joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f400
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x58
push ebx
push ebp
mov ebp, dword [esp + 0x64]
push esi
push edi
mov esi, eax
push esi
lea edi, [esp + 0x30]
call fcn.0040f5e0
test eax, eax
je 0x42ca37
mov ebx, dword [esp + 0x74]
cmp dword [ebx], 4
je 0x42ca1f
mov edx, dword [esp + 0x70]
push 0
push 0x4848e8
push esi
push edx
push esi
push ebp
mov dword [ebx], 2
call fcn.004037e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret 0xc
invalid

Function at 0x40f450
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x10020
call fcn.00425210
xor eax, eax
lea esp, [esp]
mov cl, byte [eax + 0x492380]
mov dl, byte [eax + 0x492378]
mov byte [esp + eax + 0xc], cl
mov byte [esp + eax + 0x14], dl
inc eax
cmp eax, 8
jl 0x40f460
lea eax, [esp]
push 0x4876e8
push eax
call fcn.00413990
push 4
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x2c]
push edx
call fcn.00410f70
add esp, 0x14
push ebx
push ebp
push esi
mov dword [esp + 0x14], 0
push edi
jmp 0x40f4b0
mov eax, dword [esp + 0x10034]
mov ecx, dword [eax]
push ecx
push 0x10000
lea edx, [esp + 0x38]
push 1
push edx
call fcn.004151b0
add esp, 0x10
cmp eax, 0x18
jl 0x40f531
mov ebp, eax
lea edi, [ebp - 0x14]
test edi, edi
jle 0x40f4fd
xor edx, edx
mov edi, edi
xor ecx, ecx
lea esi, [esp + edx + 0x30]
mov al, byte [esp + ecx + 0x1c]
cmp al, byte [esi + ecx]
je 0x40f521
cmp ecx, 0x14
je 0x42937a
inc edx
cmp edx, edi
jl 0x40f4e0
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x10034]
lea edx, [ecx + ebp - 0x14]
mov ecx, dword [eax]
push 1
push 0xffffffffffffffec
push ecx
mov dword [esp + 0x24], edx
call fcn.0041557c
add esp, 0xc
jmp 0x40f4b0
mov bl, byte [esp + ecx + 0x1d]
lea eax, [ecx + edx]
cmp bl, byte [esp + eax + 0x31]
je 0x40f543
inc ecx
jmp 0x40f4ef
mov eax, 3
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10020
ret 4
mov bl, byte [esp + ecx + 0x1e]
lea eax, [ecx + edx]
cmp bl, byte [esp + eax + 0x32]
je 0x40f555
add ecx, 2
jmp 0x40f4ef
mov bl, byte [esp + ecx + 0x1f]
lea eax, [ecx + edx]
cmp bl, byte [esp + eax + 0x33]
jne 0x429372
mov bl, byte [esp + ecx + 0x20]
lea eax, [ecx + edx]
cmp bl, byte [esp + eax + 0x34]
je 0x429361
add ecx, 4
jmp 0x40f4ef
add al, 0x81
invalid
call 0x43f988
Function at 0x40f5e0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a8
push ebx
push esi
mov ebx, 0x4848e8
call fcn.0040f580
mov esi, eax
lea eax, [esp + 0xa8]
push esi
push eax
call fcn.00413990
push esi
call fcn.004112ef
add esp, 0xc
lea esi, [esp + 0x18]
call fcn.0040f6a0
lea eax, [esp + 0xa8]
mov ecx, esi
call fcn.0040f6d0
xor ebx, ebx
mov dword [edi + 8], ebx
xor ecx, ecx
mov eax, ebx
movzx edx, byte [esp + ecx + 0x18]
add eax, edx
movzx edx, byte [esp + ecx + 0x19]
add eax, edx
movzx edx, byte [esp + ecx + 0x1a]
add eax, edx
movzx edx, byte [esp + ecx + 0x1b]
add ecx, 4
add eax, edx
cmp ecx, 0x10
jl 0x40f631
mov dword [edi + 8], eax
mov eax, dword [ebp + 8]
push 0x4876c8
push eax
call fcn.00414e06
add esp, 8
mov dword [edi], eax
cmp eax, ebx
je 0x42b2ee
push edi
call fcn.0040f450
cmp eax, ebx
je 0x42b2f8
mov ecx, dword [edi]
push ecx
mov esi, eax
call fcn.00414e94
add esp, 4
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xchg dword [ecx], eax
add byte [ecx + 0x14353f0], al
add byte [eax + 0x57], bl

Function at 0x40f6a0
Capabilities:
Hash data with md5

Disassembly:
push 8
lea eax, [esi + 0x44]
push 0
push eax
call fcn.004131f0
add esp, 0xc
mov dword [esi + 0x34], 0x67452301
mov dword [esi + 0x38], 0xefcdab89
mov dword [esi + 0x3c], 0x98badcfe
mov dword [esi + 0x40], 0x10325476
ret

Function at 0x40ff90
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x18
push edi
push eax
lea edi, [esp + 0x14]
call fcn.0040f5e0
test eax, eax
je 0x42b6bf
xor al, al
pop edi
add esp, 0x18
ret
add byte [eax], al

Function at 0x4103e0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x4972c8]
push esi
push 0
mov esi, dword [sym.imp.USER32.dll_CreateWindowExW]
push eax
push 0
push 0
push 0x64
push 0x12c
push accept
push accept
push 0xcf0000
push str.AutoIt_v3
push str.AutoIt_v3
push 0
call esi
mov ecx, dword [0x4972c8]
push 0
push ecx
push 1
push eax
push 0
push 0
push 0
push 0
push 0x50b008c4
push 0
push str.edit
push 0
mov dword [0x4972c0], eax
call esi
mov edx, dword [0x4972c0]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push edx
mov dword [0x4972bc], eax
call esi
mov eax, dword [0x4972c0]
push 0
push eax
call esi
pop esi
ret

Function at 0x410790
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x18
mov eax, dword [esi + 0x11c]
mov dword [esp], eax
lea esp, [esp]
test eax, eax
jne 0x42bd0d
add esp, 0x18
ret
add byte [eax], al
add bl, ch
jnp 0x413da4
inc dword [ebx - 0x7276fe3f]
cmp dh, 0xff
dec dword [ebx - 0x6f76b]
inc dword [ebx]
xchg ebp, eax
cmp dh, 0xff
dec dword [edi]
mov esi, 0xfc08502
test byte [ebx - 0x75000000], bl
lea eax, [eax + 0xffffffe]
mov esi, 0xf7e00d94
invalid

Function at 0x421fa7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x490e80]
jne 0x421fb1
repz ret
jmp fcn.00426243
Function at 0x4271e3
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1fbc
push ebx
push esi
push edi
push esi
push esi
add esp, 4
and esi, 0xd3dc
pop esi
push eax
push eax
add esp, 4
or eax, 0x47f8
xor eax, 0x1110e
pop eax
push eax
or eax, 0xc046
pop eax
push edx
push edi
add esp, 4
add edx, 0x2a26
pop edx
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
mov word [ebp - 0x1ee4], dx
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push edi
call 0x4272de
add byte [edx], dh
dec eax
inc ebx
push eax
dec esp
cmp dword [edi], edi
add esp, 4
pop edi
push ecx
push edx
add esp, 4
jmp 0x4272ed
pop ecx
push esi
push ebx
add esp, 4
or esi, 0xf9d5
pop esi
push edi
sub edi, 0xed78
pop edi
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push edx
add edx, 0xd5b0
and edx, 0x16a5c
or edx, 0x94da
xor edx, 0x3238
pop edx
push ecx
jmp 0x427360
pop ecx
push ebx
sub ebx, 0x8778
jmp 0x42736e
pop ebx
mov dword [ebp - 0x10], 1
push eax
xor eax, 0xc8b4
or eax, 0x161a9
jmp 0x42738b
or eax, 0xa3cb
pop eax
push edx
and edx, 0x11036
pop edx
push eax
add eax, 0x17bb4
and eax, 0xb6ee
pop eax
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push ecx
push eax
add esp, 4
jmp 0x4273e0
pop ecx
push edx
push ebx
add esp, 4
jmp 0x4273ec
or edx, 0x16731
call 0x427402
add byte [edx + 0x4c], cl
inc ebx
dec ebx
push eax
inc eax
push eax
aaa
cmp dword [ebx], edi
add esp, 4
pop edx
push edi
jmp 0x427410
call 0x42741c
add byte [esi + 0x43], al
dec edi
inc eax
inc edi
add esp, 4
pop edi
push esi
push eax
add esp, 4
and esi, 0x16bc7
and esi, 0x9d66
xor esi, 0xe3a3
pop esi
mov dword [ebp - 0x2c], 1
push eax
or eax, 0x390c
pop eax
push esi
push edi
add esp, 4
or esi, 0xf127
and esi, 0x158a9
pop esi
push ecx
call 0x427467
add byte [esi + 0x4c], al
dec edx
aaa
cmp al, byte [edi + 0x40]
add esp, 4
xor ecx, 0x1b15
pop ecx
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x138
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x427652
Function at 0x4272de
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1fbc
push ebx
push esi
push edi
push esi
push esi
add esp, 4
and esi, 0xd3dc
pop esi
push eax
push eax
add esp, 4
or eax, 0x47f8
xor eax, 0x1110e
pop eax
push eax
or eax, 0xc046
pop eax
push edx
push edi
add esp, 4
add edx, 0x2a26
pop edx
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
mov word [ebp - 0x1ee4], dx
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push edi
call 0x4272de
add byte [edx], dh
dec eax
inc ebx
push eax
dec esp
cmp dword [edi], edi
add esp, 4
pop edi
push ecx
push edx
add esp, 4
jmp 0x4272ed
pop ecx
push esi
push ebx
add esp, 4
or esi, 0xf9d5
pop esi
push edi
sub edi, 0xed78
pop edi
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push edx
add edx, 0xd5b0
and edx, 0x16a5c
or edx, 0x94da
xor edx, 0x3238
pop edx
push ecx
jmp 0x427360
pop ecx
push ebx
sub ebx, 0x8778
jmp 0x42736e
pop ebx
mov dword [ebp - 0x10], 1
push eax
xor eax, 0xc8b4
or eax, 0x161a9
jmp 0x42738b
or eax, 0xa3cb
pop eax
push edx
and edx, 0x11036
pop edx
push eax
add eax, 0x17bb4
and eax, 0xb6ee
pop eax
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push ecx
push eax
add esp, 4
jmp 0x4273e0
pop ecx
push edx
push ebx
add esp, 4
jmp 0x4273ec
or edx, 0x16731
call 0x427402
add byte [edx + 0x4c], cl
inc ebx
dec ebx
push eax
inc eax
push eax
aaa
cmp dword [ebx], edi
add esp, 4
pop edx
push edi
jmp 0x427410
call 0x42741c
add byte [esi + 0x43], al
dec edi
inc eax
inc edi
add esp, 4
pop edi
push esi
push eax
add esp, 4
and esi, 0x16bc7
and esi, 0x9d66
xor esi, 0xe3a3
pop esi
mov dword [ebp - 0x2c], 1
push eax
or eax, 0x390c
pop eax
push esi
push edi
add esp, 4
or esi, 0xf127
and esi, 0x158a9
pop esi
push ecx
call 0x427467
add byte [esi + 0x4c], al
dec edx
aaa
cmp al, byte [edi + 0x40]
add esp, 4
xor ecx, 0x1b15
pop ecx
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x138
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x427652
Function at 0x427402
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1fbc
push ebx
push esi
push edi
push esi
push esi
add esp, 4
and esi, 0xd3dc
pop esi
push eax
push eax
add esp, 4
or eax, 0x47f8
xor eax, 0x1110e
pop eax
push eax
or eax, 0xc046
pop eax
push edx
push edi
add esp, 4
add edx, 0x2a26
pop edx
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
mov word [ebp - 0x1ee4], dx
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push edi
call 0x4272de
add byte [edx], dh
dec eax
inc ebx
push eax
dec esp
cmp dword [edi], edi
add esp, 4
pop edi
push ecx
push edx
add esp, 4
jmp 0x4272ed
pop ecx
push esi
push ebx
add esp, 4
or esi, 0xf9d5
pop esi
push edi
sub edi, 0xed78
pop edi
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push edx
add edx, 0xd5b0
and edx, 0x16a5c
or edx, 0x94da
xor edx, 0x3238
pop edx
push ecx
jmp 0x427360
pop ecx
push ebx
sub ebx, 0x8778
jmp 0x42736e
pop ebx
mov dword [ebp - 0x10], 1
push eax
xor eax, 0xc8b4
or eax, 0x161a9
jmp 0x42738b
or eax, 0xa3cb
pop eax
push edx
and edx, 0x11036
pop edx
push eax
add eax, 0x17bb4
and eax, 0xb6ee
pop eax
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push ecx
push eax
add esp, 4
jmp 0x4273e0
pop ecx
push edx
push ebx
add esp, 4
jmp 0x4273ec
or edx, 0x16731
call 0x427402
add byte [edx + 0x4c], cl
inc ebx
dec ebx
push eax
inc eax
push eax
aaa
cmp dword [ebx], edi
add esp, 4
pop edx
push edi
jmp 0x427410
call 0x42741c
add byte [esi + 0x43], al
dec edi
inc eax
inc edi
add esp, 4
pop edi
push esi
push eax
add esp, 4
and esi, 0x16bc7
and esi, 0x9d66
xor esi, 0xe3a3
pop esi
mov dword [ebp - 0x2c], 1
push eax
or eax, 0x390c
pop eax
push esi
push edi
add esp, 4
or esi, 0xf127
and esi, 0x158a9
pop esi
push ecx
call 0x427467
add byte [esi + 0x4c], al
dec edx
aaa
cmp al, byte [edi + 0x40]
add esp, 4
xor ecx, 0x1b15
pop ecx
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x138
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x427652
Function at 0x42741c
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1fbc
push ebx
push esi
push edi
push esi
push esi
add esp, 4
and esi, 0xd3dc
pop esi
push eax
push eax
add esp, 4
or eax, 0x47f8
xor eax, 0x1110e
pop eax
push eax
or eax, 0xc046
pop eax
push edx
push edi
add esp, 4
add edx, 0x2a26
pop edx
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
mov word [ebp - 0x1ee4], dx
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push edi
call 0x4272de
add byte [edx], dh
dec eax
inc ebx
push eax
dec esp
cmp dword [edi], edi
add esp, 4
pop edi
push ecx
push edx
add esp, 4
jmp 0x4272ed
pop ecx
push esi
push ebx
add esp, 4
or esi, 0xf9d5
pop esi
push edi
sub edi, 0xed78
pop edi
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push edx
add edx, 0xd5b0
and edx, 0x16a5c
or edx, 0x94da
xor edx, 0x3238
pop edx
push ecx
jmp 0x427360
pop ecx
push ebx
sub ebx, 0x8778
jmp 0x42736e
pop ebx
mov dword [ebp - 0x10], 1
push eax
xor eax, 0xc8b4
or eax, 0x161a9
jmp 0x42738b
or eax, 0xa3cb
pop eax
push edx
and edx, 0x11036
pop edx
push eax
add eax, 0x17bb4
and eax, 0xb6ee
pop eax
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push ecx
push eax
add esp, 4
jmp 0x4273e0
pop ecx
push edx
push ebx
add esp, 4
jmp 0x4273ec
or edx, 0x16731
call 0x427402
add byte [edx + 0x4c], cl
inc ebx
dec ebx
push eax
inc eax
push eax
aaa
cmp dword [ebx], edi
add esp, 4
pop edx
push edi
jmp 0x427410
call 0x42741c
add byte [esi + 0x43], al
dec edi
inc eax
inc edi
add esp, 4
pop edi
push esi
push eax
add esp, 4
and esi, 0x16bc7
and esi, 0x9d66
xor esi, 0xe3a3
pop esi
mov dword [ebp - 0x2c], 1
push eax
or eax, 0x390c
pop eax
push esi
push edi
add esp, 4
or esi, 0xf127
and esi, 0x158a9
pop esi
push ecx
call 0x427467
add byte [esi + 0x4c], al
dec edx
aaa
cmp al, byte [edi + 0x40]
add esp, 4
xor ecx, 0x1b15
pop ecx
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x138
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x427652
Function at 0x427467
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1fbc
push ebx
push esi
push edi
push esi
push esi
add esp, 4
and esi, 0xd3dc
pop esi
push eax
push eax
add esp, 4
or eax, 0x47f8
xor eax, 0x1110e
pop eax
push eax
or eax, 0xc046
pop eax
push edx
push edi
add esp, 4
add edx, 0x2a26
pop edx
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
mov word [ebp - 0x1ee4], dx
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push edi
call 0x4272de
add byte [edx], dh
dec eax
inc ebx
push eax
dec esp
cmp dword [edi], edi
add esp, 4
pop edi
push ecx
push edx
add esp, 4
jmp 0x4272ed
pop ecx
push esi
push ebx
add esp, 4
or esi, 0xf9d5
pop esi
push edi
sub edi, 0xed78
pop edi
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push edx
add edx, 0xd5b0
and edx, 0x16a5c
or edx, 0x94da
xor edx, 0x3238
pop edx
push ecx
jmp 0x427360
pop ecx
push ebx
sub ebx, 0x8778
jmp 0x42736e
pop ebx
mov dword [ebp - 0x10], 1
push eax
xor eax, 0xc8b4
or eax, 0x161a9
jmp 0x42738b
or eax, 0xa3cb
pop eax
push edx
and edx, 0x11036
pop edx
push eax
add eax, 0x17bb4
and eax, 0xb6ee
pop eax
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push ecx
push eax
add esp, 4
jmp 0x4273e0
pop ecx
push edx
push ebx
add esp, 4
jmp 0x4273ec
or edx, 0x16731
call 0x427402
add byte [edx + 0x4c], cl
inc ebx
dec ebx
push eax
inc eax
push eax
aaa
cmp dword [ebx], edi
add esp, 4
pop edx
push edi
jmp 0x427410
call 0x42741c
add byte [esi + 0x43], al
dec edi
inc eax
inc edi
add esp, 4
pop edi
push esi
push eax
add esp, 4
and esi, 0x16bc7
and esi, 0x9d66
xor esi, 0xe3a3
pop esi
mov dword [ebp - 0x2c], 1
push eax
or eax, 0x390c
pop eax
push esi
push edi
add esp, 4
or esi, 0xf127
and esi, 0x158a9
pop esi
push ecx
call 0x427467
add byte [esi + 0x4c], al
dec edx
aaa
cmp al, byte [edi + 0x40]
add esp, 4
xor ecx, 0x1b15
pop ecx
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x138
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x427652
Function at 0x42b2e1
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x20
push ebx
push esi
push edi
lea ecx, [esp + 0x18]
call fcn.0040c060
mov ecx, 1
mov esi, dword [0x4a8e90]
mov edi, dword [0x4a8ec4]
cmp ecx, esi
jg 0x40d6a6
mov eax, ecx
inc ecx
test eax, eax
jle 0x40d6a6
shl eax, 4
add eax, edi
je 0x40d6a6
mov ebx, eax
lea eax, [ecx - 1]
mov dword [0x4a8014], eax
mov edx, dword [ebx + 4]
mov eax, dword [edx]
cmp word [eax + 8], 0
mov dword [esp + 0x10], ecx
jne 0x40d5f0
cmp dword [eax], 0x20
jne 0x40d5f0
mov edx, dword [edx + 4]
cmp word [edx + 8], 0x34
jne 0x42b2c4
mov ecx, dword [edx]
push ecx
lea esi, [esp + 0x1c]
call fcn.0040df50
mov edi, dword [esp + 0x18]
sub esp, 0x10
mov esi, esp
call fcn.00401b70
mov eax, 0x4a8054
call fcn.0040f1a0
test eax, eax
jne 0x42b2ca
mov edx, dword [ebx + 4]
mov eax, dword [edx + 8]
cmp word [eax + 8], 0x47
jne 0x42b2c4
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
push ebx
mov dword [esp + 0x24], 3
call fcn.0040da10
test eax, eax
jne 0x42b2db
mov ecx, dword [esp + 0x10]
jmp 0x40d5e4
mov esi, 0x4a8054
call fcn.00410470
lea ecx, [esp + 0x18]
call fcn.00402620
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x20
ret
jmp 0x5396b2c8
les eax, [ecx + eax*4]
ret
dec edx
xor eax, 0x83463d4e
les eax, [ebx + ebx*2]
Function at 0x42ba5c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x40b8af
mov eax, dword [esi + 0x18]
push edi
mov edi, ecx
test eax, eax
je 0x40b81d
push eax
call fcn.0040b800
mov eax, dword [esi + 0x1c]
test eax, eax
jne 0x40b8d5
cmp byte [esi + 0x10], 0
jne 0x40b884
mov edi, dword [esi + 0x14]
test edi, edi
je 0x40b884
push ebx
mov ebx, dword [edi + 0xc]
test ebx, ebx
jne 0x40b8b3
mov eax, dword [edi + 8]
pop ebx
cmp eax, 8
je 0x42ba02
cmp eax, 0xa
je 0x42ba23
cmp eax, 5
je 0x40b8f8
cmp eax, 0xb
je 0x42ba38
cmp eax, 0xc
je 0x42ba53
push edi
mov dword [edi + 8], 1
mov dword [edi], 0
call fcn.004112ef
add esp, 4
mov eax, dword [esi + 0xc]
dec dword [eax]
mov ecx, dword [esi + 0xc]
cmp dword [ecx], 0
pop edi
jne 0x40b8a6
mov edx, dword [esi]
push edx
call fcn.004112ef
mov eax, dword [esi + 0xc]
push eax
call fcn.004112ef
add esp, 8
push esi
call fcn.004112ef
add esp, 4
pop esi
ret 4
mov eax, dword [ebx + 0xc]
dec dword [eax]
mov eax, dword [ebx + 0xc]
cmp dword [eax], 0
je 0x40b8e2
push ebx
call fcn.004112ef
add esp, 4
mov dword [edi + 0xc], 0
jmp 0x40b83d
push eax
mov ecx, edi
call fcn.0040b800
jmp 0x40b828
mov ecx, dword [ebx]
push ecx
call fcn.004112ef
mov edx, dword [ebx + 0xc]
push edx
call fcn.004112ef
add esp, 8
jmp 0x40b8c0
mov eax, edi
call fcn.0040e380
jmp 0x40b86e
invalid
or al, bh
test dword [eax], esp
jmp 0x42ba28
invalid
invalid
add byte [edx + esi + 0x32], cl
xor edi, dword [ebx]
push eax
xor eax, 0x4c4833f
add esp, 4
call 0x42ba6b
add byte [esi + 0x32], al
inc esi
inc edi
push eax
add esp, 4
and edi, 0x161b
pop edi
mov ecx, dword [ebp - 0x4d8]
mov dword [ebp - 0x6ec], ecx
jmp 0x42baeb