joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50e154
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edi
push ebx
push esi
add esp, 4
or ebx, 0xa587
or ebx, 0x153f7
pop ebx
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
mov word [ebp - 0x1ee4], dx
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push esi
push eax
add esp, 4
add esi, 0x124f6
pop esi
push ebx
push ecx
add esp, 4
or ebx, 0x18282
pop ebx
push edi
push edx
add esp, 4
jmp 0x50e23c
sub edi, 0x9514
pop edi
push ecx
or ecx, 0x969b
pop ecx
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push eax
add eax, 0xff68
sub eax, 0x17765
or eax, 0x3b99
pop eax
push esi
push edx
add esp, 4
and esi, 0x9f2a
add esi, 0x6eb4
add esi, 0x8238
add esi, 0xac3e
pop esi
mov dword [ebp - 0x10], 1
push eax
or eax, 0x1d4
add eax, 0x12566
pop eax
push edx
push edx
add esp, 4
and edx, 0xccee
xor edx, 0xb817
call 0x50e2ed
add byte [edx + 0x3f], cl
cmp esi, dword [edx]
xor eax, 0x5035493b
add esp, 4
pop edx
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push ecx
push ecx
add esp, 4
jmp 0x50e328
pop ecx
push ecx
add ecx, 0x11fb0
sub ecx, 0x12266
pop ecx
push eax
push ebx
add esp, 4
sub eax, 0x14350
pop eax
push edi
push edi
add esp, 4
and edi, 0x5e6b
pop edi
push ebx
xor ebx, 0xcfa
sub ebx, 0x4842
call 0x50e36a
add byte [0x3833363e], dh
dec edi
inc esp
push eax
add esp, 4
pop ebx
push ecx
call 0x50e37d
add byte [eax + edx*2 + 0x48], al
inc ebx
inc eax
cmp eax, 0xc4834d4d
add al, 0x59
mov dword [ebp - 0x2c], 1
push ebx
push ebx
add esp, 4
call 0x50e399
add byte [ebx], dh
inc esi
inc ebx
xor al, 0x3a
xor eax, 0x5b04c483
push esi
or esi, 0xd722
and esi, 0x185bf
jmp 0x50e3b3
add esi, 0xd3f9
pop esi
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x138
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x50e59b
Function at 0x50e2ed
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edi
push ebx
push esi
add esp, 4
or ebx, 0xa587
or ebx, 0x153f7
pop ebx
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
mov word [ebp - 0x1ee4], dx
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push esi
push eax
add esp, 4
add esi, 0x124f6
pop esi
push ebx
push ecx
add esp, 4
or ebx, 0x18282
pop ebx
push edi
push edx
add esp, 4
jmp 0x50e23c
sub edi, 0x9514
pop edi
push ecx
or ecx, 0x969b
pop ecx
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push eax
add eax, 0xff68
sub eax, 0x17765
or eax, 0x3b99
pop eax
push esi
push edx
add esp, 4
and esi, 0x9f2a
add esi, 0x6eb4
add esi, 0x8238
add esi, 0xac3e
pop esi
mov dword [ebp - 0x10], 1
push eax
or eax, 0x1d4
add eax, 0x12566
pop eax
push edx
push edx
add esp, 4
and edx, 0xccee
xor edx, 0xb817
call 0x50e2ed
add byte [edx + 0x3f], cl
cmp esi, dword [edx]
xor eax, 0x5035493b
add esp, 4
pop edx
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push ecx
push ecx
add esp, 4
jmp 0x50e328
pop ecx
push ecx
add ecx, 0x11fb0
sub ecx, 0x12266
pop ecx
push eax
push ebx
add esp, 4
sub eax, 0x14350
pop eax
push edi
push edi
add esp, 4
and edi, 0x5e6b
pop edi
push ebx
xor ebx, 0xcfa
sub ebx, 0x4842
call 0x50e36a
add byte [0x3833363e], dh
dec edi
inc esp
push eax
add esp, 4
pop ebx
push ecx
call 0x50e37d
add byte [eax + edx*2 + 0x48], al
inc ebx
inc eax
cmp eax, 0xc4834d4d
add al, 0x59
mov dword [ebp - 0x2c], 1
push ebx
push ebx
add esp, 4
call 0x50e399
add byte [ebx], dh
inc esi
inc ebx
xor al, 0x3a
xor eax, 0x5b04c483
push esi
or esi, 0xd722
and esi, 0x185bf
jmp 0x50e3b3
add esi, 0xd3f9
pop esi
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x138
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x50e59b
Function at 0x50e36a
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edi
push ebx
push esi
add esp, 4
or ebx, 0xa587
or ebx, 0x153f7
pop ebx
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
mov word [ebp - 0x1ee4], dx
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push esi
push eax
add esp, 4
add esi, 0x124f6
pop esi
push ebx
push ecx
add esp, 4
or ebx, 0x18282
pop ebx
push edi
push edx
add esp, 4
jmp 0x50e23c
sub edi, 0x9514
pop edi
push ecx
or ecx, 0x969b
pop ecx
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push eax
add eax, 0xff68
sub eax, 0x17765
or eax, 0x3b99
pop eax
push esi
push edx
add esp, 4
and esi, 0x9f2a
add esi, 0x6eb4
add esi, 0x8238
add esi, 0xac3e
pop esi
mov dword [ebp - 0x10], 1
push eax
or eax, 0x1d4
add eax, 0x12566
pop eax
push edx
push edx
add esp, 4
and edx, 0xccee
xor edx, 0xb817
call 0x50e2ed
add byte [edx + 0x3f], cl
cmp esi, dword [edx]
xor eax, 0x5035493b
add esp, 4
pop edx
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push ecx
push ecx
add esp, 4
jmp 0x50e328
pop ecx
push ecx
add ecx, 0x11fb0
sub ecx, 0x12266
pop ecx
push eax
push ebx
add esp, 4
sub eax, 0x14350
pop eax
push edi
push edi
add esp, 4
and edi, 0x5e6b
pop edi
push ebx
xor ebx, 0xcfa
sub ebx, 0x4842
call 0x50e36a
add byte [0x3833363e], dh
dec edi
inc esp
push eax
add esp, 4
pop ebx
push ecx
call 0x50e37d
add byte [eax + edx*2 + 0x48], al
inc ebx
inc eax
cmp eax, 0xc4834d4d
add al, 0x59
mov dword [ebp - 0x2c], 1
push ebx
push ebx
add esp, 4
call 0x50e399
add byte [ebx], dh
inc esi
inc ebx
xor al, 0x3a
xor eax, 0x5b04c483
push esi
or esi, 0xd722
and esi, 0x185bf
jmp 0x50e3b3
add esi, 0xd3f9
pop esi
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x138
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x50e59b
Function at 0x50e37d
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edi
push ebx
push esi
add esp, 4
or ebx, 0xa587
or ebx, 0x153f7
pop ebx
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
mov word [ebp - 0x1ee4], dx
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push esi
push eax
add esp, 4
add esi, 0x124f6
pop esi
push ebx
push ecx
add esp, 4
or ebx, 0x18282
pop ebx
push edi
push edx
add esp, 4
jmp 0x50e23c
sub edi, 0x9514
pop edi
push ecx
or ecx, 0x969b
pop ecx
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push eax
add eax, 0xff68
sub eax, 0x17765
or eax, 0x3b99
pop eax
push esi
push edx
add esp, 4
and esi, 0x9f2a
add esi, 0x6eb4
add esi, 0x8238
add esi, 0xac3e
pop esi
mov dword [ebp - 0x10], 1
push eax
or eax, 0x1d4
add eax, 0x12566
pop eax
push edx
push edx
add esp, 4
and edx, 0xccee
xor edx, 0xb817
call 0x50e2ed
add byte [edx + 0x3f], cl
cmp esi, dword [edx]
xor eax, 0x5035493b
add esp, 4
pop edx
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push ecx
push ecx
add esp, 4
jmp 0x50e328
pop ecx
push ecx
add ecx, 0x11fb0
sub ecx, 0x12266
pop ecx
push eax
push ebx
add esp, 4
sub eax, 0x14350
pop eax
push edi
push edi
add esp, 4
and edi, 0x5e6b
pop edi
push ebx
xor ebx, 0xcfa
sub ebx, 0x4842
call 0x50e36a
add byte [0x3833363e], dh
dec edi
inc esp
push eax
add esp, 4
pop ebx
push ecx
call 0x50e37d
add byte [eax + edx*2 + 0x48], al
inc ebx
inc eax
cmp eax, 0xc4834d4d
add al, 0x59
mov dword [ebp - 0x2c], 1
push ebx
push ebx
add esp, 4
call 0x50e399
add byte [ebx], dh
inc esi
inc ebx
xor al, 0x3a
xor eax, 0x5b04c483
push esi
or esi, 0xd722
and esi, 0x185bf
jmp 0x50e3b3
add esi, 0xd3f9
pop esi
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x138
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x50e59b
Function at 0x50e399
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edi
push ebx
push esi
add esp, 4
or ebx, 0xa587
or ebx, 0x153f7
pop ebx
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
mov word [ebp - 0x1ee4], dx
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push esi
push eax
add esp, 4
add esi, 0x124f6
pop esi
push ebx
push ecx
add esp, 4
or ebx, 0x18282
pop ebx
push edi
push edx
add esp, 4
jmp 0x50e23c
sub edi, 0x9514
pop edi
push ecx
or ecx, 0x969b
pop ecx
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push eax
add eax, 0xff68
sub eax, 0x17765
or eax, 0x3b99
pop eax
push esi
push edx
add esp, 4
and esi, 0x9f2a
add esi, 0x6eb4
add esi, 0x8238
add esi, 0xac3e
pop esi
mov dword [ebp - 0x10], 1
push eax
or eax, 0x1d4
add eax, 0x12566
pop eax
push edx
push edx
add esp, 4
and edx, 0xccee
xor edx, 0xb817
call 0x50e2ed
add byte [edx + 0x3f], cl
cmp esi, dword [edx]
xor eax, 0x5035493b
add esp, 4
pop edx
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push ecx
push ecx
add esp, 4
jmp 0x50e328
pop ecx
push ecx
add ecx, 0x11fb0
sub ecx, 0x12266
pop ecx
push eax
push ebx
add esp, 4
sub eax, 0x14350
pop eax
push edi
push edi
add esp, 4
and edi, 0x5e6b
pop edi
push ebx
xor ebx, 0xcfa
sub ebx, 0x4842
call 0x50e36a
add byte [0x3833363e], dh
dec edi
inc esp
push eax
add esp, 4
pop ebx
push ecx
call 0x50e37d
add byte [eax + edx*2 + 0x48], al
inc ebx
inc eax
cmp eax, 0xc4834d4d
add al, 0x59
mov dword [ebp - 0x2c], 1
push ebx
push ebx
add esp, 4
call 0x50e399
add byte [ebx], dh
inc esi
inc ebx
xor al, 0x3a
xor eax, 0x5b04c483
push esi
or esi, 0xd722
and esi, 0x185bf
jmp 0x50e3b3
add esi, 0xd3f9
pop esi
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x138
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x50e59b
Function at 0x512562
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor edx, 0x16438
pop edx
mov ecx, dword [ebp - 0x4d4]
mov edx, dword [ecx]
mov dword [ebp - 0x4d4], edx
mov eax, dword [ebp - 0x4d4]
cmp eax, dword [ebp - 0xc20]
je 0x512598
mov ecx, dword [ebp - 0x4d4]
cmp dword [ecx + 0x30], 0
jne 0x51234e
mov dword [ebp - 0x2e0], 0
Function at 0x513104
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ecx
push esi
add esp, 4
or ecx, 0xe6c5
pop ecx
push ecx
push edx
add esp, 4
xor ecx, 0x75b9
add ecx, 0x477b
pop ecx
push edi
xor edi, 0xc994
add edi, 0xa049
sub edi, 0xc4f4
pop edi
mov ecx, dword [ebp - 0xc34]
mov dx, word [ecx]
mov word [ebp - 0xf86], dx
mov eax, dword [ebp - 0xc34]
add eax, 2
mov dword [ebp - 0xc34], eax
mov cx, word [ebp - 0xf86]
mov word [ebp - 0x200], cx
mov edx, dword [ebp - 0xc38]
mov ax, word [edx]
mov word [ebp - 0xf88], ax
mov ecx, dword [ebp - 0xc38]
add ecx, 2
mov dword [ebp - 0xc38], ecx
mov dx, word [ebp - 0xf88]
mov word [ebp - 0x34], dx
push eax
push edi
add esp, 4
sub eax, 0x4149
pop eax
push eax
push eax
add esp, 4
sub eax, 0x121be
call fcn.00513104
add byte [eax], bh
inc eax
inc edx
aaa
inc edi
xor eax, 0x37444c46
add esp, 4
jmp 0x51310e
pop eax
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x51312c
movzx ecx, word [ebp - 0x200]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x14fc], ecx
jmp 0x513186
movzx eax, word [ebp - 0x200]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x513054
movzx edx, word [ebp - 0x200]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x513054
movzx ecx, word [ebp - 0x200]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x513170
mov dword [ebp - 0x14f8], 0xffffffff
jmp 0x51317a
mov dword [ebp - 0x14f8], 1
mov eax, dword [ebp - 0x14f8]
mov dword [ebp - 0x14fc], eax
cmp dword [ebp - 0x14fc], 0
jne 0x5131cf
push ebx
push ecx
add esp, 4
and ebx, 0x10532
pop ebx
push eax
push eax
add esp, 4
jmp 0x5131a8
pop eax
push esi
push edi
add esp, 4
xor esi, 0x13424
or esi, 0x17708
or esi, 0x875a
pop esi
mov ecx, dword [ebp - 0x4dc]
mov dword [ebp - 0x2e0], ecx
jmp 0x513237
push ecx
add ecx, 0xfa03
xor ecx, 0x7721
xor ecx, 0x16638
pop ecx
push esi
push eax
add esp, 4
add esi, 0x168b7
or esi, 0x10d71
xor esi, 0x24f1
or esi, 0x133b1
pop esi
mov edx, dword [ebp - 0x4dc]
mov eax, dword [edx]
mov dword [ebp - 0x4dc], eax
mov ecx, dword [ebp - 0x4dc]
cmp ecx, dword [ebp - 0xc3c]
je 0x51322d
mov edx, dword [ebp - 0x4dc]
cmp dword [edx + 0x30], 0
jne 0x512ff8
mov dword [ebp - 0x2e0], 0
Function at 0x513a54
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
sub edx, 0x164b
add edx, 0xec8e
or edx, 0xc35a
pop edx
push edi
and edi, 0xd369
or edi, 0x26c3
pop edi
mov ecx, dword [ebp - 0x4e4]
mov dword [ebp - 0x2a8], ecx
jmp 0x513aee
Function at 0x513d5b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
xor ebx, 0x16cbf
pop ebx
push esi
push edx
add esp, 4
or esi, 0xcab4
pop esi
push edi
or edi, 0x7d7
and edi, 0x315
call 0x513d5b
add byte [ebx + 0x49], al
inc ebp
inc ebp
inc ecx
cmp dword [esi - 0x7d], ecx
les eax, [edi + ebx*2]
lea eax, [ebp - 0x16e8]
mov dword [ebp - 0xc54], eax
mov ecx, dword [ebp - 0x4e8]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc50], edx
xor eax, eax
mov word [ebp - 0x208], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
push edi
sub edi, 0xcc22
and edi, 0x347d
sub edi, 0x8261
pop edi
push esi
push esi
add esp, 4
add esi, 0x11e77
sub esi, 0xd49a
pop esi
push edi
push ebx
add esp, 4
and edi, 0x179d5
pop edi
mov edx, dword [ebp - 0xc50]
mov ax, word [edx]
mov word [ebp - 0xf8e], ax
mov ecx, dword [ebp - 0xc50]
add ecx, 2
mov dword [ebp - 0xc50], ecx
mov dx, word [ebp - 0xf8e]
mov word [ebp - 0x208], dx
mov eax, dword [ebp - 0xc54]
mov cx, word [eax]
mov word [ebp - 0xf90], cx
mov edx, dword [ebp - 0xc54]
add edx, 2
mov dword [ebp - 0xc54], edx
mov ax, word [ebp - 0xf90]
mov word [ebp - 0x3c], ax
push ecx
add ecx, 0x5ff0
and ecx, 0x17b95
xor ecx, 0xb714
and ecx, 0x12885
pop ecx
push edx
push edi
add esp, 4
or edx, 0x13ec
pop edx
push ebx
push edx
add esp, 4
add ebx, 0x8e2
pop ebx
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x513e61
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x1560], edx
jmp 0x513ebb
movzx ecx, word [ebp - 0x208]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x513d89
movzx eax, word [ebp - 0x208]
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x513d89
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x513ea5
mov dword [ebp - 0x151c], 0xffffffff
jmp 0x513eaf
mov dword [ebp - 0x151c], 1
mov ecx, dword [ebp - 0x151c]
mov dword [ebp - 0x1560], ecx
cmp dword [ebp - 0x1560], 0
jne 0x513f04
push ecx
push edi
add esp, 4
jmp 0x513ed1
or ecx, 0x1ca3
sub ecx, 0x15cbf
pop ecx
push ecx
push edi
add esp, 4
sub ecx, 0x5683
or ecx, 0xeb08
sub ecx, 0xcf93
pop ecx
mov edx, dword [ebp - 0x4e8]
mov dword [ebp - 0x710], edx
jmp 0x513f6c
push edi
push esi
add esp, 4
xor edi, 0x9266
or edi, 0x1c32
call 0x513f23
add byte [ebx], bh
cmp ecx, dword [ebp + 0x3f]
dec ebx
cmp byte [ecx + 0x3a], cl
add esp, 4
call 0x513f32
add byte [edi + eax*2 + 0x48], cl
inc esp
cmp byte [ebx + eax*4], bh
les eax, [edi + ebx*2]
mov eax, dword [ebp - 0x4e8]
mov ecx, dword [eax]
mov dword [ebp - 0x4e8], ecx
mov edx, dword [ebp - 0x4e8]
cmp edx, dword [ebp - 0xc58]
je 0x513f62
mov eax, dword [ebp - 0x4e8]
cmp dword [eax + 0x30], 0
jne 0x513d2d
invalid
Function at 0x513f23
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
xor ebx, 0x16cbf
pop ebx
push esi
push edx
add esp, 4
or esi, 0xcab4
pop esi
push edi
or edi, 0x7d7
and edi, 0x315
call 0x513d5b
add byte [ebx + 0x49], al
inc ebp
inc ebp
inc ecx
cmp dword [esi - 0x7d], ecx
les eax, [edi + ebx*2]
lea eax, [ebp - 0x16e8]
mov dword [ebp - 0xc54], eax
mov ecx, dword [ebp - 0x4e8]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc50], edx
xor eax, eax
mov word [ebp - 0x208], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
push edi
sub edi, 0xcc22
and edi, 0x347d
sub edi, 0x8261
pop edi
push esi
push esi
add esp, 4
add esi, 0x11e77
sub esi, 0xd49a
pop esi
push edi
push ebx
add esp, 4
and edi, 0x179d5
pop edi
mov edx, dword [ebp - 0xc50]
mov ax, word [edx]
mov word [ebp - 0xf8e], ax
mov ecx, dword [ebp - 0xc50]
add ecx, 2
mov dword [ebp - 0xc50], ecx
mov dx, word [ebp - 0xf8e]
mov word [ebp - 0x208], dx
mov eax, dword [ebp - 0xc54]
mov cx, word [eax]
mov word [ebp - 0xf90], cx
mov edx, dword [ebp - 0xc54]
add edx, 2
mov dword [ebp - 0xc54], edx
mov ax, word [ebp - 0xf90]
mov word [ebp - 0x3c], ax
push ecx
add ecx, 0x5ff0
and ecx, 0x17b95
xor ecx, 0xb714
and ecx, 0x12885
pop ecx
push edx
push edi
add esp, 4
or edx, 0x13ec
pop edx
push ebx
push edx
add esp, 4
add ebx, 0x8e2
pop ebx
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x513e61
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x1560], edx
jmp 0x513ebb
movzx ecx, word [ebp - 0x208]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x513d89
movzx eax, word [ebp - 0x208]
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x513d89
movzx edx, word [ebp - 0x208]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x513ea5
mov dword [ebp - 0x151c], 0xffffffff
jmp 0x513eaf
mov dword [ebp - 0x151c], 1
mov ecx, dword [ebp - 0x151c]
mov dword [ebp - 0x1560], ecx
cmp dword [ebp - 0x1560], 0
jne 0x513f04
push ecx
push edi
add esp, 4
jmp 0x513ed1
or ecx, 0x1ca3
sub ecx, 0x15cbf
pop ecx
push ecx
push edi
add esp, 4
sub ecx, 0x5683
or ecx, 0xeb08
sub ecx, 0xcf93
pop ecx
mov edx, dword [ebp - 0x4e8]
mov dword [ebp - 0x710], edx
jmp 0x513f6c
push edi
push esi
add esp, 4
xor edi, 0x9266
or edi, 0x1c32
call 0x513f23
add byte [ebx], bh
cmp ecx, dword [ebp + 0x3f]
dec ebx
cmp byte [ecx + 0x3a], cl
add esp, 4
call 0x513f32
add byte [edi + eax*2 + 0x48], cl
inc esp
cmp byte [ebx + eax*4], bh
les eax, [edi + ebx*2]
mov eax, dword [ebp - 0x4e8]
mov ecx, dword [eax]
mov dword [ebp - 0x4e8], ecx
mov edx, dword [ebp - 0x4e8]
cmp edx, dword [ebp - 0xc58]
je 0x513f62
mov eax, dword [ebp - 0x4e8]
cmp dword [eax + 0x30], 0
jne 0x513d2d
invalid