joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x5ba73172
nop
nop
nop
nop
nop
test eax, eax
je 0x42e04e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e024
nop
nop
nop
nop
mov eax, section..rsrc
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x275a7507
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x42e084
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x42e06c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x1002a8d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
lea eax, [ebp + 0x14]
push eax
push edi
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
mov dword [ebp + 0x14], esi
push dword [ebp + 8]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1002ae8
mov eax, dword [ebp + 0x14]
cmp eax, 2
jb 0x1002ae3
shr eax, 1
xor ecx, ecx
cmp cx, word [edi + eax*2 - 2]
jne 0x1002ae3
mov eax, dword [ebp + 0x10]
dec eax
je 0x1002adf
dec eax
jne 0x1002ae3
push esi
push edi
call fcn.01002996
test eax, eax
jne 0x1002ae8
xor eax, eax
jmp 0x1002ae8
mov eax, 0x3f7
pop edi
pop esi
pop ebp
ret 0x10

Function at 0x1002d87
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x1003220
call fcn.01002f44
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x10043c8
push ebx
push esi
push edi
call dword [sym.imp.API_MS_Win_Core_Interlocked_L1_1_0.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x1002b9c
cmp eax, esi
jne 0x1002b8f
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x1002b9f
push 0x3e8
call dword [sym.imp.API_MS_Win_Core_Misc_L1_1_0.dll_Sleep]
jmp 0x1002b76
xor esi, esi
inc esi
mov eax, dword [0x10043c4]
cmp eax, esi
jne 0x1002bb2
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1002bed
mov eax, dword [0x10043c4]
test eax, eax
jne 0x1002be7
mov dword [0x10043c4], esi
push 0x1001188
push 0x100117c
call fcn.01120000
pop ecx
pop ecx
test eax, eax
je 0x1002bed
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x1002cb7
mov dword [0x1004078], esi
mov eax, dword [0x10043c4]
cmp eax, esi
jne 0x1002c11
push 0x1001178
push 0x1001170
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x10043c4], 2
cmp dword [ebp - 0x1c], ebx
jne 0x1002c1e
push ebx
push edi
call dword [sym.imp.API_MS_Win_Core_Interlocked_L1_1_0.dll_InterlockedExchange]
cmp dword [0x10043cc], ebx
je 0x1002c3f
push 0x10043cc
call fcn.01002eb9
pop ecx
test eax, eax
je 0x1002c3f
push ebx
push 2
push ebx
call dword [0x10043cc]
push dword [0x1004060]
push dword [0x1004064]
push dword [0x100405c]
call fcn.010018dc
add esp, 0xc
mov dword [0x1004074], eax
cmp dword [0x1004068], ebx
jne 0x1002c9d
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x1004078], ebx
jne 0x1002cab
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1004074]
call fcn.01002f89
ret
call fcn.01003091
jmp 0x1002b54
Function at 0x51169a
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push eax
push esi
add esp, 4
add eax, 0x71a6
pop eax
push ebx
or ebx, 0x34bc
and ebx, 0x19c2
pop ebx
push eax
push edx
add esp, 4
and eax, 0x226b
add eax, 0x632f
or eax, 0x14a96
pop eax
lea ecx, [ebp - 0x1628]
mov dword [ebp - 0xc1c], ecx
mov edx, dword [ebp - 0x4d4]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xc18], eax
xor ecx, ecx
mov word [ebp - 0x1f8], cx
xor edx, edx
mov word [ebp - 0x100], dx
push eax
push ebx
add esp, 4
add eax, 0xbad0
add eax, 0xe7fb
and eax, 0xeed3
add eax, 0x55df
pop eax
push eax
add eax, 0x78b
or eax, 0x101cb
and eax, 0x23d0
pop eax
mov eax, dword [ebp - 0xc18]
mov cx, word [eax]
mov word [ebp - 0xf7e], cx
mov edx, dword [ebp - 0xc18]
add edx, 2
mov dword [ebp - 0xc18], edx
mov ax, word [ebp - 0xf7e]
mov word [ebp - 0x1f8], ax
mov ecx, dword [ebp - 0xc1c]
mov dx, word [ecx]
mov word [ebp - 0xf80], dx
mov eax, dword [ebp - 0xc1c]
add eax, 2
mov dword [ebp - 0xc1c], eax
mov cx, word [ebp - 0xf80]
mov word [ebp - 0x100], cx
push edx
push ebx
add esp, 4
xor edx, 0x1542d
sub edx, 0x166a
jmp 0x51168b
pop edx
push eax
call fcn.0051169a
add byte [ebx + 0x34], al
dec edi
dec eax
inc edi
dec edx
cmp byte [ebx - 0x3f7efb3c], al
add esp, 4
add eax, 0x10b3a
add esp, 4
add eax, 0x10b3a
pop eax
movzx edx, word [ebp - 0x100]
test edx, edx
jne 0x5116c7
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
sub eax, ecx
mov dword [ebp - 0x1498], eax
jmp 0x51172a
movzx edx, word [ebp - 0x1f8]
movzx eax, word [ebp - 0x100]
cmp edx, eax
je 0x5115e6
movzx ecx, word [ebp - 0x1f8]
xor ecx, 0x20
movzx edx, word [ebp - 0x100]
cmp ecx, edx
je 0x5115e6
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
cmp eax, ecx
jge 0x511714
mov dword [ebp - 0x14d8], 0xffffffff
jmp 0x51171e
mov dword [ebp - 0x14d8], 1
mov edx, dword [ebp - 0x14d8]
mov dword [ebp - 0x1498], edx
cmp dword [ebp - 0x1498], 0
jne 0x511773
push esi
push edi
add esp, 4
xor esi, 0xc526
call 0x51174a
add byte [esi + 0x50], al
aaa
inc ebp
inc ecx
push eax
add esp, 4
call 0x51175b
add byte [ebx], dh
dec eax
aas
cmp ecx, dword [ecx + 0x33]
xor cl, byte [edx - 0x7d]
les eax, [ecx + eax*4]
into
mov dh, 0x51
add dword [eax], eax
pop esi
mov eax, dword [ebp - 0x4d4]
mov dword [ebp - 0x2e0], eax
jmp 0x5117db
push edx
push edx
add esp, 4
sub edx, 0xc50a
pop edx
push esi
xor esi, 0x14a99
or esi, 0xb0c7
pop esi
push ebx
push edi
add esp, 4
sub ebx, 0xe107
or ebx, 0x148c1
xor ebx, 0x1865c
pop ebx
mov ecx, dword [ebp - 0x4d4]
mov edx, dword [ecx]
mov dword [ebp - 0x4d4], edx
mov eax, dword [ebp - 0x4d4]
cmp eax, dword [ebp - 0xc20]
je 0x5117d1
mov ecx, dword [ebp - 0x4d4]
cmp dword [ecx + 0x30], 0
jne 0x511587
mov dword [ebp - 0x2e0], 0
Function at 0x51174a
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push eax
push esi
add esp, 4
add eax, 0x71a6
pop eax
push ebx
or ebx, 0x34bc
and ebx, 0x19c2
pop ebx
push eax
push edx
add esp, 4
and eax, 0x226b
add eax, 0x632f
or eax, 0x14a96
pop eax
lea ecx, [ebp - 0x1628]
mov dword [ebp - 0xc1c], ecx
mov edx, dword [ebp - 0x4d4]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xc18], eax
xor ecx, ecx
mov word [ebp - 0x1f8], cx
xor edx, edx
mov word [ebp - 0x100], dx
push eax
push ebx
add esp, 4
add eax, 0xbad0
add eax, 0xe7fb
and eax, 0xeed3
add eax, 0x55df
pop eax
push eax
add eax, 0x78b
or eax, 0x101cb
and eax, 0x23d0
pop eax
mov eax, dword [ebp - 0xc18]
mov cx, word [eax]
mov word [ebp - 0xf7e], cx
mov edx, dword [ebp - 0xc18]
add edx, 2
mov dword [ebp - 0xc18], edx
mov ax, word [ebp - 0xf7e]
mov word [ebp - 0x1f8], ax
mov ecx, dword [ebp - 0xc1c]
mov dx, word [ecx]
mov word [ebp - 0xf80], dx
mov eax, dword [ebp - 0xc1c]
add eax, 2
mov dword [ebp - 0xc1c], eax
mov cx, word [ebp - 0xf80]
mov word [ebp - 0x100], cx
push edx
push ebx
add esp, 4
xor edx, 0x1542d
sub edx, 0x166a
jmp 0x51168b
pop edx
push eax
call fcn.0051169a
add byte [ebx + 0x34], al
dec edi
dec eax
inc edi
dec edx
cmp byte [ebx - 0x3f7efb3c], al
add esp, 4
add eax, 0x10b3a
add esp, 4
add eax, 0x10b3a
pop eax
movzx edx, word [ebp - 0x100]
test edx, edx
jne 0x5116c7
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
sub eax, ecx
mov dword [ebp - 0x1498], eax
jmp 0x51172a
movzx edx, word [ebp - 0x1f8]
movzx eax, word [ebp - 0x100]
cmp edx, eax
je 0x5115e6
movzx ecx, word [ebp - 0x1f8]
xor ecx, 0x20
movzx edx, word [ebp - 0x100]
cmp ecx, edx
je 0x5115e6
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
cmp eax, ecx
jge 0x511714
mov dword [ebp - 0x14d8], 0xffffffff
jmp 0x51171e
mov dword [ebp - 0x14d8], 1
mov edx, dword [ebp - 0x14d8]
mov dword [ebp - 0x1498], edx
cmp dword [ebp - 0x1498], 0
jne 0x511773
push esi
push edi
add esp, 4
xor esi, 0xc526
call 0x51174a
add byte [esi + 0x50], al
aaa
inc ebp
inc ecx
push eax
add esp, 4
call 0x51175b
add byte [ebx], dh
dec eax
aas
cmp ecx, dword [ecx + 0x33]
xor cl, byte [edx - 0x7d]
les eax, [ecx + eax*4]
into
mov dh, 0x51
add dword [eax], eax
pop esi
mov eax, dword [ebp - 0x4d4]
mov dword [ebp - 0x2e0], eax
jmp 0x5117db
push edx
push edx
add esp, 4
sub edx, 0xc50a
pop edx
push esi
xor esi, 0x14a99
or esi, 0xb0c7
pop esi
push ebx
push edi
add esp, 4
sub ebx, 0xe107
or ebx, 0x148c1
xor ebx, 0x1865c
pop ebx
mov ecx, dword [ebp - 0x4d4]
mov edx, dword [ecx]
mov dword [ebp - 0x4d4], edx
mov eax, dword [ebp - 0x4d4]
cmp eax, dword [ebp - 0xc20]
je 0x5117d1
mov ecx, dword [ebp - 0x4d4]
cmp dword [ecx + 0x30], 0
jne 0x511587
mov dword [ebp - 0x2e0], 0
Function at 0x51175b
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push eax
push esi
add esp, 4
add eax, 0x71a6
pop eax
push ebx
or ebx, 0x34bc
and ebx, 0x19c2
pop ebx
push eax
push edx
add esp, 4
and eax, 0x226b
add eax, 0x632f
or eax, 0x14a96
pop eax
lea ecx, [ebp - 0x1628]
mov dword [ebp - 0xc1c], ecx
mov edx, dword [ebp - 0x4d4]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xc18], eax
xor ecx, ecx
mov word [ebp - 0x1f8], cx
xor edx, edx
mov word [ebp - 0x100], dx
push eax
push ebx
add esp, 4
add eax, 0xbad0
add eax, 0xe7fb
and eax, 0xeed3
add eax, 0x55df
pop eax
push eax
add eax, 0x78b
or eax, 0x101cb
and eax, 0x23d0
pop eax
mov eax, dword [ebp - 0xc18]
mov cx, word [eax]
mov word [ebp - 0xf7e], cx
mov edx, dword [ebp - 0xc18]
add edx, 2
mov dword [ebp - 0xc18], edx
mov ax, word [ebp - 0xf7e]
mov word [ebp - 0x1f8], ax
mov ecx, dword [ebp - 0xc1c]
mov dx, word [ecx]
mov word [ebp - 0xf80], dx
mov eax, dword [ebp - 0xc1c]
add eax, 2
mov dword [ebp - 0xc1c], eax
mov cx, word [ebp - 0xf80]
mov word [ebp - 0x100], cx
push edx
push ebx
add esp, 4
xor edx, 0x1542d
sub edx, 0x166a
jmp 0x51168b
pop edx
push eax
call fcn.0051169a
add byte [ebx + 0x34], al
dec edi
dec eax
inc edi
dec edx
cmp byte [ebx - 0x3f7efb3c], al
add esp, 4
add eax, 0x10b3a
add esp, 4
add eax, 0x10b3a
pop eax
movzx edx, word [ebp - 0x100]
test edx, edx
jne 0x5116c7
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
sub eax, ecx
mov dword [ebp - 0x1498], eax
jmp 0x51172a
movzx edx, word [ebp - 0x1f8]
movzx eax, word [ebp - 0x100]
cmp edx, eax
je 0x5115e6
movzx ecx, word [ebp - 0x1f8]
xor ecx, 0x20
movzx edx, word [ebp - 0x100]
cmp ecx, edx
je 0x5115e6
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
cmp eax, ecx
jge 0x511714
mov dword [ebp - 0x14d8], 0xffffffff
jmp 0x51171e
mov dword [ebp - 0x14d8], 1
mov edx, dword [ebp - 0x14d8]
mov dword [ebp - 0x1498], edx
cmp dword [ebp - 0x1498], 0
jne 0x511773
push esi
push edi
add esp, 4
xor esi, 0xc526
call 0x51174a
add byte [esi + 0x50], al
aaa
inc ebp
inc ecx
push eax
add esp, 4
call 0x51175b
add byte [ebx], dh
dec eax
aas
cmp ecx, dword [ecx + 0x33]
xor cl, byte [edx - 0x7d]
les eax, [ecx + eax*4]
into
mov dh, 0x51
add dword [eax], eax
pop esi
mov eax, dword [ebp - 0x4d4]
mov dword [ebp - 0x2e0], eax
jmp 0x5117db
push edx
push edx
add esp, 4
sub edx, 0xc50a
pop edx
push esi
xor esi, 0x14a99
or esi, 0xb0c7
pop esi
push ebx
push edi
add esp, 4
sub ebx, 0xe107
or ebx, 0x148c1
xor ebx, 0x1865c
pop ebx
mov ecx, dword [ebp - 0x4d4]
mov edx, dword [ecx]
mov dword [ebp - 0x4d4], edx
mov eax, dword [ebp - 0x4d4]
cmp eax, dword [ebp - 0xc20]
je 0x5117d1
mov ecx, dword [ebp - 0x4d4]
cmp dword [ecx + 0x30], 0
jne 0x511587
mov dword [ebp - 0x2e0], 0
Function at 0x511aa6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
or edi, 0x15084
jmp 0x511a29
pop edi
push ebx
push edi
add esp, 4
jmp 0x511a38
and ebx, 0x16d7e
and ebx, 0x92a2
jmp 0x511a4a
pop ebx
lea edx, [ebp - 0x16cc]
mov dword [ebp - 0xc28], edx
mov eax, dword [ebp - 0x4d8]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc24], ecx
xor edx, edx
mov word [ebp - 0x1fc], dx
xor eax, eax
mov word [ebp - 0x104], ax
push esi
push edx
add esp, 4
and esi, 0x53e6
jmp 0x511a88
xor esi, 0x7093
pop esi
push esi
push ecx
add esp, 4
jmp 0x511a9a
call fcn.00511aa6
add byte [esi], bh
xor al, 0x40
cmp byte [esi + 0x3b], cl
add esp, 4
pop esi
mov ecx, dword [ebp - 0xc24]
mov dx, word [ecx]
mov word [ebp - 0xf82], dx
mov eax, dword [ebp - 0xc24]
add eax, 2
mov dword [ebp - 0xc24], eax
mov cx, word [ebp - 0xf82]
mov word [ebp - 0x1fc], cx
mov edx, dword [ebp - 0xc28]
mov ax, word [edx]
mov word [ebp - 0xf84], ax
mov ecx, dword [ebp - 0xc28]
add ecx, 2
mov dword [ebp - 0xc28], ecx
mov dx, word [ebp - 0xf84]
mov word [ebp - 0x104], dx
push esi
push edx
add esp, 4
xor esi, 0xdc22
or esi, 0x14004
sub esi, 0x81b
jmp 0x511b23
pop esi
push esi
push ebx
add esp, 4
xor esi, 0x3839
and esi, 0x17e1
pop esi
movzx eax, word [ebp - 0x104]
test eax, eax
jne 0x511b59
movzx ecx, word [ebp - 0x1fc]
movzx edx, word [ebp - 0x104]
sub ecx, edx
mov dword [ebp - 0x14e4], ecx
jmp 0x511bbc
movzx eax, word [ebp - 0x1fc]
movzx ecx, word [ebp - 0x104]
cmp eax, ecx
je 0x511a78
movzx edx, word [ebp - 0x1fc]
xor edx, 0x20
movzx eax, word [ebp - 0x104]
cmp edx, eax
je 0x511a78
movzx ecx, word [ebp - 0x1fc]
movzx edx, word [ebp - 0x104]
cmp ecx, edx
jge 0x511ba6
mov dword [ebp - 0x14e0], 0xffffffff
jmp 0x511bb0
mov dword [ebp - 0x14e0], 1
mov eax, dword [ebp - 0x14e0]
mov dword [ebp - 0x14e4], eax
cmp dword [ebp - 0x14e4], 0
jne 0x511c05
push ebx
push eax
add esp, 4
call 0x511bd8
add byte [eax + 0x39], al
dec ebx
dec ecx
cmp eax, 0x834a4a33
les eax, [ebx + ebx*2]
push eax
call 0x511bed
add byte [ebx], bh
xor cl, byte [ebp + 0x3b]
dec ebp
inc ebx
dec esi
xor al, 0x4a
dec ecx
add esp, 4
jmp 0x511bf6
pop eax
mov ecx, dword [ebp - 0x4d8]
mov dword [ebp - 0x6ec], ecx
jmp 0x511c6d
push eax
push esi
add esp, 4
xor eax, 0x330c
and eax, 0x6361
xor eax, 0x14a3d
pop eax
push eax
and eax, 0x6c5c
and eax, 0x15005
sub eax, 0xee88
add eax, 0x16a8a
pop eax
mov edx, dword [ebp - 0x4d8]
mov eax, dword [edx]
mov dword [ebp - 0x4d8], eax
mov ecx, dword [ebp - 0x4d8]
cmp ecx, dword [ebp - 0xc2c]
je 0x511c63
mov edx, dword [ebp - 0x4d8]
cmp dword [edx + 0x30], 0
jne 0x511a19
mov dword [ebp - 0x6ec], 0
Function at 0x511bd8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
or edi, 0x15084
jmp 0x511a29
pop edi
push ebx
push edi
add esp, 4
jmp 0x511a38
and ebx, 0x16d7e
and ebx, 0x92a2
jmp 0x511a4a
pop ebx
lea edx, [ebp - 0x16cc]
mov dword [ebp - 0xc28], edx
mov eax, dword [ebp - 0x4d8]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc24], ecx
xor edx, edx
mov word [ebp - 0x1fc], dx
xor eax, eax
mov word [ebp - 0x104], ax
push esi
push edx
add esp, 4
and esi, 0x53e6
jmp 0x511a88
xor esi, 0x7093
pop esi
push esi
push ecx
add esp, 4
jmp 0x511a9a
call fcn.00511aa6
add byte [esi], bh
xor al, 0x40
cmp byte [esi + 0x3b], cl
add esp, 4
pop esi
mov ecx, dword [ebp - 0xc24]
mov dx, word [ecx]
mov word [ebp - 0xf82], dx
mov eax, dword [ebp - 0xc24]
add eax, 2
mov dword [ebp - 0xc24], eax
mov cx, word [ebp - 0xf82]
mov word [ebp - 0x1fc], cx
mov edx, dword [ebp - 0xc28]
mov ax, word [edx]
mov word [ebp - 0xf84], ax
mov ecx, dword [ebp - 0xc28]
add ecx, 2
mov dword [ebp - 0xc28], ecx
mov dx, word [ebp - 0xf84]
mov word [ebp - 0x104], dx
push esi
push edx
add esp, 4
xor esi, 0xdc22
or esi, 0x14004
sub esi, 0x81b
jmp 0x511b23
pop esi
push esi
push ebx
add esp, 4
xor esi, 0x3839
and esi, 0x17e1
pop esi
movzx eax, word [ebp - 0x104]
test eax, eax
jne 0x511b59
movzx ecx, word [ebp - 0x1fc]
movzx edx, word [ebp - 0x104]
sub ecx, edx
mov dword [ebp - 0x14e4], ecx
jmp 0x511bbc
movzx eax, word [ebp - 0x1fc]
movzx ecx, word [ebp - 0x104]
cmp eax, ecx
je 0x511a78
movzx edx, word [ebp - 0x1fc]
xor edx, 0x20
movzx eax, word [ebp - 0x104]
cmp edx, eax
je 0x511a78
movzx ecx, word [ebp - 0x1fc]
movzx edx, word [ebp - 0x104]
cmp ecx, edx
jge 0x511ba6
mov dword [ebp - 0x14e0], 0xffffffff
jmp 0x511bb0
mov dword [ebp - 0x14e0], 1
mov eax, dword [ebp - 0x14e0]
mov dword [ebp - 0x14e4], eax
cmp dword [ebp - 0x14e4], 0
jne 0x511c05
push ebx
push eax
add esp, 4
call 0x511bd8
add byte [eax + 0x39], al
dec ebx
dec ecx
cmp eax, 0x834a4a33
les eax, [ebx + ebx*2]
push eax
call 0x511bed
add byte [ebx], bh
xor cl, byte [ebp + 0x3b]
dec ebp
inc ebx
dec esi
xor al, 0x4a
dec ecx
add esp, 4
jmp 0x511bf6
pop eax
mov ecx, dword [ebp - 0x4d8]
mov dword [ebp - 0x6ec], ecx
jmp 0x511c6d
push eax
push esi
add esp, 4
xor eax, 0x330c
and eax, 0x6361
xor eax, 0x14a3d
pop eax
push eax
and eax, 0x6c5c
and eax, 0x15005
sub eax, 0xee88
add eax, 0x16a8a
pop eax
mov edx, dword [ebp - 0x4d8]
mov eax, dword [edx]
mov dword [ebp - 0x4d8], eax
mov ecx, dword [ebp - 0x4d8]
cmp ecx, dword [ebp - 0xc2c]
je 0x511c63
mov edx, dword [ebp - 0x4d8]
cmp dword [edx + 0x30], 0
jne 0x511a19
mov dword [ebp - 0x6ec], 0
Function at 0x511bed
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
or edi, 0x15084
jmp 0x511a29
pop edi
push ebx
push edi
add esp, 4
jmp 0x511a38
and ebx, 0x16d7e
and ebx, 0x92a2
jmp 0x511a4a
pop ebx
lea edx, [ebp - 0x16cc]
mov dword [ebp - 0xc28], edx
mov eax, dword [ebp - 0x4d8]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc24], ecx
xor edx, edx
mov word [ebp - 0x1fc], dx
xor eax, eax
mov word [ebp - 0x104], ax
push esi
push edx
add esp, 4
and esi, 0x53e6
jmp 0x511a88
xor esi, 0x7093
pop esi
push esi
push ecx
add esp, 4
jmp 0x511a9a
call fcn.00511aa6
add byte [esi], bh
xor al, 0x40
cmp byte [esi + 0x3b], cl
add esp, 4
pop esi
mov ecx, dword [ebp - 0xc24]
mov dx, word [ecx]
mov word [ebp - 0xf82], dx
mov eax, dword [ebp - 0xc24]
add eax, 2
mov dword [ebp - 0xc24], eax
mov cx, word [ebp - 0xf82]
mov word [ebp - 0x1fc], cx
mov edx, dword [ebp - 0xc28]
mov ax, word [edx]
mov word [ebp - 0xf84], ax
mov ecx, dword [ebp - 0xc28]
add ecx, 2
mov dword [ebp - 0xc28], ecx
mov dx, word [ebp - 0xf84]
mov word [ebp - 0x104], dx
push esi
push edx
add esp, 4
xor esi, 0xdc22
or esi, 0x14004
sub esi, 0x81b
jmp 0x511b23
pop esi
push esi
push ebx
add esp, 4
xor esi, 0x3839
and esi, 0x17e1
pop esi
movzx eax, word [ebp - 0x104]
test eax, eax
jne 0x511b59
movzx ecx, word [ebp - 0x1fc]
movzx edx, word [ebp - 0x104]
sub ecx, edx
mov dword [ebp - 0x14e4], ecx
jmp 0x511bbc
movzx eax, word [ebp - 0x1fc]
movzx ecx, word [ebp - 0x104]
cmp eax, ecx
je 0x511a78
movzx edx, word [ebp - 0x1fc]
xor edx, 0x20
movzx eax, word [ebp - 0x104]
cmp edx, eax
je 0x511a78
movzx ecx, word [ebp - 0x1fc]
movzx edx, word [ebp - 0x104]
cmp ecx, edx
jge 0x511ba6
mov dword [ebp - 0x14e0], 0xffffffff
jmp 0x511bb0
mov dword [ebp - 0x14e0], 1
mov eax, dword [ebp - 0x14e0]
mov dword [ebp - 0x14e4], eax
cmp dword [ebp - 0x14e4], 0
jne 0x511c05
push ebx
push eax
add esp, 4
call 0x511bd8
add byte [eax + 0x39], al
dec ebx
dec ecx
cmp eax, 0x834a4a33
les eax, [ebx + ebx*2]
push eax
call 0x511bed
add byte [ebx], bh
xor cl, byte [ebp + 0x3b]
dec ebp
inc ebx
dec esi
xor al, 0x4a
dec ecx
add esp, 4
jmp 0x511bf6
pop eax
mov ecx, dword [ebp - 0x4d8]
mov dword [ebp - 0x6ec], ecx
jmp 0x511c6d
push eax
push esi
add esp, 4
xor eax, 0x330c
and eax, 0x6361
xor eax, 0x14a3d
pop eax
push eax
and eax, 0x6c5c
and eax, 0x15005
sub eax, 0xee88
add eax, 0x16a8a
pop eax
mov edx, dword [ebp - 0x4d8]
mov eax, dword [edx]
mov dword [ebp - 0x4d8], eax
mov ecx, dword [ebp - 0x4d8]
cmp ecx, dword [ebp - 0xc2c]
je 0x511c63
mov edx, dword [ebp - 0x4d8]
cmp dword [edx + 0x30], 0
jne 0x511a19
mov dword [ebp - 0x6ec], 0
Function at 0x51295d
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x512970
add byte [esi + 0x3a], cl
aaa
inc ecx
dec edi
inc ebp
cmp eax, 0x83324648
les eax, [ecx + ebx*2]
mov byte [ebp - 0x960], 0x56
mov byte [ebp - 0x95f], 0x69
mov byte [ebp - 0x95e], 0x72
mov byte [ebp - 0x95d], 0x74
mov byte [ebp - 0x95c], 0x75
mov byte [ebp - 0x95b], 0x61
mov byte [ebp - 0x95a], 0x6c
mov byte [ebp - 0x959], 0x50
mov byte [ebp - 0x958], 0x72
mov byte [ebp - 0x957], 0x6f
mov byte [ebp - 0x956], 0x74
mov byte [ebp - 0x955], 0x65
mov byte [ebp - 0x954], 0x63
mov byte [ebp - 0x953], 0x74
mov byte [ebp - 0x952], 0
push edx
push ecx
add esp, 4
jmp 0x5129ea
xor edx, 0xdb77
and edx, 0x918f
add edx, 0x60f0
pop edx
push esi
push ecx
add esp, 4
and esi, 0xc056
xor esi, 0xaf0
pop esi
mov eax, dword fs:[0x18]
mov dword [ebp - 0x1c34], eax
mov ecx, dword [ebp - 0x1c34]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x18d4], edx
mov eax, dword [ebp - 0x18d4]
mov dword [ebp - 0x150c], eax
push eax
push ebx
add esp, 4
or eax, 0x17663
add eax, 0xec79
add eax, 0x6436
xor eax, 0x2d29
pop eax
push ebx
xor ebx, 0x1d5e
or ebx, 0x211b
or ebx, 0xa04f
pop ebx
cmp dword [ebp - 0x150c], 0
jne 0x512a80
mov dword [ebp - 0x2a8], 0
jmp 0x512d27
mov ecx, dword [ebp - 0x150c]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xc4c], eax
push ecx
and ecx, 0x650e
add ecx, 0xb5ff
sub ecx, 0x15a06
add ecx, 0xdb7a
pop ecx
push ebx
push ecx
add esp, 4
sub ebx, 0xc048
sub ebx, 0x7abf
or ebx, 0xd15e
pop ebx
cmp dword [ebp - 0xc4c], 0
jne 0x512adc
mov dword [ebp - 0x2a8], 0
jmp 0x512d27
mov ecx, dword [ebp - 0xc4c]
mov dword [ebp - 0x4e4], ecx
Function at 0x512970
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x512970
add byte [esi + 0x3a], cl
aaa
inc ecx
dec edi
inc ebp
cmp eax, 0x83324648
les eax, [ecx + ebx*2]
mov byte [ebp - 0x960], 0x56
mov byte [ebp - 0x95f], 0x69
mov byte [ebp - 0x95e], 0x72
mov byte [ebp - 0x95d], 0x74
mov byte [ebp - 0x95c], 0x75
mov byte [ebp - 0x95b], 0x61
mov byte [ebp - 0x95a], 0x6c
mov byte [ebp - 0x959], 0x50
mov byte [ebp - 0x958], 0x72
mov byte [ebp - 0x957], 0x6f
mov byte [ebp - 0x956], 0x74
mov byte [ebp - 0x955], 0x65
mov byte [ebp - 0x954], 0x63
mov byte [ebp - 0x953], 0x74
mov byte [ebp - 0x952], 0
push edx
push ecx
add esp, 4
jmp 0x5129ea
xor edx, 0xdb77
and edx, 0x918f
add edx, 0x60f0
pop edx
push esi
push ecx
add esp, 4
and esi, 0xc056
xor esi, 0xaf0
pop esi
mov eax, dword fs:[0x18]
mov dword [ebp - 0x1c34], eax
mov ecx, dword [ebp - 0x1c34]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x18d4], edx
mov eax, dword [ebp - 0x18d4]
mov dword [ebp - 0x150c], eax
push eax
push ebx
add esp, 4
or eax, 0x17663
add eax, 0xec79
add eax, 0x6436
xor eax, 0x2d29
pop eax
push ebx
xor ebx, 0x1d5e
or ebx, 0x211b
or ebx, 0xa04f
pop ebx
cmp dword [ebp - 0x150c], 0
jne 0x512a80
mov dword [ebp - 0x2a8], 0
jmp 0x512d27
mov ecx, dword [ebp - 0x150c]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xc4c], eax
push ecx
and ecx, 0x650e
add ecx, 0xb5ff
sub ecx, 0x15a06
add ecx, 0xdb7a
pop ecx
push ebx
push ecx
add esp, 4
sub ebx, 0xc048
sub ebx, 0x7abf
or ebx, 0xd15e
pop ebx
cmp dword [ebp - 0xc4c], 0
jne 0x512adc
mov dword [ebp - 0x2a8], 0
jmp 0x512d27
mov ecx, dword [ebp - 0xc4c]
mov dword [ebp - 0x4e4], ecx