joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54b640
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x54b7b3
movzx eax, byte [esp + 4]
lea ecx, [eax - 0x61]
cmp cl, 0x19
jbe 0x54b673
lea ecx, [eax - 0x41]
cmp cl, 0x19
jbe 0x54b673
lea ecx, [eax - 0x30]
cmp cl, 9
ja 0x54b679
mov byte [esp + 0xc], 0
ret
mov ecx, dword [esp + 8]
cmp ecx, 3
je 0x54b687
cmp ecx, 4
jne 0x54b6b8
cmp al, 0x2c
ja 0x54b6a0
lea edx, [eax - 0x21]
cmp dl, 1
jbe 0x54b6b2
cmp al, 0x24
je 0x54b6b2
cmp al, 0x26
jae 0x54b6b2
jmp 0x54b6b8
lea edx, [eax - 0x3a]
cmp dl, 4
jbe 0x54b6b2
cmp al, 0x5b
je 0x54b6b2
cmp al, 0x5d
jne 0x54b6b8
mov byte [esp + 0xc], 0
ret
cmp al, 0x2f
ja 0x54b6ef
cmp al, 0x26
ja 0x54b6d1
cmp al, 0x24
je 0x54b70e
cmp al, 0x26
je 0x54b70e
jmp 0x54b795
lea edx, [eax - 0x2b]
cmp dl, 1
jbe 0x54b70e
lea edx, [eax - 0x2d]
cmp dl, 1
jbe 0x54b78f
cmp al, 0x2f
je 0x54b70e
jmp 0x54b795
cmp al, 0x3d
ja 0x54b706
lea edx, [eax - 0x3a]
cmp dl, 1
jbe 0x54b70e
cmp al, 0x3d
je 0x54b70e
jmp 0x54b795
lea edx, [eax - 0x3f]
cmp dl, 1
ja 0x54b785
cmp ecx, 2
jg 0x54b749
cmp ecx, 1
je 0x54b73e
cmp ecx, 2
jne 0x54b795
cmp al, 0x2f
je 0x54b72c
cmp al, 0x3b
je 0x54b72c
cmp al, 0x2c
jne 0x54b733
mov eax, 1
jmp 0x54b739
cmp al, 0x3f
sete al
mov byte [esp + 0xc], al
ret
cmp al, 0x3f
sete al
mov byte [esp + 0xc], al
ret
cmp ecx, 5
jne 0x54b76f
cmp al, 0x40
je 0x54b75d
cmp al, 0x2f
je 0x54b75d
cmp al, 0x3f
jne 0x54b764
mov eax, 1
jmp 0x54b76a
cmp al, 0x3a
sete al
mov byte [esp + 0xc], al
ret
cmp ecx, 6
je 0x54b77f
cmp ecx, 7
jne 0x54b795
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
ret
cmp al, 0x5f
je 0x54b78f
cmp al, 0x7e
jne 0x54b795
mov byte [esp + 0xc], 0
ret
cmp ecx, 7
jne 0x54b7ad
cmp al, 0x21
je 0x54b7a7
add eax, 0xffffffd8
cmp al, 2
ja 0x54b7ad
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
ret
call fcn.00462320
jmp fcn.0054b640
Function at 0x403010
Capabilities:
Get common file path
Get disk information
Get hostname
Manipulate console buffer
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc4
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [0x4595e8]
push ebx
mov ebx, dword [eax + 4]
mov eax, dword [0x4595ec]
push esi
mov dword [ebp - 0x18], eax
push edi
lea eax, [ebp - 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], edx
call fcn.00403000
mov edi, dword [ebp - 0xc]
mov ecx, dword [0x4595f0]
mov edx, dword [0x4595f4]
add edi, 0x23f
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x10], 0x20
lea esp, [esp]
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov esi, dword [ebp - 8]
mov eax, dword [0x460dec]
shl esi, 4
add esi, dword [ebp - 0x1c]
cmp eax, 0xfa9
jne 0x40309c
mov dword [0x460de8], 0xedeb2e40
jmp 0x4030b7
cmp eax, 0x3eb
jne 0x4030b7
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [0x460878], 0
mov eax, dword [ebp - 8]
lea ecx, [edi + eax]
mov eax, dword [ebp - 8]
shr eax, 5
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x20]
add dword [ebp - 4], edx
xor esi, ecx
cmp dword [0x460dec], 0x9e6
mov dword [0x460de4], 0xf4ea3dee
jne 0x4030ee
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EscapeCommFunction]
xor dword [ebp - 4], esi
cmp dword [0x460dec], 0x213
jne 0x40316a
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
lea eax, [ebp - 0x4c4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsA]
lea ecx, [ebp - 0xcc4]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea edx, [ebp - 0x28]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
lea eax, [ebp - 0xc4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea ecx, [ebp - 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
sub ebx, dword [ebp - 4]
cmp dword [0x460dec], 0xc
jne 0x40318e
lea edx, [ebp - 0x30]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputW]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalWire]
mov eax, ebx
shr eax, 5
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
add dword [ebp - 4], eax
mov esi, ebx
shl esi, 4
add esi, dword [ebp - 0x14]
lea ecx, [edi + ebx]
xor esi, ecx
cmp dword [0x460dec], 0xb03
jne 0x4031c9
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
xor esi, dword [ebp - 4]
mov dword [ebp - 0x24], esi
mov eax, dword [ebp - 0x24]
sub dword [ebp - 8], eax
add edi, 0x61c88647
sub dword [ebp - 0x10], 1
jne 0x403070
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
pop edi
pop esi
mov dword [eax + 4], ebx
mov dword [eax], edx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x403200
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x460dec]
mov ecx, dword [0x46087c]
shr eax, 3
test eax, eax
jbe 0x403288
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edi
mov edi, ecx
mov dword [ebp - 4], eax
lea ebx, [ebx]
cmp dword [0x460dec], 0x959
jne 0x403276
push 0
push 0
call ebx
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCalendarInfoW]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoA]
push edi
call fcn.00403010
add edi, 8
sub dword [ebp - 4], 1
jne 0x403230
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40943c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x458880]
jne 0x409446
repz ret
jmp fcn.0040d1cd

Function at 0x40cdff
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00408b3b
and dword [ebp - 4], 0
cmp dword [0x45e868], 0
mov ebx, eax
jne 0x40ceb0
push 0x401bf8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40cf61
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401bec
push edi
call esi
test eax, eax
je 0x40cf61
push eax
call fcn.00408ac9
mov dword [esp], 0x401bdc
push edi
mov dword [0x45e868], eax
call esi
push eax
call fcn.00408ac9
mov dword [esp], 0x401bc8
push edi
mov dword [0x45e86c], eax
call esi
push eax
call fcn.00408ac9
mov dword [esp], 0x401bac
push edi
mov dword [0x45e870], eax
call esi
push eax
call fcn.00408ac9
pop ecx
mov dword [0x45e878], eax
test eax, eax
je 0x40ceb0
push 0x401b94
push edi
call esi
push eax
call fcn.00408ac9
pop ecx
mov dword [0x45e874], eax
mov eax, dword [0x45e874]
cmp eax, ebx
je 0x40cf08
cmp dword [0x45e878], ebx
je 0x40cf08
push eax
call fcn.00408b44
push dword [0x45e878]
mov esi, eax
call fcn.00408b44
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40cf08
test edi, edi
je 0x40cf08
call esi
test eax, eax
je 0x40ceff
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40ceff
test byte [ebp - 0xc], 1
jne 0x40cf08
or dword [ebp + 0x10], 0x200000
jmp 0x40cf41
mov eax, dword [0x45e86c]
cmp eax, ebx
je 0x40cf41
push eax
call fcn.00408b44
pop ecx
test eax, eax
je 0x40cf41
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40cf41
mov eax, dword [0x45e870]
cmp eax, ebx
je 0x40cf41
push eax
call fcn.00408b44
pop ecx
test eax, eax
je 0x40cf41
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x45e868]
call fcn.00408b44
pop ecx
test eax, eax
je 0x40cf61
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40cf63
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x414838
Capabilities:
Accept command line arguments

Disassembly:
sub dword [0x425798], 1
jae 0x4148be
mov byte [0x4215f0], 2
mov dword [0x4251e8], 0x4205bc
mov dword [0x4251ec], 0x4205d4
mov byte [0x425226], 2
mov dword [0x4251d4], 0x413954
call fcn.004120f8
test al, al
je 0x41487b
call fcn.00412128
call fcn.004121ec
mov word [0x42522c], 0xd7b0
mov word [0x4253f8], 0xd7b0
mov word [0x4255c4], 0xd7b0
call fcn.00413848
call sub.KERNEL32.DLL_GetCommandLineA
mov dword [0x425218], eax
call fcn.00410164
mov dword [0x425214], eax
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [0x42520c], eax
ret

Function at 0x41a750
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x41a7b2
call fcn.0041a700
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.004154e4
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.004154e4
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x41a830
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x4233c4], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x41a90a
cmp dword [0x4233c0], 0
jne 0x41a90a
cmp dword [0x4235a4], 0
je 0x41a8c4
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.0041a600
add esp, 8
mov ebx, eax
test eax, eax
jne 0x41a8aa
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.0041a600
add esp, 8
mov ebx, eax
test eax, eax
jne 0x41a8aa
lea ebx, [ebp - 0x84]
jmp 0x41a8ab
inc ebx
call fcn.0041a7ec
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x41a945
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x4233c8
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.004154e4
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x4233cb
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x41a945
cmp dword [0x4233c0], 0
je 0x41a924
cmp dword [0x4233c0], 0xffffffff
je 0x41a945
push esi
call dword [0x4233c0]
pop ecx
mov eax, dword [0x4233c4]
test eax, eax
je 0x41a945
cmp dword [0x4233c4], 0xffffffff
je 0x41a945
cmp byte [eax], 0
je 0x41a945
push esi
push eax
call fcn.0041a750
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x408928
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x4085d8
call fcn.00408951
or ebx, edi
sub ebx, 0xe9f749f8
xor dword [ecx], edx
inc ecx
mov edi, 0xeb0815be
dec ebx
cmp ecx, eax
jne fcn.00408928
sub esp, 4
mov dword [esp], ebx
pop edi
mov edi, edi
ret
Function at 0x401020
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
mov eax, dword [ebp + 8]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401038
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40106a
mov ecx, dword [ebp + 8]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x401066
cmp esi, eax
jae 0x40106a
dec edi
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401058
cmp esi, eax
jb 0x401070
pop esi
xor eax, eax
pop edi
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret
Function at 0x407340
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x15], 0
mov ebx, ecx
mov esi, edi
jne 0x407390
mov eax, dword [esi + 8]
push eax
mov ecx, ebx
call fcn.00407340
mov eax, dword [edi + 0x55]
push ebp
mov ebp, esp
sub esp, 0x4b8
push ebx
push esi
push edi
push edi
push esi
add esp, 4
xor edi, 0xac46
and edi, 0x41b2
xor edi, 0x10f90
pop edi
push esi
or esi, 0x13c6a
add esi, 0xe5eb
pop esi
push edi
add byte [esi + 0x57], bl
push edi
add esp, 4
or edi, 0xe4f6
pop edi
invalid
invalid

Function at 0x407360
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x15], 0
mov ebx, ecx
mov esi, edi
jne 0x407390
mov eax, dword [esi + 8]
push eax
mov ecx, ebx
call fcn.00407340
mov eax, dword [edi + 0x55]
push ebp
mov ebp, esp
sub esp, 0x4b8
push ebx
push esi
push edi
push edi
push esi
add esp, 4
xor edi, 0xac46
and edi, 0x41b2
xor edi, 0x10f90
pop edi
push esi
or esi, 0x13c6a
add esi, 0xe5eb
pop esi
push edi
add byte [esi + 0x57], bl
push edi
add esp, 4
or edi, 0xe4f6
pop edi
invalid
invalid

Function at 0x4073a0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
add byte [esi - 0x77], ah
test dword [eax - 3], edx
invalid

Function at 0x407400
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
add byte [esi - 0x77], ah
xchg ebp, eax
pushal
std
invalid
Function at 0x408173
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop eax
push edx
xor edx, 0x16e06
xor edx, 0xb415
and edx, 0x3634
add edx, 0x178bb
pop edx
mov edx, dword [ebp - 0x128]
mov dword [ebp - 0x98], edx
jmp 0x4085d3
cmp dword [ebp - 0x98], 0
je 0x40867c
push edi
jmp 0x4085e7
pop edi
push edx
push ecx
add esp, 4
add edx, 0x100bb
call 0x408602
add byte [edx + 0x39], al
dec ebx
inc ebp
inc edi
cmp dword [ebx + 0x34], eax
cmp al, byte [ebx + 0x525a04c4]
push eax
add esp, 4
xor edx, 0xd1da
pop edx
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x49c], eax
mov ecx, dword [ebp - 0x49c]
mov dword [ebp - 0x4a0], ecx
lea edx, [ebp - 0x2b0]
push edx
call dword [ebp - 0x4a0]
test eax, eax
jne 0x40867c
push eax
sub eax, 0x10be4
add eax, 0x6d5a
and eax, 0xaaec
pop eax
push edi
or edi, 0x4993
jmp 0x40865e
pop edi
push edx
add edx, 0xf481
and edx, 0x10081
pop edx
mov dword [ebp - 0x1b4], 0
invalid
invalid
inc dword [eax]
add byte [eax], al
add cl, ch
ror dword [edx], 0
invalid

Function at 0x4081d0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ecx
mov eax, dword [ebp - 0x8c]
add eax, dword [ebp - 0x2b4]
mov dword [ebp - 0x11c], eax
jne 0x40822b
push edi
push ebx
add esp, 4
or edi, 0x6a70
pop edi
push edi
and edi, 0xa8a8
add edi, 0x11a53
add edi, 0x822e
pop edi
push esi
call 0x408216
add byte [ecx], bh
aas
push eax
dec esp
dec ebx
aas
xor al, 0x83
les eax, [esi + ebx*2]
mov ecx, dword [ebp - 0x128]
mov dword [ebp - 0x98], ecx
jmp 0x4085d3
mov edx, dword [ebp - 0x11c]
mov eax, dword [ebp - 0x8c]
add eax, dword [edx + 0x20]
mov dword [ebp - 0x48c], eax
push ebx
push ecx
add esp, 4
call 0x408251
add byte [ecx + 0x44], al
dec esp
inc ebp
xor al, 0x38
add esp, 4
call 0x408260
add byte [edx], bh
inc edx
push eax
inc ecx
cmp byte [edi - 0x7d], cl
les eax, [ebx + ebx*2]
push ecx
xor ecx, 0xc10c
or ecx, 0x164e2
pop ecx
mov ecx, dword [ebp - 0x11c]
mov edx, dword [ebp - 0x8c]
add edx, dword [ecx + 0x24]
mov dword [ebp - 0x490], edx
push edi
xor edi, 0x8e0e
pop edi
push edx
push esi
add esp, 4
or edx, 0x2cda
call 0x4082a9
add byte [ebx + 0x4f], al
cmp al, 0x39
cmp eax, dword [ebx + 0x42]
inc edi
xor al, 0x83
les eax, [ecx + eax*4]
retf 0x4247
Function at 0x408216
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ecx
mov eax, dword [ebp - 0x8c]
add eax, dword [ebp - 0x2b4]
mov dword [ebp - 0x11c], eax
jne 0x40822b
push edi
push ebx
add esp, 4
or edi, 0x6a70
pop edi
push edi
and edi, 0xa8a8
add edi, 0x11a53
add edi, 0x822e
pop edi
push esi
call 0x408216
add byte [ecx], bh
aas
push eax
dec esp
dec ebx
aas
xor al, 0x83
les eax, [esi + ebx*2]
mov ecx, dword [ebp - 0x128]
mov dword [ebp - 0x98], ecx
jmp 0x4085d3
mov edx, dword [ebp - 0x11c]
mov eax, dword [ebp - 0x8c]
add eax, dword [edx + 0x20]
mov dword [ebp - 0x48c], eax
push ebx
push ecx
add esp, 4
call 0x408251
add byte [ecx + 0x44], al
dec esp
inc ebp
xor al, 0x38
add esp, 4
call 0x408260
add byte [edx], bh
inc edx
push eax
inc ecx
cmp byte [edi - 0x7d], cl
les eax, [ebx + ebx*2]
push ecx
xor ecx, 0xc10c
or ecx, 0x164e2
pop ecx
mov ecx, dword [ebp - 0x11c]
mov edx, dword [ebp - 0x8c]
add edx, dword [ecx + 0x24]
mov dword [ebp - 0x490], edx
push edi
xor edi, 0x8e0e
pop edi
push edx
push esi
add esp, 4
or edx, 0x2cda
call 0x4082a9
add byte [ebx + 0x4f], al
cmp al, 0x39
cmp eax, dword [ebx + 0x42]
inc edi
xor al, 0x83
les eax, [ecx + eax*4]
retf 0x4247

Function at 0x408251
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ecx
mov eax, dword [ebp - 0x8c]
add eax, dword [ebp - 0x2b4]
mov dword [ebp - 0x11c], eax
jne 0x40822b
push edi
push ebx
add esp, 4
or edi, 0x6a70
pop edi
push edi
and edi, 0xa8a8
add edi, 0x11a53
add edi, 0x822e
pop edi
push esi
call 0x408216
add byte [ecx], bh
aas
push eax
dec esp
dec ebx
aas
xor al, 0x83
les eax, [esi + ebx*2]
mov ecx, dword [ebp - 0x128]
mov dword [ebp - 0x98], ecx
jmp 0x4085d3
mov edx, dword [ebp - 0x11c]
mov eax, dword [ebp - 0x8c]
add eax, dword [edx + 0x20]
mov dword [ebp - 0x48c], eax
push ebx
push ecx
add esp, 4
call 0x408251
add byte [ecx + 0x44], al
dec esp
inc ebp
xor al, 0x38
add esp, 4
call 0x408260
add byte [edx], bh
inc edx
push eax
inc ecx
cmp byte [edi - 0x7d], cl
les eax, [ebx + ebx*2]
push ecx
xor ecx, 0xc10c
or ecx, 0x164e2
pop ecx
mov ecx, dword [ebp - 0x11c]
mov edx, dword [ebp - 0x8c]
add edx, dword [ecx + 0x24]
mov dword [ebp - 0x490], edx
push edi
xor edi, 0x8e0e
pop edi
push edx
push esi
add esp, 4
or edx, 0x2cda
call 0x4082a9
add byte [ebx + 0x4f], al
cmp al, 0x39
cmp eax, dword [ebx + 0x42]
inc edi
xor al, 0x83
les eax, [ecx + eax*4]
retf 0x4247
Function at 0x408260
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ecx
mov eax, dword [ebp - 0x8c]
add eax, dword [ebp - 0x2b4]
mov dword [ebp - 0x11c], eax
jne 0x40822b
push edi
push ebx
add esp, 4
or edi, 0x6a70
pop edi
push edi
and edi, 0xa8a8
add edi, 0x11a53
add edi, 0x822e
pop edi
push esi
call 0x408216
add byte [ecx], bh
aas
push eax
dec esp
dec ebx
aas
xor al, 0x83
les eax, [esi + ebx*2]
mov ecx, dword [ebp - 0x128]
mov dword [ebp - 0x98], ecx
jmp 0x4085d3
mov edx, dword [ebp - 0x11c]
mov eax, dword [ebp - 0x8c]
add eax, dword [edx + 0x20]
mov dword [ebp - 0x48c], eax
push ebx
push ecx
add esp, 4
call 0x408251
add byte [ecx + 0x44], al
dec esp
inc ebp
xor al, 0x38
add esp, 4
call 0x408260
add byte [edx], bh
inc edx
push eax
inc ecx
cmp byte [edi - 0x7d], cl
les eax, [ebx + ebx*2]
push ecx
xor ecx, 0xc10c
or ecx, 0x164e2
pop ecx
mov ecx, dword [ebp - 0x11c]
mov edx, dword [ebp - 0x8c]
add edx, dword [ecx + 0x24]
mov dword [ebp - 0x490], edx
push edi
xor edi, 0x8e0e
pop edi
push edx
push esi
add esp, 4
or edx, 0x2cda
call 0x4082a9
add byte [ebx + 0x4f], al
cmp al, 0x39
cmp eax, dword [ebx + 0x42]
inc edi
xor al, 0x83
les eax, [ecx + eax*4]
retf 0x4247

Function at 0x4082a9
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ecx
mov eax, dword [ebp - 0x8c]
add eax, dword [ebp - 0x2b4]
mov dword [ebp - 0x11c], eax
jne 0x40822b
push edi
push ebx
add esp, 4
or edi, 0x6a70
pop edi
push edi
and edi, 0xa8a8
add edi, 0x11a53
add edi, 0x822e
pop edi
push esi
call 0x408216
add byte [ecx], bh
aas
push eax
dec esp
dec ebx
aas
xor al, 0x83
les eax, [esi + ebx*2]
mov ecx, dword [ebp - 0x128]
mov dword [ebp - 0x98], ecx
jmp 0x4085d3
mov edx, dword [ebp - 0x11c]
mov eax, dword [ebp - 0x8c]
add eax, dword [edx + 0x20]
mov dword [ebp - 0x48c], eax
push ebx
push ecx
add esp, 4
call 0x408251
add byte [ecx + 0x44], al
dec esp
inc ebp
xor al, 0x38
add esp, 4
call 0x408260
add byte [edx], bh
inc edx
push eax
inc ecx
cmp byte [edi - 0x7d], cl
les eax, [ebx + ebx*2]
push ecx
xor ecx, 0xc10c
or ecx, 0x164e2
pop ecx
mov ecx, dword [ebp - 0x11c]
mov edx, dword [ebp - 0x8c]
add edx, dword [ecx + 0x24]
mov dword [ebp - 0x490], edx
push edi
xor edi, 0x8e0e
pop edi
push edx
push esi
add esp, 4
or edx, 0x2cda
call 0x4082a9
add byte [ebx + 0x4f], al
cmp al, 0x39
cmp eax, dword [ebx + 0x42]
inc edi
xor al, 0x83
les eax, [ecx + eax*4]
retf 0x4247
Function at 0x408602
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop eax
push edx
xor edx, 0x16e06
xor edx, 0xb415
and edx, 0x3634
add edx, 0x178bb
pop edx
mov edx, dword [ebp - 0x128]
mov dword [ebp - 0x98], edx
jmp 0x4085d3
cmp dword [ebp - 0x98], 0
je 0x40867c
push edi
jmp 0x4085e7
pop edi
push edx
push ecx
add esp, 4
add edx, 0x100bb
call 0x408602
add byte [edx + 0x39], al
dec ebx
inc ebp
inc edi
cmp dword [ebx + 0x34], eax
cmp al, byte [ebx + 0x525a04c4]
push eax
add esp, 4
xor edx, 0xd1da
pop edx
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x49c], eax
mov ecx, dword [ebp - 0x49c]
mov dword [ebp - 0x4a0], ecx
lea edx, [ebp - 0x2b0]
push edx
call dword [ebp - 0x4a0]
test eax, eax
jne 0x40867c
push eax
sub eax, 0x10be4
add eax, 0x6d5a
and eax, 0xaaec
pop eax
push edi
or edi, 0x4993
jmp 0x40865e
pop edi
push edx
add edx, 0xf481
and edx, 0x10081
pop edx
mov dword [ebp - 0x1b4], 0
invalid
invalid
inc dword [eax]
add byte [eax], al
add cl, ch
ror dword [edx], 0
invalid
Function at 0x408d74
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop eax
mov ecx, dword [ebp - 0x138]
mov dword [ebp - 0x9c], ecx
jmp 0x409131
Function at 0x40ace4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop es
dec esi
dec ebp
cmp al, 0x37
xor ecx, dword ds:[edi + 0x5e]
push esi
xor esi, 0x1629
sub esi, 0x1864e
pop esi
mov dword [ebp - 0x38], 0
jmp 0x40ac99
mov eax, dword [ebp - 0x38]
add eax, 1
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0xf8]
add ecx, dword [ebp - 0x38]
movsx edx, byte [ecx]
test edx, edx
je 0x40ad35
mov eax, dword [ebp - 0x38]
movsx ecx, byte [ebp + eax - 0x164]
test ecx, ecx
je 0x40ad35
push edx
push edi
add esp, 4
sub edx, 0xab7f
pop edx
push eax
add eax, 0xb946
jmp 0x40acd5
call 0x40ace4
add byte [ebx], dh
inc edi
cmp eax, 0x3c44403e
xor edi, dword [esi]
add esp, 4
or eax, 0xb06d
pop eax
mov edx, dword [ebp - 0xf8]
add edx, dword [ebp - 0x38]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x38]
movsx edx, byte [ebp + ecx - 0x164]
cmp eax, edx
je 0x40ad27
mov eax, dword [ebp - 0xf8]
add eax, dword [ebp - 0x38]
movsx ecx, byte [eax]
xor ecx, 0x20
mov edx, dword [ebp - 0x38]
movsx eax, byte [ebp + edx - 0x164]
cmp ecx, eax
jne 0x40ad2e
jmp 0x40ac90
jmp 0x40ad35
push edx
push edx
add esp, 4
add edx, 0x18250
or edx, 0xb791
sub edx, 0xf26d
pop edx
push esi
xor esi, 0xba32
sub esi, 0xde13
add esi, 0xe13f
xor esi, 0x7e14
pop esi
mov ecx, dword [ebp - 0xf8]
add ecx, dword [ebp - 0x38]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x38]
movsx ecx, byte [ebp + eax - 0x164]
cmp edx, ecx
jne 0x40ad91
mov dword [ebp - 0x248], 0
jmp 0x40ae2c
push esi
add esi, 0xc96d
pop esi
push ebx
add ebx, 0x10a6c
pop ebx
push ecx
add ecx, 0x2fc0
xor ecx, 0x2139
xor ecx, 0x1439c
pop ecx
push ebx
xor ebx, 0x755d
add ebx, 0x2ff6
pop ebx
mov edx, dword [ebp - 0xf8]
add edx, dword [ebp - 0x38]
movsx eax, byte [edx]
or eax, 0x20
mov ecx, dword [ebp - 0x38]
movsx edx, byte [ebp + ecx - 0x164]
or edx, 0x20
cmp eax, edx
jge 0x40adf0
mov dword [ebp - 0x248], 0xffffffff
jmp 0x40ae2c
push esi
or esi, 0x14d18
xor esi, 0x15e73
pop esi
push eax
or eax, 0x88e8
call fcn.0040ae12
add byte [ebx], dh
aas
cmp dh, byte [ebx]
xor cl, byte [eax + 0x44]

Function at 0x40ae12
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ebp - 0xf4]
add ecx, 1
mov dword [ebp - 0xf4], ecx
add esp, 4
xor eax, 0x154a8
or eax, 0x85e1
pop eax
mov dword [ebp - 0x248], 1
cmp dword [ebp - 0x248], 0
jne 0x40ae75
push ebx
push ecx
add esp, 4
add ebx, 0x103bf
and ebx, 0xc315
xor ebx, 0xd3ee
pop ebx
push esi
or esi, 0x16b2
jmp 0x40ae5a
and esi, 0x6ec2
or esi, 0xa629
pop esi
mov eax, dword [ebp - 0x410]
mov dword [ebp - 0x94], eax
jmp 0x40ae86
jmp 0x40ab8d