joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5549b0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [ecx + 0x3a25f0], al
add byte [ecx + 0x7d05c8], al
add byte [ecx + 0x4b3ac8], al
add byte [eax + 0x50], bl
and eax, 0x132a9
and eax, 0x707e
xor eax, 0xee32
pop eax
mov ecx, dword [ebp - 0xf4]
mov edx, dword [ebp - 0x408]
movzx eax, word [edx + ecx*2]
mov ecx, dword [ebp - 0x40c]
mov edx, dword [ebp - 0x84]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x410], edx
push esi
and esi, 0xf677
pop esi
push ebx
call 0x554a13
add byte [ebp + eax*2 + 0x4d], al
cmp dword [eax*2 + 0x4c48333], edi
and ebx, 0xf12f
add ebx, 0xcbd2
pop ebx
push edx
push edx
add esp, 4
add edx, 0x6ea2
pop edx
mov dword [ebp - 0x38], 0
jmp 0x554a41
mov eax, dword [ebp - 0x38]
add eax, 1
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0xf8]
add ecx, dword [ebp - 0x38]
movsx edx, byte [ecx]
test edx, edx
je 0x554add
mov eax, dword [ebp - 0x38]
movsx ecx, byte [ebp + eax - 0x164]
test ecx, ecx
je 0x554add
push esi
push esi
add esp, 4
sub esi, 0x183aa
xor esi, 0xa3e0
and esi, 0xa872
jmp 0x554a83
pop esi
push ebx
push esi
add esp, 4
xor ebx, 0x168ec
xor ebx, 0x12275
pop ebx
mov edx, dword [ebp - 0xf8]
add edx, dword [ebp - 0x38]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x38]
movsx edx, byte [ebp + ecx - 0x164]
cmp eax, edx
je 0x554acf
mov eax, dword [ebp - 0xf8]
add eax, dword [ebp - 0x38]
movsx ecx, byte [eax]
xor ecx, 0x20
mov edx, dword [ebp - 0x38]
movsx eax, byte [ebp + edx - 0x164]
cmp ecx, eax
invalid
jne 0x554ad6
jmp 0x554a38
jmp 0x554add
push ecx
sub ecx, 0x3c5d
and ecx, 0x1781a
sub ecx, 0x941f
pop ecx
push esi
push esi
add esp, 4
jmp 0x554afc
xor esi, 0xa4c0
or esi, 0x11098
and esi, 0xb31a
pop esi
mov ecx, dword [ebp - 0xf8]
add ecx, dword [ebp - 0x38]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x38]
movsx ecx, byte [ebp + eax - 0x164]
cmp edx, ecx
jne 0x554b39
mov dword [ebp - 0x248], 0
jmp 0x554bd4
push ebx
push ebx
add esp, 4
or ebx, 0x128a4
pop ebx
push ebx
push ebx
add esp, 4
sub ebx, 0x4949
pop ebx
push eax
or eax, 0x1f0c
or eax, 0xad7f
pop eax
push eax
Function at 0x554a13
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [ecx + 0x3a25f0], al
add byte [ecx + 0x7d05c8], al
add byte [ecx + 0x4b3ac8], al
add byte [eax + 0x50], bl
and eax, 0x132a9
and eax, 0x707e
xor eax, 0xee32
pop eax
mov ecx, dword [ebp - 0xf4]
mov edx, dword [ebp - 0x408]
movzx eax, word [edx + ecx*2]
mov ecx, dword [ebp - 0x40c]
mov edx, dword [ebp - 0x84]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x410], edx
push esi
and esi, 0xf677
pop esi
push ebx
call 0x554a13
add byte [ebp + eax*2 + 0x4d], al
cmp dword [eax*2 + 0x4c48333], edi
and ebx, 0xf12f
add ebx, 0xcbd2
pop ebx
push edx
push edx
add esp, 4
add edx, 0x6ea2
pop edx
mov dword [ebp - 0x38], 0
jmp 0x554a41
mov eax, dword [ebp - 0x38]
add eax, 1
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0xf8]
add ecx, dword [ebp - 0x38]
movsx edx, byte [ecx]
test edx, edx
je 0x554add
mov eax, dword [ebp - 0x38]
movsx ecx, byte [ebp + eax - 0x164]
test ecx, ecx
je 0x554add
push esi
push esi
add esp, 4
sub esi, 0x183aa
xor esi, 0xa3e0
and esi, 0xa872
jmp 0x554a83
pop esi
push ebx
push esi
add esp, 4
xor ebx, 0x168ec
xor ebx, 0x12275
pop ebx
mov edx, dword [ebp - 0xf8]
add edx, dword [ebp - 0x38]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x38]
movsx edx, byte [ebp + ecx - 0x164]
cmp eax, edx
je 0x554acf
mov eax, dword [ebp - 0xf8]
add eax, dword [ebp - 0x38]
movsx ecx, byte [eax]
xor ecx, 0x20
mov edx, dword [ebp - 0x38]
movsx eax, byte [ebp + edx - 0x164]
cmp ecx, eax
invalid
jne 0x554ad6
jmp 0x554a38
jmp 0x554add
push ecx
sub ecx, 0x3c5d
and ecx, 0x1781a
sub ecx, 0x941f
pop ecx
push esi
push esi
add esp, 4
jmp 0x554afc
xor esi, 0xa4c0
or esi, 0x11098
and esi, 0xb31a
pop esi
mov ecx, dword [ebp - 0xf8]
add ecx, dword [ebp - 0x38]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x38]
movsx ecx, byte [ebp + eax - 0x164]
cmp edx, ecx
jne 0x554b39
mov dword [ebp - 0x248], 0
jmp 0x554bd4
push ebx
push ebx
add esp, 4
or ebx, 0x128a4
pop ebx
push ebx
push ebx
add esp, 4
sub ebx, 0x4949
pop ebx
push eax
or eax, 0x1f0c
or eax, 0xad7f
pop eax
push eax
Function at 0x554b60
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push eax
add esp, 4
sub eax, 0x1863c
pop eax
mov edx, dword [ebp - 0xf8]
add edx, dword [ebp - 0x38]
movsx eax, byte [edx]
or eax, 0x20
mov ecx, dword [ebp - 0x38]
movsx edx, byte [ebp + ecx - 0x164]
or edx, 0x20
cmp eax, edx
jge 0x554b98
mov dword [ebp - 0x248], 0xffffffff
jmp 0x554bd4
push ecx
push ecx
add esp, 4
xor ecx, 0x1307d
xor byte [ecx], al
add byte [ecx + 0x15992e1], al
add byte [ecx + 0x52], bl
or edx, 0x1268e
call 0x554bc0
add byte [edx + 0x41], al
aaa
cmp edi, dword [eax]
xor esi, dword ss:[0x4c48341]
or edx, 0x1769b
pop edx
mov dword [ebp - 0x248], 1
cmp dword [ebp - 0x248], 0
jne 0x554c1d
push ebx
add ebx, 0x2630
or ebx, 0x908a
pop ebx
push ebx
push edx
add esp, 4
xor ebx, 0x143ca
and ebx, 0x6ad7
pop ebx
push ecx
push eax
add esp, 4
add ecx, 0x21cf
sub ecx, 0xfa53
pop ecx
mov eax, dword [ebp - 0x410]
mov dword [ebp - 0x94], eax
jmp 0x554c2e
jmp 0x554935
cmp dword [ebp - 0x94], 0
je 0x554cd7
push edx
xor edx, 0x4f9f
or edx, 0x17dd7
sub edx, 0xb5b0
add byte [eax], al
pop edx
push eax
push ecx
add esp, 4
or eax, 0x39ed
pop eax
push ecx
push edi
add esp, 4
add ecx, 0xbf0f
add ecx, 0x395c
pop ecx
mov edx, dword [ebp - 0x94]
mov dword [ebp - 0x414], edx
mov eax, dword [ebp - 0x414]
mov dword [ebp - 0x418], eax
lea ecx, [ebp - 0x2b0]
push ecx
call dword [ebp - 0x418]
test eax, eax
jne 0x554cd7
push ebx
push edi
add esp, 4
call 0x554ca9
add byte [0x503a3850], bh
aas
inc ebp
inc edi
add esp, 4
sub ebx, 0x180ac
and ebx, 0x17290

Function at 0x554ba0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push eax
add esp, 4
sub eax, 0x1863c
pop eax
mov edx, dword [ebp - 0xf8]
add edx, dword [ebp - 0x38]
movsx eax, byte [edx]
or eax, 0x20
mov ecx, dword [ebp - 0x38]
movsx edx, byte [ebp + ecx - 0x164]
or edx, 0x20
cmp eax, edx
jge 0x554b98
mov dword [ebp - 0x248], 0xffffffff
jmp 0x554bd4
push ecx
push ecx
add esp, 4
xor ecx, 0x1307d
xor byte [ecx], al
add byte [ecx + 0x15992e1], al
add byte [ecx + 0x52], bl
or edx, 0x1268e
call 0x554bc0
add byte [edx + 0x41], al
aaa
cmp edi, dword [eax]
xor esi, dword ss:[0x4c48341]
or edx, 0x1769b
pop edx
mov dword [ebp - 0x248], 1
cmp dword [ebp - 0x248], 0
jne 0x554c1d
push ebx
add ebx, 0x2630
or ebx, 0x908a
pop ebx
push ebx
push edx
add esp, 4
xor ebx, 0x143ca
and ebx, 0x6ad7
pop ebx
push ecx
push eax
add esp, 4
add ecx, 0x21cf
sub ecx, 0xfa53
pop ecx
mov eax, dword [ebp - 0x410]
mov dword [ebp - 0x94], eax
jmp 0x554c2e
jmp 0x554935
cmp dword [ebp - 0x94], 0
je 0x554cd7
push edx
xor edx, 0x4f9f
or edx, 0x17dd7
sub edx, 0xb5b0
add byte [eax], al
pop edx
push eax
push ecx
add esp, 4
or eax, 0x39ed
pop eax
push ecx
push edi
add esp, 4
add ecx, 0xbf0f
add ecx, 0x395c
pop ecx
mov edx, dword [ebp - 0x94]
mov dword [ebp - 0x414], edx
mov eax, dword [ebp - 0x414]
mov dword [ebp - 0x418], eax
lea ecx, [ebp - 0x2b0]
push ecx
call dword [ebp - 0x418]
test eax, eax
jne 0x554cd7
push ebx
push edi
add esp, 4
call 0x554ca9
add byte [0x503a3850], bh
aas
inc ebp
inc edi
add esp, 4
sub ebx, 0x180ac
and ebx, 0x17290
Function at 0x554bc0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push eax
add esp, 4
sub eax, 0x1863c
pop eax
mov edx, dword [ebp - 0xf8]
add edx, dword [ebp - 0x38]
movsx eax, byte [edx]
or eax, 0x20
mov ecx, dword [ebp - 0x38]
movsx edx, byte [ebp + ecx - 0x164]
or edx, 0x20
cmp eax, edx
jge 0x554b98
mov dword [ebp - 0x248], 0xffffffff
jmp 0x554bd4
push ecx
push ecx
add esp, 4
xor ecx, 0x1307d
xor byte [ecx], al
add byte [ecx + 0x15992e1], al
add byte [ecx + 0x52], bl
or edx, 0x1268e
call 0x554bc0
add byte [edx + 0x41], al
aaa
cmp edi, dword [eax]
xor esi, dword ss:[0x4c48341]
or edx, 0x1769b
pop edx
mov dword [ebp - 0x248], 1
cmp dword [ebp - 0x248], 0
jne 0x554c1d
push ebx
add ebx, 0x2630
or ebx, 0x908a
pop ebx
push ebx
push edx
add esp, 4
xor ebx, 0x143ca
and ebx, 0x6ad7
pop ebx
push ecx
push eax
add esp, 4
add ecx, 0x21cf
sub ecx, 0xfa53
pop ecx
mov eax, dword [ebp - 0x410]
mov dword [ebp - 0x94], eax
jmp 0x554c2e
jmp 0x554935
cmp dword [ebp - 0x94], 0
je 0x554cd7
push edx
xor edx, 0x4f9f
or edx, 0x17dd7
sub edx, 0xb5b0
add byte [eax], al
pop edx
push eax
push ecx
add esp, 4
or eax, 0x39ed
pop eax
push ecx
push edi
add esp, 4
add ecx, 0xbf0f
add ecx, 0x395c
pop ecx
mov edx, dword [ebp - 0x94]
mov dword [ebp - 0x414], edx
mov eax, dword [ebp - 0x414]
mov dword [ebp - 0x418], eax
lea ecx, [ebp - 0x2b0]
push ecx
call dword [ebp - 0x418]
test eax, eax
jne 0x554cd7
push ebx
push edi
add esp, 4
call 0x554ca9
add byte [0x503a3850], bh
aas
inc ebp
inc edi
add esp, 4
sub ebx, 0x180ac
and ebx, 0x17290

Function at 0x554c4c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push eax
add esp, 4
sub eax, 0x1863c
pop eax
mov edx, dword [ebp - 0xf8]
add edx, dword [ebp - 0x38]
movsx eax, byte [edx]
or eax, 0x20
mov ecx, dword [ebp - 0x38]
movsx edx, byte [ebp + ecx - 0x164]
or edx, 0x20
cmp eax, edx
jge 0x554b98
mov dword [ebp - 0x248], 0xffffffff
jmp 0x554bd4
push ecx
push ecx
add esp, 4
xor ecx, 0x1307d
xor byte [ecx], al
add byte [ecx + 0x15992e1], al
add byte [ecx + 0x52], bl
or edx, 0x1268e
call 0x554bc0
add byte [edx + 0x41], al
aaa
cmp edi, dword [eax]
xor esi, dword ss:[0x4c48341]
or edx, 0x1769b
pop edx
mov dword [ebp - 0x248], 1
cmp dword [ebp - 0x248], 0
jne 0x554c1d
push ebx
add ebx, 0x2630
or ebx, 0x908a
pop ebx
push ebx
push edx
add esp, 4
xor ebx, 0x143ca
and ebx, 0x6ad7
pop ebx
push ecx
push eax
add esp, 4
add ecx, 0x21cf
sub ecx, 0xfa53
pop ecx
mov eax, dword [ebp - 0x410]
mov dword [ebp - 0x94], eax
jmp 0x554c2e
jmp 0x554935
cmp dword [ebp - 0x94], 0
je 0x554cd7
push edx
xor edx, 0x4f9f
or edx, 0x17dd7
sub edx, 0xb5b0
add byte [eax], al
pop edx
push eax
push ecx
add esp, 4
or eax, 0x39ed
pop eax
push ecx
push edi
add esp, 4
add ecx, 0xbf0f
add ecx, 0x395c
pop ecx
mov edx, dword [ebp - 0x94]
mov dword [ebp - 0x414], edx
mov eax, dword [ebp - 0x414]
mov dword [ebp - 0x418], eax
lea ecx, [ebp - 0x2b0]
push ecx
call dword [ebp - 0x418]
test eax, eax
jne 0x554cd7
push ebx
push edi
add esp, 4
call 0x554ca9
add byte [0x503a3850], bh
aas
inc ebp
inc edi
add esp, 4
sub ebx, 0x180ac
and ebx, 0x17290
Function at 0x554cc4
Capabilities:
Get number of processors

Disassembly:
call 0x554cc4
add byte [eax + 0x39], cl
inc edx
xor eax, 0xc4834537
add al, 0x5b
mov dword [ebp - 0x1bc], 0
jmp 0x55577e
lea eax, [ebp - 0x47c]
push eax
push 0x40
mov ecx, dword [ebp - 0x328]
sub ecx, dword [ebp - 0xcc]
push ecx
mov edx, dword [ebp - 0xcc]
push edx
call dword [ebp - 0x1bc]
test eax, eax
jne 0x5557dc
push ecx
add ecx, 0x895e
add ecx, 0xe62d
add ecx, 0x75f3
xor ecx, 0x17d56
pop ecx
push esi
push eax
add esp, 4
or esi, 0x9aef
or esi, 0x5241
xor esi, 0x113d3
pop esi
jmp 0x5558ef
push esi
push eax
add esp, 4
and esi, 0x13f01
pop esi
push edx
add edx, 0x11fcc
pop edx
push ecx
push esi
add esp, 4
or ecx, 0x3d7f
and ecx, 0x132f
sub ecx, 0x6b84
sub ecx, 0x89c8
pop ecx
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x438], eax
push esi
or esi, 0x8a2d
and esi, 0x161e7
sub esi, 0xb62d
pop esi
push edx
push edi
add esp, 4
and edx, 0x27c
call 0x555848
add byte [esi + edi], bh
inc esi
cmp dword [ebx], esi
cmp byte [0xc4834f37], bh
add al, 0x5a
pushal
push eax
push esi
add esp, 4
or eax, 0x16c50
add eax, 0x27b6
xor eax, 0x1b5
pop eax
push esi
or esi, 0x1016
and esi, 0x17f36
pop esi
push ebx
push edx
add esp, 4
or ebx, 0x6e0
pop ebx
call dword [ebp - 0x438]
push esi
push edi
add esp, 4
xor esi, 0xceab
add esi, 0x135a6
pop esi
push ebx
jmp 0x5558a0
jmp 0x5558a9
and ebx, 0x5a9d
jmp 0x5558b6
pop ebx
popal
push esi
push eax
add esp, 4
and esi, 0x5d27
or esi, 0x10377
add esi, 0xc9fb
pop esi
push esi
xor esi, 0x11c02
add esi, 0x185a6
xor esi, 0x63de
arpl word [eax], ax
add byte [ecx + 0x12e7ee], al
invalid
pop esi
Function at 0x555848
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
call 0x554cc4
add byte [eax + 0x39], cl
inc edx
xor eax, 0xc4834537
add al, 0x5b
mov dword [ebp - 0x1bc], 0
jmp 0x55577e
lea eax, [ebp - 0x47c]
push eax
push 0x40
mov ecx, dword [ebp - 0x328]
sub ecx, dword [ebp - 0xcc]
push ecx
mov edx, dword [ebp - 0xcc]
push edx
call dword [ebp - 0x1bc]
test eax, eax
jne 0x5557dc
push ecx
add ecx, 0x895e
add ecx, 0xe62d
add ecx, 0x75f3
xor ecx, 0x17d56
pop ecx
push esi
push eax
add esp, 4
or esi, 0x9aef
or esi, 0x5241
xor esi, 0x113d3
pop esi
jmp 0x5558ef
push esi
push eax
add esp, 4
and esi, 0x13f01
pop esi
push edx
add edx, 0x11fcc
pop edx
push ecx
push esi
add esp, 4
or ecx, 0x3d7f
and ecx, 0x132f
sub ecx, 0x6b84
sub ecx, 0x89c8
pop ecx
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x438], eax
push esi
or esi, 0x8a2d
and esi, 0x161e7
sub esi, 0xb62d
pop esi
push edx
push edi
add esp, 4
and edx, 0x27c
call 0x555848
add byte [esi + edi], bh
inc esi
cmp dword [ebx], esi
cmp byte [0xc4834f37], bh
add al, 0x5a
pushal
push eax
push esi
add esp, 4
or eax, 0x16c50
add eax, 0x27b6
xor eax, 0x1b5
pop eax
push esi
or esi, 0x1016
and esi, 0x17f36
pop esi
push ebx
push edx
add esp, 4
or ebx, 0x6e0
pop ebx
call dword [ebp - 0x438]
push esi
push edi
add esp, 4
xor esi, 0xceab
add esi, 0x135a6
pop esi
push ebx
jmp 0x5558a0
jmp 0x5558a9
and ebx, 0x5a9d
jmp 0x5558b6
pop ebx
popal
push esi
push eax
add esp, 4
and esi, 0x5d27
or esi, 0x10377
add esi, 0xc9fb
pop esi
push esi
xor esi, 0x11c02
add esi, 0x185a6
xor esi, 0x63de
arpl word [eax], ax
add byte [ecx + 0x12e7ee], al
invalid
pop esi
Function at 0x555960
Capabilities:
Get number of processors

Disassembly:
push edi
push ecx
add esp, 4
call 0x555974
add byte [esi + 0x33], cl
inc esp
dec ebx
dec eax
aas
inc ebx
dec ecx
dec ecx
add esp, 4
add edi, 0x2677
and edi, 0x118d3
pop edi
push ebx
xor ebx, 0xd742
xor ebx, 0x7c3b
pop ebx
push esi
or esi, 0x1aa7
and esi, 0x1e84
add esi, 0x42ef
pop esi
push ebx
jmp 0x5559ae
xor ebx, 0xe82a
jmp 0x5559bd
and ebx, 0x8343
pop ebx
mov eax, dword fs:[0x18]
mov dword [ebp - 0x43c], eax
push eax
push esi
add esp, 4
call 0x5559e3
add byte [0x333b3249], bh
cmp dword [edi + ecx*2], esi
add esp, 4
pop eax
push edx
or edx, 0x7b9
call 0x5559fe
add byte [ebx], bh
xor ecx, dword [ecx + ecx*2 + 0x42]
dec edx
xor al, 0x33
inc ebx
inc edi
add esp, 4
pop edx
mov ecx, dword [ebp - 0x43c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x440], edx
push edx
push eax
add esp, 4
xor edx, 0xf91c
jmp 0x555a22
pop edx
push ebx
push edi
add esp, 4
or ebx, 0xd2ed
pop ebx
push ebx
or ebx, 0xcfe1
sub ebx, 0x15bf8
and ebx, 0x5856
pop ebx
mov eax, dword [ebp - 0x440]
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 0
jne 0x555a96
push eax
and eax, 0x1827d
or eax, 0x9d27
pop eax
push ebx
push ebx
add esp, 4
jmp 0x555a74
call 0x555a80
add byte [edi], bh
inc ebp
push eax
inc esp
cmp eax, 0x4c48350
and ebx, 0x1291d
pop ebx
mov dword [ebp - 0x74], 0
jmp 0x555e22
push ebx
xor ebx, 0xc3d9
call 0x555aab
add byte [ebx + 0x3a], cl
cmp dword [esi + 0x44], ecx
cmp cl, byte [edx + ecx*2 - 0x7d]
les eax, [eax + ebp*8]
or dword [eax], eax
add byte [eax], al
add byte [esp + esi], dh
cmp byte [ebp + 0x4e], al
push eax
xor al, 0x47
add esp, 4
pop ebx
push ebx
add ebx, 0x1460f
pop ebx
mov ecx, dword [ebp - 0x32c]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 0
jne 0x555b21
push edi
push ecx
add esp, 4
add edi, 0x6d60
or edi, 0x14b74
xor edi, 0x8b6a
jmp 0x555b02
pop edi
push ebx
push eax
add esp, 4
sub ebx, 0xf7ac
xor ebx, 0x48a0
pop ebx
mov dword [ebp - 0x74], 0
jmp 0x555e22
mov ecx, dword [ebp - 0x264]
mov dword [ebp - 0xb0], ecx
push eax
xor eax, 0x8fcb
pop eax
push edx
push ecx
add esp, 4
xor edx, 0x5574
jmp 0x555b48
add edx, 0xf444
call 0x555b5b
add byte [ebx + 0x50], cl
dec edx
cmp al, 0x3e
dec esi
cmp eax, dword [ebx - 0x72a5fb3c]
xchg ebp, eax
push eax
std
invalid
cmp dword [ebp - 0x74], 0
jne 0x556abd
push edx
sub edx, 0xabda
or edx, 0xe941
pop edx
push edi
push edi
add esp, 4
xor edi, 0x12e05
or edi, 0x1161b
call 0x556aeb
add byte [edi + eax*2 + 0x4b], cl
dec ebp
dec ecx
dec ecx
dec edx
xor al, 0x3f
add esp, 4
pop edi
push ebx
add ebx, 0xfabf
or ebx, 0xcd48
pop ebx
push ecx
push edi
add esp, 4
and ecx, 0x1133e
sub ecx, 0x10a3a
pop ecx
push ebx
push edx
add esp, 4
add ebx, 0x68d7
jmp 0x556b20
pop ebx
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x464], ecx
push esi
push ebx
add esp, 4
and esi, 0x1d8f
call 0x556b49
add byte [edx + 0x40], cl
xor ecx, dword [esi + 0x32]
inc ecx
dec ebx
inc esi
cmp eax, 0x4c4834c
call 0x556b5c
add byte [ebx], dh
cmp esi, dword [esp + eax*2]
inc esp
aaa
dec esi
inc esp
dec edx
cmp dword [ebx - 0x74a1fb3c], eax
xchg ebp, eax
pushfd
sti
invalid
Function at 0x555974
Capabilities:
Get number of processors

Disassembly:
push edi
push ecx
add esp, 4
call 0x555974
add byte [esi + 0x33], cl
inc esp
dec ebx
dec eax
aas
inc ebx
dec ecx
dec ecx
add esp, 4
add edi, 0x2677
and edi, 0x118d3
pop edi
push ebx
xor ebx, 0xd742
xor ebx, 0x7c3b
pop ebx
push esi
or esi, 0x1aa7
and esi, 0x1e84
add esi, 0x42ef
pop esi
push ebx
jmp 0x5559ae
xor ebx, 0xe82a
jmp 0x5559bd
and ebx, 0x8343
pop ebx
mov eax, dword fs:[0x18]
mov dword [ebp - 0x43c], eax
push eax
push esi
add esp, 4
call 0x5559e3
add byte [0x333b3249], bh
cmp dword [edi + ecx*2], esi
add esp, 4
pop eax
push edx
or edx, 0x7b9
call 0x5559fe
add byte [ebx], bh
xor ecx, dword [ecx + ecx*2 + 0x42]
dec edx
xor al, 0x33
inc ebx
inc edi
add esp, 4
pop edx
mov ecx, dword [ebp - 0x43c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x440], edx
push edx
push eax
add esp, 4
xor edx, 0xf91c
jmp 0x555a22
pop edx
push ebx
push edi
add esp, 4
or ebx, 0xd2ed
pop ebx
push ebx
or ebx, 0xcfe1
sub ebx, 0x15bf8
and ebx, 0x5856
pop ebx
mov eax, dword [ebp - 0x440]
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 0
jne 0x555a96
push eax
and eax, 0x1827d
or eax, 0x9d27
pop eax
push ebx
push ebx
add esp, 4
jmp 0x555a74
call 0x555a80
add byte [edi], bh
inc ebp
push eax
inc esp
cmp eax, 0x4c48350
and ebx, 0x1291d
pop ebx
mov dword [ebp - 0x74], 0
jmp 0x555e22
push ebx
xor ebx, 0xc3d9
call 0x555aab
add byte [ebx + 0x3a], cl
cmp dword [esi + 0x44], ecx
cmp cl, byte [edx + ecx*2 - 0x7d]
les eax, [eax + ebp*8]
or dword [eax], eax
add byte [eax], al
add byte [esp + esi], dh
cmp byte [ebp + 0x4e], al
push eax
xor al, 0x47
add esp, 4
pop ebx
push ebx
add ebx, 0x1460f
pop ebx
mov ecx, dword [ebp - 0x32c]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 0
jne 0x555b21
push edi
push ecx
add esp, 4
add edi, 0x6d60
or edi, 0x14b74
xor edi, 0x8b6a
jmp 0x555b02
pop edi
push ebx
push eax
add esp, 4
sub ebx, 0xf7ac
xor ebx, 0x48a0
pop ebx
mov dword [ebp - 0x74], 0
jmp 0x555e22
mov ecx, dword [ebp - 0x264]
mov dword [ebp - 0xb0], ecx
push eax
xor eax, 0x8fcb
pop eax
push edx
push ecx
add esp, 4
xor edx, 0x5574
jmp 0x555b48
add edx, 0xf444
call 0x555b5b
add byte [ebx + 0x50], cl
dec edx
cmp al, 0x3e
dec esi
cmp eax, dword [ebx - 0x72a5fb3c]
xchg ebp, eax
push eax
std
invalid
cmp dword [ebp - 0x74], 0
jne 0x556abd
push edx
sub edx, 0xabda
or edx, 0xe941
pop edx
push edi
push edi
add esp, 4
xor edi, 0x12e05
or edi, 0x1161b
call 0x556aeb
add byte [edi + eax*2 + 0x4b], cl
dec ebp
dec ecx
dec ecx
dec edx
xor al, 0x3f
add esp, 4
pop edi
push ebx
add ebx, 0xfabf
or ebx, 0xcd48
pop ebx
push ecx
push edi
add esp, 4
and ecx, 0x1133e
sub ecx, 0x10a3a
pop ecx
push ebx
push edx
add esp, 4
add ebx, 0x68d7
jmp 0x556b20
pop ebx
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x464], ecx
push esi
push ebx
add esp, 4
and esi, 0x1d8f
call 0x556b49
add byte [edx + 0x40], cl
xor ecx, dword [esi + 0x32]
inc ecx
dec ebx
inc esi
cmp eax, 0x4c4834c
call 0x556b5c
add byte [ebx], dh
cmp esi, dword [esp + eax*2]
inc esp
aaa
dec esi
inc esp
dec edx
cmp dword [ebx - 0x74a1fb3c], eax
xchg ebp, eax
pushfd
sti
invalid
Function at 0x5559e3
Capabilities:
Get number of processors

Disassembly:
push edi
push ecx
add esp, 4
call 0x555974
add byte [esi + 0x33], cl
inc esp
dec ebx
dec eax
aas
inc ebx
dec ecx
dec ecx
add esp, 4
add edi, 0x2677
and edi, 0x118d3
pop edi
push ebx
xor ebx, 0xd742
xor ebx, 0x7c3b
pop ebx
push esi
or esi, 0x1aa7
and esi, 0x1e84
add esi, 0x42ef
pop esi
push ebx
jmp 0x5559ae
xor ebx, 0xe82a
jmp 0x5559bd
and ebx, 0x8343
pop ebx
mov eax, dword fs:[0x18]
mov dword [ebp - 0x43c], eax
push eax
push esi
add esp, 4
call 0x5559e3
add byte [0x333b3249], bh
cmp dword [edi + ecx*2], esi
add esp, 4
pop eax
push edx
or edx, 0x7b9
call 0x5559fe
add byte [ebx], bh
xor ecx, dword [ecx + ecx*2 + 0x42]
dec edx
xor al, 0x33
inc ebx
inc edi
add esp, 4
pop edx
mov ecx, dword [ebp - 0x43c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x440], edx
push edx
push eax
add esp, 4
xor edx, 0xf91c
jmp 0x555a22
pop edx
push ebx
push edi
add esp, 4
or ebx, 0xd2ed
pop ebx
push ebx
or ebx, 0xcfe1
sub ebx, 0x15bf8
and ebx, 0x5856
pop ebx
mov eax, dword [ebp - 0x440]
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 0
jne 0x555a96
push eax
and eax, 0x1827d
or eax, 0x9d27
pop eax
push ebx
push ebx
add esp, 4
jmp 0x555a74
call 0x555a80
add byte [edi], bh
inc ebp
push eax
inc esp
cmp eax, 0x4c48350
and ebx, 0x1291d
pop ebx
mov dword [ebp - 0x74], 0
jmp 0x555e22
push ebx
xor ebx, 0xc3d9
call 0x555aab
add byte [ebx + 0x3a], cl
cmp dword [esi + 0x44], ecx
cmp cl, byte [edx + ecx*2 - 0x7d]
les eax, [eax + ebp*8]
or dword [eax], eax
add byte [eax], al
add byte [esp + esi], dh
cmp byte [ebp + 0x4e], al
push eax
xor al, 0x47
add esp, 4
pop ebx
push ebx
add ebx, 0x1460f
pop ebx
mov ecx, dword [ebp - 0x32c]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 0
jne 0x555b21
push edi
push ecx
add esp, 4
add edi, 0x6d60
or edi, 0x14b74
xor edi, 0x8b6a
jmp 0x555b02
pop edi
push ebx
push eax
add esp, 4
sub ebx, 0xf7ac
xor ebx, 0x48a0
pop ebx
mov dword [ebp - 0x74], 0
jmp 0x555e22
mov ecx, dword [ebp - 0x264]
mov dword [ebp - 0xb0], ecx
push eax
xor eax, 0x8fcb
pop eax
push edx
push ecx
add esp, 4
xor edx, 0x5574
jmp 0x555b48
add edx, 0xf444
call 0x555b5b
add byte [ebx + 0x50], cl
dec edx
cmp al, 0x3e
dec esi
cmp eax, dword [ebx - 0x72a5fb3c]
xchg ebp, eax
push eax
std
invalid
cmp dword [ebp - 0x74], 0
jne 0x556abd
push edx
sub edx, 0xabda
or edx, 0xe941
pop edx
push edi
push edi
add esp, 4
xor edi, 0x12e05
or edi, 0x1161b
call 0x556aeb
add byte [edi + eax*2 + 0x4b], cl
dec ebp
dec ecx
dec ecx
dec edx
xor al, 0x3f
add esp, 4
pop edi
push ebx
add ebx, 0xfabf
or ebx, 0xcd48
pop ebx
push ecx
push edi
add esp, 4
and ecx, 0x1133e
sub ecx, 0x10a3a
pop ecx
push ebx
push edx
add esp, 4
add ebx, 0x68d7
jmp 0x556b20
pop ebx
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x464], ecx
push esi
push ebx
add esp, 4
and esi, 0x1d8f
call 0x556b49
add byte [edx + 0x40], cl
xor ecx, dword [esi + 0x32]
inc ecx
dec ebx
inc esi
cmp eax, 0x4c4834c
call 0x556b5c
add byte [ebx], dh
cmp esi, dword [esp + eax*2]
inc esp
aaa
dec esi
inc esp
dec edx
cmp dword [ebx - 0x74a1fb3c], eax
xchg ebp, eax
pushfd
sti
invalid