joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411700
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
imul edx, dword [ebp - 0x18], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x18], 0xfe
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x18]

Function at 0x411720
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
imul ecx, dword [ebp - 0x18], 0xfe
sub edx, ecx
mov dword [ebp - 0x1c], edx
push edx
push ecx
add esp, 4
or edx, 0x924c
and edx, 0xe6ac
add edx, 0x5852
pop edx
push ecx
xor ecx, 0x170a5
sub ecx, 0x2288
xor ecx, 0x17a33
sub ecx, 0x2728
pop ecx
mov dword [ebp - 0x1a64], 1
push eax
push ecx
add esp, 4
xor eax, 0x706d
add eax, 0xd38a
pop eax
push ecx
push esi
add esp, 4
sub ecx, 0xba85
pop ecx
push eax
xor eax, 0x903f
sub eax, 0x38d5
sub eax, 0x1147d
pop eax
imul edx, dword [ebp - 0x1a64], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x1a64], 0xfe
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x1a64]
imul ecx, dword [ebp - 0x1a64], 0xfe
sub edx, ecx
mov dword [ebp - 0x1a68], edx
push esi
jmp 0x4117d9
or esi, 0xe989
pop esi
push edx
sub edx, 0x3321
call fcn.004117f4
add byte [esi + eax*2], bh
aaa
xor al, 0x3f
dec ebp
inc ecx

Function at 0x4117f4
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or edx, 0x11d43
or edx, 0xa17a
pop edx
mov dword [ebp - 0x2c], 1
push edi
push ecx
add esp, 4
jmp 0x411815
jmp 0x41181e
pop edi
push esi
or esi, 0x7b34
call 0x411833
add byte [0x4a434336], bh
dec eax
aaa
add esp, 4
add esi, 0x5516
pop esi
imul edx, dword [ebp - 0x2c], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x2c], 0xfe
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0xfe
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x411a1e

Function at 0x411833
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or edx, 0x11d43
or edx, 0xa17a
pop edx
mov dword [ebp - 0x2c], 1
push edi
push ecx
add esp, 4
jmp 0x411815
jmp 0x41181e
pop edi
push esi
or esi, 0x7b34
call 0x411833
add byte [0x4a434336], bh
dec eax
aaa
add esp, 4
add esi, 0x5516
pop esi
imul edx, dword [ebp - 0x2c], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x2c], 0xfe
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0xfe
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x411a1e
Function at 0x415653
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or edx, 0x1872
or edx, 0x162e7
pop edx
push edi
and edi, 0x15c6b
sub edi, 0x104df
pop edi
mov edx, dword fs:[0x18]
mov dword [ebp - 0x1f14], edx
mov eax, dword [ebp - 0x1f14]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x1f18], ecx
mov edx, dword [ebp - 0x1f18]
mov dword [ebp - 0x1b60], edx
push edi
push edx
add esp, 4
call 0x4156aa
add byte [ebp + 0x46], cl
inc ecx
inc esp
inc edx
dec ebx
add esp, 4
jmp 0x4156b2
pop edi
push edi
push esi
add esp, 4
add edi, 0x1464b
pop edi
push ebx
push ecx
add esp, 4
add ebx, 0x133c4
pop ebx
cmp dword [ebp - 0x1b60], 0
jne 0x4156e3
mov dword [ebp - 0x394], 0
jmp 0x41598a
mov eax, dword [ebp - 0x1b60]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xfcc], edx
push eax
add eax, 0x8aa6
jmp 0x415705
pop eax
push esi
push eax
add esp, 4
sub esi, 0x538f
call 0x41571d
add byte [ebx + 0x42], al
inc esp
xor dh, byte [0x4c48348]
sub esi, 0x1242c
pop esi
cmp dword [ebp - 0xfcc], 0
jne 0x41573f
mov dword [ebp - 0x394], 0
jmp 0x41598a
mov eax, dword [ebp - 0xfcc]
mov dword [ebp - 0x630], eax

Function at 0x4156aa
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or edx, 0x1872
or edx, 0x162e7
pop edx
push edi
and edi, 0x15c6b
sub edi, 0x104df
pop edi
mov edx, dword fs:[0x18]
mov dword [ebp - 0x1f14], edx
mov eax, dword [ebp - 0x1f14]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x1f18], ecx
mov edx, dword [ebp - 0x1f18]
mov dword [ebp - 0x1b60], edx
push edi
push edx
add esp, 4
call 0x4156aa
add byte [ebp + 0x46], cl
inc ecx
inc esp
inc edx
dec ebx
add esp, 4
jmp 0x4156b2
pop edi
push edi
push esi
add esp, 4
add edi, 0x1464b
pop edi
push ebx
push ecx
add esp, 4
add ebx, 0x133c4
pop ebx
cmp dword [ebp - 0x1b60], 0
jne 0x4156e3
mov dword [ebp - 0x394], 0
jmp 0x41598a
mov eax, dword [ebp - 0x1b60]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xfcc], edx
push eax
add eax, 0x8aa6
jmp 0x415705
pop eax
push esi
push eax
add esp, 4
sub esi, 0x538f
call 0x41571d
add byte [ebx + 0x42], al
inc esp
xor dh, byte [0x4c48348]
sub esi, 0x1242c
pop esi
cmp dword [ebp - 0xfcc], 0
jne 0x41573f
mov dword [ebp - 0x394], 0
jmp 0x41598a
mov eax, dword [ebp - 0xfcc]
mov dword [ebp - 0x630], eax
Function at 0x41571d
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or edx, 0x1872
or edx, 0x162e7
pop edx
push edi
and edi, 0x15c6b
sub edi, 0x104df
pop edi
mov edx, dword fs:[0x18]
mov dword [ebp - 0x1f14], edx
mov eax, dword [ebp - 0x1f14]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x1f18], ecx
mov edx, dword [ebp - 0x1f18]
mov dword [ebp - 0x1b60], edx
push edi
push edx
add esp, 4
call 0x4156aa
add byte [ebp + 0x46], cl
inc ecx
inc esp
inc edx
dec ebx
add esp, 4
jmp 0x4156b2
pop edi
push edi
push esi
add esp, 4
add edi, 0x1464b
pop edi
push ebx
push ecx
add esp, 4
add ebx, 0x133c4
pop ebx
cmp dword [ebp - 0x1b60], 0
jne 0x4156e3
mov dword [ebp - 0x394], 0
jmp 0x41598a
mov eax, dword [ebp - 0x1b60]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xfcc], edx
push eax
add eax, 0x8aa6
jmp 0x415705
pop eax
push esi
push eax
add esp, 4
sub esi, 0x538f
call 0x41571d
add byte [ebx + 0x42], al
inc esp
xor dh, byte [0x4c48348]
sub esi, 0x1242c
pop esi
cmp dword [ebp - 0xfcc], 0
jne 0x41573f
mov dword [ebp - 0x394], 0
jmp 0x41598a
mov eax, dword [ebp - 0xfcc]
mov dword [ebp - 0x630], eax
Function at 0x4157c1
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edx
sub edx, 0x14807
pop edx
push esi
add esi, 0x67cc
and esi, 0x12285
pop esi
push edx
xor edx, 0x1744
pop edx
push edx
jmp 0x415770
and edx, 0x17d26
or edx, 0x14f20
pop edx
lea ecx, [ebp - 0x1ba8]
mov dword [ebp - 0xfc8], ecx
mov edx, dword [ebp - 0x630]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xfc4], eax
xor ecx, ecx
mov word [ebp - 0x2a4], cx
xor edx, edx
mov word [ebp - 0x60], dx
push edi
push edx
add esp, 4
jmp 0x4157b1
call 0x4157c1
add byte [edx + 0x46], al
inc esi
dec ecx
inc edx
inc eax
xor al, 0x37
dec ebp
push eax
add esp, 4
and edi, 0xb975
pop edi
push edx
xor edx, 0x5cf4
add edx, 0x18568
pop edx
mov eax, dword [ebp - 0xfc4]
mov cx, word [eax]
mov word [ebp - 0x140e], cx
mov edx, dword [ebp - 0xfc4]
add edx, 2
mov dword [ebp - 0xfc4], edx
mov ax, word [ebp - 0x140e]
mov word [ebp - 0x2a4], ax
mov ecx, dword [ebp - 0xfc8]
mov dx, word [ecx]
mov word [ebp - 0x1410], dx
mov eax, dword [ebp - 0xfc8]
add eax, 2
mov dword [ebp - 0xfc8], eax
mov cx, word [ebp - 0x1410]
mov word [ebp - 0x60], cx
push ecx
push ebx
add esp, 4
sub ecx, 0x8a27
call 0x41584b
add byte [edi + esi + 0x3b], al
aaa
dec ebx
cmp esi, dword [edi]
dec edi
cmp eax, 0x4c48339
pop ecx
push ecx
push esi
add esp, 4
jmp 0x41585b
or ecx, 0xfc56
pop ecx
movzx edx, word [ebp - 0x60]
test edx, edx
jne 0x41587f
movzx eax, word [ebp - 0x2a4]
movzx ecx, word [ebp - 0x60]
sub eax, ecx
mov dword [ebp - 0x1b68], eax
jmp 0x4158d9
movzx edx, word [ebp - 0x2a4]
movzx eax, word [ebp - 0x60]
cmp edx, eax
je 0x4157a7
movzx ecx, word [ebp - 0x2a4]
xor ecx, 0x20
movzx edx, word [ebp - 0x60]
cmp ecx, edx
je 0x4157a7
movzx eax, word [ebp - 0x2a4]
movzx ecx, word [ebp - 0x60]
cmp eax, ecx
jge 0x4158c3
mov dword [ebp - 0x1b64], 0xffffffff
jmp 0x4158cd
mov dword [ebp - 0x1b64], 1
mov edx, dword [ebp - 0x1b64]
mov dword [ebp - 0x1b68], edx
cmp dword [ebp - 0x1b68], 0
jne 0x415922
push ecx
call 0x4158f3
add byte [eax], bh
xor eax, 0x3a3a3c33
cmp eax, 0x833a4c41
les eax, [ebx + ebp*8]
pop es
aaa
aaa
inc eax
dec eax
cmp dword [0xf4c98148], edi
push ebp
add byte [eax], al
pop ecx
push edx
xor edx, 0x10bdb
add edx, 0x137db
pop edx
mov eax, dword [ebp - 0x630]
mov dword [ebp - 0x394], eax
jmp 0x41598a
push edi
call 0x415932
add byte [ebx + eax*2 + 0x4d], al
dec ebp
aaa
dec edx
aas
dec ebx
inc edi
add esp, 4
add edi, 0x108f
and edi, 0x105cf
pop edi
push esi
push edx
add esp, 4
and esi, 0x54ed
add esi, 0xbeff
mov esi, 0x8b5e0000
invalid
sar cl, 1
invalid
dec dword [ebx - 0x2f6a76ef]
stc
invalid
dec dword [ebx - 0x62f7b]
invalid
cmp eax, dword [ebp - 0xfcc]
je 0x415980
mov ecx, dword [ebp - 0x630]
cmp dword [ecx + 0x30], 0
jne 0x41574b
mov dword [ebp - 0x394], 0
push eax
or eax, 0x7b5a
add bl, ch
invalid
pop eax
push ebx
and ebx, 0x2826
call 0x4159ac
add byte [ebx + 0x4b], al
inc eax
cmp eax, 0xc4834032
add al, 0x81
jecxz 0x4159de
retf
jecxz 0x4159df
invalid
invalid
Function at 0x41584b
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edx
sub edx, 0x14807
pop edx
push esi
add esi, 0x67cc
and esi, 0x12285
pop esi
push edx
xor edx, 0x1744
pop edx
push edx
jmp 0x415770
and edx, 0x17d26
or edx, 0x14f20
pop edx
lea ecx, [ebp - 0x1ba8]
mov dword [ebp - 0xfc8], ecx
mov edx, dword [ebp - 0x630]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xfc4], eax
xor ecx, ecx
mov word [ebp - 0x2a4], cx
xor edx, edx
mov word [ebp - 0x60], dx
push edi
push edx
add esp, 4
jmp 0x4157b1
call 0x4157c1
add byte [edx + 0x46], al
inc esi
dec ecx
inc edx
inc eax
xor al, 0x37
dec ebp
push eax
add esp, 4
and edi, 0xb975
pop edi
push edx
xor edx, 0x5cf4
add edx, 0x18568
pop edx
mov eax, dword [ebp - 0xfc4]
mov cx, word [eax]
mov word [ebp - 0x140e], cx
mov edx, dword [ebp - 0xfc4]
add edx, 2
mov dword [ebp - 0xfc4], edx
mov ax, word [ebp - 0x140e]
mov word [ebp - 0x2a4], ax
mov ecx, dword [ebp - 0xfc8]
mov dx, word [ecx]
mov word [ebp - 0x1410], dx
mov eax, dword [ebp - 0xfc8]
add eax, 2
mov dword [ebp - 0xfc8], eax
mov cx, word [ebp - 0x1410]
mov word [ebp - 0x60], cx
push ecx
push ebx
add esp, 4
sub ecx, 0x8a27
call 0x41584b
add byte [edi + esi + 0x3b], al
aaa
dec ebx
cmp esi, dword [edi]
dec edi
cmp eax, 0x4c48339
pop ecx
push ecx
push esi
add esp, 4
jmp 0x41585b
or ecx, 0xfc56
pop ecx
movzx edx, word [ebp - 0x60]
test edx, edx
jne 0x41587f
movzx eax, word [ebp - 0x2a4]
movzx ecx, word [ebp - 0x60]
sub eax, ecx
mov dword [ebp - 0x1b68], eax
jmp 0x4158d9
movzx edx, word [ebp - 0x2a4]
movzx eax, word [ebp - 0x60]
cmp edx, eax
je 0x4157a7
movzx ecx, word [ebp - 0x2a4]
xor ecx, 0x20
movzx edx, word [ebp - 0x60]
cmp ecx, edx
je 0x4157a7
movzx eax, word [ebp - 0x2a4]
movzx ecx, word [ebp - 0x60]
cmp eax, ecx
jge 0x4158c3
mov dword [ebp - 0x1b64], 0xffffffff
jmp 0x4158cd
mov dword [ebp - 0x1b64], 1
mov edx, dword [ebp - 0x1b64]
mov dword [ebp - 0x1b68], edx
cmp dword [ebp - 0x1b68], 0
jne 0x415922
push ecx
call 0x4158f3
add byte [eax], bh
xor eax, 0x3a3a3c33
cmp eax, 0x833a4c41
les eax, [ebx + ebp*8]
pop es
aaa
aaa
inc eax
dec eax
cmp dword [0xf4c98148], edi
push ebp
add byte [eax], al
pop ecx
push edx
xor edx, 0x10bdb
add edx, 0x137db
pop edx
mov eax, dword [ebp - 0x630]
mov dword [ebp - 0x394], eax
jmp 0x41598a
push edi
call 0x415932
add byte [ebx + eax*2 + 0x4d], al
dec ebp
aaa
dec edx
aas
dec ebx
inc edi
add esp, 4
add edi, 0x108f
and edi, 0x105cf
pop edi
push esi
push edx
add esp, 4
and esi, 0x54ed
add esi, 0xbeff
mov esi, 0x8b5e0000
invalid
sar cl, 1
invalid
dec dword [ebx - 0x2f6a76ef]
stc
invalid
dec dword [ebx - 0x62f7b]
invalid
cmp eax, dword [ebp - 0xfcc]
je 0x415980
mov ecx, dword [ebp - 0x630]
cmp dword [ecx + 0x30], 0
jne 0x41574b
mov dword [ebp - 0x394], 0
push eax
or eax, 0x7b5a
add bl, ch
invalid
pop eax
push ebx
and ebx, 0x2826
call 0x4159ac
add byte [ebx + 0x4b], al
inc eax
cmp eax, 0xc4834032
add al, 0x81
jecxz 0x4159de
retf
jecxz 0x4159df
invalid
invalid
Function at 0x4158f3
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edx
sub edx, 0x14807
pop edx
push esi
add esi, 0x67cc
and esi, 0x12285
pop esi
push edx
xor edx, 0x1744
pop edx
push edx
jmp 0x415770
and edx, 0x17d26
or edx, 0x14f20
pop edx
lea ecx, [ebp - 0x1ba8]
mov dword [ebp - 0xfc8], ecx
mov edx, dword [ebp - 0x630]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xfc4], eax
xor ecx, ecx
mov word [ebp - 0x2a4], cx
xor edx, edx
mov word [ebp - 0x60], dx
push edi
push edx
add esp, 4
jmp 0x4157b1
call 0x4157c1
add byte [edx + 0x46], al
inc esi
dec ecx
inc edx
inc eax
xor al, 0x37
dec ebp
push eax
add esp, 4
and edi, 0xb975
pop edi
push edx
xor edx, 0x5cf4
add edx, 0x18568
pop edx
mov eax, dword [ebp - 0xfc4]
mov cx, word [eax]
mov word [ebp - 0x140e], cx
mov edx, dword [ebp - 0xfc4]
add edx, 2
mov dword [ebp - 0xfc4], edx
mov ax, word [ebp - 0x140e]
mov word [ebp - 0x2a4], ax
mov ecx, dword [ebp - 0xfc8]
mov dx, word [ecx]
mov word [ebp - 0x1410], dx
mov eax, dword [ebp - 0xfc8]
add eax, 2
mov dword [ebp - 0xfc8], eax
mov cx, word [ebp - 0x1410]
mov word [ebp - 0x60], cx
push ecx
push ebx
add esp, 4
sub ecx, 0x8a27
call 0x41584b
add byte [edi + esi + 0x3b], al
aaa
dec ebx
cmp esi, dword [edi]
dec edi
cmp eax, 0x4c48339
pop ecx
push ecx
push esi
add esp, 4
jmp 0x41585b
or ecx, 0xfc56
pop ecx
movzx edx, word [ebp - 0x60]
test edx, edx
jne 0x41587f
movzx eax, word [ebp - 0x2a4]
movzx ecx, word [ebp - 0x60]
sub eax, ecx
mov dword [ebp - 0x1b68], eax
jmp 0x4158d9
movzx edx, word [ebp - 0x2a4]
movzx eax, word [ebp - 0x60]
cmp edx, eax
je 0x4157a7
movzx ecx, word [ebp - 0x2a4]
xor ecx, 0x20
movzx edx, word [ebp - 0x60]
cmp ecx, edx
je 0x4157a7
movzx eax, word [ebp - 0x2a4]
movzx ecx, word [ebp - 0x60]
cmp eax, ecx
jge 0x4158c3
mov dword [ebp - 0x1b64], 0xffffffff
jmp 0x4158cd
mov dword [ebp - 0x1b64], 1
mov edx, dword [ebp - 0x1b64]
mov dword [ebp - 0x1b68], edx
cmp dword [ebp - 0x1b68], 0
jne 0x415922
push ecx
call 0x4158f3
add byte [eax], bh
xor eax, 0x3a3a3c33
cmp eax, 0x833a4c41
les eax, [ebx + ebp*8]
pop es
aaa
aaa
inc eax
dec eax
cmp dword [0xf4c98148], edi
push ebp
add byte [eax], al
pop ecx
push edx
xor edx, 0x10bdb
add edx, 0x137db
pop edx
mov eax, dword [ebp - 0x630]
mov dword [ebp - 0x394], eax
jmp 0x41598a
push edi
call 0x415932
add byte [ebx + eax*2 + 0x4d], al
dec ebp
aaa
dec edx
aas
dec ebx
inc edi
add esp, 4
add edi, 0x108f
and edi, 0x105cf
pop edi
push esi
push edx
add esp, 4
and esi, 0x54ed
add esi, 0xbeff
mov esi, 0x8b5e0000
invalid
sar cl, 1
invalid
dec dword [ebx - 0x2f6a76ef]
stc
invalid
dec dword [ebx - 0x62f7b]
invalid
cmp eax, dword [ebp - 0xfcc]
je 0x415980
mov ecx, dword [ebp - 0x630]
cmp dword [ecx + 0x30], 0
jne 0x41574b
mov dword [ebp - 0x394], 0
push eax
or eax, 0x7b5a
add bl, ch
invalid
pop eax
push ebx
and ebx, 0x2826
call 0x4159ac
add byte [ebx + 0x4b], al
inc eax
cmp eax, 0xc4834032
add al, 0x81
jecxz 0x4159de
retf
jecxz 0x4159df
invalid
invalid
Function at 0x415932
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edx
sub edx, 0x14807
pop edx
push esi
add esi, 0x67cc
and esi, 0x12285
pop esi
push edx
xor edx, 0x1744
pop edx
push edx
jmp 0x415770
and edx, 0x17d26
or edx, 0x14f20
pop edx
lea ecx, [ebp - 0x1ba8]
mov dword [ebp - 0xfc8], ecx
mov edx, dword [ebp - 0x630]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xfc4], eax
xor ecx, ecx
mov word [ebp - 0x2a4], cx
xor edx, edx
mov word [ebp - 0x60], dx
push edi
push edx
add esp, 4
jmp 0x4157b1
call 0x4157c1
add byte [edx + 0x46], al
inc esi
dec ecx
inc edx
inc eax
xor al, 0x37
dec ebp
push eax
add esp, 4
and edi, 0xb975
pop edi
push edx
xor edx, 0x5cf4
add edx, 0x18568
pop edx
mov eax, dword [ebp - 0xfc4]
mov cx, word [eax]
mov word [ebp - 0x140e], cx
mov edx, dword [ebp - 0xfc4]
add edx, 2
mov dword [ebp - 0xfc4], edx
mov ax, word [ebp - 0x140e]
mov word [ebp - 0x2a4], ax
mov ecx, dword [ebp - 0xfc8]
mov dx, word [ecx]
mov word [ebp - 0x1410], dx
mov eax, dword [ebp - 0xfc8]
add eax, 2
mov dword [ebp - 0xfc8], eax
mov cx, word [ebp - 0x1410]
mov word [ebp - 0x60], cx
push ecx
push ebx
add esp, 4
sub ecx, 0x8a27
call 0x41584b
add byte [edi + esi + 0x3b], al
aaa
dec ebx
cmp esi, dword [edi]
dec edi
cmp eax, 0x4c48339
pop ecx
push ecx
push esi
add esp, 4
jmp 0x41585b
or ecx, 0xfc56
pop ecx
movzx edx, word [ebp - 0x60]
test edx, edx
jne 0x41587f
movzx eax, word [ebp - 0x2a4]
movzx ecx, word [ebp - 0x60]
sub eax, ecx
mov dword [ebp - 0x1b68], eax
jmp 0x4158d9
movzx edx, word [ebp - 0x2a4]
movzx eax, word [ebp - 0x60]
cmp edx, eax
je 0x4157a7
movzx ecx, word [ebp - 0x2a4]
xor ecx, 0x20
movzx edx, word [ebp - 0x60]
cmp ecx, edx
je 0x4157a7
movzx eax, word [ebp - 0x2a4]
movzx ecx, word [ebp - 0x60]
cmp eax, ecx
jge 0x4158c3
mov dword [ebp - 0x1b64], 0xffffffff
jmp 0x4158cd
mov dword [ebp - 0x1b64], 1
mov edx, dword [ebp - 0x1b64]
mov dword [ebp - 0x1b68], edx
cmp dword [ebp - 0x1b68], 0
jne 0x415922
push ecx
call 0x4158f3
add byte [eax], bh
xor eax, 0x3a3a3c33
cmp eax, 0x833a4c41
les eax, [ebx + ebp*8]
pop es
aaa
aaa
inc eax
dec eax
cmp dword [0xf4c98148], edi
push ebp
add byte [eax], al
pop ecx
push edx
xor edx, 0x10bdb
add edx, 0x137db
pop edx
mov eax, dword [ebp - 0x630]
mov dword [ebp - 0x394], eax
jmp 0x41598a
push edi
call 0x415932
add byte [ebx + eax*2 + 0x4d], al
dec ebp
aaa
dec edx
aas
dec ebx
inc edi
add esp, 4
add edi, 0x108f
and edi, 0x105cf
pop edi
push esi
push edx
add esp, 4
and esi, 0x54ed
add esi, 0xbeff
mov esi, 0x8b5e0000
invalid
sar cl, 1
invalid
dec dword [ebx - 0x2f6a76ef]
stc
invalid
dec dword [ebx - 0x62f7b]
invalid
cmp eax, dword [ebp - 0xfcc]
je 0x415980
mov ecx, dword [ebp - 0x630]
cmp dword [ecx + 0x30], 0
jne 0x41574b
mov dword [ebp - 0x394], 0
push eax
or eax, 0x7b5a
add bl, ch
invalid
pop eax
push ebx
and ebx, 0x2826
call 0x4159ac
add byte [ebx + 0x4b], al
inc eax
cmp eax, 0xc4834032
add al, 0x81
jecxz 0x4159de
retf
jecxz 0x4159df
invalid
invalid
Function at 0x415970
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edx
sub edx, 0x14807
pop edx
push esi
add esi, 0x67cc
and esi, 0x12285
pop esi
push edx
xor edx, 0x1744
pop edx
push edx
jmp 0x415770
and edx, 0x17d26
or edx, 0x14f20
pop edx
lea ecx, [ebp - 0x1ba8]
mov dword [ebp - 0xfc8], ecx
mov edx, dword [ebp - 0x630]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xfc4], eax
xor ecx, ecx
mov word [ebp - 0x2a4], cx
xor edx, edx
mov word [ebp - 0x60], dx
push edi
push edx
add esp, 4
jmp 0x4157b1
call 0x4157c1
add byte [edx + 0x46], al
inc esi
dec ecx
inc edx
inc eax
xor al, 0x37
dec ebp
push eax
add esp, 4
and edi, 0xb975
pop edi
push edx
xor edx, 0x5cf4
add edx, 0x18568
pop edx
mov eax, dword [ebp - 0xfc4]
mov cx, word [eax]
mov word [ebp - 0x140e], cx
mov edx, dword [ebp - 0xfc4]
add edx, 2
mov dword [ebp - 0xfc4], edx
mov ax, word [ebp - 0x140e]
mov word [ebp - 0x2a4], ax
mov ecx, dword [ebp - 0xfc8]
mov dx, word [ecx]
mov word [ebp - 0x1410], dx
mov eax, dword [ebp - 0xfc8]
add eax, 2
mov dword [ebp - 0xfc8], eax
mov cx, word [ebp - 0x1410]
mov word [ebp - 0x60], cx
push ecx
push ebx
add esp, 4
sub ecx, 0x8a27
call 0x41584b
add byte [edi + esi + 0x3b], al
aaa
dec ebx
cmp esi, dword [edi]
dec edi
cmp eax, 0x4c48339
pop ecx
push ecx
push esi
add esp, 4
jmp 0x41585b
or ecx, 0xfc56
pop ecx
movzx edx, word [ebp - 0x60]
test edx, edx
jne 0x41587f
movzx eax, word [ebp - 0x2a4]
movzx ecx, word [ebp - 0x60]
sub eax, ecx
mov dword [ebp - 0x1b68], eax
jmp 0x4158d9
movzx edx, word [ebp - 0x2a4]
movzx eax, word [ebp - 0x60]
cmp edx, eax
je 0x4157a7
movzx ecx, word [ebp - 0x2a4]
xor ecx, 0x20
movzx edx, word [ebp - 0x60]
cmp ecx, edx
je 0x4157a7
movzx eax, word [ebp - 0x2a4]
movzx ecx, word [ebp - 0x60]
cmp eax, ecx
jge 0x4158c3
mov dword [ebp - 0x1b64], 0xffffffff
jmp 0x4158cd
mov dword [ebp - 0x1b64], 1
mov edx, dword [ebp - 0x1b64]
mov dword [ebp - 0x1b68], edx
cmp dword [ebp - 0x1b68], 0
jne 0x415922
push ecx
call 0x4158f3
add byte [eax], bh
xor eax, 0x3a3a3c33
cmp eax, 0x833a4c41
les eax, [ebx + ebp*8]
pop es
aaa
aaa
inc eax
dec eax
cmp dword [0xf4c98148], edi
push ebp
add byte [eax], al
pop ecx
push edx
xor edx, 0x10bdb
add edx, 0x137db
pop edx
mov eax, dword [ebp - 0x630]
mov dword [ebp - 0x394], eax
jmp 0x41598a
push edi
call 0x415932
add byte [ebx + eax*2 + 0x4d], al
dec ebp
aaa
dec edx
aas
dec ebx
inc edi
add esp, 4
add edi, 0x108f
and edi, 0x105cf
pop edi
push esi
push edx
add esp, 4
and esi, 0x54ed
add esi, 0xbeff
mov esi, 0x8b5e0000
invalid
sar cl, 1
invalid
dec dword [ebx - 0x2f6a76ef]
stc
invalid
dec dword [ebx - 0x62f7b]
invalid
cmp eax, dword [ebp - 0xfcc]
je 0x415980
mov ecx, dword [ebp - 0x630]
cmp dword [ecx + 0x30], 0
jne 0x41574b
mov dword [ebp - 0x394], 0
push eax
or eax, 0x7b5a
add bl, ch
invalid
pop eax
push ebx
and ebx, 0x2826
call 0x4159ac
add byte [ebx + 0x4b], al
inc eax
cmp eax, 0xc4834032
add al, 0x81
jecxz 0x4159de
retf
jecxz 0x4159df
invalid
invalid
Function at 0x4159ac
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edx
sub edx, 0x14807
pop edx
push esi
add esi, 0x67cc
and esi, 0x12285
pop esi
push edx
xor edx, 0x1744
pop edx
push edx
jmp 0x415770
and edx, 0x17d26
or edx, 0x14f20
pop edx
lea ecx, [ebp - 0x1ba8]
mov dword [ebp - 0xfc8], ecx
mov edx, dword [ebp - 0x630]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xfc4], eax
xor ecx, ecx
mov word [ebp - 0x2a4], cx
xor edx, edx
mov word [ebp - 0x60], dx
push edi
push edx
add esp, 4
jmp 0x4157b1
call 0x4157c1
add byte [edx + 0x46], al
inc esi
dec ecx
inc edx
inc eax
xor al, 0x37
dec ebp
push eax
add esp, 4
and edi, 0xb975
pop edi
push edx
xor edx, 0x5cf4
add edx, 0x18568
pop edx
mov eax, dword [ebp - 0xfc4]
mov cx, word [eax]
mov word [ebp - 0x140e], cx
mov edx, dword [ebp - 0xfc4]
add edx, 2
mov dword [ebp - 0xfc4], edx
mov ax, word [ebp - 0x140e]
mov word [ebp - 0x2a4], ax
mov ecx, dword [ebp - 0xfc8]
mov dx, word [ecx]
mov word [ebp - 0x1410], dx
mov eax, dword [ebp - 0xfc8]
add eax, 2
mov dword [ebp - 0xfc8], eax
mov cx, word [ebp - 0x1410]
mov word [ebp - 0x60], cx
push ecx
push ebx
add esp, 4
sub ecx, 0x8a27
call 0x41584b
add byte [edi + esi + 0x3b], al
aaa
dec ebx
cmp esi, dword [edi]
dec edi
cmp eax, 0x4c48339
pop ecx
push ecx
push esi
add esp, 4
jmp 0x41585b
or ecx, 0xfc56
pop ecx
movzx edx, word [ebp - 0x60]
test edx, edx
jne 0x41587f
movzx eax, word [ebp - 0x2a4]
movzx ecx, word [ebp - 0x60]
sub eax, ecx
mov dword [ebp - 0x1b68], eax
jmp 0x4158d9
movzx edx, word [ebp - 0x2a4]
movzx eax, word [ebp - 0x60]
cmp edx, eax
je 0x4157a7
movzx ecx, word [ebp - 0x2a4]
xor ecx, 0x20
movzx edx, word [ebp - 0x60]
cmp ecx, edx
je 0x4157a7
movzx eax, word [ebp - 0x2a4]
movzx ecx, word [ebp - 0x60]
cmp eax, ecx
jge 0x4158c3
mov dword [ebp - 0x1b64], 0xffffffff
jmp 0x4158cd
mov dword [ebp - 0x1b64], 1
mov edx, dword [ebp - 0x1b64]
mov dword [ebp - 0x1b68], edx
cmp dword [ebp - 0x1b68], 0
jne 0x415922
push ecx
call 0x4158f3
add byte [eax], bh
xor eax, 0x3a3a3c33
cmp eax, 0x833a4c41
les eax, [ebx + ebp*8]
pop es
aaa
aaa
inc eax
dec eax
cmp dword [0xf4c98148], edi
push ebp
add byte [eax], al
pop ecx
push edx
xor edx, 0x10bdb
add edx, 0x137db
pop edx
mov eax, dword [ebp - 0x630]
mov dword [ebp - 0x394], eax
jmp 0x41598a
push edi
call 0x415932
add byte [ebx + eax*2 + 0x4d], al
dec ebp
aaa
dec edx
aas
dec ebx
inc edi
add esp, 4
add edi, 0x108f
and edi, 0x105cf
pop edi
push esi
push edx
add esp, 4
and esi, 0x54ed
add esi, 0xbeff
mov esi, 0x8b5e0000
invalid
sar cl, 1
invalid
dec dword [ebx - 0x2f6a76ef]
stc
invalid
dec dword [ebx - 0x62f7b]
invalid
cmp eax, dword [ebp - 0xfcc]
je 0x415980
mov ecx, dword [ebp - 0x630]
cmp dword [ecx + 0x30], 0
jne 0x41574b
mov dword [ebp - 0x394], 0
push eax
or eax, 0x7b5a
add bl, ch
invalid
pop eax
push ebx
and ebx, 0x2826
call 0x4159ac
add byte [ebx + 0x4b], al
inc eax
cmp eax, 0xc4834032
add al, 0x81
jecxz 0x4159de
retf
jecxz 0x4159df
invalid
invalid