joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4060ee
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, 0x104
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
pop esi
jbe 0x406112
xor eax, eax
test eax, eax
je 0x406124
cmp byte [ebp + eax - 0x121], 0x5c
je 0x406124
xor ecx, ecx
jmp 0x406127
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx + 0x40a014]
lea eax, [ebp + eax - 0x120]
push ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
leave
ret 4

Function at 0x4061d1
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42cdfc], 0
push esi
jne 0x406208
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4061e2
mov dword [ecx*4 + 0x42cdf8], eax
inc ecx
cmp ecx, 0x100
jl 0x4061dd
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406239
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42cdf8]
xor eax, esi
inc ecx
dec edx
jne 0x40621b
pop edi
not eax
pop esi
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x5e6de9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0xc
mov esi, dword [esp + 0x20]
test esi, esi
je 0x5e6e5c
mov eax, dword [esi + 0x3c]
mov edx, esi
add edx, dword [esi + eax + 0x78]
mov dword [esp + 8], edx
mov edi, dword [edx + 0x20]
mov ebp, dword [edx + 0x18]
test ebp, ebp
je 0x5e6e60
mov ebx, 0
add edi, esi
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, esi
add eax, dword [edi + ebx*4]
mov dword [esp], eax
call fcn.005e6d8f
test al, al
jne 0x5e6e3d
add ebx, 1
cmp ebx, ebp
jne 0x5e6e16
mov eax, 0
jmp 0x5e6e54
lea eax, [esi + ebx*2]
mov ecx, dword [esp + 8]
add eax, dword [ecx + 0x24]
movzx eax, word [eax]
lea eax, [esi + eax*4]
add eax, dword [ecx + 0x1c]
add esi, dword [eax]
mov eax, esi
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, esi
jmp 0x5e6e54
mov eax, 0
jmp 0x5e6e54

Function at 0x5e6ef0
Capabilities:
Access peb ldr_data

Disassembly:
push edi
push esi
push ebx
sub esp, 4
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, dword fs:[0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0xc
jmp 0x5e6f1f
test esi, esi
je 0x5e6f30
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
call fcn.005e6eac
cmp eax, esi
je 0x5e6f3a
mov ebx, dword [ebx]
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x5e6f1f
test edi, edi
je 0x5e6f0c
mov dword [edi], eax
jmp 0x5e6f0c
mov eax, dword [ebx + 0x18]
add esp, 4
pop ebx
pop esi
pop edi
ret
mov eax, dword [ebx + 0x18]
jmp 0x5e6f33
Function at 0x5e6f3f
Capabilities:
Terminate process

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov dword [esp + 0x1c], 0
lea eax, [esp + 0x1c]
mov dword [esp + 4], eax
mov dword [esp], 0
call fcn.005e6ef0
mov esi, eax
mov eax, dword [0x76764d]
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.005e6ef0
mov ebx, eax
mov edi, dword [0x767645]
cmp dword [edi], 0
je 0x5e6fb5
mov ebp, dword [esp + 0x1c]
mov dword [esp], ebp
call fcn.005e6d6f
cmp byte [edi], al
je 0x5e6f9f
cmp byte [edi + 1], al
jne 0x5e70d0
mov dword [esp], ebp
call fcn.005e6e80
cmp dword [edi + 4], eax
je 0x5e6fb5
cmp dword [edi + 8], eax
jne 0x5e70dd
mov dword [esp + 0x18], 0
mov eax, dword [0x76762d]
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0x1000
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
sub esp, 0x10
mov edx, dword [0x767639]
test edx, edx
je 0x5e7013
mov edx, 0
mov ecx, dword [0x767631]
mov ecx, dword [ecx + edx]
mov dword [eax + edx], ecx
mov ecx, dword [0x767659]
add edx, ecx
mov ecx, dword [0x767639]
cmp ecx, edx
ja 0x5e6ff5
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.005e6de9
mov edi, eax
test eax, eax
je 0x5e70c3
mov ebx, dword [0x767655]
mov edx, dword [0x767639]
mov eax, dword [0x767625]
lea ecx, [esp + 0x18]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], ebx
call edi
sub esp, 0x10
mov eax, dword [0x767661]
add esi, eax
mov ecx, dword [esi + 4]
mov eax, dword [0x767625]
cmp eax, 8
jbe 0x5e7083
mov edx, 8
mov eax, ecx
add eax, dword [esi + edx]
mov dword [ebx + edx], eax
mov eax, dword [0x767659]
add edx, eax
mov eax, dword [0x767625]
cmp eax, edx
ja 0x5e706b
mov eax, dword [0x76765d]
mov dword [ebx + 8], eax
mov eax, dword [0x767625]
lea edx, [esp + 0x18]
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x18]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], ebx
call edi
sub esp, 0x10
mov eax, dword [0x767629]
mov edx, dword [0x767629]
add eax, dword [ebx + 0xc]
add eax, ebx
add ebx, edx
mov dword [esp], ebx
call eax
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_ExitProcess]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_ExitProcess]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_ExitProcess]
Function at 0x7158f0
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd44
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x715946
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x101
push 0x2b4
lea eax, [ebp - 0x2bc]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.0040a944
push eax
call sub.shell32.dll_SHGetFileInfoW
mov eax, dword [ebp - 0x2bc]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x715950
cmp dword [ebp - 8], 1
ja 0x715999
xor eax, eax
push ebp
push 0x71598f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 4]
call fcn.0040a944
push eax
mov eax, dword [0x768cec]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.shell32.dll_ExtractIconW
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x715999
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x715b94
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
cmp edx, 1
jae 0x715b9f
xor ecx, ecx
jmp 0x715bcc
or ecx, 0xffffffff
mov ebx, eax
mov eax, edx
dec eax
test eax, eax
jb 0x715bca
inc eax
movzx edx, byte [ebx]
mov esi, 0xff
and esi, ecx
xor edx, esi
mov edx, dword [edx*4 + 0x767624]
shr ecx, 8
xor edx, ecx
mov ecx, edx
inc ebx
dec eax
jne 0x715bac
not ecx
mov eax, ecx
pop esi
pop ebx
ret

Function at 0x715f68
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, esi
call fcn.00406bb0
imul ebx, dword [0x76760c], 0x8088405
inc ebx
mov dword [0x76760c], ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, esi
xor edx, edx
call fcn.0040b874
mov eax, edx
xor edx, edx
pop esi
pop ebx
ret

Function at 0x715f9c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00409a08
xor eax, eax
push ebp
push 0x716024
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x76760c], 0x18f13e8
mov eax, dword [ebp - 4]
test eax, eax
je 0x715fd4
sub eax, 4
mov eax, dword [eax]
mov esi, eax
test esi, esi
jle 0x716004
mov ebx, 1
mov eax, 0x80
call fcn.00715f68
or al, 0x80
mov edx, dword [ebp - 4]
xor al, byte [edx + ebx - 1]
push eax
lea eax, [ebp - 4]
call fcn.00409ee8
pop edx
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x715fdf
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00409d98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x71602b
lea eax, [ebp - 4]
call fcn.00409938
ret
Function at 0x75172c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [0x7687e8]
mov eax, dword [eax]
xor edx, edx
call fcn.005ee094
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x45c], edx
mov eax, dword [0x768ed0]
cmp dword [eax], 0
je 0x75176a
mov eax, dword [0x768ed0]
mov eax, dword [eax]
call fcn.00561a1c
jmp 0x7518da
mov eax, dword [ebp - 4]
cmp byte [eax + 0x45a], 0
je 0x751785
mov eax, 0x7518ec
call fcn.00712c38
jmp 0x7518da
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x744c44]
call fcn.005ed004
mov edx, dword [0x768ed0]
mov dword [edx], eax
xor eax, eax
push ebp
push 0x7518d3
push dword fs:[eax]
mov dword fs:[eax], esp
push 5
mov eax, dword [ebp - 4]
call fcn.0056a620
push eax
call sub.user32.dll_ShowWindow
cmp bl, 1
jne 0x7517e3
mov eax, dword [0x768ed0]
mov eax, dword [eax]
mov edx, dword [eax + 0x3b8]
mov eax, dword [0x768ed0]
mov eax, dword [eax]
mov eax, dword [eax + 0x3b0]
mov ecx, dword [eax]
call dword [ecx + 0x220]
jmp 0x75182e
cmp bl, 2
jne 0x75180c
mov eax, dword [0x768ed0]
mov eax, dword [eax]
mov edx, dword [eax + 0x3f8]
mov eax, dword [0x768ed0]
mov eax, dword [eax]
mov eax, dword [eax + 0x3b0]
mov ecx, dword [eax]
call dword [ecx + 0x220]
jmp 0x75182e
mov eax, dword [0x768ed0]
mov eax, dword [eax]
mov edx, dword [eax + 0x3b4]
mov eax, dword [0x768ed0]
mov eax, dword [eax]
mov eax, dword [eax + 0x3b0]
mov ecx, dword [eax]
call dword [ecx + 0x220]
mov eax, dword [0x768ed0]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x128]
mov eax, dword [0x768ed0]
mov eax, dword [eax]
cmp dword [eax + 0x2d8], 1
jne 0x751869
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x454]
call fcn.0073a1b0
test al, al
jne 0x751869
mov eax, 0x75195c
call fcn.00712c38
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x454]
call fcn.0073a7f4
mov eax, dword [0x7687e8]
mov eax, dword [eax]
call fcn.0074c414
mov eax, dword [ebp - 4]
call fcn.0074f650
mov eax, dword [ebp - 4]
call fcn.0074f510
mov eax, dword [ebp - 4]
call fcn.0074fc94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7518da
push 0
mov eax, dword [ebp - 4]
call fcn.0056a620
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x768ed0]
mov eax, dword [eax]
call fcn.00407bf8
mov eax, dword [0x768ed0]
xor edx, edx
mov dword [eax], edx
call fcn.007161e8
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x4015a0
Capabilities:
Terminate process

Disassembly:
call fcn.00401940
jmp fcn.004012d0

Function at 0x4015b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x403008]
jne 0x4015ba
repz ret
jmp fcn.004019f0
Function at 0x10009253
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x10009262
pop dword [ebp - 0x14]
mov eax, 0x27080853
sub eax, 0x170775f1
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x4c2cedda
add dword [ebp - 0x24], 0x2255771
mov dword [ebp - 0x20], 0x1db42a0c
sub dword [ebp - 0x20], 0xeb80ddc7
mov dword [ebp - 0x1c], 0x9189e836
add dword [ebp - 0x1c], 0xbac25bf8
mov dword [ebp - 0x18], 0x453c3696
sub dword [ebp - 0x18], 0x453c3696
lea eax, [ebp - 0x24]
push eax
mov eax, 0xc119ed60
add eax, 0x4ee7b2a8
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x1aa6c59e
sub dword [ebp - 0x24], 0xa6345c48
mov dword [ebp - 0x20], 0xb6f0b848
sub dword [ebp - 0x20], 0x758456d3
mov dword [ebp - 0x1c], 0x2b8566d7
sub dword [ebp - 0x1c], 0xc815fa6b
mov dword [ebp - 0x18], 0x8422aceb
sub dword [ebp - 0x18], 0x8422aceb
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x3baff
push 0
call eax
mov ecx, 0x81cfe7b1
sub ecx, 0x81cf9a1a
xor ebx, ebx
add ebx, eax
mov edx, 0x10024a00
add edx, dword [ebp - 0x14]
mov edi, 0x4536c93a
add edi, 0xd2cba27c
mov esi, dword [edx]
mov dword [ebp - 4], 0xfde27845
xor esi, edi
add dword [ebp - 8], 0x84f65285
mov dword [ebx], esi
add dword [ebp - 0x10], 0x9926c885
add ebx, 0x726753c2
add ebx, 0x8d98ac42
add edx, 4
loop 0x1000937b
add eax, 0x1292f
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x40145d
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x401467
add ecx, 0xee31
pop ecx
mov edx, dword [ebp - 0x30]
add edx, 0xfe
imul eax, dword [ebp - 0x2c], 0xfe
add eax, 0x56f3663b
imul ecx, dword [ebp - 0x2c], 0xfe
sub eax, ecx
xor edx, eax
imul edx, dword [ebp - 0x2c]
mov dword [ebp - 0x1d60], edx
push edx
add edx, 0xbbb9
add edx, 0xd3f4
add edx, 0x8242
pop edx
push ebx
push ecx
add esp, 4
sub ebx, 0xc13b
pop ebx
push edx
push edx
add esp, 4
xor edx, 0xd6e4
and edx, 0x7429
pop edx
mov edx, dword [ebp - 0x1d60]
add edx, 1
mov dword [ebp - 0x159c], edx
push edi
jmp 0x4014e1
add edi, 0xd32e
pop edi
push edi
sub edi, 0x2ff5
sub edi, 0x168f4
call 0x401501
add byte [ecx + 0x32], cl
cmp dword [ebx + 0x40], eax
dec edi
add esp, 4
xor edi, 0x5f44
pop edi
push edx
push eax
add esp, 4
xor edx, 0x47fc
xor edx, 0xb9d7
or edx, 0x8442
add edx, 0x1280a
pop edx
push esi
add esi, 0x1218d
or esi, 0xc430
or esi, 0x90df
pop esi
imul eax, dword [ebp - 0x2c], 0xfe
add eax, 0x56f3663b
imul ecx, dword [ebp - 0x2c], 0xfe
sub eax, ecx
xor eax, dword [ebp - 0x159c]
imul eax, dword [ebp - 0x2c]
imul edx, dword [ebp - 0x2c], 0xfe
sub eax, edx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x159c]
imul eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1e28], eax
mov dword [ebp - 0x1628], 1
push edi
add edi, 0x17be8
jmp 0x40158f
pop edi
push ebx
push edx
add esp, 4
and ebx, 0x10ebd
sub ebx, 0x27d5
or ebx, 0xe90d
pop ebx
push esi
push ecx
add esp, 4
add esi, 0xe5e8
pop esi
imul ecx, dword [ebp - 0x1628], 0xfe
add ecx, 0x56f3663b
imul edx, dword [ebp - 0x1628], 0xfe
sub ecx, edx
xor ecx, dword [ebp - 0x1e28]
imul ecx, dword [ebp - 0x1628]
imul eax, dword [ebp - 0x1628], 0xfe
sub ecx, eax
mov dword [ebp - 0x162c], ecx
Function at 0x401501
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x401467
add ecx, 0xee31
pop ecx
mov edx, dword [ebp - 0x30]
add edx, 0xfe
imul eax, dword [ebp - 0x2c], 0xfe
add eax, 0x56f3663b
imul ecx, dword [ebp - 0x2c], 0xfe
sub eax, ecx
xor edx, eax
imul edx, dword [ebp - 0x2c]
mov dword [ebp - 0x1d60], edx
push edx
add edx, 0xbbb9
add edx, 0xd3f4
add edx, 0x8242
pop edx
push ebx
push ecx
add esp, 4
sub ebx, 0xc13b
pop ebx
push edx
push edx
add esp, 4
xor edx, 0xd6e4
and edx, 0x7429
pop edx
mov edx, dword [ebp - 0x1d60]
add edx, 1
mov dword [ebp - 0x159c], edx
push edi
jmp 0x4014e1
add edi, 0xd32e
pop edi
push edi
sub edi, 0x2ff5
sub edi, 0x168f4
call 0x401501
add byte [ecx + 0x32], cl
cmp dword [ebx + 0x40], eax
dec edi
add esp, 4
xor edi, 0x5f44
pop edi
push edx
push eax
add esp, 4
xor edx, 0x47fc
xor edx, 0xb9d7
or edx, 0x8442
add edx, 0x1280a
pop edx
push esi
add esi, 0x1218d
or esi, 0xc430
or esi, 0x90df
pop esi
imul eax, dword [ebp - 0x2c], 0xfe
add eax, 0x56f3663b
imul ecx, dword [ebp - 0x2c], 0xfe
sub eax, ecx
xor eax, dword [ebp - 0x159c]
imul eax, dword [ebp - 0x2c]
imul edx, dword [ebp - 0x2c], 0xfe
sub eax, edx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x159c]
imul eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1e28], eax
mov dword [ebp - 0x1628], 1
push edi
add edi, 0x17be8
jmp 0x40158f
pop edi
push ebx
push edx
add esp, 4
and ebx, 0x10ebd
sub ebx, 0x27d5
or ebx, 0xe90d
pop ebx
push esi
push ecx
add esp, 4
add esi, 0xe5e8
pop esi
imul ecx, dword [ebp - 0x1628], 0xfe
add ecx, 0x56f3663b
imul edx, dword [ebp - 0x1628], 0xfe
sub ecx, edx
xor ecx, dword [ebp - 0x1e28]
imul ecx, dword [ebp - 0x1628]
imul eax, dword [ebp - 0x1628], 0xfe
sub ecx, eax
mov dword [ebp - 0x162c], ecx
Function at 0x404a58
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x4fc]
add edx, 1
mov dword [ebp - 0x4fc], edx
push eax
push esi
add esp, 4
call 0x404a58
add byte [eax], al
inc ebp
cmp byte [edx], bh
inc ebx
inc esi
inc ebp
add esp, 4
cmp dword [ebp - 0xc80], 0
jle 0x404c95
push ecx
push edx
add esp, 4
and ecx, 0xfde3
or ecx, 0x1045a
mov dword [ebp - 0xac4], eax
mov ecx, dword [ebp - 0xa60]
add ecx, 1
mov dword [ebp - 0xa60], ecx
jmp 0x404b70
mov edx, dword [ebp - 0xc84]
mov dword [ebp - 0x15cc], edx
cmp dword [ebp - 0x15cc], 0
jne 0x404cea
push edx
push eax
add esp, 4
call 0x404cbc
add byte [ebp + 0x41], al
xor eax, 0x83504445
les eax, [ecx + eax*4]
ljmp 0xca81
jmp 0x404a38

Function at 0x404a5b
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
call 0x404a69
add byte [esi], dh
aas
push eax
dec ebx
cmp dword [edi], edi
push eax
add esp, 4
sub eax, 0x378c
or eax, 0x8019
pop eax
mov eax, dword [ebp - 0x4fc]
sub eax, dword [ebp - 0x3f0]
cmp eax, 0xffffffff
jb 0x404ac1
push ecx
push esi
add esp, 4
call 0x404a9f
add byte [edx + edi], bh
inc esi
dec eax
aaa
dec esp
inc esi
inc ecx
cmp dword [ebp - 0x7d], eax
les eax, [ecx + eax*4]
leave
mov eax, 0x81000167
int1
xchg ebx, eax
int 0
add byte [ecx + 0x56], bl
jmp 0x404ab5
sub esi, 0x6041
pop esi
jmp 0x404cef
mov dword [ebp - 0xc80], 7
push esi
push edi
add esp, 4
or esi, 0x90a4
and esi, 0x17677
pop esi
push edx
or edx, 0x130e0
and edx, 0x1490a
pop edx
push edi
push ebx
add esp, 4
add edi, 0x42fc
sub edi, 0x4bf8
pop edi
mov dword [ebp - 0x3e8], 0
push esi
push edx
add esp, 4
or esi, 0x98ba
xor esi, 0x12089
or esi, 0x808e
and esi, 0xfbb6
pop esi
push ebx
push ecx
add esp, 4
or ebx, 0x7542
pop ebx
push edx
xor edx, 0x60ba
pop edx
push edi
push esi
add esp, 4
or edi, 0x237d
pop edi
push edx
push esi
add esp, 4
xor edx, 0x5cc6
pop edx
push ecx
add ecx, 0x7f60
or ecx, 0x15394
and ecx, 0xe186
add ecx, 0x18473
pop ecx
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xbe4]
mov dword [ebp - 0x15d0], eax
push edx
or edx, 0xb5d0
call 0x404dbb
add byte [eax + edx*2 + 0x40], cl
xor esi, dword [edi]
dec ebp
inc edx
dec esp
inc ebx
dec edi
add esp, 4
call 0x404dcc
add byte [esi + 0x3c], al
xor eax, 0x4b4f3539
xor eax, dword [ebx - 0x3d7efb3c]
push ds
loop 0x404dd4
add byte [edx - 0x39], bl
test dword [edi + ebx*8 - 1], ebx
Function at 0x404a69
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
call 0x404a69
add byte [esi], dh
aas
push eax
dec ebx
cmp dword [edi], edi
push eax
add esp, 4
sub eax, 0x378c
or eax, 0x8019
pop eax
mov eax, dword [ebp - 0x4fc]
sub eax, dword [ebp - 0x3f0]
cmp eax, 0xffffffff
jb 0x404ac1
push ecx
push esi
add esp, 4
call 0x404a9f
add byte [edx + edi], bh
inc esi
dec eax
aaa
dec esp
inc esi
inc ecx
cmp dword [ebp - 0x7d], eax
les eax, [ecx + eax*4]
leave
mov eax, 0x81000167
int1
xchg ebx, eax
int 0
add byte [ecx + 0x56], bl
jmp 0x404ab5
sub esi, 0x6041
pop esi
jmp 0x404cef
mov dword [ebp - 0xc80], 7
push esi
push edi
add esp, 4
or esi, 0x90a4
and esi, 0x17677
pop esi
push edx
or edx, 0x130e0
and edx, 0x1490a
pop edx
push edi
push ebx
add esp, 4
add edi, 0x42fc
sub edi, 0x4bf8
pop edi
mov dword [ebp - 0x3e8], 0
push esi
push edx
add esp, 4
or esi, 0x98ba
xor esi, 0x12089
or esi, 0x808e
and esi, 0xfbb6
pop esi
push ebx
push ecx
add esp, 4
or ebx, 0x7542
pop ebx
push edx
xor edx, 0x60ba
pop edx
push edi
push esi
add esp, 4
or edi, 0x237d
pop edi
push edx
push esi
add esp, 4
xor edx, 0x5cc6
pop edx
push ecx
add ecx, 0x7f60
or ecx, 0x15394
and ecx, 0xe186
add ecx, 0x18473
pop ecx
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xbe4]
mov dword [ebp - 0x15d0], eax
push edx
or edx, 0xb5d0
call 0x404dbb
add byte [eax + edx*2 + 0x40], cl
xor esi, dword [edi]
dec ebp
inc edx
dec esp
inc ebx
dec edi
add esp, 4
call 0x404dcc
add byte [esi + 0x3c], al
xor eax, 0x4b4f3539
xor eax, dword [ebx - 0x3d7efb3c]
push ds
loop 0x404dd4
add byte [edx - 0x39], bl
test dword [edi + ebx*8 - 1], ebx
Function at 0x404a9f
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
call 0x404a69
add byte [esi], dh
aas
push eax
dec ebx
cmp dword [edi], edi
push eax
add esp, 4
sub eax, 0x378c
or eax, 0x8019
pop eax
mov eax, dword [ebp - 0x4fc]
sub eax, dword [ebp - 0x3f0]
cmp eax, 0xffffffff
jb 0x404ac1
push ecx
push esi
add esp, 4
call 0x404a9f
add byte [edx + edi], bh
inc esi
dec eax
aaa
dec esp
inc esi
inc ecx
cmp dword [ebp - 0x7d], eax
les eax, [ecx + eax*4]
leave
mov eax, 0x81000167
int1
xchg ebx, eax
int 0
add byte [ecx + 0x56], bl
jmp 0x404ab5
sub esi, 0x6041
pop esi
jmp 0x404cef
mov dword [ebp - 0xc80], 7
push esi
push edi
add esp, 4
or esi, 0x90a4
and esi, 0x17677
pop esi
push edx
or edx, 0x130e0
and edx, 0x1490a
pop edx
push edi
push ebx
add esp, 4
add edi, 0x42fc
sub edi, 0x4bf8
pop edi
mov dword [ebp - 0x3e8], 0
push esi
push edx
add esp, 4
or esi, 0x98ba
xor esi, 0x12089
or esi, 0x808e
and esi, 0xfbb6
pop esi
push ebx
push ecx
add esp, 4
or ebx, 0x7542
pop ebx
push edx
xor edx, 0x60ba
pop edx
push edi
push esi
add esp, 4
or edi, 0x237d
pop edi
push edx
push esi
add esp, 4
xor edx, 0x5cc6
pop edx
push ecx
add ecx, 0x7f60
or ecx, 0x15394
and ecx, 0xe186
add ecx, 0x18473
pop ecx
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xbe4]
mov dword [ebp - 0x15d0], eax
push edx
or edx, 0xb5d0
call 0x404dbb
add byte [eax + edx*2 + 0x40], cl
xor esi, dword [edi]
dec ebp
inc edx
dec esp
inc ebx
dec edi
add esp, 4
call 0x404dcc
add byte [esi + 0x3c], al
xor eax, 0x4b4f3539
xor eax, dword [ebx - 0x3d7efb3c]
push ds
loop 0x404dd4
add byte [edx - 0x39], bl
test dword [edi + ebx*8 - 1], ebx

Function at 0x404acb
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ebp - 0x4fc]
mov dword [ebp - 0xac4], ecx
push edx
or edx, 0x18356
and edx, 0xc6ca
jmp 0x404aeb
pop edx
push edx
or edx, 0xa9b8
pop edx
push esi
push esi
add esp, 4
jmp 0x404b02
xor esi, 0xe1b8
pop esi
mov edx, dword [ebp - 0x15c4]
mov dword [ebp - 0xa60], edx
mov dword [ebp - 0xc84], 0
mov eax, dword [ebp - 0x4fc]
invalid
invalid
invalid

Function at 0x404b8e
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
call 0x404b9c
add byte [ecx*2 + 0x4f473b3a], bh
inc edi
cmp eax, dword [ebx + 0x7e804c4]
add byte [eax], al
add byte [eax], al
dec esi
aas
dec ebp
dec esp
add esp, 4
pop ecx
mov edx, dword [ebp - 0xac4]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0xa60]
movzx edx, byte [ecx]
cmp eax, edx
je 0x404c31
push esi
push edi
add esp, 4
add esi, 0x18496
xor esi, 0x5b4c
pop esi
push edi
and edi, 0xce54
and edi, 0x155ad
and edi, 0xaaf5
pop edi
push esi
push eax
add esp, 4
add esi, 0x6ab0
pop esi
invalid
invalid
invalid