joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5087b4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov ecx, dword [edi + 0x170]
mov edx, ebx
mov eax, edi
call fcn.005089e8
mov esi, eax
mov dword [edi + 0x170], esi
and esi, 0xff
add dword [edi + 0x174], esi
imul esi, dword [edi + 0x174], 0x8088405
inc esi
mov dword [edi + 0x174], esi
mov edx, esi
shr edx, 0x18
mov ecx, dword [edi + 0x178]
mov eax, edi
call fcn.005089e8
mov dword [edi + 0x178], eax
pop edi
pop esi
pop ebx
ret

Function at 0x508828
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x50884d
inc esi
mov eax, edi
call fcn.0050880c
xor byte [ebx], al
mov dl, byte [ebx]
mov eax, edi
call fcn.005087b4
inc ebx
dec esi
jne 0x508837
pop edi
pop esi
pop ebx
ret

Function at 0x5088dc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00404d40
xor eax, eax
push ebp
push 0x508951
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.00508854
mov dword [ebp - 8], 0xc
lea esi, [ebp - 0x14]
mov eax, edi
call fcn.0050880c
mov ebx, eax
xor bl, byte [esi]
mov edx, ebx
mov eax, edi
call fcn.005087b4
mov byte [esi], bl
inc esi
dec dword [ebp - 8]
jne 0x50891c
mov bl, byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x508958
lea eax, [ebp - 4]
call fcn.00404890
ret
Function at 0x509514
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5096f8
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
jle 0x5096b4
mov eax, dword [ebp - 4]
call fcn.0050ae90
cmp ebx, eax
jge 0x5096b4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x118]
mov edx, ebx
call fcn.004ffe1c
mov edx, dword [0x5011a4]
call fcn.00403c2c
mov esi, eax
mov eax, esi
call fcn.00502058
test al, al
je 0x5096aa
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov edi, dword [esi + 0x44]
test edi, edi
jne 0x50969e
xor eax, eax
push ebp
push 0x509697
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00509acc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
call fcn.0041fd7c
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push dword [esi + 0x34]
push dword [esi + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
lea edx, [ebp - 0x46]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, 0x2e
mov esi, dword [eax]
call dword [esi + 0xc]
movzx eax, word [ebp - 0x2a]
movzx edx, word [ebp - 0x28]
add eax, edx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x18]
movzx esi, word [ebp - 0x26]
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.00404edc
mov eax, dword [ebp - 8]
call fcn.00404da8
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, esi
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
mov al, byte [eax + 0x28]
mov byte [ebp - 9], al
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00509890
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
mov dl, byte [ebp - 9]
mov byte [eax + 0x28], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5096e2
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
jne 0x509696
mov eax, dword [ebp - 4]
call fcn.00509b50
ret
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.0040a27c
jmp 0x5096e2
mov eax, dword [ebp - 8]
call fcn.00404890
jmp 0x5096e2
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x4c], 0
lea eax, [ebp - 0x50]
push eax
push 0
lea edx, [ebp - 0x54]
mov eax, 0xb3
call fcn.004097f8
mov ecx, dword [ebp - 0x54]
mov dl, 1
mov eax, dword [0x41a6b8]
call fcn.0040d268
call fcn.00404248
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5096ff
lea eax, [ebp - 0x54]
call fcn.00404890
ret
Function at 0x50edd0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 8
push 0
push 0
dec ecx
jne 0x50edd9
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00404d40
mov eax, dword [ebp - 0xc]
call fcn.00404d40
xor eax, eax
push ebp
push 0x50f01f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x300]
mov byte [eax + 0x38], 0
mov dl, 1
mov eax, dword [0x41b288]
call fcn.00403a4c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x50efa0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x304]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.004dc124
lea eax, [ebp - 0x14]
push eax
xor ecx, ecx
mov edx, 0x50f038
mov eax, dword [ebp - 0xc]
call fcn.0043a3b8
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
call fcn.00404c9c
je 0x50ef4b
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.00409dbc
mov eax, dword [ebp - 0x18]
call fcn.004099ac
test al, al
jne 0x50ef4b
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0xc]
call fcn.00409dbc
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x1c]
mov edx, 1
call fcn.0043a454
mov eax, dword [ebp - 0x1c]
mov edx, 0x50f038
call fcn.00404c9c
jne 0x50ef11
lea edx, [ebp - 0x28]
mov eax, dword [0x525a98]
mov eax, dword [eax]
call fcn.0047bf14
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.00409dbc
lea eax, [ebp - 0x24]
push eax
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 0xc]
call fcn.00409dbc
mov eax, dword [ebp - 0x30]
call fcn.00404b50
dec eax
push eax
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 0xc]
call fcn.00409dbc
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x2c]
pop edx
call fcn.0043a3e4
mov edx, dword [ebp - 0x2c]
pop eax
call fcn.00404b58
mov eax, dword [ebp - 0x24]
call fcn.004099d0
jmp 0x50ef4b
lea edx, [ebp - 0x3c]
mov eax, dword [0x525a98]
mov eax, dword [eax]
call fcn.0047bf14
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x38]
call fcn.00409dbc
lea eax, [ebp - 0x38]
push eax
lea edx, [ebp - 0x40]
mov eax, dword [ebp - 0xc]
call fcn.00409dbc
mov edx, dword [ebp - 0x40]
pop eax
call fcn.00404b58
mov eax, dword [ebp - 0x38]
call fcn.004099d0
push 0x80
mov eax, dword [ebp - 0xc]
call fcn.00404d50
push eax
call sub.kernel32.dll_SetFileAttributesA
mov edx, 0x20
mov eax, dword [ebp - 0xc]
call fcn.00409b74
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.004204dc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x31c]
mov dl, 1
call fcn.0045bc0c
mov eax, dword [ebp - 0x10]
call fcn.00403a7c
mov eax, dword [ebp - 4]
call fcn.0050ec08
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x50eff7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50f026
lea eax, [ebp - 0x44]
mov edx, 0xd
call fcn.004048b4
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004048b4
ret
Function at 0x50ff28
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd44
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x29c], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404d40
xor eax, eax
push ebp
push 0x51007a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x198]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
xor ecx, ecx
push ebp
push 0x510052
push dword fs:[ecx]
mov dword fs:[ecx], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x298]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x298]
mov edx, dword [ebp - 4]
call fcn.0040a128
lea eax, [ebp - 0x298]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x51003b
mov edx, dword [eax + 0xc]
test edx, edx
je 0x510035
mov ebx, dword [edx]
test ebx, ebx
je 0x51002f
lea eax, [ebp - 0x29c]
push eax
xor eax, eax
mov al, byte [ebx]
mov dword [ebp - 0x2bc], eax
mov byte [ebp - 0x2b8], 0
xor eax, eax
mov al, byte [ebx + 1]
mov dword [ebp - 0x2b4], eax
mov byte [ebp - 0x2b0], 0
xor eax, eax
mov al, byte [ebx + 2]
mov dword [ebp - 0x2ac], eax
mov byte [ebp - 0x2a8], 0
xor eax, eax
mov al, byte [ebx + 3]
mov dword [ebp - 0x2a4], eax
mov byte [ebp - 0x2a0], 0
lea edx, [ebp - 0x2bc]
mov ecx, 3
mov eax, 0x510094
call fcn.0040a76c
mov edx, dword [ebp - 0x29c]
mov eax, esi
call fcn.004048e4
mov byte [ebp - 5], 1
jmp 0x51003f
mov byte [ebp - 5], 0
jmp 0x51003f
mov byte [ebp - 5], 0
jmp 0x51003f
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x510059
call sub.wsock32.dll_WSACleanup
ret

Function at 0x51035c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404d40
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x51047f
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor edx, edx
mov eax, 2
call fcn.004a1ec8
mov esi, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, esi
call fcn.004a1ee8
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x510451
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00404b00
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.00409ed8
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00408d7c
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00408d7c
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.00404c9c
jne 0x510442
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov ebx, eax
push 0
push ebx
call sub.kernel32.dll_TerminateProcess
push ebx
call sub.kernel32.dll_CloseHandle_1
mov bl, 1
mov edx, edi
mov eax, esi
call fcn.004a1f08
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x5103cb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x510486
lea eax, [ebp - 0x13c]
mov edx, 4
call fcn.004048b4
lea eax, [ebp - 4]
call fcn.00404890
ret
Function at 0x510490
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x104], edx
mov dword [ebp - 0x108], edx
mov esi, eax
xor eax, eax
push ebp
push 0x5105dd
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, esi
call fcn.00462700
push eax
call sub.user32.dll_GetWindow
mov ebx, eax
test ebx, ebx
je 0x5105bf
push 0xff
lea eax, [ebp - 0xff]
push eax
push ebx
call sub.user32.dll_GetWindowTextA
test eax, eax
jle 0x5105ad
lea eax, [ebp - 0x104]
mov ecx, 0x5105f4
mov edx, dword [0x52546c]
call fcn.00404b9c
mov eax, dword [ebp - 0x104]
push eax
lea edx, [ebp - 0x108]
lea eax, [ebp - 0xff]
call fcn.0040a27c
mov edx, dword [ebp - 0x108]
pop eax
call fcn.00404c9c
jne 0x5105ad
mov byte [0x5274d9], 0
xor edx, edx
mov eax, dword [esi + 0x368]
call fcn.0045bc0c
mov eax, dword [0x527400]
call fcn.0047836c
xor edx, edx
mov eax, dword [esi + 0x33c]
call fcn.004391a8
mov edx, dword [esi + 0x40]
add edx, 0x64
mov eax, dword [0x52592c]
mov eax, dword [eax]
call fcn.0045b45c
mov edx, dword [esi + 0x44]
add edx, 0x32
mov eax, dword [0x52592c]
mov eax, dword [eax]
call fcn.0045b480
mov eax, dword [0x52546c]
call fcn.00404d50
mov edx, eax
lea eax, [ebp - 0x10c]
call fcn.00404a88
mov eax, dword [ebp - 0x10c]
call fcn.0051035c
mov eax, dword [0x52592c]
mov eax, dword [eax]
mov dl, 1
call fcn.0050edc0
push 2
push ebx
call sub.user32.dll_GetWindow
mov ebx, eax
test ebx, ebx
jne 0x5104d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5105e4
lea eax, [ebp - 0x10c]
mov edx, 3
call fcn.004048b4
ret
Function at 0x1000194d
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp al, byte [ecx]
add al, ch
or dword [eax], eax
add byte [eax], al
add byte [eax + edx*2 + 0x34], al
xor eax, 0x83373e47
les eax, [ebx + ebx*2]

Function at 0x1000195e
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp al, byte [ecx]
add al, ch
or dword [eax], eax
add byte [eax], al
add byte [eax + edx*2 + 0x34], al
xor eax, 0x83373e47
les eax, [ebx + ebx*2]

Function at 0x10001962
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov byte [ebp - 0x83c], 0x45
mov byte [ebp - 0x83b], 0x78
mov byte [ebp - 0x83a], 0x69
mov byte [ebp - 0x839], 0x74
mov byte [ebp - 0x838], 0x50
mov byte [ebp - 0x837], 0x72
mov byte [ebp - 0x836], 0x6f
mov byte [ebp - 0x835], 0x63
mov byte [ebp - 0x834], 0x65
mov byte [ebp - 0x833], 0x73
mov byte [ebp - 0x832], 0x73
mov byte [ebp - 0x831], 0
inc dword [eax]
push ebx
or ebx, 0xe4a4
pop ebx
push esi
push ebx
add esp, 4
sub esi, 0x90e4
jmp 0x100019cf
pop esi
push edx
push edi
add esp, 4
sub edx, 0x18649
or edx, 0x6057
Function at 0x100019e7
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
pop edx
mov eax, 0x6b
mov word [ebp - 0x15d0], ax
mov ecx, 0x65
mov word [ebp - 0x15ce], cx
mov edx, 0x72
mov word [ebp - 0x15cc], dx
mov eax, 0x6e
mov word [ebp - 0x15ca], ax
mov ecx, 0x65
mov word [ebp - 0x15c8], cx
mov edx, 0x6c
mov word [ebp - 0x15c6], dx
mov eax, 0x33
mov word [ebp - 0x15c4], ax
mov ecx, 0x32
mov word [ebp - 0x15c2], cx
mov edx, 0x2e
mov word [ebp - 0x15c0], dx
mov eax, 0x64
mov word [ebp - 0x15be], ax
mov ecx, 0x6c
mov word [ebp - 0x15bc], cx
mov edx, 0x6c
mov word [ebp - 0x15ba], dx
xor eax, eax
mov word [ebp - 0x15b8], ax
push eax
push edi
add esp, 4
or eax, 0x13e3d
pop eax
push ebx
sub ebx, 0xfd6f
pop ebx
push edi
push ecx
add esp, 4
les eax, [ecx + eax*4]
iretd
aaa
add dword [ecx], eax
add byte [ecx + 0x130cbe7], al
add byte [ecx + 0x4d3ccf], al
add byte [ecx + 0x157dbe7], al
add byte [edi + 0x53], bl
xor ebx, 0x42c
add ebx, 0x72c5
pop ebx
push esi
or esi, 0x6ff2
or esi, 0xc72d
call 0x10001adb
add byte [eax + 0x39], al
cmp eax, 0x83504943
les eax, [ecx + eax*4]
out dx, al
imul edi, dword [eax + 1], 0
pop esi
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x1a30], ecx
mov edx, dword [ebp - 0x1a30]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x1be0], eax
mov ecx, dword [ebp - 0x1be0]
mov dword [ebp - 0x1504], ecx
push esi
push esi
add esp, 4
call 0x10001b1e
add byte [edi + ecx*2 + 0x49], cl
dec esp
aas
inc ebx
add esp, 4
pop esi
push edx
push ebx
add esp, 4
sub edx, 0x968
sub edx, 0x16efe
pop edx
push edi
push edx
add esp, 4
jmp 0x10001b3e
pop edi
cmp dword [ebp - 0x1504], 0
jne 0x10001b57
mov dword [ebp - 0x29c], 0
jmp 0x10001e13
mov edx, dword [ebp - 0x1504]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc1c], ecx
push edi
add edi, 0x9c7e
xor edi, 0x180dd
call 0x10001b85
add byte [esp + ecx*2 + 0x4c], al
dec esi
inc ebp
inc ecx
inc eax
dec ecx
dec ecx
add esp, 4
xor edi, 0xb557
pop edi
push edx
push edi
add esp, 4
add edx, 0xaa24
pop edx
cmp dword [ebp - 0xc1c], 0
jne 0x10001bb3
mov dword [ebp - 0x29c], 0
jmp 0x10001e13
mov edx, dword [ebp - 0xc1c]
mov dword [ebp - 0x4bc], edx
push ecx
push edx
add esp, 4
jmp 0x10001bcb
call 0x10001bd9
add byte [esi + 0x43], cl
cmp dword [edi], edi
xor al, byte [edi + 0x35]
dec ebx
add esp, 4
or ecx, 0x3194
pop ecx
push edi
and edi, 0x15ae5
and edi, 0x1207e
pop edi
lea eax, [ebp - 0x15d0]
mov dword [ebp - 0xc18], eax
mov ecx, dword [ebp - 0x4bc]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc14], edx
invalid
push dword [ebx]
shl byte [esi - 0x77], 0x85
push esp
invalid
invalid
push dword [ebx]
leave
mov word [ebp - 0x100], cx
push esi
push edx
add esp, 4
and esi, 0xf3dd
and esi, 0x9a14
or esi, 0x6fa3
pop esi
push edi
call 0x10001c44
add byte [ebp + 0x41], cl
cmp edx, dword [eax + 0x50]
push eax
cmp al, 0x83
les eax, [edi + ebx*2]
push edi
sub edi, 0xe7b6
pop edi
mov edx, dword [ebp - 0xc14]
invalid
invalid
Function at 0x10001adb
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
pop edx
mov eax, 0x6b
mov word [ebp - 0x15d0], ax
mov ecx, 0x65
mov word [ebp - 0x15ce], cx
mov edx, 0x72
mov word [ebp - 0x15cc], dx
mov eax, 0x6e
mov word [ebp - 0x15ca], ax
mov ecx, 0x65
mov word [ebp - 0x15c8], cx
mov edx, 0x6c
mov word [ebp - 0x15c6], dx
mov eax, 0x33
mov word [ebp - 0x15c4], ax
mov ecx, 0x32
mov word [ebp - 0x15c2], cx
mov edx, 0x2e
mov word [ebp - 0x15c0], dx
mov eax, 0x64
mov word [ebp - 0x15be], ax
mov ecx, 0x6c
mov word [ebp - 0x15bc], cx
mov edx, 0x6c
mov word [ebp - 0x15ba], dx
xor eax, eax
mov word [ebp - 0x15b8], ax
push eax
push edi
add esp, 4
or eax, 0x13e3d
pop eax
push ebx
sub ebx, 0xfd6f
pop ebx
push edi
push ecx
add esp, 4
les eax, [ecx + eax*4]
iretd
aaa
add dword [ecx], eax
add byte [ecx + 0x130cbe7], al
add byte [ecx + 0x4d3ccf], al
add byte [ecx + 0x157dbe7], al
add byte [edi + 0x53], bl
xor ebx, 0x42c
add ebx, 0x72c5
pop ebx
push esi
or esi, 0x6ff2
or esi, 0xc72d
call 0x10001adb
add byte [eax + 0x39], al
cmp eax, 0x83504943
les eax, [ecx + eax*4]
out dx, al
imul edi, dword [eax + 1], 0
pop esi
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x1a30], ecx
mov edx, dword [ebp - 0x1a30]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x1be0], eax
mov ecx, dword [ebp - 0x1be0]
mov dword [ebp - 0x1504], ecx
push esi
push esi
add esp, 4
call 0x10001b1e
add byte [edi + ecx*2 + 0x49], cl
dec esp
aas
inc ebx
add esp, 4
pop esi
push edx
push ebx
add esp, 4
sub edx, 0x968
sub edx, 0x16efe
pop edx
push edi
push edx
add esp, 4
jmp 0x10001b3e
pop edi
cmp dword [ebp - 0x1504], 0
jne 0x10001b57
mov dword [ebp - 0x29c], 0
jmp 0x10001e13
mov edx, dword [ebp - 0x1504]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc1c], ecx
push edi
add edi, 0x9c7e
xor edi, 0x180dd
call 0x10001b85
add byte [esp + ecx*2 + 0x4c], al
dec esi
inc ebp
inc ecx
inc eax
dec ecx
dec ecx
add esp, 4
xor edi, 0xb557
pop edi
push edx
push edi
add esp, 4
add edx, 0xaa24
pop edx
cmp dword [ebp - 0xc1c], 0
jne 0x10001bb3
mov dword [ebp - 0x29c], 0
jmp 0x10001e13
mov edx, dword [ebp - 0xc1c]
mov dword [ebp - 0x4bc], edx
push ecx
push edx
add esp, 4
jmp 0x10001bcb
call 0x10001bd9
add byte [esi + 0x43], cl
cmp dword [edi], edi
xor al, byte [edi + 0x35]
dec ebx
add esp, 4
or ecx, 0x3194
pop ecx
push edi
and edi, 0x15ae5
and edi, 0x1207e
pop edi
lea eax, [ebp - 0x15d0]
mov dword [ebp - 0xc18], eax
mov ecx, dword [ebp - 0x4bc]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc14], edx
invalid
push dword [ebx]
shl byte [esi - 0x77], 0x85
push esp
invalid
invalid
push dword [ebx]
leave
mov word [ebp - 0x100], cx
push esi
push edx
add esp, 4
and esi, 0xf3dd
and esi, 0x9a14
or esi, 0x6fa3
pop esi
push edi
call 0x10001c44
add byte [ebp + 0x41], cl
cmp edx, dword [eax + 0x50]
push eax
cmp al, 0x83
les eax, [edi + ebx*2]
push edi
sub edi, 0xe7b6
pop edi
mov edx, dword [ebp - 0xc14]
invalid
invalid
Function at 0x10001b1e
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
pop edx
mov eax, 0x6b
mov word [ebp - 0x15d0], ax
mov ecx, 0x65
mov word [ebp - 0x15ce], cx
mov edx, 0x72
mov word [ebp - 0x15cc], dx
mov eax, 0x6e
mov word [ebp - 0x15ca], ax
mov ecx, 0x65
mov word [ebp - 0x15c8], cx
mov edx, 0x6c
mov word [ebp - 0x15c6], dx
mov eax, 0x33
mov word [ebp - 0x15c4], ax
mov ecx, 0x32
mov word [ebp - 0x15c2], cx
mov edx, 0x2e
mov word [ebp - 0x15c0], dx
mov eax, 0x64
mov word [ebp - 0x15be], ax
mov ecx, 0x6c
mov word [ebp - 0x15bc], cx
mov edx, 0x6c
mov word [ebp - 0x15ba], dx
xor eax, eax
mov word [ebp - 0x15b8], ax
push eax
push edi
add esp, 4
or eax, 0x13e3d
pop eax
push ebx
sub ebx, 0xfd6f
pop ebx
push edi
push ecx
add esp, 4
les eax, [ecx + eax*4]
iretd
aaa
add dword [ecx], eax
add byte [ecx + 0x130cbe7], al
add byte [ecx + 0x4d3ccf], al
add byte [ecx + 0x157dbe7], al
add byte [edi + 0x53], bl
xor ebx, 0x42c
add ebx, 0x72c5
pop ebx
push esi
or esi, 0x6ff2
or esi, 0xc72d
call 0x10001adb
add byte [eax + 0x39], al
cmp eax, 0x83504943
les eax, [ecx + eax*4]
out dx, al
imul edi, dword [eax + 1], 0
pop esi
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x1a30], ecx
mov edx, dword [ebp - 0x1a30]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x1be0], eax
mov ecx, dword [ebp - 0x1be0]
mov dword [ebp - 0x1504], ecx
push esi
push esi
add esp, 4
call 0x10001b1e
add byte [edi + ecx*2 + 0x49], cl
dec esp
aas
inc ebx
add esp, 4
pop esi
push edx
push ebx
add esp, 4
sub edx, 0x968
sub edx, 0x16efe
pop edx
push edi
push edx
add esp, 4
jmp 0x10001b3e
pop edi
cmp dword [ebp - 0x1504], 0
jne 0x10001b57
mov dword [ebp - 0x29c], 0
jmp 0x10001e13
mov edx, dword [ebp - 0x1504]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc1c], ecx
push edi
add edi, 0x9c7e
xor edi, 0x180dd
call 0x10001b85
add byte [esp + ecx*2 + 0x4c], al
dec esi
inc ebp
inc ecx
inc eax
dec ecx
dec ecx
add esp, 4
xor edi, 0xb557
pop edi
push edx
push edi
add esp, 4
add edx, 0xaa24
pop edx
cmp dword [ebp - 0xc1c], 0
jne 0x10001bb3
mov dword [ebp - 0x29c], 0
jmp 0x10001e13
mov edx, dword [ebp - 0xc1c]
mov dword [ebp - 0x4bc], edx
push ecx
push edx
add esp, 4
jmp 0x10001bcb
call 0x10001bd9
add byte [esi + 0x43], cl
cmp dword [edi], edi
xor al, byte [edi + 0x35]
dec ebx
add esp, 4
or ecx, 0x3194
pop ecx
push edi
and edi, 0x15ae5
and edi, 0x1207e
pop edi
lea eax, [ebp - 0x15d0]
mov dword [ebp - 0xc18], eax
mov ecx, dword [ebp - 0x4bc]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc14], edx
invalid
push dword [ebx]
shl byte [esi - 0x77], 0x85
push esp
invalid
invalid
push dword [ebx]
leave
mov word [ebp - 0x100], cx
push esi
push edx
add esp, 4
and esi, 0xf3dd
and esi, 0x9a14
or esi, 0x6fa3
pop esi
push edi
call 0x10001c44
add byte [ebp + 0x41], cl
cmp edx, dword [eax + 0x50]
push eax
cmp al, 0x83
les eax, [edi + ebx*2]
push edi
sub edi, 0xe7b6
pop edi
mov edx, dword [ebp - 0xc14]
invalid
invalid