joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5657c9
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
jl 0x565764
add byte [ecx + 0xbfc4ce], al
add byte [ecx + 0x12200e6], al
add byte [ecx + 0xc173ce], al
add byte [esi + 0x52], bl
or esi, 0xbfc4
and esi, 0x12200
or esi, 0xc173
pop esi
push edx
jmp 0x56577e
pop edx
cmp dword [ebp - 0x4b4], 0
jne 0x565797
mov dword [ebp - 0xa8], 0
jmp 0x565a19
mov edx, dword [ebp - 0x4b4]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x2d4], ecx
push ecx
push edx
add esp, 4
sub ecx, 0xaeb2
pop ecx
push ecx
and ecx, 0xcaf
call 0x5657c9
add byte [esi + 0x41], cl
inc edx
inc ecx
cmp cl, byte [ebp + 0x44]
dec ebp
inc esp
add esp, 4
jmp 0x5657d4
xor ecx, 0x6fc2
pop ecx
cmp dword [ebp - 0x2d4], 0
jne 0x5657f3
mov dword [ebp - 0xa8], 0
jmp 0x565a19
mov edx, dword [ebp - 0x2d4]
mov dword [ebp - 0xfc], edx
push edi
or edi, 0xf3ff
pop edi
push ecx
push ebx
add esp, 4
sub ecx, 0xa07a
pop ecx
push edi
push esi
add esp, 4
sub edi, 0x11b2
xor edi, 0x11324
jmp 0x56582a
sub edi, 0x9ac2
pop edi
lea eax, [ebp - 0x55c]
mov dword [ebp - 0x2d0], eax
mov ecx, dword [ebp - 0xfc]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x2cc], edx
xor eax, eax
mov word [ebp - 0x80], ax
xor ecx, ecx
mov word [ebp - 0x44], cx
push esi
add esi, 0x885c
jmp 0x565864
jmp 0x56586c
pop esi
push ebx
xor ebx, 0xe535
call 0x565880
add byte [eax + eax*2], bh
inc eax
dec ebp
dec edx
dec ebp
add esp, 4
xor ebx, 0x17517
pop ebx
mov edx, dword [ebp - 0x2cc]
mov ax, word [edx]
mov word [ebp - 0x322], ax
mov ecx, dword [ebp - 0x2cc]
add ecx, 2
mov dword [ebp - 0x2cc], ecx
mov dx, word [ebp - 0x322]
mov word [ebp - 0x80], dx
mov eax, dword [ebp - 0x2d0]
mov cx, word [eax]
mov word [ebp - 0x386], cx
mov edx, dword [ebp - 0x2d0]
add edx, 2
mov dword [ebp - 0x2d0], edx
mov ax, word [ebp - 0x386]
mov word [ebp - 0x44], ax
push eax
xor eax, 0x110f7
xor eax, 0x168b0
jmp 0x5658f1
pop eax
push ebx
push ebx
add esp, 4
xor ebx, 0x11ce9
and ebx, 0xb8f1
xor ebx, 0x143f3
xor ebx, 0x744b
pop ebx
movzx ecx, word [ebp - 0x44]
test ecx, ecx
jne 0x56592a
movzx edx, word [ebp - 0x80]
movzx eax, word [ebp - 0x44]
sub edx, eax
mov dword [ebp - 0x4bc], edx
jmp 0x565968
movzx ecx, word [ebp - 0x80]
movzx edx, word [ebp - 0x44]
cmp ecx, edx
je 0x565858
movzx eax, word [ebp - 0x80]
movzx ecx, word [ebp - 0x44]
cmp eax, ecx
jge 0x565952
mov dword [ebp - 0x4b8], 0xffffffff
jmp 0x56595c
mov dword [ebp - 0x4b8], 1
mov edx, dword [ebp - 0x4b8]
mov dword [ebp - 0x4bc], edx
cmp dword [ebp - 0x4bc], 0
jne 0x5659b1
push esi
sub esi, 0x1017a
or esi, 0x17544
add esi, 0xc3a5
pop esi
push edi
add edi, 0x16d9a
add edi, 0x2350
call 0x56599f
add byte [0x503f3332], bh
inc ecx
dec ecx
add esp, 4
pop edi
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0xa8], eax
jmp 0x565a19
push eax
jmp 0x5659b8
xor eax, 0x21c4
call 0x5659cb
add byte [eax + ecx*2 + 0x4c], cl
xor al, 0x4f
cmp byte [ecx - 0x7d], cl
les eax, [eax + ebx*2]
push esi
invalid
Function at 0x565880
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
jl 0x565764
add byte [ecx + 0xbfc4ce], al
add byte [ecx + 0x12200e6], al
add byte [ecx + 0xc173ce], al
add byte [esi + 0x52], bl
or esi, 0xbfc4
and esi, 0x12200
or esi, 0xc173
pop esi
push edx
jmp 0x56577e
pop edx
cmp dword [ebp - 0x4b4], 0
jne 0x565797
mov dword [ebp - 0xa8], 0
jmp 0x565a19
mov edx, dword [ebp - 0x4b4]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x2d4], ecx
push ecx
push edx
add esp, 4
sub ecx, 0xaeb2
pop ecx
push ecx
and ecx, 0xcaf
call 0x5657c9
add byte [esi + 0x41], cl
inc edx
inc ecx
cmp cl, byte [ebp + 0x44]
dec ebp
inc esp
add esp, 4
jmp 0x5657d4
xor ecx, 0x6fc2
pop ecx
cmp dword [ebp - 0x2d4], 0
jne 0x5657f3
mov dword [ebp - 0xa8], 0
jmp 0x565a19
mov edx, dword [ebp - 0x2d4]
mov dword [ebp - 0xfc], edx
push edi
or edi, 0xf3ff
pop edi
push ecx
push ebx
add esp, 4
sub ecx, 0xa07a
pop ecx
push edi
push esi
add esp, 4
sub edi, 0x11b2
xor edi, 0x11324
jmp 0x56582a
sub edi, 0x9ac2
pop edi
lea eax, [ebp - 0x55c]
mov dword [ebp - 0x2d0], eax
mov ecx, dword [ebp - 0xfc]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x2cc], edx
xor eax, eax
mov word [ebp - 0x80], ax
xor ecx, ecx
mov word [ebp - 0x44], cx
push esi
add esi, 0x885c
jmp 0x565864
jmp 0x56586c
pop esi
push ebx
xor ebx, 0xe535
call 0x565880
add byte [eax + eax*2], bh
inc eax
dec ebp
dec edx
dec ebp
add esp, 4
xor ebx, 0x17517
pop ebx
mov edx, dword [ebp - 0x2cc]
mov ax, word [edx]
mov word [ebp - 0x322], ax
mov ecx, dword [ebp - 0x2cc]
add ecx, 2
mov dword [ebp - 0x2cc], ecx
mov dx, word [ebp - 0x322]
mov word [ebp - 0x80], dx
mov eax, dword [ebp - 0x2d0]
mov cx, word [eax]
mov word [ebp - 0x386], cx
mov edx, dword [ebp - 0x2d0]
add edx, 2
mov dword [ebp - 0x2d0], edx
mov ax, word [ebp - 0x386]
mov word [ebp - 0x44], ax
push eax
xor eax, 0x110f7
xor eax, 0x168b0
jmp 0x5658f1
pop eax
push ebx
push ebx
add esp, 4
xor ebx, 0x11ce9
and ebx, 0xb8f1
xor ebx, 0x143f3
xor ebx, 0x744b
pop ebx
movzx ecx, word [ebp - 0x44]
test ecx, ecx
jne 0x56592a
movzx edx, word [ebp - 0x80]
movzx eax, word [ebp - 0x44]
sub edx, eax
mov dword [ebp - 0x4bc], edx
jmp 0x565968
movzx ecx, word [ebp - 0x80]
movzx edx, word [ebp - 0x44]
cmp ecx, edx
je 0x565858
movzx eax, word [ebp - 0x80]
movzx ecx, word [ebp - 0x44]
cmp eax, ecx
jge 0x565952
mov dword [ebp - 0x4b8], 0xffffffff
jmp 0x56595c
mov dword [ebp - 0x4b8], 1
mov edx, dword [ebp - 0x4b8]
mov dword [ebp - 0x4bc], edx
cmp dword [ebp - 0x4bc], 0
jne 0x5659b1
push esi
sub esi, 0x1017a
or esi, 0x17544
add esi, 0xc3a5
pop esi
push edi
add edi, 0x16d9a
add edi, 0x2350
call 0x56599f
add byte [0x503f3332], bh
inc ecx
dec ecx
add esp, 4
pop edi
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0xa8], eax
jmp 0x565a19
push eax
jmp 0x5659b8
xor eax, 0x21c4
call 0x5659cb
add byte [eax + ecx*2 + 0x4c], cl
xor al, 0x4f
cmp byte [ecx - 0x7d], cl
les eax, [eax + ebx*2]
push esi
invalid
Function at 0x56599f
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
jl 0x565764
add byte [ecx + 0xbfc4ce], al
add byte [ecx + 0x12200e6], al
add byte [ecx + 0xc173ce], al
add byte [esi + 0x52], bl
or esi, 0xbfc4
and esi, 0x12200
or esi, 0xc173
pop esi
push edx
jmp 0x56577e
pop edx
cmp dword [ebp - 0x4b4], 0
jne 0x565797
mov dword [ebp - 0xa8], 0
jmp 0x565a19
mov edx, dword [ebp - 0x4b4]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x2d4], ecx
push ecx
push edx
add esp, 4
sub ecx, 0xaeb2
pop ecx
push ecx
and ecx, 0xcaf
call 0x5657c9
add byte [esi + 0x41], cl
inc edx
inc ecx
cmp cl, byte [ebp + 0x44]
dec ebp
inc esp
add esp, 4
jmp 0x5657d4
xor ecx, 0x6fc2
pop ecx
cmp dword [ebp - 0x2d4], 0
jne 0x5657f3
mov dword [ebp - 0xa8], 0
jmp 0x565a19
mov edx, dword [ebp - 0x2d4]
mov dword [ebp - 0xfc], edx
push edi
or edi, 0xf3ff
pop edi
push ecx
push ebx
add esp, 4
sub ecx, 0xa07a
pop ecx
push edi
push esi
add esp, 4
sub edi, 0x11b2
xor edi, 0x11324
jmp 0x56582a
sub edi, 0x9ac2
pop edi
lea eax, [ebp - 0x55c]
mov dword [ebp - 0x2d0], eax
mov ecx, dword [ebp - 0xfc]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x2cc], edx
xor eax, eax
mov word [ebp - 0x80], ax
xor ecx, ecx
mov word [ebp - 0x44], cx
push esi
add esi, 0x885c
jmp 0x565864
jmp 0x56586c
pop esi
push ebx
xor ebx, 0xe535
call 0x565880
add byte [eax + eax*2], bh
inc eax
dec ebp
dec edx
dec ebp
add esp, 4
xor ebx, 0x17517
pop ebx
mov edx, dword [ebp - 0x2cc]
mov ax, word [edx]
mov word [ebp - 0x322], ax
mov ecx, dword [ebp - 0x2cc]
add ecx, 2
mov dword [ebp - 0x2cc], ecx
mov dx, word [ebp - 0x322]
mov word [ebp - 0x80], dx
mov eax, dword [ebp - 0x2d0]
mov cx, word [eax]
mov word [ebp - 0x386], cx
mov edx, dword [ebp - 0x2d0]
add edx, 2
mov dword [ebp - 0x2d0], edx
mov ax, word [ebp - 0x386]
mov word [ebp - 0x44], ax
push eax
xor eax, 0x110f7
xor eax, 0x168b0
jmp 0x5658f1
pop eax
push ebx
push ebx
add esp, 4
xor ebx, 0x11ce9
and ebx, 0xb8f1
xor ebx, 0x143f3
xor ebx, 0x744b
pop ebx
movzx ecx, word [ebp - 0x44]
test ecx, ecx
jne 0x56592a
movzx edx, word [ebp - 0x80]
movzx eax, word [ebp - 0x44]
sub edx, eax
mov dword [ebp - 0x4bc], edx
jmp 0x565968
movzx ecx, word [ebp - 0x80]
movzx edx, word [ebp - 0x44]
cmp ecx, edx
je 0x565858
movzx eax, word [ebp - 0x80]
movzx ecx, word [ebp - 0x44]
cmp eax, ecx
jge 0x565952
mov dword [ebp - 0x4b8], 0xffffffff
jmp 0x56595c
mov dword [ebp - 0x4b8], 1
mov edx, dword [ebp - 0x4b8]
mov dword [ebp - 0x4bc], edx
cmp dword [ebp - 0x4bc], 0
jne 0x5659b1
push esi
sub esi, 0x1017a
or esi, 0x17544
add esi, 0xc3a5
pop esi
push edi
add edi, 0x16d9a
add edi, 0x2350
call 0x56599f
add byte [0x503f3332], bh
inc ecx
dec ecx
add esp, 4
pop edi
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0xa8], eax
jmp 0x565a19
push eax
jmp 0x5659b8
xor eax, 0x21c4
call 0x5659cb
add byte [eax + ecx*2 + 0x4c], cl
xor al, 0x4f
cmp byte [ecx - 0x7d], cl
les eax, [eax + ebx*2]
push esi
invalid
Function at 0x5659cb
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
jl 0x565764
add byte [ecx + 0xbfc4ce], al
add byte [ecx + 0x12200e6], al
add byte [ecx + 0xc173ce], al
add byte [esi + 0x52], bl
or esi, 0xbfc4
and esi, 0x12200
or esi, 0xc173
pop esi
push edx
jmp 0x56577e
pop edx
cmp dword [ebp - 0x4b4], 0
jne 0x565797
mov dword [ebp - 0xa8], 0
jmp 0x565a19
mov edx, dword [ebp - 0x4b4]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x2d4], ecx
push ecx
push edx
add esp, 4
sub ecx, 0xaeb2
pop ecx
push ecx
and ecx, 0xcaf
call 0x5657c9
add byte [esi + 0x41], cl
inc edx
inc ecx
cmp cl, byte [ebp + 0x44]
dec ebp
inc esp
add esp, 4
jmp 0x5657d4
xor ecx, 0x6fc2
pop ecx
cmp dword [ebp - 0x2d4], 0
jne 0x5657f3
mov dword [ebp - 0xa8], 0
jmp 0x565a19
mov edx, dword [ebp - 0x2d4]
mov dword [ebp - 0xfc], edx
push edi
or edi, 0xf3ff
pop edi
push ecx
push ebx
add esp, 4
sub ecx, 0xa07a
pop ecx
push edi
push esi
add esp, 4
sub edi, 0x11b2
xor edi, 0x11324
jmp 0x56582a
sub edi, 0x9ac2
pop edi
lea eax, [ebp - 0x55c]
mov dword [ebp - 0x2d0], eax
mov ecx, dword [ebp - 0xfc]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x2cc], edx
xor eax, eax
mov word [ebp - 0x80], ax
xor ecx, ecx
mov word [ebp - 0x44], cx
push esi
add esi, 0x885c
jmp 0x565864
jmp 0x56586c
pop esi
push ebx
xor ebx, 0xe535
call 0x565880
add byte [eax + eax*2], bh
inc eax
dec ebp
dec edx
dec ebp
add esp, 4
xor ebx, 0x17517
pop ebx
mov edx, dword [ebp - 0x2cc]
mov ax, word [edx]
mov word [ebp - 0x322], ax
mov ecx, dword [ebp - 0x2cc]
add ecx, 2
mov dword [ebp - 0x2cc], ecx
mov dx, word [ebp - 0x322]
mov word [ebp - 0x80], dx
mov eax, dword [ebp - 0x2d0]
mov cx, word [eax]
mov word [ebp - 0x386], cx
mov edx, dword [ebp - 0x2d0]
add edx, 2
mov dword [ebp - 0x2d0], edx
mov ax, word [ebp - 0x386]
mov word [ebp - 0x44], ax
push eax
xor eax, 0x110f7
xor eax, 0x168b0
jmp 0x5658f1
pop eax
push ebx
push ebx
add esp, 4
xor ebx, 0x11ce9
and ebx, 0xb8f1
xor ebx, 0x143f3
xor ebx, 0x744b
pop ebx
movzx ecx, word [ebp - 0x44]
test ecx, ecx
jne 0x56592a
movzx edx, word [ebp - 0x80]
movzx eax, word [ebp - 0x44]
sub edx, eax
mov dword [ebp - 0x4bc], edx
jmp 0x565968
movzx ecx, word [ebp - 0x80]
movzx edx, word [ebp - 0x44]
cmp ecx, edx
je 0x565858
movzx eax, word [ebp - 0x80]
movzx ecx, word [ebp - 0x44]
cmp eax, ecx
jge 0x565952
mov dword [ebp - 0x4b8], 0xffffffff
jmp 0x56595c
mov dword [ebp - 0x4b8], 1
mov edx, dword [ebp - 0x4b8]
mov dword [ebp - 0x4bc], edx
cmp dword [ebp - 0x4bc], 0
jne 0x5659b1
push esi
sub esi, 0x1017a
or esi, 0x17544
add esi, 0xc3a5
pop esi
push edi
add edi, 0x16d9a
add edi, 0x2350
call 0x56599f
add byte [0x503f3332], bh
inc ecx
dec ecx
add esp, 4
pop edi
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0xa8], eax
jmp 0x565a19
push eax
jmp 0x5659b8
xor eax, 0x21c4
call 0x5659cb
add byte [eax + ecx*2 + 0x4c], cl
xor al, 0x4f
cmp byte [ecx - 0x7d], cl
les eax, [eax + ebx*2]
push esi
invalid
Function at 0x565a29
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
sub ebx, 0x3a91
call 0x565a3f
add byte [ebx + 0x43], cl
aas
cmp al, 0x40
add esp, 4
pop ebx
push esi
or esi, 0x11374
pop esi
cmp dword [ebp - 0xa8], 0
jne 0x5662aa
mov edx, 0x6b
mov word [ebp - 0x5c8], dx
mov eax, 0x65
mov word [ebp - 0x5c6], ax
mov ecx, 0x72
mov word [ebp - 0x5c4], cx
mov edx, 0x6e
mov word [ebp - 0x5c2], dx
mov eax, 0x65
mov word [ebp - 0x5c0], ax
mov ecx, 0x6c
mov word [ebp - 0x5be], cx
mov edx, 0x33
mov word [ebp - 0x5bc], dx
mov eax, 0x32
xor al, byte [eax]
add byte [eax], al
xor edx, 0xadbc
jmp 0x565bc4
pop edx
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x6f8], ecx
mov edx, dword [ebp - 0x6f8]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x6fc], eax
mov ecx, dword [ebp - 0x6fc]
mov dword [ebp - 0x4d8], ecx
push ebx
push edi
add esp, 4
jmp 0x5662dd
xor ebx, 0xe016
pop ebx
push edi
push ecx
add esp, 4
sub edi, 0x10f6e
or edi, 0x8d7e
add edi, 0x129d1
pop edi
push edi
or edi, 0x14679
pop edi
cmp dword [ebp - 0x4d8], 0
jne 0x56631c
mov dword [ebp - 0xa8], 0
jmp 0x5665ad
mov edx, dword [ebp - 0x4d8]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x2f0], ecx
push ebx
push ecx
add esp, 4
or ebx, 0x1e3b
add ebx, 0x7c7
sub ebx, 0x185eb
or ebx, 0xabeb
pop ebx
push edx
jmp 0x566353
add edx, 0x10633
and edx, 0x128aa
pop edx
cmp dword [ebp - 0x2f0], 0
jne 0x566378
mov dword [ebp - 0xa8], 0
jmp 0x5665ad
mov edx, dword [ebp - 0x2f0]
mov dword [ebp - 0xf4], edx
push eax
xor eax, 0x42bd
and eax, 0x5d1c
pop eax
push ebx
call 0x5663a0
add byte [ebx + 0x41], al
aas
inc esi
xor eax, 0x4c4834f
pop ebx
push edi
push edx
add esp, 4
add edi, 0x29bb
add edi, 0x128a3
pop edi
lea eax, [ebp - 0x55c]
mov dword [ebp - 0x2ec], eax
push esi
call 0x5665ba
add byte [edi + 0x33], cl
inc edi
dec ebp
xor eax, 0x5e04c483
push ebx
jmp 0x5665c4
sub ebx, 0xe925
pop ebx
push esi
sub esi, 0xf5e4
xor esi, 0x1334f
xor esi, 0x15a5
pop esi
mov edx, dword [ebp - 0xa8]
mov eax, dword [edx + 0x18]
mov dword [ebp - 0xb8], eax
push ecx
push edx
add esp, 4
call 0x566602
add byte [eax + edx*2 + 0x48], al
inc esp
push eax
dec ebx
inc ebx
inc eax
cmp eax, dword [ebx + 0x535904c4]
push ebx
add esp, 4
add ebx, 0x13b7c
pop ebx
push esi
jmp 0x566619
sub esi, 0x9225
pop esi
mov dword [ebp - 0x1b4], 0
mov ecx, dword [ebp - 0xb8]
mov dword [ebp - 0x4e4], ecx
cmp dword [ebp - 0x4e4], 0
jne 0x566650
mov edx, dword [ebp - 0x1b4]
mov dword [ebp - 0xf0], edx
jmp 0x566916
mov eax, dword [ebp - 0x4e4]
mov ecx, dword [ebp - 0xb8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x4e8], ecx
jne 0x566678
mov edx, dword [ebp - 0x1b4]
mov dword [ebp - 0xf0], edx
jmp 0x566916
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0x4e8]
mov ecx, dword [ebp - 0x1b4]
mov dword [ebp - 0xf0], ecx
Function at 0x565a3f
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
sub ebx, 0x3a91
call 0x565a3f
add byte [ebx + 0x43], cl
aas
cmp al, 0x40
add esp, 4
pop ebx
push esi
or esi, 0x11374
pop esi
cmp dword [ebp - 0xa8], 0
jne 0x5662aa
mov edx, 0x6b
mov word [ebp - 0x5c8], dx
mov eax, 0x65
mov word [ebp - 0x5c6], ax
mov ecx, 0x72
mov word [ebp - 0x5c4], cx
mov edx, 0x6e
mov word [ebp - 0x5c2], dx
mov eax, 0x65
mov word [ebp - 0x5c0], ax
mov ecx, 0x6c
mov word [ebp - 0x5be], cx
mov edx, 0x33
mov word [ebp - 0x5bc], dx
mov eax, 0x32
xor al, byte [eax]
add byte [eax], al
xor edx, 0xadbc
jmp 0x565bc4
pop edx
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x6f8], ecx
mov edx, dword [ebp - 0x6f8]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x6fc], eax
mov ecx, dword [ebp - 0x6fc]
mov dword [ebp - 0x4d8], ecx
push ebx
push edi
add esp, 4
jmp 0x5662dd
xor ebx, 0xe016
pop ebx
push edi
push ecx
add esp, 4
sub edi, 0x10f6e
or edi, 0x8d7e
add edi, 0x129d1
pop edi
push edi
or edi, 0x14679
pop edi
cmp dword [ebp - 0x4d8], 0
jne 0x56631c
mov dword [ebp - 0xa8], 0
jmp 0x5665ad
mov edx, dword [ebp - 0x4d8]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x2f0], ecx
push ebx
push ecx
add esp, 4
or ebx, 0x1e3b
add ebx, 0x7c7
sub ebx, 0x185eb
or ebx, 0xabeb
pop ebx
push edx
jmp 0x566353
add edx, 0x10633
and edx, 0x128aa
pop edx
cmp dword [ebp - 0x2f0], 0
jne 0x566378
mov dword [ebp - 0xa8], 0
jmp 0x5665ad
mov edx, dword [ebp - 0x2f0]
mov dword [ebp - 0xf4], edx
push eax
xor eax, 0x42bd
and eax, 0x5d1c
pop eax
push ebx
call 0x5663a0
add byte [ebx + 0x41], al
aas
inc esi
xor eax, 0x4c4834f
pop ebx
push edi
push edx
add esp, 4
add edi, 0x29bb
add edi, 0x128a3
pop edi
lea eax, [ebp - 0x55c]
mov dword [ebp - 0x2ec], eax
push esi
call 0x5665ba
add byte [edi + 0x33], cl
inc edi
dec ebp
xor eax, 0x5e04c483
push ebx
jmp 0x5665c4
sub ebx, 0xe925
pop ebx
push esi
sub esi, 0xf5e4
xor esi, 0x1334f
xor esi, 0x15a5
pop esi
mov edx, dword [ebp - 0xa8]
mov eax, dword [edx + 0x18]
mov dword [ebp - 0xb8], eax
push ecx
push edx
add esp, 4
call 0x566602
add byte [eax + edx*2 + 0x48], al
inc esp
push eax
dec ebx
inc ebx
inc eax
cmp eax, dword [ebx + 0x535904c4]
push ebx
add esp, 4
add ebx, 0x13b7c
pop ebx
push esi
jmp 0x566619
sub esi, 0x9225
pop esi
mov dword [ebp - 0x1b4], 0
mov ecx, dword [ebp - 0xb8]
mov dword [ebp - 0x4e4], ecx
cmp dword [ebp - 0x4e4], 0
jne 0x566650
mov edx, dword [ebp - 0x1b4]
mov dword [ebp - 0xf0], edx
jmp 0x566916
mov eax, dword [ebp - 0x4e4]
mov ecx, dword [ebp - 0xb8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x4e8], ecx
jne 0x566678
mov edx, dword [ebp - 0x1b4]
mov dword [ebp - 0xf0], edx
jmp 0x566916
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0x4e8]
mov ecx, dword [ebp - 0x1b4]
mov dword [ebp - 0xf0], ecx

Function at 0x565aad
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
xor al, byte [eax]
add byte [eax], al
mov word [ebp - 0x5ba], ax
mov ecx, 0x2e
invalid
invalid
lea ecx, [eax - 6]
Function at 0x565ad3
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
mov word [ebp - 0x5b4], ax
mov ecx, 0x6c
mov word [ebp - 0x5b2], cx
dec esi
cli
invalid
push dword [ebx]
shl byte [esi - 0x77], cl
xchg ebp, eax
push eax
cli
invalid
call dword [edx + 0x56]
add esp, 4
sub edx, 0xf248
pop edx
push edi
push eax
add esp, 4
or edi, 0x181b7
and edi, 0x148d2
sub edi, 0xa623
add edi, 0x6459
add byte [eax], al
pop edi
push edi
and edi, 0x151cf
pop edi
mov byte [ebp - 0x214], 0x4c
mov byte [ebp - 0x213], 0x6f
mov byte [ebp - 0x212], 0x61
mov byte [ebp - 0x211], 0x64
mov byte [ebp - 0x210], 0x4c
mov byte [ebp - 0x20f], 0x69
mov byte [ebp - 0x20e], 0x62
std
invalid
jmp dword [edx - 0x3a]
test ebx, esi
std
invalid
push dword [edx - 0x3a]
test esp, esi
std
invalid
jmp dword [ecx - 0x3a]
test ebp, esi
std
invalid
push dword [edx - 0x3a]
test esi, esi
std
invalid
invalid
jns 0x565b37
test edi, esi
std
invalid
call dword [edi - 0x3a]
test eax, edi
std
invalid
inc dword [eax]
mov eax, dword fs:[0x18]
mov dword [ebp - 0x6d8], eax
sub cl, bh
invalid
dec dword [ebx - 0x6d773]
dec dword [ebx - 0x6a76cfaf]
and al, 0xf9
invalid
dec dword [ebx - 0x6db7b]
dec dword [ecx - 0x4bf7b]
call dword [edx + 0x52]
add esp, 4
and edx, 0xba5e
jmp 0x565bb6

Function at 0x565bc0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
dec edx
cmp byte [ecx + 0x5a], cl
push edx
push edi
add esp, 4
add edx, 0x9276
xor edx, 0x8df0
pop edx
cmp dword [ebp - 0x4c0], 0
jne 0x565bef
mov dword [ebp - 0x194], 0
jmp 0x565e80
mov ecx, dword [ebp - 0x4c0]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x2e0], eax
push edx
push edx
add esp, 4
add edx, 0x12623
pop edx
push ecx
call 0x565c1b
add byte [eax + 0x3b], al
aaa
cmp byte ss:[ecx - 0x7d], cl
les eax, [ecx + eax*4]
jmp 0x56f9b8
mov dword [ecx + 0x20], edx
push 0
push 8
call fcn.0056f7e8
ret

Function at 0x565c1b
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
dec edx
cmp byte [ecx + 0x5a], cl
push edx
push edi
add esp, 4
add edx, 0x9276
xor edx, 0x8df0
pop edx
cmp dword [ebp - 0x4c0], 0
jne 0x565bef
mov dword [ebp - 0x194], 0
jmp 0x565e80
mov ecx, dword [ebp - 0x4c0]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x2e0], eax
push edx
push edx
add esp, 4
add edx, 0x12623
pop edx
push ecx
call 0x565c1b
add byte [eax + 0x3b], al
aaa
cmp byte ss:[ecx - 0x7d], cl
les eax, [ecx + eax*4]
jmp 0x56f9b8
mov dword [ecx + 0x20], edx
push 0
push 8
call fcn.0056f7e8
ret
Function at 0x565e40
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
and esi, 0x12f0d
pop esi
mov eax, dword [ebp - 0xf8]
mov ecx, dword [eax]
mov dword [ebp - 0xf8], ecx
mov edx, dword [ebp - 0xf8]
cmp edx, dword [ebp - 0x2e0]
je 0x565e76
mov eax, dword [ebp - 0xf8]
cmp dword [eax + 0x30], 0
Function at 0x565eb0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp edi, dword [esi]
xor al, 0x3e
dec ebp
xor eax, 0x4c48349
add esp, 4
pop ebx
mov dword [ebp - 0x1e0], 0
jmp 0x566922

Function at 0x565eb7
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp edi, dword [esi]
xor al, 0x3e
dec ebp
xor eax, 0x4c48349
add esp, 4
pop ebx
mov dword [ebp - 0x1e0], 0
jmp 0x566922
Function at 0x5660ac
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x19c]
add eax, 1
mov dword [ebp - 0x19c], eax
invalid
invalid
invalid
dec dword [ebx - 0x19773]
push 0x8bfffffe
xchg ebp, eax
invalid
invalid
invalid
invalid
cmp edx, dword [ecx + 0x18]
jae 0x5661f5
mov eax, dword [ebp - 0x19c]
mov ecx, dword [ebp - 0x6e0]
mov edx, dword [ebp - 0xbc]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x1a0], edx
mov eax, dword [ebp - 0x19c]
mov ecx, dword [ebp - 0x6e4]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x6e8]
mov ecx, dword [ebp - 0xbc]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x6ec], ecx
mov dword [ebp - 0x14], 0
jmp 0x56607b
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x1a0]
add eax, dword [ebp - 0x14]
movsx ecx, byte [eax]
test ecx, ecx
je 0x566117
mov edx, dword [ebp - 0x14]
movsx eax, byte [ebp + edx - 0x214]
test eax, eax
je 0x566117
push ecx
call 0x5660ac
add byte [eax + 0x41], dl
cmp al, 0x44
dec edi
inc eax
dec eax
add esp, 4
pop ecx
push ebx
push ecx
add esp, 4
sub ebx, 0x6417
pop ebx
push edx
or edx, 0x1bf9
or edx, 0x9633
add edx, 0xfdc3
pop edx
mov ecx, dword [ebp - 0x1a0]
add ecx, dword [ebp - 0x14]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x14]
movsx ecx, byte [ebp + eax - 0x214]
cmp edx, ecx
je 0x566109
mov edx, dword [ebp - 0x1a0]
add edx, dword [ebp - 0x14]
movsx eax, byte [edx]
xor eax, 0x20
mov ecx, dword [ebp - 0x14]
movsx edx, byte [ebp + ecx - 0x214]
cmp eax, edx
jne 0x566110
jmp 0x566072
jmp 0x566117
push edi
jmp 0x56611f
sub edi, 0x6fe7
pop edi
push eax
call 0x566133
add byte [eax], bh
dec esp
cmp al, 0x33
add esp, 4
invalid