joyce8/EMBER2024-capa huggingface dataset:
Function at 0x613000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x613131
push esi
call fcn.00616145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00605080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x613131
push 0
push ebp
call fcn.006053a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00605260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x61308b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.006052f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x613121
push 0x62b918
push edi
call fcn.006143f0
push eax
push ebx
push esi
call fcn.00612f60
push 0x62b8f8
push edi
call fcn.006143f0
push eax
push ebx
push esi
call fcn.00612f60
push 0x62b8d8
push edi
call fcn.006143f0
push eax
push ebx
push esi
call fcn.00612f60
push 0x62b8c0
push edi
call fcn.006143f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00612f60
push 0x62b8a0
push edi
call fcn.006143f0
push eax
push ebx
push esi
call fcn.00612f60
push 0x62b888
push edi
call fcn.006143f0
push eax
push ebx
push esi
call fcn.00612f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x6141b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00614140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00614140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00614140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00614140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x614bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x614c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x62687c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x614c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x614c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x474ea3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x474ee5
call fcn.0047a820
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x474ee5
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x474edc
xor eax, eax
jmp 0x474eed
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00474ef3
pop edi
pop esi
pop ebx
ret 4

Function at 0x47ad50
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x47ad7e
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x47ad9c
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0047acb6
jmp 0x47ad9c
mov eax, dword [esi + 0x14]
test eax, eax
je 0x47ad9c
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0047acb6
test edi, edi
mov eax, edi
jne 0x47ad86
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x402bac
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x408014]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402c44
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402c24
xor eax, eax
push ebp
push 0x402c1d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402c60
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402c24
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x408014]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x408014], ax
mov esp, ebp
pop ebp
ret

Function at 0x403578
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x409038], 0
je 0x4035d9
cmp word [0x40920c], 0xd7b2
jne 0x4035a1
cmp dword [0x409214], 0
jbe 0x4035a1
mov eax, 0x409208
call dword [0x409224]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x40805c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403600
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x408020], 0
jne 0x4035f5
push 0
push 0x408054
push 0x40805c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x404030
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x404096
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00403858
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402aa0
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x404080
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40409d
lea eax, [ebp - 0x10]
call fcn.004036fc
ret
Function at 0x405034
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
test dl, dl
je 0x405049
add esp, 0xfffffff0
call fcn.00402edc
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov eax, dword [ebp - 8]
call fcn.00403a84
xor eax, eax
push ebp
push 0x4050e1
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xa
mov eax, dword [ebp - 8]
call fcn.00403a94
push eax
mov eax, dword [0x409654]
push eax
call sub.kernel32.dll_FindResourceA
mov esi, eax
test esi, esi
je 0x4050cb
push esi
mov eax, dword [0x409654]
push eax
call sub.kernel32.dll_LoadResource
mov edi, eax
mov dword [ebx + 4], edi
test edi, edi
je 0x4050cb
push edi
call sub.kernel32.dll_LockResource
mov dword [ebx + 0xc], eax
cmp dword [ebx + 0xc], 0
je 0x4050b6
push esi
mov eax, dword [0x409654]
push eax
call sub.kernel32.dll_SizeofResource
mov dword [ebx + 0x10], eax
mov eax, dword [ebx + 0xc]
mov dword [ebx + 8], eax
mov dl, 1
mov eax, dword [0x404c58]
call fcn.00402cc8
mov dword [ebx + 0x18], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4050e8
lea eax, [ebp - 8]
call fcn.004036fc
ret
Function at 0x65016050
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
sub esi, 0x14d97
pop esi
mov ecx, dword [ebp - 0xc30]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0xc2c]
movzx ecx, byte [eax]
cmp edx, ecx
jle 0x6501607c
mov dword [ebp - 0x18fc], 1
jmp 0x65016086
mov dword [ebp - 0x18fc], 0xffffffff
mov edx, dword [ebp - 0x18fc]
mov dword [ebp - 0xe9c], edx
jmp 0x650160f8

Function at 0x650160a3
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x650160ab
xor edi, 0x16d24
xor edi, 0x9d53
pop edi
push ecx
xor ecx, 0x10187
sub ecx, 0x6686
pop ecx
mov eax, dword [ebp - 0xe98]
sub eax, 1
mov dword [ebp - 0xe98], eax
mov ecx, dword [ebp - 0xc30]
add ecx, 1
mov dword [ebp - 0xc30], ecx
mov edx, dword [ebp - 0xc2c]
add edx, 1
mov dword [ebp - 0xc2c], edx
jmp 0x65015fd3
Function at 0x65016303
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
add ebx, 0xfaf
pop ebx
push esi
push edx
add esp, 4
call 0x65016303
add byte [esi], dh
cmp esi, dword [edi]
cmp dword [ebx + 0x49], ecx
xor eax, dword [ebx - 0x16a1fb3c]
add al, byte cs:[eax]
add bh, al
test dword [eax - 0xf], esp
invalid

Function at 0x6501638a
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x5cc]
add eax, 1
mov dword [ebp - 0x5cc], eax
add esp, 4
sub edx, 0x6833
pop edx
push edi
sub edi, 0xe48b
sub edi, 0x13bb8
pop edi
push edx
or edx, 0x4491
pop edx
mov edx, dword [ebp - 0xea4]
mov dword [ebp - 0x1908], edx
jmp 0x650164ec
cmp dword [ebp - 0x1908], 0
jne 0x65016535
push eax
push ebx
add esp, 4
jmp 0x65016501
and eax, 0xfc38
or eax, 0x7660
jmp 0x65016514
pop eax
push eax
push esi
add esp, 4
add eax, 0x80ce
xor eax, 0x9da4
pop eax
mov ecx, dword [ebp - 0x5cc]
mov dword [ebp - 0xc20], ecx
jmp 0x65016576
jmp 0x65016283
push eax
jmp 0x6501657e
sub eax, 0x1bf2
sub eax, 0x16830
jmp 0x65016593
pop eax
push edx
jmp 0x6501659b
sub edx, 0x3c90
sub edx, 0x5e35
pop edx
mov byte [ebp - 0x9d8], 0x45
mov byte [ebp - 0x9d7], 0x78
mov byte [ebp - 0x9d6], 0x69
mov byte [ebp - 0x9d5], 0x74
mov byte [ebp - 0x9d4], 0x50
mov byte [ebp - 0x9d3], 0x72
mov byte [ebp - 0x9d2], 0x6f
mov byte [ebp - 0x9d1], 0x63
mov byte [ebp - 0x9d0], 0x65
mov byte [ebp - 0x9cf], 0x73
mov byte [ebp - 0x9ce], 0x73
mov byte [ebp - 0x9cd], 0
push eax
sub eax, 0xd637
and eax, 0x92f9
jmp 0x65016612
pop eax
push ecx
sub ecx, 0x12f25
and ecx, 0xba1e
add ecx, 0x12f3f
jmp 0x6501662d
pop ecx
mov edx, 0x6b
mov word [ebp - 0x1a88], dx
mov eax, 0x65
mov word [ebp - 0x1a86], ax
mov ecx, 0x72
mov word [ebp - 0x1a84], cx
mov edx, 0x6e
mov word [ebp - 0x1a82], dx
mov eax, 0x65
mov word [ebp - 0x1a80], ax
mov ecx, 0x6c
mov word [ebp - 0x1a7e], cx
mov edx, 0x33
mov word [ebp - 0x1a7c], dx
mov eax, 0x32
mov word [ebp - 0x1a7a], ax
mov ecx, 0x2e
mov word [ebp - 0x1a78], cx
mov edx, 0x64
mov word [ebp - 0x1a76], dx
mov eax, 0x6c
mov word [ebp - 0x1a74], ax
mov ecx, 0x6c
mov word [ebp - 0x1a72], cx
xor edx, edx
mov word [ebp - 0x1a70], dx
push edi
call 0x650166d7
add byte [ebp + 0x3f], al
dec ecx
inc ebp
cmp eax, 0x433d3837
add esp, 4
or edi, 0x7ed9
pop edi
push edx
push ecx
add esp, 4
add edx, 0x17f36
pop edx
push ecx
push ebx
add esp, 4
add ecx, 0x1233b
pop ecx
push ebx
push eax
add esp, 4
add ebx, 0xa375
jmp 0x6501670c
pop ebx
push esi
push ecx
add esp, 4
jmp 0x65016719
jmp 0x6501671e
or esi, 0x13733
xor esi, 0xd511
pop esi
mov eax, dword fs:[0x18]
mov dword [ebp - 0x26c0], eax
mov ecx, dword [ebp - 0x26c0]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x26c4], edx
mov eax, dword [ebp - 0x26c4]
mov dword [ebp - 0x190c], eax
push ecx
xor ecx, 0x15289
or ecx, 0x1f1d
pop ecx
push edi
push ebx
add esp, 4
add edi, 0xb9a6
pop edi
push esi
push edi
add esp, 4
and esi, 0x1edb
and esi, 0x5b02
and esi, 0x13f73
aas
add dword [eax], eax
Function at 0x650163e4
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp dword [ebp - 0xea0], 0
jle 0x650164e0
push edx
and edx, 0xed4e
jmp 0x650163d7
call 0x650163e4
add byte [ebp + 0x3c], cl
dec ecx
xor al, 0x38
dec esi
inc edi
add esp, 4
call fcn.650163f6
add byte [edx + eax*2], bh
xor al, 0x45
xor al, byte [edi + esi + 0x3c]
dec ebp
add esp, 4
pop edx
mov eax, dword [ebp - 0xc28]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0xc24]
movzx eax, byte [edx]
cmp ecx, eax
je 0x6501647c
push esi
add esi, 0x12f86
pop esi
push ecx
jmp 0x65016422
and ecx, 0xdd16
and ecx, 0xdb95
pop ecx
push eax
push ebx
add esp, 4
jmp 0x6501643b
xor eax, 0x151f2
pop eax
mov ecx, dword [ebp - 0xc28]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0xc24]
movzx ecx, byte [eax]
cmp edx, ecx
jle 0x65016464
mov dword [ebp - 0x18d0], 1
jmp 0x6501646e
mov dword [ebp - 0x18d0], 0xffffffff
mov edx, dword [ebp - 0x18d0]
mov dword [ebp - 0xea4], edx
jmp 0x650164e0
push ecx
push ecx
add esp, 4
or ecx, 0xe1bc
and ecx, 0x9a57
xor ecx, 0x9cdf
pop ecx
push eax
jmp 0x6501649b
xor eax, 0xcc4
and eax, 0x15d1e
or eax, 0x151c9
pop eax
mov eax, dword [ebp - 0xea0]
sub eax, 1
mov dword [ebp - 0xea0], eax
mov ecx, dword [ebp - 0xc28]
add ecx, 1
mov dword [ebp - 0xc28], ecx
mov edx, dword [ebp - 0xc24]
add edx, 1
mov dword [ebp - 0xc24], edx
jmp 0x650163bb
mov eax, dword [ebp - 0xea4]
mov dword [ebp - 0x1908], eax

Function at 0x650163f6
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp dword [ebp - 0xea0], 0
jle 0x650164e0
push edx
and edx, 0xed4e
jmp 0x650163d7
call 0x650163e4
add byte [ebp + 0x3c], cl
dec ecx
xor al, 0x38
dec esi
inc edi
add esp, 4
call fcn.650163f6
add byte [edx + eax*2], bh
xor al, 0x45
xor al, byte [edi + esi + 0x3c]
dec ebp
add esp, 4
pop edx
mov eax, dword [ebp - 0xc28]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0xc24]
movzx eax, byte [edx]
cmp ecx, eax
je 0x6501647c
push esi
add esi, 0x12f86
pop esi
push ecx
jmp 0x65016422
and ecx, 0xdd16
and ecx, 0xdb95
pop ecx
push eax
push ebx
add esp, 4
jmp 0x6501643b
xor eax, 0x151f2
pop eax
mov ecx, dword [ebp - 0xc28]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0xc24]
movzx ecx, byte [eax]
cmp edx, ecx
jle 0x65016464
mov dword [ebp - 0x18d0], 1
jmp 0x6501646e
mov dword [ebp - 0x18d0], 0xffffffff
mov edx, dword [ebp - 0x18d0]
mov dword [ebp - 0xea4], edx
jmp 0x650164e0
push ecx
push ecx
add esp, 4
or ecx, 0xe1bc
and ecx, 0x9a57
xor ecx, 0x9cdf
pop ecx
push eax
jmp 0x6501649b
xor eax, 0xcc4
and eax, 0x15d1e
or eax, 0x151c9
pop eax
mov eax, dword [ebp - 0xea0]
sub eax, 1
mov dword [ebp - 0xea0], eax
mov ecx, dword [ebp - 0xc28]
add ecx, 1
mov dword [ebp - 0xc28], ecx
mov edx, dword [ebp - 0xc24]
add edx, 1
mov dword [ebp - 0xc24], edx
jmp 0x650163bb
mov eax, dword [ebp - 0xea4]
mov dword [ebp - 0x1908], eax

Function at 0x65016568
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop esi
mov dword [ebp - 0xc20], 0
Function at 0x650166d7
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x5cc]
add eax, 1
mov dword [ebp - 0x5cc], eax
add esp, 4
sub edx, 0x6833
pop edx
push edi
sub edi, 0xe48b
sub edi, 0x13bb8
pop edi
push edx
or edx, 0x4491
pop edx
mov edx, dword [ebp - 0xea4]
mov dword [ebp - 0x1908], edx
jmp 0x650164ec
cmp dword [ebp - 0x1908], 0
jne 0x65016535
push eax
push ebx
add esp, 4
jmp 0x65016501
and eax, 0xfc38
or eax, 0x7660
jmp 0x65016514
pop eax
push eax
push esi
add esp, 4
add eax, 0x80ce
xor eax, 0x9da4
pop eax
mov ecx, dword [ebp - 0x5cc]
mov dword [ebp - 0xc20], ecx
jmp 0x65016576
jmp 0x65016283
push eax
jmp 0x6501657e
sub eax, 0x1bf2
sub eax, 0x16830
jmp 0x65016593
pop eax
push edx
jmp 0x6501659b
sub edx, 0x3c90
sub edx, 0x5e35
pop edx
mov byte [ebp - 0x9d8], 0x45
mov byte [ebp - 0x9d7], 0x78
mov byte [ebp - 0x9d6], 0x69
mov byte [ebp - 0x9d5], 0x74
mov byte [ebp - 0x9d4], 0x50
mov byte [ebp - 0x9d3], 0x72
mov byte [ebp - 0x9d2], 0x6f
mov byte [ebp - 0x9d1], 0x63
mov byte [ebp - 0x9d0], 0x65
mov byte [ebp - 0x9cf], 0x73
mov byte [ebp - 0x9ce], 0x73
mov byte [ebp - 0x9cd], 0
push eax
sub eax, 0xd637
and eax, 0x92f9
jmp 0x65016612
pop eax
push ecx
sub ecx, 0x12f25
and ecx, 0xba1e
add ecx, 0x12f3f
jmp 0x6501662d
pop ecx
mov edx, 0x6b
mov word [ebp - 0x1a88], dx
mov eax, 0x65
mov word [ebp - 0x1a86], ax
mov ecx, 0x72
mov word [ebp - 0x1a84], cx
mov edx, 0x6e
mov word [ebp - 0x1a82], dx
mov eax, 0x65
mov word [ebp - 0x1a80], ax
mov ecx, 0x6c
mov word [ebp - 0x1a7e], cx
mov edx, 0x33
mov word [ebp - 0x1a7c], dx
mov eax, 0x32
mov word [ebp - 0x1a7a], ax
mov ecx, 0x2e
mov word [ebp - 0x1a78], cx
mov edx, 0x64
mov word [ebp - 0x1a76], dx
mov eax, 0x6c
mov word [ebp - 0x1a74], ax
mov ecx, 0x6c
mov word [ebp - 0x1a72], cx
xor edx, edx
mov word [ebp - 0x1a70], dx
push edi
call 0x650166d7
add byte [ebp + 0x3f], al
dec ecx
inc ebp
cmp eax, 0x433d3837
add esp, 4
or edi, 0x7ed9
pop edi
push edx
push ecx
add esp, 4
add edx, 0x17f36
pop edx
push ecx
push ebx
add esp, 4
add ecx, 0x1233b
pop ecx
push ebx
push eax
add esp, 4
add ebx, 0xa375
jmp 0x6501670c
pop ebx
push esi
push ecx
add esp, 4
jmp 0x65016719
jmp 0x6501671e
or esi, 0x13733
xor esi, 0xd511
pop esi
mov eax, dword fs:[0x18]
mov dword [ebp - 0x26c0], eax
mov ecx, dword [ebp - 0x26c0]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x26c4], edx
mov eax, dword [ebp - 0x26c4]
mov dword [ebp - 0x190c], eax
push ecx
xor ecx, 0x15289
or ecx, 0x1f1d
pop ecx
push edi
push ebx
add esp, 4
add edi, 0xb9a6
pop edi
push esi
push edi
add esp, 4
and esi, 0x1edb
and esi, 0x5b02
and esi, 0x13f73
aas
add dword [eax], eax
Function at 0x65016780
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
aas
add dword [eax], eax
pop esi
cmp dword [ebp - 0x190c], 0
jne 0x6501679c
mov dword [ebp - 0x37c], 0
jmp 0x65016a58
mov ecx, dword [ebp - 0x190c]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xeb0], eax
push ebx
call 0x650167bc
add byte [ecx], bh
inc ebp
aas
dec edx
dec esi
inc ebp
add esp, 4
xor ebx, 0x1f7e
and ebx, 0xc17
pop ebx
push eax
and eax, 0x1ce1
sub eax, 0x1251c
sub eax, 0xd0e6
pop eax
cmp dword [ebp - 0xeb0], 0
jne 0x650167f8
mov dword [ebp - 0x37c], 0
jmp 0x65016a58
mov ecx, dword [ebp - 0xeb0]
mov dword [ebp - 0x5d0], ecx
push esi
or esi, 0x17848
pop esi
push eax
push edi
add esp, 4
sub eax, 0x15e82
and eax, 0x15166
pop eax
push esi
push ecx
add esp, 4
sub esi, 0x18459
pop esi
push edi
push ecx
add esp, 4
sub edi, 0x1827e
pop edi
lea edx, [ebp - 0x1a88]
mov dword [ebp - 0xeac], edx
mov eax, dword [ebp - 0x5d0]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xea8], ecx
xor edx, edx
mov word [ebp - 0x270], dx
xor eax, eax
mov word [ebp - 0x138], ax
push esi
push ebx
add esp, 4
add esi, 0xbc4
call 0x6501687a
add byte [ecx + 0x50], cl
inc edx
inc esp
cmp dword [ecx - 0x7d], eax
les eax, [esi + ebx*2]
push esi
push edi
add esp, 4
call 0x65016891
add byte [ebx], dh
aas
inc ebp
xor al, 0x44
inc ebx
push eax
cmp eax, 0x5e04c483
mov ecx, dword [ebp - 0xea8]
mov dx, word [ecx]
mov word [ebp - 0x12c6], dx
mov eax, dword [ebp - 0xea8]
add eax, 2
mov dword [ebp - 0xea8], eax
mov cx, word [ebp - 0x12c6]
mov word [ebp - 0x270], cx
mov edx, dword [ebp - 0xeac]
mov ax, word [edx]
invalid
invalid
test dword [eax], edi
in eax, dx
Function at 0x650167bc
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
aas
add dword [eax], eax
pop esi
cmp dword [ebp - 0x190c], 0
jne 0x6501679c
mov dword [ebp - 0x37c], 0
jmp 0x65016a58
mov ecx, dword [ebp - 0x190c]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xeb0], eax
push ebx
call 0x650167bc
add byte [ecx], bh
inc ebp
aas
dec edx
dec esi
inc ebp
add esp, 4
xor ebx, 0x1f7e
and ebx, 0xc17
pop ebx
push eax
and eax, 0x1ce1
sub eax, 0x1251c
sub eax, 0xd0e6
pop eax
cmp dword [ebp - 0xeb0], 0
jne 0x650167f8
mov dword [ebp - 0x37c], 0
jmp 0x65016a58
mov ecx, dword [ebp - 0xeb0]
mov dword [ebp - 0x5d0], ecx
push esi
or esi, 0x17848
pop esi
push eax
push edi
add esp, 4
sub eax, 0x15e82
and eax, 0x15166
pop eax
push esi
push ecx
add esp, 4
sub esi, 0x18459
pop esi
push edi
push ecx
add esp, 4
sub edi, 0x1827e
pop edi
lea edx, [ebp - 0x1a88]
mov dword [ebp - 0xeac], edx
mov eax, dword [ebp - 0x5d0]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xea8], ecx
xor edx, edx
mov word [ebp - 0x270], dx
xor eax, eax
mov word [ebp - 0x138], ax
push esi
push ebx
add esp, 4
add esi, 0xbc4
call 0x6501687a
add byte [ecx + 0x50], cl
inc edx
inc esp
cmp dword [ecx - 0x7d], eax
les eax, [esi + ebx*2]
push esi
push edi
add esp, 4
call 0x65016891
add byte [ebx], dh
aas
inc ebp
xor al, 0x44
inc ebx
push eax
cmp eax, 0x5e04c483
mov ecx, dword [ebp - 0xea8]
mov dx, word [ecx]
mov word [ebp - 0x12c6], dx
mov eax, dword [ebp - 0xea8]
add eax, 2
mov dword [ebp - 0xea8], eax
mov cx, word [ebp - 0x12c6]
mov word [ebp - 0x270], cx
mov edx, dword [ebp - 0xeac]
mov ax, word [edx]
invalid
invalid
test dword [eax], edi
in eax, dx
Function at 0x6501687a
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
aas
add dword [eax], eax
pop esi
cmp dword [ebp - 0x190c], 0
jne 0x6501679c
mov dword [ebp - 0x37c], 0
jmp 0x65016a58
mov ecx, dword [ebp - 0x190c]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xeb0], eax
push ebx
call 0x650167bc
add byte [ecx], bh
inc ebp
aas
dec edx
dec esi
inc ebp
add esp, 4
xor ebx, 0x1f7e
and ebx, 0xc17
pop ebx
push eax
and eax, 0x1ce1
sub eax, 0x1251c
sub eax, 0xd0e6
pop eax
cmp dword [ebp - 0xeb0], 0
jne 0x650167f8
mov dword [ebp - 0x37c], 0
jmp 0x65016a58
mov ecx, dword [ebp - 0xeb0]
mov dword [ebp - 0x5d0], ecx
push esi
or esi, 0x17848
pop esi
push eax
push edi
add esp, 4
sub eax, 0x15e82
and eax, 0x15166
pop eax
push esi
push ecx
add esp, 4
sub esi, 0x18459
pop esi
push edi
push ecx
add esp, 4
sub edi, 0x1827e
pop edi
lea edx, [ebp - 0x1a88]
mov dword [ebp - 0xeac], edx
mov eax, dword [ebp - 0x5d0]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xea8], ecx
xor edx, edx
mov word [ebp - 0x270], dx
xor eax, eax
mov word [ebp - 0x138], ax
push esi
push ebx
add esp, 4
add esi, 0xbc4
call 0x6501687a
add byte [ecx + 0x50], cl
inc edx
inc esp
cmp dword [ecx - 0x7d], eax
les eax, [esi + ebx*2]
push esi
push edi
add esp, 4
call 0x65016891
add byte [ebx], dh
aas
inc ebp
xor al, 0x44
inc ebx
push eax
cmp eax, 0x5e04c483
mov ecx, dword [ebp - 0xea8]
mov dx, word [ecx]
mov word [ebp - 0x12c6], dx
mov eax, dword [ebp - 0xea8]
add eax, 2
mov dword [ebp - 0xea8], eax
mov cx, word [ebp - 0x12c6]
mov word [ebp - 0x270], cx
mov edx, dword [ebp - 0xeac]
mov ax, word [edx]
invalid
invalid
test dword [eax], edi
in eax, dx