joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b910
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov edi, eax
mov eax, dword [esi + 8]
cmp eax, 1
jne 0x40b99f
mov ecx, dword [edi + 8]
cmp ecx, eax
jne 0x40b967
mov eax, dword [edi]
mov ebx, dword [esi]
lea ebp, [eax + ebx]
cdq
mov ecx, eax
mov edi, edx
mov eax, ebx
cdq
add ecx, eax
adc edi, edx
mov eax, ebp
cdq
cmp eax, ecx
jne 0x42b7cf
cmp edx, edi
jne 0x42b7cf
mov dword [esi], ebp
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x42b7f9
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
cmp ecx, 2
je 0x42b7e0
cmp eax, 3
je case.0x40b9a7.3
mov ecx, esi
call fcn.0040be90
fstp qword [esp + 0x10]
call fcn.004092c0
fld qword [esp + 0x10]
fstp qword [esi]
mov dword [esi + 8], 3
mov ecx, edi
call fcn.0040be90
fadd qword [esi]
fstp qword [esi]
jmp case.0x40b9a7.5
sub eax, 2
cmp eax, 9
ja case.0x40b9a7.5
jmp dword [eax*4 + 0x40b9b0]
cld
invalid
outsb dx, byte [esi]
add byte [eax], al
loop 0x42b6e1
adc eax, dword [eax]
add byte [ecx + 0x6f7c2], al
add byte [edx - 0x75], bl
xchg ebp, eax
enter 0xfffffffffffffff8, 0xffffffffffffffff
xchg ebp, eax
xor bh, ah
invalid
mov dword [0xce810000], eax
mov byte [edi], cl
add byte [esi + 0x50], bl
jmp 0x42b7b8
sub eax, 0x4d4a
pop eax
push edx
jmp 0x42b7c8
add edx, 0xdb80
pop edx
mov byte [ebp - 0x960], 0x56
mov byte [ebp - 0x95f], 0x69
mov byte [ebp - 0x95e], 0x72
mov byte [ebp - 0x95d], 0x74
idiv bh
push dword [edx - 0x3a]
test dword [ebx + 0x74fffff6], esp
mov byte [ebp - 0x95c], 0x75
mov byte [ebp - 0x95b], 0x61
mov byte [ebp - 0x95a], 0x6c
mov byte [ebp - 0x959], 0x50
mov byte [ebp - 0x958], 0x72
mov byte [ebp - 0x957], 0x6f
mov byte [ebp - 0x956], 0x74
mov byte [ebp - 0x955], 0x65
mov byte [ebp - 0x954], 0x63
mov byte [ebp - 0x953], 0x74
mov byte [ebp - 0x952], 0
push ecx
push ebx
add esp, 4
and ecx, 0x5b48
pop ecx
push eax
push ebx
add esp, 4
or eax, 0x10fb4
jmp 0x42b858
call 0x42b866
add byte [edx], bh
inc ebx
dec ebp
cmp eax, 0x4a463f3c
add esp, 4
pop eax
mov eax, dword fs:[0x18]
mov dword [ebp - 0x1c34], eax
mov ecx, dword [ebp - 0x1c34]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x18d4], edx
mov eax, dword [ebp - 0x18d4]
mov dword [ebp - 0x150c], eax
push ebx
or ebx, 0x9004
or ebx, 0x206e
sub ebx, 0x12c08
pop ebx
push eax
push edi
add esp, 4
or eax, 0x168fc
Function at 0x40bd00
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, 1
cmp dword [edi + 4], ebx
je 0x40bd20
cmp byte [edi + 0xd], 0
push esi
jne 0x40bd25
cmp byte [edi + 0xc], 0
je 0x42a406
mov byte [edi + 0xd], bl
pop esi
dec dword [edi + 4]
pop ebx
ret
mov esi, dword [edi + 8]
push ebp
mov ebp, dword [esi + 0x10]
test esi, esi
je 0x40bd3e
call fcn.004092c0
push esi
call fcn.004112ef
add esp, 4
mov dword [edi + 8], ebp
mov byte [edi + 0xd], 0
pop ebp
jmp 0x40bd12

Function at 0x40c000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp dword [esi + 4], 0
push ebx
jne 0x40c014
mov ebx, dword [esi]
push edi
call fcn.00409210
inc dword [esi + 4]
pop ebx
ret
cmp byte [esi + 0xd], 0
je 0x40c02c
mov ebx, dword [esi + 8]
push edi
call fcn.00409210
inc dword [esi + 4]
mov byte [esi + 0xd], 0
pop ebx
ret
push 0x18
call fcn.0041171a
add esp, 4
test eax, eax
je 0x40c059
mov ebx, eax
mov eax, edi
call fcn.0040bd50
mov eax, dword [esi + 8]
test eax, eax
jne 0x42c155
mov dword [ebx + 0x10], eax
inc dword [esi + 4]
mov dword [esi + 8], ebx
pop ebx
ret
xor ebx, ebx
jmp 0x40c043
in al, dx
clc
Function at 0x40c060
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
xor ecx, ecx
mov eax, 8
mov dword [esi + 8], eax
mov edx, 2
mul edx
seto cl
mov dword [esi + 4], 0
neg ecx
or ecx, eax
push ecx
call fcn.0041171a
xor ecx, ecx
mov dword [esi], eax
push 4
mov word [eax], cx
call fcn.0041171a
add esp, 8
test eax, eax
je 0x429d02
mov dword [eax], 1
mov dword [esi + 0xc], eax
mov eax, esi
pop esi
ret
jmp 0x42ed24
mov dword [esi + 0xf60c], 0xd86c76a
test byte [eax], 0
mov dword fs:[esi + 0xf60e], 0xf86c770
test byte [eax], 0
mov dword gs:[esi + 0xf610], 0x1186c766
test byte [eax], 0
push esp
mov dword [esi + 0xf612], 0x1386c775
test byte [eax], 0
jae 0x42ed1a
xchg byte [esi + esi*8], dl
add byte [eax], al
push 0xffffffffffffffc7
xchg byte [0x6f0000f6], dl
mov dword [esi + 0xf616], 0x1786c768
test byte [eax], 0
add dword [edx + eax*4 - 0x14], edx
jl 0x42edd5
add al, byte [ecx]
and ah, 0x22
in al, 0x22
jb 0x42ed7b
add dword [edx + 0x1a920cc], eax
add dword [eax + ebx*2 + 0x54], ebx
or ah, 0x20
test eax, 0x585c0101
push esp
test ch, al
add eax, 0x334df082
add dword [ecx], eax
xor al, 0x35
mov byte [ecx], al
add dword [eax + 0x58], esp
push esp
test ch, al
add eax, 0x8755d082
add al, byte [ecx]
pushal
mov dword [esi + 0xf619], 0x1a86c753
test byte [eax], 0
jne 0x42ed76
xchg byte [ebx], bl
test byte [eax], 0
insd dword es:[edi], dx
mov dword [esi + 0xf61c], 0x1d86c744
test byte [eax], 0
jae 0x42ed8b
xchg byte [esi], bl
test byte [eax], 0
mov word [esi + 0xf61f], 0xc762
xchg byte [eax], ah
test byte [eax], 0
add byte [eax], al
jne 0x42eda0
xchg byte [ecx], ah
test byte [eax], 0
mov word [esi + 0xf622], 0xc756
xchg byte [ebx], ah
test byte [eax], 0
outsd dx, dword [esi]
mov dword [esi + 0xf624], 0x2586c76a
test byte [eax], 0
mov dword fs:[esi + 0xf626], 0x2786c770
test byte [eax], 0
mov dword gs:[esi + 0xf628], 0x2986c766
test byte [eax], 0
push esp
mov dword [esi + 0xf62a], 0x2b86c775
test byte [eax], 0
jae 0x42eded
xchg byte [esi + esi*8], ch
add byte [eax], al
push 0xffffffffffffffc7
xchg byte [0x6f0000f6], ch
mov dword [esi + 0xf62e], 0x2f86c768
test byte [eax], 0
add dword [ebx - 0x17], edx
or byte [ecx], al
add dword [ecx], eax
add dword [ebp + 0x45], eax
dec ebp
dec ecx
dec esi
dec ebp
test ch, al
add eax, 0x6ce9eb82
add dword [ecx], eax
pop ebx
push ecx
jmp 0x143ef6a

Function at 0x40c0b0
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esi + 4]
mov edx, dword [ecx + 4]
test eax, eax
je 0x429906
test edx, edx
je 0x429912
mov ecx, dword [ecx]
cmp eax, edx
jb 0x40c0ce
mov edx, eax
mov eax, dword [esi]
jmp fcn.0040c0e0
call dword [eax]
hlt
Function at 0x40c170
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebp
push esi
push edi
mov edi, eax
mov esi, ecx
test edi, edi
je 0x40c1ce
mov ebp, dword [esp + 0x10]
mov eax, dword [ebx + 4]
cmp ebp, eax
jae 0x40c1ce
cmp edi, 0xffffffff
jne 0x42a4d4
sub eax, ebp
mov edi, eax
mov eax, dword [esi + 0xc]
cmp dword [eax], 1
jg 0x40c1d6
mov eax, dword [esi + 4]
add eax, edi
call fcn.004034b0
mov ecx, dword [ebx]
lea eax, [edi + edi]
push eax
mov eax, dword [esi + 4]
lea edx, [ecx + ebp*2]
mov ecx, dword [esi]
push edx
lea edx, [ecx + eax*2]
push edx
call fcn.00410f70
add dword [esi + 4], edi
mov eax, dword [esi + 4]
mov ecx, dword [esi]
add esp, 0xc
xor edx, edx
mov word [ecx + eax*2], dx
pop edi
mov eax, esi
pop esi
pop ebp
ret 4
dec dword [eax]
push 4
call fcn.0041171a
add esp, 4
test eax, eax
je 0x40c249
mov dword [eax], 1
mov edx, dword [esi + 4]
mov dword [esi + 0xc], eax
lea eax, [edx + edi + 1]
mov dword [esi + 8], eax
test eax, eax
je 0x42a4e4
add eax, 7
shr eax, 3
add eax, eax
add eax, eax
add eax, eax
xor ecx, ecx
mov dword [esi + 8], eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041171a
mov ecx, dword [esi + 4]
lea edx, [ecx + ecx + 2]
mov ecx, dword [esi]
push edx
push ecx
push eax
mov dword [esp + 0x20], eax
call fcn.00410f70
mov edx, dword [esp + 0x20]
add esp, 0x10
mov dword [esi], edx
jmp 0x40c1a5
xor eax, eax
jmp 0x40c1ec
add byte [eax], al
add byte [eax], al
aas

Function at 0x40c2a0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
inc dword [eax]
mov ecx, dword [eax]
push edi
xor edi, edi
mov dword [edx], ecx
lea esp, [esp]
mov ecx, dword [eax]
mov edx, dword [esi + 4]
mov edx, dword [edx + ecx*4]
movsx edx, word [edx + 8]
cmp edx, 0x47
jge 0x40c2c6
inc ecx
mov dword [eax], ecx
jmp 0x40c2b0
sub edx, 0x47
je 0x40c2f3
sub edx, 1
jne 0x40c2e3
test edi, edi
jne 0x40c2ed
mov edx, dword [esp + 0xc]
mov dword [edx], ecx
inc ecx
mov dword [eax], ecx
xor eax, eax
pop edi
ret 8
sub edx, 0x37
jne 0x40c2c1
jmp 0x42b171
dec edi
inc ecx
mov dword [eax], ecx
jmp 0x40c2b0
inc edi
inc ecx
mov dword [eax], ecx
jmp 0x40c2b0

Function at 0x40c3e0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
test ecx, ecx
jne 0x40c42c
cmp dword [0x4a7cdc], ecx
jne 0x42a475
push 0x4a7ccc
push esi
call fcn.004042f0
test al, al
je 0x40c46a
mov eax, dword [0x4a7ccc]
test eax, eax
je 0x40c46a
mov ecx, dword [eax + 0x10]
mov edx, dword [esp + 8]
and ecx, 0xff00
mov dword [edx], ecx
mov eax, dword [eax + 0x14]
mov ecx, dword [esp + 4]
mov dword [ecx], eax
test eax, eax
je 0x40c46e
mov eax, 1
ret 8
sub ecx, 1
jne 0x42a422
cmp dword [0x4a7cdc], ecx
jne 0x42a45a
push 0x4a7ccc
push esi
call fcn.004042f0
test al, al
je 0x40c46a
mov eax, dword [0x4a7ccc]
test eax, eax
je 0x40c46a
mov edx, dword [eax + 0x10]
mov ecx, dword [esp + 8]
and edx, 0xff00
mov dword [ecx], edx
jmp 0x40c417
xor eax, eax
jmp 0x40c41a
xor eax, eax
ret 8
sub al, 0xfb
invalid
add al, 0x5e
call 0x6742a46d
mov ecx, dword [eax]
Function at 0x40c620
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x118
push ebx
push ebp
mov ebp, dword [esp + 0x128]
push esi
push edi
mov esi, eax
mov eax, dword [esi]
mov edi, ecx
mov ecx, dword [edi + 4]
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], ebx
mov edx, dword [ecx + eax*4 - 4]
lea eax, [ecx + eax*4]
movsx ecx, word [edx + 0xa]
mov edx, dword [eax]
cmp word [edx + 8], 0x4e
mov dword [esp + 0x24], ecx
jne 0x40c6d7
inc dword [esi]
mov eax, dword [esi]
mov ecx, dword [edi + 4]
mov edx, dword [ecx + eax*4]
movsx eax, word [edx + 0xa]
push 0xffffffffffffffff
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x134]
push esi
push edi
mov dword [esp + 0x30], eax
call fcn.0040ab50
test eax, eax
jne 0x42c290
lea ecx, [esp + 0x10]
call fcn.0040c760
test eax, eax
jl 0x42c267
mov eax, dword [esi]
mov edx, dword [edi + 4]
mov ecx, dword [edx + eax*4]
cmp word [ecx + 8], 0x4f
jne 0x42c278
inc eax
lea ecx, [esp + 0x10]
mov dword [esi], eax
call fcn.0040c760
mov edx, dword [esi]
mov dword [esp + ebx*4 + 0x28], eax
mov eax, dword [edi + 4]
mov ecx, dword [eax + edx*4]
inc ebx
cmp word [ecx + 8], 0x4e
je 0x40c664
mov esi, dword [ebp]
cmp dword [esi + 8], 5
jne 0x42c24a
mov eax, dword [esi]
xor edi, edi
cmp ebx, edi
mov dword [eax + 0x210], edi
jle 0x40c703
mov esi, dword [esp + edi*4 + 0x28]
mov edx, dword [ebp]
call fcn.0040d0f0
inc edi
cmp edi, ebx
jl 0x40c6f2
mov ecx, dword [esp + 0x134]
mov edx, dword [ebp]
push 0
push ecx
push edx
call fcn.0040d030
add esp, 0xc
mov dword [ebp], eax
test eax, eax
je 0x42c256
lea esi, [esp + 0x10]
call fcn.004092c0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x118
ret 0xc
add byte [eax], al
add byte [ebx - 0x1876b], cl
dec dword [edi]
mov esi, 0xf7d01584
invalid
adc eax, 0xfffff7d0
add byte [eax], al
xchg ebp, eax
add byte [eax], al
jo 0x42c2b0
add dword [eax], eax

Function at 0x40c770
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [esi + 8]
sub esp, 0xc
push ebx
push edi
mov edi, eax
mov eax, dword [edi + 8]
lea eax, [eax + eax*2]
lea edx, [ecx + eax*4]
mov eax, dword [edx*4 + 0x4923c8]
cmp eax, 1
jne 0x40c7ae
mov ecx, edi
call fcn.0040c760
mov ecx, esi
mov edi, eax
call fcn.0040c760
xor ecx, ecx
cmp edi, eax
setl cl
mov al, cl
pop edi
pop ebx
add esp, 0xc
ret
cmp eax, 3
jne 0x42a889
mov ecx, edi
call fcn.0040be90
fstp qword [esp + 0xc]
mov ecx, esi
call fcn.0040be90
fcomp qword [esp + 0xc]
fnstsw ax
test ah, 0x41
je 0x42a8d8
pop edi
xor eax, eax
pop ebx
add esp, 0xc
ret
add dword [eax], eax
Function at 0x40c8a0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp byte [edi + 9], 0
push esi
jne 0x42a2d0
cmp byte [edi + 8], 0
jne 0x42a2ec
push ebx
push ebp
mov ebp, dword [edi + 4]
mov ebx, dword [ebp + 0x30]
test ebp, ebp
je 0x40c8da
lea esi, [ebp + 0x20]
call fcn.004092c0
lea esi, [ebp + 0x10]
call fcn.004092c0
push ebp
call fcn.004112ef
add esp, 4
dec dword [edi]
pop ebp
mov dword [edi + 4], ebx
pop ebx
mov byte [edi + 9], 0
pop esi
ret
imul byte [ecx]
or eax, dword [eax]
add byte [esi + 0x51], bl
inc dword [eax]
add byte [edi + 0x50], bl

Function at 0x40cc14
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x28
push ebx
push esi
mov esi, ecx
push edi
mov edi, eax
mov eax, dword [esi + 8]
mov edx, dword [edi + 8]
lea ecx, [eax + eax*2]
lea ecx, [edx + ecx*4]
mov ecx, dword [ecx*4 + 0x4923c8]
dec ecx
cmp ecx, 0xa
ja case.0x40cc37.5
jmp dword [ecx*4 + 0x40cca4]
mov ecx, esi
call fcn.0040c760
mov ecx, edi
mov esi, eax
call fcn.0040c760
cmp esi, eax
jne 0x42c30c
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x28
ret
cmp edx, 4
jne 0x42c2e2
cmp dword [esi + 8], 4
mov edi, dword [edi + 0xc]
jne 0x42c2f7
mov esi, dword [esi + 0xc]
mov ecx, dword [edi + 4]
mov edi, dword [edi]
mov edx, dword [esi]
push edi
push edx
mov edx, dword [esi + 4]
xor eax, eax
call fcn.0040e740
test eax, eax
jne 0x42c30c
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x28
ret
add eax, 0xffff3fe9
call dword [esi + 0x50]
add byte [eax], al
hlt

Function at 0x40cfe0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp byte [ebx + 9], 0
push edi
mov edi, eax
jne 0x42c2a3
push esi
push 0x38
call fcn.0041171a
add esp, 4
test eax, eax
je 0x40d011
mov esi, eax
call fcn.0040cd40
mov ecx, dword [ebx + 4]
mov dword [esi + 0x30], ecx
inc dword [ebx]
mov dword [ebx + 4], esi
pop esi
pop edi
ret
mov ecx, dword [ebx + 4]
xor esi, esi
mov dword [esi + 0x30], ecx
inc dword [ebx]
mov dword [ebx + 4], esi
pop esi
pop edi
ret
adc dword [ebx - 0x1877b], ecx
dec dword [edi]
mov esi, 0xf7d0058c
invalid
Function at 0x40d030
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
mov ebx, 5
cmp dword [ebp + 8], ebx
jne 0x42c13d
cmp byte [esp + 0x10], 0
push esi
push edi
mov edi, dword [esp + 0x1c]
je 0x40d07b
test edi, edi
jne 0x40d084
mov eax, ebp
call fcn.0040d120
test eax, eax
jl 0x42c14e
mov ecx, dword [ebp]
mov edx, dword [ecx]
mov esi, eax
cmp dword [edx + esi*4], 0
je 0x40d0b6
mov ecx, dword [ecx]
mov eax, dword [ecx + esi*4]
pop edi
pop esi
pop ebp
pop ebx
ret
mov esi, ebp
call fcn.0040e7c0
jmp 0x40d051
cmp dword [ebp + 8], ebx
jne 0x42c142
mov eax, dword [ebp]
mov dword [eax + 0x210], 0
test edi, edi
jle 0x40d055
lea ebx, [esp + 0x1c]
mov esi, dword [ebx + 4]
add ebx, 4
mov edx, ebp
call fcn.0040d0f0
sub edi, 1
je 0x40d055
jmp 0x40d0a2
push 0x10
call fcn.0041171a
add esp, 4
test eax, eax
je 0x40d0e5
mov edi, 0x4848e8
mov ebx, eax
call fcn.0040d420
mov ecx, dword [ebp]
mov edx, dword [ecx]
mov dword [edx + esi*4], eax
mov eax, dword [ebp]
mov ecx, dword [eax]
mov eax, dword [ecx + esi*4]
pop edi
pop esi
pop ebp
pop ebx
ret
xor eax, eax
jmp 0x40d0d0
test dword [eax], edi
cld
invalid
lea edx, [eax - 0x76000016]
invalid

Function at 0x40d330
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, eax
mov eax, dword [esi + 0xc]
cmp dword [eax], 1
jg 0x42a1e1
push edi
mov eax, esi
call fcn.0040d2d0
pop esi
ret
cmp byte [edx + 0x37], cl

Function at 0x40d500
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push 0x10
mov dword [esi + 4], 0
mov dword [esi + 8], 0x10
call fcn.0041171a
mov dword [esi], eax
push 4
mov byte [eax], 0
call fcn.0041171a
add esp, 8
test eax, eax
je 0x429ce9
mov dword [eax], 1
mov dword [esi + 0xc], eax
mov eax, esi
ret
inc eax
push ecx
push ebx
add esp, 4
sub ecx, 0xf5ee
sub ecx, 0x106d7
sub ecx, 0x1baf
sub ecx, 0x501d
pop ecx
push ebx
and ebx, 0x14380
or ebx, 0x3ea2
sub ebx, 0x736a
pop ebx
mov eax, dword [ebp - 0x4cc]
mov dword [ebp - 0x3cc], eax
jmp 0x429d6b
push edi
push edi
add esp, 4
xor edi, 0xa294
jmp 0x429d7f
jmp 0x429d88
jmp 0x429d8e
pop edi
push edx
or edx, 0x168eb
xor edx, 0x1656a
pop edx
push ebx
xor ebx, 0x10bb2
and ebx, 0xcec3
or ebx, 0x180f6
pop ebx
push esi
push ebx
add esp, 4
or esi, 0xe394
pop esi
push edx
push edi
add esp, 4
sub edx, 0x18296
xor edx, 0xa0ec
pop edx
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xb80]
mov dword [ebp - 0x14c8], eax
push edi
and edi, 0x11dd0
call 0x429dfb
add byte [ecx + 0x4b], al
dec ebp
dec ecx
xor eax, 0x3437384f
inc esi
add esp, 4
jmp fcn.00429e07

Function at 0x40d590
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebp
push esi
push edi
mov edi, eax
cmp byte [edi + 0xd], 0
jne 0x42a737
mov esi, dword [edi + 8]
mov ebp, dword [ecx]
call fcn.004092c0
mov dword [esi + 8], 1
mov dword [esi], ebp
cmp byte [edi + 0xd], 0
jne 0x42a742
mov edi, dword [edi + 8]
mov byte [edi + 0x10], 0
pop edi
pop esi
pop ebp
ret
add byte [eax], al
cmp esi, dword [esi]
cmp bh, byte [edx]
loopne 0x42a73b
invalid
Function at 0x40d5d0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x20
push ebx
push esi
push edi
lea ecx, [esp + 0x18]
call fcn.0040c060
mov ecx, 1
mov esi, dword [0x4a8e90]
mov edi, dword [0x4a8ec4]
cmp ecx, esi
jg 0x40d6a6
mov eax, ecx
inc ecx
test eax, eax
jle 0x40d6a6
shl eax, 4
add eax, edi
je 0x40d6a6
mov ebx, eax
lea eax, [ecx - 1]
mov dword [0x4a8014], eax
mov edx, dword [ebx + 4]
mov eax, dword [edx]
cmp word [eax + 8], 0
mov dword [esp + 0x10], ecx
jne 0x40d5f0
cmp dword [eax], 0x20
jne 0x40d5f0
mov edx, dword [edx + 4]
cmp word [edx + 8], 0x34
jne 0x42b2c4
mov ecx, dword [edx]
push ecx
lea esi, [esp + 0x1c]
call fcn.0040df50
mov edi, dword [esp + 0x18]
sub esp, 0x10
mov esi, esp
call fcn.00401b70
mov eax, 0x4a8054
call fcn.0040f1a0
test eax, eax
jne 0x42b2ca
mov edx, dword [ebx + 4]
mov eax, dword [edx + 8]
cmp word [eax + 8], 0x47
jne 0x42b2c4
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
push ebx
mov dword [esp + 0x24], 3
call fcn.0040da10
test eax, eax
jne 0x42b2db
mov ecx, dword [esp + 0x10]
jmp 0x40d5e4
mov esi, 0x4a8054
call fcn.00410470
lea ecx, [esp + 0x18]
call fcn.00402620
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x20
ret
std
invalid
add byte [edi - 0x7f], dl
invalid
out 0, eax
add byte [eax + 0x53], bl

Function at 0x40d6d0
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x438
push ebx
push esi
push edi
mov edi, eax
lea eax, [esp + 0x20]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push edi
call fcn.00401f80
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x431a9d
mov eax, dword [0x4a7cfc]
test eax, eax
je 0x431ab6
mov byte [esp + 0xf], 0
mov esi, 0x4a8e80
cmp eax, 1
je 0x431aca
push 0x4a7cfc
lea ecx, [esp + 0x13]
mov eax, 0x4a7d14
call fcn.0040f3b0
test al, al
je 0x431aeb
mov dl, byte [0x4a8e80]
mov bl, byte [0x4a8e81]
push 0x4a7cf8
lea eax, [esp + 0x234]
push eax
push 0x104
push 0x4a7d14
mov byte [0x4a7d00], dl
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov ecx, dword [0x4a7cfc]
push ecx
push 0x4a7d14
call fcn.00401440
test eax, eax
jne 0x431aff
cmp bl, 1
je 0x431b23
call fcn.004101f0
call fcn.004103e0
cmp byte [0x4a7d00], 0
jne 0x40d7a8
mov esi, 0x4a84b8
call fcn.0040e1e0
push 1
mov ecx, 0x4a7f20
call fcn.00409560
cmp byte [0x4a7d00], 0
jne 0x40d7c7
mov ecx, 0x4a84b8
call fcn.00401000
mov ebx, 0x4a8e80
call fcn.0040ebc0
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
pop edi
pop esi
pop ebx
add esp, 0x438
ret
add dword [ecx], eax
mov word [esi + 0xf965], ss
popal
stc
add byte [eax], al
mov word [esi + 0xe725], ss
mov word [esi + 0xfdcd], es
mov word [esi + 0xff89], cs
add byte [esi + edx*4], al
xchg byte [ecx], al
add dword [ecx], eax
Function at 0x40da10
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x4c
push ebx
push ebp
mov ebp, dword [esp + 0x5c]
push esi
push edi
lea ecx, [esp + 0x38]
call fcn.0040c060
mov eax, dword [esp + 0x6c]
mov ebx, dword [eax]
xor edi, edi
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], 0x4848ec
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x10], 0xffffffff
dec ebx
call fcn.0040c060
mov ecx, dword [esp + 0x60]
mov esi, dword [ecx + 4]
mov edx, dword [ebp]
mov eax, dword [esi + edx*4]
cmp word [eax + 8], 0x48
je 0x40db52
mov dword [esp + 0x14], edi
mov edi, edi
mov ecx, dword [ebp]
mov edx, dword [esi + ecx*4]
cmp word [edx + 8], 0
mov byte [esp + 0x64], 0
je 0x42b1ac
mov ecx, dword [ebp]
mov esi, dword [esi + ecx*4]
cmp word [esi + 8], 0x33
jne 0x42b27f
mov eax, dword [esi]
lea edx, [esp + 0x28]
cmp edx, eax
je 0x40daa8
mov ecx, edx
call fcn.00404080
mov eax, dword [esp + 0x20]
xor edi, edi
test eax, eax
jbe 0x40dad1
mov ecx, dword [esp + 0x1c]
mov esi, dword [ecx + edi*4]
lea eax, [esp + 0x28]
call fcn.0040dd00
test al, al
jne 0x40dacd
inc edi
cmp edi, dword [esp + 0x20]
jb 0x40dab2
mov eax, dword [esp + 0x20]
cmp edi, eax
jne 0x42b266
lea edi, [esp + 0x28]
lea esi, [esp + 0x18]
call fcn.0040d970
inc dword [ebp]
mov edi, dword [esp + 0x60]
mov eax, dword [ebp]
mov esi, dword [edi + 4]
mov edx, dword [esi + eax*4]
cmp word [edx + 8], 0x41
je 0x42b1ee
cmp dword [esp + 0x10], 0xffffffff
jne 0x42b24a
mov edx, dword [esi + eax*4]
movzx ecx, word [edx + 8]
inc dword [esp + 0x14]
cmp cx, 0x40
jne 0x40dbe6
mov edx, 0x48
cmp cx, 0x40
jne 0x40db3e
mov ecx, dword [esi + eax*4 + 4]
inc eax
mov dword [ebp], eax
cmp word [ecx + 8], dx
je 0x42b25c
mov eax, dword [ebp]
mov ecx, dword [esi + eax*4]
cmp word [ecx + 8], dx
jne 0x40da70
mov edi, dword [esp + 0x14]
inc dword [ebp]
mov edx, dword [esp + 0x60]
mov ebp, dword [ebp]
mov eax, dword [edx + 4]
mov ecx, dword [eax + ebp*4]
cmp word [ecx + 8], 0x7f
jne 0x42b244
mov edx, dword [esp + 0x6c]
call fcn.0040f320
test eax, eax
jne 0x42b29f
mov edx, dword [esp + 0x68]
mov ebp, dword [esp + 0x6c]
push edx
lea esi, [esp + 0x3c]
call fcn.0040df50
mov eax, dword [ebp]
dec eax
cmp dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x48], ebx
mov dword [esp + 0x54], eax
mov dword [esp + 0x4c], edi
jne 0x40dbab
mov dword [esp + 0x10], edi
mov ecx, dword [esp + 0x10]
lea edi, [esp + 0x38]
mov ebx, 0x4a8054
mov dword [esp + 0x50], ecx
call fcn.0040eaf0
lea ecx, [esp + 0x28]
call fcn.00402620
lea ecx, [esp + 0x18]
call fcn.00410a20
mov ecx, edi
call fcn.00402620
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret 0x10
cmp cx, 0x48
je 0x40db21
jmp 0x42b250
mov bh, 0x8d
add dh, bh
invalid
invalid
insd dword es:[edi], dx
dec ebp
add byte [eax], al
mov byte [0x5f0000ca], al
lea esp, [eax]
std
invalid
les eax, [ebx + ebp*8]
add eax, 0x3e454544
cmp ebx, dword [ecx + 0x50]
or eax, 0x81000022
int1
sahf
and dword [eax], eax
add byte [ecx + 0x56], bl
and al, 0xfb
invalid