joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
nop
je 0x42e072
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x72347352
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x42e060
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x42e0d2
nop
mov ebx, 0x42cd70
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x68e16478
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
loop 0x42e0c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219

Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
mov ebx, 0x40915c
nop
mov ecx, 0x64670dd7
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x431024
nop
nop
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x42f3f8
mov ecx, 0x23a3b83
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x431084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408ecc
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x14352d99
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x6edd4ef8
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x4080d0
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x13379797
pop eax
mov dword [ebp - 0x3c0], eax
push eax
push edx
add esp, 4
and eax, 0xc629
xor eax, 0x4160
pop eax
push esi
add esi, 0x16f76
call 0x40802f
add byte [edi], bh
dec esp
xor eax, 0x42404e43
aaa
add esp, 4
and esi, 0x98b7
pop esi
mov ecx, dword [ebp - 0x1fa0]
mov dword [ebp - 0x14b8], ecx
push edx
add edx, 0x14103
pop edx
push edx
push ecx
add esp, 4
add edx, 0x5bd
xor edx, 0x1609c
pop edx
push esi
push eax
add esp, 4
or esi, 0x17e14
and esi, 0x2c0f
or esi, 0x2162
pop esi
mov edx, dword [ebp - 0x14]
add edx, 0x138
imul eax, dword [ebp - 0x10], 0x138
add eax, 0x44f3644b
imul ecx, dword [ebp - 0x10], 0x138
sub eax, ecx
xor edx, eax
imul edx, dword [ebp - 0x10]
mov dword [ebp - 0x14b8], edx
mov edx, dword [ebp - 0x3c0]
mov dword [ebp - 0x1ef8], edx
mov eax, dword [ebp - 0x1ef8]
add eax, dword [ebp - 0x14b8]
mov dword [ebp - 0x3c0], eax
push ebx
call 0x4080d0
add byte [eax + 0x39], dl
cmp byte [ebp + 0x50], al
dec ebp
inc esi
dec edx
xor al, byte [ebx - 0x3c7efb3c]
pop ds
add eax, dword [eax]
add bl, ch
add edi, dword [ebx]
cmp al, 0x3f
or ebx, 0x15871
pop ebx
push edi
push ebx
add esp, 4
jmp 0x4080f0
pop edi
mov byte [ebp - 0xb78], 0x52
mov byte [ebp - 0xb77], 0xb9
mov byte [ebp - 0xb76], 0x10
mov byte [ebp - 0xb75], 0x10
mov byte [ebp - 0xb74], 0x10
mov byte [ebp - 0xb73], 0x10
mov byte [ebp - 0xb72], 0x5a
push ebx
jmp 0x40812a
or ebx, 0x7af8
sub ebx, 0x10a83
pop ebx
push ebx
jmp 0x408141
pop ebx
push ebx
push edx
add esp, 4
or ebx, 0x17e53
and ebx, 0xbc80
pop ebx
mov byte [ebp - 0xb80], 0x52
mov byte [ebp - 0xb7f], 0xb9
mov byte [ebp - 0xb7e], 0x20
mov byte [ebp - 0xb7d], 0x20
mov byte [ebp - 0xb7c], 0x20
mov byte [ebp - 0xb7b], 0x20
mov byte [ebp - 0xb7a], 0x5a
push ecx
and ecx, 0x17ee9
xor ecx, 0x10846
pop ecx
push edi
push eax
add esp, 4
or edi, 0xc50c
and edi, 0x16ad
add edi, 0x12a6f
pop edi
push eax
push ebx
add esp, 4
add eax, 0x10f28
pop eax
mov dword [ebp - 0x1fa4], 0xe
push ebx
push edx
add esp, 4
and ebx, 0x13de3
sub ebx, 0x6c46
pop ebx
push ebx
push edi
add esp, 4
and ebx, 0x4280
sub ebx, 0x16377
jmp 0x4081ea
pop ebx
push edx
and edx, 0xaca9
pop edx
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xb78]
mov dword [ebp - 0x14bc], eax
push ebx
or ebx, 0x31ae
sub ebx, 0x6d54
add ebx, 0x14265
pop ebx
push esi
or esi, 0x10a3c
call 0x408231
add byte [eax + 0x43], cl
xor bh, byte [eax]
cmp dh, byte [esi]
inc ebx
add esp, 4
jmp 0x408239
pop esi
mov dword [ebp - 0x1fa8], 0xffffffff
push edi
push edx
add esp, 4
and edi, 0x28e
xor edi, 0x4977
pop edi
push esi
push ebx
add esp, 4
add al, 0xeb
invalid
Function at 0x408231
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x13379797
pop eax
mov dword [ebp - 0x3c0], eax
push eax
push edx
add esp, 4
and eax, 0xc629
xor eax, 0x4160
pop eax
push esi
add esi, 0x16f76
call 0x40802f
add byte [edi], bh
dec esp
xor eax, 0x42404e43
aaa
add esp, 4
and esi, 0x98b7
pop esi
mov ecx, dword [ebp - 0x1fa0]
mov dword [ebp - 0x14b8], ecx
push edx
add edx, 0x14103
pop edx
push edx
push ecx
add esp, 4
add edx, 0x5bd
xor edx, 0x1609c
pop edx
push esi
push eax
add esp, 4
or esi, 0x17e14
and esi, 0x2c0f
or esi, 0x2162
pop esi
mov edx, dword [ebp - 0x14]
add edx, 0x138
imul eax, dword [ebp - 0x10], 0x138
add eax, 0x44f3644b
imul ecx, dword [ebp - 0x10], 0x138
sub eax, ecx
xor edx, eax
imul edx, dword [ebp - 0x10]
mov dword [ebp - 0x14b8], edx
mov edx, dword [ebp - 0x3c0]
mov dword [ebp - 0x1ef8], edx
mov eax, dword [ebp - 0x1ef8]
add eax, dword [ebp - 0x14b8]
mov dword [ebp - 0x3c0], eax
push ebx
call 0x4080d0
add byte [eax + 0x39], dl
cmp byte [ebp + 0x50], al
dec ebp
inc esi
dec edx
xor al, byte [ebx - 0x3c7efb3c]
pop ds
add eax, dword [eax]
add bl, ch
add edi, dword [ebx]
cmp al, 0x3f
or ebx, 0x15871
pop ebx
push edi
push ebx
add esp, 4
jmp 0x4080f0
pop edi
mov byte [ebp - 0xb78], 0x52
mov byte [ebp - 0xb77], 0xb9
mov byte [ebp - 0xb76], 0x10
mov byte [ebp - 0xb75], 0x10
mov byte [ebp - 0xb74], 0x10
mov byte [ebp - 0xb73], 0x10
mov byte [ebp - 0xb72], 0x5a
push ebx
jmp 0x40812a
or ebx, 0x7af8
sub ebx, 0x10a83
pop ebx
push ebx
jmp 0x408141
pop ebx
push ebx
push edx
add esp, 4
or ebx, 0x17e53
and ebx, 0xbc80
pop ebx
mov byte [ebp - 0xb80], 0x52
mov byte [ebp - 0xb7f], 0xb9
mov byte [ebp - 0xb7e], 0x20
mov byte [ebp - 0xb7d], 0x20
mov byte [ebp - 0xb7c], 0x20
mov byte [ebp - 0xb7b], 0x20
mov byte [ebp - 0xb7a], 0x5a
push ecx
and ecx, 0x17ee9
xor ecx, 0x10846
pop ecx
push edi
push eax
add esp, 4
or edi, 0xc50c
and edi, 0x16ad
add edi, 0x12a6f
pop edi
push eax
push ebx
add esp, 4
add eax, 0x10f28
pop eax
mov dword [ebp - 0x1fa4], 0xe
push ebx
push edx
add esp, 4
and ebx, 0x13de3
sub ebx, 0x6c46
pop ebx
push ebx
push edi
add esp, 4
and ebx, 0x4280
sub ebx, 0x16377
jmp 0x4081ea
pop ebx
push edx
and edx, 0xaca9
pop edx
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xb78]
mov dword [ebp - 0x14bc], eax
push ebx
or ebx, 0x31ae
sub ebx, 0x6d54
add ebx, 0x14265
pop ebx
push esi
or esi, 0x10a3c
call 0x408231
add byte [eax + 0x43], cl
xor bh, byte [eax]
cmp dh, byte [esi]
inc ebx
add esp, 4
jmp 0x408239
pop esi
mov dword [ebp - 0x1fa8], 0xffffffff
push edi
push edx
add esp, 4
and edi, 0x28e
xor edi, 0x4977
pop edi
push esi
push ebx
add esp, 4
add al, 0xeb
invalid
Function at 0x40870c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x4d0]
add edx, 1
mov dword [ebp - 0x4d0], edx
and edi, 0x812f
and edi, 0xde50
pop edi
push eax
and eax, 0xac92
pop eax
push ecx
and ecx, 0x3563
xor ecx, 0x3bb0
pop ecx
push edi
jmp 0x408735
jmp 0x40873c
pop edi
mov edx, dword [ebp - 0x14c8]
mov dword [ebp - 0x9f0], edx
mov dword [ebp - 0xc14], 0
mov eax, dword [ebp - 0x4d0]
cmp eax, dword [ebp - 0x14c8]
jne 0x4087a4
push edx
sub edx, 0xc888
and edx, 0x7129
xor edx, 0x30d0
invalid

Function at 0x4087c1
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp dword [ebp - 0xc10], 0
jle 0x4088c9
push ecx
push edi
add esp, 4
and ecx, 0xb594
add ecx, 0x116b2
add byte [ecx + 0x104f8c1], al
add byte [ecx + 0x53], bl
add byte [ecx + 0x104f8c1], al
add byte [ecx + 0x53], bl
and ebx, 0xa65c
and ebx, 0x566a
sub ebx, 0x18a7
add ebx, 0xd1e1
pop ebx
mov edx, dword [ebp - 0xa60]
movzx eax, byte [edx]
invalid
invalid

Function at 0x408872
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or edi, 0xfaaa
pop edi
push ebx
push esi
add esp, 4
xor ebx, 0xc9d3
call 0x408893
add byte [edx + 0x46], al
inc ebx
inc esp
xor al, 0x50
add esp, 4
pop ebx
mov edx, dword [ebp - 0xc10]
sub edx, 1
mov dword [ebp - 0xc10], edx
mov eax, dword [ebp - 0xa60]
add eax, 1
mov dword [ebp - 0xa60], eax
mov ecx, dword [ebp - 0x9f0]
add ecx, 1
mov dword [ebp - 0x9f0], ecx
jmp 0x4087a4

Function at 0x408893
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or edi, 0xfaaa
pop edi
push ebx
push esi
add esp, 4
xor ebx, 0xc9d3
call 0x408893
add byte [edx + 0x46], al
inc ebx
inc esp
xor al, 0x50
add esp, 4
pop ebx
mov edx, dword [ebp - 0xc10]
sub edx, 1
mov dword [ebp - 0xc10], edx
mov eax, dword [ebp - 0xa60]
add eax, 1
mov dword [ebp - 0xa60], eax
mov ecx, dword [ebp - 0x9f0]
add ecx, 1
mov dword [ebp - 0x9f0], ecx
jmp 0x4087a4

Function at 0x408900
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
and edx, 0x519a
or edx, 0x2ea6
pop edx
mov eax, dword [ebp - 0x4d0]
mov dword [ebp - 0xa5c], eax
jmp 0x40895f
Function at 0x408c5e
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
call fcn.00408c5e
add byte [0x414b4950], dh
cmp eax, 0x4e4d463a
add esp, 4
and ebx, 0x1606b
sub ebx, 0x18527
call 0x408c7b
add byte [esi + ecx*2], dh
aas
dec edx
dec eax
cmp al, 0x44
add esp, 4
pop ebx
mov eax, dword [ebp - 0xc18]
mov cx, word [eax]
mov word [ebp - 0xf7e], cx
mov edx, dword [ebp - 0xc18]
add edx, 2
mov dword [ebp - 0xc18], edx
mov ax, word [ebp - 0xf7e]
mov word [ebp - 0x1f8], ax
mov ecx, dword [ebp - 0xc1c]
mov dx, word [ecx]
mov word [ebp - 0xf80], dx
mov eax, dword [ebp - 0xc1c]
add eax, 2
mov dword [ebp - 0xc1c], eax
mov cx, word [ebp - 0xf80]
mov word [ebp - 0x100], cx
push ebx
call 0x408ce8
add byte [ebp + 0x36], cl
inc ebx
dec edx
cmp edi, dword [eax]
dec edx
push eax
add esp, 4
pop ebx
push ebx
add ebx, 0xda24
pop ebx
push edx
sub edx, 0xa987
jmp 0x408d04
sub edx, 0x10ed3
pop edx
movzx edx, word [ebp - 0x100]
test edx, edx
jne 0x408d2e
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
sub eax, ecx
mov dword [ebp - 0x1498], eax
jmp 0x408d91
movzx edx, word [ebp - 0x1f8]
movzx eax, word [ebp - 0x100]
cmp edx, eax
je 0x408c4d
movzx ecx, word [ebp - 0x1f8]
xor ecx, 0x20
movzx edx, word [ebp - 0x100]
cmp ecx, edx
je 0x408c4d
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
cmp eax, ecx
jge 0x408d7b
mov dword [ebp - 0x14d8], 0xffffffff
jmp 0x408d85
mov dword [ebp - 0x14d8], 1
mov edx, dword [ebp - 0x14d8]
mov dword [ebp - 0x1498], edx
cmp dword [ebp - 0x1498], 0
jne 0x408dda
push ebx
push edx
add esp, 4
and ebx, 0x871b
add ebx, 0x3a4
jmp 0x408db2
pop ebx
push edi
or edi, 0x198a
call 0x408dc8
add byte [edi], dh
dec ebp
xor esi, dword [eax + edx*2]
aaa
add esp, 4
pop edi
mov eax, dword [ebp - 0x4d4]
mov dword [ebp - 0x2e0], eax
jmp 0x408e42
push ecx
or ecx, 0xe981
or ecx, 0x1403f
and ecx, 0x45b9
pop ecx
push ebx
and ebx, 0x8db
call 0x408e02
add byte [ebx], bh
xor dh, byte [edi]
dec eax
cmp al, 0x33
inc ecx
add esp, 4
and ebx, 0x11a3d
pop ebx
mov ecx, dword [ebp - 0x4d4]
mov edx, dword [ecx]
mov dword [ebp - 0x4d4], edx
mov eax, dword [ebp - 0x4d4]
cmp eax, dword [ebp - 0xc20]
je 0x408e38
mov ecx, dword [ebp - 0x4d4]
cmp dword [ecx + 0x30], 0
jne 0x408bee
mov dword [ebp - 0x2e0], 0
Function at 0x408c7b
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
call fcn.00408c5e
add byte [0x414b4950], dh
cmp eax, 0x4e4d463a
add esp, 4
and ebx, 0x1606b
sub ebx, 0x18527
call 0x408c7b
add byte [esi + ecx*2], dh
aas
dec edx
dec eax
cmp al, 0x44
add esp, 4
pop ebx
mov eax, dword [ebp - 0xc18]
mov cx, word [eax]
mov word [ebp - 0xf7e], cx
mov edx, dword [ebp - 0xc18]
add edx, 2
mov dword [ebp - 0xc18], edx
mov ax, word [ebp - 0xf7e]
mov word [ebp - 0x1f8], ax
mov ecx, dword [ebp - 0xc1c]
mov dx, word [ecx]
mov word [ebp - 0xf80], dx
mov eax, dword [ebp - 0xc1c]
add eax, 2
mov dword [ebp - 0xc1c], eax
mov cx, word [ebp - 0xf80]
mov word [ebp - 0x100], cx
push ebx
call 0x408ce8
add byte [ebp + 0x36], cl
inc ebx
dec edx
cmp edi, dword [eax]
dec edx
push eax
add esp, 4
pop ebx
push ebx
add ebx, 0xda24
pop ebx
push edx
sub edx, 0xa987
jmp 0x408d04
sub edx, 0x10ed3
pop edx
movzx edx, word [ebp - 0x100]
test edx, edx
jne 0x408d2e
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
sub eax, ecx
mov dword [ebp - 0x1498], eax
jmp 0x408d91
movzx edx, word [ebp - 0x1f8]
movzx eax, word [ebp - 0x100]
cmp edx, eax
je 0x408c4d
movzx ecx, word [ebp - 0x1f8]
xor ecx, 0x20
movzx edx, word [ebp - 0x100]
cmp ecx, edx
je 0x408c4d
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
cmp eax, ecx
jge 0x408d7b
mov dword [ebp - 0x14d8], 0xffffffff
jmp 0x408d85
mov dword [ebp - 0x14d8], 1
mov edx, dword [ebp - 0x14d8]
mov dword [ebp - 0x1498], edx
cmp dword [ebp - 0x1498], 0
jne 0x408dda
push ebx
push edx
add esp, 4
and ebx, 0x871b
add ebx, 0x3a4
jmp 0x408db2
pop ebx
push edi
or edi, 0x198a
call 0x408dc8
add byte [edi], dh
dec ebp
xor esi, dword [eax + edx*2]
aaa
add esp, 4
pop edi
mov eax, dword [ebp - 0x4d4]
mov dword [ebp - 0x2e0], eax
jmp 0x408e42
push ecx
or ecx, 0xe981
or ecx, 0x1403f
and ecx, 0x45b9
pop ecx
push ebx
and ebx, 0x8db
call 0x408e02
add byte [ebx], bh
xor dh, byte [edi]
dec eax
cmp al, 0x33
inc ecx
add esp, 4
and ebx, 0x11a3d
pop ebx
mov ecx, dword [ebp - 0x4d4]
mov edx, dword [ecx]
mov dword [ebp - 0x4d4], edx
mov eax, dword [ebp - 0x4d4]
cmp eax, dword [ebp - 0xc20]
je 0x408e38
mov ecx, dword [ebp - 0x4d4]
cmp dword [ecx + 0x30], 0
jne 0x408bee
mov dword [ebp - 0x2e0], 0
Function at 0x408ce8
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
call fcn.00408c5e
add byte [0x414b4950], dh
cmp eax, 0x4e4d463a
add esp, 4
and ebx, 0x1606b
sub ebx, 0x18527
call 0x408c7b
add byte [esi + ecx*2], dh
aas
dec edx
dec eax
cmp al, 0x44
add esp, 4
pop ebx
mov eax, dword [ebp - 0xc18]
mov cx, word [eax]
mov word [ebp - 0xf7e], cx
mov edx, dword [ebp - 0xc18]
add edx, 2
mov dword [ebp - 0xc18], edx
mov ax, word [ebp - 0xf7e]
mov word [ebp - 0x1f8], ax
mov ecx, dword [ebp - 0xc1c]
mov dx, word [ecx]
mov word [ebp - 0xf80], dx
mov eax, dword [ebp - 0xc1c]
add eax, 2
mov dword [ebp - 0xc1c], eax
mov cx, word [ebp - 0xf80]
mov word [ebp - 0x100], cx
push ebx
call 0x408ce8
add byte [ebp + 0x36], cl
inc ebx
dec edx
cmp edi, dword [eax]
dec edx
push eax
add esp, 4
pop ebx
push ebx
add ebx, 0xda24
pop ebx
push edx
sub edx, 0xa987
jmp 0x408d04
sub edx, 0x10ed3
pop edx
movzx edx, word [ebp - 0x100]
test edx, edx
jne 0x408d2e
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
sub eax, ecx
mov dword [ebp - 0x1498], eax
jmp 0x408d91
movzx edx, word [ebp - 0x1f8]
movzx eax, word [ebp - 0x100]
cmp edx, eax
je 0x408c4d
movzx ecx, word [ebp - 0x1f8]
xor ecx, 0x20
movzx edx, word [ebp - 0x100]
cmp ecx, edx
je 0x408c4d
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
cmp eax, ecx
jge 0x408d7b
mov dword [ebp - 0x14d8], 0xffffffff
jmp 0x408d85
mov dword [ebp - 0x14d8], 1
mov edx, dword [ebp - 0x14d8]
mov dword [ebp - 0x1498], edx
cmp dword [ebp - 0x1498], 0
jne 0x408dda
push ebx
push edx
add esp, 4
and ebx, 0x871b
add ebx, 0x3a4
jmp 0x408db2
pop ebx
push edi
or edi, 0x198a
call 0x408dc8
add byte [edi], dh
dec ebp
xor esi, dword [eax + edx*2]
aaa
add esp, 4
pop edi
mov eax, dword [ebp - 0x4d4]
mov dword [ebp - 0x2e0], eax
jmp 0x408e42
push ecx
or ecx, 0xe981
or ecx, 0x1403f
and ecx, 0x45b9
pop ecx
push ebx
and ebx, 0x8db
call 0x408e02
add byte [ebx], bh
xor dh, byte [edi]
dec eax
cmp al, 0x33
inc ecx
add esp, 4
and ebx, 0x11a3d
pop ebx
mov ecx, dword [ebp - 0x4d4]
mov edx, dword [ecx]
mov dword [ebp - 0x4d4], edx
mov eax, dword [ebp - 0x4d4]
cmp eax, dword [ebp - 0xc20]
je 0x408e38
mov ecx, dword [ebp - 0x4d4]
cmp dword [ecx + 0x30], 0
jne 0x408bee
mov dword [ebp - 0x2e0], 0
Function at 0x408dc8
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
call fcn.00408c5e
add byte [0x414b4950], dh
cmp eax, 0x4e4d463a
add esp, 4
and ebx, 0x1606b
sub ebx, 0x18527
call 0x408c7b
add byte [esi + ecx*2], dh
aas
dec edx
dec eax
cmp al, 0x44
add esp, 4
pop ebx
mov eax, dword [ebp - 0xc18]
mov cx, word [eax]
mov word [ebp - 0xf7e], cx
mov edx, dword [ebp - 0xc18]
add edx, 2
mov dword [ebp - 0xc18], edx
mov ax, word [ebp - 0xf7e]
mov word [ebp - 0x1f8], ax
mov ecx, dword [ebp - 0xc1c]
mov dx, word [ecx]
mov word [ebp - 0xf80], dx
mov eax, dword [ebp - 0xc1c]
add eax, 2
mov dword [ebp - 0xc1c], eax
mov cx, word [ebp - 0xf80]
mov word [ebp - 0x100], cx
push ebx
call 0x408ce8
add byte [ebp + 0x36], cl
inc ebx
dec edx
cmp edi, dword [eax]
dec edx
push eax
add esp, 4
pop ebx
push ebx
add ebx, 0xda24
pop ebx
push edx
sub edx, 0xa987
jmp 0x408d04
sub edx, 0x10ed3
pop edx
movzx edx, word [ebp - 0x100]
test edx, edx
jne 0x408d2e
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
sub eax, ecx
mov dword [ebp - 0x1498], eax
jmp 0x408d91
movzx edx, word [ebp - 0x1f8]
movzx eax, word [ebp - 0x100]
cmp edx, eax
je 0x408c4d
movzx ecx, word [ebp - 0x1f8]
xor ecx, 0x20
movzx edx, word [ebp - 0x100]
cmp ecx, edx
je 0x408c4d
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
cmp eax, ecx
jge 0x408d7b
mov dword [ebp - 0x14d8], 0xffffffff
jmp 0x408d85
mov dword [ebp - 0x14d8], 1
mov edx, dword [ebp - 0x14d8]
mov dword [ebp - 0x1498], edx
cmp dword [ebp - 0x1498], 0
jne 0x408dda
push ebx
push edx
add esp, 4
and ebx, 0x871b
add ebx, 0x3a4
jmp 0x408db2
pop ebx
push edi
or edi, 0x198a
call 0x408dc8
add byte [edi], dh
dec ebp
xor esi, dword [eax + edx*2]
aaa
add esp, 4
pop edi
mov eax, dword [ebp - 0x4d4]
mov dword [ebp - 0x2e0], eax
jmp 0x408e42
push ecx
or ecx, 0xe981
or ecx, 0x1403f
and ecx, 0x45b9
pop ecx
push ebx
and ebx, 0x8db
call 0x408e02
add byte [ebx], bh
xor dh, byte [edi]
dec eax
cmp al, 0x33
inc ecx
add esp, 4
and ebx, 0x11a3d
pop ebx
mov ecx, dword [ebp - 0x4d4]
mov edx, dword [ecx]
mov dword [ebp - 0x4d4], edx
mov eax, dword [ebp - 0x4d4]
cmp eax, dword [ebp - 0xc20]
je 0x408e38
mov ecx, dword [ebp - 0x4d4]
cmp dword [ecx + 0x30], 0
jne 0x408bee
mov dword [ebp - 0x2e0], 0
Function at 0x408e02
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
call fcn.00408c5e
add byte [0x414b4950], dh
cmp eax, 0x4e4d463a
add esp, 4
and ebx, 0x1606b
sub ebx, 0x18527
call 0x408c7b
add byte [esi + ecx*2], dh
aas
dec edx
dec eax
cmp al, 0x44
add esp, 4
pop ebx
mov eax, dword [ebp - 0xc18]
mov cx, word [eax]
mov word [ebp - 0xf7e], cx
mov edx, dword [ebp - 0xc18]
add edx, 2
mov dword [ebp - 0xc18], edx
mov ax, word [ebp - 0xf7e]
mov word [ebp - 0x1f8], ax
mov ecx, dword [ebp - 0xc1c]
mov dx, word [ecx]
mov word [ebp - 0xf80], dx
mov eax, dword [ebp - 0xc1c]
add eax, 2
mov dword [ebp - 0xc1c], eax
mov cx, word [ebp - 0xf80]
mov word [ebp - 0x100], cx
push ebx
call 0x408ce8
add byte [ebp + 0x36], cl
inc ebx
dec edx
cmp edi, dword [eax]
dec edx
push eax
add esp, 4
pop ebx
push ebx
add ebx, 0xda24
pop ebx
push edx
sub edx, 0xa987
jmp 0x408d04
sub edx, 0x10ed3
pop edx
movzx edx, word [ebp - 0x100]
test edx, edx
jne 0x408d2e
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
sub eax, ecx
mov dword [ebp - 0x1498], eax
jmp 0x408d91
movzx edx, word [ebp - 0x1f8]
movzx eax, word [ebp - 0x100]
cmp edx, eax
je 0x408c4d
movzx ecx, word [ebp - 0x1f8]
xor ecx, 0x20
movzx edx, word [ebp - 0x100]
cmp ecx, edx
je 0x408c4d
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
cmp eax, ecx
jge 0x408d7b
mov dword [ebp - 0x14d8], 0xffffffff
jmp 0x408d85
mov dword [ebp - 0x14d8], 1
mov edx, dword [ebp - 0x14d8]
mov dword [ebp - 0x1498], edx
cmp dword [ebp - 0x1498], 0
jne 0x408dda
push ebx
push edx
add esp, 4
and ebx, 0x871b
add ebx, 0x3a4
jmp 0x408db2
pop ebx
push edi
or edi, 0x198a
call 0x408dc8
add byte [edi], dh
dec ebp
xor esi, dword [eax + edx*2]
aaa
add esp, 4
pop edi
mov eax, dword [ebp - 0x4d4]
mov dword [ebp - 0x2e0], eax
jmp 0x408e42
push ecx
or ecx, 0xe981
or ecx, 0x1403f
and ecx, 0x45b9
pop ecx
push ebx
and ebx, 0x8db
call 0x408e02
add byte [ebx], bh
xor dh, byte [edi]
dec eax
cmp al, 0x33
inc ecx
add esp, 4
and ebx, 0x11a3d
pop ebx
mov ecx, dword [ebp - 0x4d4]
mov edx, dword [ecx]
mov dword [ebp - 0x4d4], edx
mov eax, dword [ebp - 0x4d4]
cmp eax, dword [ebp - 0xc20]
je 0x408e38
mov ecx, dword [ebp - 0x4d4]
cmp dword [ecx + 0x30], 0
jne 0x408bee
mov dword [ebp - 0x2e0], 0
Function at 0x409254
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop esi
push esi
push edi
add esp, 4
call 0x409254
add byte [ecx + 0x3d], al
push eax
cmp edi, dword [0xc4833937]
add al, 0x81
into
add al, 0xeb
add byte [eax], al
pop esi
mov ecx, dword [ebp - 0x4d8]
mov dword [ebp - 0x6ec], ecx
jmp 0x4092d4