joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417d03
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x41dcd4], ebx
push esi
push edi
jne 0x417d83
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x417dbe
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x41af98
push edi
call esi
test eax, eax
mov dword [0x41dcd4], eax
je 0x417dbe
push 0x41af88
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x41dcd8], eax
call esi
cmp dword [0x41dae4], 2
mov dword [0x41dcdc], eax
jne 0x417d83
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x41dce4], eax
je 0x417d83
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x41dce0], eax
mov eax, dword [0x41dce0]
test eax, eax
je 0x417dc8
call eax
test eax, eax
je 0x417daf
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x41dce4]
test eax, eax
je 0x417daf
test byte [ebp - 8], 1
jne 0x417dc8
cmp dword [0x41daf0], 4
jb 0x417dc2
or byte [ebp + 0x12], 0x20
jmp 0x417de7
xor eax, eax
jmp 0x417df7
or byte [ebp + 0x12], 4
jmp 0x417de7
mov eax, dword [0x41dcd8]
test eax, eax
je 0x417de7
call eax
mov ebx, eax
test ebx, ebx
je 0x417de7
mov eax, dword [0x41dcdc]
test eax, eax
je 0x417de7
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x41dcd4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x417ea1
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.004153a0
mov eax, dword [0x41d0a0]
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
cmp ebx, dword [0x41f900]
mov dword [ebp - 4], eax
jae 0x417fe4
mov eax, ebx
sar eax, 5
mov eax, dword [eax*4 + 0x41f920]
mov ecx, ebx
and ecx, 0x1f
test byte [eax + ecx*8 + 4], 1
je 0x417fe4
push 1
push esi
push ebx
call fcn.00414a66
add esp, 0xc
cmp eax, 0xffffffff
mov dword [ebp - 0x1008], eax
je 0x417fee
push 2
push esi
push ebx
call fcn.00414a66
add esp, 0xc
cmp eax, 0xffffffff
je 0x417fee
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
test edi, edi
jle 0x417f8e
push 0x1000
lea eax, [ebp - 0x1004]
push esi
push eax
call fcn.00415020
push 0x8000
push ebx
call fcn.0041877a
add esp, 0x14
mov dword [ebp + 8], eax
mov eax, 0x1000
cmp edi, eax
jge 0x417f4d
mov eax, edi
push eax
lea eax, [ebp - 0x1004]
push eax
push ebx
call fcn.004145bd
add esp, 0xc
cmp eax, 0xffffffff
je 0x417f6b
sub edi, eax
test edi, edi
jg 0x417f42
jmp 0x417f81
cmp dword [0x41dadc], 5
jne 0x417f7e
mov dword [0x41dad8], 0xd
or esi, 0xffffffff
push dword [ebp + 8]
push ebx
call fcn.0041877a
pop ecx
pop ecx
jmp 0x417fce
jge 0x417fce
push 0
push dword [ebp + 0xc]
push ebx
call fcn.00414a66
push ebx
call fcn.00416b7f
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
cmp esi, 0xffffffff
jne 0x417fce
mov dword [0x41dad8], 0xd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x41dadc], eax
push 0
push dword [ebp - 0x1008]
push ebx
call fcn.00414a66
add esp, 0xc
mov eax, esi
pop edi
jmp 0x417ff1
mov dword [0x41dad8], 9
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.00414d89
leave
ret
Function at 0x9eb920
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
test edi, edi
je 0x9eb96c
mov cl, byte [ebx + esi]
mov dl, cl
mov al, cl
shr dl, 1
and al, 0xfe
not dl
movzx eax, al
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
or cl, 1
test dl, 2
movzx ecx, cl
cmove ecx, eax
mov byte [ebx + esi], cl
inc esi
cmp esi, edi
jb 0x9eb932
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x9eb9d0
Capabilities:
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0xf0000040
push 1
push 0
push 0
lea edi, [esi + 4]
mov dword [esi], 0
push esi
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x9eba22
push edi
push 0
push 0
push 0x8002
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x9eba28
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esi], 0
pop edi
xor eax, eax
pop esi
pop ebp
ret
pop edi
mov eax, 1
pop esi
pop ebp
ret

Function at 0xa03f15
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00a03bd5

Function at 0xa08d0f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00a08b8e

Function at 0xa0e2c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0xa0e2ed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0xa0e2ed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
jmp fcn.00401219
Function at 0x40987c
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409930
jmp 0x409925
cmp dword [esi + 0x10], 0x1000
jne 0x409911
test byte [esi + 0x15], 1
jne 0x409911
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x4098d0
cmp eax, 2
je 0x4098d0
cmp eax, 0x10
je 0x4098d0
cmp eax, 0x20
jne 0x4098e5
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4098e5
mov bl, 1
xor ebp, ebp
jmp 0x4098f6
mov eax, dword [esi]
add eax, ebp
call fcn.00409874
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x4098e9
test bl, bl
je 0x409911
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409930
mov eax, dword [esi + 4]
cmp eax, edi
je 0x4098a8
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43300c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x454500
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x3d000]
push edi
or ebp, 0xffffffff
jmp 0x454522
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x454529
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x454518
mov eax, 1
add ebx, ebx
jne 0x45453b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x454530
jne 0x45454c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x454530
xor ecx, ecx
sub eax, 3
jb 0x454560
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4545d2
mov ebp, eax
add ebx, ebx
jne 0x45456b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x454578
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x45459c
inc ecx
add ebx, ebx
jne 0x454588
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x45457d
jne 0x454599
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x45457d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4545bc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4545ad
jmp 0x45451e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4545bc
add edi, ecx
jmp 0x45451e
pop esi
mov edi, esi
mov ecx, 0x21
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4545da
cmp byte [edi], 0x30
jne 0x4545da
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4545df
lea edi, [esi + 0x52000]
mov eax, dword [edi]
or eax, eax
je 0x454657
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x54a0c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x54a48]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x45460c
mov ecx, edi
jns 0x45463b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x54a4c]
or eax, eax
je 0x454651
mov dword [ebx], eax
add ebx, 4
jmp 0x454629
call dword [esi + 0x54a5c]
mov ebp, dword [esi + 0x54a50]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1cf]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x45468b
sub esp, 0xffffff80
jmp 0x401094

Function at 0x40c006
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ecx, 0xcbf
mov ebx, edx
xor word [eax], dx
lea edx, [ebx + edx]
xchg dh, dl
lea eax, [eax + 2]
loop 0x40c00e
pop ebx
ret
Function at 0x4d93f0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.004083f0
xor eax, eax
push ebp
push 0x4d952f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x4d9502
xor edx, edx
push ebp
push 0x4d94fb
push dword fs:[edx]
mov dword fs:[edx], esp
mov esi, dword [ebp - 4]
mov eax, esi
test eax, eax
je 0x4d943d
sub eax, 4
mov eax, dword [eax]
add eax, eax
add eax, 2
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x4d94d0
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
xor edx, edx
push ebp
push 0x4d94bf
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, esi
test eax, eax
je 0x4d9482
sub eax, 4
mov eax, dword [eax]
mov esi, eax
add esi, esi
mov eax, dword [ebp - 4]
call fcn.00408f4c
lea ecx, [esi + 2]
mov edx, ebx
call fcn.00404874
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 0xd
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d94c6
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x75ec18]
mov dl, 1
mov eax, dword [0x41b29c]
call fcn.00427368
call fcn.00407a08
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d9536
lea eax, [ebp - 4]
call fcn.0040830c
ret

Function at 0x4fecbc
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
mov eax, ebx
call fcn.004fed6c
test eax, eax
je 0x4fecf7
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, ebx
call fcn.004fed6c
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00408494
jmp 0x4fed05
mov ecx, esi
mov edx, 0x4fed24
mov eax, ebx
call fcn.004fec08
lea eax, [ebx + 0x1c]
mov edx, dword [esi]
call fcn.004086ec
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x508df1
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1fbc
push ebx
push esi
push edi
push edi
jmp 0x508e03
or edi, 0x362e
pop edi
push edx
sub edx, 0x17ff7
add bl, ch
pop es
pop edx
Function at 0x508f00
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add bl, ch
pop es
dec ebx
cmp al, 0x4c
xor eax, 0x5a344e44
push edx
push eax
add esp, 4
sub edx, 0x14e8f
jmp 0x508e2e
pop edx
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
mov word [ebp - 0x1ee4], dx
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push edi
xor edi, 0x7814
xor edi, 0x3527
pop edi
push edx
push ebx
add esp, 4
call 0x508f00
add byte [ecx + 0x32], cl
aaa
dec esp
dec ebx
cmp dword [esi + 0x3d], ecx
push eax
add esp, 4
add edx, 0xb5f0
xor edx, 0x473b
pop edx
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push ebx
push ebx
add esp, 4
add ebx, 0x9abe
or ebx, 0x6c8
add ebx, 0xaca3
pop ebx
push ecx
add ecx, 0xf6ca
xor ecx, 0x4d42
add ecx, 0x135d4
and ecx, 0xc87a
pop ecx
mov dword [ebp - 0x10], 1
push ecx
push esi
add esp, 4
call 0x508f98
add byte [esp + edi + 0x47], cl
dec ebx
dec ebx
cmp esi, dword [esi]
dec ebx
inc esp
add esp, 4
and ecx, 0x1796b
pop ecx
push edi
sub edi, 0x69c8
sub edi, 0x14cda
xor edi, 0x5658
pop edi
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push esi
push eax
add esp, 4
add esi, 0xe69
add esi, 0xdefa
or esi, 0x7a8c
or esi, 0x16379
pop esi
push edx
or edx, 0x11579
and edx, 0x52aa
xor edx, 0x15fdc
pop edx
push ebx
push edi
add esp, 4
call 0x509027
add byte [0x4a4f3f3e], dh
xor al, 0x33
dec edx
add esp, 4
call 0x509039
add byte [ebp + 0x33], al
dec edx
dec ebx
inc esp
xor al, 0x47
cmp al, 0x83
les eax, [ebx + ebx*2]
push ebx
jmp 0x509045
pop ebx
mov dword [ebp - 0x2c], 1
push esi
xor esi, 0x5a60
and esi, 0x332
pop esi
push ecx
call 0x509069
add byte [ebp + 0x38], al
xor al, byte [esi + edi + 0x3c]
aas
add esp, 4
and ecx, 0xf6eb
jmp 0x509078
sub ecx, 0xd739
pop ecx
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x138
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x509260
Function at 0x508f98
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add bl, ch
pop es
dec ebx
cmp al, 0x4c
xor eax, 0x5a344e44
push edx
push eax
add esp, 4
sub edx, 0x14e8f
jmp 0x508e2e
pop edx
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
mov word [ebp - 0x1ee4], dx
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push edi
xor edi, 0x7814
xor edi, 0x3527
pop edi
push edx
push ebx
add esp, 4
call 0x508f00
add byte [ecx + 0x32], cl
aaa
dec esp
dec ebx
cmp dword [esi + 0x3d], ecx
push eax
add esp, 4
add edx, 0xb5f0
xor edx, 0x473b
pop edx
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push ebx
push ebx
add esp, 4
add ebx, 0x9abe
or ebx, 0x6c8
add ebx, 0xaca3
pop ebx
push ecx
add ecx, 0xf6ca
xor ecx, 0x4d42
add ecx, 0x135d4
and ecx, 0xc87a
pop ecx
mov dword [ebp - 0x10], 1
push ecx
push esi
add esp, 4
call 0x508f98
add byte [esp + edi + 0x47], cl
dec ebx
dec ebx
cmp esi, dword [esi]
dec ebx
inc esp
add esp, 4
and ecx, 0x1796b
pop ecx
push edi
sub edi, 0x69c8
sub edi, 0x14cda
xor edi, 0x5658
pop edi
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push esi
push eax
add esp, 4
add esi, 0xe69
add esi, 0xdefa
or esi, 0x7a8c
or esi, 0x16379
pop esi
push edx
or edx, 0x11579
and edx, 0x52aa
xor edx, 0x15fdc
pop edx
push ebx
push edi
add esp, 4
call 0x509027
add byte [0x4a4f3f3e], dh
xor al, 0x33
dec edx
add esp, 4
call 0x509039
add byte [ebp + 0x33], al
dec edx
dec ebx
inc esp
xor al, 0x47
cmp al, 0x83
les eax, [ebx + ebx*2]
push ebx
jmp 0x509045
pop ebx
mov dword [ebp - 0x2c], 1
push esi
xor esi, 0x5a60
and esi, 0x332
pop esi
push ecx
call 0x509069
add byte [ebp + 0x38], al
xor al, byte [esi + edi + 0x3c]
aas
add esp, 4
and ecx, 0xf6eb
jmp 0x509078
sub ecx, 0xd739
pop ecx
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x138
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x509260
Function at 0x509027
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add bl, ch
pop es
dec ebx
cmp al, 0x4c
xor eax, 0x5a344e44
push edx
push eax
add esp, 4
sub edx, 0x14e8f
jmp 0x508e2e
pop edx
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
mov word [ebp - 0x1ee4], dx
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push edi
xor edi, 0x7814
xor edi, 0x3527
pop edi
push edx
push ebx
add esp, 4
call 0x508f00
add byte [ecx + 0x32], cl
aaa
dec esp
dec ebx
cmp dword [esi + 0x3d], ecx
push eax
add esp, 4
add edx, 0xb5f0
xor edx, 0x473b
pop edx
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push ebx
push ebx
add esp, 4
add ebx, 0x9abe
or ebx, 0x6c8
add ebx, 0xaca3
pop ebx
push ecx
add ecx, 0xf6ca
xor ecx, 0x4d42
add ecx, 0x135d4
and ecx, 0xc87a
pop ecx
mov dword [ebp - 0x10], 1
push ecx
push esi
add esp, 4
call 0x508f98
add byte [esp + edi + 0x47], cl
dec ebx
dec ebx
cmp esi, dword [esi]
dec ebx
inc esp
add esp, 4
and ecx, 0x1796b
pop ecx
push edi
sub edi, 0x69c8
sub edi, 0x14cda
xor edi, 0x5658
pop edi
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push esi
push eax
add esp, 4
add esi, 0xe69
add esi, 0xdefa
or esi, 0x7a8c
or esi, 0x16379
pop esi
push edx
or edx, 0x11579
and edx, 0x52aa
xor edx, 0x15fdc
pop edx
push ebx
push edi
add esp, 4
call 0x509027
add byte [0x4a4f3f3e], dh
xor al, 0x33
dec edx
add esp, 4
call 0x509039
add byte [ebp + 0x33], al
dec edx
dec ebx
inc esp
xor al, 0x47
cmp al, 0x83
les eax, [ebx + ebx*2]
push ebx
jmp 0x509045
pop ebx
mov dword [ebp - 0x2c], 1
push esi
xor esi, 0x5a60
and esi, 0x332
pop esi
push ecx
call 0x509069
add byte [ebp + 0x38], al
xor al, byte [esi + edi + 0x3c]
aas
add esp, 4
and ecx, 0xf6eb
jmp 0x509078
sub ecx, 0xd739
pop ecx
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x138
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x509260