joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f3ff
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 0x1d60], edx
push edx
push ecx
add esp, 4
add edx, 0x1068c
or edx, 0xc263
xor edx, 0x9a05
sub edx, 0xd526
pop edx
push edx
push ebx
add esp, 4
sub edx, 0x5cf7
pop edx
push esi
add esi, 0x1632f
pop esi
mov edx, dword [ebp - 0x1d60]
add edx, 1
mov dword [ebp - 0x159c], edx
push edx
push eax
add esp, 4
jmp 0x40f2c2
and edx, 0x8a6c
jmp 0x40f2d0
pop edx
push ecx
push edx
add esp, 4
xor ecx, 0x14b3a
pop ecx
push edi
push edx
add esp, 4
and edi, 0x171b1
pop edi
push eax
call 0x40f2f7
add byte [ebx + 0x44], cl
inc edx
inc esi
dec esp
xor bh, byte [ebx + eax*4]
les eax, [ecx + eax*4]
loopne 0x40f351
or al, byte [eax]
add al, ch
or dword [eax], eax
add byte [eax], al
add byte [ebx + 0x48], cl
inc ebp
aaa
dec esp
dec esp
inc ecx
xor al, byte [ebx + 0x7eb04c4]
inc edi
cmp dword [edx], esi
inc ebp
inc ecx
aas
xor ebx, dword [eax + 0x69]
inc ebp
aam 0xfe
add byte [eax], al
add byte [0x56f3663b], al
imul ecx, dword [ebp - 0x2c], 0xfe
sub eax, ecx
xor eax, dword [ebp - 0x159c]
imul eax, dword [ebp - 0x2c]
imul edx, dword [ebp - 0x2c], 0xfe
sub eax, edx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x159c]
imul eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1e28], eax
mov dword [ebp - 0x1628], 1
push edi
push ecx
add esp, 4
call 0x40f373
add byte [ebx + 0x37], cl
push eax
dec ecx
xor eax, 0x833e3f33
les eax, [eax + ebp*8]
or byte [eax], al
add byte [eax], al
add byte [ecx + edi + 0x38], cl
inc esi
aaa
inc edi
inc esi
add esp, 4
add edi, 0xc419
jmp 0x40f391
test eax, ebx
loope 0x40f354
invalid
inc edi
test eax, ebx
jmp 0x42f35d
pop edi
imul ecx, dword [ebp - 0x1628], 0xfe
add ecx, 0x56f3663b
imul edx, dword [ebp - 0x1628], 0xfe
sub ecx, edx
xor ecx, dword [ebp - 0x1e28]
imul ecx, dword [ebp - 0x1628]
imul eax, dword [ebp - 0x1628], 0xfe
sub ecx, eax
mov dword [ebp - 0x162c], ecx
mov ecx, dword [ebp - 0x1064]
mov edx, dword [ebp - 0x1060]
mov dword [ebp - 0x1634], ecx
mov dword [ebp - 0x1630], edx
push ebx
push esi
add esp, 4
sub ebx, 0x756e
pop ebx
push ebx
call 0x40f3ff
add byte [esi + edi + 0x35], cl
xor al, 0x47
inc ebx
inc edx
add esp, 4
les eax, [ebx + ebp*8]
invalid
add ebx, 0x104d8
pop ebx
push edx
jmp 0x40f416
pop edx
push edi
push edi
add esp, 4
or edi, 0x177b2
pop edi
push esi
xor esi, 0x14174
xor esi, 0xdbc7
pop esi
push edi
push edi
add esp, 4
add edi, 0x7084
xor edi, 0x12f64
sub edi, 0x766d
pop edi
mov eax, dword [ebp - 0x30]
add eax, 0xfe
imul ecx, dword [ebp - 0x2c], 0xfe
add ecx, 0x56f3663b
imul edx, dword [ebp - 0x2c], 0xfe
sub ecx, edx
xor eax, ecx
imul eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1e30], eax
push esi
push esi
add esp, 4
add esi, 0x7309
pop esi
push edi
push ebx
add esp, 4
sub edi, 0x12ab9
pop edi
push ecx
push eax
add esp, 4
Function at 0x412730
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
pop esi
push ebx
push ecx
add esp, 4
or ebx, 0x9510
or ebx, 0xc5db
xor ebx, 0x17cb6
pop ebx
mov dword [ebp - 0x209c], 0xe
push eax
xor eax, 0x3e1d
xor eax, 0x1b1d
pop eax
push edi
jmp 0x412768
jmp 0x41276d
pop edi
push eax
push esi
add esp, 4
or eax, 0xcbfd
jmp 0x41277e
and eax, 0xa173
pop eax
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xbec]
mov dword [ebp - 0x15c4], eax
push eax
call 0x4127aa
add byte [ebx + 0x36], cl
cmp eax, 0x3538354f
cmp dword [ebx], esi
add esp, 4
jmp 0x4127b2
jmp 0x4127b7
pop eax
push edx
sub edx, 0x995b
pop edx
push edi
push ebx
add esp, 4
xor edi, 0xd8b5
pop edi
mov dword [ebp - 0x20a0], 0xffffffff
push edi
push ecx
add esp, 4
add edi, 0xee54
xor edi, 0xd86c
pop edi
push edx
xor edx, 0x6e6b
xor edx, 0xecc9
pop edx
push esi
push ebx
add esp, 4
and esi, 0x9a8d
sub esi, 0xe802
pop esi
mov ecx, dword [ebp - 0x3f0]
mov dword [ebp - 0x4fc], ecx
jmp 0x412825

Function at 0x4127aa
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
pop esi
push ebx
push ecx
add esp, 4
or ebx, 0x9510
or ebx, 0xc5db
xor ebx, 0x17cb6
pop ebx
mov dword [ebp - 0x209c], 0xe
push eax
xor eax, 0x3e1d
xor eax, 0x1b1d
pop eax
push edi
jmp 0x412768
jmp 0x41276d
pop edi
push eax
push esi
add esp, 4
or eax, 0xcbfd
jmp 0x41277e
and eax, 0xa173
pop eax
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xbec]
mov dword [ebp - 0x15c4], eax
push eax
call 0x4127aa
add byte [ebx + 0x36], cl
cmp eax, 0x3538354f
cmp dword [ebx], esi
add esp, 4
jmp 0x4127b2
jmp 0x4127b7
pop eax
push edx
sub edx, 0x995b
pop edx
push edi
push ebx
add esp, 4
xor edi, 0xd8b5
pop edi
mov dword [ebp - 0x20a0], 0xffffffff
push edi
push ecx
add esp, 4
add edi, 0xee54
xor edi, 0xd86c
pop edi
push edx
xor edx, 0x6e6b
xor edx, 0xecc9
pop edx
push esi
push ebx
add esp, 4
and esi, 0x9a8d
sub esi, 0xe802
pop esi
mov ecx, dword [ebp - 0x3f0]
mov dword [ebp - 0x4fc], ecx
jmp 0x412825
Function at 0x413910
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmc
add byte [eax], al
pop edi
mov eax, dword [ebp - 0x750]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x320], ecx
mov dword [ebp - 0x760], 0
mov edx, dword [ebp - 0x320]
mov dword [ebp - 0x15f0], edx
cmp dword [ebp - 0x15f0], 0
Function at 0x413c6b
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor eax, 0xe8e9
xor eax, 0xe631
pop eax
push edi
and edi, 0xe051
pop edi
mov eax, dword [ebp - 0x3f4]
mov dword [ebp - 0x1974], eax
push edx
jmp 0x413c99
add edx, 0xdc9a
pop edx
push ecx
push esi
add esp, 4
xor ecx, 0x1a2
call 0x413cb7
add byte [eax], bh
xor al, 0x44
xor al, 0x32
aaa
add esp, 4
and ecx, 0x6b03
pop ecx
mov ecx, dword [ebp - 0x1974]
mov dword [ebp - 0x1978], ecx
lea edx, [ebp - 0x1738]
push edx
call dword [ebp - 0x1978]
test eax, eax
jne 0x413d1f
push esi
sub esi, 0x1685f
sub esi, 0x3779
and esi, 0xfd72
sub esi, 0x835a
pop esi
push ebx
push edx
add esp, 4
call 0x413d0c
add byte [edx], dh
cmp al, 0x41
inc edx
dec ebp
dec ebp
inc edx
cmp byte [esi - 0x7d], cl
les eax, [ebx + ebx*2]
mov dword [ebp - 0x79c], 0
jmp 0x414409
push edx
xor edx, 0x3f03
call 0x413d34
add byte [esp + eax*2], bh
dec eax
aas
inc eax
cmp al, 0x4f
xor eax, dword [ebx - 0x357efb3c]
inc edx
mov byte [eax], al
add al, ch
or eax, dword [eax]
add byte [eax], al
add byte [ecx], bh
aas
dec ebx
inc eax
dec edx
aas
inc ebx
inc edi
dec ebp
add esp, 4
pop edx
mov eax, dword fs:[0x18]
mov dword [ebp - 0x197c], eax
mov ecx, dword [ebp - 0x197c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x1980], edx
mov eax, dword [ebp - 0x1980]
mov dword [ebp - 0x15fc], eax
push edx
call 0x413d88
add byte [ebx + 0x38], al
inc edx
dec esi
inc esi
dec ebp
inc ebx
cmp byte [ebx + 0x4eb04c4], al
dec eax
inc ebp
dec esi
xor eax, dword [ecx + 0x91f4ea]
add byte [edx + 0x56], bl
push eax
add esp, 4
or esi, 0xb888
and esi, 0x25be
pop esi
cmp dword [ebp - 0x15fc], 0
jne 0x413dc2
mov dword [ebp - 0x31c], 0
jmp 0x414069
mov ecx, dword [ebp - 0x15fc]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xcb4], eax
push eax
push ebx
add esp, 4
xor eax, 0x941d
pop eax
push eax
push ebx
add esp, 4
or eax, 0x12971
xor eax, 0x6e6e
pop eax
push edi
add edi, 0x6c22
and edi, 0x12520
and edi, 0x13df
pop edi
cmp dword [ebp - 0xcb4], 0
jne 0x413e1e
mov dword [ebp - 0x31c], 0
jmp 0x414069
mov ecx, dword [ebp - 0xcb4]
mov dword [ebp - 0x50c], ecx
Function at 0x413cb7
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor eax, 0xe8e9
xor eax, 0xe631
pop eax
push edi
and edi, 0xe051
pop edi
mov eax, dword [ebp - 0x3f4]
mov dword [ebp - 0x1974], eax
push edx
jmp 0x413c99
add edx, 0xdc9a
pop edx
push ecx
push esi
add esp, 4
xor ecx, 0x1a2
call 0x413cb7
add byte [eax], bh
xor al, 0x44
xor al, 0x32
aaa
add esp, 4
and ecx, 0x6b03
pop ecx
mov ecx, dword [ebp - 0x1974]
mov dword [ebp - 0x1978], ecx
lea edx, [ebp - 0x1738]
push edx
call dword [ebp - 0x1978]
test eax, eax
jne 0x413d1f
push esi
sub esi, 0x1685f
sub esi, 0x3779
and esi, 0xfd72
sub esi, 0x835a
pop esi
push ebx
push edx
add esp, 4
call 0x413d0c
add byte [edx], dh
cmp al, 0x41
inc edx
dec ebp
dec ebp
inc edx
cmp byte [esi - 0x7d], cl
les eax, [ebx + ebx*2]
mov dword [ebp - 0x79c], 0
jmp 0x414409
push edx
xor edx, 0x3f03
call 0x413d34
add byte [esp + eax*2], bh
dec eax
aas
inc eax
cmp al, 0x4f
xor eax, dword [ebx - 0x357efb3c]
inc edx
mov byte [eax], al
add al, ch
or eax, dword [eax]
add byte [eax], al
add byte [ecx], bh
aas
dec ebx
inc eax
dec edx
aas
inc ebx
inc edi
dec ebp
add esp, 4
pop edx
mov eax, dword fs:[0x18]
mov dword [ebp - 0x197c], eax
mov ecx, dword [ebp - 0x197c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x1980], edx
mov eax, dword [ebp - 0x1980]
mov dword [ebp - 0x15fc], eax
push edx
call 0x413d88
add byte [ebx + 0x38], al
inc edx
dec esi
inc esi
dec ebp
inc ebx
cmp byte [ebx + 0x4eb04c4], al
dec eax
inc ebp
dec esi
xor eax, dword [ecx + 0x91f4ea]
add byte [edx + 0x56], bl
push eax
add esp, 4
or esi, 0xb888
and esi, 0x25be
pop esi
cmp dword [ebp - 0x15fc], 0
jne 0x413dc2
mov dword [ebp - 0x31c], 0
jmp 0x414069
mov ecx, dword [ebp - 0x15fc]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xcb4], eax
push eax
push ebx
add esp, 4
xor eax, 0x941d
pop eax
push eax
push ebx
add esp, 4
or eax, 0x12971
xor eax, 0x6e6e
pop eax
push edi
add edi, 0x6c22
and edi, 0x12520
and edi, 0x13df
pop edi
cmp dword [ebp - 0xcb4], 0
jne 0x413e1e
mov dword [ebp - 0x31c], 0
jmp 0x414069
mov ecx, dword [ebp - 0xcb4]
mov dword [ebp - 0x50c], ecx
Function at 0x413d0c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor eax, 0xe8e9
xor eax, 0xe631
pop eax
push edi
and edi, 0xe051
pop edi
mov eax, dword [ebp - 0x3f4]
mov dword [ebp - 0x1974], eax
push edx
jmp 0x413c99
add edx, 0xdc9a
pop edx
push ecx
push esi
add esp, 4
xor ecx, 0x1a2
call 0x413cb7
add byte [eax], bh
xor al, 0x44
xor al, 0x32
aaa
add esp, 4
and ecx, 0x6b03
pop ecx
mov ecx, dword [ebp - 0x1974]
mov dword [ebp - 0x1978], ecx
lea edx, [ebp - 0x1738]
push edx
call dword [ebp - 0x1978]
test eax, eax
jne 0x413d1f
push esi
sub esi, 0x1685f
sub esi, 0x3779
and esi, 0xfd72
sub esi, 0x835a
pop esi
push ebx
push edx
add esp, 4
call 0x413d0c
add byte [edx], dh
cmp al, 0x41
inc edx
dec ebp
dec ebp
inc edx
cmp byte [esi - 0x7d], cl
les eax, [ebx + ebx*2]
mov dword [ebp - 0x79c], 0
jmp 0x414409
push edx
xor edx, 0x3f03
call 0x413d34
add byte [esp + eax*2], bh
dec eax
aas
inc eax
cmp al, 0x4f
xor eax, dword [ebx - 0x357efb3c]
inc edx
mov byte [eax], al
add al, ch
or eax, dword [eax]
add byte [eax], al
add byte [ecx], bh
aas
dec ebx
inc eax
dec edx
aas
inc ebx
inc edi
dec ebp
add esp, 4
pop edx
mov eax, dword fs:[0x18]
mov dword [ebp - 0x197c], eax
mov ecx, dword [ebp - 0x197c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x1980], edx
mov eax, dword [ebp - 0x1980]
mov dword [ebp - 0x15fc], eax
push edx
call 0x413d88
add byte [ebx + 0x38], al
inc edx
dec esi
inc esi
dec ebp
inc ebx
cmp byte [ebx + 0x4eb04c4], al
dec eax
inc ebp
dec esi
xor eax, dword [ecx + 0x91f4ea]
add byte [edx + 0x56], bl
push eax
add esp, 4
or esi, 0xb888
and esi, 0x25be
pop esi
cmp dword [ebp - 0x15fc], 0
jne 0x413dc2
mov dword [ebp - 0x31c], 0
jmp 0x414069
mov ecx, dword [ebp - 0x15fc]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xcb4], eax
push eax
push ebx
add esp, 4
xor eax, 0x941d
pop eax
push eax
push ebx
add esp, 4
or eax, 0x12971
xor eax, 0x6e6e
pop eax
push edi
add edi, 0x6c22
and edi, 0x12520
and edi, 0x13df
pop edi
cmp dword [ebp - 0xcb4], 0
jne 0x413e1e
mov dword [ebp - 0x31c], 0
jmp 0x414069
mov ecx, dword [ebp - 0xcb4]
mov dword [ebp - 0x50c], ecx

Function at 0x4140a0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
dec dword [ebx - 0x7276e7b8]
fdiv st(4), st(0)
invalid
Function at 0x414554
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add edi, 0x8944
call 0x414554
add byte [ecx + 0x49], cl
xor eax, 0x3f473d39
dec esp
add esp, 4
jmp 0x41455c
sub edi, 0xf79b
pop edi
push ecx
jmp 0x41456c
pop ecx
mov byte [ebp - 0x9d4], 0x56
mov byte [ebp - 0x9d3], 0x69
mov byte [ebp - 0x9d2], 0x72
mov byte [ebp - 0x9d1], 0x74
mov byte [ebp - 0x9d0], 0x75
mov byte [ebp - 0x9cf], 0x61
mov byte [ebp - 0x9ce], 0x6c
mov byte [ebp - 0x9cd], 0x50
mov byte [ebp - 0x9cc], 0x72
mov byte [ebp - 0x9cb], 0x6f
mov byte [ebp - 0x9ca], 0x74
mov byte [ebp - 0x9c9], 0x65
mov byte [ebp - 0x9c8], 0x63
mov byte [ebp - 0x9c7], 0x74
mov byte [ebp - 0x9c6], 0
push ebx
push edi
add esp, 4
sub ebx, 0x4125
add ebx, 0x42a4
or ebx, 0xd804
pop ebx
push esi
add esi, 0x160c8
add esi, 0x10af8
and esi, 0xe168
xor esi, 0x67eb
pop esi
mov eax, dword fs:[0x18]
mov dword [ebp - 0x1994], eax
mov ecx, dword [ebp - 0x1994]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x1998], edx
mov eax, dword [ebp - 0x1998]
mov dword [ebp - 0x1614], eax
push ecx
add ecx, 0x8bc
xor ecx, 0x7373
call 0x41464b
add byte [0x464d4136], bh
dec edx
cmp cl, byte [edx + 0x3f]
add esp, 4
call 0x41465d
add byte [edx + 0x43], al
cmp eax, 0x42393247
dec esi
xor eax, 0x5904c483
cmp dword [ebp - 0x1614], 0
jne 0x414679
mov dword [ebp - 0x2fc], 0
jmp 0x414920
mov ecx, dword [ebp - 0x1614]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xcc4], eax
push edi
push edx
add esp, 4
or edi, 0x124a5
add edi, 0x72fe
pop edi
push edi
push ecx
add esp, 4
or edi, 0x5b9d
jmp 0x4146b0
or edi, 0x3f9c
add edi, 0x105e0
pop edi
cmp dword [ebp - 0xcc4], 0
jne 0x4146d5
mov dword [ebp - 0x2fc], 0
jmp 0x414920
mov ecx, dword [ebp - 0xcc4]
mov dword [ebp - 0x514], ecx
push edi
sub edi, 0x16ddf
add edi, 0x16b67
add edi, 0x138e0
pop edi
push eax
push edi
add esp, 4
or eax, 0x41f7
add eax, 0x9bc9
xor eax, 0xc596
xor eax, 0xe18f
pop eax
lea edx, [ebp - 0x1738]
mov dword [ebp - 0xcc0], edx
mov eax, dword [ebp - 0x514]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcbc], ecx
xor edx, edx
mov word [ebp - 0x21c], dx
xor eax, eax
mov word [ebp - 0x38], ax
push ebx
sub ebx, 0x6c96
jmp 0x41474a
pop ebx
push edi
xor edi, 0xdc80
or edi, 0x17c1b
call 0x414765
add byte [ecx + 0x50], cl
xor bh, byte [esi]
cmp eax, 0xc483414c
add al, 0x81
iretd
push edi
push edx
add esp, 4
sub edi, 0x9c8d
and edi, 0xa450
call 0x41493e
add byte [ebx + 0x33], al
dec ecx
inc eax
dec edx
inc ecx
cmp eax, dword [ebx + 0x8e804c4]
add byte [eax], al
add byte [eax], al
cmp ecx, dword [ecx + 0x4e]
inc ecx
dec ecx
cmp esi, dword [esi]
add esp, 4
add al, 0x5f
cmp dword [ebp - 0x2fc], 0
jne 0x415257
mov eax, 0x6b
mov word [ebp - 0x1790], ax
mov ecx, 0x65
mov word [ebp - 0x178e], cx
mov edx, 0x72
mov word [ebp - 0x178c], dx
mov eax, 0x6e
mov word [ebp - 0x178a], ax
mov ecx, 0x65
mov word [ebp - 0x1788], cx
mov edx, 0x6c
mov word [ebp - 0x1786], dx
mov eax, 0x33
mov word [ebp - 0x1784], ax
mov ecx, 0x32
mov word [ebp - 0x1782], cx
mov edx, 0x2e
mov word [ebp - 0x1780], dx
mov eax, 0x64
mov word [ebp - 0x177e], ax
mov ecx, 0x6c
invalid
invalid
invalid
invalid
Function at 0x41464b
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add edi, 0x8944
call 0x414554
add byte [ecx + 0x49], cl
xor eax, 0x3f473d39
dec esp
add esp, 4
jmp 0x41455c
sub edi, 0xf79b
pop edi
push ecx
jmp 0x41456c
pop ecx
mov byte [ebp - 0x9d4], 0x56
mov byte [ebp - 0x9d3], 0x69
mov byte [ebp - 0x9d2], 0x72
mov byte [ebp - 0x9d1], 0x74
mov byte [ebp - 0x9d0], 0x75
mov byte [ebp - 0x9cf], 0x61
mov byte [ebp - 0x9ce], 0x6c
mov byte [ebp - 0x9cd], 0x50
mov byte [ebp - 0x9cc], 0x72
mov byte [ebp - 0x9cb], 0x6f
mov byte [ebp - 0x9ca], 0x74
mov byte [ebp - 0x9c9], 0x65
mov byte [ebp - 0x9c8], 0x63
mov byte [ebp - 0x9c7], 0x74
mov byte [ebp - 0x9c6], 0
push ebx
push edi
add esp, 4
sub ebx, 0x4125
add ebx, 0x42a4
or ebx, 0xd804
pop ebx
push esi
add esi, 0x160c8
add esi, 0x10af8
and esi, 0xe168
xor esi, 0x67eb
pop esi
mov eax, dword fs:[0x18]
mov dword [ebp - 0x1994], eax
mov ecx, dword [ebp - 0x1994]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x1998], edx
mov eax, dword [ebp - 0x1998]
mov dword [ebp - 0x1614], eax
push ecx
add ecx, 0x8bc
xor ecx, 0x7373
call 0x41464b
add byte [0x464d4136], bh
dec edx
cmp cl, byte [edx + 0x3f]
add esp, 4
call 0x41465d
add byte [edx + 0x43], al
cmp eax, 0x42393247
dec esi
xor eax, 0x5904c483
cmp dword [ebp - 0x1614], 0
jne 0x414679
mov dword [ebp - 0x2fc], 0
jmp 0x414920
mov ecx, dword [ebp - 0x1614]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xcc4], eax
push edi
push edx
add esp, 4
or edi, 0x124a5
add edi, 0x72fe
pop edi
push edi
push ecx
add esp, 4
or edi, 0x5b9d
jmp 0x4146b0
or edi, 0x3f9c
add edi, 0x105e0
pop edi
cmp dword [ebp - 0xcc4], 0
jne 0x4146d5
mov dword [ebp - 0x2fc], 0
jmp 0x414920
mov ecx, dword [ebp - 0xcc4]
mov dword [ebp - 0x514], ecx
push edi
sub edi, 0x16ddf
add edi, 0x16b67
add edi, 0x138e0
pop edi
push eax
push edi
add esp, 4
or eax, 0x41f7
add eax, 0x9bc9
xor eax, 0xc596
xor eax, 0xe18f
pop eax
lea edx, [ebp - 0x1738]
mov dword [ebp - 0xcc0], edx
mov eax, dword [ebp - 0x514]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcbc], ecx
xor edx, edx
mov word [ebp - 0x21c], dx
xor eax, eax
mov word [ebp - 0x38], ax
push ebx
sub ebx, 0x6c96
jmp 0x41474a
pop ebx
push edi
xor edi, 0xdc80
or edi, 0x17c1b
call 0x414765
add byte [ecx + 0x50], cl
xor bh, byte [esi]
cmp eax, 0xc483414c
add al, 0x81
iretd
push edi
push edx
add esp, 4
sub edi, 0x9c8d
and edi, 0xa450
call 0x41493e
add byte [ebx + 0x33], al
dec ecx
inc eax
dec edx
inc ecx
cmp eax, dword [ebx + 0x8e804c4]
add byte [eax], al
add byte [eax], al
cmp ecx, dword [ecx + 0x4e]
inc ecx
dec ecx
cmp esi, dword [esi]
add esp, 4
add al, 0x5f
cmp dword [ebp - 0x2fc], 0
jne 0x415257
mov eax, 0x6b
mov word [ebp - 0x1790], ax
mov ecx, 0x65
mov word [ebp - 0x178e], cx
mov edx, 0x72
mov word [ebp - 0x178c], dx
mov eax, 0x6e
mov word [ebp - 0x178a], ax
mov ecx, 0x65
mov word [ebp - 0x1788], cx
mov edx, 0x6c
mov word [ebp - 0x1786], dx
mov eax, 0x33
mov word [ebp - 0x1784], ax
mov ecx, 0x32
mov word [ebp - 0x1782], cx
mov edx, 0x2e
mov word [ebp - 0x1780], dx
mov eax, 0x64
mov word [ebp - 0x177e], ax
mov ecx, 0x6c
invalid
invalid
invalid
invalid
Function at 0x41465d
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add edi, 0x8944
call 0x414554
add byte [ecx + 0x49], cl
xor eax, 0x3f473d39
dec esp
add esp, 4
jmp 0x41455c
sub edi, 0xf79b
pop edi
push ecx
jmp 0x41456c
pop ecx
mov byte [ebp - 0x9d4], 0x56
mov byte [ebp - 0x9d3], 0x69
mov byte [ebp - 0x9d2], 0x72
mov byte [ebp - 0x9d1], 0x74
mov byte [ebp - 0x9d0], 0x75
mov byte [ebp - 0x9cf], 0x61
mov byte [ebp - 0x9ce], 0x6c
mov byte [ebp - 0x9cd], 0x50
mov byte [ebp - 0x9cc], 0x72
mov byte [ebp - 0x9cb], 0x6f
mov byte [ebp - 0x9ca], 0x74
mov byte [ebp - 0x9c9], 0x65
mov byte [ebp - 0x9c8], 0x63
mov byte [ebp - 0x9c7], 0x74
mov byte [ebp - 0x9c6], 0
push ebx
push edi
add esp, 4
sub ebx, 0x4125
add ebx, 0x42a4
or ebx, 0xd804
pop ebx
push esi
add esi, 0x160c8
add esi, 0x10af8
and esi, 0xe168
xor esi, 0x67eb
pop esi
mov eax, dword fs:[0x18]
mov dword [ebp - 0x1994], eax
mov ecx, dword [ebp - 0x1994]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x1998], edx
mov eax, dword [ebp - 0x1998]
mov dword [ebp - 0x1614], eax
push ecx
add ecx, 0x8bc
xor ecx, 0x7373
call 0x41464b
add byte [0x464d4136], bh
dec edx
cmp cl, byte [edx + 0x3f]
add esp, 4
call 0x41465d
add byte [edx + 0x43], al
cmp eax, 0x42393247
dec esi
xor eax, 0x5904c483
cmp dword [ebp - 0x1614], 0
jne 0x414679
mov dword [ebp - 0x2fc], 0
jmp 0x414920
mov ecx, dword [ebp - 0x1614]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xcc4], eax
push edi
push edx
add esp, 4
or edi, 0x124a5
add edi, 0x72fe
pop edi
push edi
push ecx
add esp, 4
or edi, 0x5b9d
jmp 0x4146b0
or edi, 0x3f9c
add edi, 0x105e0
pop edi
cmp dword [ebp - 0xcc4], 0
jne 0x4146d5
mov dword [ebp - 0x2fc], 0
jmp 0x414920
mov ecx, dword [ebp - 0xcc4]
mov dword [ebp - 0x514], ecx
push edi
sub edi, 0x16ddf
add edi, 0x16b67
add edi, 0x138e0
pop edi
push eax
push edi
add esp, 4
or eax, 0x41f7
add eax, 0x9bc9
xor eax, 0xc596
xor eax, 0xe18f
pop eax
lea edx, [ebp - 0x1738]
mov dword [ebp - 0xcc0], edx
mov eax, dword [ebp - 0x514]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcbc], ecx
xor edx, edx
mov word [ebp - 0x21c], dx
xor eax, eax
mov word [ebp - 0x38], ax
push ebx
sub ebx, 0x6c96
jmp 0x41474a
pop ebx
push edi
xor edi, 0xdc80
or edi, 0x17c1b
call 0x414765
add byte [ecx + 0x50], cl
xor bh, byte [esi]
cmp eax, 0xc483414c
add al, 0x81
iretd
push edi
push edx
add esp, 4
sub edi, 0x9c8d
and edi, 0xa450
call 0x41493e
add byte [ebx + 0x33], al
dec ecx
inc eax
dec edx
inc ecx
cmp eax, dword [ebx + 0x8e804c4]
add byte [eax], al
add byte [eax], al
cmp ecx, dword [ecx + 0x4e]
inc ecx
dec ecx
cmp esi, dword [esi]
add esp, 4
add al, 0x5f
cmp dword [ebp - 0x2fc], 0
jne 0x415257
mov eax, 0x6b
mov word [ebp - 0x1790], ax
mov ecx, 0x65
mov word [ebp - 0x178e], cx
mov edx, 0x72
mov word [ebp - 0x178c], dx
mov eax, 0x6e
mov word [ebp - 0x178a], ax
mov ecx, 0x65
mov word [ebp - 0x1788], cx
mov edx, 0x6c
mov word [ebp - 0x1786], dx
mov eax, 0x33
mov word [ebp - 0x1784], ax
mov ecx, 0x32
mov word [ebp - 0x1782], cx
mov edx, 0x2e
mov word [ebp - 0x1780], dx
mov eax, 0x64
mov word [ebp - 0x177e], ax
mov ecx, 0x6c
invalid
invalid
invalid
invalid
Function at 0x414765
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add edi, 0x8944
call 0x414554
add byte [ecx + 0x49], cl
xor eax, 0x3f473d39
dec esp
add esp, 4
jmp 0x41455c
sub edi, 0xf79b
pop edi
push ecx
jmp 0x41456c
pop ecx
mov byte [ebp - 0x9d4], 0x56
mov byte [ebp - 0x9d3], 0x69
mov byte [ebp - 0x9d2], 0x72
mov byte [ebp - 0x9d1], 0x74
mov byte [ebp - 0x9d0], 0x75
mov byte [ebp - 0x9cf], 0x61
mov byte [ebp - 0x9ce], 0x6c
mov byte [ebp - 0x9cd], 0x50
mov byte [ebp - 0x9cc], 0x72
mov byte [ebp - 0x9cb], 0x6f
mov byte [ebp - 0x9ca], 0x74
mov byte [ebp - 0x9c9], 0x65
mov byte [ebp - 0x9c8], 0x63
mov byte [ebp - 0x9c7], 0x74
mov byte [ebp - 0x9c6], 0
push ebx
push edi
add esp, 4
sub ebx, 0x4125
add ebx, 0x42a4
or ebx, 0xd804
pop ebx
push esi
add esi, 0x160c8
add esi, 0x10af8
and esi, 0xe168
xor esi, 0x67eb
pop esi
mov eax, dword fs:[0x18]
mov dword [ebp - 0x1994], eax
mov ecx, dword [ebp - 0x1994]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x1998], edx
mov eax, dword [ebp - 0x1998]
mov dword [ebp - 0x1614], eax
push ecx
add ecx, 0x8bc
xor ecx, 0x7373
call 0x41464b
add byte [0x464d4136], bh
dec edx
cmp cl, byte [edx + 0x3f]
add esp, 4
call 0x41465d
add byte [edx + 0x43], al
cmp eax, 0x42393247
dec esi
xor eax, 0x5904c483
cmp dword [ebp - 0x1614], 0
jne 0x414679
mov dword [ebp - 0x2fc], 0
jmp 0x414920
mov ecx, dword [ebp - 0x1614]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xcc4], eax
push edi
push edx
add esp, 4
or edi, 0x124a5
add edi, 0x72fe
pop edi
push edi
push ecx
add esp, 4
or edi, 0x5b9d
jmp 0x4146b0
or edi, 0x3f9c
add edi, 0x105e0
pop edi
cmp dword [ebp - 0xcc4], 0
jne 0x4146d5
mov dword [ebp - 0x2fc], 0
jmp 0x414920
mov ecx, dword [ebp - 0xcc4]
mov dword [ebp - 0x514], ecx
push edi
sub edi, 0x16ddf
add edi, 0x16b67
add edi, 0x138e0
pop edi
push eax
push edi
add esp, 4
or eax, 0x41f7
add eax, 0x9bc9
xor eax, 0xc596
xor eax, 0xe18f
pop eax
lea edx, [ebp - 0x1738]
mov dword [ebp - 0xcc0], edx
mov eax, dword [ebp - 0x514]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcbc], ecx
xor edx, edx
mov word [ebp - 0x21c], dx
xor eax, eax
mov word [ebp - 0x38], ax
push ebx
sub ebx, 0x6c96
jmp 0x41474a
pop ebx
push edi
xor edi, 0xdc80
or edi, 0x17c1b
call 0x414765
add byte [ecx + 0x50], cl
xor bh, byte [esi]
cmp eax, 0xc483414c
add al, 0x81
iretd
push edi
push edx
add esp, 4
sub edi, 0x9c8d
and edi, 0xa450
call 0x41493e
add byte [ebx + 0x33], al
dec ecx
inc eax
dec edx
inc ecx
cmp eax, dword [ebx + 0x8e804c4]
add byte [eax], al
add byte [eax], al
cmp ecx, dword [ecx + 0x4e]
inc ecx
dec ecx
cmp esi, dword [esi]
add esp, 4
add al, 0x5f
cmp dword [ebp - 0x2fc], 0
jne 0x415257
mov eax, 0x6b
mov word [ebp - 0x1790], ax
mov ecx, 0x65
mov word [ebp - 0x178e], cx
mov edx, 0x72
mov word [ebp - 0x178c], dx
mov eax, 0x6e
mov word [ebp - 0x178a], ax
mov ecx, 0x65
mov word [ebp - 0x1788], cx
mov edx, 0x6c
mov word [ebp - 0x1786], dx
mov eax, 0x33
mov word [ebp - 0x1784], ax
mov ecx, 0x32
mov word [ebp - 0x1782], cx
mov edx, 0x2e
mov word [ebp - 0x1780], dx
mov eax, 0x64
mov word [ebp - 0x177e], ax
mov ecx, 0x6c
invalid
invalid
invalid
invalid