joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414e27
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
add ebx, 0x12753
jmp 0x414d72
or ebx, 0x29bc
pop ebx
mov ecx, dword [ebp - 0x2040]
mov dword [ebp - 0x15dc], ecx
push edi
call 0x414d93
add byte [eax + 0x4a], dl
inc eax
aas
inc edi
push eax
aaa
add esp, 4
xor edi, 0x3bc9
pop edi
push ecx
push ecx
add esp, 4
sub ecx, 0x16b60
add ecx, 0x10885
pop ecx
push esi
sub esi, 0x5715
pop esi
mov edx, dword [ebp - 0x10c]
add edx, 0xfe
imul eax, dword [ebp - 0x108], 0xfe
add eax, 0x56f3663b
imul ecx, dword [ebp - 0x108], 0xfe
sub eax, ecx
xor edx, eax
imul edx, dword [ebp - 0x108]
mov dword [ebp - 0x15dc], edx
mov edx, dword [ebp - 0x414]
mov dword [ebp - 0x202c], edx
mov eax, dword [ebp - 0x202c]
add eax, dword [ebp - 0x15dc]
mov dword [ebp - 0x414], eax
push esi
or esi, 0x1f8
or esi, 0xdbb3
call 0x414e27
add byte [esi + 0x4c], cl
cmp eax, 0x4f473543
cmp dh, byte [esi]
add esp, 4
pop esi
push ebx
push edi
add esp, 4
sub ebx, 0xba21
sub ebx, 0x619c
pop ebx
push eax
push ebx
add esp, 4
add eax, 0xb228
sub eax, 0xada5
pop eax
push ebx
or ebx, 0x8d9a
or ebx, 0x235
call 0x414e6b
add byte [0x3d37483b], dh
dec ecx
inc eax
inc esi
cmp eax, 0x5b04c483
mov byte [ebp - 0xc08], 0x51
mov byte [ebp - 0xc07], 0xb9
mov byte [ebp - 0xc06], 0x10
mov byte [ebp - 0xc05], 0x10
mov byte [ebp - 0xc04], 0x10
mov byte [ebp - 0xc03], 0x10
mov byte [ebp - 0xc02], 0x59
push esi
push ebx
add esp, 4
sub esi, 0x504f
sub esi, 0x12a7f
pop esi
push esi
push eax
add esp, 4
jmp 0x414ebd
xor esi, 0x12bd8
add esi, 0x180b0
pop esi
push esi
or esi, 0x5d09
pop esi
push edi
and edi, 0xd31e
xor edi, 0x13e3b
add edi, 0x319d
jmp 0x414eec
pop edi
push ecx
and ecx, 0x13857
call 0x414f00
add byte [edx], dh
aaa
dec ebp
xor al, byte [ebx + eax*4 - 0x3c]
add al, 0x59
mov byte [ebp - 0xc10], 0x51
mov byte [ebp - 0xc0f], 0xb9
mov byte [ebp - 0xc0e], 0x20
mov byte [ebp - 0xc0d], 0x20
mov byte [ebp - 0xc0c], 0x20
mov byte [ebp - 0xc0b], 0x20
mov byte [ebp - 0xc0a], 0x59
push edi
or edi, 0xa165
and edi, 0xdfe9
or edi, 0xa5c6
or edi, 0x1a38
pop edi
push ebx
push esi
add esp, 4
add ebx, 0x9258
xor ebx, 0x11a33
add ebx, 0xbf7
pop ebx
push esi
call 0x414f75
add byte [edx], dh
inc ebx
inc esp
xor eax, 0x833b3a4e
les eax, [ecx + eax*4]
mul al
sbb dword [eax], eax
add byte [ecx + 0x11ec5c6], al
add byte [esi + 0x50], bl
or eax, 0xb3d1
add byte [ecx + 0x1040f0], al
add byte [ecx + 0xfcc5c0], al
add byte [eax - 0x39], bl
test dword [edi + ebx*8 + 0xeffff], edi
add byte [eax], al
Function at 0x414e6b
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
add ebx, 0x12753
jmp 0x414d72
or ebx, 0x29bc
pop ebx
mov ecx, dword [ebp - 0x2040]
mov dword [ebp - 0x15dc], ecx
push edi
call 0x414d93
add byte [eax + 0x4a], dl
inc eax
aas
inc edi
push eax
aaa
add esp, 4
xor edi, 0x3bc9
pop edi
push ecx
push ecx
add esp, 4
sub ecx, 0x16b60
add ecx, 0x10885
pop ecx
push esi
sub esi, 0x5715
pop esi
mov edx, dword [ebp - 0x10c]
add edx, 0xfe
imul eax, dword [ebp - 0x108], 0xfe
add eax, 0x56f3663b
imul ecx, dword [ebp - 0x108], 0xfe
sub eax, ecx
xor edx, eax
imul edx, dword [ebp - 0x108]
mov dword [ebp - 0x15dc], edx
mov edx, dword [ebp - 0x414]
mov dword [ebp - 0x202c], edx
mov eax, dword [ebp - 0x202c]
add eax, dword [ebp - 0x15dc]
mov dword [ebp - 0x414], eax
push esi
or esi, 0x1f8
or esi, 0xdbb3
call 0x414e27
add byte [esi + 0x4c], cl
cmp eax, 0x4f473543
cmp dh, byte [esi]
add esp, 4
pop esi
push ebx
push edi
add esp, 4
sub ebx, 0xba21
sub ebx, 0x619c
pop ebx
push eax
push ebx
add esp, 4
add eax, 0xb228
sub eax, 0xada5
pop eax
push ebx
or ebx, 0x8d9a
or ebx, 0x235
call 0x414e6b
add byte [0x3d37483b], dh
dec ecx
inc eax
inc esi
cmp eax, 0x5b04c483
mov byte [ebp - 0xc08], 0x51
mov byte [ebp - 0xc07], 0xb9
mov byte [ebp - 0xc06], 0x10
mov byte [ebp - 0xc05], 0x10
mov byte [ebp - 0xc04], 0x10
mov byte [ebp - 0xc03], 0x10
mov byte [ebp - 0xc02], 0x59
push esi
push ebx
add esp, 4
sub esi, 0x504f
sub esi, 0x12a7f
pop esi
push esi
push eax
add esp, 4
jmp 0x414ebd
xor esi, 0x12bd8
add esi, 0x180b0
pop esi
push esi
or esi, 0x5d09
pop esi
push edi
and edi, 0xd31e
xor edi, 0x13e3b
add edi, 0x319d
jmp 0x414eec
pop edi
push ecx
and ecx, 0x13857
call 0x414f00
add byte [edx], dh
aaa
dec ebp
xor al, byte [ebx + eax*4 - 0x3c]
add al, 0x59
mov byte [ebp - 0xc10], 0x51
mov byte [ebp - 0xc0f], 0xb9
mov byte [ebp - 0xc0e], 0x20
mov byte [ebp - 0xc0d], 0x20
mov byte [ebp - 0xc0c], 0x20
mov byte [ebp - 0xc0b], 0x20
mov byte [ebp - 0xc0a], 0x59
push edi
or edi, 0xa165
and edi, 0xdfe9
or edi, 0xa5c6
or edi, 0x1a38
pop edi
push ebx
push esi
add esp, 4
add ebx, 0x9258
xor ebx, 0x11a33
add ebx, 0xbf7
pop ebx
push esi
call 0x414f75
add byte [edx], dh
inc ebx
inc esp
xor eax, 0x833b3a4e
les eax, [ecx + eax*4]
mul al
sbb dword [eax], eax
add byte [ecx + 0x11ec5c6], al
add byte [esi + 0x50], bl
or eax, 0xb3d1
add byte [ecx + 0x1040f0], al
add byte [ecx + 0xfcc5c0], al
add byte [eax - 0x39], bl
test dword [edi + ebx*8 + 0xeffff], edi
add byte [eax], al
Function at 0x414f00
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
add ebx, 0x12753
jmp 0x414d72
or ebx, 0x29bc
pop ebx
mov ecx, dword [ebp - 0x2040]
mov dword [ebp - 0x15dc], ecx
push edi
call 0x414d93
add byte [eax + 0x4a], dl
inc eax
aas
inc edi
push eax
aaa
add esp, 4
xor edi, 0x3bc9
pop edi
push ecx
push ecx
add esp, 4
sub ecx, 0x16b60
add ecx, 0x10885
pop ecx
push esi
sub esi, 0x5715
pop esi
mov edx, dword [ebp - 0x10c]
add edx, 0xfe
imul eax, dword [ebp - 0x108], 0xfe
add eax, 0x56f3663b
imul ecx, dword [ebp - 0x108], 0xfe
sub eax, ecx
xor edx, eax
imul edx, dword [ebp - 0x108]
mov dword [ebp - 0x15dc], edx
mov edx, dword [ebp - 0x414]
mov dword [ebp - 0x202c], edx
mov eax, dword [ebp - 0x202c]
add eax, dword [ebp - 0x15dc]
mov dword [ebp - 0x414], eax
push esi
or esi, 0x1f8
or esi, 0xdbb3
call 0x414e27
add byte [esi + 0x4c], cl
cmp eax, 0x4f473543
cmp dh, byte [esi]
add esp, 4
pop esi
push ebx
push edi
add esp, 4
sub ebx, 0xba21
sub ebx, 0x619c
pop ebx
push eax
push ebx
add esp, 4
add eax, 0xb228
sub eax, 0xada5
pop eax
push ebx
or ebx, 0x8d9a
or ebx, 0x235
call 0x414e6b
add byte [0x3d37483b], dh
dec ecx
inc eax
inc esi
cmp eax, 0x5b04c483
mov byte [ebp - 0xc08], 0x51
mov byte [ebp - 0xc07], 0xb9
mov byte [ebp - 0xc06], 0x10
mov byte [ebp - 0xc05], 0x10
mov byte [ebp - 0xc04], 0x10
mov byte [ebp - 0xc03], 0x10
mov byte [ebp - 0xc02], 0x59
push esi
push ebx
add esp, 4
sub esi, 0x504f
sub esi, 0x12a7f
pop esi
push esi
push eax
add esp, 4
jmp 0x414ebd
xor esi, 0x12bd8
add esi, 0x180b0
pop esi
push esi
or esi, 0x5d09
pop esi
push edi
and edi, 0xd31e
xor edi, 0x13e3b
add edi, 0x319d
jmp 0x414eec
pop edi
push ecx
and ecx, 0x13857
call 0x414f00
add byte [edx], dh
aaa
dec ebp
xor al, byte [ebx + eax*4 - 0x3c]
add al, 0x59
mov byte [ebp - 0xc10], 0x51
mov byte [ebp - 0xc0f], 0xb9
mov byte [ebp - 0xc0e], 0x20
mov byte [ebp - 0xc0d], 0x20
mov byte [ebp - 0xc0c], 0x20
mov byte [ebp - 0xc0b], 0x20
mov byte [ebp - 0xc0a], 0x59
push edi
or edi, 0xa165
and edi, 0xdfe9
or edi, 0xa5c6
or edi, 0x1a38
pop edi
push ebx
push esi
add esp, 4
add ebx, 0x9258
xor ebx, 0x11a33
add ebx, 0xbf7
pop ebx
push esi
call 0x414f75
add byte [edx], dh
inc ebx
inc esp
xor eax, 0x833b3a4e
les eax, [ecx + eax*4]
mul al
sbb dword [eax], eax
add byte [ecx + 0x11ec5c6], al
add byte [esi + 0x50], bl
or eax, 0xb3d1
add byte [ecx + 0x1040f0], al
add byte [ecx + 0xfcc5c0], al
add byte [eax - 0x39], bl
test dword [edi + ebx*8 + 0xeffff], edi
add byte [eax], al
Function at 0x414f75
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
add ebx, 0x12753
jmp 0x414d72
or ebx, 0x29bc
pop ebx
mov ecx, dword [ebp - 0x2040]
mov dword [ebp - 0x15dc], ecx
push edi
call 0x414d93
add byte [eax + 0x4a], dl
inc eax
aas
inc edi
push eax
aaa
add esp, 4
xor edi, 0x3bc9
pop edi
push ecx
push ecx
add esp, 4
sub ecx, 0x16b60
add ecx, 0x10885
pop ecx
push esi
sub esi, 0x5715
pop esi
mov edx, dword [ebp - 0x10c]
add edx, 0xfe
imul eax, dword [ebp - 0x108], 0xfe
add eax, 0x56f3663b
imul ecx, dword [ebp - 0x108], 0xfe
sub eax, ecx
xor edx, eax
imul edx, dword [ebp - 0x108]
mov dword [ebp - 0x15dc], edx
mov edx, dword [ebp - 0x414]
mov dword [ebp - 0x202c], edx
mov eax, dword [ebp - 0x202c]
add eax, dword [ebp - 0x15dc]
mov dword [ebp - 0x414], eax
push esi
or esi, 0x1f8
or esi, 0xdbb3
call 0x414e27
add byte [esi + 0x4c], cl
cmp eax, 0x4f473543
cmp dh, byte [esi]
add esp, 4
pop esi
push ebx
push edi
add esp, 4
sub ebx, 0xba21
sub ebx, 0x619c
pop ebx
push eax
push ebx
add esp, 4
add eax, 0xb228
sub eax, 0xada5
pop eax
push ebx
or ebx, 0x8d9a
or ebx, 0x235
call 0x414e6b
add byte [0x3d37483b], dh
dec ecx
inc eax
inc esi
cmp eax, 0x5b04c483
mov byte [ebp - 0xc08], 0x51
mov byte [ebp - 0xc07], 0xb9
mov byte [ebp - 0xc06], 0x10
mov byte [ebp - 0xc05], 0x10
mov byte [ebp - 0xc04], 0x10
mov byte [ebp - 0xc03], 0x10
mov byte [ebp - 0xc02], 0x59
push esi
push ebx
add esp, 4
sub esi, 0x504f
sub esi, 0x12a7f
pop esi
push esi
push eax
add esp, 4
jmp 0x414ebd
xor esi, 0x12bd8
add esi, 0x180b0
pop esi
push esi
or esi, 0x5d09
pop esi
push edi
and edi, 0xd31e
xor edi, 0x13e3b
add edi, 0x319d
jmp 0x414eec
pop edi
push ecx
and ecx, 0x13857
call 0x414f00
add byte [edx], dh
aaa
dec ebp
xor al, byte [ebx + eax*4 - 0x3c]
add al, 0x59
mov byte [ebp - 0xc10], 0x51
mov byte [ebp - 0xc0f], 0xb9
mov byte [ebp - 0xc0e], 0x20
mov byte [ebp - 0xc0d], 0x20
mov byte [ebp - 0xc0c], 0x20
mov byte [ebp - 0xc0b], 0x20
mov byte [ebp - 0xc0a], 0x59
push edi
or edi, 0xa165
and edi, 0xdfe9
or edi, 0xa5c6
or edi, 0x1a38
pop edi
push ebx
push esi
add esp, 4
add ebx, 0x9258
xor ebx, 0x11a33
add ebx, 0xbf7
pop ebx
push esi
call 0x414f75
add byte [edx], dh
inc ebx
inc esp
xor eax, 0x833b3a4e
les eax, [ecx + eax*4]
mul al
sbb dword [eax], eax
add byte [ecx + 0x11ec5c6], al
add byte [esi + 0x50], bl
or eax, 0xb3d1
add byte [ecx + 0x1040f0], al
add byte [ecx + 0xfcc5c0], al
add byte [eax - 0x39], bl
test dword [edi + ebx*8 + 0xeffff], edi
add byte [eax], al
Function at 0x4166d7
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edx
sub edx, 0x141f
add edx, 0x9782
or edx, 0x8d62
sub edx, 0xf9c3
pop edx
push edx
push edi
add esp, 4
xor edx, 0x7942
and edx, 0x17006
sub edx, 0x11205
pop edx
lea edx, [ebp - 0x1770]
mov dword [ebp - 0xccc], edx
mov eax, dword [ebp - 0x450]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcc8], ecx
xor edx, edx
mov word [ebp - 0x1c4], dx
xor eax, eax
mov word [ebp - 0x30], ax
push esi
jmp 0x4166c7
call 0x4166d7
add byte [eax + 0x46], al
cmp byte [edi], bh
cmp byte [ebx + edi], dh
cmp byte [eax], bh
inc ebp
add esp, 4
sub esi, 0x9752
or esi, 0x3c0e
pop esi
push edx
push edx
add esp, 4
add edx, 0xbc8a
pop edx
mov ecx, dword [ebp - 0xcc8]
mov dx, word [ecx]
mov word [ebp - 0x104e], dx
mov eax, dword [ebp - 0xcc8]
add eax, 2
mov dword [ebp - 0xcc8], eax
mov cx, word [ebp - 0x104e]
mov word [ebp - 0x1c4], cx
mov edx, dword [ebp - 0xccc]
mov ax, word [edx]
mov word [ebp - 0x1064], ax
mov ecx, dword [ebp - 0xccc]
add ecx, 2
mov dword [ebp - 0xccc], ecx
mov dx, word [ebp - 0x1064]
cmp edx, eax
je 0x4166c1
movzx ecx, word [ebp - 0x1c4]
movzx edx, word [ebp - 0x30]
cmp ecx, edx
jge 0x4167dd
mov dword [ebp - 0x1620], 0xffffffff
jmp 0x4167e7
mov dword [ebp - 0x1620], 1
mov eax, dword [ebp - 0x1620]
mov dword [ebp - 0x1624], eax
cmp dword [ebp - 0x1624], 0
jne 0x41683c
push edx
push edx
add esp, 4
call 0x41680d
add byte [ecx + 0x50], al
cmp dword ds:[eax + 0x36], ecx
add esp, 4
jmp 0x416817
pop edx
push edi
push edi
add esp, 4
jmp 0x416825
pop edi
push eax
add eax, 0xa692
pop eax
mov ecx, dword [ebp - 0x450]
mov dword [ebp - 0x2f8], ecx
jmp 0x4168a4
push eax
xor eax, 0xe758
pop eax
push edi
push edx
add esp, 4
or edi, 0xdfd5
pop edi
push ebx
push eax
add esp, 4
or ebx, 0x12d37
sub ebx, 0x9c7a
or ebx, 0x76de
add ebx, 0xabaf
pop ebx
mov edx, dword [ebp - 0x450]
mov eax, dword [edx]
mov dword [ebp - 0x450], eax
mov ecx, dword [ebp - 0x450]
cmp ecx, dword [ebp - 0xcd0]
je 0x41689a
mov edx, dword [ebp - 0x450]
cmp dword [edx + 0x30], 0
jne 0x416665
mov dword [ebp - 0x2f8], 0
push edi
push edi
add esp, 4
jmp 0x4168af
and edi, 0x2913
sub edi, 0x73e2
pop edi
push edx
push edi
add esp, 4
or edx, 0x154ae
and edx, 0xb297
pop edx
push esi
and esi, 0x10cbf
pop esi
mov eax, dword [ebp - 0x2f8]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x398], ecx
push edi
add edi, 0x121e4
or edi, 0x151aa
jmp 0x4168f8
pop edi
push ecx
push edx
add esp, 4
and ecx, 0x811f
and ecx, 0x14d5b
xor ecx, 0x5c7c
or ecx, 0x3c1e
pop ecx
mov dword [ebp - 0x780], 0
mov edx, dword [ebp - 0x398]
mov dword [ebp - 0x1628], edx
cmp dword [ebp - 0x1628], 0
jne 0x416947
mov eax, dword [ebp - 0x780]
mov dword [ebp - 0x44c], eax
jmp 0x416c38
mov ecx, dword [ebp - 0x1628]
mov edx, dword [ebp - 0x398]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x162c], edx
jne 0x41696f
mov eax, dword [ebp - 0x780]
invalid
invalid
mov ah, 0xfb
invalid
Function at 0x416767
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov word [ebp - 0x30], dx
push edi
jmp 0x416752
jmp 0x41675b
call 0x416767
add byte [ebx + 0x34], al
inc esi
cmp eax, 0x5f04c483
push edx
call 0x416778
add byte [0x494b3d38], bh
dec ecx
add esp, 4
pop edx
movzx eax, word [ebp - 0x30]
test eax, eax
jne 0x416799
movzx ecx, word [ebp - 0x1c4]
movzx edx, word [ebp - 0x30]
sub ecx, edx
mov dword [ebp - 0x1624], ecx
jmp 0x4167f3
movzx eax, word [ebp - 0x1c4]
movzx ecx, word [ebp - 0x30]
cmp eax, ecx
je 0x4166c1
movzx edx, word [ebp - 0x1c4]
xor edx, 0x20
movzx eax, word [ebp - 0x30]

Function at 0x416778
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov word [ebp - 0x30], dx
push edi
jmp 0x416752
jmp 0x41675b
call 0x416767
add byte [ebx + 0x34], al
inc esi
cmp eax, 0x5f04c483
push edx
call 0x416778
add byte [0x494b3d38], bh
dec ecx
add esp, 4
pop edx
movzx eax, word [ebp - 0x30]
test eax, eax
jne 0x416799
movzx ecx, word [ebp - 0x1c4]
movzx edx, word [ebp - 0x30]
sub ecx, edx
mov dword [ebp - 0x1624], ecx
jmp 0x4167f3
movzx eax, word [ebp - 0x1c4]
movzx ecx, word [ebp - 0x30]
cmp eax, ecx
je 0x4166c1
movzx edx, word [ebp - 0x1c4]
xor edx, 0x20
movzx eax, word [ebp - 0x30]
Function at 0x4167ba
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edx
sub edx, 0x141f
add edx, 0x9782
or edx, 0x8d62
sub edx, 0xf9c3
pop edx
push edx
push edi
add esp, 4
xor edx, 0x7942
and edx, 0x17006
sub edx, 0x11205
pop edx
lea edx, [ebp - 0x1770]
mov dword [ebp - 0xccc], edx
mov eax, dword [ebp - 0x450]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcc8], ecx
xor edx, edx
mov word [ebp - 0x1c4], dx
xor eax, eax
mov word [ebp - 0x30], ax
push esi
jmp 0x4166c7
call 0x4166d7
add byte [eax + 0x46], al
cmp byte [edi], bh
cmp byte [ebx + edi], dh
cmp byte [eax], bh
inc ebp
add esp, 4
sub esi, 0x9752
or esi, 0x3c0e
pop esi
push edx
push edx
add esp, 4
add edx, 0xbc8a
pop edx
mov ecx, dword [ebp - 0xcc8]
mov dx, word [ecx]
mov word [ebp - 0x104e], dx
mov eax, dword [ebp - 0xcc8]
add eax, 2
mov dword [ebp - 0xcc8], eax
mov cx, word [ebp - 0x104e]
mov word [ebp - 0x1c4], cx
mov edx, dword [ebp - 0xccc]
mov ax, word [edx]
mov word [ebp - 0x1064], ax
mov ecx, dword [ebp - 0xccc]
add ecx, 2
mov dword [ebp - 0xccc], ecx
mov dx, word [ebp - 0x1064]
cmp edx, eax
je 0x4166c1
movzx ecx, word [ebp - 0x1c4]
movzx edx, word [ebp - 0x30]
cmp ecx, edx
jge 0x4167dd
mov dword [ebp - 0x1620], 0xffffffff
jmp 0x4167e7
mov dword [ebp - 0x1620], 1
mov eax, dword [ebp - 0x1620]
mov dword [ebp - 0x1624], eax
cmp dword [ebp - 0x1624], 0
jne 0x41683c
push edx
push edx
add esp, 4
call 0x41680d
add byte [ecx + 0x50], al
cmp dword ds:[eax + 0x36], ecx
add esp, 4
jmp 0x416817
pop edx
push edi
push edi
add esp, 4
jmp 0x416825
pop edi
push eax
add eax, 0xa692
pop eax
mov ecx, dword [ebp - 0x450]
mov dword [ebp - 0x2f8], ecx
jmp 0x4168a4
push eax
xor eax, 0xe758
pop eax
push edi
push edx
add esp, 4
or edi, 0xdfd5
pop edi
push ebx
push eax
add esp, 4
or ebx, 0x12d37
sub ebx, 0x9c7a
or ebx, 0x76de
add ebx, 0xabaf
pop ebx
mov edx, dword [ebp - 0x450]
mov eax, dword [edx]
mov dword [ebp - 0x450], eax
mov ecx, dword [ebp - 0x450]
cmp ecx, dword [ebp - 0xcd0]
je 0x41689a
mov edx, dword [ebp - 0x450]
cmp dword [edx + 0x30], 0
jne 0x416665
mov dword [ebp - 0x2f8], 0
push edi
push edi
add esp, 4
jmp 0x4168af
and edi, 0x2913
sub edi, 0x73e2
pop edi
push edx
push edi
add esp, 4
or edx, 0x154ae
and edx, 0xb297
pop edx
push esi
and esi, 0x10cbf
pop esi
mov eax, dword [ebp - 0x2f8]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x398], ecx
push edi
add edi, 0x121e4
or edi, 0x151aa
jmp 0x4168f8
pop edi
push ecx
push edx
add esp, 4
and ecx, 0x811f
and ecx, 0x14d5b
xor ecx, 0x5c7c
or ecx, 0x3c1e
pop ecx
mov dword [ebp - 0x780], 0
mov edx, dword [ebp - 0x398]
mov dword [ebp - 0x1628], edx
cmp dword [ebp - 0x1628], 0
jne 0x416947
mov eax, dword [ebp - 0x780]
mov dword [ebp - 0x44c], eax
jmp 0x416c38
mov ecx, dword [ebp - 0x1628]
mov edx, dword [ebp - 0x398]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x162c], edx
jne 0x41696f
mov eax, dword [ebp - 0x780]
invalid
invalid
mov ah, 0xfb
invalid
Function at 0x41680d
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edx
sub edx, 0x141f
add edx, 0x9782
or edx, 0x8d62
sub edx, 0xf9c3
pop edx
push edx
push edi
add esp, 4
xor edx, 0x7942
and edx, 0x17006
sub edx, 0x11205
pop edx
lea edx, [ebp - 0x1770]
mov dword [ebp - 0xccc], edx
mov eax, dword [ebp - 0x450]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcc8], ecx
xor edx, edx
mov word [ebp - 0x1c4], dx
xor eax, eax
mov word [ebp - 0x30], ax
push esi
jmp 0x4166c7
call 0x4166d7
add byte [eax + 0x46], al
cmp byte [edi], bh
cmp byte [ebx + edi], dh
cmp byte [eax], bh
inc ebp
add esp, 4
sub esi, 0x9752
or esi, 0x3c0e
pop esi
push edx
push edx
add esp, 4
add edx, 0xbc8a
pop edx
mov ecx, dword [ebp - 0xcc8]
mov dx, word [ecx]
mov word [ebp - 0x104e], dx
mov eax, dword [ebp - 0xcc8]
add eax, 2
mov dword [ebp - 0xcc8], eax
mov cx, word [ebp - 0x104e]
mov word [ebp - 0x1c4], cx
mov edx, dword [ebp - 0xccc]
mov ax, word [edx]
mov word [ebp - 0x1064], ax
mov ecx, dword [ebp - 0xccc]
add ecx, 2
mov dword [ebp - 0xccc], ecx
mov dx, word [ebp - 0x1064]
cmp edx, eax
je 0x4166c1
movzx ecx, word [ebp - 0x1c4]
movzx edx, word [ebp - 0x30]
cmp ecx, edx
jge 0x4167dd
mov dword [ebp - 0x1620], 0xffffffff
jmp 0x4167e7
mov dword [ebp - 0x1620], 1
mov eax, dword [ebp - 0x1620]
mov dword [ebp - 0x1624], eax
cmp dword [ebp - 0x1624], 0
jne 0x41683c
push edx
push edx
add esp, 4
call 0x41680d
add byte [ecx + 0x50], al
cmp dword ds:[eax + 0x36], ecx
add esp, 4
jmp 0x416817
pop edx
push edi
push edi
add esp, 4
jmp 0x416825
pop edi
push eax
add eax, 0xa692
pop eax
mov ecx, dword [ebp - 0x450]
mov dword [ebp - 0x2f8], ecx
jmp 0x4168a4
push eax
xor eax, 0xe758
pop eax
push edi
push edx
add esp, 4
or edi, 0xdfd5
pop edi
push ebx
push eax
add esp, 4
or ebx, 0x12d37
sub ebx, 0x9c7a
or ebx, 0x76de
add ebx, 0xabaf
pop ebx
mov edx, dword [ebp - 0x450]
mov eax, dword [edx]
mov dword [ebp - 0x450], eax
mov ecx, dword [ebp - 0x450]
cmp ecx, dword [ebp - 0xcd0]
je 0x41689a
mov edx, dword [ebp - 0x450]
cmp dword [edx + 0x30], 0
jne 0x416665
mov dword [ebp - 0x2f8], 0
push edi
push edi
add esp, 4
jmp 0x4168af
and edi, 0x2913
sub edi, 0x73e2
pop edi
push edx
push edi
add esp, 4
or edx, 0x154ae
and edx, 0xb297
pop edx
push esi
and esi, 0x10cbf
pop esi
mov eax, dword [ebp - 0x2f8]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x398], ecx
push edi
add edi, 0x121e4
or edi, 0x151aa
jmp 0x4168f8
pop edi
push ecx
push edx
add esp, 4
and ecx, 0x811f
and ecx, 0x14d5b
xor ecx, 0x5c7c
or ecx, 0x3c1e
pop ecx
mov dword [ebp - 0x780], 0
mov edx, dword [ebp - 0x398]
mov dword [ebp - 0x1628], edx
cmp dword [ebp - 0x1628], 0
jne 0x416947
mov eax, dword [ebp - 0x780]
mov dword [ebp - 0x44c], eax
jmp 0x416c38
mov ecx, dword [ebp - 0x1628]
mov edx, dword [ebp - 0x398]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x162c], edx
jne 0x41696f
mov eax, dword [ebp - 0x780]
invalid
invalid
mov ah, 0xfb
invalid
Function at 0x416b6a
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ebp - 0x120]
add ecx, 1
mov dword [ebp - 0x120], ecx
mov edx, dword [ebp - 0x77c]
add edx, dword [ebp - 0x120]
movsx eax, byte [edx]
test eax, eax
je 0x416b42
mov ecx, dword [ebp - 0x120]
movsx edx, byte [ebp + ecx - 0x890]
test edx, edx
je 0x416b42
push ebx
and ebx, 0x157b5
sub ebx, 0xcb21
pop ebx
push ebx
push esi
add esp, 4
add ebx, 0xbd2
call fcn.00416ae3
add byte [ebx + 0x41], cl
cmp al, 0x4e
cmp edi, dword [ebx]
dec ebp
add esp, 4
jmp 0x416aee
pop ebx
mov eax, dword [ebp - 0x77c]
add eax, dword [ebp - 0x120]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x120]
movsx eax, byte [ebp + edx - 0x890]
cmp ecx, eax
je 0x416b34
mov ecx, dword [ebp - 0x77c]
add ecx, dword [ebp - 0x120]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x120]
movsx ecx, byte [ebp + eax - 0x890]
cmp edx, ecx
jne 0x416b3b
jmp 0x416a81
jmp 0x416b42
push edi
add edi, 0x11535
or edi, 0x6006
pop edi
push ecx
push esi
add esp, 4
or ecx, 0x7fdd
call 0x416b6a
add byte [esi], dh
inc ecx
inc ecx
dec eax
push eax
inc eax
inc eax
dec edi
cmp al, 0x83
les eax, [ecx + eax*4]
int1
and byte [esi], al
add byte [ecx - 0x75], bl
pop ecx
invalid
xchg ebp, eax
test al, bh
invalid

Function at 0x416b73
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ebp - 0x120]
add ecx, 1
mov dword [ebp - 0x120], ecx
mov edx, dword [ebp - 0x77c]
add edx, dword [ebp - 0x120]
movsx eax, byte [edx]
test eax, eax
je 0x416b42
mov ecx, dword [ebp - 0x120]
movsx edx, byte [ebp + ecx - 0x890]
test edx, edx
je 0x416b42
push ebx
and ebx, 0x157b5
sub ebx, 0xcb21
pop ebx
push ebx
push esi
add esp, 4
add ebx, 0xbd2
call fcn.00416ae3
add byte [ebx + 0x41], cl
cmp al, 0x4e
cmp edi, dword [ebx]
dec ebp
add esp, 4
jmp 0x416aee
pop ebx
mov eax, dword [ebp - 0x77c]
add eax, dword [ebp - 0x120]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x120]
movsx eax, byte [ebp + edx - 0x890]
cmp ecx, eax
je 0x416b34
mov ecx, dword [ebp - 0x77c]
add ecx, dword [ebp - 0x120]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x120]
movsx ecx, byte [ebp + eax - 0x890]
cmp edx, ecx
jne 0x416b3b
jmp 0x416a81
jmp 0x416b42
push edi
add edi, 0x11535
or edi, 0x6006
pop edi
push ecx
push esi
add esp, 4
or ecx, 0x7fdd
call 0x416b6a
add byte [esi], dh
inc ecx
inc ecx
dec eax
push eax
inc eax
inc eax
dec edi
cmp al, 0x83
les eax, [ecx + eax*4]
int1
and byte [esi], al
add byte [ecx - 0x75], bl
pop ecx
invalid
xchg ebp, eax
test al, bh
invalid
Function at 0x416bf6
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x778]
add edx, 1
mov dword [ebp - 0x778], edx
mov eax, dword [ebp - 0x774]
mov ecx, dword [ebp - 0x778]
cmp ecx, dword [eax + 0x18]
jae 0x416c2c
mov edx, dword [ebp - 0x778]
mov eax, dword [ebp - 0x19b8]
mov ecx, dword [ebp - 0x398]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x77c], ecx
mov edx, dword [ebp - 0x778]
mov eax, dword [ebp - 0x19bc]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x19c0]
mov eax, dword [ebp - 0x398]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x19c4], eax
mov dword [ebp - 0x120], 0
jmp 0x416a90
cmp ecx, eax
jge 0x416c06
mov dword [ebp - 0xcd4], 0xffffffff
jmp 0x416c10
mov dword [ebp - 0xcd4], 1
cmp dword [ebp - 0xcd4], 0
jne 0x416c27
mov ecx, dword [ebp - 0x19c4]
mov dword [ebp - 0x44c], ecx
jmp 0x416c38
jmp 0x416a11
mov edx, dword [ebp - 0x780]
mov dword [ebp - 0x44c], edx