joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4081c0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
inc dword [eax]
push eax
push ecx
add esp, 4
or eax, 0x79cb
sub eax, 0xd135
sub eax, 0x1003f
pop eax
push esi
jmp 0x4081e0
add esi, 0x179a3
jmp 0x4081ed
and esi, 0x7785
pop esi
mov edx, 0x6b
mov word [ebp - 0xc50], dx
mov eax, 0x65
mov word [ebp - 0xc4e], ax
mov ecx, 0x72
mov word [ebp - 0xc4c], cx
mov edx, 0x6e
mov word [ebp - 0xc4a], dx
mov eax, 0x65
mov word [ebp - 0xc48], ax
mov ecx, 0x6c
mov word [ebp - 0xc46], cx
mov edx, 0x33
add byte [esi - 0x77], ah
xchg ebp, eax
mov esp, 0xb8fffff3
xor al, byte [eax]
add byte [eax], al
mov word [ebp - 0xc42], ax

Function at 0x408254
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, 0x2e
mov word [ebp - 0xc40], cx
mov edx, 0x64
mov word [ebp - 0xc3e], dx
mov eax, 0x6c
mov word [ebp - 0xc3c], ax
mov ecx, 0x6c
mov word [ebp - 0xc3a], cx
xor edx, edx
mov word [ebp - 0xc38], dx
push ebx
add ebx, 0x110c0
pop ebx
push edx
push edx
add esp, 4
and edx, 0x45b4
xor edx, 0x16846
pop edx
push edi
push eax
add esp, 4
xor edi, 0xf1fa
or edi, 0x30c3
add edi, 0x6e45
pop edi
mov eax, dword fs:[0x18]
mov dword [ebp - 0xe28], eax
invalid

Function at 0x408314
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
inc ecx
aas
inc ebx
cmp al, 0x3b
cmp byte [eax + 0x46], al
add esp, 4
pop esi
cmp dword [ebp - 0xb54], 0
invalid
inc dword [eax]
jne 0x408330
mov dword [ebp - 0x188], 0
jmp 0x4085d7
mov ecx, dword [ebp - 0xb54]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x6b0], eax
push esi
push edi
add esp, 4
xor esi, 0xbf0f
add bl, ch
push es
and esi, 0xfd44
pop esi
push edi
push edx
add esp, 4
add edi, 0x112e1
xor edi, 0x7b01
or edi, 0x185ff
pop edi
cmp dword [ebp - 0x6b0], 0
jne 0x40838c
mov dword [ebp - 0x188], 0
jmp 0x4085d7
dec ebx
add al, byte [eax]
invalid
mov ecx, dword [ebp - 0x6b0]
mov dword [ebp - 0x25c], ecx
push edx
push edx
add esp, 4
sub edx, 0x6478
xor edx, 0xba80
add byte [ecx + 0x7fbbf2], al
add byte [ecx + 0xebcff2], al
add byte [edx + 0x51], bl
invalid
invalid
sub ebp, dword [ecx + 1]

Function at 0x4083a8
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [ecx + 0x7fbbf2], al
add byte [ecx + 0xebcff2], al
add byte [edx + 0x51], bl

Function at 0x408510
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 0xb58], 1

Function at 0x40858c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
jmp 0x408594
sub ecx, 0x14efb
xor ecx, 0x47f2
pop ecx
mov edx, dword [ebp - 0x25c]
invalid

Function at 0x4085a8
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add cl, byte [ecx - 0x25b7b]
dec dword [ebx - 0x25b73]
invalid
Function at 0x4085dc
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
xor ecx, 0x7bec
xor ecx, 0x1936
pop ecx
push ecx
call 0x4085f7
add byte [ebx + 0x43], cl
cmp eax, 0x83354434
les eax, [ecx + ebx*2]
push edi
and edi, 0x12150
sub edi, 0x181d7
pop edi
cmp dword [ebp - 0x188], 0
jne 0x408edc
mov eax, 0x6b
mov word [ebp - 0xca8], ax
mov ecx, 0x65
mov word [ebp - 0xca6], cx
mov edx, 0x72
mov word [ebp - 0xca4], dx
mov eax, 0x6e
mov word [ebp - 0xca2], ax
mov ecx, 0x65
mov word [ebp - 0xca0], cx
mov edx, 0x6c
mov word [ebp - 0xc9e], dx
mov dword [ebp - 0xc9e], edx
mov eax, 0x33
mov word [ebp - 0xc9c], ax
mov dword [ebp - 0xc9c], eax
mov ecx, 0x32
mov word [ebp - 0xc9a], cx
mov edx, 0x2e
mov word [ebp - 0xc98], dx
mov eax, 0x64
mov word [ebp - 0xc96], ax
mov ecx, 0x6c
mov word [ebp - 0xc94], cx
mov edx, 0x6c
mov word [ebp - 0xc92], dx
xor eax, eax
mov word [ebp - 0xc90], ax
push eax
push eax
add esp, 4
sub eax, 0xb500
or eax, 0x10ee2
pop eax
push eax
add eax, 0x6926
pop eax
push esi
push edx
add esp, 4
xor esi, 0x12327
add esi, 0x9af1
add esi, 0x1773f
pop esi
invalid
invalid
inc eax

Function at 0x4085ec
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
xor ecx, 0x7bec
xor ecx, 0x1936
pop ecx
push ecx
call 0x4085f7
add byte [ebx + 0x43], cl
cmp eax, 0x83354434
les eax, [ecx + ebx*2]
push edi
and edi, 0x12150
sub edi, 0x181d7
pop edi
cmp dword [ebp - 0x188], 0
jne 0x408edc
mov eax, 0x6b
mov word [ebp - 0xca8], ax
mov ecx, 0x65
mov word [ebp - 0xca6], cx
mov edx, 0x72
mov word [ebp - 0xca4], dx
mov eax, 0x6e
mov word [ebp - 0xca2], ax
mov ecx, 0x65
mov word [ebp - 0xca0], cx
mov edx, 0x6c
mov word [ebp - 0xc9e], dx
mov dword [ebp - 0xc9e], edx
mov eax, 0x33
mov word [ebp - 0xc9c], ax
mov dword [ebp - 0xc9c], eax
mov ecx, 0x32
mov word [ebp - 0xc9a], cx
mov edx, 0x2e
mov word [ebp - 0xc98], dx
mov eax, 0x64
mov word [ebp - 0xc96], ax
mov ecx, 0x6c
mov word [ebp - 0xc94], cx
mov edx, 0x6c
mov word [ebp - 0xc92], dx
xor eax, eax
mov word [ebp - 0xc90], ax
push eax
push eax
add esp, 4
sub eax, 0xb500
or eax, 0x10ee2
pop eax
push eax
add eax, 0x6926
pop eax
push esi
push edx
add esp, 4
xor esi, 0x12327
add esi, 0x9af1
add esi, 0x1773f
pop esi
invalid
invalid
inc eax
Function at 0x4085f7
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
xor ecx, 0x7bec
xor ecx, 0x1936
pop ecx
push ecx
call 0x4085f7
add byte [ebx + 0x43], cl
cmp eax, 0x83354434
les eax, [ecx + ebx*2]
push edi
and edi, 0x12150
sub edi, 0x181d7
pop edi
cmp dword [ebp - 0x188], 0
jne 0x408edc
mov eax, 0x6b
mov word [ebp - 0xca8], ax
mov ecx, 0x65
mov word [ebp - 0xca6], cx
mov edx, 0x72
mov word [ebp - 0xca4], dx
mov eax, 0x6e
mov word [ebp - 0xca2], ax
mov ecx, 0x65
mov word [ebp - 0xca0], cx
mov edx, 0x6c
mov word [ebp - 0xc9e], dx
mov dword [ebp - 0xc9e], edx
mov eax, 0x33
mov word [ebp - 0xc9c], ax
mov dword [ebp - 0xc9c], eax
mov ecx, 0x32
mov word [ebp - 0xc9a], cx
mov edx, 0x2e
mov word [ebp - 0xc98], dx
mov eax, 0x64
mov word [ebp - 0xc96], ax
mov ecx, 0x6c
mov word [ebp - 0xc94], cx
mov edx, 0x6c
mov word [ebp - 0xc92], dx
xor eax, eax
mov word [ebp - 0xc90], ax
push eax
push eax
add esp, 4
sub eax, 0xb500
or eax, 0x10ee2
pop eax
push eax
add eax, 0x6926
pop eax
push esi
push edx
add esp, 4
xor esi, 0x12327
add esi, 0x9af1
add esi, 0x1773f
pop esi
invalid
invalid
inc eax

Function at 0x40873c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x18]
mov dword [ebp - 0xe30], ecx
mov edx, dword [ebp - 0xe30]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xe34], eax
mov ecx, dword [ebp - 0xe34]
mov dword [ebp - 0xb60], ecx
push esi
jmp 0x40876a
or esi, 0x17167
pop esi
push edx
jmp 0x40877b
xor edx, 0x11ebc
pop edx
push eax
xor eax, 0xed89
or eax, 0x15dbe
add eax, 0xae55
pop eax
cmp dword [ebp - 0xb60], 0
jne 0x4087ae
mov dword [ebp - 0x3cc], 0
jmp 0x408a55
mov edx, dword [ebp - 0xb60]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x6bc], ecx
push edi
push edx
add esp, 4
add al, 0x81
imul dword [edi + ecx]
add dword [eax], eax
pop edi
push edx
push ebx
add esp, 4
and edx, 0x130be
pop edx
push edx
jmp 0x4087e2
call 0x4087ee
add byte [ebx], dh
inc eax
aas
inc eax
inc edx
add esp, 4
pop edx
cmp dword [ebp - 0x6bc], 0
jne 0x40880a
mov dword [ebp - 0x3cc], 0
jmp 0x408a55
mov edx, dword [ebp - 0x6bc]
mov dword [ebp - 0x258], edx
Function at 0x4087ee
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x18]
mov dword [ebp - 0xe30], ecx
mov edx, dword [ebp - 0xe30]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xe34], eax
mov ecx, dword [ebp - 0xe34]
mov dword [ebp - 0xb60], ecx
push esi
jmp 0x40876a
or esi, 0x17167
pop esi
push edx
jmp 0x40877b
xor edx, 0x11ebc
pop edx
push eax
xor eax, 0xed89
or eax, 0x15dbe
add eax, 0xae55
pop eax
cmp dword [ebp - 0xb60], 0
jne 0x4087ae
mov dword [ebp - 0x3cc], 0
jmp 0x408a55
mov edx, dword [ebp - 0xb60]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x6bc], ecx
push edi
push edx
add esp, 4
add al, 0x81
imul dword [edi + ecx]
add dword [eax], eax
pop edi
push edx
push ebx
add esp, 4
and edx, 0x130be
pop edx
push edx
jmp 0x4087e2
call 0x4087ee
add byte [ebx], dh
inc eax
aas
inc eax
inc edx
add esp, 4
pop edx
cmp dword [ebp - 0x6bc], 0
jne 0x40880a
mov dword [ebp - 0x3cc], 0
jmp 0x408a55
mov edx, dword [ebp - 0x6bc]
mov dword [ebp - 0x258], edx

Function at 0x408874
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push esi
push eax
add esp, 4
xor esi, 0xaf82
xor esi, 0x6261
xor esi, 0x1792a
pop esi
push edi
or edi, 0x62f5
add edi, 0x2778
pop edi
push edx
push ecx
add esp, 4
sub edx, 0x45ed
pop edx
lea eax, [ebp - 0xca8]
mov dword [ebp - 0x6b8], eax
mov ecx, dword [ebp - 0x258]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x6b4], edx
xor eax, eax
mov word [ebp - 0x118], ax
xor ecx, ecx
mov word [ebp - 0x2c], cx
push eax
push eax
add esp, 4
sub eax, 0x4bfb
add eax, 0x4975
and eax, 0x1173a
pop eax
push ebx
push edi
add esp, 4
add ebx, 0x1067c
jmp 0x40889d
add ebx, 0xc2c5
pop ebx
mov edx, dword [ebp - 0x6b4]
mov ax, word [edx]
add ah, byte [esi - 0x77]
test dword [edx - 0x74000009], ecx
lea ecx, [ecx + edi*8 - 1]
inc dword [ebx - 0x7276fd3f]
dec esp
stc
invalid
jmp dword [esi - 0x75]
xchg ebp, eax
mov dh, bh
invalid
jmp dword [esi - 0x77]
xchg ebp, eax
call 0x8c4088d0
test dword [eax - 7], ecx
invalid
jmp dword [esi - 0x75]
or byte [esi - 0x77], ah
lea ecx, [eax - 0x74000009]
xchg ebp, eax
dec eax
stc
invalid
inc dword [ebx - 0x6a76fd3e]
dec eax
stc
invalid
jmp dword [esi - 0x75]
invalid
invalid

Function at 0x4088ac
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add ah, byte [esi - 0x77]
test dword [edx - 0x74000009], ecx
lea ecx, [ecx + edi*8 - 1]
inc dword [ebx - 0x7276fd3f]
dec esp
stc
invalid

Function at 0x408950
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
dec dword [edi]
mov bh, 0x55
aam 0x3b
retf 0x840f

Function at 0x408c90
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [ecx + 0x4460c0], al
add byte [ecx + 0x6bbdc8], al
add byte [ecx + 0xda9cc8], al
add byte [eax + 0x53], bl
Function at 0x409590
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0xc8]
movsx ecx, byte [ebp + eax - 0x494]
or ecx, 0x20
and byte [ebx], bh
sar dword [ebp + 0xc], 1
mov dword [ebp - 0x6d0], 0xffffffff
jmp 0x409593
mov dword [ebp - 0x6d0], 1
Function at 0x409868
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 0x24c], edx
push eax
push esi
add esp, 4
and eax, 0x9363
pop eax
push edi
and edi, 0x4fc2
sub edi, 0x3b88
or edi, 0xdcd3
and edi, 0x12e79
pop edi
push edi
push eax
add esp, 4
add edi, 0x797f
pop edi
lea eax, [ebp - 0xc50]
mov dword [ebp - 0x6d8], eax
mov ecx, dword [ebp - 0x24c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x6d4], edx
xor eax, eax
mov word [ebp - 0x120], ax
xor ecx, ecx
mov word [ebp - 0x34], cx
push ecx
push ebx
add esp, 4
or ecx, 0x8887
sub ecx, 0xb03e
sub ecx, 0x79d6
sub ecx, 0x145d6
pop ecx
push edx
sub edx, 0x98dd
pop edx
push ebx
push edx
add esp, 4
and ebx, 0x2446
pop ebx
mov edx, dword [ebp - 0x6d4]
mov ax, word [edx]
mov word [ebp - 0x88e], ax
mov ecx, dword [ebp - 0x6d4]
add ecx, 2
mov dword [ebp - 0x6d4], ecx
mov dx, word [ebp - 0x88e]
mov word [ebp - 0x120], dx
mov eax, dword [ebp - 0x6d8]
mov cx, word [eax]
mov word [ebp - 0x890], cx
mov edx, dword [ebp - 0x6d8]
add edx, 2
mov dword [ebp - 0x6d8], edx
mov ax, word [ebp - 0x890]
mov word [ebp - 0x34], ax
push eax
push esi
add esp, 4
Function at 0x409958
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
and eax, 0x15d78
pop eax
push ebx
push edx
add esp, 4
and ebx, 0x3641
xor ebx, 0x171ea
xor ebx, 0x95fb
pop ebx
push ecx
sub ecx, 0x12d09
sub ecx, 0x6463
pop ecx
movzx ecx, word [ebp - 0x34]
test ecx, ecx
jne 0x4099a2
movzx edx, word [ebp - 0x120]
movzx eax, word [ebp - 0x34]
sub edx, eax
mov dword [ebp - 0xb98], edx
jmp 0x4099fc
movzx ecx, word [ebp - 0x120]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
je 0x4098ca
movzx eax, word [ebp - 0x120]
xor eax, 0x20
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x4098ca
movzx edx, word [ebp - 0x120]
movzx eax, word [ebp - 0x34]
cmp edx, eax
jge 0x4099e6
mov dword [ebp - 0xb94], 0xffffffff
jmp 0x4099f0
mov dword [ebp - 0xb94], 1
mov ecx, dword [ebp - 0xb94]
mov dword [ebp - 0xb98], ecx
cmp dword [ebp - 0xb98], 0
jne 0x409a45
push ebx
push edi
add esp, 4
add ebx, 0x14c7c
and ebx, 0xbb15
and ebx, 0xd462
or ebx, 0xa92a
pop ebx
push ecx
jmp 0x409a2a
xor ecx, 0xb07d
sub ecx, 0x45d3
pop ecx
mov edx, dword [ebp - 0x24c]
mov dword [ebp - 0x18c], edx
jmp 0x409aad
push esi
push ecx
add esp, 4
and esi, 0x49c6
add esi, 0x140bf
or esi, 0xe6b8
pop esi
push ebx
xor ebx, 0x170ec
or ebx, 0x10498
and ebx, 0x9f87
or ebx, 0x1828d
pop ebx
mov eax, dword [ebp - 0x24c]
mov ecx, dword [eax]
mov dword [ebp - 0x24c], ecx
mov edx, dword [ebp - 0x24c]
cmp edx, dword [ebp - 0x6dc]
je 0x409aa3
mov eax, dword [ebp - 0x24c]
cmp dword [eax + 0x30], 0
jne 0x40986e
mov dword [ebp - 0x18c], 0
push edi
call 0x409abb
add byte [esi + 0x35], al
xor esi, dword [0x833c3b3f]
les eax, [ecx + eax*4]
out 0x43, eax
jp 0x409ac4
add byte [edi + 0x57], bl
pop edi
push edi
add edi, 0xfdab
and edi, 0x160ca
add edi, 0xa9e6
sub edi, 0xad5f
pop edi
cmp dword [ebp - 0x18c], 0
jne 0x40a3b2
mov ecx, 0x6b
mov word [ebp - 0xcc4], cx
mov edx, 0x65
mov word [ebp - 0xcc2], dx
mov eax, 0x72
mov word [ebp - 0xcc0], ax
mov ecx, 0x6e
mov word [ebp - 0xcbe], cx
mov edx, 0x65
mov word [ebp - 0xcbc], dx
mov eax, 0x6c
mov word [ebp - 0xcba], ax
mov ecx, 0x33
mov word [ebp - 0xcb8], cx
mov edx, 0x32
mov word [ebp - 0xcb6], dx
mov eax, 0x2e
mov word [ebp - 0xcb4], ax
mov ecx, 0x64
mov word [ebp - 0xcb2], cx
mov edx, 0x6c
mov word [ebp - 0xcb0], dx
mov eax, 0x6c
mov word [ebp - 0xcae], ax
xor ecx, ecx
mov word [ebp - 0xcac], cx
push ecx
or ecx, 0x3759
call 0x409b9c
add byte [ebp + 0x44], cl
xor bh, byte [0x3d43374e]
dec eax
xor eax, 0x5904c483
push ebx
jmp 0x409baa
or ebx, 0x2322
sub ebx, 0x12ff
pop ebx
mov byte [ebp - 0x4d0], 0x4c
mov byte [ebp - 0x4cf], 0x6f
mov byte [ebp - 0x4ce], 0x61
mov byte [ebp - 0x4cd], 0x64
mov byte [ebp - 0x4cc], 0x4c
mov byte [ebp - 0x4cb], 0x69
mov byte [ebp - 0x4ca], 0x62
mov byte [ebp - 0x4c9], 0x72
mov byte [ebp - 0x4c8], 0x61
mov byte [ebp - 0x4c7], 0x72
mov byte [ebp - 0x4c6], 0x79
sti
invalid
invalid
jns 0x409bcb
test dword [ebx], edi
sti
invalid
call dword [edi - 0x3a]
Function at 0x409abb
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
and eax, 0x15d78
pop eax
push ebx
push edx
add esp, 4
and ebx, 0x3641
xor ebx, 0x171ea
xor ebx, 0x95fb
pop ebx
push ecx
sub ecx, 0x12d09
sub ecx, 0x6463
pop ecx
movzx ecx, word [ebp - 0x34]
test ecx, ecx
jne 0x4099a2
movzx edx, word [ebp - 0x120]
movzx eax, word [ebp - 0x34]
sub edx, eax
mov dword [ebp - 0xb98], edx
jmp 0x4099fc
movzx ecx, word [ebp - 0x120]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
je 0x4098ca
movzx eax, word [ebp - 0x120]
xor eax, 0x20
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x4098ca
movzx edx, word [ebp - 0x120]
movzx eax, word [ebp - 0x34]
cmp edx, eax
jge 0x4099e6
mov dword [ebp - 0xb94], 0xffffffff
jmp 0x4099f0
mov dword [ebp - 0xb94], 1
mov ecx, dword [ebp - 0xb94]
mov dword [ebp - 0xb98], ecx
cmp dword [ebp - 0xb98], 0
jne 0x409a45
push ebx
push edi
add esp, 4
add ebx, 0x14c7c
and ebx, 0xbb15
and ebx, 0xd462
or ebx, 0xa92a
pop ebx
push ecx
jmp 0x409a2a
xor ecx, 0xb07d
sub ecx, 0x45d3
pop ecx
mov edx, dword [ebp - 0x24c]
mov dword [ebp - 0x18c], edx
jmp 0x409aad
push esi
push ecx
add esp, 4
and esi, 0x49c6
add esi, 0x140bf
or esi, 0xe6b8
pop esi
push ebx
xor ebx, 0x170ec
or ebx, 0x10498
and ebx, 0x9f87
or ebx, 0x1828d
pop ebx
mov eax, dword [ebp - 0x24c]
mov ecx, dword [eax]
mov dword [ebp - 0x24c], ecx
mov edx, dword [ebp - 0x24c]
cmp edx, dword [ebp - 0x6dc]
je 0x409aa3
mov eax, dword [ebp - 0x24c]
cmp dword [eax + 0x30], 0
jne 0x40986e
mov dword [ebp - 0x18c], 0
push edi
call 0x409abb
add byte [esi + 0x35], al
xor esi, dword [0x833c3b3f]
les eax, [ecx + eax*4]
out 0x43, eax
jp 0x409ac4
add byte [edi + 0x57], bl
pop edi
push edi
add edi, 0xfdab
and edi, 0x160ca
add edi, 0xa9e6
sub edi, 0xad5f
pop edi
cmp dword [ebp - 0x18c], 0
jne 0x40a3b2
mov ecx, 0x6b
mov word [ebp - 0xcc4], cx
mov edx, 0x65
mov word [ebp - 0xcc2], dx
mov eax, 0x72
mov word [ebp - 0xcc0], ax
mov ecx, 0x6e
mov word [ebp - 0xcbe], cx
mov edx, 0x65
mov word [ebp - 0xcbc], dx
mov eax, 0x6c
mov word [ebp - 0xcba], ax
mov ecx, 0x33
mov word [ebp - 0xcb8], cx
mov edx, 0x32
mov word [ebp - 0xcb6], dx
mov eax, 0x2e
mov word [ebp - 0xcb4], ax
mov ecx, 0x64
mov word [ebp - 0xcb2], cx
mov edx, 0x6c
mov word [ebp - 0xcb0], dx
mov eax, 0x6c
mov word [ebp - 0xcae], ax
xor ecx, ecx
mov word [ebp - 0xcac], cx
push ecx
or ecx, 0x3759
call 0x409b9c
add byte [ebp + 0x44], cl
xor bh, byte [0x3d43374e]
dec eax
xor eax, 0x5904c483
push ebx
jmp 0x409baa
or ebx, 0x2322
sub ebx, 0x12ff
pop ebx
mov byte [ebp - 0x4d0], 0x4c
mov byte [ebp - 0x4cf], 0x6f
mov byte [ebp - 0x4ce], 0x61
mov byte [ebp - 0x4cd], 0x64
mov byte [ebp - 0x4cc], 0x4c
mov byte [ebp - 0x4cb], 0x69
mov byte [ebp - 0x4ca], 0x62
mov byte [ebp - 0x4c9], 0x72
mov byte [ebp - 0x4c8], 0x61
mov byte [ebp - 0x4c7], 0x72
mov byte [ebp - 0x4c6], 0x79
sti
invalid
invalid
jns 0x409bcb
test dword [ebx], edi
sti
invalid
call dword [edi - 0x3a]
Function at 0x409b9c
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
and eax, 0x15d78
pop eax
push ebx
push edx
add esp, 4
and ebx, 0x3641
xor ebx, 0x171ea
xor ebx, 0x95fb
pop ebx
push ecx
sub ecx, 0x12d09
sub ecx, 0x6463
pop ecx
movzx ecx, word [ebp - 0x34]
test ecx, ecx
jne 0x4099a2
movzx edx, word [ebp - 0x120]
movzx eax, word [ebp - 0x34]
sub edx, eax
mov dword [ebp - 0xb98], edx
jmp 0x4099fc
movzx ecx, word [ebp - 0x120]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
je 0x4098ca
movzx eax, word [ebp - 0x120]
xor eax, 0x20
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x4098ca
movzx edx, word [ebp - 0x120]
movzx eax, word [ebp - 0x34]
cmp edx, eax
jge 0x4099e6
mov dword [ebp - 0xb94], 0xffffffff
jmp 0x4099f0
mov dword [ebp - 0xb94], 1
mov ecx, dword [ebp - 0xb94]
mov dword [ebp - 0xb98], ecx
cmp dword [ebp - 0xb98], 0
jne 0x409a45
push ebx
push edi
add esp, 4
add ebx, 0x14c7c
and ebx, 0xbb15
and ebx, 0xd462
or ebx, 0xa92a
pop ebx
push ecx
jmp 0x409a2a
xor ecx, 0xb07d
sub ecx, 0x45d3
pop ecx
mov edx, dword [ebp - 0x24c]
mov dword [ebp - 0x18c], edx
jmp 0x409aad
push esi
push ecx
add esp, 4
and esi, 0x49c6
add esi, 0x140bf
or esi, 0xe6b8
pop esi
push ebx
xor ebx, 0x170ec
or ebx, 0x10498
and ebx, 0x9f87
or ebx, 0x1828d
pop ebx
mov eax, dword [ebp - 0x24c]
mov ecx, dword [eax]
mov dword [ebp - 0x24c], ecx
mov edx, dword [ebp - 0x24c]
cmp edx, dword [ebp - 0x6dc]
je 0x409aa3
mov eax, dword [ebp - 0x24c]
cmp dword [eax + 0x30], 0
jne 0x40986e
mov dword [ebp - 0x18c], 0
push edi
call 0x409abb
add byte [esi + 0x35], al
xor esi, dword [0x833c3b3f]
les eax, [ecx + eax*4]
out 0x43, eax
jp 0x409ac4
add byte [edi + 0x57], bl
pop edi
push edi
add edi, 0xfdab
and edi, 0x160ca
add edi, 0xa9e6
sub edi, 0xad5f
pop edi
cmp dword [ebp - 0x18c], 0
jne 0x40a3b2
mov ecx, 0x6b
mov word [ebp - 0xcc4], cx
mov edx, 0x65
mov word [ebp - 0xcc2], dx
mov eax, 0x72
mov word [ebp - 0xcc0], ax
mov ecx, 0x6e
mov word [ebp - 0xcbe], cx
mov edx, 0x65
mov word [ebp - 0xcbc], dx
mov eax, 0x6c
mov word [ebp - 0xcba], ax
mov ecx, 0x33
mov word [ebp - 0xcb8], cx
mov edx, 0x32
mov word [ebp - 0xcb6], dx
mov eax, 0x2e
mov word [ebp - 0xcb4], ax
mov ecx, 0x64
mov word [ebp - 0xcb2], cx
mov edx, 0x6c
mov word [ebp - 0xcb0], dx
mov eax, 0x6c
mov word [ebp - 0xcae], ax
xor ecx, ecx
mov word [ebp - 0xcac], cx
push ecx
or ecx, 0x3759
call 0x409b9c
add byte [ebp + 0x44], cl
xor bh, byte [0x3d43374e]
dec eax
xor eax, 0x5904c483
push ebx
jmp 0x409baa
or ebx, 0x2322
sub ebx, 0x12ff
pop ebx
mov byte [ebp - 0x4d0], 0x4c
mov byte [ebp - 0x4cf], 0x6f
mov byte [ebp - 0x4ce], 0x61
mov byte [ebp - 0x4cd], 0x64
mov byte [ebp - 0x4cc], 0x4c
mov byte [ebp - 0x4cb], 0x69
mov byte [ebp - 0x4ca], 0x62
mov byte [ebp - 0x4c9], 0x72
mov byte [ebp - 0x4c8], 0x61
mov byte [ebp - 0x4c7], 0x72
mov byte [ebp - 0x4c6], 0x79
sti
invalid
invalid
jns 0x409bcb
test dword [ebx], edi
sti
invalid
call dword [edi - 0x3a]
Function at 0x409d24
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 0x6e4], ecx
mov edx, dword [ebp - 0x248]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x6e0], eax
xor ecx, ecx
mov word [ebp - 0x124], cx
xor edx, edx
mov word [ebp - 0x38], dx
push edi
push ecx
add esp, 4
and edi, 0xc6e6
call 0x409d62
add byte [esi + 0x35], al
xor esi, dword [edx]
inc eax
xor al, 0x39
add esp, 4
and edi, 0x123d6
and eax, dword [ecx]
add byte [ecx + 0x30e4e7], al
add byte [edi + 0x50], bl
or eax, 0x12c6f
pop eax
mov eax, dword [ebp - 0x6e0]
mov cx, word [eax]
mov word [ebp - 0x892], cx
mov edx, dword [ebp - 0x6e0]
add edx, 2
mov dword [ebp - 0x6e0], edx
mov ax, word [ebp - 0x892]
invalid
invalid
test esp, ebx

Function at 0x409d62
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 0x6e4], ecx
mov edx, dword [ebp - 0x248]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x6e0], eax
xor ecx, ecx
mov word [ebp - 0x124], cx
xor edx, edx
mov word [ebp - 0x38], dx
push edi
push ecx
add esp, 4
and edi, 0xc6e6
call 0x409d62
add byte [esi + 0x35], al
xor esi, dword [edx]
inc eax
xor al, 0x39
add esp, 4
and edi, 0x123d6
and eax, dword [ecx]
add byte [ecx + 0x30e4e7], al
add byte [edi + 0x50], bl
or eax, 0x12c6f
pop eax
mov eax, dword [ebp - 0x6e0]
mov cx, word [eax]
mov word [ebp - 0x892], cx
mov edx, dword [ebp - 0x6e0]
add edx, 2
mov dword [ebp - 0x6e0], edx
mov ax, word [ebp - 0x892]
invalid
invalid
test esp, ebx

Function at 0x409d68
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 0x6e4], ecx
mov edx, dword [ebp - 0x248]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x6e0], eax
xor ecx, ecx
mov word [ebp - 0x124], cx
xor edx, edx
mov word [ebp - 0x38], dx
push edi
push ecx
add esp, 4
and edi, 0xc6e6
call 0x409d62
add byte [esi + 0x35], al
xor esi, dword [edx]
inc eax
xor al, 0x39
add esp, 4
and edi, 0x123d6
and eax, dword [ecx]
add byte [ecx + 0x30e4e7], al
add byte [edi + 0x50], bl
or eax, 0x12c6f
pop eax
mov eax, dword [ebp - 0x6e0]
mov cx, word [eax]
mov word [ebp - 0x892], cx
mov edx, dword [ebp - 0x6e0]
add edx, 2
mov dword [ebp - 0x6e0], edx
mov ax, word [ebp - 0x892]
invalid
invalid
test esp, ebx