joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408980
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x5555bb
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x5973cc]
xor eax, esp
mov dword [esp + 0x228], eax
push ebx
push edi
mov eax, dword [0x5973cc]
xor eax, esp
push eax
lea eax, [esp + 0x238]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
mov dword [esp + 0xc], ebx
cmp edi, 0x23
je 0x4089dc
cmp edi, 0x1a
je 0x4089dc
push 0x571cec
mov ecx, esi
call fcn.00402ac0
jmp 0x408ae9
push 0x206
lea ecx, [esp + 0x32]
xor eax, eax
push ebx
push ecx
mov word [esp + 0x38], ax
call fcn.00506190
add esp, 0xc
lea edx, [esp + 0x2c]
push edx
push ebx
push ebx
push edi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, ebx
jge 0x408a2b
push ebx
xor eax, eax
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebx
push 0x571cec
mov ecx, esi
mov word [esi + 4], ax
call fcn.00404690
jmp 0x408ae9
mov edi, 7
xor ecx, ecx
lea eax, [esp + 0x2c]
mov dword [esp + 0x28], edi
mov dword [esp + 0x24], ebx
mov word [esp + 0x14], cx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x408a46
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x30]
push edx
lea ecx, [esp + 0x18]
call fcn.00404690
push 0x11
push str.360TotalSecurity
lea ecx, [esp + 0x18]
mov dword [esp + 0x248], ebx
call fcn.00406ae0
cmp byte [esp + 0x248], bl
jne 0x408ab5
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x18]
xor eax, eax
push ecx
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], ebx
mov ecx, esi
mov word [esi + 4], ax
call fcn.004057f0
cmp dword [esp + 0x28], 8
jb 0x408ae9
mov edx, dword [esp + 0x14]
push edx
call fcn.00505cfe
add esp, 4
jmp 0x408ae9
lea eax, [esp + 0x10]
push eax
call int.0041d7f0
add esp, 4
test al, al
je 0x408ad4
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.00404640
jmp 0x408ae0
push 0x571cec
mov ecx, esi
call fcn.00402ac0
lea ecx, [esp + 0x10]
call fcn.00402b00
mov eax, esi
mov ecx, dword [esp + 0x238]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [esp + 0x228]
xor ecx, esp
call fcn.005060ef
add esp, 0x238
ret
Function at 0x40bd60
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 4]
lea ecx, [esp + 4]
push ecx
or edx, 1
push edx
push 0
push eax
mov eax, dword [esi]
push eax
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40bdc4
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov esi, dword [esi + 8]
push ecx
mov ecx, dword [esp + 8]
push edx
push eax
push 0
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [esp + 4]
mov esi, eax
neg esi
sbb esi, esi
push edx
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ecx
ret
xor eax, eax
pop esi
pop ecx
ret

Function at 0x40bef0
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0x59d620]
test eax, eax
jne 0x40bf4b
push eax
push 1
push 0x59d61c
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
jne 0x40bf20
call fcn.0040c140
mov dword [0x59d620], eax
mov dword [0x59d61c], 2
ret
mov eax, dword [0x59d61c]
cmp eax, 2
je 0x40bf41
push esi
add bl, ch
push es
dec ebx
push eax
cmp al, 0x35
dec ecx
dec ecx

Function at 0x40bf2b
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20bc
push ebx
push esi
push edi
push edx
push edx
add esp, 4
add edx, 0x25e6
jmp 0x40bf4a
pop edx
push edi
push ecx
add esp, 4

Function at 0x40bf50
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
sub edi, 0x11889
add edi, 0x14365
sub edi, 0x15bbe
add dword [eax], eax
and edi, 0x1190b
pop edi
mov eax, 0x4d
mov word [ebp - 0x1ff8], ax
mov ecx, 0x42
mov word [ebp - 0x1ff6], cx
mov edx, 0x53
mov word [ebp - 0x1ff4], dx
mov eax, 0x65
mov word [ebp - 0x1ff2], ax
mov ecx, 0x72
mov word [ebp - 0x1ff0], cx
mov edx, 0x76
mov word [ebp - 0x1fee], dx
mov eax, 0x69
mov word [ebp - 0x1fec], ax
mov ecx, 0x63
mov word [ebp - 0x1fea], cx
mov edx, 0x65
mov word [ebp - 0x1fe8], dx
mov eax, 0x2e
mov word [ebp - 0x1fe6], ax
mov ecx, 0x65
mov word [ebp - 0x1fe4], cx
mov edx, 0x78
mov word [ebp - 0x1fe2], dx
mov eax, 0x65
mov word [ebp - 0x1fe0], ax
xor ecx, ecx
mov word [ebp - 0x1fde], cx
mov dword [ebp - 0x1060], 1
push eax
push edx
add esp, 4
add eax, 0xa676
call fcn.0040c032
add byte [eax], bh
dec esp
dec edx
xor eax, 0x3341464c
invalid
inc esi
Function at 0x40bf60
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
sub edi, 0x11889
add edi, 0x14365
sub edi, 0x15bbe
add dword [eax], eax
and edi, 0x1190b
pop edi
mov eax, 0x4d
mov word [ebp - 0x1ff8], ax
mov ecx, 0x42
mov word [ebp - 0x1ff6], cx
mov edx, 0x53
mov word [ebp - 0x1ff4], dx
mov eax, 0x65
mov word [ebp - 0x1ff2], ax
mov ecx, 0x72
mov word [ebp - 0x1ff0], cx
mov edx, 0x76
mov word [ebp - 0x1fee], dx
mov eax, 0x69
mov word [ebp - 0x1fec], ax
mov ecx, 0x63
mov word [ebp - 0x1fea], cx
mov edx, 0x65
mov word [ebp - 0x1fe8], dx
mov eax, 0x2e
mov word [ebp - 0x1fe6], ax
mov ecx, 0x65
mov word [ebp - 0x1fe4], cx
mov edx, 0x78
mov word [ebp - 0x1fe2], dx
mov eax, 0x65
mov word [ebp - 0x1fe0], ax
xor ecx, ecx
mov word [ebp - 0x1fde], cx
mov dword [ebp - 0x1060], 1
push eax
push edx
add esp, 4
add eax, 0xa676
call fcn.0040c032
add byte [eax], bh
dec esp
dec edx
xor eax, 0x3341464c
invalid
inc esi

Function at 0x40c032
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop eax
push ecx
sub ecx, 0x2781
add ecx, 0xb675
and ecx, 0x9c35
pop ecx
imul edx, dword [ebp - 0x1060], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x1060], 0xfe
sub edx, eax
xor edx, 0xaa6272
imul edx, dword [ebp - 0x1060]
imul ecx, dword [ebp - 0x1060], 0xfe
sub edx, ecx
mov dword [ebp - 0x1064], edx
push ebx
push ebx
add esp, 4
sub ebx, 0xeed8
sub ebx, 0xa603
add ebx, 0xe396
pop ebx
push ebx
sub ebx, 0x1e5f
sub ebx, 0x10929
or ebx, 0x123b0
jmp 0x40c0b6
pop ebx
mov dword [ebp - 0x10], 1
push eax
push ebx
add esp, 4
add eax, 0xdfce
or eax, 0x4104
and eax, 0x7ac3
call 0x40c0e4
add byte [edi + 0x39], cl
dec ebp
inc ebp
dec ecx
inc esp
xor cl, byte [esi + 0x35]
add esp, 4
pop eax
push ecx
sub ecx, 0x18141
pop ecx
imul edx, dword [ebp - 0x10], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x10], 0xfe
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0xfe
sub edx, ecx
mov dword [ebp - 0x14], edx
push esi
push ebx
add esp, 4
jmp 0x40c128
add esi, 0x7e6
xor esi, 0xe26b
pop esi
push edi
jmp 0x40c13b
or edi, 0xa0df
xor edi, 0x17ce9
xor edi, 0x14dae
pop edi
push esi
Function at 0x40c0e4
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop eax
push ecx
sub ecx, 0x2781
add ecx, 0xb675
and ecx, 0x9c35
pop ecx
imul edx, dword [ebp - 0x1060], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x1060], 0xfe
sub edx, eax
xor edx, 0xaa6272
imul edx, dword [ebp - 0x1060]
imul ecx, dword [ebp - 0x1060], 0xfe
sub edx, ecx
mov dword [ebp - 0x1064], edx
push ebx
push ebx
add esp, 4
sub ebx, 0xeed8
sub ebx, 0xa603
add ebx, 0xe396
pop ebx
push ebx
sub ebx, 0x1e5f
sub ebx, 0x10929
or ebx, 0x123b0
jmp 0x40c0b6
pop ebx
mov dword [ebp - 0x10], 1
push eax
push ebx
add esp, 4
add eax, 0xdfce
or eax, 0x4104
and eax, 0x7ac3
call 0x40c0e4
add byte [edi + 0x39], cl
dec ebp
inc ebp
dec ecx
inc esp
xor cl, byte [esi + 0x35]
add esp, 4
pop eax
push ecx
sub ecx, 0x18141
pop ecx
imul edx, dword [ebp - 0x10], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x10], 0xfe
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0xfe
sub edx, ecx
mov dword [ebp - 0x14], edx
push esi
push ebx
add esp, 4
jmp 0x40c128
add esi, 0x7e6
xor esi, 0xe26b
pop esi
push edi
jmp 0x40c13b
or edi, 0xa0df
xor edi, 0x17ce9
xor edi, 0x14dae
pop edi
push esi

Function at 0x40c197
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
inc edi
inc edi
dec edx
inc ebx
cmp eax, 0xc4833845
add al, 0xe8
or byte [eax], al
add byte [eax], al
add byte [edx], dh
cmp dword ss:[ebx], edi
cmp ecx, dword [ebp + 0x4b]
add esp, 4
pop edi
push ecx
or ecx, 0x87c8
add ecx, 0x119ac
pop ecx
imul edx, dword [ebp - 0x2c], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x2c], 0xfe
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0xfe
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x40c39a
mov ecx, dword [ebp - 0x1064]

Function at 0x40c1a7
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
inc edi
inc edi
dec edx
inc ebx
cmp eax, 0xc4833845
add al, 0xe8
or byte [eax], al
add byte [eax], al
add byte [edx], dh
cmp dword ss:[ebx], edi
cmp ecx, dword [ebp + 0x4b]
add esp, 4
pop edi
push ecx
or ecx, 0x87c8
add ecx, 0x119ac
pop ecx
imul edx, dword [ebp - 0x2c], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x2c], 0xfe
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0xfe
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x40c39a
mov ecx, dword [ebp - 0x1064]
Function at 0x40c330
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push esi
jmp 0x40c1ef
call 0x40c1fb
add byte [esi], bh
inc edx
inc edi
push eax
cmp byte [eax], bh
add esp, 4
jmp 0x40c206
pop esi
push edx
push edx
add esp, 4
or edx, 0xe498
sub edx, 0x16a96
pop edx
mov edx, dword [ebp - 0x30]
add edx, 0xfe
imul eax, dword [ebp - 0x2c], 0xfe
add eax, 0x56f3663b
imul ecx, dword [ebp - 0x2c], 0xfe
sub eax, ecx
xor edx, eax
imul edx, dword [ebp - 0x2c]
mov dword [ebp - 0x1d60], edx
push esi
push ecx
add esp, 4
sub esi, 0x11cd1
pop esi
push esi
push ecx
add esp, 4
and esi, 0x118ce
jmp 0x40c260
xor esi, 0x12e2b
xor esi, 0x11f99
pop esi
push eax
add eax, 0x16348
pop eax
mov edx, dword [ebp - 0x1d60]
add edx, 1
mov dword [ebp - 0x159c], edx
push ebx
and ebx, 0x757f
or ebx, 0x4182
pop ebx
push esi
call fcn.0040c29f
add byte [ebp + 0x43], cl
dec edi
dec ecx
cmp dword [ebx + 0x575e04c4], eax
add esp, 4
pop esi
push edi
or edi, 0xa9f7
jmp 0x40c2af
sub edi, 0xc56d
pop edi
push ecx
and ecx, 0x125c2
jmp 0x40c2c2
add ecx, 0x9f27
pop ecx
push ecx
or ecx, 0x4587
or ecx, 0xd5a5
call 0x40c2e4
add byte [edx], dh
xor ecx, dword [ecx + edi + 0x48]
cmp al, 0x42
cmp eax, dword [ebx + 0x695904c4]
inc ebp
aam 0xfe
add byte [eax], al
add byte [0x56f3663b], al
imul ecx, dword [ebp - 0x2c], 0xfe
sub eax, ecx
xor eax, dword [ebp - 0x159c]
imul eax, dword [ebp - 0x2c]
imul edx, dword [ebp - 0x2c], 0xfe
sub eax, edx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x159c]
imul eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1e28], eax
mov dword [ebp - 0x1628], 1
push esi
push ebx
add esp, 4
les eax, [ecx + eax*4]
mov ch, 0x49
add byte [eax], al
add esi, 0x1146
pop esi
push edi
xor edi, 0x3f4b
and edi, 0x2ecf
pop edi
push edx
push ecx
add esp, 4
les eax, [ecx + eax*4]
loop 0x40c323
xor dword [eax], eax
add byte [ecx + 0x1f78e2], al
add byte [edx + 0x69], bl
invalid
fsubr st(1)
invalid
invalid
inc byte [eax]
add byte [eax], al
add ecx, 0x56f3663b
imul edx, dword [ebp - 0x1628], 0xfe
xchg ebp, eax
fsubr st(1)
invalid
invalid
inc byte [eax]
add byte [eax], al
sub ecx, edx
xor ecx, dword [ebp - 0x1e28]
dec dword [edi]
scasd eax, dword es:[edi]
invalid
fsubr st(1)
invalid
jmp [ecx - 0x7b]
fsubr st(1)
invalid
invalid
inc byte [eax]
add byte [eax], al
sub ecx, eax
mov dword [ebp - 0x162c], ecx
imul ecx, dword [ebp - 0x10c0], 0xfe
sub edx, ecx
mov dword [ebp - 0x10c4], edx
mov edx, dword [ebp - 0x10c4]
mov eax, dword [ebp - 0x10c0]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], eax
push ecx
sub ecx, 0xd223
and ecx, 0x16f71
and ecx, 0x11a48
call 0x40f536
add byte [esi + 0x33], al
inc eax
xor al, 0x34
xor cl, byte [ecx + 0x4c]
xor al, 0x83
les eax, [ecx + ebx*2]
push eax
push edi
add esp, 4
or eax, 0x110d
pop eax
jmp 0x40c1e7
Function at 0x40c350
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push esi
jmp 0x40c1ef
call 0x40c1fb
add byte [esi], bh
inc edx
inc edi
push eax
cmp byte [eax], bh
add esp, 4
jmp 0x40c206
pop esi
push edx
push edx
add esp, 4
or edx, 0xe498
sub edx, 0x16a96
pop edx
mov edx, dword [ebp - 0x30]
add edx, 0xfe
imul eax, dword [ebp - 0x2c], 0xfe
add eax, 0x56f3663b
imul ecx, dword [ebp - 0x2c], 0xfe
sub eax, ecx
xor edx, eax
imul edx, dword [ebp - 0x2c]
mov dword [ebp - 0x1d60], edx
push esi
push ecx
add esp, 4
sub esi, 0x11cd1
pop esi
push esi
push ecx
add esp, 4
and esi, 0x118ce
jmp 0x40c260
xor esi, 0x12e2b
xor esi, 0x11f99
pop esi
push eax
add eax, 0x16348
pop eax
mov edx, dword [ebp - 0x1d60]
add edx, 1
mov dword [ebp - 0x159c], edx
push ebx
and ebx, 0x757f
or ebx, 0x4182
pop ebx
push esi
call fcn.0040c29f
add byte [ebp + 0x43], cl
dec edi
dec ecx
cmp dword [ebx + 0x575e04c4], eax
add esp, 4
pop esi
push edi
or edi, 0xa9f7
jmp 0x40c2af
sub edi, 0xc56d
pop edi
push ecx
and ecx, 0x125c2
jmp 0x40c2c2
add ecx, 0x9f27
pop ecx
push ecx
or ecx, 0x4587
or ecx, 0xd5a5
call 0x40c2e4
add byte [edx], dh
xor ecx, dword [ecx + edi + 0x48]
cmp al, 0x42
cmp eax, dword [ebx + 0x695904c4]
inc ebp
aam 0xfe
add byte [eax], al
add byte [0x56f3663b], al
imul ecx, dword [ebp - 0x2c], 0xfe
sub eax, ecx
xor eax, dword [ebp - 0x159c]
imul eax, dword [ebp - 0x2c]
imul edx, dword [ebp - 0x2c], 0xfe
sub eax, edx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x159c]
imul eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1e28], eax
mov dword [ebp - 0x1628], 1
push esi
push ebx
add esp, 4
les eax, [ecx + eax*4]
mov ch, 0x49
add byte [eax], al
add esi, 0x1146
pop esi
push edi
xor edi, 0x3f4b
and edi, 0x2ecf
pop edi
push edx
push ecx
add esp, 4
les eax, [ecx + eax*4]
loop 0x40c323
xor dword [eax], eax
add byte [ecx + 0x1f78e2], al
add byte [edx + 0x69], bl
invalid
fsubr st(1)
invalid
invalid
inc byte [eax]
add byte [eax], al
add ecx, 0x56f3663b
imul edx, dword [ebp - 0x1628], 0xfe
xchg ebp, eax
fsubr st(1)
invalid
invalid
inc byte [eax]
add byte [eax], al
sub ecx, edx
xor ecx, dword [ebp - 0x1e28]
dec dword [edi]
scasd eax, dword es:[edi]
invalid
fsubr st(1)
invalid
jmp [ecx - 0x7b]
fsubr st(1)
invalid
invalid
inc byte [eax]
add byte [eax], al
sub ecx, eax
mov dword [ebp - 0x162c], ecx
imul ecx, dword [ebp - 0x10c0], 0xfe
sub edx, ecx
mov dword [ebp - 0x10c4], edx
mov edx, dword [ebp - 0x10c4]
mov eax, dword [ebp - 0x10c0]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], eax
push ecx
sub ecx, 0xd223
and ecx, 0x16f71
and ecx, 0x11a48
call 0x40f536
add byte [esi + 0x33], al
inc eax
xor al, 0x34
xor cl, byte [ecx + 0x4c]
xor al, 0x83
les eax, [ecx + ebx*2]
push eax
push edi
add esp, 4
or eax, 0x110d
pop eax
jmp 0x40c1e7
Function at 0x40c3a0
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x1060]
mov dword [ebp - 0x1634], ecx
mov dword [ebp - 0x1630], edx
push edi
call 0x40c3bf
add byte [edi], dh
aaa
xor dh, byte [esi]
xor eax, 0x4c48345
pop edi
push eax
call 0x40c3d4
add byte [esi + 0x3c], al
cmp ecx, dword [ebx + 0x4f]
inc ebx
aas
dec esp
inc esi
dec edi
add esp, 4
xor eax, 0x16204
and eax, 0x16e7e
pop eax
push ebx
add ebx, 0xaaa6
call 0x40c3f9
add byte [ebx + 0x39], cl
inc edx
inc ebx
inc ecx
xor ecx, dword [edi + 0x4f]
add esp, 4
sub ebx, 0x929e
pop ebx
push edi
jmp 0x40c409
xor edi, 0x6174
and edi, 0x13f69
pop edi
mov eax, dword [ebp - 0x30]
add eax, 0xfe
imul ecx, dword [ebp - 0x2c], 0xfe
add ecx, 0x56f3663b
imul edx, dword [ebp - 0x2c], 0xfe
sub ecx, edx
xor eax, ecx
imul eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1e30], eax
push eax
push ebx
add esp, 4
or eax, 0x25fe
or eax, 0x6af7
and eax, 0xaa07
pop eax
push eax
or eax, 0x10baf
or eax, 0xdb85
xor eax, 0x16b4b
or eax, 0x76bf
pop eax
mov eax, dword [ebp - 0x1634]
add eax, 0xfe
imul ecx, dword [ebp - 0x1630], 0xfe
add ecx, 0x56f3663b
imul edx, dword [ebp - 0x1630], 0xfe
sub ecx, edx
xor eax, ecx
imul eax, dword [ebp - 0x1630]
mov dword [ebp - 0x1e2c], eax
mov eax, dword [ebp - 0x1e2c]
mov dword [ebp - 0x1e34], eax
mov ecx, dword [ebp - 0x1e30]
cmp ecx, dword [ebp - 0x1e34]

Function at 0x40c3bf
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x1060]
mov dword [ebp - 0x1634], ecx
mov dword [ebp - 0x1630], edx
push edi
call 0x40c3bf
add byte [edi], dh
aaa
xor dh, byte [esi]
xor eax, 0x4c48345
pop edi
push eax
call 0x40c3d4
add byte [esi + 0x3c], al
cmp ecx, dword [ebx + 0x4f]
inc ebx
aas
dec esp
inc esi
dec edi
add esp, 4
xor eax, 0x16204
and eax, 0x16e7e
pop eax
push ebx
add ebx, 0xaaa6
call 0x40c3f9
add byte [ebx + 0x39], cl
inc edx
inc ebx
inc ecx
xor ecx, dword [edi + 0x4f]
add esp, 4
sub ebx, 0x929e
pop ebx
push edi
jmp 0x40c409
xor edi, 0x6174
and edi, 0x13f69
pop edi
mov eax, dword [ebp - 0x30]
add eax, 0xfe
imul ecx, dword [ebp - 0x2c], 0xfe
add ecx, 0x56f3663b
imul edx, dword [ebp - 0x2c], 0xfe
sub ecx, edx
xor eax, ecx
imul eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1e30], eax
push eax
push ebx
add esp, 4
or eax, 0x25fe
or eax, 0x6af7
and eax, 0xaa07
pop eax
push eax
or eax, 0x10baf
or eax, 0xdb85
xor eax, 0x16b4b
or eax, 0x76bf
pop eax
mov eax, dword [ebp - 0x1634]
add eax, 0xfe
imul ecx, dword [ebp - 0x1630], 0xfe
add ecx, 0x56f3663b
imul edx, dword [ebp - 0x1630], 0xfe
sub ecx, edx
xor eax, ecx
imul eax, dword [ebp - 0x1630]
mov dword [ebp - 0x1e2c], eax
mov eax, dword [ebp - 0x1e2c]
mov dword [ebp - 0x1e34], eax
mov ecx, dword [ebp - 0x1e30]
cmp ecx, dword [ebp - 0x1e34]
Function at 0x40c3d4
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x1060]
mov dword [ebp - 0x1634], ecx
mov dword [ebp - 0x1630], edx
push edi
call 0x40c3bf
add byte [edi], dh
aaa
xor dh, byte [esi]
xor eax, 0x4c48345
pop edi
push eax
call 0x40c3d4
add byte [esi + 0x3c], al
cmp ecx, dword [ebx + 0x4f]
inc ebx
aas
dec esp
inc esi
dec edi
add esp, 4
xor eax, 0x16204
and eax, 0x16e7e
pop eax
push ebx
add ebx, 0xaaa6
call 0x40c3f9
add byte [ebx + 0x39], cl
inc edx
inc ebx
inc ecx
xor ecx, dword [edi + 0x4f]
add esp, 4
sub ebx, 0x929e
pop ebx
push edi
jmp 0x40c409
xor edi, 0x6174
and edi, 0x13f69
pop edi
mov eax, dword [ebp - 0x30]
add eax, 0xfe
imul ecx, dword [ebp - 0x2c], 0xfe
add ecx, 0x56f3663b
imul edx, dword [ebp - 0x2c], 0xfe
sub ecx, edx
xor eax, ecx
imul eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1e30], eax
push eax
push ebx
add esp, 4
or eax, 0x25fe
or eax, 0x6af7
and eax, 0xaa07
pop eax
push eax
or eax, 0x10baf
or eax, 0xdb85
xor eax, 0x16b4b
or eax, 0x76bf
pop eax
mov eax, dword [ebp - 0x1634]
add eax, 0xfe
imul ecx, dword [ebp - 0x1630], 0xfe
add ecx, 0x56f3663b
imul edx, dword [ebp - 0x1630], 0xfe
sub ecx, edx
xor eax, ecx
imul eax, dword [ebp - 0x1630]
mov dword [ebp - 0x1e2c], eax
mov eax, dword [ebp - 0x1e2c]
mov dword [ebp - 0x1e34], eax
mov ecx, dword [ebp - 0x1e30]
cmp ecx, dword [ebp - 0x1e34]

Function at 0x40c3f9
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x1060]
mov dword [ebp - 0x1634], ecx
mov dword [ebp - 0x1630], edx
push edi
call 0x40c3bf
add byte [edi], dh
aaa
xor dh, byte [esi]
xor eax, 0x4c48345
pop edi
push eax
call 0x40c3d4
add byte [esi + 0x3c], al
cmp ecx, dword [ebx + 0x4f]
inc ebx
aas
dec esp
inc esi
dec edi
add esp, 4
xor eax, 0x16204
and eax, 0x16e7e
pop eax
push ebx
add ebx, 0xaaa6
call 0x40c3f9
add byte [ebx + 0x39], cl
inc edx
inc ebx
inc ecx
xor ecx, dword [edi + 0x4f]
add esp, 4
sub ebx, 0x929e
pop ebx
push edi
jmp 0x40c409
xor edi, 0x6174
and edi, 0x13f69
pop edi
mov eax, dword [ebp - 0x30]
add eax, 0xfe
imul ecx, dword [ebp - 0x2c], 0xfe
add ecx, 0x56f3663b
imul edx, dword [ebp - 0x2c], 0xfe
sub ecx, edx
xor eax, ecx
imul eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1e30], eax
push eax
push ebx
add esp, 4
or eax, 0x25fe
or eax, 0x6af7
and eax, 0xaa07
pop eax
push eax
or eax, 0x10baf
or eax, 0xdb85
xor eax, 0x16b4b
or eax, 0x76bf
pop eax
mov eax, dword [ebp - 0x1634]
add eax, 0xfe
imul ecx, dword [ebp - 0x1630], 0xfe
add ecx, 0x56f3663b
imul edx, dword [ebp - 0x1630], 0xfe
sub ecx, edx
xor eax, ecx
imul eax, dword [ebp - 0x1630]
mov dword [ebp - 0x1e2c], eax
mov eax, dword [ebp - 0x1e2c]
mov dword [ebp - 0x1e34], eax
mov ecx, dword [ebp - 0x1e30]
cmp ecx, dword [ebp - 0x1e34]
Function at 0x40f850
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edi
add esp, 4
xor ecx, 0x1717
pop ecx
push esi
push edi
add esp, 4
or esi, 0x45fb
pop esi
jmp 0x40fa9a

Function at 0x40f950
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
jg 0x40f953
add byte [ecx + 0x553df0], al
add byte [eax - 0x75], bl
xchg ebp, eax
cmp al, 0xf5
invalid

Function at 0x40f9e0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp dword [ebp - 0xc80], 0
jle 0x40fa40
push edi
add edi, 0x12a5b
pop edi
push edx
push ebx
add esp, 4
xor edx, 0x71e8
pop edx
push eax
push edi
add esp, 4
and eax, 0x4a6d
and eax, 0x6b00
or eax, 0x17f52
jg 0x40f953
add byte [ecx + 0x553df0], al
add byte [eax - 0x75], bl
xchg ebp, eax
cmp al, 0xf5
invalid
dec dword [edi]
mov dh, 2
mov ecx, dword [ebp - 0xa60]
movzx edx, byte [ecx]
cmp eax, edx
je 0x40f9dc
push edx
push eax
add esp, 4
xor edx, 0xab03
sub edx, 0xedfd
call 0x40f98f
add byte [edi], dh
inc ebp
inc eax
cmp eax, 0x41493849
add esp, 4
call 0x40f99e
add byte [edi + 0x40], al
inc edx
xor cl, byte [ebx + 0x3a]
add esp, 4
pop edx
mov eax, dword [ebp - 0xac4]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0xa60]
movzx eax, byte [edx]
cmp ecx, eax
jle 0x40f9c4
mov dword [ebp - 0x15c8], 1
jmp 0x40f9ce
mov dword [ebp - 0x15c8], 0xffffffff
mov ecx, dword [ebp - 0x15c8]
mov dword [ebp - 0xc84], ecx
jmp 0x40fa40
push esi
sub esi, 0x134e3
xor al, 1
add byte [ecx + 0x12704c6], al
add byte [ecx + 0x551dee], al
add byte [ecx + 0x1181eee], al
add byte [esi + 0x56], bl
xor al, 1
add byte [ecx + 0x12704c6], al
add byte [ecx + 0x551dee], al
add byte [ecx + 0x1181eee], al
add byte [esi + 0x56], bl
push edx
add esp, 4
and esi, 0x9074
pop esi
push eax
push esi
add esp, 4
jmp 0x40fa0d
pop eax
mov edx, dword [ebp - 0xc80]
sub edx, 1
mov dword [ebp - 0xc80], edx
mov eax, dword [ebp - 0xac4]
add eax, 1
mov dword [ebp - 0xac4], eax
mov ecx, dword [ebp - 0xa60]
add ecx, 1
mov dword [ebp - 0xa60], ecx
jmp 0x40f91b
mov edx, dword [ebp - 0xc84]
mov dword [ebp - 0x15cc], edx
cmp dword [ebp - 0x15cc], 0
jne 0x40fa95
push edi
call 0x40fa64
add byte [esi], bh
inc edi
dec edi
inc edx
inc esp
push eax
dec eax
inc edi
add esp, 4
and edi, 0x5f65
call 0x40fa7b
add byte [esi + 0x47], al
aas
dec edx
cmp al, 0x32
cmp al, byte [edx - 0x7d]
les eax, [ebx + ebp*8]
push es
aas
dec esi
dec edx
inc edi
cmp eax, 0x858b5f39
add al, 0xfb
invalid
jmp 0x40f7e3