joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2fd610dc
Capabilities:
Terminate process

Disassembly:
call 0x2fd610e6
jmp 0x2fd611c3
push 0x58
push 0x2fd612d8
call fcn.2fd61300
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [0x2fd61028]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x2fd63044
push 0
push esi
push edi
call dword [0x2fd6102c]
test eax, eax
jne 0x2fd618e7
xor esi, esi
inc esi
mov eax, dword [0x2fd63040]
cmp eax, esi
je 0x2fd61905
mov eax, dword [0x2fd63040]
test eax, eax
jne 0x2fd61578
mov dword [0x2fd63040], esi
push 0x2fd612d0
push 0x2fd612c8
call sub.MSVCR80.dll__initterm_e
pop ecx
pop ecx
test eax, eax
jne 0x2fd619a7
mov eax, dword [0x2fd63040]
cmp eax, esi
jne 0x2fd6126f
push 0x2fd612c4
push 0x2fd612bc
call sub.MSVCR80.dll__initterm
pop ecx
pop ecx
mov dword [0x2fd63040], 2
test ebx, ebx
jne 0x2fd6127b
push ebx
push edi
call dword [0x2fd61034]
cmp dword [0x2fd63050], 0
jne 0x2fd61912
mov eax, dword [sym.imp.MSVCR80.dll__acmdln]
mov esi, dword [eax]
nop
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
jbe 0x2fd61538
cmp al, 0x22
je 0x2fd61528
movzx eax, al
push eax
call dword [sym.imp.MSVCR80.dll__ismbblead]
pop ecx
test eax, eax
jne 0x2fd6194b
inc esi
jmp 0x2fd61290
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
jmp 0x2fd612a5
test al, al
je 0x2fd61546
cmp dword [ebp - 0x1c], 0
jne 0x2fd6129d
mov al, byte [esi]
test al, al
je 0x2fd61556
cmp al, 0x20
ja 0x2fd61556
inc esi
mov dword [ebp - 0x20], esi
jmp 0x2fd61546
test byte [ebp - 0x3c], 1
jne 0x2fd61572
push 0xa
pop eax
push eax
push esi
push 0
push 0x2fd60000
call fcn.2fd61583
jmp 0x2fd61936
movzx eax, word [ebp - 0x38]
jmp 0x2fd6155f
mov dword [0x2fd63058], esi
jmp 0x2fd6124b
cmp eax, esi
jne 0x2fd618f5
xor esi, esi
inc esi
mov ebx, esi
jmp 0x2fd61212
push 0x3e8
call dword [0x2fd61030]
jmp 0x2fd611fd
push 0x1f
call sub.MSVCR80.dll__amsg_exit
pop ecx
jmp 0x2fd6124b
push 0x2fd63050
call fcn.2fd61ef1
pop ecx
test eax, eax
je 0x2fd61288
push 0
push 2
push 0
call dword [0x2fd63050]
jmp 0x2fd61288
mov dword [0x2fd63054], eax
cmp dword [0x2fd63020], 0
jne 0x2fd61983
push eax
call dword [sym.imp.MSVCR80.dll_exit]
inc esi
mov dword [ebp - 0x20], esi
jmp 0x2fd612b8
cmp dword [0x2fd63058], 0
jne 0x2fd61992
call dword [sym.imp.MSVCR80.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x2fd63054]
jmp 0x2fd619b3
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.2fd61514
ret
Function at 0x2fd6164e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x2fd61718
push 0x80000001
mov dword [ebp - 0x10], 4
call esi
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x2fd616b8
cmp dword [ebp - 4], 0
je 0x2fd616b8
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x2fd61704
push dword [ebp - 4]
call edi
push dword [ebp - 4]
mov dword [ebp - 0x14], eax
call ebx
cmp dword [ebp - 0x14], 0
je 0x2fd618b2
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x2fd61718
push 0x80000002
call esi
test eax, eax
jne 0x2fd616fc
cmp dword [ebp - 4], eax
je 0x2fd616fc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x2fd61704
push dword [ebp - 4]
call edi
push dword [ebp - 4]
mov esi, eax
call ebx
test esi, esi
je 0x2fd618c9
xor al, al
pop edi
pop esi
pop ebx
leave
ret
cmp dword [ebp - 8], 4
jne 0x2fd616b8
xor eax, eax
cmp dword [ebp - 0xc], eax
setne al
jmp 0x2fd616fe
cmp dword [ebp - 8], 4
jne 0x2fd616fc
xor eax, eax
cmp dword [ebp - 0xc], eax
jmp 0x2fd618c1
Function at 0x56dea8
Capabilities:
Resume thread

Disassembly:
call 0x756e2b4
test eax, eax
jne fcn.0056de5c
mov eax, dword [edi]
pop es
mov esi, dword [eax + 0x2d]
cmp dh, cl
call dword [0x664258]
mov ecx, edi
inc dword [esi + 0x33]
rcr bl, 0x15
push dword [ebp + 0x10]
mov edi, 0x15ff2c77
inc eax
mov dword [0x45762e5e], eax
sbb byte [ecx + 0x75], bl
or edi, edi
ja 0x56defd
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, edi
mov ecx, esp
cmpsb byte [esi], byte es:[edi]
add al, byte [eax]
ret 0x18
add dl, ch
add dword [ebx + 0x581565ce], ecx
stosd dword es:[edi], eax
pop esi
add byte [esi + edx*8 - 0x51], al
jge 0x56de9d
add byte [ecx + edx - 0x75], dh
pop es
mov esi, dword [eax + 0x78]
mov ecx, esi
movsb byte es:[edi], byte [esi]
stosb byte es:[edi], al
pop eax
stosd dword es:[edi], eax
pop esi
add dh, ah
iretd

Function at 0x570528
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
stc
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x74], edi
cmp byte [eax - 0x14], ch
adc eax, 0x15ff005f
sub byte [ebp - 0x3f7aaf6d], ah
je 0x57056f
push str.RegDeleteKeyTransactedW
push eax
invalid
pop esi
add al, 0x74
or bl, byte [edi + 0x5e]
out 0xc, al
jmp dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]

Function at 0x570afa
Capabilities:
Encode data using xor

Disassembly:
call 0xea57d719
mov esi, ebx
mov al, 1
rol byte [eax], 0x85
mov esp, 0x768b0574
and bl, ch
out 0x62, al
push esi
inc ebp
dec dword [eax]
sal byte [ebp + 6], 0xd3
div byte [ebx]
call [ecx + 0x4f]
bnd jo 0x570b40
jmp 0x570b81
mov edx, 0xd74fe3b

Function at 0x5816af
Capabilities:
Print debug messages

Disassembly:
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
idiv byte cs:[eax + 0xe]
push 0xea21
push 0xfffffffffffffff4
jmp 0xa9682c93
sub byte [esi], bl
bound eax, qword [ebp - 0x10]
mov esi, 0xb7e900
test eax, eax
je 0x58167c
sub al, 0xff
ja 0x5816e2
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
je 0x5816da
push 0x5e00ea5f
push 0xfffffffffffffff4
push eax
inc dword [ebp + 0x10]
and al, 0x5e
cmp byte [edx], bh
push 0xfffffffffffffff4
cmp ch, byte [edx - 0xc]
inc dword [edx - 0x10]
call dword [0x455e4806]
push es
dec eax
pop esi
inc ebp
cmp dword [ebx + 4], 0
je 0x581705
push 1
push 0xffffffffffffffb1
push dword [edi - 0x20]
push esi
fsubr qword [edx]
pop esi
add byte [ebx + 0x18487], cl
add byte [edx + 0x36], dh
add dword [ebx + 0x4a1ffcd], edi
push dword [edi - 0xb]
mov eax, dword [0xf577ff04]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x581720
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xac]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x581744
mov eax, dword [eax]
push 1
mov esi, dword [eax + 0x5c]
into
call dword [0x5e4958]
fmul qword [ebp - 0x18]
test dh, dl
mov esi, dword [edx + ebp*2 + 1]
mov esi, dword [eax + 0x7f0178]
mov ecx, esi
call dword [0x5eab58]
mov ecx, edi
inc dword [eax]
cmp dword [ebx], 0xe900
je 0x58176f
xor eax, 0x3577ff33
call dword [0x105ed17e]
jmp 0x581772
mov ebp, ecx
invalid
push 5
push eax
call dword [0xd9ea04]
mov eax, dword [ebx + 0x14]
or eax, 0x89b78095
int3
Function at 0x5a3e9c
Capabilities:
Encode data using xor

Disassembly:
rol byte [edx], 0x89
jle 0x5a3f14
pop edi
adc al, 0x46
xor byte [esi + 0x5b], bl
pop ss
ret 8
invalid
xor eax, 0x468b174e
movsd dword es:[edi], dword [esi]
jns 0x5a3f14
dec edi
ror dword [ebx - 0x2fd403b5], 0x8d
dec ebx
cld
sub edx, eax
lea edi, [ebp + 0x34808901]

Function at 0x5b5852
Capabilities:
Encode data using xor

Disassembly:
add dword [esi - 0x75], edx
jno 0x5b579f
add eax, 0x7708d61a
adc al, 0x8b
or eax, ebp
jmp 0x5b5786
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x1d]
push esi
mov edx, dword [edi + 0x74fffae6]
pop esi
add byte [ebp + 8], al
sub eax, 0
je 0x5b5822
sub eax, 1
je 0x5b57f8
invalid

Function at 0x5be146
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, dword [ebp + 0x10]
mov bl, 0x8d
call 0x29d9dc
or ebx, eax
push 8
push 0x657f88
call 0x7b597190
mov eax, dword [ebp + 8]
push dword [eax]
aad 0xc4
idiv bh
call dword [ebp - 0x7d]
push 0x458b00fc
or al, 0x8b
add byte [ebx + 0x489b8b00], ah
dec eax
test dword [eax + ebx*8 - 0x377ce8], ecx
xor dword [edx + 0x38], esi
add dword [edi + 0x30f8810f], esp
sub esp, dword [ebp]
je 0x5be193
je 0x5be176
xchg edi, eax
add eax, 0xc7590000
inc ebp
invalid
mov dword [ebp - 0xd], 0xffff5afe
call 0x3b54e1b1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0xb100fae6], ecx
pop ecx
cmpsb byte [esi], byte es:[edi]
pop esi
pop ebx
leave
ret 0xc

Function at 0x5be822
Capabilities:
Encode data using xor

Disassembly:
call fcn.0059b090
and dword [ebp - 0x43], 0
mov eax, dword [ebp + 8]
mov dword [0xeff7e80f], eax
stosb byte es:[edi], al
call [ecx + 1]
cld
add byte [edx + 0x8b7645], dh
xor byte [esi], ah
push ds
xlatb
jns fcn.005be822
pop ecx
mov dword [0x7b1658], eax
outsd dx, dword [esi]
add dword [ebx], esi
pop ebx
add bh, bh
adc eax, 0x5e2665
mov esi, eax
mov eax, dword [0x65eb68]
mov dword [0x66d058], eax
outsb dx, byte [esi]
jne 0x5be84c
mov dword [ebp - 4], 0xffff33fe
call 0x92e914
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
mov esp, 0xc2c95b5e
or al, 0
mov esi, dword [ebp - 0x1c]
std
jb fcn.005be8e0
xor esi, dword [ecx]
call 0xffe9d874
pop ecx
ret

Function at 0x5c3670
Capabilities:
Encode data using xor
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call 0xf5be3e8
in eax, dx
jne 0x5c3688
invalid
into

Function at 0x409825
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
test esi, esi
jle 0x409855
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
push edi
movsx edi, byte [edx]
mov eax, dword [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x42a0c8]
inc edx
dec esi
mov dword [ecx], eax
jne 0x409837
pop edi
pop esi
ret
Function at 0x432002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x432072
mov ebx, 0x40c7d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x2b5e335c
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x432060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4320d2
mov ebx, 0x42f314
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x44de4b18
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x406624
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x406648
xor eax, eax
test eax, eax
je 0x40665b
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x40665b
xor ecx, ecx
jmp 0x40665e
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406787
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4698ec], 0
push esi
jne 0x4067be
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406798
mov dword [ecx*4 + 0x4698e8], eax
inc ecx
cmp ecx, 0x100
jl 0x406793
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4067ef
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4698e8]
xor eax, esi
inc ecx
dec edx
jne 0x4067d1
pop edi
not eax
pop esi
ret 0xc

Function at 0x2078d0c
Capabilities:
Encode data using xor

Disassembly:
or dword [eax + 0x2c178a58], 0x200b8e47
dec ebx
cmp byte [edi], 0xb9
sbb eax, 0x56eee2f9
stc
loop 0x2078cf6
push esi
clc
sbb al, 0x58
jmp 0x2078d16
pushal
call 0x2078d1c
pop ebp
sub ebp, 0x10
sub ebp, 0x1c78d0c
jmp 0x2078d32
mov eax, 0x1c78d0c
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b2
mov edx, 0x28aa62d
xor byte [eax], dl
inc eax
dec ecx
jne 0x2078d49
jmp 0x2078d5c
cmpsb byte [esi], byte es:[edi]
loopne 0x2078d05
movsb byte es:[edi], byte [esi]
adc dword [0xecac2d2d], ebp
aad 0x2d
sub eax, 0x95e02e2d
sub eax, 0x5972d2d
sub eax, 0x2695e02e
sub eax, 0x5972d2d
sub eax, 0xcfda2d2d
in eax, 0xa6
lodsb al, byte [esi]
and dword [0xe82e2d2d], ebp
jge 0x2078e01
inc ebp
mov ch, 0x28
adc ch, byte [0xa5aa5945]
sub al, 0x2c
add dword [ecx], ecx
inc ebp
jnp 0x2078d69
xor dword [ebp - 0x3b], esi
sub byte [0x1dc42d2d], ch
sub eax, 0x49a02d2d
or ecx, edx
movsb byte es:[edi], byte [esi]
add dword [ecx], ecx
mov al, byte [0xa62d0941]
test al, 0x25
sub eax, 0xb8a62d2d
and dword [0xa0a62d2d], ebp
cmp eax, 0xec2d2d2d
les ebp, [edi]
sbb al, 0x2f
scasb al, byte es:[edi]
out dx, eax
sub dword [edx - 0x58], esp
invalid
dec ebx
sub eax, 0x90a62d2d
and eax, 0x1e2d2d2d
in al, 0x1e
jmp [esi + 0x226528c5]
Function at 0x54d060
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [0x566bc8], 0
mov byte [0x566bcc], 0
mov esi, dword [0x566bbc]
add esi, 0xfffffac9
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov dword [0x566bc0], ecx
mov dword [0x566bc4], 0
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x566bbc], 0x1cb3
mov eax, dword [0x566bc4]
add eax, 1
mov dword [0x566bc4], eax
cmp eax, 0x100
mov dword [ebp - 0x20], eax
jl 0x54d0b3
xor eax, eax
mov dword [0x566bbc], 0x1549
mov dword [0x566bc4], 0
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov ecx, 0x100
mov dword [0x566bd0], 0
mov edx, dword [0x566bc8]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + eax]
add edi, edx
mov dword [ebp - 0x28], eax
xor edx, edx
mov ebx, dword [ebp - 0x10]
div ebx
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add edi, edx
mov dword [0x566bd0], edi
mov dword [0x566bbc], 0x15b
mov eax, edi
cdq
idiv ecx
mov dword [0x566bc8], edx
mov dword [0x566bc0], 0xffffff07
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x28]
mov cl, byte [ecx + edi]
mov byte [0x566bcc], cl
mov ecx, dword [ebp - 0x18]
mov cl, byte [ecx + edx]
mov edx, dword [ebp - 0x18]
mov byte [edx + edi], cl
mov ecx, dword [0x566bc0]
add ecx, 0xffffdd45
mov dword [0x566bbc], ecx
mov cl, byte [0x566bcc]
mov edx, dword [0x566bc8]
mov esi, dword [ebp - 0x18]
mov byte [esi + edx], cl
mov edx, dword [0x566bc4]
add edx, 1
mov dword [0x566bc4], edx
cmp edx, 0x100
mov dword [ebp - 0x24], edx
jl 0x54d0fc
mov dword [0x566bc0], 0x18f5
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x54d290
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, dword [0x566bbc]
add edi, 0xffffe881
mov dword [0x566bc0], edi
mov dword [0x566bc4], 0
mov dword [0x566bc8], 0
mov dword [0x566bd4], 0
cmp eax, 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jne 0x54d2fa
mov dword [0x566bc0], 0x13b3
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
mov ecx, eax
mov edx, eax
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], eax
jmp 0x54d30b
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
mov dword [0x566bbc], 0x1751
add ecx, 1
mov dword [ebp - 0x2c], eax
mov eax, ecx
mov dword [ebp - 0x30], edx
cdq
idiv esi
mov dword [0x566bc4], edx
mov ecx, dword [ebp - 0x1c]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x30]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x566bc8], edx
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x566bcc], cl
mov edi, dword [ebp - 0x1c]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov cl, byte [0x566bcc]
mov edx, dword [0x566bc8]
mov byte [edi + edx], cl
mov edx, dword [0x566bc4]
movzx edx, byte [edi + edx]
mov ebx, dword [0x566bc8]
movzx ebx, byte [edi + ebx]
add ebx, edx
mov dword [0x566bc0], 0x26fd
and ebx, 0xff
mov dword [0x566bd4], ebx
mov dword [0x566bbc], 0x267e
mov cl, byte [edi + ebx]
mov edx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x2c]
mov ch, byte [edx + ebx]
mov dl, cl
add dl, byte [0x566bd9]
mov byte [0x566bd8], dl
mov byte [0x566bd9], ch
mov byte [0x566bda], cl
mov dword [0x566bc0], 0x1b66
xor ch, cl
mov dword [0x566bbc], 0x1174
mov edx, dword [ebp - 0x18]
mov byte [edx + ebx], ch
add ebx, 1
mov edx, dword [ebp - 0x10]
cmp ebx, edx
mov dword [ebp - 0x38], ebx
je 0x54d41c
mov eax, dword [0x566bc4]
mov ecx, dword [0x566bc8]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x28], edx
jmp 0x54d30b
jmp 0x54d2e8
Function at 0x54dbd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4c
mov eax, dword [ebp + 8]
mov dword [0x566bbc], 0x1994
mov dword [ebp - 0x10], eax
call fcn.0054d600
mov ecx, eax
mov edx, dword [eax + 0x3c]
mov eax, dword [eax + edx + 0x78]
mov dword [0x566bbc], 0x2010
mov edx, eax
add edx, 0x20
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
xor eax, eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x1c]
add ecx, dword [ecx + edx]
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x18]
mov ebx, dword [esi + edi + 0x18]
cmp ebx, 0
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], eax
je 0x54dd39
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov edx, dword [eax + ecx + 0x24]
mov dword [ebp - 0x2c], edx
xor eax, eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x2c]
add ecx, edx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
xor edx, edx
mov esi, dword [ebp - 0x24]
mov edi, dword [esi + eax*4]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x44]
mov ecx, eax
mov edx, dword [ebp - 0x40]
add ecx, edx
mov esi, dword [ebp - 0x14]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov bl, cl
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x49], bh
mov byte [ebp - 0x4a], cl
mov byte [ebp - 0x4b], bl
je 0x54dcdc
mov eax, dword [ebp - 0x48]
add eax, 1
mov cl, byte [ebp - 0x49]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x4a]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
mov dword [ebp - 0x50], eax
mov byte [ebp - 0x51], ch
mov al, byte [ebp - 0x51]
test al, 1
mov ecx, dword [ebp - 0x50]
mov dl, byte [ebp - 0x4a]
mov dword [ebp - 0x44], ecx
mov byte [ebp - 0x4b], dl
jne 0x54dc73
jmp 0x54dcdc
mov al, byte [ebp - 0x4b]
test al, 1
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x58], ecx
jne 0x54dd0d
mov eax, dword [ebp - 0x3c]
add eax, 2
mov ecx, dword [ebp - 0x38]
add ecx, 1
mov edx, dword [ebp - 0x20]
cmp ecx, edx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], ecx
jb 0x54dc59
jmp 0x54dd32
mov eax, dword [ebp - 0x58]
movzx eax, word [eax]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
add ecx, dword [ecx + edx + 0x1c]
mov esi, dword [ebp - 0x14]
add esi, dword [ecx + eax*4]
mov dword [0x566bc0], 0x2690
mov dword [ebp - 0x28], esi
jmp 0x54dd39
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x54dd39
mov eax, dword [ebp - 0x28]
add esp, 0x4c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x54dd50
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 4], 0
mov dword [0x566bbc], 0xe24
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x10]
mov ecx, dword [ecx + 0x3c]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ecx
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x54ddc0
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x12], 0x64
je 0x54de79
jmp 0x54deb6
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
mov dx, word [eax + ecx*2 - 0xe]
mov word [ebp - 0x16], dx
mov ax, word [ebp - 0x16]
cmp ax, 0x6c
je 0x54dea2
jmp 0x54deb6
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], edx
je 0x54ddfe
mov dword [0x566bc0], 0xd66
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
cmp eax, 0x104
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x20], ecx
jl 0x54ddc0
mov eax, dword [ebp - 0x20]
mov dword [0x566bbc], 0xf30
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x14], eax
jne 0x54deb6
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff4
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2], 0x6f
jne 0x54deb6
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
mov dx, word [eax + ecx*2 - 0x16]
mov word [ebp - 0x2a], dx
mov ax, word [ebp - 0x2a]
cmp ax, 0x61
jne 0x54deb6
mov dword [0x566bbc], 0x15e2
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
mov dx, word [eax + ecx*2 - 0x14]
mov word [ebp - 0x2c], dx
mov ax, word [ebp - 0x2c]
cmp ax, 0x64
je 0x54dd86
jmp 0x54deb6
mov dword [0x566bbc], 0x1882
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff8
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x30]
cmp word [eax + ecx*2], 0x6c
je 0x54dd9e
jmp 0x54deb6
mov dword [0x566bc0], 0xfeb
mov eax, 1
mov dword [ebp - 0x34], eax
jmp 0x54dec5
xor eax, eax
mov dword [0x566bbc], 0x177
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
add esp, 0x34
pop ebp
ret