joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401ae0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0x40406c], eax
push str.Riched32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push str.mifedount
push str.Deltapo
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401b33
xor eax, eax
jmp 0x401b4e
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x402880
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4045b8
push 0x402b50
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffff98
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push 2
call dword [sym.imp.MSVCRT.dll___set_app_type]
add esp, 4
mov dword [0x4046e8], 0xffffffff
mov dword [0x4046ec], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x4046e4]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov edx, dword [0x4046e0]
mov dword [eax], edx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov ecx, dword [eax]
mov dword [0x4046f0], ecx
call fcn.00402b40
mov eax, dword [0x4043b8]
test eax, eax
jne 0x402911
push 0x402b30
call dword [sym.imp.MSVCRT.dll___setusermatherr]
add esp, 4
call fcn.00402b10
push 0x4040f0
push 0x4040ec
call sub.MSVCRT.dll__initterm
add esp, 8
mov edx, dword [0x4046dc]
mov dword [ebp - 0x6c], edx
lea eax, [ebp - 0x6c]
push eax
mov ecx, dword [0x4046d8]
push ecx
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x60]
push ecx
call dword [sym.imp.MSVCRT.dll___getmainargs]
add esp, 0x14
push 0x4040e8
push 0x4040e4
call sub.MSVCRT.dll__initterm
add esp, 8
call dword [sym.imp.MSVCRT.dll___p__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x74], esi
cmp byte [esi], 0x22
jne 0x402a1f
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x402985
cmp al, 0x22
jne 0x402977
cmp byte [esi], 0x22
jne 0x40298e
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x40299e
cmp al, 0x20
ja 0x40299e
inc esi
mov dword [ebp - 0x74], esi
jmp 0x40298e
mov dword [ebp - 0x30], 0
lea edx, [ebp - 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x4029bf
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x4029c4
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x68], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
jmp 0x402a04
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x20
jbe 0x40298e
inc esi
mov dword [ebp - 0x74], esi
jmp 0x402a1f
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42a004]
jne 0x40100a
repz ret
jmp fcn.00401424

Function at 0x406ecc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42a004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00404a1c
and dword [ebp - 0x14], 0
cmp dword [0x42c958], 0
mov dword [ebp - 0x18], eax
jne 0x406f7f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x407027
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x407027
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x42c958], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42c95c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x42c960], eax
call edi
push eax
call esi
mov dword [0x42c968], eax
test eax, eax
je 0x406f7f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x42c964], eax
mov eax, dword [0x42c964]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x406fd8
cmp dword [0x42c968], ecx
je 0x406fd8
push eax
call esi
push dword [0x42c968]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x406fd8
test ebx, ebx
je 0x406fd8
call edi
test eax, eax
je 0x406fcf
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x406fcf
test byte [ebp - 8], 1
jne 0x406fd8
or dword [ebp + 0x10], 0x200000
jmp 0x40700b
mov eax, dword [0x42c95c]
cmp eax, dword [ebp - 0x18]
je 0x40700b
push eax
call esi
test eax, eax
je 0x40700b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40700b
mov eax, dword [0x42c960]
cmp eax, dword [ebp - 0x18]
je 0x40700b
push eax
call esi
test eax, eax
je 0x40700b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42c958]
call esi
test eax, eax
je 0x407027
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x407029
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret
Function at 0x452f30
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 8]
test edi, edi
je 0x452fa6
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x452fa6
mov dl, byte [ecx]
cmp dl, 0xbc
push ebx
push esi
jne 0x452f77
cmp byte [ecx + 1], 0xbd
jne 0x452f77
lea edx, [ecx + 2]
mov esi, edi
sub esi, edx
mov bl, byte [edx]
mov byte [esi + edx], bl
inc edx
test bl, bl
jne 0x452f57
lea eax, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x452f64
pop esi
sub ecx, eax
pop ebx
mov byte [ecx + edi - 4], dl
mov eax, edi
pop edi
ret
xor dl, 0x23
mov byte [edi], dl
mov al, byte [ecx]
xor esi, esi
test al, al
je 0x452f9c
mov edx, edi
sub edx, ecx
mov al, byte [ecx + 1]
mov bl, byte [edx + ecx]
inc esi
inc ecx
dec al
xor al, bl
mov byte [edx + ecx], al
cmp byte [ecx], 0
jne 0x452f88
mov byte [esi + edi], 0
pop esi
pop ebx
mov eax, edi
pop edi
ret
xor eax, eax
pop edi
ret
Function at 0x455fb6
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.004548d0
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x456051
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x498df0]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x456051
cmp eax, 1
je 0x456072
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x456051
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x45601e
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x45604d
xor eax, eax
inc eax
jmp 0x456091
cmp edi, eax
jae 0x456055
xor eax, eax
jmp 0x456091
cmp eax, esi
jae 0x45605c
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x498df0]
jmp 0x456075
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x45693b
Capabilities:
Inspect section memory permissions

Disassembly:
call dword [eax + 0x56]
push dword [ebp + 8]
call fcn.0045640d
add esp, 0x10
mov dword [ebp - 0xc0], eax
push 0x40
push 0x1000
push dword [ebp + 0xc]
push ebx
call dword [ebp - 0x88]
mov esi, eax
cmp esi, ebx
je 0x456c41
push dword [ebp - 0xb4]
push dword [ebp + 0x10]
push esi
invalid

Function at 0x456ab0
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x456afc
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
ror byte [ecx - 0x35c4f7b3], 1
ror byte [ecx - 0x35c4f7b3], 1
jae 0x456af7
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x456ae1
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x456ae9
cmp edx, ebx
jne 0x456c37
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x456ab8
add eax, dword [eax + 4]
jmp 0x456aa5
mov dword [ebp + 0xc], ebx
jmp 0x456b07
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x456b1f
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x456b3d
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
invalid
inc esp
invalid
Function at 0x4578ec
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop esp
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.00456448
test eax, 0x8d3bf794
test esp, edx
clc
invalid

Function at 0x45c088
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x496f74]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x4975a0]
je 0x45c0bd
inc eax
cmp eax, 0x13
jb 0x45c0ae
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x4975a0]
jne 0x45c1e3
mov eax, dword [0x498c5c]
cmp eax, 1
je 0x45c1bb
cmp eax, edx
jne 0x45c0ed
cmp dword [0x496fa0], 1
je 0x45c1bb
cmp ecx, 0xfc
je 0x45c1e3
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x45c123
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call fcn.0045aef0
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.00456ab0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x45c157
mov eax, edi
push eax
call fcn.00456ab0
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x4888d4
push edi
call fcn.00454760
add esp, 0x10
push edi
call fcn.00456ab0
push dword [esi + 0x4975a4]
mov ebx, eax
call fcn.00456ab0
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.004548d0
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.0045aef0
push edi
push ebx
call fcn.0045af00
push 0x4888d0
push ebx
call fcn.0045af00
push dword [esi + 0x4975a4]
push ebx
call fcn.0045af00
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.00465c2c
add esp, 0x2c
jmp 0x45c1e3
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x4975a4]
push dword [esi]
call fcn.00456ab0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.004543e5
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret
Function at 0x401dca
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x401dd9
pop dword [ebp - 0x48]
mov eax, 0x3c351c95
add eax, 0xc40b0144
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x648bfffb
add dword [ebp - 0x58], 0xe9c64550
mov dword [ebp - 0x54], 0xcc583059
sub dword [ebp - 0x54], 0x9a24e414
mov dword [ebp - 0x50], 0x41f970a9
add dword [ebp - 0x50], 0xa52d385
mov dword [ebp - 0x4c], 0x50227be
add dword [ebp - 0x4c], 0xfafdd842
lea eax, [ebp - 0x58]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xae1acc2f
add dword [ebp - 0x58], 0xc6579d27
mov dword [ebp - 0x54], 0xc5978c0
sub dword [ebp - 0x54], 0xcaed174b
mov dword [ebp - 0x50], 0x606ae5a8
add dword [ebp - 0x50], 0x30486c4
mov dword [ebp - 0x4c], 0xf8bc0cd0
sub dword [ebp - 0x4c], 0xf8bc0cd0
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0xe82e6bf1
add eax, 0x1813c533
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3d6ec
push 0
call eax
mov ecx, 0x46e0
xor edx, edx
add edx, eax
mov ebx, 0x74d1319d
add ebx, 0x8b721263
add ebx, dword [ebp - 0x48]
mov edi, 0xee443e22
sub edi, 0x92d977ed
mov dword [ebp - 0x40], 0x2a61bec8
mov esi, dword [ebx]
sub dword [ebp - 0x18], esi
xor esi, edi
xor dword [ebp - 0x10], 0xbfd70a5e
mov dword [edx], esi
mov dword [ebp - 0x24], 0x73bb0bae
add edx, 0x7f172079
add edx, 0x80e8df8b
add ebx, 0x44deb2ff
add ebx, 0xbb214d05
loop 0x401ef2
add eax, 0xb9cc52fa
add eax, 0x4634bb59
mov ebx, eax
add eax, 0xc2bcbcf0
sub eax, 0xc2bcbceb
mov ecx, 0x16fbe4b9
add ecx, 0xe9441b47
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0x405262
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x405279
pop esi
ret
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x4052ae
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x4052aa
cmp edi, eax
jae 0x4052ae
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x40529c
cmp edi, eax
jb 0x4052b2
xor eax, eax
jmp 0x4052bb
movzx eax, word [edi]
neg eax
sbb eax, eax
and eax, edi
pop edi
pop esi
ret

Function at 0x4147b5
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop eax
push ecx
add ecx, 0xbef1
xor ecx, 0xf688
pop ecx
imul ecx, dword [ebp - 0x2d8], 0xfe
add ecx, 0x56f3663b
imul edx, dword [ebp - 0x2d8], 0xfe
sub ecx, edx
xor ecx, 2
imul ecx, dword [ebp - 0x2d8]
imul eax, dword [ebp - 0x2d8], 0xfe
sub ecx, eax
mov dword [ebp - 0x2dc], ecx
push eax
push edx
add esp, 4
sub eax, 0xa6f7
pop eax
push edi
push esi
add esp, 4
xor edi, 0xd1b0
sub edi, 0x15325
xor edi, 0x10e40
add edi, 0xb7a
pop edi
push esi
or esi, 0x15cc5
pop esi
mov ecx, dword [ebp - 0x9dc]
dec dword [ebx - 0x9d76b]
dec dword [ecx - 0x1b773]
dec dword [ecx - 0x1b36b]
invalid
jmp 0x414787
push edx
xor edx, 0x159e4
sub edx, 0xc4cc
sub edx, 0x15e5e
pop edx
push edi
push esi
add esp, 4
sub edi, 0x160d9
call 0x4147b5
add byte [ebx], bh
dec ebx
dec esi
xor eax, 0x3749414d
cmp dword [ebx - 0x74a0fb3c], eax
xchg ebp, eax
dec eax
invalid
Function at 0x414d1f
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
int1
add byte [eax], al
add ebx, 0x16055
and ebx, 0x5d98
pop ebx
push ecx
call 0x414d1f
add byte [eax + edx*2 + 0x33], cl
dec ecx
aaa
dec edi
add esp, 4
or ecx, 0xadc
add ecx, 0x88e0
pop ecx
mov edx, dword [ebp - 0x2dc]
mov eax, dword [ebp - 0x2d8]
mov dword [ebp - 0x20d0], edx
mov dword [ebp - 0x20cc], eax
push esi
add esi, 0x165e7
or esi, 0x4046
pop esi
push ebx
push ecx
add esp, 4
add ebx, 0x116b4
xor ebx, 0x8e54
pop ebx
push edi
push ecx
add esp, 4
or edi, 0x14766
or edi, 0xfe66
pop edi
mov ecx, dword [ebp - 0x2040]
mov dword [ebp - 0x15dc], ecx
push ebx
push edi
add esp, 4
or ebx, 0x458d
pop ebx
push esi
or esi, 0x14520
xor esi, 0x152a
pop esi
push ebx
push esi
add esp, 4
add ebx, 0x9952
sub ebx, 0xfbf0
add ebx, 0xeba9
pop ebx
mov edx, dword [ebp - 0x10c]
add edx, 0xfe
imul eax, dword [ebp - 0x108], 0xfe
add eax, 0x56f3663b
imul ecx, dword [ebp - 0x108], 0xfe
sub eax, ecx
xor edx, eax
imul edx, dword [ebp - 0x108]
mov dword [ebp - 0x15dc], edx
mov edx, dword [ebp - 0x414]
mov dword [ebp - 0x202c], edx
mov eax, dword [ebp - 0x202c]
add eax, dword [ebp - 0x15dc]
mov dword [ebp - 0x414], eax
push ecx
and ecx, 0xb477
sub ecx, 0xf127
pop ecx
push edi
push ecx
add esp, 4
call 0x414e2d
add byte [ecx + 0x4f], cl
cmp eax, 0x3f4d4a40
dec edi
aaa
add esp, 4
xor edi, 0x16977
and edi, 0x9a66
pop edi
push edx
sub edx, 0x13bef
pop edx
push esi
push ebx
add esp, 4
add esi, 0x1383
add esi, 0x730d
pop esi
push esi
push edi
add esp, 4
sub esi, 0x15f2f
xor esi, 0x165ab
or esi, 0x1001c
pop esi
mov byte [ebp - 0xc08], 0x51
mov byte [ebp - 0xc07], 0xb9
mov byte [ebp - 0xc06], 0x10
mov byte [ebp - 0xc05], 0x10
mov byte [ebp - 0xc04], 0x10
mov byte [ebp - 0xc03], 0x10
mov byte [ebp - 0xc02], 0x59
push ecx
push esi
add esp, 4
and ecx, 0x2e2b
or ecx, 0xcf95
and ecx, 0x16129
pop ecx
push esi
jmp 0x414ec1
sub esi, 0x309
pop esi
push eax
jmp 0x414ed1
pop eax
push edx
push ecx
add esp, 4
add edx, 0xba79
or edx, 0x9c2a
pop edx
push ecx
and ecx, 0x17d7
and ecx, 0xea77
pop ecx
push ebx
push edi
add esp, 4
and ebx, 0x619c
and ebx, 0x8c96
pop ebx
mov byte [ebp - 0xc10], 0x51
mov byte [ebp - 0xc0f], 0xb9
mov byte [ebp - 0xc0e], 0x20
mov byte [ebp - 0xc0d], 0x20
mov byte [ebp - 0xc0c], 0x20
mov byte [ebp - 0xc0b], 0x20
mov byte [ebp - 0xc0a], 0x59
push eax
jmp 0x414f3e
and eax, 0x770a
jmp 0x414f4c
pop eax
push edx
sub edx, 0x15dac
or edx, 0xf60b
or edx, 0x5da3
add edx, 0xd232
pop edx
push ecx
push edi
add esp, 4
or ecx, 0x14f76
sub ecx, 0xa47b
and ecx, 0x26b
pop ecx
push esi
or esi, 0x14e09
or esi, 0xe7fe
add byte [ecx + 0x149cdce], al
add byte [ecx + 0x10ae6ee], al
add byte [esi - 0x39], bl
test dword [edi + ebx*8 + 0xeffff], edi
add byte [eax], al
Function at 0x414e2d
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
int1
add byte [eax], al
add ebx, 0x16055
and ebx, 0x5d98
pop ebx
push ecx
call 0x414d1f
add byte [eax + edx*2 + 0x33], cl
dec ecx
aaa
dec edi
add esp, 4
or ecx, 0xadc
add ecx, 0x88e0
pop ecx
mov edx, dword [ebp - 0x2dc]
mov eax, dword [ebp - 0x2d8]
mov dword [ebp - 0x20d0], edx
mov dword [ebp - 0x20cc], eax
push esi
add esi, 0x165e7
or esi, 0x4046
pop esi
push ebx
push ecx
add esp, 4
add ebx, 0x116b4
xor ebx, 0x8e54
pop ebx
push edi
push ecx
add esp, 4
or edi, 0x14766
or edi, 0xfe66
pop edi
mov ecx, dword [ebp - 0x2040]
mov dword [ebp - 0x15dc], ecx
push ebx
push edi
add esp, 4
or ebx, 0x458d
pop ebx
push esi
or esi, 0x14520
xor esi, 0x152a
pop esi
push ebx
push esi
add esp, 4
add ebx, 0x9952
sub ebx, 0xfbf0
add ebx, 0xeba9
pop ebx
mov edx, dword [ebp - 0x10c]
add edx, 0xfe
imul eax, dword [ebp - 0x108], 0xfe
add eax, 0x56f3663b
imul ecx, dword [ebp - 0x108], 0xfe
sub eax, ecx
xor edx, eax
imul edx, dword [ebp - 0x108]
mov dword [ebp - 0x15dc], edx
mov edx, dword [ebp - 0x414]
mov dword [ebp - 0x202c], edx
mov eax, dword [ebp - 0x202c]
add eax, dword [ebp - 0x15dc]
mov dword [ebp - 0x414], eax
push ecx
and ecx, 0xb477
sub ecx, 0xf127
pop ecx
push edi
push ecx
add esp, 4
call 0x414e2d
add byte [ecx + 0x4f], cl
cmp eax, 0x3f4d4a40
dec edi
aaa
add esp, 4
xor edi, 0x16977
and edi, 0x9a66
pop edi
push edx
sub edx, 0x13bef
pop edx
push esi
push ebx
add esp, 4
add esi, 0x1383
add esi, 0x730d
pop esi
push esi
push edi
add esp, 4
sub esi, 0x15f2f
xor esi, 0x165ab
or esi, 0x1001c
pop esi
mov byte [ebp - 0xc08], 0x51
mov byte [ebp - 0xc07], 0xb9
mov byte [ebp - 0xc06], 0x10
mov byte [ebp - 0xc05], 0x10
mov byte [ebp - 0xc04], 0x10
mov byte [ebp - 0xc03], 0x10
mov byte [ebp - 0xc02], 0x59
push ecx
push esi
add esp, 4
and ecx, 0x2e2b
or ecx, 0xcf95
and ecx, 0x16129
pop ecx
push esi
jmp 0x414ec1
sub esi, 0x309
pop esi
push eax
jmp 0x414ed1
pop eax
push edx
push ecx
add esp, 4
add edx, 0xba79
or edx, 0x9c2a
pop edx
push ecx
and ecx, 0x17d7
and ecx, 0xea77
pop ecx
push ebx
push edi
add esp, 4
and ebx, 0x619c
and ebx, 0x8c96
pop ebx
mov byte [ebp - 0xc10], 0x51
mov byte [ebp - 0xc0f], 0xb9
mov byte [ebp - 0xc0e], 0x20
mov byte [ebp - 0xc0d], 0x20
mov byte [ebp - 0xc0c], 0x20
mov byte [ebp - 0xc0b], 0x20
mov byte [ebp - 0xc0a], 0x59
push eax
jmp 0x414f3e
and eax, 0x770a
jmp 0x414f4c
pop eax
push edx
sub edx, 0x15dac
or edx, 0xf60b
or edx, 0x5da3
add edx, 0xd232
pop edx
push ecx
push edi
add esp, 4
or ecx, 0x14f76
sub ecx, 0xa47b
and ecx, 0x26b
pop ecx
push esi
or esi, 0x14e09
or esi, 0xe7fe
add byte [ecx + 0x149cdce], al
add byte [ecx + 0x10ae6ee], al
add byte [esi - 0x39], bl
test dword [edi + ebx*8 + 0xeffff], edi
add byte [eax], al
Function at 0x416746
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov word [ebp - 0x30], dx
push eax
push esi
add esp, 4
and eax, 0x3927
pop eax
push ebx
push edx
add esp, 4
or ebx, 0x4a45
jmp 0x41676a
xor ebx, 0x539f
pop ebx
push ebx
push edx
add esp, 4
jmp 0x41677b
pop ebx
movzx eax, word [ebp - 0x30]
test eax, eax
jne 0x416799
movzx ecx, word [ebp - 0x1c4]
movzx edx, word [ebp - 0x30]
sub ecx, edx
mov dword [ebp - 0x1624], ecx
jmp 0x4167f3
movzx eax, word [ebp - 0x1c4]
movzx ecx, word [ebp - 0x30]
cmp eax, ecx
je 0x4166c1
movzx edx, word [ebp - 0x1c4]
xor edx, 0x20
movzx eax, word [ebp - 0x30]