joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001457
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push eax
call 0x10001457
add byte [eax + 0x39], al
cmp dh, byte [edi]
inc edi
dec edi
dec ecx
add esp, 4
add eax, 0x1661b
xor eax, 0x12f92
xor eax, 0x15886
pop eax
push esi
push eax
add esp, 4
les eax, [ecx + eax*4]
out dx, al
sbb edx, esp
add byte [eax], al
pop esi
mov edx, dword [ebp - 0x38]
add edx, 0xfe
imul eax, dword [ebp - 0x34], 0xfe
add eax, 0x56f3663b
imul ecx, dword [ebp - 0x34], 0xfe
sub eax, ecx
xor edx, eax
imul edx, dword [ebp - 0x34]
mov dword [ebp - 0x23c8], edx
push eax
push ecx
add esp, 4
or eax, 0x18696
or eax, 0x5bba
xor eax, 0xcc3e
pop eax
push edi
sub edi, 0x10be2
add edi, 0x10c6e
xor edi, 0x8ade
or edi, 0xe672
pop edi
mov edx, dword [ebp - 0x23c8]
add edx, 1
mov dword [ebp - 0x18b4], edx
dec esp
out 0xff, eax
call dword [esi + 0x56]
add esp, 4
xor esi, 0x338e
and esi, 0xd1fe
and esi, 0xe8b6
pop esi
push edx
push edx
add esp, 4
or edx, 0xca3c
sub edx, 0xa959
jmp 0x10001515
pop edx
push esi
push eax
add esp, 4
sub esi, 0xd338
call 0x10001530
add byte [edx], bh
inc ebx
cmp byte [esi + 0x44], al
inc eax
dec eax
cmp byte [edx - 0x7d], cl
les eax, [ecx + eax*4]
mul byte [ebp + 0x5e0000c3]
push edx
and edx, 0x139a1
xor edx, 0x127a7
pop edx
imul eax, dword [ebp - 0x34], 0xfe
add eax, 0x56f3663b
imul ecx, dword [ebp - 0x34], 0xfe
sub eax, ecx
xor eax, dword [ebp - 0x18b4]
imul eax, dword [ebp - 0x34]
imul edx, dword [ebp - 0x34], 0xfe
sub eax, edx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x18b4]
imul eax, dword [ebp - 0x34]
mov dword [ebp - 0x24b4], eax
mov dword [ebp - 0x1940], 1
push edx
push eax
add esp, 4
xor edx, 0x12336
sub edx, 0x13b4f
xor edx, 0x11bef
or edx, 0x2098
pop edx
push ecx
push edi
add esp, 4
jmp 0x100015b6
jmp 0x100015be
pop ecx
imul ecx, dword [ebp - 0x1940], 0xfe
add ecx, 0x56f3663b
imul edx, dword [ebp - 0x1940], 0xfe
sub ecx, edx
xor ecx, dword [ebp - 0x24b4]
imul ecx, dword [ebp - 0x1940]
imul eax, dword [ebp - 0x1940], 0xfe
sub ecx, eax
mov dword [ebp - 0x1944], ecx
mov dword [ebp - 0x24d0], edx
mov eax, dword [ebp - 0x24d0]
sub eax, 0x898
mov dword [ebp - 0x24d4], eax
mov dword [ebp - 0x12e8], 1
push esi
and esi, 0x18128
call 0x10001898
add byte [ebx], bh
inc eax
cmp eax, 0x37423a44
cmp eax, 0xc4833444
add al, 0xe8
or dword [eax], eax
add byte [eax], al
add byte [esi + 0x3e], cl
cmp edi, dword [ecx]
cmp byte [ebx], bh
cmp eax, 0x4c4833c
and esi, 0x5456
pop esi
imul ecx, dword [ebp - 0x12e8], 0xfe
add ecx, 0x56f3663b
imul edx, dword [ebp - 0x12e8], 0xfe
sub ecx, edx
xor ecx, dword [ebp - 0x24d4]
imul ecx, dword [ebp - 0x12e8]
imul eax, dword [ebp - 0x12e8], 0xfe
sub ecx, eax
mov dword [ebp - 0x12ec], ecx
mov ecx, dword [ebp - 0x12ec]
mov edx, dword [ebp - 0x12e8]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], edx
push eax
push eax
add esp, 4
call 0x10001915
add byte [eax + 0x32], al
inc edi
inc ecx
push eax
dec esp
dec ecx
inc ebp
dec eax
add esp, 4
jmp 0x1000191d
sub eax, 0x38b1
pop eax
push esi
xor esi, 0x6279
sub esi, 0x168d5
pop esi
Function at 0x10001530
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push eax
call 0x10001457
add byte [eax + 0x39], al
cmp dh, byte [edi]
inc edi
dec edi
dec ecx
add esp, 4
add eax, 0x1661b
xor eax, 0x12f92
xor eax, 0x15886
pop eax
push esi
push eax
add esp, 4
les eax, [ecx + eax*4]
out dx, al
sbb edx, esp
add byte [eax], al
pop esi
mov edx, dword [ebp - 0x38]
add edx, 0xfe
imul eax, dword [ebp - 0x34], 0xfe
add eax, 0x56f3663b
imul ecx, dword [ebp - 0x34], 0xfe
sub eax, ecx
xor edx, eax
imul edx, dword [ebp - 0x34]
mov dword [ebp - 0x23c8], edx
push eax
push ecx
add esp, 4
or eax, 0x18696
or eax, 0x5bba
xor eax, 0xcc3e
pop eax
push edi
sub edi, 0x10be2
add edi, 0x10c6e
xor edi, 0x8ade
or edi, 0xe672
pop edi
mov edx, dword [ebp - 0x23c8]
add edx, 1
mov dword [ebp - 0x18b4], edx
dec esp
out 0xff, eax
call dword [esi + 0x56]
add esp, 4
xor esi, 0x338e
and esi, 0xd1fe
and esi, 0xe8b6
pop esi
push edx
push edx
add esp, 4
or edx, 0xca3c
sub edx, 0xa959
jmp 0x10001515
pop edx
push esi
push eax
add esp, 4
sub esi, 0xd338
call 0x10001530
add byte [edx], bh
inc ebx
cmp byte [esi + 0x44], al
inc eax
dec eax
cmp byte [edx - 0x7d], cl
les eax, [ecx + eax*4]
mul byte [ebp + 0x5e0000c3]
push edx
and edx, 0x139a1
xor edx, 0x127a7
pop edx
imul eax, dword [ebp - 0x34], 0xfe
add eax, 0x56f3663b
imul ecx, dword [ebp - 0x34], 0xfe
sub eax, ecx
xor eax, dword [ebp - 0x18b4]
imul eax, dword [ebp - 0x34]
imul edx, dword [ebp - 0x34], 0xfe
sub eax, edx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x18b4]
imul eax, dword [ebp - 0x34]
mov dword [ebp - 0x24b4], eax
mov dword [ebp - 0x1940], 1
push edx
push eax
add esp, 4
xor edx, 0x12336
sub edx, 0x13b4f
xor edx, 0x11bef
or edx, 0x2098
pop edx
push ecx
push edi
add esp, 4
jmp 0x100015b6
jmp 0x100015be
pop ecx
imul ecx, dword [ebp - 0x1940], 0xfe
add ecx, 0x56f3663b
imul edx, dword [ebp - 0x1940], 0xfe
sub ecx, edx
xor ecx, dword [ebp - 0x24b4]
imul ecx, dword [ebp - 0x1940]
imul eax, dword [ebp - 0x1940], 0xfe
sub ecx, eax
mov dword [ebp - 0x1944], ecx
mov dword [ebp - 0x24d0], edx
mov eax, dword [ebp - 0x24d0]
sub eax, 0x898
mov dword [ebp - 0x24d4], eax
mov dword [ebp - 0x12e8], 1
push esi
and esi, 0x18128
call 0x10001898
add byte [ebx], bh
inc eax
cmp eax, 0x37423a44
cmp eax, 0xc4833444
add al, 0xe8
or dword [eax], eax
add byte [eax], al
add byte [esi + 0x3e], cl
cmp edi, dword [ecx]
cmp byte [ebx], bh
cmp eax, 0x4c4833c
and esi, 0x5456
pop esi
imul ecx, dword [ebp - 0x12e8], 0xfe
add ecx, 0x56f3663b
imul edx, dword [ebp - 0x12e8], 0xfe
sub ecx, edx
xor ecx, dword [ebp - 0x24d4]
imul ecx, dword [ebp - 0x12e8]
imul eax, dword [ebp - 0x12e8], 0xfe
sub ecx, eax
mov dword [ebp - 0x12ec], ecx
mov ecx, dword [ebp - 0x12ec]
mov edx, dword [ebp - 0x12e8]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], edx
push eax
push eax
add esp, 4
call 0x10001915
add byte [eax + 0x32], al
inc edi
inc ecx
push eax
dec esp
dec ecx
inc ebp
dec eax
add esp, 4
jmp 0x1000191d
sub eax, 0x38b1
pop eax
push esi
xor esi, 0x6279
sub esi, 0x168d5
pop esi
Function at 0x10003df0
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
test dword [esp + edi*8 + 0x1ffff], edi
add byte [eax], al

Function at 0x10004050
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ecx
mov edx, dword [ebp - 0x2610]
sub edx, 1
mov dword [ebp - 0x18cc], edx
push eax
or eax, 0x9fcd
or eax, 0xc6db
pop eax
push ebx
push ecx
add esp, 4
xor ebx, 0x4d5d
sub ebx, 0x150c3
and ebx, 0x743e
pop ebx
push esi
push ecx
add esp, 4
xor esi, 0xee72
pop esi
push edi
push esi
add esp, 4
xor edi, 0x3494
or edi, 0x96c
jmp 0x10003fa5
pop edi
push esi
push edi
add esp, 4
sub esi, 0x10ae8
or esi, 0x12803
or esi, 0xef6
pop esi
imul eax, dword [ebp - 0x2c4], 0xfe
add eax, 0x56f3663b
imul ecx, dword [ebp - 0x2c4], 0xfe
sub eax, ecx
xor eax, dword [ebp - 0x18cc]
imul eax, dword [ebp - 0x2c4]
imul edx, dword [ebp - 0x2c4], 0xfe
sub eax, edx
mov dword [ebp - 0x2c8], eax
mov eax, dword [ebp - 0x18cc]
imul eax, dword [ebp - 0x2c4]
mov dword [ebp - 0x2614], eax
mov dword [ebp - 0x1978], 1
push esi
sub esi, 0x12fe0
and esi, 0x5854
jmp 0x10004029
add esi, 0x3c07
pop esi
push eax
push ecx
add esp, 4
sub eax, 0x1455
sub eax, 0x15817
jmp 0x10004046
pop eax
imul ecx, dword [ebp - 0x1978], 0xfe
add byte [ecx - 0xc99c43f], al
push esi
imul edx, dword [ebp - 0x1978], 0xfe
sub ecx, edx
xor ecx, dword [ebp - 0x2614]
imul ecx, dword [ebp - 0x1978]
imul eax, dword [ebp - 0x1978], 0xfe
sub ecx, eax
mov dword [ebp - 0x197c], ecx
Function at 0x10005323
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
or edx, 0x17e50
pop edx
push edx
push edx
add esp, 4
add edx, 0x67cf
or edx, 0x1ef5
xor edx, 0xaf1c
sub edx, 0xb3a5
pop edx
push edi
push edi
add esp, 4
sub edi, 0x9826
pop edi
push eax
push esi
add esp, 4
xor eax, 0x26f8
jmp 0x100052b2
sub eax, 0xea06
pop eax
push edx
push esi
add esp, 4
or edx, 0x10330
xor byte [ebx], al
add dword [eax], eax
sub edx, 0x3b60
jmp 0x100052d2
pop edx
mov edx, dword fs:[0x18]
mov dword [ebp - 0x2688], edx
mov eax, dword [ebp - 0x2688]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x268c], ecx
mov edx, dword [ebp - 0x268c]
mov dword [ebp - 0x18ec], edx
push edi
sub edi, 0x5107
call 0x10005312
add byte [edi + 0x3c], cl
aas
inc edi
cmp eax, 0x39333e41
cmp dword [ebx + eax*4], edi
les eax, [eax + ebp*8]
or dword [eax], eax
add byte [eax], al
add byte [0x47484b32], bh
dec ebp
xor dh, byte [0x8104c483]
out dx, eax
or eax, 0x5f00010c
cmp dword [ebp - 0x18ec], 0
jne 0x10005345
mov dword [ebp - 0x398], 0
jmp 0x10005601
mov eax, dword [ebp - 0x18ec]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xe98], edx
push ecx
call 0x10005367
add byte [edi + 0x4b], cl
push edx
push ecx
add esp, 4
and edx, 0xb47d
xor edx, 0x63b4
call 0x10005621
add byte [ebp + 0x33], al
cmp al, byte [ecx + 0x34]
cmp cl, byte [ebx + 0x42]
cmp eax, 0x8104c483
ljmp 0x575a
Function at 0x10005367
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
inc ebx
inc eax
dec esi
cmp eax, dword [ebx + 0x3d]
add esp, 4
pop ecx
push ecx
call 0x10005379
add byte [ebp + 0x3a], al
cmp al, 0x3e
cmp bh, byte [edi]
inc edx
add esp, 4
pop ecx
push ecx
push esi
add esp, 4
xor ecx, 0x1b25
pop ecx
cmp dword [ebp - 0xe98], 0
jne 0x100053a1
mov dword [ebp - 0x398], 0
jmp 0x10005601
mov eax, dword [ebp - 0xe98]
mov dword [ebp - 0x5c4], eax
push edi
add edi, 0xdf8a
add edi, 0xda84
xor edi, 0x31e6
sub edi, 0x6eff
pop edi
push esi
push ecx
add esp, 4
and esi, 0x344c
or esi, 0x15223
sub esi, 0xa174
pop esi
lea ecx, [ebp - 0x1a68]
mov dword [ebp - 0xe94], ecx
mov edx, dword [ebp - 0x5c4]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xe90], eax
xor ecx, ecx
mov word [ebp - 0x264], cx
xor edx, edx
mov word [ebp - 0x138], dx
push eax
add eax, 0x17e14
pop eax
push ecx
push ecx
add esp, 4
or ecx, 0x7e09
sub ecx, 0xe663
sub ecx, 0x1629a
and ecx, 0xef0e
pop ecx
push esi
push ebx
add esp, 4
xor esi, 0x94cc
pop esi
mov eax, dword [ebp - 0xe90]
mov cx, word [eax]
mov word [ebp - 0x12ae], cx
mov edx, dword [ebp - 0xe90]
add edx, 2
mov dword [ebp - 0xe90], edx
mov ax, word [ebp - 0x12ae]
mov word [ebp - 0x264], ax
mov ecx, dword [ebp - 0xe94]
mov dx, word [ecx]
mov word [ebp - 0x12b0], dx
mov eax, dword [ebp - 0xe94]
add eax, 2
mov dword [ebp - 0xe94], eax
mov cx, word [ebp - 0x12b0]
mov word [ebp - 0x138], cx
push eax
push edx
add esp, 4
or eax, 0x1813e
add eax, 0x84d2
pop eax
push edi
push ebx
add esp, 4
and edi, 0xcb10
jmp 0x100054bd
add edi, 0x25c0
xor edi, 0xcd28
pop edi
movzx edx, word [ebp - 0x138]
test edx, edx
jne 0x100054ed
movzx eax, word [ebp - 0x264]
movzx ecx, word [ebp - 0x138]
sub eax, ecx
mov dword [ebp - 0x18f4], eax
jmp 0x10005550
movzx edx, word [ebp - 0x264]
movzx eax, word [ebp - 0x138]
cmp edx, eax
je 0x1000540c
movzx ecx, word [ebp - 0x264]
xor ecx, 0x20
movzx edx, word [ebp - 0x138]
cmp ecx, edx
je 0x1000540c
movzx eax, word [ebp - 0x264]
movzx ecx, word [ebp - 0x138]
cmp eax, ecx
jge 0x1000553a
mov dword [ebp - 0x18f0], 0xffffffff
jmp 0x10005544
mov dword [ebp - 0x18f0], 1
mov edx, dword [ebp - 0x18f0]
mov dword [ebp - 0x18f4], edx
cmp dword [ebp - 0x18f4], 0
jne 0x10005599
push ebx
push edi
add esp, 4
and ebx, 0xb773
sub ebx, 0x7129
add ebx, 0x7636
add ebx, 0xf1e9
pop ebx
push edx
xor edx, 0x123cc
sub edx, 0x16c64
or edx, 0x3e1c
pop edx
mov eax, dword [ebp - 0x5c4]
mov dword [ebp - 0x398], eax
jmp 0x10005601
push edx
push esi
add esp, 4
add edx, 0xdff2
or edx, 0x16034
xor edx, 0x17c5
or edx, 0x2d95
pop edx
push eax
and eax, 0x9bf
jmp 0x100055c4
jmp 0x100055ca
pop eax
mov ecx, dword [ebp - 0x5c4]
mov edx, dword [ecx]
mov dword [ebp - 0x5c4], edx
mov eax, dword [ebp - 0x5c4]
cmp eax, dword [ebp - 0xe98]
je 0x100055f7
mov ecx, dword [ebp - 0x5c4]
cmp dword [ecx + 0x30], 0
jne 0x100053ad
mov dword [ebp - 0x398], 0
Function at 0x10005379
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
inc ebx
inc eax
dec esi
cmp eax, dword [ebx + 0x3d]
add esp, 4
pop ecx
push ecx
call 0x10005379
add byte [ebp + 0x3a], al
cmp al, 0x3e
cmp bh, byte [edi]
inc edx
add esp, 4
pop ecx
push ecx
push esi
add esp, 4
xor ecx, 0x1b25
pop ecx
cmp dword [ebp - 0xe98], 0
jne 0x100053a1
mov dword [ebp - 0x398], 0
jmp 0x10005601
mov eax, dword [ebp - 0xe98]
mov dword [ebp - 0x5c4], eax
push edi
add edi, 0xdf8a
add edi, 0xda84
xor edi, 0x31e6
sub edi, 0x6eff
pop edi
push esi
push ecx
add esp, 4
and esi, 0x344c
or esi, 0x15223
sub esi, 0xa174
pop esi
lea ecx, [ebp - 0x1a68]
mov dword [ebp - 0xe94], ecx
mov edx, dword [ebp - 0x5c4]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xe90], eax
xor ecx, ecx
mov word [ebp - 0x264], cx
xor edx, edx
mov word [ebp - 0x138], dx
push eax
add eax, 0x17e14
pop eax
push ecx
push ecx
add esp, 4
or ecx, 0x7e09
sub ecx, 0xe663
sub ecx, 0x1629a
and ecx, 0xef0e
pop ecx
push esi
push ebx
add esp, 4
xor esi, 0x94cc
pop esi
mov eax, dword [ebp - 0xe90]
mov cx, word [eax]
mov word [ebp - 0x12ae], cx
mov edx, dword [ebp - 0xe90]
add edx, 2
mov dword [ebp - 0xe90], edx
mov ax, word [ebp - 0x12ae]
mov word [ebp - 0x264], ax
mov ecx, dword [ebp - 0xe94]
mov dx, word [ecx]
mov word [ebp - 0x12b0], dx
mov eax, dword [ebp - 0xe94]
add eax, 2
mov dword [ebp - 0xe94], eax
mov cx, word [ebp - 0x12b0]
mov word [ebp - 0x138], cx
push eax
push edx
add esp, 4
or eax, 0x1813e
add eax, 0x84d2
pop eax
push edi
push ebx
add esp, 4
and edi, 0xcb10
jmp 0x100054bd
add edi, 0x25c0
xor edi, 0xcd28
pop edi
movzx edx, word [ebp - 0x138]
test edx, edx
jne 0x100054ed
movzx eax, word [ebp - 0x264]
movzx ecx, word [ebp - 0x138]
sub eax, ecx
mov dword [ebp - 0x18f4], eax
jmp 0x10005550
movzx edx, word [ebp - 0x264]
movzx eax, word [ebp - 0x138]
cmp edx, eax
je 0x1000540c
movzx ecx, word [ebp - 0x264]
xor ecx, 0x20
movzx edx, word [ebp - 0x138]
cmp ecx, edx
je 0x1000540c
movzx eax, word [ebp - 0x264]
movzx ecx, word [ebp - 0x138]
cmp eax, ecx
jge 0x1000553a
mov dword [ebp - 0x18f0], 0xffffffff
jmp 0x10005544
mov dword [ebp - 0x18f0], 1
mov edx, dword [ebp - 0x18f0]
mov dword [ebp - 0x18f4], edx
cmp dword [ebp - 0x18f4], 0
jne 0x10005599
push ebx
push edi
add esp, 4
and ebx, 0xb773
sub ebx, 0x7129
add ebx, 0x7636
add ebx, 0xf1e9
pop ebx
push edx
xor edx, 0x123cc
sub edx, 0x16c64
or edx, 0x3e1c
pop edx
mov eax, dword [ebp - 0x5c4]
mov dword [ebp - 0x398], eax
jmp 0x10005601
push edx
push esi
add esp, 4
add edx, 0xdff2
or edx, 0x16034
xor edx, 0x17c5
or edx, 0x2d95
pop edx
push eax
and eax, 0x9bf
jmp 0x100055c4
jmp 0x100055ca
pop eax
mov ecx, dword [ebp - 0x5c4]
mov edx, dword [ecx]
mov dword [ebp - 0x5c4], edx
mov eax, dword [ebp - 0x5c4]
cmp eax, dword [ebp - 0xe98]
je 0x100055f7
mov ecx, dword [ebp - 0x5c4]
cmp dword [ecx + 0x30], 0
jne 0x100053ad
mov dword [ebp - 0x398], 0
Function at 0x10005621
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
or edx, 0x17e50
pop edx
push edx
push edx
add esp, 4
add edx, 0x67cf
or edx, 0x1ef5
xor edx, 0xaf1c
sub edx, 0xb3a5
pop edx
push edi
push edi
add esp, 4
sub edi, 0x9826
pop edi
push eax
push esi
add esp, 4
xor eax, 0x26f8
jmp 0x100052b2
sub eax, 0xea06
pop eax
push edx
push esi
add esp, 4
or edx, 0x10330
xor byte [ebx], al
add dword [eax], eax
sub edx, 0x3b60
jmp 0x100052d2
pop edx
mov edx, dword fs:[0x18]
mov dword [ebp - 0x2688], edx
mov eax, dword [ebp - 0x2688]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x268c], ecx
mov edx, dword [ebp - 0x268c]
mov dword [ebp - 0x18ec], edx
push edi
sub edi, 0x5107
call 0x10005312
add byte [edi + 0x3c], cl
aas
inc edi
cmp eax, 0x39333e41
cmp dword [ebx + eax*4], edi
les eax, [eax + ebp*8]
or dword [eax], eax
add byte [eax], al
add byte [0x47484b32], bh
dec ebp
xor dh, byte [0x8104c483]
out dx, eax
or eax, 0x5f00010c
cmp dword [ebp - 0x18ec], 0
jne 0x10005345
mov dword [ebp - 0x398], 0
jmp 0x10005601
mov eax, dword [ebp - 0x18ec]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xe98], edx
push ecx
call 0x10005367
add byte [edi + 0x4b], cl
push edx
push ecx
add esp, 4
and edx, 0xb47d
xor edx, 0x63b4
call 0x10005621
add byte [ebp + 0x33], al
cmp al, byte [ecx + 0x34]
cmp cl, byte [ebx + 0x42]
cmp eax, 0x8104c483
ljmp 0x575a
Function at 0x10005940
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
add esp, 4
sub edi, 0x8fce
pop edi
push eax
push edx
add esp, 4
and eax, 0x12e0b
add eax, 0x1e0
add eax, 0x8fc8
and eax, 0x12923
pop eax
push edx
add edx, 0x8485
pop edx
lea edx, [ebp - 0x1ac8]
mov dword [ebp - 0xea0], edx
mov eax, dword [ebp - 0x5c8]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xe9c], ecx
xor edx, edx
mov word [ebp - 0x268], dx
xor eax, eax
mov word [ebp - 0x13c], ax
push ecx
push edi
add esp, 4
add ecx, 0x8f59
add ecx, 0xa3b2
or ecx, 0x178ef
add ecx, 0xd678
pop ecx
push esi
xor esi, 0x14445
pop esi
push eax
push ecx
add esp, 4
add eax, 0x72f8
pop eax
mov ecx, dword [ebp - 0xe9c]
mov dx, word [ecx]
mov word [ebp - 0x12b2], dx
mov eax, dword [ebp - 0xe9c]
add eax, 2
mov dword [ebp - 0xe9c], eax
mov cx, word [ebp - 0x12b2]
mov word [ebp - 0x268], cx
mov edx, dword [ebp - 0xea0]
mov ax, word [edx]
mov word [ebp - 0x12b4], ax
mov ecx, dword [ebp - 0xea0]
add ecx, 2
mov dword [ebp - 0xea0], ecx
mov dx, word [ebp - 0x12b4]
mov word [ebp - 0x13c], dx
push edx
and edx, 0x11bb5
call fcn.10005940
add byte [edi], dh
inc edi
cmp bh, byte [esi]
cmp bh, byte [edi]
dec ebx
cmp eax, 0x4c48339
add esp, 4
add esp, 4
xor edx, 0xfe53
pop edx
push ecx
push esi
add esp, 4
xor ecx, 0xa145
and ecx, 0xd07
pop ecx
movzx eax, word [ebp - 0x13c]
test eax, eax
jne 0x1000597f
movzx ecx, word [ebp - 0x268]
movzx edx, word [ebp - 0x13c]
sub ecx, edx
mov dword [ebp - 0x1900], ecx
jmp 0x100059e2
movzx eax, word [ebp - 0x268]
movzx ecx, word [ebp - 0x13c]
cmp eax, ecx
je 0x1000589e
movzx edx, word [ebp - 0x268]
xor edx, 0x20
movzx eax, word [ebp - 0x13c]
cmp edx, eax
je 0x1000589e
movzx ecx, word [ebp - 0x268]
movzx edx, word [ebp - 0x13c]
cmp ecx, edx
jge 0x100059cc
mov dword [ebp - 0x18fc], 0xffffffff
jmp 0x100059d6
mov dword [ebp - 0x18fc], 1
mov eax, dword [ebp - 0x18fc]
mov dword [ebp - 0x1900], eax
cmp dword [ebp - 0x1900], 0
jne 0x10005a2b
push eax
push edx
add esp, 4
call 0x100059fc
add byte [esi], bh
cmp dword [ecx + 0x35], ecx
cmp dword [eax - 0x7d], edx
les eax, [ecx + eax*4]
call int.1000b00b
jmp 0x10005a0c
call 0x10005a19
add byte [ebx + 0x3d], al
cmp byte [edi + 0x4d], cl
inc edi
xor al, byte [ebx - 0x74a7fb3c]
lea edi, [eax]
cli
invalid
push ebx
xor ebx, 0xc8ac
xor ebx, 0x11640
pop ebx
push esi
push edx
add esp, 4
and esi, 0x1010e
jmp 0x10005a49
pop esi
push eax
jmp 0x10005a50
sub eax, 0x147ce
or eax, 0x1319
pop eax
mov edx, dword [ebp - 0x5c8]
mov eax, dword [edx]
mov dword [ebp - 0x5c8], eax
mov ecx, dword [ebp - 0x5c8]
cmp ecx, dword [ebp - 0xea4]
je 0x10005a89
mov edx, dword [ebp - 0x5c8]
cmp dword [edx + 0x30], 0
jne 0x1000583f
mov dword [ebp - 0x870], 0
push edi
call 0x10005aa2
add byte [eax + 0x3c], al
inc eax
cmp dword [edi + 0x50], ecx
dec esp
xor al, byte [ebx - 0x187efb3c]
popfd
jmp 0x625f5aad
Function at 0x10005a19
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
add esp, 4
sub edi, 0x8fce
pop edi
push eax
push edx
add esp, 4
and eax, 0x12e0b
add eax, 0x1e0
add eax, 0x8fc8
and eax, 0x12923
pop eax
push edx
add edx, 0x8485
pop edx
lea edx, [ebp - 0x1ac8]
mov dword [ebp - 0xea0], edx
mov eax, dword [ebp - 0x5c8]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xe9c], ecx
xor edx, edx
mov word [ebp - 0x268], dx
xor eax, eax
mov word [ebp - 0x13c], ax
push ecx
push edi
add esp, 4
add ecx, 0x8f59
add ecx, 0xa3b2
or ecx, 0x178ef
add ecx, 0xd678
pop ecx
push esi
xor esi, 0x14445
pop esi
push eax
push ecx
add esp, 4
add eax, 0x72f8
pop eax
mov ecx, dword [ebp - 0xe9c]
mov dx, word [ecx]
mov word [ebp - 0x12b2], dx
mov eax, dword [ebp - 0xe9c]
add eax, 2
mov dword [ebp - 0xe9c], eax
mov cx, word [ebp - 0x12b2]
mov word [ebp - 0x268], cx
mov edx, dword [ebp - 0xea0]
mov ax, word [edx]
mov word [ebp - 0x12b4], ax
mov ecx, dword [ebp - 0xea0]
add ecx, 2
mov dword [ebp - 0xea0], ecx
mov dx, word [ebp - 0x12b4]
mov word [ebp - 0x13c], dx
push edx
and edx, 0x11bb5
call fcn.10005940
add byte [edi], dh
inc edi
cmp bh, byte [esi]
cmp bh, byte [edi]
dec ebx
cmp eax, 0x4c48339
add esp, 4
add esp, 4
xor edx, 0xfe53
pop edx
push ecx
push esi
add esp, 4
xor ecx, 0xa145
and ecx, 0xd07
pop ecx
movzx eax, word [ebp - 0x13c]
test eax, eax
jne 0x1000597f
movzx ecx, word [ebp - 0x268]
movzx edx, word [ebp - 0x13c]
sub ecx, edx
mov dword [ebp - 0x1900], ecx
jmp 0x100059e2
movzx eax, word [ebp - 0x268]
movzx ecx, word [ebp - 0x13c]
cmp eax, ecx
je 0x1000589e
movzx edx, word [ebp - 0x268]
xor edx, 0x20
movzx eax, word [ebp - 0x13c]
cmp edx, eax
je 0x1000589e
movzx ecx, word [ebp - 0x268]
movzx edx, word [ebp - 0x13c]
cmp ecx, edx
jge 0x100059cc
mov dword [ebp - 0x18fc], 0xffffffff
jmp 0x100059d6
mov dword [ebp - 0x18fc], 1
mov eax, dword [ebp - 0x18fc]
mov dword [ebp - 0x1900], eax
cmp dword [ebp - 0x1900], 0
jne 0x10005a2b
push eax
push edx
add esp, 4
call 0x100059fc
add byte [esi], bh
cmp dword [ecx + 0x35], ecx
cmp dword [eax - 0x7d], edx
les eax, [ecx + eax*4]
call int.1000b00b
jmp 0x10005a0c
call 0x10005a19
add byte [ebx + 0x3d], al
cmp byte [edi + 0x4d], cl
inc edi
xor al, byte [ebx - 0x74a7fb3c]
lea edi, [eax]
cli
invalid
push ebx
xor ebx, 0xc8ac
xor ebx, 0x11640
pop ebx
push esi
push edx
add esp, 4
and esi, 0x1010e
jmp 0x10005a49
pop esi
push eax
jmp 0x10005a50
sub eax, 0x147ce
or eax, 0x1319
pop eax
mov edx, dword [ebp - 0x5c8]
mov eax, dword [edx]
mov dword [ebp - 0x5c8], eax
mov ecx, dword [ebp - 0x5c8]
cmp ecx, dword [ebp - 0xea4]
je 0x10005a89
mov edx, dword [ebp - 0x5c8]
cmp dword [edx + 0x30], 0
jne 0x1000583f
mov dword [ebp - 0x870], 0
push edi
call 0x10005aa2
add byte [eax + 0x3c], al
inc eax
cmp dword [edi + 0x50], ecx
dec esp
xor al, byte [ebx - 0x187efb3c]
popfd
jmp 0x625f5aad