joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1016629f
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov edi, 0x1769
mov dword [0x1017db20], 0
mov byte [0x1017db24], 0
mov dword [0x1017db14], 0x1769
mov dword [0x1017db1c], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], edi
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
add eax, 0xffffe280
mov dword [0x1017db14], eax
mov eax, ecx
mov dl, al
mov eax, dword [ebp - 0x18]
mov byte [eax + ecx], dl
mov ecx, dword [0x1017db14]
mov esi, ecx
add esi, 0xfffff237
mov dword [0x1017db18], esi
mov esi, dword [0x1017db1c]
add esi, 1
mov dword [0x1017db1c], esi
cmp esi, 0x100
mov edi, ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], edi
jl 0x101662ec
xor eax, eax
mov ecx, dword [ebp - 0x24]
add ecx, 0xffffe7c2
mov dword [0x1017db14], ecx
mov dword [0x1017db1c], 0
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov ecx, 0x100
mov dword [0x1017db28], 0
mov dword [0x1017db18], 0x2161
mov edx, dword [0x1017db20]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + eax]
add edi, edx
mov dword [ebp - 0x2c], eax
xor edx, edx
mov ebx, dword [ebp - 0x10]
div ebx
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add edi, edx
mov dword [0x1017db28], edi
mov eax, edi
cdq
idiv ecx
mov dword [0x1017db20], edx
mov dword [0x1017db14], 0x2438
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x2c]
mov cl, byte [ecx + edi]
mov byte [0x1017db24], cl
mov dword [0x1017db14], 0x1cf5
mov ecx, dword [ebp - 0x18]
mov cl, byte [ecx + edx]
mov edx, dword [ebp - 0x18]
mov byte [edx + edi], cl
mov cl, byte [0x1017db24]
mov edx, dword [0x1017db20]
mov esi, dword [ebp - 0x18]
mov byte [esi + edx], cl
mov dword [0x1017db14], 0x1799
mov edx, dword [0x1017db1c]
add edx, 1
mov dword [0x1017db1c], edx
cmp edx, 0x100
mov dword [ebp - 0x28], edx
jl 0x1016635d
mov dword [0x1017db14], 0x27cb
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10166ba8
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [0x1017db14], 0x13
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
mov cl, byte [eax + 0x1016965e]
mov dl, byte [eax + 0x1016962f]
sub dl, cl
mov byte [ebp + eax - 0x20], dl
add eax, 1
cmp eax, 0xe
mov dword [ebp - 0x2c], eax
jne 0x10166bc9
lea eax, [ebp - 0x20]
mov dword [0x1017db18], 0x1499
mov dword [0x1017db14], 0x11f8
mov dword [ebp - 0x30], eax
call fcn.101661d5
mov dword [esp], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 4], eax
call fcn.10165cd5
mov dword [0x1017db14], 0x23c5
cmp eax, 0
sete cl
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x35], cl
xor eax, eax
mov cl, byte [ebp - 0x35]
test cl, 1
mov dword [ebp - 0x3c], eax
jne 0x10166d09
jmp 0x10166c48
mov eax, dword [ebp - 0x34]
mov dword [0x1017db18], 0x185a
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov ecx, dword [0x1017db14]
add ecx, 0xfffff955
mov dword [0x1017db14], ecx
mov dword [esp], eax
mov ecx, dword [ebp - 0x24]
mov dword [esp + 4], ecx
mov dword [ebp - 0x40], eax
call fcn.10166a88
mov eax, dword [ebp - 0x40]
mov word [eax], 0x5a4d
xor eax, eax
mov ecx, dword [ebp - 0x40]
mov dword [ecx + 0x3c], 0xd0
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x28]
mov dword [edx + 0x5c], ecx
mov ecx, dword [ebp - 0x40]
mov dword [edx + 0x18], ecx
mov dword [0x1017db14], 0xfffff3db
mov dword [0x1017db18], 0x9c
cmp ecx, 0
mov dword [ebp - 0x3c], eax
je 0x10166d09
mov eax, dword [ebp - 0x40]
add eax, 0x1c4d
mov dword [0x1017db18], 0x1744
mov dword [0x1017db14], 0x1b4
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
add esp, 0x50
pop ebp
ret
Function at 0x1016704a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov ebx, dword [0x1017db18]
mov dword [0x1017db1c], 0
mov dword [0x1017db20], 0
mov dword [0x1017db2c], 0
mov dword [0x1017db14], 0xa9f
cmp eax, 0
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov eax, edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], ebx
je 0x101671d5
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov esi, 0x100
add edx, 1
mov dword [0x1017db14], 0x1b0a
mov edi, eax
add edi, 1
mov dword [ebp - 0x30], eax
mov eax, edx
cdq
idiv esi
mov dword [0x1017db1c], edx
mov ebx, dword [ebp - 0x24]
movzx ebx, byte [ebx + edx]
add ebx, ecx
mov eax, ebx
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x1017db20], edx
mov ecx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x1017db24], cl
mov dword [0x1017db14], 0x1ba7
mov ebx, dword [ebp - 0x24]
mov cl, byte [ebx + edx]
mov byte [ebx + esi], cl
mov cl, byte [0x1017db24]
mov edx, dword [0x1017db20]
mov byte [ebx + edx], cl
mov dword [0x1017db14], 0x25da
mov edx, dword [0x1017db1c]
movzx edx, byte [ebx + edx]
mov ecx, dword [0x1017db20]
movzx ecx, byte [ebx + ecx]
add ecx, edx
and ecx, 0xff
mov dword [0x1017db2c], ecx
mov dword [0x1017db14], 0x4df
mov cl, byte [ebx + ecx]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x30]
mov ch, byte [edx + esi]
mov byte [0x1017db31], ch
mov byte [0x1017db32], cl
xor ch, cl
mov byte [0x1017db30], ch
mov dword [0x1017db18], 0xd0
mov edx, dword [ebp - 0x20]
mov byte [edx + esi], ch
mov edx, dword [0x1017db18]
mov esi, edx
add esi, 0xffffe557
mov dword [0x1017db14], esi
mov esi, dword [ebp - 0x10]
cmp edi, esi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x2c], edx
je 0x101671d5
mov eax, dword [0x1017db1c]
mov ecx, dword [0x1017db20]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x28], edx
jmp 0x101670b6
mov eax, dword [ebp - 0x2c]
add eax, 0xffffe56e
mov dword [0x1017db14], eax
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x101671ea
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x98
mov eax, dword [0x1017db18]
add eax, 0x1601
mov dword [0x1017db18], eax
call fcn.10001092
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x24], ecx
jne 0x10167362
lea eax, [esp + 0x28]
lea ecx, [esp + 0x38]
mov dword [0x1017db14], 0x3bb
mov dword [esp], eax
mov dword [esp + 0x20], ecx
call fcn.10166795
lea ecx, [0x101660e5]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x88], edx
mov dword [esp + 0x40], 0x140200
mov edx, dword [0x1017db00]
mov dword [esp + 0x44], edx
mov edx, dword [0x1017db04]
mov dword [esp + 0x8c], edx
mov edx, dword [0x1017db08]
mov dword [esp + 0x38], edx
mov edx, dword [0x1017db0c]
mov dword [esp + 0x70], edx
mov edx, dword [0x1017db10]
mov dword [esp + 0x68], edx
mov dword [0x1017db18], 0xc9d
mov dword [0x1017db14], 0xc7
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x18]
cmp word [eax], 0x5a4d
mov dword [esp + 0x14], eax
jne 0x101672c6
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0x10], ecx
je 0x101672da
mov eax, dword [esp + 0x14]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x18], eax
jmp 0x101672a3
mov eax, dword [esp + 0x14]
mov dword [esp + 0x4c], eax
mov dword [0x1017db18], 0x83d
mov ecx, dword [esp + 0x10]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0x5c], edx
mov dword [0x1017db14], 0x5f1
call fcn.10165b6a
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0xc], ecx
jne 0x1016735a
lea eax, [esp + 0x38]
mov dword [0x1017db18], 0x17ac
mov ecx, dword [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.10166ba8
mov ecx, esp
lea edx, [esp + 0x38]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov ecx, dword [0x1017db14]
add ecx, 0x122d
mov dword [0x1017db14], ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov esp, ebp
pop ebp
ret
Function at 0x401340
Capabilities:
Get file system object information
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x4f1eac
mov eax, dword fs:[0]
push eax
sub esp, 0x2bc
mov eax, dword [0x52e028]
xor eax, esp
mov dword [esp + 0x2b8], eax
push esi
mov eax, dword [0x52e028]
xor eax, esp
push eax
lea eax, [esp + 0x2c4]
mov dword fs:[0], eax
lea ecx, [esp + 8]
call dword [0x4fff58]
mov dword [esp + 0x2cc], 0
push 0x104
push 0x104
lea ecx, [esp + 0x10]
call dword [0x4fff30]
push eax
push 0x5003c0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0xffffffffffffffff
lea ecx, [esp + 0xc]
call dword [0x4ffef8]
mov ecx, dword [esp + 8]
push 0x4001
push 0x2b4
lea eax, [esp + 0x14]
push eax
push 0
push ecx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push eax
call fcn.004ef11a
mov esi, eax
mov dword [esp + 0x2cc], 0xffffffff
lea ecx, [esp + 8]
call dword [0x4fff34]
mov eax, esi
mov ecx, dword [esp + 0x2c4]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x2b8]
xor ecx, esp
call fcn.004efe2a
add esp, 0x2c8
ret

Function at 0x401da2
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edx
push edx
or edx, 0x13bb2
and edx, 0xe1d
sub edx, 0x13eb5
pop edx
mov dword [ebp - 0x10], 1
push edi
push edi
add esp, 4
and edi, 0x11097
and edi, 0xd8ad
sub edi, 0x528e
pop edi
push esi
xor esi, 0xf08b
add esi, 0xe160
sub esi, 0x90b4
sub esi, 0x40b4
pop esi
imul edx, dword [ebp - 0x10], 0x70
add edx, 0x44f3663b
imul eax, dword [ebp - 0x10], 0x70
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x70
sub edx, ecx
mov dword [ebp - 0x14], edx
push eax
sub eax, 0x10417
sub eax, 0x8e65
and eax, 0x126cc
pop eax
push edx
or edx, 0x15a34
jmp 0x401e3a
jmp 0x401e41
xor edx, 0x511b
pop edx
push esi
push eax
add esp, 4
xor esi, 0xb1dc
pop esi
push ecx
push eax
add esp, 4
sub ecx, 0x14a42
pop ecx
push eax
sub eax, 0x9799
sub eax, 0x11d4b
add eax, 0x158a6
and eax, 0x2fba
pop eax
mov dword [ebp - 0x2c], 1
push edi
push ebx
add esp, 4
xor edi, 0x26e
pop edi
push eax
push esi
add esp, 4
and eax, 0x16197
pop eax
push ecx
sub ecx, 0x11a7d
call 0x401eaf
add byte [eax + 0x32], dl
dec esi
aaa
xor eax, 0x41503c42
add esp, 4
pop ecx
imul edx, dword [ebp - 0x2c], 0x70
add edx, 0x44f3663b
imul eax, dword [ebp - 0x2c], 0x70
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x70
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x402070
Function at 0x401eaf
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edx
push edx
or edx, 0x13bb2
and edx, 0xe1d
sub edx, 0x13eb5
pop edx
mov dword [ebp - 0x10], 1
push edi
push edi
add esp, 4
and edi, 0x11097
and edi, 0xd8ad
sub edi, 0x528e
pop edi
push esi
xor esi, 0xf08b
add esi, 0xe160
sub esi, 0x90b4
sub esi, 0x40b4
pop esi
imul edx, dword [ebp - 0x10], 0x70
add edx, 0x44f3663b
imul eax, dword [ebp - 0x10], 0x70
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x70
sub edx, ecx
mov dword [ebp - 0x14], edx
push eax
sub eax, 0x10417
sub eax, 0x8e65
and eax, 0x126cc
pop eax
push edx
or edx, 0x15a34
jmp 0x401e3a
jmp 0x401e41
xor edx, 0x511b
pop edx
push esi
push eax
add esp, 4
xor esi, 0xb1dc
pop esi
push ecx
push eax
add esp, 4
sub ecx, 0x14a42
pop ecx
push eax
sub eax, 0x9799
sub eax, 0x11d4b
add eax, 0x158a6
and eax, 0x2fba
pop eax
mov dword [ebp - 0x2c], 1
push edi
push ebx
add esp, 4
xor edi, 0x26e
pop edi
push eax
push esi
add esp, 4
and eax, 0x16197
pop eax
push ecx
sub ecx, 0x11a7d
call 0x401eaf
add byte [eax + 0x32], dl
dec esi
aaa
xor eax, 0x41503c42
add esp, 4
pop ecx
imul edx, dword [ebp - 0x2c], 0x70
add edx, 0x44f3663b
imul eax, dword [ebp - 0x2c], 0x70
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x70
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x402070
Function at 0x4061c6
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor ebx, 0x6826
pop ebx
push eax
sub eax, 0x1392e
xor eax, 0x10653
pop eax
push eax
or eax, 0x2156
pop eax
mov ecx, dword [ebp - 0x508]
mov dword [ebp - 0x750], ecx
jmp 0x40625c

Function at 0x4067da
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edi
push esi
push eax
add esp, 4
and esi, 0x13f3e
pop esi
push eax
push eax
add esp, 4
add eax, 0x1c57
or eax, 0xf46e
pop eax
cmp dword [ebp - 0xcb4], 0
jne 0x406814
mov dword [ebp - 0x31c], 0
jmp 0x406a5f
mov ecx, dword [ebp - 0xcb4]
mov dword [ebp - 0x50c], ecx
push eax
push ecx
add esp, 4
xor eax, 0x34b6
pop eax
push esi
push ecx
add esp, 4
xor esi, 0x11490
pop esi
push eax
add eax, 0x81cf
xor eax, 0xeb67
jmp 0x40684b
or eax, 0x138e9
pop eax
lea edx, [ebp - 0x173c]
mov dword [ebp - 0xcb0], edx
mov eax, dword [ebp - 0x50c]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcac], ecx
xor edx, edx
mov word [ebp - 0x218], dx
xor eax, eax
mov word [ebp - 0x34], ax
push edx
add edx, 0x13c2b
add edx, 0x8922
pop edx
push ebx
push ecx
add esp, 4
add ebx, 0xa0e2
sub ebx, 0x139be
pop ebx
push ecx
push esi
add esp, 4
xor ecx, 0x11991
xor ecx, 0x7aee
pop ecx
mov ecx, dword [ebp - 0xcac]
mov dx, word [ecx]
mov word [ebp - 0x103a], dx
mov eax, dword [ebp - 0xcac]
add eax, 2
mov dword [ebp - 0xcac], eax
mov cx, word [ebp - 0x103a]
mov word [ebp - 0x218], cx
mov edx, dword [ebp - 0xcb0]
mov ax, word [edx]
mov word [ebp - 0x103c], ax
mov ecx, dword [ebp - 0xcb0]
add ecx, 2
mov dword [ebp - 0xcb0], ecx
mov dx, word [ebp - 0x103c]
mov word [ebp - 0x34], dx
push edx
push eax
add esp, 4
and edx, 0x168e5
call 0x40691c
add byte [ebx + 0x46], cl
cmp eax, dword [ebx + 0x49]
inc eax
add esp, 4
pop edx
push ecx
or ecx, 0xaf9b
jmp 0x406930
and ecx, 0x1758
pop ecx
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x406954
movzx ecx, word [ebp - 0x218]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x1608], ecx
jmp 0x4069ae
movzx eax, word [ebp - 0x218]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x40687c
movzx edx, word [ebp - 0x218]
invalid
invalid
Function at 0x40691c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edi
push esi
push eax
add esp, 4
and esi, 0x13f3e
pop esi
push eax
push eax
add esp, 4
add eax, 0x1c57
or eax, 0xf46e
pop eax
cmp dword [ebp - 0xcb4], 0
jne 0x406814
mov dword [ebp - 0x31c], 0
jmp 0x406a5f
mov ecx, dword [ebp - 0xcb4]
mov dword [ebp - 0x50c], ecx
push eax
push ecx
add esp, 4
xor eax, 0x34b6
pop eax
push esi
push ecx
add esp, 4
xor esi, 0x11490
pop esi
push eax
add eax, 0x81cf
xor eax, 0xeb67
jmp 0x40684b
or eax, 0x138e9
pop eax
lea edx, [ebp - 0x173c]
mov dword [ebp - 0xcb0], edx
mov eax, dword [ebp - 0x50c]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcac], ecx
xor edx, edx
mov word [ebp - 0x218], dx
xor eax, eax
mov word [ebp - 0x34], ax
push edx
add edx, 0x13c2b
add edx, 0x8922
pop edx
push ebx
push ecx
add esp, 4
add ebx, 0xa0e2
sub ebx, 0x139be
pop ebx
push ecx
push esi
add esp, 4
xor ecx, 0x11991
xor ecx, 0x7aee
pop ecx
mov ecx, dword [ebp - 0xcac]
mov dx, word [ecx]
mov word [ebp - 0x103a], dx
mov eax, dword [ebp - 0xcac]
add eax, 2
mov dword [ebp - 0xcac], eax
mov cx, word [ebp - 0x103a]
mov word [ebp - 0x218], cx
mov edx, dword [ebp - 0xcb0]
mov ax, word [edx]
mov word [ebp - 0x103c], ax
mov ecx, dword [ebp - 0xcb0]
add ecx, 2
mov dword [ebp - 0xcb0], ecx
mov dx, word [ebp - 0x103c]
mov word [ebp - 0x34], dx
push edx
push eax
add esp, 4
and edx, 0x168e5
call 0x40691c
add byte [ebx + 0x46], cl
cmp eax, dword [ebx + 0x49]
inc eax
add esp, 4
pop edx
push ecx
or ecx, 0xaf9b
jmp 0x406930
and ecx, 0x1758
pop ecx
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x406954
movzx ecx, word [ebp - 0x218]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x1608], ecx
jmp 0x4069ae
movzx eax, word [ebp - 0x218]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x40687c
movzx edx, word [ebp - 0x218]
invalid
invalid
Function at 0x406fd9
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edi
push ecx
sub ecx, 0x1ebd
mov ebp, 0xe800001e
or eax, dword [eax]
add byte [eax], al
add byte [esi], dh
inc ecx
inc ebp
dec ebp
dec esp
cmp edx, dword [eax + 0x44]
cmp bh, byte [edx]
add esp, 4
sub ecx, 0x1e69
pop ecx
mov eax, dword fs:[0x18]
mov dword [ebp - 0x19f8], eax
mov ecx, dword [ebp - 0x19f8]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x19fc], edx
mov eax, dword [ebp - 0x19fc]
mov dword [ebp - 0x1618], eax
push ecx
push edi
add esp, 4
or ecx, 0xa2b1
add ecx, 0x73b6
xor ecx, 0x1715
xor ecx, 0x17c56
pop ecx
push esi
or esi, 0x9269
or esi, 0x178c
xor esi, 0x16240
pop esi
cmp dword [ebp - 0x1618], 0
jne 0x40706f
mov dword [ebp - 0x2fc], 0
jmp 0x407316
invalid

Function at 0x406fe0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edi
push ecx
sub ecx, 0x1ebd
mov ebp, 0xe800001e
or eax, dword [eax]
add byte [eax], al
add byte [esi], dh
inc ecx
inc ebp
dec ebp
dec esp
cmp edx, dword [eax + 0x44]
cmp bh, byte [edx]
add esp, 4
sub ecx, 0x1e69
pop ecx
mov eax, dword fs:[0x18]
mov dword [ebp - 0x19f8], eax
mov ecx, dword [ebp - 0x19f8]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x19fc], edx
mov eax, dword [ebp - 0x19fc]
mov dword [ebp - 0x1618], eax
push ecx
push edi
add esp, 4
or ecx, 0xa2b1
add ecx, 0x73b6
xor ecx, 0x1715
xor ecx, 0x17c56
pop ecx
push esi
or esi, 0x9269
or esi, 0x178c
xor esi, 0x16240
pop esi
cmp dword [ebp - 0x1618], 0
jne 0x40706f
mov dword [ebp - 0x2fc], 0
jmp 0x407316
invalid

Function at 0x406ff4
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edi
push ecx
sub ecx, 0x1ebd
mov ebp, 0xe800001e
or eax, dword [eax]
add byte [eax], al
add byte [esi], dh
inc ecx
inc ebp
dec ebp
dec esp
cmp edx, dword [eax + 0x44]
cmp bh, byte [edx]
add esp, 4
sub ecx, 0x1e69
pop ecx
mov eax, dword fs:[0x18]
mov dword [ebp - 0x19f8], eax
mov ecx, dword [ebp - 0x19f8]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x19fc], edx
mov eax, dword [ebp - 0x19fc]
mov dword [ebp - 0x1618], eax
push ecx
push edi
add esp, 4
or ecx, 0xa2b1
add ecx, 0x73b6
xor ecx, 0x1715
xor ecx, 0x17c56
pop ecx
push esi
or esi, 0x9269
or esi, 0x178c
xor esi, 0x16240
pop esi
cmp dword [ebp - 0x1618], 0
jne 0x40706f
mov dword [ebp - 0x2fc], 0
jmp 0x407316
invalid
Function at 0x4070e5
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push eax
call 0x4070e5
add byte [eax], bh
xor al, byte [esp + ecx*2 + 0x39]
push eax
inc ecx
add esp, 4
xor eax, 0x981
pop eax
push ebx
or ebx, 0xe240
add ebx, 0x5d25
or ebx, 0x3ca4
xor ebx, 0x1354d
pop ebx
lea edx, [ebp - 0x173c]
mov dword [ebp - 0xcc0], edx
mov eax, dword [ebp - 0x514]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcbc], ecx
inc esp
invalid
invalid
push dword [ebx]
shl byte [esi - 0x77], cl
xchg ebp, eax
in al, 0xfd
invalid
push dword [ebx]
shl byte [esi - 0x77], 0x45
invalid
push eax
push esi
add esp, 4
jmp 0x40713d
xor eax, 0x76a7
pop eax
push esi
sub esi, 0xd00d
or esi, 0x14119
call 0x407161
add byte [ebp + 0x4d], al
xor eax, dword ds:[eax + 0x34]
inc ebp
dec ecx
xor dh, byte [edi]
add esp, 4
pop esi
mov ecx, dword [ebp - 0xcbc]
mov dx, word [ecx]
mov word [ebp - 0x103e], dx
mov eax, dword [ebp - 0xcbc]
add eax, 2
mov dword [ebp - 0xcbc], eax
mov cx, word [ebp - 0x103e]
mov word [ebp - 0x21c], cx
mov edx, dword [ebp - 0xcc0]
mov ax, word [edx]
mov word [ebp - 0x1040], ax
mov ecx, dword [ebp - 0xcc0]
add ecx, 2
mov dword [ebp - 0xcc0], ecx
mov dx, word [ebp - 0x1040]
mov word [ebp - 0x38], dx
push ecx
push ebx
add esp, 4
and ecx, 0x7c7f
jmp 0x4071cd
pop ecx
push eax
push ecx
add esp, 4
sub eax, 0xd3e9
pop eax
push esi
push esi
add esp, 4
add esi, 0x88a8
pop esi
push ebx
sub ebx, 0x3d33
pop ebx
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x40720b
movzx ecx, word [ebp - 0x21c]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x1620], ecx
jmp 0x407265
movzx eax, word [ebp - 0x21c]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x407133
movzx edx, word [ebp - 0x21c]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x407133
movzx ecx, word [ebp - 0x21c]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x40724f
mov dword [ebp - 0x161c], 0xffffffff
jmp 0x407259
mov dword [ebp - 0x161c], 1
mov eax, dword [ebp - 0x161c]
mov dword [ebp - 0x1620], eax
cmp dword [ebp - 0x1620], 0
jne 0x4072ae
push edx
or edx, 0x25ed
and edx, 0x1114a
add edx, 0x7469
pop edx
push esi
push esi
add esp, 4
jmp 0x40728e
jmp 0x407294
jmp 0x407299
or esi, 0x11787
pop esi
mov ecx, dword [ebp - 0x514]
mov dword [ebp - 0x2fc], ecx
jmp 0x407316
push edx
sub edx, 0x893d
pop edx
push ebx
add ebx, 0x9adf
jmp 0x4072c6
and ebx, 0xfc2a
call 0x4072dc
add byte [eax], al
push eax
inc esp
add byte [eax], al
push eax
inc esp
inc eax
cmp byte [0x48374837], dh
inc ecx
add esp, 4
pop ebx
mov edx, dword [ebp - 0x514]
mov eax, dword [edx]
mov dword [ebp - 0x514], eax
mov ecx, dword [ebp - 0x514]
cmp ecx, dword [ebp - 0xcc4]
je 0x40730c
mov edx, dword [ebp - 0x514]
cmp dword [edx + 0x30], 0
jne 0x4070d7
mov dword [ebp - 0x2fc], 0
push ebx
call 0x407326
add byte [ecx + 0x47], al
push eax