joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10012020
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x1010
call fcn.10017c80
mov eax, dword [esp + 0x1014]
push ebx
push ebp
mov ebp, dword [esp + 0x1020]
push esi
push edi
xor edi, edi
push 1
push edi
push edi
push eax
mov dword [ebp], edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
je 0x10012122
jmp 0x1001205f
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x1024]
xor esi, esi
lea ecx, [esp + 0x18]
push esi
push ecx
lea edx, [esp + 0x28]
push 0x1000
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1001213f
mov eax, dword [esp + 0x18]
mov dword [esp + 0x14], esi
cmp eax, esi
jle 0x100120ab
mov cl, byte [esp + esi + 0x20]
test cl, cl
je 0x100120a2
inc esi
cmp esi, eax
jl 0x10012093
jmp 0x100120ab
inc esi
mov dword [esp + 0x14], 1
mov eax, dword [ebp]
mov ebx, edi
add edi, esi
test eax, eax
mov dword [esp + 0x1c], edi
je 0x100120c7
inc edi
push edi
push eax
call fcn.10011510
add esp, 8
jmp 0x100120d1
inc edi
push edi
call fcn.10011470
add esp, 4
mov edi, eax
lea ecx, [esp + 0x20]
add edi, ebx
push esi
push ecx
push edi
mov dword [ebp], eax
call fcn.10017b80
mov eax, dword [esp + 0x20]
add esp, 0xc
test eax, eax
mov byte [edi + esi], 0
jne 0x10012158
cmp dword [esp + 0x18], 0x1000
jb 0x1001218b
mov edx, dword [esp + 0x1024]
push 1
push 0
push 0
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
jne 0x1001205b
mov eax, dword [esp + 0x102c]
pop edi
pop esi
pop ebp
mov dword [eax], 0
mov eax, 1
pop ebx
add esp, 0x1010
ret
mov ecx, dword [esp + 0x102c]
pop edi
mov eax, 1
mov dword [ecx], esi
pop esi
pop ebp
pop ebx
add esp, 0x1010
ret
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x1024]
push 0
add esi, edx
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [esp + 0x102c]
pop edi
pop esi
pop ebp
mov dword [ecx], 1
xor eax, eax
pop ebx
add esp, 0x1010
ret
mov edx, dword [esp + 0x102c]
pop edi
pop esi
pop ebp
mov dword [edx], 1
mov eax, 1
pop ebx
add esp, 0x1010
ret

Function at 0x100121b0
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esp + 0x18]
push 4
push ecx
push edi
mov dword [esi], 0
call ebx
test eax, eax
je 0x1001223c
cmp dword [esp + 0x14], 4
jb 0x1001223c
mov edx, dword [esp + 0x10]
add edx, 8
push edx
call fcn.10011470
mov edx, dword [esp + 0x14]
add esp, 4
lea ecx, [esp + 0x14]
mov dword [esi], eax
push 0
push ecx
add eax, 8
push edx
push eax
push edi
call ebx
test eax, eax
je 0x1001222b
mov esi, dword [esi]
mov dword [esi], 1
mov eax, dword [esp + 0x14]
mov dword [esi + 4], eax
mov ecx, dword [esp + 0x14]
cmp ecx, dword [esp + 0x10]
jne 0x1001223c
pop edi
pop esi
xor eax, eax
pop ebx
ret
mov edx, dword [esi]
push edx
call fcn.10011580
add esp, 4
mov dword [esi], 0
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x10012620
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
mov esi, dword [esp + 0x1c]
push edi
push 1
mov dword [esi], 0
mov edi, dword [ebx + 4]
push 0
push 0
push edi
call ebp
mov dword [esp + 0x10], eax
lea eax, [esp + 0x20]
push 0
push eax
lea ecx, [esp + 0x24]
push 4
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1001272a
mov edx, dword [ebx + 0xc]
lea eax, [ebx + 0x10]
lea ecx, [ebx + 0x34]
push eax
push edx
mov dword [esp + 0x1c], ecx
push ecx
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x28]
push 4
push eax
push ecx
call fcn.10016390
mov eax, dword [esp + 0x38]
add esp, 0x18
cmp eax, 4
jb 0x1001272a
mov edx, dword [esp + 0x1c]
add edx, 8
push edx
call fcn.10011470
add esp, 4
mov dword [esi], eax
push 1
push 0
push 0
push edi
call ebp
mov edx, dword [esi]
mov ecx, dword [esp + 0x1c]
mov ebp, eax
lea eax, [esp + 0x20]
push 0
push eax
add edx, 8
push ecx
push edx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10012719
mov eax, dword [esi]
mov dword [eax], 1
mov ecx, dword [esp + 0x20]
mov dword [eax + 4], ecx
mov edx, dword [ebx + 0xc]
mov ecx, dword [esp + 0x20]
lea eax, [ebx + 0x10]
push eax
mov eax, dword [esp + 0x18]
push edx
mov edx, dword [esi]
push eax
add edx, 8
push ecx
push edx
push ebp
call fcn.10016390
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
add esp, 0x18
cmp eax, ecx
jne 0x1001272a
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
mov ecx, dword [esi]
push ecx
call fcn.10011580
add esp, 4
mov dword [esi], 0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
Function at 0x100131a0
Capabilities:
Get file size

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x100131ae
or eax, 0xffffffff
pop esi
ret
push esi
call fcn.10016bc0
add esp, 4
test eax, eax
jne 0x100131c0
or eax, 0xffffffff
pop esi
ret
mov ecx, dword [esi]
or eax, 0xffffffff
cmp ecx, 1
je 0x100131de
cmp ecx, 3
je 0x100131de
cmp ecx, 2
jne 0x100131ed
mov ecx, dword [esi + 4]
call fcn.10016bb0
pop esi
ret
mov esi, dword [esi + 4]
lea eax, [esp + 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
pop esi
ret
Function at 0x10014620
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
jne 0x10014635
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
push edi
call fcn.10016bc0
add esp, 4
test eax, eax
jne 0x10014648
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov esi, dword [esp + 0x28]
test esi, esi
jg 0x10014658
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov eax, dword [edi]
xor ebx, ebx
cmp eax, 1
jne 0x100146b1
mov edi, dword [edi + 4]
push esi
call fcn.10017949
add esp, 4
mov ebp, eax
lea eax, [esp + 0x1c]
push ebx
push eax
push esi
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10014693
push ebp
call fcn.10017caf
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov ecx, dword [esp + 0x1c]
push ecx
push ebp
call fcn.10016e20
push ebp
mov ebx, eax
call fcn.10017caf
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
cmp eax, 2
jne 0x100146fc
mov edi, dword [edi + 4]
lea edx, [esi + 8]
push edx
call fcn.100114c0
mov ebx, eax
add esp, 4
lea ecx, [ebx + 8]
mov dword [ebx], 1
mov dword [ebx + 4], esi
mov eax, dword [edi]
push esi
push ecx
mov ecx, edi
call dword [eax + 0x20]
test eax, eax
jne 0x100146f1
push ebx
call fcn.10011580
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
mov dword [ebx + 4], eax
pop esi
mov eax, ebx
pop ebp
pop ebx
pop ecx
ret
cmp eax, 3
jne 0x10014775
mov ebx, dword [edi + 4]
push esi
call fcn.10017949
add esp, 4
mov ebp, eax
push 1
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea edx, [esp + 0x1c]
push 0
push edx
push esi
push ebp
push ebx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10014745
push ebp
call fcn.10017caf
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov edx, dword [edi + 0xc]
mov eax, dword [esp + 0x1c]
lea ecx, [edi + 0x10]
add edi, 0x34
push ecx
push edx
push edi
mov esi, eax
push eax
mov eax, dword [esp + 0x20]
push ebp
push eax
call fcn.10016390
push esi
push ebp
call fcn.10016e20
push ebp
mov ebx, eax
call fcn.10017caf
add esp, 0x24
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
pop ecx
ret
Function at 0x10015b10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, edx
push esi
push edi
mov esi, ebp
xor edi, edi
and esi, 3
mov eax, ecx
jle 0x10015b31
mov dl, byte [eax]
inc eax
cmp dl, bl
je 0x10015b8b
inc edi
cmp edi, esi
jl 0x10015b25
mov edi, ebx
and edi, 0xff
mov esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
lea edi, [ecx + ebp]
cmp eax, edi
jae 0x10015bc0
mov edx, dword [eax]
xor edx, esi
lea ebp, [edx - 0x1010101]
not edx
and ebp, edx
test ebp, 0x80808080
je 0x10015b7a
cmp byte [eax], bl
je 0x10015b95
cmp byte [eax + 1], bl
je 0x10015b9e
cmp byte [eax + 2], bl
je 0x10015ba8
cmp byte [eax + 3], bl
je 0x10015bb4
add eax, 4
cmp eax, edi
jb 0x10015b51
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
dec eax
pop ebx
ret 4
pop edi
pop esi
pop ebp
sub eax, ecx
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
inc eax
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 2
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 3
pop ebx
ret 4
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4

Function at 0x100161a0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [esp + 0x11c]
lea eax, [esp + 0x18]
mov ebx, edi
xor esi, esi
xor ecx, ecx
sub ebx, eax
mov eax, ecx
lea ebp, [esp + ecx + 0x18]
cdq
idiv dword [esp + 0x124]
mov eax, dword [esp + 0x120]
mov byte [ebx + ebp], cl
inc ecx
cmp ecx, 0x100
mov dl, byte [edx + eax]
mov byte [ebp], dl
jl 0x100161d2
lea ebp, [esp + 0x18]
mov eax, edi
sub ebp, edi
mov dword [esp + 0x10], 0x100
mov cl, byte [eax]
xor edx, edx
mov dl, byte [eax + ebp]
mov byte [esp + 0x14], cl
mov ebx, dword [esp + 0x14]
add esi, edx
and ebx, 0xff
add esi, ebx
and esi, 0x800000ff
jns 0x10016232
dec esi
or esi, 0xffffff00
inc esi
mov dl, byte [esi + edi]
mov byte [eax], dl
mov byte [esi + edi], cl
mov ecx, dword [esp + 0x10]
inc eax
dec ecx
mov dword [esp + 0x10], ecx
jne 0x10016209
xor al, al
mov byte [edi + 0x100], al
mov byte [edi + 0x101], al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
Function at 0x100162e0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push esi
push edi
mov edi, dword [esp + 0x14]
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
xor esi, esi
mov byte [esp + 0x18], cl
test edi, edi
mov byte [esp + 8], dl
jle 0x1001637c
mov edx, dword [esp + 0x10]
push ebx
push ebp
mov cl, byte [esp + 0x20]
mov bl, byte [esp + 0x10]
inc cl
mov byte [esp + 0x20], cl
mov ecx, dword [esp + 0x20]
and ecx, 0xff
lea edi, [ecx + eax]
mov cl, byte [ecx + eax]
add bl, cl
mov byte [esp + 0x10], bl
mov ebx, dword [esp + 0x10]
and ebx, 0xff
lea ebp, [ebx + eax]
mov bl, byte [ebx + eax]
mov byte [edi], bl
mov byte [ebp], cl
mov bl, byte [edi]
add bl, cl
and ebx, 0xff
mov cl, byte [ebx + eax]
mov bl, byte [esi + edx]
xor bl, cl
mov ecx, dword [esp + 0x1c]
mov byte [esi + edx], bl
inc esi
cmp esi, ecx
jl 0x1001630b
mov dl, byte [esp + 0x20]
mov cl, byte [esp + 0x10]
pop ebp
pop ebx
pop edi
mov byte [eax + 0x100], dl
mov byte [eax + 0x101], cl
pop esi
pop ecx
ret
pop edi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop esi
pop ecx
ret
Function at 0x100e2ee0
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x100e30c4
pushal
mov esi, section.UPX1
lea edi, [esi - 0x82000]
push edi
or ebp, 0xffffffff
jmp 0x100e2f0a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x100e2f11
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100e2f00
mov eax, 1
add ebx, ebx
jne 0x100e2f23
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x100e2f34
jne 0x100e2f53
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100e2f53
dec eax
add ebx, ebx
jne 0x100e2f40
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x100e2f18
add ebx, ebx
jne 0x100e2f4f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x100e2fa5
xor ecx, ecx
sub eax, 3
jb 0x100e2f6b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x100e2fda
sar eax, 1
mov ebp, eax
jmp 0x100e2f76
add ebx, ebx
jne 0x100e2f76
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100e2f44
inc ecx
add ebx, ebx
jne 0x100e2f84
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100e2f44
add ebx, ebx
jne 0x100e2f91
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x100e2f86
jne 0x100e2fa2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x100e2f86
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x100e2fc4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x100e2fb6
jmp 0x100e2f06
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x100e2fc4
add edi, ecx
jmp 0x100e2f06
pop esi
mov edi, esi
mov ecx, 0x3d5
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x100e2fe2
cmp byte [edi], 5
jne 0x100e2fe2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x100e2fe7
lea edi, [esi + 0xe0000]
mov eax, dword [edi]
or eax, eax
je 0x100e3056
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xe3a20]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xe3ac4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x100e3014
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xe3ac8]
or eax, eax
je 0x100e3050
mov dword [ebx], eax
add ebx, 4
jmp 0x100e3031
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x100e3087
cmp al, 0xef
ja 0x100e307a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x100e305c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x100e3069
mov ebp, dword [esi + 0xe3acc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x100e30bb
sub esp, 0xffffff80
jmp 0x100020e0
Function at 0x4f9691
Capabilities:
Get file system object information

Disassembly:
push 0x4cc
mov eax, 0x59158b
call fcn.0055d7c5
mov ebx, ecx
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.0040a8a0
pop ecx
lea esi, [eax + 0x10]
mov dword [ebp - 0x4d0], esi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x4d0]
push 0
push 0x5dd32c
call fcn.00417d60
cmp eax, 0xffffffff
jne 0x4f976c
push 0
push 0x5aa3ec
lea ecx, [ebp - 0x4d0]
call fcn.00417d60
cmp eax, 0xffffffff
jne 0x4f976c
push 0
push 0x5a0adc
lea ecx, [ebp - 0x4d0]
call fcn.00417d60
cmp eax, 0xffffffff
jne 0x4f976c
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.0040a8a0
add eax, 0x10
pop ecx
mov dword [ebp - 0x4d8], eax
xor edx, edx
mov byte [ebp - 4], 1
push edx
lea ecx, [ebp - 0x218]
push ecx
push 0x104
push edx
push eax
lea edi, [eax - 0x10]
push edx
mov dword [ebp - 0x4d4], edi
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x4f973b
mov eax, dword [ebx]
mov edi, dword [eax + 0x14]
mov ecx, edi
call dword [0x597998]
mov ecx, ebx
call edi
mov ecx, dword [ebp - 0x4d4]
mov edi, eax
call fcn.0040b460
jmp 0x4f97a5
lea eax, [ebp - 0x218]
push eax
call fcn.0057051f
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0040b2c0
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.0040b460
mov esi, dword [ebp - 0x4d0]
push 0x105
push 0x2b4
lea eax, [ebp - 0x4cc]
push eax
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x4f9792
mov edi, dword [ebp - 0x4cc]
jmp 0x4f97a5
mov eax, dword [ebx]
mov edi, dword [eax + 0x14]
mov ecx, edi
call dword [0x597998]
mov ecx, ebx
call edi
mov edi, eax
lea ecx, [esi - 0x10]
call fcn.0040b460
mov eax, edi
call fcn.0055d774
ret
Function at 0x511e33
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop eax
push eax
xor eax, 0x46a5
or eax, 0x72b1
jmp 0x511e49
sub eax, 0x2b9f
pop eax
jmp 0x512083
push esi
push ecx
add esp, 4
sub esi, 0x41c0
or esi, 0xd21e
pop esi
push esi
jmp 0x51209b
xor esi, 0x3e84
call 0x5120b1
add byte [ecx], bh
inc ecx
inc edi
xor al, 0x34
dec ecx
inc ecx
dec ecx
xor al, 0x4c
add esp, 4
pop esi
mov dword [ebp - 0xa5c], 0
push ecx
push esi
add esp, 4
call 0x5120d4
add byte [esi + 0x4c], al
cmp dh, byte [esp + eax*2]
cmp al, 0x40
dec ebp
push eax
inc ecx
add esp, 4
pop ecx
push ebx
push esi
add esp, 4
call 0x5120ed
add byte [edi], bh
dec edi
push eax
xor edi, dword [ecx]
xor eax, 0x45353d37
add esp, 4
pop ebx
mov byte [ebp - 0x804], 0x45
mov byte [ebp - 0x803], 0x78
mov byte [ebp - 0x802], 0x69
mov byte [ebp - 0x801], 0x74
mov byte [ebp - 0x800], 0x50
mov byte [ebp - 0x7ff], 0x72
mov byte [ebp - 0x7fe], 0x6f
mov byte [ebp - 0x7fd], 0x63
mov byte [ebp - 0x7fc], 0x65
mov byte [ebp - 0x7fb], 0x73
mov byte [ebp - 0x7fa], 0x73
mov byte [ebp - 0x7f9], 0
push ecx
jmp 0x51214c
or ecx, 0x1282f
pop ecx
push ecx
and ecx, 0x1644e
call 0x512167
add byte [ebp + 0x42], al
dec ecx
xor eax, 0x834b333f
les eax, [ecx + eax*4]
loope 0x51218b
cmp al, 0
add byte [ecx + 0xd519c9], al
add byte [ecx - 0x47], bl
imul eax, dword [eax], 0
add byte [esi - 0x77], ah
invalid
fucompp
invalid
Function at 0x511f21
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x4d0]
add edx, 1
mov dword [ebp - 0x4d0], edx
push ebx
push esi
add esp, 4
jmp 0x511de6
and ebx, 0x9828
pop ebx
push esi
push ecx
add esp, 4
and esi, 0x5e4d
sub esi, 0xcd7b
pop esi
push ecx
sub ecx, 0x1616
sub ecx, 0x1680f
pop ecx
mov eax, dword [ebp - 0x4d0]
sub eax, dword [ebp - 0x3c0]
cmp eax, 0xffffffff
jb 0x511e55
push eax
sub eax, 0xfa36
call fcn.00511e33
add byte [ebx + 0x47], cl
inc ecx
inc esp
inc esp
xor eax, 0xc483393e
add esp, 4
pop eax
mov dword [ebp - 0xc10], 7
mov ecx, dword [ebp - 0x4d0]
mov dword [ebp - 0xa60], ecx
push eax
xor eax, 0xe2e0
pop eax
push edi
push eax
add esp, 4
sub edi, 0x6b2f
jmp 0x511e85
jmp 0x511e8e
pop edi
push edx
add edx, 0x12ff6
sub edx, 0xe007
pop edx
mov edx, dword [ebp - 0x14c8]
mov dword [ebp - 0x9f0], edx
mov dword [ebp - 0xc14], 0
mov eax, dword [ebp - 0x4d0]
cmp eax, dword [ebp - 0x14c8]
jne 0x511f04
push edx
and edx, 0xd44a
or edx, 0x7179
sub edx, 0x4cd4
pop edx
push ecx
push edx
add esp, 4
and ecx, 0xeef4
xor ecx, 0x4120
sub ecx, 0x99ce
sub ecx, 0x1450c
pop ecx
mov ecx, dword [ebp - 0xc14]
mov dword [ebp - 0x14d0], ecx
jmp 0x512035
cmp dword [ebp - 0xc10], 0
jle 0x512029
push edi
call fcn.00511f21
add byte [ecx], bh
dec edx
inc edx
dec esi
inc eax
dec edx
cmp byte [ecx + ecx*2 - 0x7d], al
add esp, 4
sub edi, 0xd924
add esp, 4
sub edi, 0xd924
or edi, 0xd54c
pop edi
push ebx
push esi
add esp, 4
jmp 0x511f3c
or ebx, 0xdab5
pop ebx
mov edx, dword [ebp - 0xa60]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x9f0]
movzx edx, byte [ecx]
cmp eax, edx
je 0x511fc5
push ecx
xor ecx, 0x13e3
or ecx, 0x9847
call 0x511f75
add byte [edi + edi], dh
dec edx
cmp eax, 0x4b3e454b
dec edi
add esp, 4
and ecx, 0x6b58
pop ecx
push eax
push ebx
add esp, 4
and eax, 0x13b31
pop eax
mov eax, dword [ebp - 0xa60]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x9f0]
movzx eax, byte [edx]
cmp ecx, eax
jle 0x511fad
mov dword [ebp - 0x14cc], 1
jmp 0x511fb7
mov dword [ebp - 0x14cc], 0xffffffff
mov ecx, dword [ebp - 0x14cc]
mov dword [ebp - 0xc14], ecx
jmp 0x512029
push edi
and edi, 0x1904
add edi, 0x50b8
call 0x511fe1
add byte [ebp + 0x44], cl
cmp eax, 0x32504940
xor eax, 0x4c48342
call 0x511ff3
add byte [edx + 0x3a], al
aaa
dec edx
cmp eax, 0x484f4834
add esp, 4
pop edi
mov edx, dword [ebp - 0xc10]
sub edx, 1
mov dword [ebp - 0xc10], edx
mov eax, dword [ebp - 0xa60]
add eax, 1
mov dword [ebp - 0xa60], eax
mov ecx, dword [ebp - 0x9f0]
add ecx, 1
mov dword [ebp - 0x9f0], ecx
jmp 0x511f04
mov edx, dword [ebp - 0xc14]
mov dword [ebp - 0x14d0], edx
cmp dword [ebp - 0x14d0], 0
jne 0x51207e
push ebx
or ebx, 0xc971
xor ebx, 0x1544e
pop ebx
push ecx
push ecx
add esp, 4
or ecx, 0x68d
and ecx, 0x9ab0
call 0x51206c
add byte [ebp + 0x4f], al
inc edi
inc ebx
inc ebx
cmp byte [esi + 0x4c], al
aaa
add esp, 4
pop ecx
mov eax, dword [ebp - 0x4d0]
mov dword [ebp - 0xa5c], eax
jmp 0x5120bf
jmp 0x511dcc
Function at 0x511f75
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x4d0]
add edx, 1
mov dword [ebp - 0x4d0], edx
push ebx
push esi
add esp, 4
jmp 0x511de6
and ebx, 0x9828
pop ebx
push esi
push ecx
add esp, 4
and esi, 0x5e4d
sub esi, 0xcd7b
pop esi
push ecx
sub ecx, 0x1616
sub ecx, 0x1680f
pop ecx
mov eax, dword [ebp - 0x4d0]
sub eax, dword [ebp - 0x3c0]
cmp eax, 0xffffffff
jb 0x511e55
push eax
sub eax, 0xfa36
call fcn.00511e33
add byte [ebx + 0x47], cl
inc ecx
inc esp
inc esp
xor eax, 0xc483393e
add esp, 4
pop eax
mov dword [ebp - 0xc10], 7
mov ecx, dword [ebp - 0x4d0]
mov dword [ebp - 0xa60], ecx
push eax
xor eax, 0xe2e0
pop eax
push edi
push eax
add esp, 4
sub edi, 0x6b2f
jmp 0x511e85
jmp 0x511e8e
pop edi
push edx
add edx, 0x12ff6
sub edx, 0xe007
pop edx
mov edx, dword [ebp - 0x14c8]
mov dword [ebp - 0x9f0], edx
mov dword [ebp - 0xc14], 0
mov eax, dword [ebp - 0x4d0]
cmp eax, dword [ebp - 0x14c8]
jne 0x511f04
push edx
and edx, 0xd44a
or edx, 0x7179
sub edx, 0x4cd4
pop edx
push ecx
push edx
add esp, 4
and ecx, 0xeef4
xor ecx, 0x4120
sub ecx, 0x99ce
sub ecx, 0x1450c
pop ecx
mov ecx, dword [ebp - 0xc14]
mov dword [ebp - 0x14d0], ecx
jmp 0x512035
cmp dword [ebp - 0xc10], 0
jle 0x512029
push edi
call fcn.00511f21
add byte [ecx], bh
dec edx
inc edx
dec esi
inc eax
dec edx
cmp byte [ecx + ecx*2 - 0x7d], al
add esp, 4
sub edi, 0xd924
add esp, 4
sub edi, 0xd924
or edi, 0xd54c
pop edi
push ebx
push esi
add esp, 4
jmp 0x511f3c
or ebx, 0xdab5
pop ebx
mov edx, dword [ebp - 0xa60]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x9f0]
movzx edx, byte [ecx]
cmp eax, edx
je 0x511fc5
push ecx
xor ecx, 0x13e3
or ecx, 0x9847
call 0x511f75
add byte [edi + edi], dh
dec edx
cmp eax, 0x4b3e454b
dec edi
add esp, 4
and ecx, 0x6b58
pop ecx
push eax
push ebx
add esp, 4
and eax, 0x13b31
pop eax
mov eax, dword [ebp - 0xa60]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x9f0]
movzx eax, byte [edx]
cmp ecx, eax
jle 0x511fad
mov dword [ebp - 0x14cc], 1
jmp 0x511fb7
mov dword [ebp - 0x14cc], 0xffffffff
mov ecx, dword [ebp - 0x14cc]
mov dword [ebp - 0xc14], ecx
jmp 0x512029
push edi
and edi, 0x1904
add edi, 0x50b8
call 0x511fe1
add byte [ebp + 0x44], cl
cmp eax, 0x32504940
xor eax, 0x4c48342
call 0x511ff3
add byte [edx + 0x3a], al
aaa
dec edx
cmp eax, 0x484f4834
add esp, 4
pop edi
mov edx, dword [ebp - 0xc10]
sub edx, 1
mov dword [ebp - 0xc10], edx
mov eax, dword [ebp - 0xa60]
add eax, 1
mov dword [ebp - 0xa60], eax
mov ecx, dword [ebp - 0x9f0]
add ecx, 1
mov dword [ebp - 0x9f0], ecx
jmp 0x511f04
mov edx, dword [ebp - 0xc14]
mov dword [ebp - 0x14d0], edx
cmp dword [ebp - 0x14d0], 0
jne 0x51207e
push ebx
or ebx, 0xc971
xor ebx, 0x1544e
pop ebx
push ecx
push ecx
add esp, 4
or ecx, 0x68d
and ecx, 0x9ab0
call 0x51206c
add byte [ebp + 0x4f], al
inc edi
inc ebx
inc ebx
cmp byte [esi + 0x4c], al
aaa
add esp, 4
pop ecx
mov eax, dword [ebp - 0x4d0]
mov dword [ebp - 0xa5c], eax
jmp 0x5120bf
jmp 0x511dcc