joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x404b8f
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x880
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [eax]
mov eax, dword [eax + 4]
xor ebx, ebx
cmp dword [0x241a2f4], 0x594
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], eax
jne 0x404bc5
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push ebx
call dword [sym.imp.KERNEL32.dll_ClearCommBreak]
mov eax, dword [0x42c3e8]
mov dword [ebp - 0x34], eax
mov eax, dword [0x42c3ec]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x28], 0x9e3779b9
call fcn.00404b88
mov eax, dword [0x42c3f0]
add dword [ebp - 0xc], 0x23f
mov dword [ebp - 0x30], eax
mov eax, dword [0x42c3f4]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0x20
mov dword [ebp - 0x10], 2
add dword [ebp - 0x10], 3
mov eax, edi
shl eax, 4
add eax, dword [ebp - 0x30]
mov dword [ebp - 8], eax
mov eax, dword [0x241a2f4]
cmp eax, 0xfa9
jne 0x404c31
mov dword [0x241a2f0], 0xedeb2e40
cmp eax, 0x3eb
jne 0x404c3e
mov dword [0x23fc010], ebx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov esi, edi
shr esi, cl
add eax, edi
mov dword [ebp - 0x2c], eax
mov dword [0x241a2ec], 0xf4ea3dee
add esi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
xor dword [ebp - 8], eax
xor esi, dword [ebp - 8]
cmp dword [0x241a2f4], 0x213
jne 0x404c78
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
sub dword [ebp - 0x14], esi
cmp dword [0x241a2f4], 0xc
jne 0x404cae
xor eax, eax
mov word [ebp - 0x44], ax
lea edi, [ebp - 0x42]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push ebx
stosw word es:[edi], ax
lea eax, [ebp - 0x87c]
push eax
push 0x4047c8
lea eax, [ebp - 0x44]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x14]
mov eax, esi
lea ecx, [ebp - 8]
call fcn.00404b82
mov eax, dword [ebp - 0x34]
add dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
add eax, esi
xor dword [ebp - 8], eax
shr esi, cl
add esi, dword [ebp - 0x24]
cmp dword [0x241a2f4], 0x121
jne 0x404ced
push ebx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthW]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
xor dword [ebp - 8], esi
sub edi, dword [ebp - 8]
mov dword [ebp - 0x18], edi
mov eax, dword [ebp - 0x28]
sub dword [ebp - 0xc], eax
dec dword [ebp - 0x1c]
jne 0x404c05
cmp dword [0x241a2f4], 0xa6d
mov esi, dword [ebp + 8]
mov dword [esi], edi
jne 0x404d34
push 0x30
lea eax, [ebp - 0x74]
push ebx
push eax
mov dword [ebp - 0x78], ebx
call fcn.004074f0
add esp, 0xc
push ebx
lea eax, [ebp - 0x78]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetDefaultCommConfigW]
mov eax, dword [ebp - 0x14]
pop edi
mov dword [esi + 4], eax
pop esi
pop ebx
leave
ret 4
Function at 0x404d41
Capabilities:
Get common file path
Get memory capacity
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x241a2f4]
mov ecx, dword [0x23fc014]
sub esp, 0xd6c
push ebx
push esi
shr eax, 3
xor esi, esi
push edi
cmp eax, esi
jbe 0x404df4
mov edi, ecx
mov ebx, eax
cmp dword [0x241a2f4], 0x959
jne 0x404de4
push esi
call dword [sym.imp.KERNEL32.dll_LocalLock]
push esi
push esi
lea eax, [ebp - 0x568]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [ebp - 0x168]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push esi
push 0x4047d0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push esi
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
lea eax, [ebp - 0xd68]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
push esi
call dword [sym.imp.KERNEL32.dll_FatalExit]
push edi
call fcn.00404b8f
add edi, 8
dec ebx
jne 0x404d69
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4067df
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42b128]
jne 0x4067e9
repz ret
jmp fcn.0040c7cc

Function at 0x40cacd
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040b3fa
and dword [ebp - 4], 0
cmp dword [0x430258], 0
mov ebx, eax
jne 0x40cb7e
push 0x401c08
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40cc2f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401bfc
push edi
call esi
test eax, eax
je 0x40cc2f
push eax
call fcn.0040b388
mov dword [esp], 0x401bec
push edi
mov dword [0x430258], eax
call esi
push eax
call fcn.0040b388
mov dword [esp], 0x401bd8
push edi
mov dword [0x43025c], eax
call esi
push eax
call fcn.0040b388
mov dword [esp], 0x401bbc
push edi
mov dword [0x430260], eax
call esi
push eax
call fcn.0040b388
pop ecx
mov dword [0x430268], eax
test eax, eax
je 0x40cb7e
push 0x401ba4
push edi
call esi
push eax
call fcn.0040b388
pop ecx
mov dword [0x430264], eax
mov eax, dword [0x430264]
cmp eax, ebx
je 0x40cbd6
cmp dword [0x430268], ebx
je 0x40cbd6
push eax
call fcn.0040b403
push dword [0x430268]
mov esi, eax
call fcn.0040b403
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40cbd6
test edi, edi
je 0x40cbd6
call esi
test eax, eax
je 0x40cbcd
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40cbcd
test byte [ebp - 0xc], 1
jne 0x40cbd6
or dword [ebp + 0x10], 0x200000
jmp 0x40cc0f
mov eax, dword [0x43025c]
cmp eax, ebx
je 0x40cc0f
push eax
call fcn.0040b403
pop ecx
test eax, eax
je 0x40cc0f
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40cc0f
mov eax, dword [0x430260]
cmp eax, ebx
je 0x40cc0f
push eax
call fcn.0040b403
pop ecx
test eax, eax
je 0x40cc0f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x430258]
call fcn.0040b403
pop ecx
test eax, eax
je 0x40cc2f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40cc31
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40140c
Capabilities:
Get number of processors
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20bc
push ebx
push esi
push edi
push ecx
push ebx
add esp, 4
xor ecx, 0x2739
call fcn.00401432
add byte [eax + 0x4f], al
dec ebp
dec edx
cmp al, 0x41
aas
aaa
aas

Function at 0x401432
Capabilities:
Get number of processors
Parse pe header

Disassembly:
add esp, 4
pop ecx
push edi
xor edi, 0x1660d
jmp 0x401443
or edi, 0x8aac
pop edi
mov eax, 0x4d
mov word [ebp - 0x1ff8], ax
mov ecx, 0x42
mov word [ebp - 0x1ff6], cx
mov edx, 0x53
mov word [ebp - 0x1ff4], dx
mov eax, 0x65
mov word [ebp - 0x1ff2], ax
mov ecx, 0x72
mov word [ebp - 0x1ff0], cx
mov edx, 0x76
mov word [ebp - 0x1fee], dx
mov eax, 0x69
mov word [ebp - 0x1fec], ax
mov ecx, 0x63
mov word [ebp - 0x1fea], cx
mov edx, 0x65
mov word [ebp - 0x1fe8], dx
mov eax, 0x2e
mov word [ebp - 0x1fe6], ax
mov ecx, 0x65
mov word [ebp - 0x1fe4], cx
mov edx, 0x78
mov word [ebp - 0x1fe2], dx
mov eax, 0x65
mov word [ebp - 0x1fe0], ax
xor ecx, ecx
mov word [ebp - 0x1fde], cx
mov dword [ebp - 0x1060], 1
push ecx
call 0x401506
add byte [0x3c43383c], bh
inc ecx
add esp, 4
call 0x401515
add byte [eax + edi + 0x3d], cl
dec ebx
xor al, byte [edx - 0x7d]
les eax, [ecx + eax*4]
shr dword [ecx + 0x5900003d], 0x50
push edi
add esp, 4
xor eax, 0x107dd
pop eax
imul edx, dword [ebp - 0x1060], 0x70
add edx, 0x44f3663b
imul eax, dword [ebp - 0x1060], 0x70
sub edx, eax
xor edx, 0xaa6272
imul edx, dword [ebp - 0x1060]
imul ecx, dword [ebp - 0x1060], 0x70
sub edx, ecx
mov dword [ebp - 0x1064], edx
push eax
xor eax, 0x11e56
pop eax
push eax
push ebx
add esp, 4
sub eax, 0xa7c8
jmp 0x401577
pop eax
push ebx
jmp 0x401580
xor ebx, 0x12c74
pop ebx
push edi
add edi, 0x1187
pop edi
mov dword [ebp - 0x10], 1
push edi
push edi
add esp, 4
xor edi, 0x24f8
pop edi
push edi
push edi
add esp, 4
xor edi, 0x4e07
sub edi, 0x1575c
xor edi, 0x176a
pop edi
push ecx
or ecx, 0x55eb
xor ecx, 0x341e
pop ecx
imul edx, dword [ebp - 0x10], 0x70
add edx, 0x44f3663b
imul eax, dword [ebp - 0x10], 0x70
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x70
sub edx, ecx
mov dword [ebp - 0x14], edx
push edx
push edx
add esp, 4
jmp 0x4015f6
sub edx, 0x74a2
or edx, 0x11de6
pop edx
push edx
sub edx, 0xe69b
pop edx
push ecx
call 0x401619
add byte [0x39364f43], bh
cmp dword [ebp - 0x7d], ecx
les eax, [ecx + ebx*2]
push ebx
and ebx, 0x38a3
pop ebx
push ecx
or ecx, 0xb72e
pop ecx
push ebx
add ebx, 0x5a93
pop ebx
push edi
sub edi, 0x16b4d
and edi, 0xd9e3
add edi, 0x6f28
and edi, 0x102e5
pop edi
mov dword [ebp - 0x2c], 1
push edx
push ecx
add esp, 4
or edx, 0x12a61
add edx, 0x461d
xor edx, 0x16c25
pop edx
push edi
sub edi, 0x8b4e
xor edi, 0xe206
xor edi, 0x100ef
xor edi, 0xd314
pop edi
imul edx, dword [ebp - 0x2c], 0x70
add edx, 0x44f3663b
imul eax, dword [ebp - 0x2c], 0x70
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x70
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x401845
Function at 0x401506
Capabilities:
Get number of processors

Disassembly:
add esp, 4
pop ecx
push edi
xor edi, 0x1660d
jmp 0x401443
or edi, 0x8aac
pop edi
mov eax, 0x4d
mov word [ebp - 0x1ff8], ax
mov ecx, 0x42
mov word [ebp - 0x1ff6], cx
mov edx, 0x53
mov word [ebp - 0x1ff4], dx
mov eax, 0x65
mov word [ebp - 0x1ff2], ax
mov ecx, 0x72
mov word [ebp - 0x1ff0], cx
mov edx, 0x76
mov word [ebp - 0x1fee], dx
mov eax, 0x69
mov word [ebp - 0x1fec], ax
mov ecx, 0x63
mov word [ebp - 0x1fea], cx
mov edx, 0x65
mov word [ebp - 0x1fe8], dx
mov eax, 0x2e
mov word [ebp - 0x1fe6], ax
mov ecx, 0x65
mov word [ebp - 0x1fe4], cx
mov edx, 0x78
mov word [ebp - 0x1fe2], dx
mov eax, 0x65
mov word [ebp - 0x1fe0], ax
xor ecx, ecx
mov word [ebp - 0x1fde], cx
mov dword [ebp - 0x1060], 1
push ecx
call 0x401506
add byte [0x3c43383c], bh
inc ecx
add esp, 4
call 0x401515
add byte [eax + edi + 0x3d], cl
dec ebx
xor al, byte [edx - 0x7d]
les eax, [ecx + eax*4]
shr dword [ecx + 0x5900003d], 0x50
push edi
add esp, 4
xor eax, 0x107dd
pop eax
imul edx, dword [ebp - 0x1060], 0x70
add edx, 0x44f3663b
imul eax, dword [ebp - 0x1060], 0x70
sub edx, eax
xor edx, 0xaa6272
imul edx, dword [ebp - 0x1060]
imul ecx, dword [ebp - 0x1060], 0x70
sub edx, ecx
mov dword [ebp - 0x1064], edx
push eax
xor eax, 0x11e56
pop eax
push eax
push ebx
add esp, 4
sub eax, 0xa7c8
jmp 0x401577
pop eax
push ebx
jmp 0x401580
xor ebx, 0x12c74
pop ebx
push edi
add edi, 0x1187
pop edi
mov dword [ebp - 0x10], 1
push edi
push edi
add esp, 4
xor edi, 0x24f8
pop edi
push edi
push edi
add esp, 4
xor edi, 0x4e07
sub edi, 0x1575c
xor edi, 0x176a
pop edi
push ecx
or ecx, 0x55eb
xor ecx, 0x341e
pop ecx
imul edx, dword [ebp - 0x10], 0x70
add edx, 0x44f3663b
imul eax, dword [ebp - 0x10], 0x70
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x70
sub edx, ecx
mov dword [ebp - 0x14], edx
push edx
push edx
add esp, 4
jmp 0x4015f6
sub edx, 0x74a2
or edx, 0x11de6
pop edx
push edx
sub edx, 0xe69b
pop edx
push ecx
call 0x401619
add byte [0x39364f43], bh
cmp dword [ebp - 0x7d], ecx
les eax, [ecx + ebx*2]
push ebx
and ebx, 0x38a3
pop ebx
push ecx
or ecx, 0xb72e
pop ecx
push ebx
add ebx, 0x5a93
pop ebx
push edi
sub edi, 0x16b4d
and edi, 0xd9e3
add edi, 0x6f28
and edi, 0x102e5
pop edi
mov dword [ebp - 0x2c], 1
push edx
push ecx
add esp, 4
or edx, 0x12a61
add edx, 0x461d
xor edx, 0x16c25
pop edx
push edi
sub edi, 0x8b4e
xor edi, 0xe206
xor edi, 0x100ef
xor edi, 0xd314
pop edi
imul edx, dword [ebp - 0x2c], 0x70
add edx, 0x44f3663b
imul eax, dword [ebp - 0x2c], 0x70
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x70
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x401845
Function at 0x401515
Capabilities:
Get number of processors

Disassembly:
add esp, 4
pop ecx
push edi
xor edi, 0x1660d
jmp 0x401443
or edi, 0x8aac
pop edi
mov eax, 0x4d
mov word [ebp - 0x1ff8], ax
mov ecx, 0x42
mov word [ebp - 0x1ff6], cx
mov edx, 0x53
mov word [ebp - 0x1ff4], dx
mov eax, 0x65
mov word [ebp - 0x1ff2], ax
mov ecx, 0x72
mov word [ebp - 0x1ff0], cx
mov edx, 0x76
mov word [ebp - 0x1fee], dx
mov eax, 0x69
mov word [ebp - 0x1fec], ax
mov ecx, 0x63
mov word [ebp - 0x1fea], cx
mov edx, 0x65
mov word [ebp - 0x1fe8], dx
mov eax, 0x2e
mov word [ebp - 0x1fe6], ax
mov ecx, 0x65
mov word [ebp - 0x1fe4], cx
mov edx, 0x78
mov word [ebp - 0x1fe2], dx
mov eax, 0x65
mov word [ebp - 0x1fe0], ax
xor ecx, ecx
mov word [ebp - 0x1fde], cx
mov dword [ebp - 0x1060], 1
push ecx
call 0x401506
add byte [0x3c43383c], bh
inc ecx
add esp, 4
call 0x401515
add byte [eax + edi + 0x3d], cl
dec ebx
xor al, byte [edx - 0x7d]
les eax, [ecx + eax*4]
shr dword [ecx + 0x5900003d], 0x50
push edi
add esp, 4
xor eax, 0x107dd
pop eax
imul edx, dword [ebp - 0x1060], 0x70
add edx, 0x44f3663b
imul eax, dword [ebp - 0x1060], 0x70
sub edx, eax
xor edx, 0xaa6272
imul edx, dword [ebp - 0x1060]
imul ecx, dword [ebp - 0x1060], 0x70
sub edx, ecx
mov dword [ebp - 0x1064], edx
push eax
xor eax, 0x11e56
pop eax
push eax
push ebx
add esp, 4
sub eax, 0xa7c8
jmp 0x401577
pop eax
push ebx
jmp 0x401580
xor ebx, 0x12c74
pop ebx
push edi
add edi, 0x1187
pop edi
mov dword [ebp - 0x10], 1
push edi
push edi
add esp, 4
xor edi, 0x24f8
pop edi
push edi
push edi
add esp, 4
xor edi, 0x4e07
sub edi, 0x1575c
xor edi, 0x176a
pop edi
push ecx
or ecx, 0x55eb
xor ecx, 0x341e
pop ecx
imul edx, dword [ebp - 0x10], 0x70
add edx, 0x44f3663b
imul eax, dword [ebp - 0x10], 0x70
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x70
sub edx, ecx
mov dword [ebp - 0x14], edx
push edx
push edx
add esp, 4
jmp 0x4015f6
sub edx, 0x74a2
or edx, 0x11de6
pop edx
push edx
sub edx, 0xe69b
pop edx
push ecx
call 0x401619
add byte [0x39364f43], bh
cmp dword [ebp - 0x7d], ecx
les eax, [ecx + ebx*2]
push ebx
and ebx, 0x38a3
pop ebx
push ecx
or ecx, 0xb72e
pop ecx
push ebx
add ebx, 0x5a93
pop ebx
push edi
sub edi, 0x16b4d
and edi, 0xd9e3
add edi, 0x6f28
and edi, 0x102e5
pop edi
mov dword [ebp - 0x2c], 1
push edx
push ecx
add esp, 4
or edx, 0x12a61
add edx, 0x461d
xor edx, 0x16c25
pop edx
push edi
sub edi, 0x8b4e
xor edi, 0xe206
xor edi, 0x100ef
xor edi, 0xd314
pop edi
imul edx, dword [ebp - 0x2c], 0x70
add edx, 0x44f3663b
imul eax, dword [ebp - 0x2c], 0x70
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x70
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x401845
Function at 0x401619
Capabilities:
Get number of processors

Disassembly:
add esp, 4
pop ecx
push edi
xor edi, 0x1660d
jmp 0x401443
or edi, 0x8aac
pop edi
mov eax, 0x4d
mov word [ebp - 0x1ff8], ax
mov ecx, 0x42
mov word [ebp - 0x1ff6], cx
mov edx, 0x53
mov word [ebp - 0x1ff4], dx
mov eax, 0x65
mov word [ebp - 0x1ff2], ax
mov ecx, 0x72
mov word [ebp - 0x1ff0], cx
mov edx, 0x76
mov word [ebp - 0x1fee], dx
mov eax, 0x69
mov word [ebp - 0x1fec], ax
mov ecx, 0x63
mov word [ebp - 0x1fea], cx
mov edx, 0x65
mov word [ebp - 0x1fe8], dx
mov eax, 0x2e
mov word [ebp - 0x1fe6], ax
mov ecx, 0x65
mov word [ebp - 0x1fe4], cx
mov edx, 0x78
mov word [ebp - 0x1fe2], dx
mov eax, 0x65
mov word [ebp - 0x1fe0], ax
xor ecx, ecx
mov word [ebp - 0x1fde], cx
mov dword [ebp - 0x1060], 1
push ecx
call 0x401506
add byte [0x3c43383c], bh
inc ecx
add esp, 4
call 0x401515
add byte [eax + edi + 0x3d], cl
dec ebx
xor al, byte [edx - 0x7d]
les eax, [ecx + eax*4]
shr dword [ecx + 0x5900003d], 0x50
push edi
add esp, 4
xor eax, 0x107dd
pop eax
imul edx, dword [ebp - 0x1060], 0x70
add edx, 0x44f3663b
imul eax, dword [ebp - 0x1060], 0x70
sub edx, eax
xor edx, 0xaa6272
imul edx, dword [ebp - 0x1060]
imul ecx, dword [ebp - 0x1060], 0x70
sub edx, ecx
mov dword [ebp - 0x1064], edx
push eax
xor eax, 0x11e56
pop eax
push eax
push ebx
add esp, 4
sub eax, 0xa7c8
jmp 0x401577
pop eax
push ebx
jmp 0x401580
xor ebx, 0x12c74
pop ebx
push edi
add edi, 0x1187
pop edi
mov dword [ebp - 0x10], 1
push edi
push edi
add esp, 4
xor edi, 0x24f8
pop edi
push edi
push edi
add esp, 4
xor edi, 0x4e07
sub edi, 0x1575c
xor edi, 0x176a
pop edi
push ecx
or ecx, 0x55eb
xor ecx, 0x341e
pop ecx
imul edx, dword [ebp - 0x10], 0x70
add edx, 0x44f3663b
imul eax, dword [ebp - 0x10], 0x70
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x70
sub edx, ecx
mov dword [ebp - 0x14], edx
push edx
push edx
add esp, 4
jmp 0x4015f6
sub edx, 0x74a2
or edx, 0x11de6
pop edx
push edx
sub edx, 0xe69b
pop edx
push ecx
call 0x401619
add byte [0x39364f43], bh
cmp dword [ebp - 0x7d], ecx
les eax, [ecx + ebx*2]
push ebx
and ebx, 0x38a3
pop ebx
push ecx
or ecx, 0xb72e
pop ecx
push ebx
add ebx, 0x5a93
pop ebx
push edi
sub edi, 0x16b4d
and edi, 0xd9e3
add edi, 0x6f28
and edi, 0x102e5
pop edi
mov dword [ebp - 0x2c], 1
push edx
push ecx
add esp, 4
or edx, 0x12a61
add edx, 0x461d
xor edx, 0x16c25
pop edx
push edi
sub edi, 0x8b4e
xor edi, 0xe206
xor edi, 0x100ef
xor edi, 0xd314
pop edi
imul edx, dword [ebp - 0x2c], 0x70
add edx, 0x44f3663b
imul eax, dword [ebp - 0x2c], 0x70
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x70
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x401845
Function at 0x404d5b
Capabilities:
Get number of processors

Disassembly:
add esp, 4
or eax, 0xba0e
and eax, 0xdb70
pop eax
push esi
and esi, 0x7a04
xor esi, 0x164e5
add esi, 0x1701c
pop esi
mov dword [ebp - 0x20a4], 0xffffffff
push eax
push eax
add esp, 4
sub eax, 0x26a6
sub eax, 0x3303
and eax, 0x16b06
or eax, 0x11dd8
pop eax
push eax
add eax, 0xab71
xor eax, 0x4b41
and eax, 0x174fb
pop eax
mov ecx, dword [ebp - 0x3f0]
mov dword [ebp - 0x500], ecx
jmp 0x404dd8
Function at 0x404f23
Capabilities:
Get number of processors

Disassembly:
dec ebx
xor al, byte [ebx - 0x7d]
add esp, 4
pop ecx
push ecx
push ecx
add esp, 4
and ecx, 0xde5f
pop ecx
push edi
jmp 0x404f39
xor edi, 0x17a5c
pop edi
mov edx, dword [ebp - 0xac0]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0xabc]
movzx edx, byte [ecx]
cmp eax, edx
je 0x404fc2
push esi
push ebx
add esp, 4
add esi, 0x3527
jmp 0x404f69
or esi, 0x1860e
sub esi, 0xf0cd
pop esi
push ebx
push edi
add esp, 4
and ebx, 0xe55c
sub ebx, 0x10f18
pop ebx
mov eax, dword [ebp - 0xac0]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0xabc]
movzx eax, byte [edx]
cmp ecx, eax
jle 0x404faa
mov dword [ebp - 0x15a0], 1
jmp 0x404fb4
mov dword [ebp - 0x15a0], 0xffffffff
mov ecx, dword [ebp - 0x15a0]
mov dword [ebp - 0xc8c], ecx
push edi
push edx
add esp, 4
call 0x404fd6
add byte [ecx], bh
inc edx
dec edx
dec ebp
dec edx
push eax
add esp, 4
add edi, 0xb9b
jmp 0x404fe5
add edi, 0x15801
pop edi
push ebx
sub ebx, 0x99ff
pop ebx
mov edx, dword [ebp - 0xc88]
sub edx, 1
mov dword [ebp - 0xc88], edx
mov eax, dword [ebp - 0xac0]
add eax, 1
mov dword [ebp - 0xac0], eax
mov ecx, dword [ebp - 0xabc]
add ecx, 1
mov dword [ebp - 0xabc], ecx
jmp 0x404f01

Function at 0x404fd6
Capabilities:
Get number of processors

Disassembly:
dec ebx
xor al, byte [ebx - 0x7d]
add esp, 4
pop ecx
push ecx
push ecx
add esp, 4
and ecx, 0xde5f
pop ecx
push edi
jmp 0x404f39
xor edi, 0x17a5c
pop edi
mov edx, dword [ebp - 0xac0]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0xabc]
movzx edx, byte [ecx]
cmp eax, edx
je 0x404fc2
push esi
push ebx
add esp, 4
add esi, 0x3527
jmp 0x404f69
or esi, 0x1860e
sub esi, 0xf0cd
pop esi
push ebx
push edi
add esp, 4
and ebx, 0xe55c
sub ebx, 0x10f18
pop ebx
mov eax, dword [ebp - 0xac0]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0xabc]
movzx eax, byte [edx]
cmp ecx, eax
jle 0x404faa
mov dword [ebp - 0x15a0], 1
jmp 0x404fb4
mov dword [ebp - 0x15a0], 0xffffffff
mov ecx, dword [ebp - 0x15a0]
mov dword [ebp - 0xc8c], ecx
push edi
push edx
add esp, 4
call 0x404fd6
add byte [ecx], bh
inc edx
dec edx
dec ebp
dec edx
push eax
add esp, 4
add edi, 0xb9b
jmp 0x404fe5
add edi, 0x15801
pop edi
push ebx
sub ebx, 0x99ff
pop ebx
mov edx, dword [ebp - 0xc88]
sub edx, 1
mov dword [ebp - 0xc88], edx
mov eax, dword [ebp - 0xac0]
add eax, 1
mov dword [ebp - 0xac0], eax
mov ecx, dword [ebp - 0xabc]
add ecx, 1
mov dword [ebp - 0xabc], ecx
jmp 0x404f01
Function at 0x405ad5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor dh, byte [edi - 0x3b7cb6cd]
add al, 0x81
ret 0x589d
Function at 0x406ee0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x406eef
add byte [0x5044493e], bh
dec ebp
add esp, 4
pop edx
mov edx, dword [ebp - 0x518]
mov dword [ebp - 0x774], edx
jmp 0x406f69

Function at 0x406eef
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x406eef
add byte [0x5044493e], bh
dec ebp
add esp, 4
pop edx
mov edx, dword [ebp - 0x518]
mov dword [ebp - 0x774], edx
jmp 0x406f69

Function at 0x406f29
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
sub eax, 0x3f1b