joyce8/EMBER2024-capa huggingface dataset:
Function at 0x11292c27
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
push ebp
bswap bp
sal dh, 0x67
mov ebp, esp
adc ah, 0xef
not ax
sal dx, cl
push 0xffffffffffffffff
rdtsc
rcr edx, 0xe8
push 0x100e8c61
shl eax, 0x97
test sp, 0x52c4
sub al, bh
mov eax, dword fs:[0]
cmp ebp, ecx
shr dl, cl
push eax
rcl dx, cl
rol al, 0x2f
sub esp, 0xefc
shrd eax, edi, 0x6b
xadd dl, ah
cmova edx, ecx
mov eax, dword [0x10149de0]
cwd
or dl, 0xbf
shld edx, edi, 0x43
xor eax, ebp
stc
mov dword [ebp - 0x10], eax
test dx, si
dec dl
push ebx
push esi
shr dh, cl
push edi
movzx edx, dx
push eax
dec ax
test al, 0xb2
adc dx, 0x6b82
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
rol edx, cl
shrd dx, cx, 0x60
push 0x206
shrd dx, cx, 0xc1
bt edx, 0xd6
sub esi, esi
adc dx, bp
bsr edx, ebp
lea edx, [ebp - 0xa96]
test esi, edx
jmp 0x1149a8e1
xor ecx, ecx
jmp loc.1002e81e
Function at 0x113495ff
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
xor eax, esp
push eax
rcr al, cl
or al, al
lea eax, [esp + 0x2d8]
cmc
cmp sp, 0x3c2e
mov dword fs:[0], eax
cbw
mov eax, dword [ebp + 8]
test edx, 0x2ff82aa7
clc
xor esi, esi
cmp dword [ebp + 0xc], esi
jmp 0x112ff94a
jne 0x11499083
push 0x80004005
jmp 0x1149907e
push eax
adc al, 0x79
sar eax, cl
lea esp, [esp - 0x2c8]
sal ah, 0xac
adc ah, 0x42
btc ax, 0x98
mov eax, dword [0x10149de0]
xor eax, esp
cmp eax, esi
stc
mov dword [esp + 0x2c0], eax
sbb ax, di
push ebx
push esi
push edi
mov eax, dword [0x10149de0]
jmp 0x10172de2
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], ecx
jmp 0x11479f49
call eax
add eax, 0x10
mov dword [esp + 0x10], eax
mov dword [esp + 0x2e0], esi
mov bl, 0x37
mov al, 0xaf
mov dl, 0xe1
mov dl, 0xac
mov cl, 3
mov cl, 0x53
mov byte [esp + 0x172], bl
jmp 0x10001e60
push ebp
test esi, ebx
mov ebp, esp
and esp, 0xfffffff8
btr eax, 0xbb
push 0xffffffffffffffff
xor ax, cx
push 0x100e777b
shrd ax, bx, 0x14
bsf eax, eax
cmc
mov eax, dword fs:[0]
jmp 0x1126c1fd
setne cl
cmp ecx, esp
cmp ecx, esi
jmp 0x1017bfc0
jle 0x1146af55
call fcn.100634e0
xor ecx, ecx
cmp eax, esi
jmp 0x1139bca9
ret
call fcn.10071dc8
mov esp, ebp
movzx ebp, bp
mov bp, bp
pop ebp
jmp 0x11444741
mov ecx, dword [esp + 0x2d8]
mov dword fs:[0], ecx
xadd di, di
pop ecx
btc di, cx
btr ecx, esp
cmp ecx, esp
pop edi
movzx ecx, di
pop esi
setae bl
add ebx, edx
pop ebx
clc
test esp, 0x19fd2b06
mov ecx, dword [esp + 0x2c0]
xor ecx, esp
jmp 0x1145f9c7
mov dword [esp + 0x1c], edx
jmp 0x113d8df0
call fcn.100072c0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
jmp 0x113428f5
Function at 0x11375c8a
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x9ddf29b8
call fcn.112af7a6
Function at 0x113ef1d5
Capabilities:
Hash data with crc32

Disassembly:
push edx
jmp 0x1003bbfa
jne 0x113c9c42
sub eax, edx
mov edx, eax
cwde
mov eax, 0xffffffff
mov ecx, 0x42470270
mov cx, si
mov ecx, ebx
jmp 0x1134c4ab
inc ecx
cmp ecx, edx
jb 0x113d866d
mov esi, dword [0x1016820c]
not eax
jmp 0x1137435d
je 0x112dc921
jmp 0x113d866d
push eax
jmp 0x1137af8f
call fcn.111fcf2c
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
cmovp edx, ebp
movsx edx, dx
mov edx, dword [ebp + 0x14]
cmp esi, edx
cmc
add esp, 4
push eax
bswap eax
cmovo ax, bx
mov eax, dword [ebp - 0x278]
jmp 0x11454c6b
push ebx
call esi
lea eax, [ebp - 0x25c]
movsx dx, bh
lea edx, [eax + 1]
xchg cl, cl
mov cl, byte [eax]
jmp 0x1145b586
xor esi, ebx
cmp bh, bl
test edx, ebp
shr eax, 8
xor eax, dword [esi*4 + 0x1014ee50]
jmp 0x112dc918
movzx esi, byte [ebp + ecx - 0x25c]
bt bx, ax
xor ebx, edi
mov ebx, eax
clc
cmp esp, ecx
and ebx, 0xff
test ebp, 0x8cb28a0
jmp 0x113d61ae
push 0x9ddf29b8
call fcn.112af7a6
push ebx
jmp 0x113c9c30
push ecx
movsx ecx, cx
mov ecx, dword [ebp - 0x27c]
jmp 0x1127542e
inc eax
test edx, ecx
clc
stc
cmp cl, bl
jmp 0x112b62e3

Function at 0x113f8a70
Capabilities:
Check for software breakpoints
Contain obfuscated stackstrings
Execute anti-debugging instructions

Disassembly:
push esi
mov esi, eax
movzx esi, sp
push edi
mov esi, 0x6a0812e6
xchg esi, esi
not esi
push eax
mov ah, ch
lea eax, [ebp - 0xc]
mov si, si
bswap esi
mov dword fs:[0], eax
not al
mov eax, dword [ebp + 8]
push dword [ebp + 4]
pop dword [ebp - 0x4f8]
cmovae esi, ebp
mov esi, dword [ebp + 0xc]
jmp 0x112514dd
push esi
jmp 0x114267fb
push 0xd7c85c20
call fcn.1140360f
push ebx
jmp 0x1124e47a
push eax
jmp loc.100060bf

Function at 0x114011c7
Capabilities:
Execute anti-debugging instructions

Disassembly:
push edi
push eax
mov edi, esi
cbw
jmp 0x113911e3
call fcn.10071dc8
mov esp, ebp
jmp 0x113e078d
call fcn.113dcb08
mov esi, eax
test esi, esi
ja 0x11343a7a
sub eax, eax
jmp 0x114239d7
push esi
jmp loc.10018b35
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
jmp 0x113b726d
push 0
jmp 0x1147e2a4
mov dword [ebp - 0x10], eax
push ebx
jmp 0x1142d0b4
pop ebp
ret
push ebp
adc ebp, 0x479c4c6d
setge al
sal ebp, 0xc5
mov ebp, esp
cmp si, ax
cbw
push 0xffffffffffffffff
adc ax, si
rcl ah, cl
push 0x100e8c17
sar ah, cl
rcr al, 0x2e
cwde
mov eax, dword fs:[0]
jmp 0x114b49cc
mov ecx, dword [ebp - 0xc]
rcl bx, cl
mov dword fs:[0], ecx
pop ecx
pop edi
xchg ebx, esi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
test cl, 0x67
xor ecx, ebp
jmp 0x1123e5a1
push esi
jmp 0x111bae7d
push edi
mov dword [ebp - 0x100], 0
jmp 0x112c8194
push eax
test si, ax
mov eax, esp
sub esp, 0x114
mov al, 0xc2
mov eax, dword [0x10149de0]
xor eax, ebp
jmp 0x113de01d
Function at 0x114089c3
Capabilities:
Hash data with crc32

Disassembly:
mov word [esp + 0x434], ax
call fcn.10078880
add esp, 0xc
lahf
xor edx, edx
nop
push 0x206
nop
cmovs ax, si
push edx
movzx eax, cx
lea eax, [esp + 0x22a]
jmp 0x11353360
push eax
jmp 0x1138da47
mov word [esp + 0x22c], dx
jmp 0x114c4dac
push ebp
mov ebp, esp
sar ch, 0x3b
and esp, 0xfffffff8
sbb cl, bh
cmp bp, si
lea esp, [esp - 0x62c]
bswap ax
add ecx, 0x771a635c
mov eax, dword [0x10149de0]
xor eax, esp
bt cx, 0x6e
rcr ecx, cl
mov dword [esp + 0x628], eax
push ebx
push esi
xchg cx, cx
add cl, 0xed
btc ecx, 0x20
push edi
bswap ecx
not cx
sub eax, eax
setp ch
movzx ecx, sp
push 0x206
push eax
movsx ecx, cx
bswap cx
mov cx, cx
lea ecx, [esp + 0x432]
push ecx
jmp 0x11200f77
call fcn.10078880
add esp, 0xc
push 0
jmp loc.10023655

Function at 0x11409af9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [esp + 0x71], 0x64
jmp loc.1002df32
mov byte [esp + 0x6f], 0x63
jmp 0x11424253
push 0xd7c85c20
call fcn.1140360f
mov byte [esp + 0x6e], bl
jmp 0x1131500d
mov byte [esp + 0x70], 0x6f
jmp 0x1126a266
Function at 0x1148c86b
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
push ebx
jmp 0x114df031
push ebx
jmp 0x10171606
push 0x9ddf29b8
call fcn.112af7a6
push 0x10027cb0
jmp 0x1136a3b4
call dword [0x100eb418]
push eax
jmp loc.100165bc

Function at 0x114a3f1c
Capabilities:
Hash data with crc32

Disassembly:
mov byte [ebp - 0x1e], dl
jmp loc.1001496f
push 0x9ddf29b8
call fcn.112af7a6
mov byte [ebp - 0x1f], 0x75
jmp 0x1126d32c

Function at 0x114b49cc
Capabilities:
Execute anti-debugging instructions

Disassembly:
push edi
push eax
mov edi, esi
cbw
jmp 0x113911e3
call fcn.10071dc8
mov esp, ebp
jmp 0x113e078d
call fcn.113dcb08
mov esi, eax
test esi, esi
ja 0x11343a7a
sub eax, eax
jmp 0x114239d7
push esi
jmp loc.10018b35
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
jmp 0x113b726d
push 0
jmp 0x1147e2a4
mov dword [ebp - 0x10], eax
push ebx
jmp 0x1142d0b4
pop ebp
ret
push ebp
adc ebp, 0x479c4c6d
setge al
sal ebp, 0xc5
mov ebp, esp
cmp si, ax
cbw
push 0xffffffffffffffff
adc ax, si
rcl ah, cl
push 0x100e8c17
sar ah, cl
rcr al, 0x2e
cwde
mov eax, dword fs:[0]
jmp 0x114b49cc
mov ecx, dword [ebp - 0xc]
rcl bx, cl
mov dword fs:[0], ecx
pop ecx
pop edi
xchg ebx, esi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
test cl, 0x67
xor ecx, ebp
jmp 0x1123e5a1
push esi
jmp 0x111bae7d
push edi
mov dword [ebp - 0x100], 0
jmp 0x112c8194
push eax
test si, ax
mov eax, esp
sub esp, 0x114
mov al, 0xc2
mov eax, dword [0x10149de0]
xor eax, ebp
jmp 0x113de01d
Function at 0x114c8368
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
lea eax, [edi - 0x10]
movzx cx, dl
shr ch, 0x3e
cmc
mov byte [ebp - 4], 6
lea ecx, [eax + 0xc]
clc
cmp cx, ax
or edx, 0xffffffff
clc
cmc
cmp bl, 0x8e
lock xadd dword [ecx], edx
jmp 0x11496b66
call fcn.10027d70
add esp, 4
test di, bp
cmp ax, dx
cmp dword [ebp - 0x1184], ebx
jmp 0x11451f94
call fcn.10006d60
lea eax, [ebp - 0x1178]
xchg cl, ch
movsx ecx, si
mov cl, 0xd4
push eax
not cx
xchg cx, cx
mov cx, 0x4d06
lea ecx, [ebp - 0x11e4]
jmp 0x112eb786
push eax
jmp 0x11391275
lea edi, [ebp - 0x11e4]
jmp 0x114f4575
push 0x4d
jmp 0x111f90f6
push ecx
jmp 0x113fc5ec
push ecx
bswap dx
mov edx, 0x10113888
jmp 0x1131fd6a
je 0x1130bdfa
call fcn.10073bb3
cmp dword [ebp - 0x1278], edi
jne 0x1134592f
push 1
xchg si, ax
mov esi, 0x10111d76
not al
bswap eax
movzx ax, bl
lea eax, [ebp - 0x520]
jmp 0x113f2c87
je 0x1130bdf5
cmp eax, dword [ebp - 0x11e4]
jmp 0x1130bdef
call fcn.10006bd0
mov esi, dword [ebp - 0x118c]
movzx edx, bp
mov ah, 0x3b
mov eax, dword [esi - 0xc]
cdq
push esi
mov dx, cx
xchg dl, dl
lea edx, [ebp - 0x117c]
jmp 0x11465a72
mov esi, dword [ebp - 0x118c]
movzx edx, cx
mov edx, dword [ebp - 0x119c]
jmp 0x114934da
call dword [0x100eb3fc]
mov eax, dword [ebp - 0x1178]
cmova edi, esi
mov edi, dword [ebp - 0x117c]
movzx cx, dh
xchg dl, ch
bswap cx
push eax
push edi
lea ecx, [ebp - 0x950]
cmovp eax, ecx
push ecx
cwde
lea edx, [ebp - 0x788]
push edx
push 0x38
nop
cbw
lea eax, [ebp - 0x18]
jmp 0x11259c15
call fcn.1138762f
lea esi, [esi - 0x10]
or ecx, eax
shrd ecx, esi, 0x8d
add esp, 0x1c
or ch, ah
sbb cx, di
mov byte [ebp - 4], 9
btr ecx, 0xd9
sal cx, 0x92
lea ecx, [esi + 0xc]
cmc
or edx, 0xffffffff
test ecx, edi
lock xadd dword [ecx], edx
jmp 0x114057db
lea ecx, [ebp - 0x520]
jmp 0x10183433
jmp 0x1134592f
mov dword [ebp - 0x1184], ebx
jmp 0x114659ef
call fcn.1004b230
mov dword [eax], 1
jmp 0x113dcb0e
dec edx
test edx, ebp
clc
test edx, edx
jg 0x1003caa2
mov ecx, dword [esi]
mov eax, dword [ecx]
movzx dx, bl
mov edx, dword [eax + 4]
push esi
jmp 0x1003caa0
jle 0x11345926
lea ecx, [ebp - 0x117c]
not dl
sets dh
jmp 0x112f9fc2
call fcn.10027d00
lea eax, [ebp - 0x1184]
btc edi, 0xc6
add esp, 4
push eax
seta cl
movzx ecx, di
mov edi, 0x2b584da8
lea edi, [ebp - 0x118c]
movsx ecx, di
jmp 0x113ac715
push edx
jmp 0x111a5e2a
push edx
jmp 0x113850cd
push 0xd7c85c20
call fcn.1140360f
call fcn.10006bd0
lea ecx, [ebp - 0x1178]
push ecx
mov dx, 0x607a
movsx edx, di
cmovbe dx, cx
lea edx, [ebp - 0x127c]
not di
cmovge edi, edx
push edx
bswap di
jmp 0x11200ac4
call fcn.1004b2d0
mov eax, dword [ebp - 0x127c]
sar di, 0x8b
movzx edi, dx
mov edi, dword [ebp - 0x11cc]
cmp si, 0x2169
cmp dx, si
cmp eax, ebx
jmp 0x1130d800
Function at 0x5310f4
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004055b8
mov eax, dword [ebp - 8]
call fcn.004055b8
xor eax, eax
push ebp
push 0x531231
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x44]
mov byte [ebp - 0xd], 0
call fcn.0048dd5c
test al, al
je 0x531216
push 0x531244
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [ebp - 0x18], eax
push 0x531254
mov eax, dword [ebp - 0x18]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0xbc5edc], eax
push 0x53126c
mov eax, dword [ebp - 0x18]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0xbc5ee0], eax
push 0x53128c
mov eax, dword [ebp - 0x18]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0xbc5ee4], eax
push 0x5312a4
mov eax, dword [ebp - 0x18]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0xbc5ee8], eax
push 0x5312c4
mov eax, dword [ebp - 0x18]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0xbc5eec], eax
push 0x5312dc
mov eax, dword [ebp - 0x18]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0xbc5ef0], eax
cmp dword [0xbc5edc], 0
je 0x53120d
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x5311fb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
mov edx, 2
mov eax, dword [ebp - 4]
call fcn.00530dcc
mov dword [ebp - 0x14], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x531205
cmp dword [ebp - 0x14], 0
setg byte [ebp - 0xd]
mov eax, dword [ebp - 0x18]
push eax
call sub.KERNEL32.DLL_FreeLibrary
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x531238
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040512c
ret

Function at 0x551078
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov esi, dword [ebp + 0xc]
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, ecx
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x55134e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x2c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x20]
mov dword [ebp - 0x20], eax
cmp dword [ebp + 8], 0
je 0x551176
lea eax, [ebp - 0x24]
call fcn.00406ff4
push eax
push 0x615b6c
push 1
push 0
push 0x615b7c
call sub.ole32.dll_CoCreateInstance
call fcn.0041a240
test al, al
je 0x551176
mov eax, dword [ebp - 4]
or byte [eax + 0x30], 8
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x1c]
Function at 0x551108
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4b8
push ebx
push esi
push edi
push edi
push edi
add esp, 4
sub edi, 0x124ea
sub edi, 0x71fd
and edi, 0x72e3
sub edi, 0xfee6
pop edi
push eax
add eax, 0x96b2
or eax, 0x163ea
xor eax, 0x9629
pop eax
mov eax, 0x6b
mov word [ebp - 0x2b0], ax
mov ecx, 0x65
mov word [ebp - 0x2ae], cx
mov edx, 0x72
mov word [ebp - 0x2ac], dx
mov eax, 0x6e
mov word [ebp - 0x2aa], ax
mov ecx, 0x65
mov word [ebp - 0x2a8], cx
mov edx, 0x6c
mov word [ebp - 0x2a6], dx
mov eax, 0x33
mov word [ebp - 0x2a4], ax
mov ecx, 0x32
mov word [ebp - 0x2a2], cx
mov edx, 0x2e
mov word [ebp - 0x2a0], dx
mov eax, 0x64
mov word [ebp - 0x29e], ax
mov ecx, 0x6c
mov word [ebp - 0x29c], cx
mov edx, 0x6c
mov word [ebp - 0x29a], dx
xor eax, eax
mov word [ebp - 0x298], ax
mov dword [ebp - 0x1b0], 0
push edi
push esi
add esp, 4
xor edi, 0x1102d
pop edi
push ebx
xor ebx, 0x5a5
jmp 0x551202
call 0x551211
add byte [ebx], dh
push eax
add byte [eax], al
add byte [eax], al
xor edi, dword [esi]
push eax
xor cl, byte [edi + 0x33]
aas
inc edx
cmp eax, 0x8104c483
jmp 0x551204

Function at 0x551211
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4b8
push ebx
push esi
push edi
push edi
push edi
add esp, 4
sub edi, 0x124ea
sub edi, 0x71fd
and edi, 0x72e3
sub edi, 0xfee6
pop edi
push eax
add eax, 0x96b2
or eax, 0x163ea
xor eax, 0x9629
pop eax
mov eax, 0x6b
mov word [ebp - 0x2b0], ax
mov ecx, 0x65
mov word [ebp - 0x2ae], cx
mov edx, 0x72
mov word [ebp - 0x2ac], dx
mov eax, 0x6e
mov word [ebp - 0x2aa], ax
mov ecx, 0x65
mov word [ebp - 0x2a8], cx
mov edx, 0x6c
mov word [ebp - 0x2a6], dx
mov eax, 0x33
mov word [ebp - 0x2a4], ax
mov ecx, 0x32
mov word [ebp - 0x2a2], cx
mov edx, 0x2e
mov word [ebp - 0x2a0], dx
mov eax, 0x64
mov word [ebp - 0x29e], ax
mov ecx, 0x6c
mov word [ebp - 0x29c], cx
mov edx, 0x6c
mov word [ebp - 0x29a], dx
xor eax, eax
mov word [ebp - 0x298], ax
mov dword [ebp - 0x1b0], 0
push edi
push esi
add esp, 4
xor edi, 0x1102d
pop edi
push ebx
xor ebx, 0x5a5
jmp 0x551202
call 0x551211
add byte [ebx], dh
push eax
add byte [eax], al
add byte [eax], al
xor edi, dword [esi]
push eax
xor cl, byte [edi + 0x33]
aas
inc edx
cmp eax, 0x8104c483
jmp 0x551204
Function at 0x5512ef
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
add esi, 0x1276f
or esi, 0x11d57
jmp 0x551303
pop esi
push edx
push ebx
add esp, 4
add edx, 0xdb07
pop edx
mov edx, dword fs:[0x18]
mov dword [ebp - 0x434], edx
push eax
push ebx
add esp, 4
sub eax, 0xe8a6
pop eax
push esi
sub esi, 0xea10
add esi, 0xfbc
or esi, 0x3a96
pop esi
push esi
push eax
add esp, 4
or esi, 0x153bd
add esi, 0xd46c
pop esi
mov eax, dword [ebp - 0x434]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x480], ecx
push esi
xor esi, 0x174bf
add byte [esi + 0x56], bl
push eax
add esp, 4
add esi, 0xb2a5
xor esi, 0x10cb2
add esi, 0x126de
call 0x55138c
add byte [eax + 0x3d], dl
dec esp
xor cl, byte [edi + 0x45]
dec eax
push eax
cmp byte [ebx - 0x74a1fb3c], al
xchg ebp, eax
cmp bl, 0xff
dec dword [ecx - 0x3676b]
inc dword [ebx - 0x36743]
inc dword [eax]
jne 0x5513e3
push ebx
push edx
add esp, 4
sub ebx, 0x10558
pop ebx
push edi
and edi, 0x9b60
pop edi
push ecx
push edi
add esp, 4
add ecx, 0x6c2b
and ecx, 0x7db4
sub ecx, 0xba9a
or ecx, 0xc248
pop ecx
mov dword [ebp - 0x6c], 0
jmp 0x55176f
push edx
push esi
add esp, 4
or edx, 0x146ec
add edx, 0xca45
pop edx
push esi
jmp 0x5513fc
and esi, 0xed43
pop esi
push eax
push ecx
add esp, 4
and eax, 0x121e0
sub eax, 0xd493
pop eax
mov eax, dword [ebp - 0x368]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x1ec], edx
cmp dword [ebp - 0x1ec], 0
jne 0x55146e
push edi
xor edi, 0x14000
or edi, 0x1383a
sub edi, 0x648b
add edi, 0x1571b
pop edi
push esi
push edi
add esp, 4
and esi, 0x16453
xor esi, 0x742c
and esi, 0xdd8e
pop esi
mov dword [ebp - 0x6c], 0
jmp 0x55176f
mov eax, dword [ebp - 0x1ec]
mov dword [ebp - 0xc4], eax
Function at 0x551364
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
add esi, 0x1276f
or esi, 0x11d57
jmp 0x551303
pop esi
push edx
push ebx
add esp, 4
add edx, 0xdb07
pop edx
mov edx, dword fs:[0x18]
mov dword [ebp - 0x434], edx
push eax
push ebx
add esp, 4
sub eax, 0xe8a6
pop eax
push esi
sub esi, 0xea10
add esi, 0xfbc
or esi, 0x3a96
pop esi
push esi
push eax
add esp, 4
or esi, 0x153bd
add esi, 0xd46c
pop esi
mov eax, dword [ebp - 0x434]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x480], ecx
push esi
xor esi, 0x174bf
add byte [esi + 0x56], bl
push eax
add esp, 4
add esi, 0xb2a5
xor esi, 0x10cb2
add esi, 0x126de
call 0x55138c
add byte [eax + 0x3d], dl
dec esp
xor cl, byte [edi + 0x45]
dec eax
push eax
cmp byte [ebx - 0x74a1fb3c], al
xchg ebp, eax
cmp bl, 0xff
dec dword [ecx - 0x3676b]
inc dword [ebx - 0x36743]
inc dword [eax]
jne 0x5513e3
push ebx
push edx
add esp, 4
sub ebx, 0x10558
pop ebx
push edi
and edi, 0x9b60
pop edi
push ecx
push edi
add esp, 4
add ecx, 0x6c2b
and ecx, 0x7db4
sub ecx, 0xba9a
or ecx, 0xc248
pop ecx
mov dword [ebp - 0x6c], 0
jmp 0x55176f
push edx
push esi
add esp, 4
or edx, 0x146ec
add edx, 0xca45
pop edx
push esi
jmp 0x5513fc
and esi, 0xed43
pop esi
push eax
push ecx
add esp, 4
and eax, 0x121e0
sub eax, 0xd493
pop eax
mov eax, dword [ebp - 0x368]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x1ec], edx
cmp dword [ebp - 0x1ec], 0
jne 0x55146e
push edi
xor edi, 0x14000
or edi, 0x1383a
sub edi, 0x648b
add edi, 0x1571b
pop edi
push esi
push edi
add esp, 4
and esi, 0x16453
xor esi, 0x742c
and esi, 0xdd8e
pop esi
mov dword [ebp - 0x6c], 0
jmp 0x55176f
mov eax, dword [ebp - 0x1ec]
mov dword [ebp - 0xc4], eax
Function at 0x55138c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
add esi, 0x1276f
or esi, 0x11d57
jmp 0x551303
pop esi
push edx
push ebx
add esp, 4
add edx, 0xdb07
pop edx
mov edx, dword fs:[0x18]
mov dword [ebp - 0x434], edx
push eax
push ebx
add esp, 4
sub eax, 0xe8a6
pop eax
push esi
sub esi, 0xea10
add esi, 0xfbc
or esi, 0x3a96
pop esi
push esi
push eax
add esp, 4
or esi, 0x153bd
add esi, 0xd46c
pop esi
mov eax, dword [ebp - 0x434]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x480], ecx
push esi
xor esi, 0x174bf
add byte [esi + 0x56], bl
push eax
add esp, 4
add esi, 0xb2a5
xor esi, 0x10cb2
add esi, 0x126de
call 0x55138c
add byte [eax + 0x3d], dl
dec esp
xor cl, byte [edi + 0x45]
dec eax
push eax
cmp byte [ebx - 0x74a1fb3c], al
xchg ebp, eax
cmp bl, 0xff
dec dword [ecx - 0x3676b]
inc dword [ebx - 0x36743]
inc dword [eax]
jne 0x5513e3
push ebx
push edx
add esp, 4
sub ebx, 0x10558
pop ebx
push edi
and edi, 0x9b60
pop edi
push ecx
push edi
add esp, 4
add ecx, 0x6c2b
and ecx, 0x7db4
sub ecx, 0xba9a
or ecx, 0xc248
pop ecx
mov dword [ebp - 0x6c], 0
jmp 0x55176f
push edx
push esi
add esp, 4
or edx, 0x146ec
add edx, 0xca45
pop edx
push esi
jmp 0x5513fc
and esi, 0xed43
pop esi
push eax
push ecx
add esp, 4
and eax, 0x121e0
sub eax, 0xd493
pop eax
mov eax, dword [ebp - 0x368]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x1ec], edx
cmp dword [ebp - 0x1ec], 0
jne 0x55146e
push edi
xor edi, 0x14000
or edi, 0x1383a
sub edi, 0x648b
add edi, 0x1571b
pop edi
push esi
push edi
add esp, 4
and esi, 0x16453
xor esi, 0x742c
and esi, 0xdd8e
pop esi
mov dword [ebp - 0x6c], 0
jmp 0x55176f
mov eax, dword [ebp - 0x1ec]
mov dword [ebp - 0xc4], eax
Function at 0x551e74
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
xor esi, 0x1e1
pop esi
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x98], eax
jmp 0x55237b
Function at 0x5548a8
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
xor ebx, 0x774a
pop ebx
push eax
push ecx
add esp, 4
or eax, 0x728c
or eax, 0x174ab
xor eax, 0xddb8
add eax, 0x7379
pop eax
mov eax, dword [ebp - 0xf0]
mov ecx, dword [ebp - 0x84]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x408], ecx
push eax
xor eax, 0x8240
add eax, 0x1162c
call 0x5548fe
add byte [eax + 0x44], cl
cmp eax, 0x45323340
xor bh, byte [0x5804c483]
push ebx
push ebx
add esp, 4
sub ebx, 0x164ff
or ebx, 0x722f
pop ebx
mov edx, dword [ebp - 0xf0]
mov eax, dword [ebp - 0x84]
add eax, dword [edx + 0x1c]
mov dword [ebp - 0x40c], eax
mov dword [ebp - 0xf4], 0
jmp 0x554944
mov edx, dword [ebp - 0xf0]
invalid
invalid

Function at 0x5548fe
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
xor ebx, 0x774a
pop ebx
push eax
push ecx
add esp, 4
or eax, 0x728c
or eax, 0x174ab
xor eax, 0xddb8
add eax, 0x7379
pop eax
mov eax, dword [ebp - 0xf0]
mov ecx, dword [ebp - 0x84]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x408], ecx
push eax
xor eax, 0x8240
add eax, 0x1162c
call 0x5548fe
add byte [eax + 0x44], cl
cmp eax, 0x45323340
xor bh, byte [0x5804c483]
push ebx
push ebx
add esp, 4
sub ebx, 0x164ff
or ebx, 0x722f
pop ebx
mov edx, dword [ebp - 0xf0]
mov eax, dword [ebp - 0x84]
add eax, dword [edx + 0x1c]
mov dword [ebp - 0x40c], eax
mov dword [ebp - 0xf4], 0
jmp 0x554944
mov edx, dword [ebp - 0xf0]
invalid
invalid