joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40bd00
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, 1
cmp dword [edi + 4], ebx
je 0x40bd20
cmp byte [edi + 0xd], 0
push esi
jne 0x40bd25
cmp byte [edi + 0xc], 0
je 0x42a406
mov byte [edi + 0xd], bl
pop esi
dec dword [edi + 4]
pop ebx
ret
mov esi, dword [edi + 8]
push ebp
mov ebp, dword [esi + 0x10]
test esi, esi
je 0x40bd3e
call fcn.004092c0
push esi
call fcn.004112ef
add esp, 4
mov dword [edi + 8], ebp
mov byte [edi + 0xd], 0
pop ebp
jmp 0x40bd12
add al, 0x81
ror byte [ecx], 0
add dword [eax], eax

Function at 0x40be00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esi + 0xc]
cmp dword [esi + 8], eax
je 0x40be36
push 0x10
call fcn.0041171a
add esp, 4
test eax, eax
je 0x42c015
push ebx
mov ebx, eax
mov eax, dword [esp + 8]
call fcn.0040bd50
pop ebx
mov ecx, dword [esi + 8]
mov edx, dword [esi + 4]
mov dword [edx + ecx*4], eax
inc dword [esi + 8]
ret 4
add eax, eax
mov dword [esi + 0xc], eax
cmp eax, 4
jae 0x40be45
mov eax, 4
xor ecx, ecx
mov dword [esi + 0xc], eax
mov edx, 4
mul edx
seto cl
push edi
neg ecx
or ecx, eax
push ecx
call fcn.0041171a
mov ecx, dword [esi + 4]
mov edi, eax
mov eax, dword [esi + 8]
add eax, eax
add eax, eax
push eax
push ecx
push edi
call fcn.00410f70
mov edx, dword [esi + 4]
push edx
call fcn.004112ef
add esp, 0x14
mov dword [esi + 4], edi
pop edi
jmp 0x40be08

Function at 0x40bee0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push esi
mov esi, eax
mov eax, dword [esi + 8]
cmp eax, 1
jne 0x40bf36
cmp eax, 3
je case.0x40bf47.3
mov ecx, esi
call fcn.0040be90
fstp qword [esp + 8]
call fcn.004092c0
fld qword [esp + 8]
fstp qword [esi]
mov dword [esi + 8], 3
mov ecx, dword [ebp + 8]
call fcn.0040be90
fdivr qword [esi]
fstp qword [esi]
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x42a353
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
mov ecx, eax
sub ecx, 2
cmp ecx, 9
ja case.0x40bf47.5
movzx ecx, byte [ecx + 0x40bf5c]
jmp dword [ecx*4 + 0x40bf50]
add byte [eax], al
inc edi
inc ebx

Function at 0x40c140
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push ebx
push esi
mov esi, eax
cmp esi, dword [esp + 0x1c]
je 0x42a4ee
mov ebx, dword [esp + 0x1c]
push 0
or eax, 0xffffffff
mov ecx, esi
call fcn.0040c170
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x40c170
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebp
push esi
push edi
mov edi, eax
mov esi, ecx
test edi, edi
je 0x40c1ce
mov ebp, dword [esp + 0x10]
mov eax, dword [ebx + 4]
cmp ebp, eax
jae 0x40c1ce
cmp edi, 0xffffffff
jne 0x42a4d4
sub eax, ebp
mov edi, eax
mov eax, dword [esi + 0xc]
cmp dword [eax], 1
jg 0x40c1d6
mov eax, dword [esi + 4]
add eax, edi
call fcn.004034b0
mov ecx, dword [ebx]
lea eax, [edi + edi]
push eax
mov eax, dword [esi + 4]
lea edx, [ecx + ebp*2]
mov ecx, dword [esi]
push edx
lea edx, [ecx + eax*2]
push edx
call fcn.00410f70
add dword [esi + 4], edi
mov eax, dword [esi + 4]
mov ecx, dword [esi]
add esp, 0xc
xor edx, edx
mov word [ecx + eax*2], dx
pop edi
mov eax, esi
pop esi
pop ebp
ret 4
dec dword [eax]
push 4
call fcn.0041171a
add esp, 4
test eax, eax
je 0x40c249
mov dword [eax], 1
mov edx, dword [esi + 4]
mov dword [esi + 0xc], eax
lea eax, [edx + edi + 1]
mov dword [esi + 8], eax
test eax, eax
je 0x42a4e4
add eax, 7
shr eax, 3
add eax, eax
add eax, eax
add eax, eax
xor ecx, ecx
mov dword [esi + 8], eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041171a
mov ecx, dword [esi + 4]
lea edx, [ecx + ecx + 2]
mov ecx, dword [esi]
push edx
push ecx
push eax
mov dword [esp + 0x20], eax
call fcn.00410f70
mov edx, dword [esp + 0x20]
add esp, 0x10
mov dword [esi], edx
jmp 0x40c1a5
xor eax, eax
jmp 0x40c1ec
out 0xa2, eax
add byte [eax], al

Function at 0x40c2a0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
inc dword [eax]
mov ecx, dword [eax]
push edi
xor edi, edi
mov dword [edx], ecx
lea esp, [esp]
mov ecx, dword [eax]
mov edx, dword [esi + 4]
mov edx, dword [edx + ecx*4]
movsx edx, word [edx + 8]
cmp edx, 0x47
jge 0x40c2c6
inc ecx
mov dword [eax], ecx
jmp 0x40c2b0
sub edx, 0x47
je 0x40c2f3
sub edx, 1
jne 0x40c2e3
test edi, edi
jne 0x40c2ed
mov edx, dword [esp + 0xc]
mov dword [edx], ecx
inc ecx
mov dword [eax], ecx
xor eax, eax
pop edi
ret 8
sub edx, 0x37
jne 0x40c2c1
jmp 0x42b171
dec edi
inc ecx
mov dword [eax], ecx
jmp 0x40c2b0
inc edi
inc ecx
mov dword [eax], ecx
jmp 0x40c2b0

Function at 0x40c3e0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
test ecx, ecx
jne 0x40c42c
cmp dword [0x4a7cdc], ecx
jne 0x42a475
push 0x4a7ccc
push esi
call fcn.004042f0
test al, al
je 0x40c46a
mov eax, dword [0x4a7ccc]
test eax, eax
je 0x40c46a
mov ecx, dword [eax + 0x10]
mov edx, dword [esp + 8]
and ecx, 0xff00
mov dword [edx], ecx
mov eax, dword [eax + 0x14]
mov ecx, dword [esp + 4]
mov dword [ecx], eax
test eax, eax
je 0x40c46e
mov eax, 1
ret 8
sub ecx, 1
jne 0x42a422
cmp dword [0x4a7cdc], ecx
jne 0x42a45a
push 0x4a7ccc
push esi
call fcn.004042f0
test al, al
je 0x40c46a
mov eax, dword [0x4a7ccc]
test eax, eax
je 0x40c46a
mov edx, dword [eax + 0x10]
mov ecx, dword [esp + 8]
and edx, 0xff00
mov dword [ecx], edx
jmp 0x40c417
xor eax, eax
jmp 0x40c41a
xor eax, eax
ret 8
sub al, 0xfb
invalid
call 0x6742a46d
mov ecx, dword [eax]
Function at 0x40c770
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [esi + 8]
sub esp, 0xc
push ebx
push edi
mov edi, eax
mov eax, dword [edi + 8]
lea eax, [eax + eax*2]
lea edx, [ecx + eax*4]
mov eax, dword [edx*4 + 0x4923c8]
cmp eax, 1
jne 0x40c7ae
mov ecx, edi
call fcn.0040c760
mov ecx, esi
mov edi, eax
call fcn.0040c760
xor ecx, ecx
cmp edi, eax
setl cl
mov al, cl
pop edi
pop ebx
add esp, 0xc
ret
cmp eax, 3
jne 0x42a889
mov ecx, edi
call fcn.0040be90
fstp qword [esp + 0xc]
mov ecx, esi
call fcn.0040be90
fcomp qword [esp + 0xc]
fnstsw ax
test ah, 0x41
je 0x42a8d8
pop edi
xor eax, eax
pop ebx
add esp, 0xc
ret
add dword [eax], eax

Function at 0x40c8a0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp byte [edi + 9], 0
push esi
jne 0x42a2d0
cmp byte [edi + 8], 0
jne 0x42a2ec
push ebx
push ebp
mov ebp, dword [edi + 4]
mov ebx, dword [ebp + 0x30]
test ebp, ebp
je 0x40c8da
lea esi, [ebp + 0x20]
call fcn.004092c0
lea esi, [ebp + 0x10]
call fcn.004092c0
push ebp
call fcn.004112ef
add esp, 4
dec dword [edi]
pop ebp
mov dword [edi + 4], ebx
pop ebx
mov byte [edi + 9], 0
pop esi
ret
inc edi
dec edx
xor bh, byte [esi + ecx*2]
pop ds
add byte [eax], al

Function at 0x40d420
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push 0x10
mov dword [ebx + 8], 4
call fcn.0041171a
add esp, 4
test eax, eax
je 0x429e1f
push esi
mov esi, eax
call fcn.00401b70
pop esi
mov dword [ebx + 0xc], eax
mov eax, ebx
ret
call dword [edi - 0x7f]
invalid

Function at 0x40d590
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebp
push esi
push edi
mov edi, eax
cmp byte [edi + 0xd], 0
jne 0x42a737
mov esi, dword [edi + 8]
mov ebp, dword [ecx]
call fcn.004092c0
mov dword [esi + 8], 1
mov dword [esi], ebp
cmp byte [edi + 0xd], 0
jne 0x42a742
mov edi, dword [edi + 8]
mov byte [edi + 0x10], 0
pop edi
pop esi
pop ebp
ret
inc ebx
loopne 0x42a73b
invalid
Function at 0x40d6d0
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x438
push ebx
push esi
push edi
mov edi, eax
lea eax, [esp + 0x20]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push edi
call fcn.00401f80
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x431a9d
mov eax, dword [0x4a7cfc]
test eax, eax
je 0x431ab6
mov byte [esp + 0xf], 0
mov esi, 0x4a8e80
cmp eax, 1
je 0x431aca
push 0x4a7cfc
lea ecx, [esp + 0x13]
mov eax, 0x4a7d14
call fcn.0040f3b0
test al, al
je 0x431aeb
mov dl, byte [0x4a8e80]
mov bl, byte [0x4a8e81]
push 0x4a7cf8
lea eax, [esp + 0x234]
push eax
push 0x104
push 0x4a7d14
mov byte [0x4a7d00], dl
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov ecx, dword [0x4a7cfc]
push ecx
push 0x4a7d14
call fcn.00401440
test eax, eax
jne 0x431aff
cmp bl, 1
je 0x431b23
call fcn.004101f0
call fcn.004103e0
cmp byte [0x4a7d00], 0
jne 0x40d7a8
mov esi, 0x4a84b8
call fcn.0040e1e0
push 1
mov ecx, 0x4a7f20
call fcn.00409560
cmp byte [0x4a7d00], 0
jne 0x40d7c7
mov ecx, 0x4a84b8
call fcn.00401000
mov ebx, 0x4a8e80
call fcn.0040ebc0
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
pop edi
pop esi
pop ebx
add esp, 0x438
ret
add eax, dword [ebx]
mov ds, word [eax + 0x202fb67]
mov cs, word [eax + 0x202e92f]
mov ss, word [eax + 0x202ffcf]
push es
arpl bx, di
add al, byte [edx]
mov ds, word [eax + 0x202e927]
mov cs, word [eax + 0x202ffcf]
push es
pop es
lea ecx, [eax + ecx*4 + 0x202e923]
retf 0x8b88
mov ss, word [eax + 0x202018b]
xchg ah, al
add al, 0x8c
nop
mov eax, dword [ecx]
add al, byte [edx]
mov ds, word [eax + 0x202fb63]
push es
add al, byte [esi]
cwde
mov eax, dword [ecx]
add al, byte [edx]
adc al, cl
add eax, 0x8712c388
sahf
add eax, dword [ebx]
add ecx, dword [esi + 0x2018b90]
add dl, byte [edx]
rcl dword [edi + 0x2f81b10], 2
mov ch, dl
adc al, byte [edi + 0x3030388]
mov byte [ebx], al
add eax, dword [ebx]
push ebp
out dx, al
or al, byte [ebp + 0x3f]
push ebx
inc edx
inc esi
cmp eax, 0xeb555d41
or eax, 0x3030303
xor eax, 0x454a4f3f
inc eax
cmp al, 0x44
xchg bh, al
pop es
out dx, al
pop es
dec ebp
inc ebx
dec edi
inc ecx
out dx, al
or byte [edx], bh
cmp al, byte [edx + 0x36]
inc edx
test ch, dh
mov ebx, 0x5d03043b
mov cs, word [eax + 0x202fb63]
push es
mov byte [ebx + 0x12020201], cl
ror dword [ebx], 0x8e
cwde
mov eax, dword [ecx]
add al, byte [edx]
adc al, cl
xchg dword [eax], ebx
sbb edi, eax
add al, byte [edx]
retf
Function at 0x40da10
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x4c
push ebx
push ebp
mov ebp, dword [esp + 0x5c]
push esi
push edi
lea ecx, [esp + 0x38]
call fcn.0040c060
mov eax, dword [esp + 0x6c]
mov ebx, dword [eax]
xor edi, edi
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], 0x4848ec
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x10], 0xffffffff
dec ebx
call fcn.0040c060
mov ecx, dword [esp + 0x60]
mov esi, dword [ecx + 4]
mov edx, dword [ebp]
mov eax, dword [esi + edx*4]
cmp word [eax + 8], 0x48
je 0x40db52
mov dword [esp + 0x14], edi
mov edi, edi
mov ecx, dword [ebp]
mov edx, dword [esi + ecx*4]
cmp word [edx + 8], 0
mov byte [esp + 0x64], 0
je 0x42b1ac
mov ecx, dword [ebp]
mov esi, dword [esi + ecx*4]
cmp word [esi + 8], 0x33
jne 0x42b27f
mov eax, dword [esi]
lea edx, [esp + 0x28]
cmp edx, eax
je 0x40daa8
mov ecx, edx
call fcn.00404080
mov eax, dword [esp + 0x20]
xor edi, edi
test eax, eax
jbe 0x40dad1
mov ecx, dword [esp + 0x1c]
mov esi, dword [ecx + edi*4]
lea eax, [esp + 0x28]
call fcn.0040dd00
test al, al
jne 0x40dacd
inc edi
cmp edi, dword [esp + 0x20]
jb 0x40dab2
mov eax, dword [esp + 0x20]
cmp edi, eax
jne 0x42b266
lea edi, [esp + 0x28]
lea esi, [esp + 0x18]
call fcn.0040d970
inc dword [ebp]
mov edi, dword [esp + 0x60]
mov eax, dword [ebp]
mov esi, dword [edi + 4]
mov edx, dword [esi + eax*4]
cmp word [edx + 8], 0x41
je 0x42b1ee
cmp dword [esp + 0x10], 0xffffffff
jne 0x42b24a
mov edx, dword [esi + eax*4]
movzx ecx, word [edx + 8]
inc dword [esp + 0x14]
cmp cx, 0x40
jne 0x40dbe6
mov edx, 0x48
cmp cx, 0x40
jne 0x40db3e
mov ecx, dword [esi + eax*4 + 4]
inc eax
mov dword [ebp], eax
cmp word [ecx + 8], dx
je 0x42b25c
mov eax, dword [ebp]
mov ecx, dword [esi + eax*4]
cmp word [ecx + 8], dx
jne 0x40da70
mov edi, dword [esp + 0x14]
inc dword [ebp]
mov edx, dword [esp + 0x60]
mov ebp, dword [ebp]
mov eax, dword [edx + 4]
mov ecx, dword [eax + ebp*4]
cmp word [ecx + 8], 0x7f
jne 0x42b244
mov edx, dword [esp + 0x6c]
call fcn.0040f320
test eax, eax
jne 0x42b29f
mov edx, dword [esp + 0x68]
mov ebp, dword [esp + 0x6c]
push edx
lea esi, [esp + 0x3c]
call fcn.0040df50
mov eax, dword [ebp]
dec eax
cmp dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x48], ebx
mov dword [esp + 0x54], eax
mov dword [esp + 0x4c], edi
jne 0x40dbab
mov dword [esp + 0x10], edi
mov ecx, dword [esp + 0x10]
lea edi, [esp + 0x38]
mov ebx, 0x4a8054
mov dword [esp + 0x50], ecx
call fcn.0040eaf0
lea ecx, [esp + 0x28]
call fcn.00402620
lea ecx, [esp + 0x18]
call fcn.00410a20
mov ecx, edi
call fcn.00402620
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret 0x10
cmp cx, 0x48
je 0x40db21
jmp 0x42b250
mov bh, 0x8d
add dh, bh
invalid
invalid
inc ebx
cmp al, byte [eax]
add byte [esi + 0x57], bl
fsubr dword [ebp - 0x74a10000]
lea esp, [ebx + edi*8]
invalid
lea esp, [eax]
std
invalid
les eax, [ecx + eax*4]
out dx, al
mov bh, 0x61
add byte [eax], al
inc dword [eax]
add byte [ecx + 0x13a90e8], al
add byte [ecx + 0x1241c8], al
add byte [ecx + 0x68c3e8], al
add byte [eax - 0x75], bl
xchg ebp, eax
and al, 0xfb
invalid
and al, 0xfb
invalid
Function at 0x40e1e0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3a8
push ebx
push edi
push 0x3a4
lea eax, [esp + 0x10]
push 0
push eax
mov dword [esp + 0x14], 0x3a8
call fcn.004131f0
add esp, 0xc
cmp dword [esi + 0x188], 0
jne 0x40e21f
mov ecx, dword [0x4a7cec]
mov dword [esi + 0x188], ecx
cmp dword [esi + 0x194], 0
jne 0x40e239
mov eax, dword [0x4a7cf0]
mov dword [esi + 0x194], eax
mov dword [esi + 0x198], eax
cmp dword [esi + 0x1a0], 0
jne 0x40e24e
mov ecx, dword [0x4a7cf4]
mov dword [esi + 0x1a0], ecx
mov eax, dword [esi + 0x18c]
lea edi, [esi + 0x190]
test eax, eax
jne 0x42aa0b
mov edx, dword [0x4972c0]
mov dword [esi + 0x18c], 0
mov byte [edi], 0
cmp dword [esi + 0x40], 0
mov ebx, 1
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], 0x401
mov dword [esp + 0x1c], 0
jne 0x42aa20
mov eax, dword [esi + 0x188]
mov dword [esp + 0x1c], eax
mov dword [esi + 0x18c], eax
cmp byte [0x497292], bl
je 0x42aa50
lea ecx, [esp + 8]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov byte [0x497292], bl
mov eax, esi
call fcn.00401e70
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
add byte [ebx - 0x75], bl
lea ebp, [eax]
sti
invalid

Function at 0x40e640
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
call fcn.004092c0
push 0x10
mov dword [esi + 8], 4
call fcn.0041171a
add esp, 4
test eax, eax
je 0x42a3e3
mov ecx, dword [edi]
mov dword [eax], ecx
mov edx, dword [edi + 4]
mov dword [eax + 4], edx
mov ecx, dword [edi + 8]
mov dword [eax + 8], ecx
mov ecx, dword [edi + 0xc]
mov dword [eax + 0xc], ecx
inc dword [ecx]
mov dword [esi + 0xc], eax
mov eax, esi
ret

Function at 0x40e6b0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esi]
test eax, eax
jne 0x429d60
mov dword [esi + 8], 0
ret
pop edi
mov dword [ebp - 0x3cc], 0

Function at 0x40e6d0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ebx
call fcn.004092c0
push 0x10
mov dword [ebx + 8], 4
call fcn.0041171a
add esp, 4
test eax, eax
je 0x42a3ea
mov esi, eax
call fcn.00401b70
mov dword [ebx + 0xc], eax
mov eax, ebx
pop esi
ret
retf 0

Function at 0x40e700
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp dword [esi + 0x16c], 0
push ebx
push edi
jne 0x42a639
cmp byte [0x4a7cc1], 0
jne 0x42a64e
lea ebx, [esi + 0x488]
mov edi, 0x4848e8
call fcn.0040e6d0
cmp byte [0x4a7cc2], 0
pop edi
pop ebx
jne 0x42a675
ret
les eax, [ebx + ebp*8]
add al, 0x45
inc esi
dec ebx
cmp byte [ecx + 0x508c9], al
add byte [ecx + 0x1090ce1], al
add byte [ecx + 0x13254c1], al
add byte [ecx + 0x57], bl
rcl dword [edx + esi + 1], 0

Function at 0x40e7c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp dword [esi + 8], 5
jne 0x40e7d8
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
test eax, eax
je 0x40e7d8
cmp dword [eax], 1
jg 0x42c0a7
ret
Function at 0x40e7e0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, eax
mov ebx, 5
cmp dword [edi + 8], ebx
je 0x42b34a
call fcn.0040e8f0
test esi, esi
je 0x40e833
cmp dword [edi + 8], ebx
jne 0x42b354
mov eax, dword [edi]
mov dword [eax + 0x210], 0
test esi, esi
jle 0x40e833
push ebp
lea ebx, [esp + 0x14]
mov ebp, esi
mov esi, dword [ebx + 4]
add ebx, 4
mov edx, edi
call fcn.0040d0f0
sub ebp, 1
jne 0x40e820
pop ebp
mov eax, dword [edi]
mov ecx, dword [eax + 0x210]
mov dword [eax + 0x20c], ecx
mov edx, dword [edi]
mov dword [edx + 8], 1
mov eax, dword [edi]
cmp dword [eax + 0x20c], 0
jle 0x40e891
xor edx, edx
mov ecx, 0xc
lea esp, [esp]
mov esi, dword [ecx + eax + 0x100]
mov dword [ecx + eax], esi
mov eax, dword [edi]
mov esi, dword [ecx + eax]
imul esi, dword [eax + 8]
mov dword [eax + 8], esi
mov eax, dword [edi]
cmp dword [eax + 8], 0x1000000
jg 0x42b360
inc edx
add ecx, 4
cmp edx, dword [eax + 0x20c]
jl 0x40e860
mov eax, dword [edi]
mov eax, dword [eax + 8]
xor ecx, ecx
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041171a
mov ecx, dword [edi]
push 4
mov dword [ecx], eax
call fcn.0041171a
add esp, 8
test eax, eax
je 0x40e8ea
mov dword [eax], 1
mov edx, dword [edi]
mov dword [edx + 4], eax
mov eax, dword [edi]
cmp dword [eax + 8], 0
jle 0x40e8e4
xor ecx, ecx
mov eax, dword [eax]
mov dword [eax + ecx*4], 0
mov eax, dword [edi]
inc ecx
cmp ecx, dword [eax + 8]
jl 0x40e8d3
pop edi
pop esi
mov al, 1
pop ebx
ret
xor eax, eax
jmp 0x40e8c4
add al, 0xfd
invalid
clc
invalid

Function at 0x40e940
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ecx
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0x14]
test eax, eax
jg 0x42adeb
test ecx, ecx
jne 0x42ad4f
test edx, edx
jne 0x42ad6a
test esi, esi
jne 0x42ad82
test edi, edi
jne 0x42ad9d
test ebx, ebx
jne 0x42adb8
test ebp, ebp
jne 0x42add3
xor eax, eax
pop ebp
pop ecx
ret 0xc
mov esi, 0x80958b08
invalid
invalid
invalid
dec edi
dec esp
dec esi
inc edx
invalid

Function at 0x40f040
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
mov eax, dword [eax + 4]
mov dword [esp], eax
lea esp, [esp]
test eax, eax
jne 0x429d41
add esp, 8
ret
add byte [ecx + 0x57], bl
push edx
add esp, 4
and edi, 0xf88d
add edi, 0x7282
pop edi
push edi
push edx
add esp, 4
xor edi, 0x183b

Function at 0x40f060
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
mov eax, esi
call fcn.0040f040
mov eax, dword [esi + 0x468]
mov dword [esp], eax
push ecx
lea eax, [esp + 4]
mov dword [esp], 0
call fcn.0040f090
test al, al
jne 0x42a32a
add esp, 8
ret

Function at 0x40f0b0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esi]
test eax, eax
jne 0x42a721
mov dword [esi + 8], 0
ret
and dword [edx], ebp
add byte [eax], al
Function at 0x40f110
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [esp + 0x14]
lea ecx, [eax + eax]
lea eax, [esp]
push eax
xor edx, edx
push 1
push edx
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x18]
mov word [esi], dx
mov edx, dword [esp + 0x14]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40f15f
mov ecx, dword [esp + 0x10]
mov edx, dword [esp]
lea eax, [esp + 0x14]
push eax
push esi
push 0
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ecx
ret

Function at 0x40f1a0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ecx
push edi
mov edi, eax
cmp dword [edi + 0xc], 0
jne 0x40f1ba
lea ecx, [esp + 0xc]
call fcn.00402620
xor eax, eax
pop edi
pop ecx
ret 0x10
push ebx
push esi
lea esi, [esp + 0x14]
call fcn.00410a40
mov ebx, dword [edi + 8]
test ebx, ebx
jne 0x42a935
mov esi, dword [edi]
test esi, esi
je 0x40f1ee
lea eax, [esp + 0x14]
call fcn.0040dd00
test al, al
jne 0x42a925
mov esi, dword [esi + 0x20]
test esi, esi
jne 0x40f1d6
lea ecx, [esp + 0x14]
call fcn.00402620
xor eax, eax
pop esi
pop ebx
pop edi
pop ecx
ret 0x10
mov ecx, dword [ebp - 0xf82]
invalid

Function at 0x40f450
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x10020
call fcn.00425210
xor eax, eax
lea esp, [esp]
mov cl, byte [eax + 0x492380]
mov dl, byte [eax + 0x492378]
mov byte [esp + eax + 0xc], cl
mov byte [esp + eax + 0x14], dl
inc eax
cmp eax, 8
jl 0x40f460
lea eax, [esp]
push 0x4876e8
push eax
call fcn.00413990
push 4
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x2c]
push edx
call fcn.00410f70
add esp, 0x14
push ebx
push ebp
push esi
mov dword [esp + 0x14], 0
push edi
jmp 0x40f4b0
mov eax, dword [esp + 0x10034]
mov ecx, dword [eax]
push ecx
push 0x10000
lea edx, [esp + 0x38]
push 1
push edx
call fcn.004151b0
add esp, 0x10
cmp eax, 0x18
jl 0x40f531
mov ebp, eax
lea edi, [ebp - 0x14]
test edi, edi
jle 0x40f4fd
xor edx, edx
mov edi, edi
xor ecx, ecx
lea esi, [esp + edx + 0x30]
mov al, byte [esp + ecx + 0x1c]
cmp al, byte [esi + ecx]
je 0x40f521
cmp ecx, 0x14
je 0x42937a
inc edx
cmp edx, edi
jl 0x40f4e0
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x10034]
lea edx, [ecx + ebp - 0x14]
mov ecx, dword [eax]
push 1
push 0xffffffffffffffec
push ecx
mov dword [esp + 0x24], edx
call fcn.0041557c
add esp, 0xc
jmp 0x40f4b0
mov bl, byte [esp + ecx + 0x1d]
lea eax, [ecx + edx]
cmp bl, byte [esp + eax + 0x31]
je 0x40f543
inc ecx
jmp 0x40f4ef
mov eax, 3
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10020
ret 4
mov bl, byte [esp + ecx + 0x1e]
lea eax, [ecx + edx]
cmp bl, byte [esp + eax + 0x32]
je 0x40f555
add ecx, 2
jmp 0x40f4ef
mov bl, byte [esp + ecx + 0x1f]
lea eax, [ecx + edx]
cmp bl, byte [esp + eax + 0x33]
jne 0x429372
mov bl, byte [esp + ecx + 0x20]
lea eax, [ecx + edx]
cmp bl, byte [esp + eax + 0x34]
je 0x429361
add ecx, 4
jmp 0x40f4ef
lea eax, [eax]
invalid
inc eax
std
invalid