebp - 0x14bc]
jne 0x404a40
push ecx
add ecx, 0xa0a9
or ecx, 0x55b1
and ecx, 0x17560
pop ecx
push esi
push edi
add esp, 4
add esi, 0x7085
pop esi
push eax
push ebx
add esp, 4
or eax, 0x14759
add eax, 0x3e2d
pop eax
mov ecx, dword [ebp - 0xc0c]
mov dword [ebp - 0x14c4], ecx
jmp 0x404b71
cmp dword [ebp - 0xc08], 0
jle 0x404b65
push ecx
and ecx, 0x18371
and ecx, 0xecf0
or ecx, 0x15aee
pop ecx
push esi
and esi, 0xc1d5
jmp 0x404a6d
call fcn.00404a7b
add byte [edi], dh
aaa
inc edi
inc esp
cmp eax, dword [edx + 0x3d]
add esp, 4
pop esi
mov edx, dword [ebp - 0xa68]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0xa64]
movzx edx, byte [ecx]
cmp eax, edx
je 0x404b01
push edx
call 0x404aa5
add byte [esi + esi + 0x4d], cl
inc ecx
dec esp
inc eax
xor al, 0x43
aas
add esp, 4
sub edx, 0x4255
call 0x404abd
add byte [ebx], dh
cmp al, byte ss:[ebx + 0x49]
dec ebx
inc edx
cmp dword [ebx], esi
add esp, 4
or edx, 0x154d0
pop edx
mov eax, dword [ebp - 0xa68]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0xa64]
movzx eax, byte [edx]
cmp ecx, eax
jle 0x404ae9
mov dword [ebp - 0x14c0], 1
jmp 0x404af3
mov dword [ebp - 0x14c0], 0xffffffff
mov ecx, dword [ebp - 0x14c0]
mov dword [ebp - 0xc0c], ecx
jmp 0x404b65
push esi
add esi, 0x141b9
jmp 0x404b11
or esi, 0xbcca
call 0x404b27
add byte [eax + 0x40], cl
dec edx
dec ebx
aas
cmp al, 0x32
cmp bh, byte [edx]
cmp al, byte [ebx + 0x505e04c4]
xor eax, 0xb7d2
pop eax
mov edx, dword [ebp - 0xc08]
sub edx, 1
mov dword [ebp - 0xc08], edx
mov eax, dword [ebp - 0xa68]
add eax, 1
mov dword [ebp - 0xa68], eax
mov ecx, dword [ebp - 0xa64]
add ecx, 1
mov dword [ebp - 0xa64], ecx
jmp 0x404a40
mov edx, dword [ebp - 0xc0c]
mov dword [ebp - 0x14c4], edx
cmp dword [ebp - 0x14c4], 0
jne 0x404bba
push esi
or esi, 0xe6fa
pop esi
push edi
push edi
add esp, 4
add edi, 0xa5f5
add edi, 0x5410
and edi, 0x146d9
pop edi
push edi
push eax
add esp, 4
xor edi, 0x548c
xor edi, 0x399d
pop edi
mov eax, dword [ebp - 0x4cc]
mov dword [ebp - 0x3cc], eax
jmp 0x404bfb
jmp 0x404908
Function at 0x404b27
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x4cc]
add edx, 1
mov dword [ebp - 0x4cc], edx
push edi
jmp 0x40491e
pop edi
push ebx
push eax
add esp, 4
sub ebx, 0x17dd3
jmp 0x404933
jmp 0x404939
call 0x404945
add byte [esi + eax*2], bh
inc esi
inc esi
xor eax, 0x4c48332
pop ebx
mov eax, dword [ebp - 0x4cc]
sub eax, dword [ebp - 0x3c0]
cmp eax, 0xffffffff
jb 0x404991
push eax
call fcn.00404969
add byte [ebx + 0x33], cl
cmp cl, byte [eax + 0x4b]
cmp bh, byte [esi]
cmp al, byte [ebx + 0x535804c4]
add esp, 4
pop eax
push ebx
mov dword [ebp - 0xc08], 7
mov ecx, dword [ebp - 0x4cc]
mov dword [ebp - 0xa68], ecx
push esi
or esi, 0xf725
and esi, 0x83db
and esi, 0x1069a
pop esi
push eax
push ebx
add esp, 4
sub eax, 0xcf05
and eax, 0x4fb2
sub eax, 0x1ce9
sub eax, 0xc635
pop eax
mov edx, dword [ebp - 0x14bc]
mov dword [ebp - 0xa64], edx
mov dword [ebp - 0xc0c], 0
mov eax, dword [ebp - 0x4cc]
cmp eax, dword [ebp - 0x14bc]
jne 0x404a40
push ecx
add ecx, 0xa0a9
or ecx, 0x55b1
and ecx, 0x17560
pop ecx
push esi
push edi
add esp, 4
add esi, 0x7085
pop esi
push eax
push ebx
add esp, 4
or eax, 0x14759
add eax, 0x3e2d
pop eax
mov ecx, dword [ebp - 0xc0c]
mov dword [ebp - 0x14c4], ecx
jmp 0x404b71
cmp dword [ebp - 0xc08], 0
jle 0x404b65
push ecx
and ecx, 0x18371
and ecx, 0xecf0
or ecx, 0x15aee
pop ecx
push esi
and esi, 0xc1d5
jmp 0x404a6d
call fcn.00404a7b
add byte [edi], dh
aaa
inc edi
inc esp
cmp eax, dword [edx + 0x3d]
add esp, 4
pop esi
mov edx, dword [ebp - 0xa68]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0xa64]
movzx edx, byte [ecx]
cmp eax, edx
je 0x404b01
push edx
call 0x404aa5
add byte [esi + esi + 0x4d], cl
inc ecx
dec esp
inc eax
xor al, 0x43
aas
add esp, 4
sub edx, 0x4255
call 0x404abd
add byte [ebx], dh
cmp al, byte ss:[ebx + 0x49]
dec ebx
inc edx
cmp dword [ebx], esi
add esp, 4
or edx, 0x154d0
pop edx
mov eax, dword [ebp - 0xa68]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0xa64]
movzx eax, byte [edx]
cmp ecx, eax
jle 0x404ae9
mov dword [ebp - 0x14c0], 1
jmp 0x404af3
mov dword [ebp - 0x14c0], 0xffffffff
mov ecx, dword [ebp - 0x14c0]
mov dword [ebp - 0xc0c], ecx
jmp 0x404b65
push esi
add esi, 0x141b9
jmp 0x404b11
or esi, 0xbcca
call 0x404b27
add byte [eax + 0x40], cl
dec edx
dec ebx
aas
cmp al, 0x32
cmp bh, byte [edx]
cmp al, byte [ebx + 0x505e04c4]
xor eax, 0xb7d2
pop eax
mov edx, dword [ebp - 0xc08]
sub edx, 1
mov dword [ebp - 0xc08], edx
mov eax, dword [ebp - 0xa68]
add eax, 1
mov dword [ebp - 0xa68], eax
mov ecx, dword [ebp - 0xa64]
add ecx, 1
mov dword [ebp - 0xa64], ecx
jmp 0x404a40
mov edx, dword [ebp - 0xc0c]
mov dword [ebp - 0x14c4], edx
cmp dword [ebp - 0x14c4], 0
jne 0x404bba
push esi
or esi, 0xe6fa
pop esi
push edi
push edi
add esp, 4
add edi, 0xa5f5
add edi, 0x5410
and edi, 0x146d9
pop edi
push edi
push eax
add esp, 4
xor edi, 0x548c
xor edi, 0x399d
pop edi
mov eax, dword [ebp - 0x4cc]
mov dword [ebp - 0x3cc], eax
jmp 0x404bfb
jmp 0x404908