joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40fa7b
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp dword [ebp - 0xc80], 0
jle 0x40fa40
push edi
add edi, 0x12a5b
pop edi
push edx
push ebx
add esp, 4
xor edx, 0x71e8
pop edx
push eax
push edi
add esp, 4
and eax, 0x4a6d
and eax, 0x6b00
or eax, 0x17f52
jg 0x40f953
add byte [ecx + 0x553df0], al
add byte [eax - 0x75], bl
xchg ebp, eax
cmp al, 0xf5
invalid
dec dword [edi]
mov dh, 2
mov ecx, dword [ebp - 0xa60]
movzx edx, byte [ecx]
cmp eax, edx
je 0x40f9dc
push edx
push eax
add esp, 4
xor edx, 0xab03
sub edx, 0xedfd
call 0x40f98f
add byte [edi], dh
inc ebp
inc eax
cmp eax, 0x41493849
add esp, 4
call 0x40f99e
add byte [edi + 0x40], al
inc edx
xor cl, byte [ebx + 0x3a]
add esp, 4
pop edx
mov eax, dword [ebp - 0xac4]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0xa60]
movzx eax, byte [edx]
cmp ecx, eax
jle 0x40f9c4
mov dword [ebp - 0x15c8], 1
jmp 0x40f9ce
mov dword [ebp - 0x15c8], 0xffffffff
mov ecx, dword [ebp - 0x15c8]
mov dword [ebp - 0xc84], ecx
jmp 0x40fa40
push esi
sub esi, 0x134e3
xor al, 1
add byte [ecx + 0x12704c6], al
add byte [ecx + 0x551dee], al
add byte [ecx + 0x1181eee], al
add byte [esi + 0x56], bl
xor al, 1
add byte [ecx + 0x12704c6], al
add byte [ecx + 0x551dee], al
add byte [ecx + 0x1181eee], al
add byte [esi + 0x56], bl
push edx
add esp, 4
and esi, 0x9074
pop esi
push eax
push esi
add esp, 4
jmp 0x40fa0d
pop eax
mov edx, dword [ebp - 0xc80]
sub edx, 1
mov dword [ebp - 0xc80], edx
mov eax, dword [ebp - 0xac4]
add eax, 1
mov dword [ebp - 0xac4], eax
mov ecx, dword [ebp - 0xa60]
add ecx, 1
mov dword [ebp - 0xa60], ecx
jmp 0x40f91b
mov edx, dword [ebp - 0xc84]
mov dword [ebp - 0x15cc], edx
cmp dword [ebp - 0x15cc], 0
jne 0x40fa95
push edi
call 0x40fa64
add byte [esi], bh
inc edi
dec edi
inc edx
inc esp
push eax
dec eax
inc edi
add esp, 4
and edi, 0x5f65
call 0x40fa7b
add byte [esi + 0x47], al
aas
dec edx
cmp al, 0x32
cmp al, byte [edx - 0x7d]
les eax, [ebx + ebp*8]
push es
aas
dec esi
dec edx
inc edi
cmp eax, 0x858b5f39
add al, 0xfb
invalid
jmp 0x40f7e3

Function at 0x40fafd
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop esi
push ecx
jmp 0x40fb07
pop ecx
push ecx
push edi
add esp, 4
add ecx, 0x7ffa
pop ecx
push edx
add edx, 0x13285
xor edx, 0xc22e
add edx, 0x148e4
xor edx, 0x10684
pop edx
push ebx
push eax
add esp, 4
sub ebx, 0x35b9
pop ebx
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xbe4]
mov dword [ebp - 0x15d0], eax
push edi

Function at 0x40fb69
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
or edi, 0xcd2
pop edi
push ecx
push eax
add esp, 4
call 0x40fb69
add byte [eax + 0x38], al
aaa
inc esp
xor eax, 0xc483324b
add al, 0x59
push edx
sub edx, 0xf8f8
add edx, 0xddbf
add edx, 0x1610f
pop edx
mov dword [ebp - 0x20a4], 0xffffffff
push ecx
push ebx
add esp, 4
call 0x40fb9c
add byte [edi], bh
dec esi
inc eax
inc esp
inc ebp
cmp eax, 0x8104c483
mov edx, dword [ebp - 0x500]
add edx, 1
mov dword [ebp - 0x500], edx
Function at 0x40fb9c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
or edi, 0xcd2
pop edi
push ecx
push eax
add esp, 4
call 0x40fb69
add byte [eax + 0x38], al
aaa
inc esp
xor eax, 0xc483324b
add al, 0x59
push edx
sub edx, 0xf8f8
add edx, 0xddbf
add edx, 0x1610f
pop edx
mov dword [ebp - 0x20a4], 0xffffffff
push ecx
push ebx
add esp, 4
call 0x40fb9c
add byte [edi], bh
dec esi
inc eax
inc esp
inc ebp
cmp eax, 0x8104c483
mov edx, dword [ebp - 0x500]
add edx, 1
mov dword [ebp - 0x500], edx

Function at 0x40fbb3
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
loope 0x40fc06
push esp
add dword [eax], eax
call 0x40fbb3
add byte [0x3c444e45], dh
cmp dh, byte [edx]
dec esp
add esp, 4
sub ecx, 0x3a66
pop ecx
mov ecx, dword [ebp - 0x3f0]
mov dword [ebp - 0x500], ecx
jmp 0x40fbda
push esi
push edx
add esp, 4
call 0x40fbef
add byte [esi], bh
cmp byte [esi], bh
cmp dword [0x46424a3f], esi
inc edx
add esp, 4
sub esi, 0xcf70
call 0x40fc08
add byte [eax + 0x34], dl
inc edi
inc ecx
inc eax
inc eax
cmp al, 0x4e
dec edi
dec esi
add esp, 4
pop esi
mov eax, dword [ebp - 0x500]
sub eax, dword [ebp - 0x3f0]
cmp eax, 0xffffffff
jb 0x40fc54
push ecx
sub ecx, 0x959b
pop ecx
push ecx
or ecx, 0x11300
jmp 0x40fc34
pop ecx
push eax
and eax, 0x22f7
call 0x40fc4b
add byte [esi], bh
dec ecx
dec ebp
dec eax
xor bh, byte [ebx]
push eax
cmp eax, 0x4c4834c
pop eax
jmp 0x40fe82
mov dword [ebp - 0xc88], 7
invalid
invalid

Function at 0x40fbef
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
loope 0x40fc06
push esp
add dword [eax], eax
call 0x40fbb3
add byte [0x3c444e45], dh
cmp dh, byte [edx]
dec esp
add esp, 4
sub ecx, 0x3a66
pop ecx
mov ecx, dword [ebp - 0x3f0]
mov dword [ebp - 0x500], ecx
jmp 0x40fbda
push esi
push edx
add esp, 4
call 0x40fbef
add byte [esi], bh
cmp byte [esi], bh
cmp dword [0x46424a3f], esi
inc edx
add esp, 4
sub esi, 0xcf70
call 0x40fc08
add byte [eax + 0x34], dl
inc edi
inc ecx
inc eax
inc eax
cmp al, 0x4e
dec edi
dec esi
add esp, 4
pop esi
mov eax, dword [ebp - 0x500]
sub eax, dword [ebp - 0x3f0]
cmp eax, 0xffffffff
jb 0x40fc54
push ecx
sub ecx, 0x959b
pop ecx
push ecx
or ecx, 0x11300
jmp 0x40fc34
pop ecx
push eax
and eax, 0x22f7
call 0x40fc4b
add byte [esi], bh
dec ecx
dec ebp
dec eax
xor bh, byte [ebx]
push eax
cmp eax, 0x4c4834c
pop eax
jmp 0x40fe82
mov dword [ebp - 0xc88], 7
invalid
invalid
Function at 0x40fc08
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
loope 0x40fc06
push esp
add dword [eax], eax
call 0x40fbb3
add byte [0x3c444e45], dh
cmp dh, byte [edx]
dec esp
add esp, 4
sub ecx, 0x3a66
pop ecx
mov ecx, dword [ebp - 0x3f0]
mov dword [ebp - 0x500], ecx
jmp 0x40fbda
push esi
push edx
add esp, 4
call 0x40fbef
add byte [esi], bh
cmp byte [esi], bh
cmp dword [0x46424a3f], esi
inc edx
add esp, 4
sub esi, 0xcf70
call 0x40fc08
add byte [eax + 0x34], dl
inc edi
inc ecx
inc eax
inc eax
cmp al, 0x4e
dec edi
dec esi
add esp, 4
pop esi
mov eax, dword [ebp - 0x500]
sub eax, dword [ebp - 0x3f0]
cmp eax, 0xffffffff
jb 0x40fc54
push ecx
sub ecx, 0x959b
pop ecx
push ecx
or ecx, 0x11300
jmp 0x40fc34
pop ecx
push eax
and eax, 0x22f7
call 0x40fc4b
add byte [esi], bh
dec ecx
dec ebp
dec eax
xor bh, byte [ebx]
push eax
cmp eax, 0x4c4834c
pop eax
jmp 0x40fe82
mov dword [ebp - 0xc88], 7
invalid
invalid

Function at 0x40fc4b
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
loope 0x40fc06
push esp
add dword [eax], eax
call 0x40fbb3
add byte [0x3c444e45], dh
cmp dh, byte [edx]
dec esp
add esp, 4
sub ecx, 0x3a66
pop ecx
mov ecx, dword [ebp - 0x3f0]
mov dword [ebp - 0x500], ecx
jmp 0x40fbda
push esi
push edx
add esp, 4
call 0x40fbef
add byte [esi], bh
cmp byte [esi], bh
cmp dword [0x46424a3f], esi
inc edx
add esp, 4
sub esi, 0xcf70
call 0x40fc08
add byte [eax + 0x34], dl
inc edi
inc ecx
inc eax
inc eax
cmp al, 0x4e
dec edi
dec esi
add esp, 4
pop esi
mov eax, dword [ebp - 0x500]
sub eax, dword [ebp - 0x3f0]
cmp eax, 0xffffffff
jb 0x40fc54
push ecx
sub ecx, 0x959b
pop ecx
push ecx
or ecx, 0x11300
jmp 0x40fc34
pop ecx
push eax
and eax, 0x22f7
call 0x40fc4b
add byte [esi], bh
dec ecx
dec ebp
dec eax
xor bh, byte [ebx]
push eax
cmp eax, 0x4c4834c
pop eax
jmp 0x40fe82
mov dword [ebp - 0xc88], 7
invalid
invalid

Function at 0x40fdd0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edi
or edi, 0x6722
sub edi, 0x398a
add edi, 0x8cf6
call 0x40fdf2
add byte [ecx + 0x3c], al
inc ecx
inc ebx
inc ebx
inc eax
inc esp
cmp al, 0x37
add esp, 4
pop edi
mov edx, dword [ebp - 0xc88]
sub edx, 1
mov dword [ebp - 0xc88], edx
mov eax, dword [ebp - 0xac0]
add eax, 1
mov dword [ebp - 0xac0], eax
mov ecx, dword [ebp - 0xabc]
add ecx, 1
mov dword [ebp - 0xabc], ecx
jmp 0x40fd03

Function at 0x40fdf2
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edi
or edi, 0x6722
sub edi, 0x398a
add edi, 0x8cf6
call 0x40fdf2
add byte [ecx + 0x3c], al
inc ecx
inc ebx
inc ebx
inc eax
inc esp
cmp al, 0x37
add esp, 4
pop edi
mov edx, dword [ebp - 0xc88]
sub edx, 1
mov dword [ebp - 0xc88], edx
mov eax, dword [ebp - 0xac0]
add eax, 1
mov dword [ebp - 0xac0], eax
mov ecx, dword [ebp - 0xabc]
add ecx, 1
mov dword [ebp - 0xabc], ecx
jmp 0x40fd03
Function at 0x40fe97
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push eax
inc eax
inc ebx
push esi
add esi, 0x166bf
pop esi
push edi
call 0x40fe97
add byte [ebx + edi], bh
push eax
xor dh, byte [0x4c48340]
pop edi
push edx
push edi
add esp, 4
call 0x40feb0
add byte [edi + 0x50], al
cmp esi, dword [0x3a473d4d]
inc ebp
xor al, byte [ebx - 0x38a5fb3c]
test dword [eax - 0xb], ecx
invalid

Function at 0x40feb0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push eax
inc eax
inc ebx
push esi
add esi, 0x166bf
pop esi
push edi
call 0x40fe97
add byte [ebx + edi], bh
push eax
xor dh, byte [0x4c48340]
pop edi
push edx
push edi
add esp, 4
call 0x40feb0
add byte [edi + 0x50], al
cmp esi, dword [0x3a473d4d]
inc ebp
xor al, byte [ebx - 0x38a5fb3c]
test dword [eax - 0xb], ecx
invalid

Function at 0x410256
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push esi
push esi
add esp, 4
or esi, 0x7e61
jmp 0x4101be
jmp 0x4101c6
sub esi, 0xc370
pop esi
push esi
push ebx
add esp, 4
jmp 0x4101d7
and esi, 0x114bd
pop esi
mov eax, dword [ebp - 0xc90]
mov cx, word [eax]
mov word [ebp - 0x1032], cx
mov edx, dword [ebp - 0xc90]
add edx, 2
mov dword [ebp - 0xc90], edx
mov ax, word [ebp - 0x1032]
mov word [ebp - 0x210], ax
mov ecx, dword [ebp - 0xc94]
mov dx, word [ecx]
mov word [ebp - 0x1034], dx
mov eax, dword [ebp - 0xc94]
add eax, 2
mov dword [ebp - 0xc94], eax
mov cx, word [ebp - 0x1034]
mov word [ebp - 0x10c], cx
push edi
push esi
add esp, 4
jmp 0x410244
xor edi, 0x8327
call fcn.00410256
add byte [ebx], dh
cmp bh, byte [0x8347464b]
add esp, 4
pop edi
add esp, 4
pop edi
push edx
or edx, 0x1627a
pop edx
push ebx
and ebx, 0xad7f
pop ebx
movzx edx, word [ebp - 0x10c]
test edx, edx
jne 0x41028d
movzx eax, word [ebp - 0x210]
movzx ecx, word [ebp - 0x10c]
sub eax, ecx
mov dword [ebp - 0x15e0], eax
jmp 0x4102f0
movzx edx, word [ebp - 0x210]
movzx eax, word [ebp - 0x10c]
cmp edx, eax
je 0x4101ac
movzx ecx, word [ebp - 0x210]
xor ecx, 0x20
movzx edx, word [ebp - 0x10c]
cmp ecx, edx
je 0x4101ac
movzx eax, word [ebp - 0x210]
movzx ecx, word [ebp - 0x10c]
cmp eax, ecx
jge 0x4102da
mov dword [ebp - 0x15dc], 0xffffffff
jmp 0x4102e4
mov dword [ebp - 0x15dc], 1
mov edx, dword [ebp - 0x15dc]
mov dword [ebp - 0x15e0], edx
cmp dword [ebp - 0x15e0], 0
jne 0x410339
push eax
push eax
add esp, 4
and eax, 0xa649
pop eax
push edx
xor edx, 0x76f6
pop edx
push esi
push ebx
add esp, 4
jmp 0x410317
jmp 0x41031e
and esi, 0x14da7
sub esi, 0x13773
pop esi
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0x31c], eax
jmp 0x4103a1
push edi
push ebx
add esp, 4
and edi, 0x3b0a
jmp 0x41034d
and edi, 0x10920
pop edi
push esi
call 0x410361
add byte [ebp + 0x33], cl
cmp byte [edx], dh
inc ebp
dec esp
add esp, 4
xor esi, 0xfd51
pop esi
mov ecx, dword [ebp - 0x504]
mov edx, dword [ecx]
mov dword [ebp - 0x504], edx
mov eax, dword [ebp - 0x504]
cmp eax, dword [ebp - 0xc98]
je 0x410397
mov ecx, dword [ebp - 0x504]
cmp dword [ecx + 0x30], 0
jne 0x41014d
mov dword [ebp - 0x31c], 0
Function at 0x410361
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push esi
push esi
add esp, 4
or esi, 0x7e61
jmp 0x4101be
jmp 0x4101c6
sub esi, 0xc370
pop esi
push esi
push ebx
add esp, 4
jmp 0x4101d7
and esi, 0x114bd
pop esi
mov eax, dword [ebp - 0xc90]
mov cx, word [eax]
mov word [ebp - 0x1032], cx
mov edx, dword [ebp - 0xc90]
add edx, 2
mov dword [ebp - 0xc90], edx
mov ax, word [ebp - 0x1032]
mov word [ebp - 0x210], ax
mov ecx, dword [ebp - 0xc94]
mov dx, word [ecx]
mov word [ebp - 0x1034], dx
mov eax, dword [ebp - 0xc94]
add eax, 2
mov dword [ebp - 0xc94], eax
mov cx, word [ebp - 0x1034]
mov word [ebp - 0x10c], cx
push edi
push esi
add esp, 4
jmp 0x410244
xor edi, 0x8327
call fcn.00410256
add byte [ebx], dh
cmp bh, byte [0x8347464b]
add esp, 4
pop edi
add esp, 4
pop edi
push edx
or edx, 0x1627a
pop edx
push ebx
and ebx, 0xad7f
pop ebx
movzx edx, word [ebp - 0x10c]
test edx, edx
jne 0x41028d
movzx eax, word [ebp - 0x210]
movzx ecx, word [ebp - 0x10c]
sub eax, ecx
mov dword [ebp - 0x15e0], eax
jmp 0x4102f0
movzx edx, word [ebp - 0x210]
movzx eax, word [ebp - 0x10c]
cmp edx, eax
je 0x4101ac
movzx ecx, word [ebp - 0x210]
xor ecx, 0x20
movzx edx, word [ebp - 0x10c]
cmp ecx, edx
je 0x4101ac
movzx eax, word [ebp - 0x210]
movzx ecx, word [ebp - 0x10c]
cmp eax, ecx
jge 0x4102da
mov dword [ebp - 0x15dc], 0xffffffff
jmp 0x4102e4
mov dword [ebp - 0x15dc], 1
mov edx, dword [ebp - 0x15dc]
mov dword [ebp - 0x15e0], edx
cmp dword [ebp - 0x15e0], 0
jne 0x410339
push eax
push eax
add esp, 4
and eax, 0xa649
pop eax
push edx
xor edx, 0x76f6
pop edx
push esi
push ebx
add esp, 4
jmp 0x410317
jmp 0x41031e
and esi, 0x14da7
sub esi, 0x13773
pop esi
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0x31c], eax
jmp 0x4103a1
push edi
push ebx
add esp, 4
and edi, 0x3b0a
jmp 0x41034d
and edi, 0x10920
pop edi
push esi
call 0x410361
add byte [ebp + 0x33], cl
cmp byte [edx], dh
inc ebp
dec esp
add esp, 4
xor esi, 0xfd51
pop esi
mov ecx, dword [ebp - 0x504]
mov edx, dword [ecx]
mov dword [ebp - 0x504], edx
mov eax, dword [ebp - 0x504]
cmp eax, dword [ebp - 0xc98]
je 0x410397
mov ecx, dword [ebp - 0x504]
cmp dword [ecx + 0x30], 0
jne 0x41014d
mov dword [ebp - 0x31c], 0

Function at 0x410bc0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push 0xffffffe
mov esi, 0xf76c1584
invalid
Function at 0x410c77
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x410c8a
add byte [edx], dh
cmp dword [esi], edi
xor eax, 0x4e464434
cmp al, byte [ebx - 0x74a7fb3c]
lea ecx, [esi - 0x72760001]
mov dh, ah
invalid

Function at 0x410c8a
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x410c8a
add byte [edx], dh
cmp dword [esi], edi
xor eax, 0x4e464434
cmp al, byte [ebx - 0x74a7fb3c]
lea ecx, [esi - 0x72760001]
mov dh, ah
invalid
Function at 0x411346
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x768]
add edx, 1
mov dword [ebp - 0x768], edx
mov eax, dword [ebp - 0x764]
mov ecx, dword [ebp - 0x768]
cmp ecx, dword [eax + 0x18]
jae 0x4113be
mov edx, dword [ebp - 0x768]
mov eax, dword [ebp - 0x1984]
mov ecx, dword [ebp - 0x324]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x76c], ecx
mov edx, dword [ebp - 0x768]
mov eax, dword [ebp - 0x1988]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x1d10]
mov eax, dword [ebp - 0x324]
add eax, dword [edx + ecx*4]
mov cl, byte [ecx - 0x198b7b]
inc edi
test dword [esi + edi*8 - 1], esp
inc dword [eax]
add byte [eax], al
add bl, ch
invalid
mov ecx, dword [ebp - 0x19c]
add ecx, 1
mov dword [ebp - 0x19c], ecx
mov edx, dword [ebp - 0x76c]
add edx, dword [ebp - 0x19c]
movsx eax, byte [edx]
test eax, eax
je 0x4112d4
mov ecx, dword [ebp - 0x19c]
movsx edx, byte [ebp + ecx - 0x878]
test edx, edx
je 0x4112d4
push edi
xor edi, 0x16bbe
pop edi
push esi
add esi, 0x13abb
or esi, 0x8346
pop esi
push ecx
xor ecx, 0x115ea
pop ecx
push ebx
xor ebx, 0x68b6
sub ebx, 0x39c8
sub ebx, 0xa20b
pop ebx
mov eax, dword [ebp - 0x76c]
add eax, dword [ebp - 0x19c]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x19c]
movsx eax, byte [ebp + edx - 0x878]
cmp ecx, eax
je 0x4112c6
mov ecx, dword [ebp - 0x76c]
add ecx, dword [ebp - 0x19c]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x19c]
movsx ecx, byte [ebp + eax - 0x878]
cmp edx, ecx
jne 0x4112cd
jmp fcn.00411213
jmp 0x4112d4
push ebx
or ebx, 0x14f35
sub ebx, 0x150ad
or ebx, 0x1311
sub ebx, 0xcfa9
pop ebx
push ebx
push edx
add esp, 4
add ebx, 0xc87f
or ebx, 0x3189
add ebx, 0x18636
pop ebx
mov edx, dword [ebp - 0x76c]
add edx, dword [ebp - 0x19c]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x19c]
movsx edx, byte [ebp + ecx - 0x878]
cmp eax, edx
jne 0x411333
mov dword [ebp - 0xcb8], 0
jmp 0x4113a2
push ebx
push edi
add esp, 4
call 0x411346
add byte [edx + 0x4e], cl
inc ecx
dec esi
cmp al, 0x4d
aaa
cmp al, byte [ebx + 0x565b04c4]
push edi
add esp, 4
sub esi, 0xe1e1
jmp 0x41135e
sub esi, 0x75c4
pop esi
mov eax, dword [ebp - 0x76c]
add eax, dword [ebp - 0x19c]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x19c]
movsx eax, byte [ebp + edx - 0x878]
or eax, 0x20
cmp ecx, eax
jge 0x411398
mov dword [ebp - 0xcb8], 0xffffffff
jmp 0x4113a2
mov dword [ebp - 0xcb8], 1
cmp dword [ebp - 0xcb8], 0
jne 0x4113b9
mov ecx, dword [ebp - 0x198c]
mov dword [ebp - 0x510], ecx
jmp 0x4113ca
jmp 0x4111a3
mov edx, dword [ebp - 0x770]
mov dword [ebp - 0x510], edx
mov eax, dword [ebp - 0x510]
Function at 0x411540
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add eax, 0x14d24
and eax, 0x143be
xor eax, 0x10be7
pop eax
push ebx
xor ebx, 0x10d89
or ebx, 0x96de
and ebx, 0x11c34
and ebx, 0x18486
pop ebx
mov eax, dword [ebp - 0x3e8]
mov cl, byte [eax + 0xa]
mov byte [ebp - 0x3ae], cl
mov edx, dword [ebp - 0xab8]
sub edx, dword [ebp - 0x3e8]
mov dword [ebp - 0x1694], edx
mov dword [ebp - 0xce8], 0
push ebx
push ecx
add esp, 4
sub ebx, 0x925b
pop ebx
push eax
push esi
add esp, 4
or eax, 0x99ba
sub eax, 0x791d
or eax, 0xe5c0
pop eax
push eax
sub eax, 0x121
jmp 0x411539
pop eax
mov byte [ebp - 0x9d4], 0x56
push esi
mov byte [ebp - 0x9d3], 0x69
mov byte [ebp - 0x9d2], 0x72
mov byte [ebp - 0x9d1], 0x74
mov byte [ebp - 0x9d0], 0x75
mov byte [ebp - 0x9cf], 0x61
mov byte [ebp - 0x9ce], 0x6c
mov byte [ebp - 0x9cd], 0x50
mov byte [ebp - 0x9cc], 0x72
mov byte [ebp - 0x9cb], 0x6f
mov byte [ebp - 0x9ca], 0x74
mov byte [ebp - 0x9c9], 0x65
mov byte [ebp - 0x9c8], 0x63
mov byte [ebp - 0x9c7], 0x74
mov byte [ebp - 0x9c6], 0
push edx
push edx
add esp, 4
and edx, 0x16e26
pop edx
push ebx
push ecx
add esp, 4
call 0x4115c2
add byte [ecx], bh
cmp al, 0x38
cmp ecx, dword [ebp + 0x34]
dec esi
xor al, byte [ebx + 0x7eb04c4]
cmp dword [ecx + 0x4a], ecx
dec ebx
inc esi
cmp cl, byte [ecx + eax*4 - 0x1d]
push cs
ja 0x4115d4
add byte [ebx + 0x64], bl
mov eax, dword [0x18]
pop ebx
mov eax, dword fs:[0x18]
mov dword [ebp - 0x1994], eax
mov ecx, dword [ebp - 0x1994]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x1998], edx
mov eax, dword [ebp - 0x1998]
mov dword [ebp - 0x1614], eax
push esi
sub esi, 0x15306
pop esi
push ebx
xor ebx, 0xdf58
jmp 0x411610
sub ebx, 0x153f6
pop ebx
push esi
call 0x411624
add byte [esi], dh
inc esp
dec eax
dec edx
inc esp
dec esi
add esp, 4
and esi, 0x5173
pop esi
cmp dword [ebp - 0x1614], 0
jne 0x411646
mov dword [ebp - 0x2fc], 0
jmp 0x4118ed
mov ecx, dword [ebp - 0x1614]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xcc4], eax
push ebx
push edi
add esp, 4
call 0x41166d
add byte [edi + 0x47], cl
push eax
inc ebp
inc edx
inc eax
cmp dword [esi], edi
aas
add esp, 4
jmp 0x411678
pop ebx
push esi
push edi
add esp, 4
jmp 0x411683
xor esi, 0x9565
pop esi
cmp dword [ebp - 0xcc4], 0
jne 0x4116a2
mov dword [ebp - 0x2fc], 0
jmp 0x4118ed
mov ecx, dword [ebp - 0xcc4]
mov dword [ebp - 0x514], ecx
push ebx
jmp 0x4116b7
add ebx, 0xa5d1
pop ebx
push ecx
add ecx, 0x1649c
jmp 0x4116ca
or ecx, 0xc0b6
call 0x4116dc
add byte [edi], dh
inc edi
aas
cmp eax, dword [ebp + ecx*2 - 0x7d]
les eax, [ecx + ebx*2]
Function at 0x4115c2
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add eax, 0x14d24
and eax, 0x143be
xor eax, 0x10be7
pop eax
push ebx
xor ebx, 0x10d89
or ebx, 0x96de
and ebx, 0x11c34
and ebx, 0x18486
pop ebx
mov eax, dword [ebp - 0x3e8]
mov cl, byte [eax + 0xa]
mov byte [ebp - 0x3ae], cl
mov edx, dword [ebp - 0xab8]
sub edx, dword [ebp - 0x3e8]
mov dword [ebp - 0x1694], edx
mov dword [ebp - 0xce8], 0
push ebx
push ecx
add esp, 4
sub ebx, 0x925b
pop ebx
push eax
push esi
add esp, 4
or eax, 0x99ba
sub eax, 0x791d
or eax, 0xe5c0
pop eax
push eax
sub eax, 0x121
jmp 0x411539
pop eax
mov byte [ebp - 0x9d4], 0x56
push esi
mov byte [ebp - 0x9d3], 0x69
mov byte [ebp - 0x9d2], 0x72
mov byte [ebp - 0x9d1], 0x74
mov byte [ebp - 0x9d0], 0x75
mov byte [ebp - 0x9cf], 0x61
mov byte [ebp - 0x9ce], 0x6c
mov byte [ebp - 0x9cd], 0x50
mov byte [ebp - 0x9cc], 0x72
mov byte [ebp - 0x9cb], 0x6f
mov byte [ebp - 0x9ca], 0x74
mov byte [ebp - 0x9c9], 0x65
mov byte [ebp - 0x9c8], 0x63
mov byte [ebp - 0x9c7], 0x74
mov byte [ebp - 0x9c6], 0
push edx
push edx
add esp, 4
and edx, 0x16e26
pop edx
push ebx
push ecx
add esp, 4
call 0x4115c2
add byte [ecx], bh
cmp al, 0x38
cmp ecx, dword [ebp + 0x34]
dec esi
xor al, byte [ebx + 0x7eb04c4]
cmp dword [ecx + 0x4a], ecx
dec ebx
inc esi
cmp cl, byte [ecx + eax*4 - 0x1d]
push cs
ja 0x4115d4
add byte [ebx + 0x64], bl
mov eax, dword [0x18]
pop ebx
mov eax, dword fs:[0x18]
mov dword [ebp - 0x1994], eax
mov ecx, dword [ebp - 0x1994]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x1998], edx
mov eax, dword [ebp - 0x1998]
mov dword [ebp - 0x1614], eax
push esi
sub esi, 0x15306
pop esi
push ebx
xor ebx, 0xdf58
jmp 0x411610
sub ebx, 0x153f6
pop ebx
push esi
call 0x411624
add byte [esi], dh
inc esp
dec eax
dec edx
inc esp
dec esi
add esp, 4
and esi, 0x5173
pop esi
cmp dword [ebp - 0x1614], 0
jne 0x411646
mov dword [ebp - 0x2fc], 0
jmp 0x4118ed
mov ecx, dword [ebp - 0x1614]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xcc4], eax
push ebx
push edi
add esp, 4
call 0x41166d
add byte [edi + 0x47], cl
push eax
inc ebp
inc edx
inc eax
cmp dword [esi], edi
aas
add esp, 4
jmp 0x411678
pop ebx
push esi
push edi
add esp, 4
jmp 0x411683
xor esi, 0x9565
pop esi
cmp dword [ebp - 0xcc4], 0
jne 0x4116a2
mov dword [ebp - 0x2fc], 0
jmp 0x4118ed
mov ecx, dword [ebp - 0xcc4]
mov dword [ebp - 0x514], ecx
push ebx
jmp 0x4116b7
add ebx, 0xa5d1
pop ebx
push ecx
add ecx, 0x1649c
jmp 0x4116ca
or ecx, 0xc0b6
call 0x4116dc
add byte [edi], dh
inc edi
aas
cmp eax, dword [ebp + ecx*2 - 0x7d]
les eax, [ecx + ebx*2]