joyce8/EMBER2024-capa huggingface dataset:
Function at 0x509b01
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or edi, 0xa093
pop edi
push eax
or eax, 0x75a5
and eax, 0x4e9e
sub eax, 0x1baf
pop eax
xor edx, edx
mov word [ebp - 0x58], dx
xor eax, eax
mov word [ebp - 0xc], ax
push eax
push ecx
add esp, 4
or eax, 0x7085
sub eax, 0xc62b
jmp 0x509b44
sub eax, 0x10a9f
pop eax
push ebx
push eax
add esp, 4
jmp 0x509b56
and ebx, 0x786f
pop ebx
mov ecx, dword [ebp - 0x1f0]
mov dx, word [ecx]
mov word [ebp - 0x28c], dx
mov eax, dword [ebp - 0x1f0]
add eax, 2
mov dword [ebp - 0x1f0], eax
mov cx, word [ebp - 0x28c]
mov word [ebp - 0x58], cx
push eax
push ebx
add esp, 4
call 0x509b9b
add byte [edi + edi + 0x4d], al
aaa
aaa
inc esi
dec esp
inc eax
aas
add esp, 4
pop eax
push ebx
jmp 0x509ba6
or ebx, 0x11921
and ebx, 0x10aec
sub ebx, 0xe9c5
pop ebx
mov edx, dword [ebp - 0x1f4]
mov ax, word [edx]
mov word [ebp - 0x28e], ax
mov ecx, dword [ebp - 0x1f4]
add ecx, 2
mov dword [ebp - 0x1f4], ecx
mov dx, word [ebp - 0x28e]
mov word [ebp - 0xc], dx
push edx
add edx, 0x17c04
pop edx
push ebx
push esi
add esp, 4
or ebx, 0x16f46
or ebx, 0x9bc7
and ebx, 0x7ed6
pop ebx
push edi
push edi
add esp, 4
and edi, 0x248a
and edi, 0x15875
pop edi
movzx eax, word [ebp - 0xc]
test eax, eax
jne 0x509c32
movzx ecx, word [ebp - 0x58]
movzx edx, word [ebp - 0xc]
sub ecx, edx
mov dword [ebp - 0x37c], ecx
jmp 0x509cb5
movzx eax, word [ebp - 0x58]
movzx ecx, word [ebp - 0xc]
cmp eax, ecx
je 0x509b2b
movzx edx, word [ebp - 0x58]
xor edx, 0x20
movzx eax, word [ebp - 0xc]
cmp edx, eax
je 0x509b2b
push edi
call 0x509c65
add byte [eax + 0x48], al
xor eax, dword [esi + 0x34]
dec edi
push eax
cmp dword [eax - 0x7d], ecx
les eax, [ecx + eax*4]
iretd
cmp dword [ebp - 0x37c], 0
jne 0x509d01
push ebx
add ebx, 0xe5d1
and ebx, 0x5e06
pop ebx
push edi
push eax
add esp, 4
sub edi, 0x69e
call 0x509ce6
add byte [eax + ecx*2], bh
aaa
cmp al, 0x4d
inc ebx
cmp al, 0x43
xor al, 0x83
les eax, [ecx + eax*4]
test dword [edx], 0x5f000100
mov edx, dword [ebp - 0xc0]
mov eax, dword [edx]
mov dword [ebp - 0xc0], eax
push ebx
call 0x509d1d
add byte [eax], bh
inc ecx
dec ebp
cmp byte [edi + 0x3a], cl
inc esp
add esp, 4
call 0x509d2f
add byte [0x3b4c4a4b], dh
inc esp
inc ebx
dec eax
cmp al, byte [ebx - 0x347efb3c]
pop edx
sbb al, 0
add bl, ch
push es
inc esi
xor al, 0x49
inc edx
dec edx
pop ebx
mov ecx, dword [ebp - 0xc0]
cmp ecx, dword [ebp - 0x1f8]
je 0x509d5f
mov edx, dword [ebp - 0xc0]
cmp dword [edx + 0x30], 0
jne 0x509aa0
push edx
xor edx, 0x16b6f
and edx, 0x38a8
and edx, 0xe098
pop edx
push eax
push esi
add esp, 4
or eax, 0x4eab
xor eax, 0x2998
sub eax, 0x16973
sub eax, 0x148b1
pop eax
mov dword [ebp - 0x118], 0
Function at 0x509b9b
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or edi, 0xa093
pop edi
push eax
or eax, 0x75a5
and eax, 0x4e9e
sub eax, 0x1baf
pop eax
xor edx, edx
mov word [ebp - 0x58], dx
xor eax, eax
mov word [ebp - 0xc], ax
push eax
push ecx
add esp, 4
or eax, 0x7085
sub eax, 0xc62b
jmp 0x509b44
sub eax, 0x10a9f
pop eax
push ebx
push eax
add esp, 4
jmp 0x509b56
and ebx, 0x786f
pop ebx
mov ecx, dword [ebp - 0x1f0]
mov dx, word [ecx]
mov word [ebp - 0x28c], dx
mov eax, dword [ebp - 0x1f0]
add eax, 2
mov dword [ebp - 0x1f0], eax
mov cx, word [ebp - 0x28c]
mov word [ebp - 0x58], cx
push eax
push ebx
add esp, 4
call 0x509b9b
add byte [edi + edi + 0x4d], al
aaa
aaa
inc esi
dec esp
inc eax
aas
add esp, 4
pop eax
push ebx
jmp 0x509ba6
or ebx, 0x11921
and ebx, 0x10aec
sub ebx, 0xe9c5
pop ebx
mov edx, dword [ebp - 0x1f4]
mov ax, word [edx]
mov word [ebp - 0x28e], ax
mov ecx, dword [ebp - 0x1f4]
add ecx, 2
mov dword [ebp - 0x1f4], ecx
mov dx, word [ebp - 0x28e]
mov word [ebp - 0xc], dx
push edx
add edx, 0x17c04
pop edx
push ebx
push esi
add esp, 4
or ebx, 0x16f46
or ebx, 0x9bc7
and ebx, 0x7ed6
pop ebx
push edi
push edi
add esp, 4
and edi, 0x248a
and edi, 0x15875
pop edi
movzx eax, word [ebp - 0xc]
test eax, eax
jne 0x509c32
movzx ecx, word [ebp - 0x58]
movzx edx, word [ebp - 0xc]
sub ecx, edx
mov dword [ebp - 0x37c], ecx
jmp 0x509cb5
movzx eax, word [ebp - 0x58]
movzx ecx, word [ebp - 0xc]
cmp eax, ecx
je 0x509b2b
movzx edx, word [ebp - 0x58]
xor edx, 0x20
movzx eax, word [ebp - 0xc]
cmp edx, eax
je 0x509b2b
push edi
call 0x509c65
add byte [eax + 0x48], al
xor eax, dword [esi + 0x34]
dec edi
push eax
cmp dword [eax - 0x7d], ecx
les eax, [ecx + eax*4]
iretd
cmp dword [ebp - 0x37c], 0
jne 0x509d01
push ebx
add ebx, 0xe5d1
and ebx, 0x5e06
pop ebx
push edi
push eax
add esp, 4
sub edi, 0x69e
call 0x509ce6
add byte [eax + ecx*2], bh
aaa
cmp al, 0x4d
inc ebx
cmp al, 0x43
xor al, 0x83
les eax, [ecx + eax*4]
test dword [edx], 0x5f000100
mov edx, dword [ebp - 0xc0]
mov eax, dword [edx]
mov dword [ebp - 0xc0], eax
push ebx
call 0x509d1d
add byte [eax], bh
inc ecx
dec ebp
cmp byte [edi + 0x3a], cl
inc esp
add esp, 4
call 0x509d2f
add byte [0x3b4c4a4b], dh
inc esp
inc ebx
dec eax
cmp al, byte [ebx - 0x347efb3c]
pop edx
sbb al, 0
add bl, ch
push es
inc esi
xor al, 0x49
inc edx
dec edx
pop ebx
mov ecx, dword [ebp - 0xc0]
cmp ecx, dword [ebp - 0x1f8]
je 0x509d5f
mov edx, dword [ebp - 0xc0]
cmp dword [edx + 0x30], 0
jne 0x509aa0
push edx
xor edx, 0x16b6f
and edx, 0x38a8
and edx, 0xe098
pop edx
push eax
push esi
add esp, 4
or eax, 0x4eab
xor eax, 0x2998
sub eax, 0x16973
sub eax, 0x148b1
pop eax
mov dword [ebp - 0x118], 0
Function at 0x509c65
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or edi, 0xa093
pop edi
push eax
or eax, 0x75a5
and eax, 0x4e9e
sub eax, 0x1baf
pop eax
xor edx, edx
mov word [ebp - 0x58], dx
xor eax, eax
mov word [ebp - 0xc], ax
push eax
push ecx
add esp, 4
or eax, 0x7085
sub eax, 0xc62b
jmp 0x509b44
sub eax, 0x10a9f
pop eax
push ebx
push eax
add esp, 4
jmp 0x509b56
and ebx, 0x786f
pop ebx
mov ecx, dword [ebp - 0x1f0]
mov dx, word [ecx]
mov word [ebp - 0x28c], dx
mov eax, dword [ebp - 0x1f0]
add eax, 2
mov dword [ebp - 0x1f0], eax
mov cx, word [ebp - 0x28c]
mov word [ebp - 0x58], cx
push eax
push ebx
add esp, 4
call 0x509b9b
add byte [edi + edi + 0x4d], al
aaa
aaa
inc esi
dec esp
inc eax
aas
add esp, 4
pop eax
push ebx
jmp 0x509ba6
or ebx, 0x11921
and ebx, 0x10aec
sub ebx, 0xe9c5
pop ebx
mov edx, dword [ebp - 0x1f4]
mov ax, word [edx]
mov word [ebp - 0x28e], ax
mov ecx, dword [ebp - 0x1f4]
add ecx, 2
mov dword [ebp - 0x1f4], ecx
mov dx, word [ebp - 0x28e]
mov word [ebp - 0xc], dx
push edx
add edx, 0x17c04
pop edx
push ebx
push esi
add esp, 4
or ebx, 0x16f46
or ebx, 0x9bc7
and ebx, 0x7ed6
pop ebx
push edi
push edi
add esp, 4
and edi, 0x248a
and edi, 0x15875
pop edi
movzx eax, word [ebp - 0xc]
test eax, eax
jne 0x509c32
movzx ecx, word [ebp - 0x58]
movzx edx, word [ebp - 0xc]
sub ecx, edx
mov dword [ebp - 0x37c], ecx
jmp 0x509cb5
movzx eax, word [ebp - 0x58]
movzx ecx, word [ebp - 0xc]
cmp eax, ecx
je 0x509b2b
movzx edx, word [ebp - 0x58]
xor edx, 0x20
movzx eax, word [ebp - 0xc]
cmp edx, eax
je 0x509b2b
push edi
call 0x509c65
add byte [eax + 0x48], al
xor eax, dword [esi + 0x34]
dec edi
push eax
cmp dword [eax - 0x7d], ecx
les eax, [ecx + eax*4]
iretd
cmp dword [ebp - 0x37c], 0
jne 0x509d01
push ebx
add ebx, 0xe5d1
and ebx, 0x5e06
pop ebx
push edi
push eax
add esp, 4
sub edi, 0x69e
call 0x509ce6
add byte [eax + ecx*2], bh
aaa
cmp al, 0x4d
inc ebx
cmp al, 0x43
xor al, 0x83
les eax, [ecx + eax*4]
test dword [edx], 0x5f000100
mov edx, dword [ebp - 0xc0]
mov eax, dword [edx]
mov dword [ebp - 0xc0], eax
push ebx
call 0x509d1d
add byte [eax], bh
inc ecx
dec ebp
cmp byte [edi + 0x3a], cl
inc esp
add esp, 4
call 0x509d2f
add byte [0x3b4c4a4b], dh
inc esp
inc ebx
dec eax
cmp al, byte [ebx - 0x347efb3c]
pop edx
sbb al, 0
add bl, ch
push es
inc esi
xor al, 0x49
inc edx
dec edx
pop ebx
mov ecx, dword [ebp - 0xc0]
cmp ecx, dword [ebp - 0x1f8]
je 0x509d5f
mov edx, dword [ebp - 0xc0]
cmp dword [edx + 0x30], 0
jne 0x509aa0
push edx
xor edx, 0x16b6f
and edx, 0x38a8
and edx, 0xe098
pop edx
push eax
push esi
add esp, 4
or eax, 0x4eab
xor eax, 0x2998
sub eax, 0x16973
sub eax, 0x148b1
pop eax
mov dword [ebp - 0x118], 0

Function at 0x509c7d
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or edi, 0xc99c
pop edi
movzx ecx, word [ebp - 0x58]
movzx edx, word [ebp - 0xc]
cmp ecx, edx
jge 0x509c9f
mov dword [ebp - 0x378], 0xffffffff
jmp 0x509ca9
mov dword [ebp - 0x378], 1
mov eax, dword [ebp - 0x378]
mov dword [ebp - 0x37c], eax
Function at 0x509ce6
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or edi, 0xa093
pop edi
push eax
or eax, 0x75a5
and eax, 0x4e9e
sub eax, 0x1baf
pop eax
xor edx, edx
mov word [ebp - 0x58], dx
xor eax, eax
mov word [ebp - 0xc], ax
push eax
push ecx
add esp, 4
or eax, 0x7085
sub eax, 0xc62b
jmp 0x509b44
sub eax, 0x10a9f
pop eax
push ebx
push eax
add esp, 4
jmp 0x509b56
and ebx, 0x786f
pop ebx
mov ecx, dword [ebp - 0x1f0]
mov dx, word [ecx]
mov word [ebp - 0x28c], dx
mov eax, dword [ebp - 0x1f0]
add eax, 2
mov dword [ebp - 0x1f0], eax
mov cx, word [ebp - 0x28c]
mov word [ebp - 0x58], cx
push eax
push ebx
add esp, 4
call 0x509b9b
add byte [edi + edi + 0x4d], al
aaa
aaa
inc esi
dec esp
inc eax
aas
add esp, 4
pop eax
push ebx
jmp 0x509ba6
or ebx, 0x11921
and ebx, 0x10aec
sub ebx, 0xe9c5
pop ebx
mov edx, dword [ebp - 0x1f4]
mov ax, word [edx]
mov word [ebp - 0x28e], ax
mov ecx, dword [ebp - 0x1f4]
add ecx, 2
mov dword [ebp - 0x1f4], ecx
mov dx, word [ebp - 0x28e]
mov word [ebp - 0xc], dx
push edx
add edx, 0x17c04
pop edx
push ebx
push esi
add esp, 4
or ebx, 0x16f46
or ebx, 0x9bc7
and ebx, 0x7ed6
pop ebx
push edi
push edi
add esp, 4
and edi, 0x248a
and edi, 0x15875
pop edi
movzx eax, word [ebp - 0xc]
test eax, eax
jne 0x509c32
movzx ecx, word [ebp - 0x58]
movzx edx, word [ebp - 0xc]
sub ecx, edx
mov dword [ebp - 0x37c], ecx
jmp 0x509cb5
movzx eax, word [ebp - 0x58]
movzx ecx, word [ebp - 0xc]
cmp eax, ecx
je 0x509b2b
movzx edx, word [ebp - 0x58]
xor edx, 0x20
movzx eax, word [ebp - 0xc]
cmp edx, eax
je 0x509b2b
push edi
call 0x509c65
add byte [eax + 0x48], al
xor eax, dword [esi + 0x34]
dec edi
push eax
cmp dword [eax - 0x7d], ecx
les eax, [ecx + eax*4]
iretd
cmp dword [ebp - 0x37c], 0
jne 0x509d01
push ebx
add ebx, 0xe5d1
and ebx, 0x5e06
pop ebx
push edi
push eax
add esp, 4
sub edi, 0x69e
call 0x509ce6
add byte [eax + ecx*2], bh
aaa
cmp al, 0x4d
inc ebx
cmp al, 0x43
xor al, 0x83
les eax, [ecx + eax*4]
test dword [edx], 0x5f000100
mov edx, dword [ebp - 0xc0]
mov eax, dword [edx]
mov dword [ebp - 0xc0], eax
push ebx
call 0x509d1d
add byte [eax], bh
inc ecx
dec ebp
cmp byte [edi + 0x3a], cl
inc esp
add esp, 4
call 0x509d2f
add byte [0x3b4c4a4b], dh
inc esp
inc ebx
dec eax
cmp al, byte [ebx - 0x347efb3c]
pop edx
sbb al, 0
add bl, ch
push es
inc esi
xor al, 0x49
inc edx
dec edx
pop ebx
mov ecx, dword [ebp - 0xc0]
cmp ecx, dword [ebp - 0x1f8]
je 0x509d5f
mov edx, dword [ebp - 0xc0]
cmp dword [edx + 0x30], 0
jne 0x509aa0
push edx
xor edx, 0x16b6f
and edx, 0x38a8
and edx, 0xe098
pop edx
push eax
push esi
add esp, 4
or eax, 0x4eab
xor eax, 0x2998
sub eax, 0x16973
sub eax, 0x148b1
pop eax
mov dword [ebp - 0x118], 0
Function at 0x509d2f
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or edi, 0xa093
pop edi
push eax
or eax, 0x75a5
and eax, 0x4e9e
sub eax, 0x1baf
pop eax
xor edx, edx
mov word [ebp - 0x58], dx
xor eax, eax
mov word [ebp - 0xc], ax
push eax
push ecx
add esp, 4
or eax, 0x7085
sub eax, 0xc62b
jmp 0x509b44
sub eax, 0x10a9f
pop eax
push ebx
push eax
add esp, 4
jmp 0x509b56
and ebx, 0x786f
pop ebx
mov ecx, dword [ebp - 0x1f0]
mov dx, word [ecx]
mov word [ebp - 0x28c], dx
mov eax, dword [ebp - 0x1f0]
add eax, 2
mov dword [ebp - 0x1f0], eax
mov cx, word [ebp - 0x28c]
mov word [ebp - 0x58], cx
push eax
push ebx
add esp, 4
call 0x509b9b
add byte [edi + edi + 0x4d], al
aaa
aaa
inc esi
dec esp
inc eax
aas
add esp, 4
pop eax
push ebx
jmp 0x509ba6
or ebx, 0x11921
and ebx, 0x10aec
sub ebx, 0xe9c5
pop ebx
mov edx, dword [ebp - 0x1f4]
mov ax, word [edx]
mov word [ebp - 0x28e], ax
mov ecx, dword [ebp - 0x1f4]
add ecx, 2
mov dword [ebp - 0x1f4], ecx
mov dx, word [ebp - 0x28e]
mov word [ebp - 0xc], dx
push edx
add edx, 0x17c04
pop edx
push ebx
push esi
add esp, 4
or ebx, 0x16f46
or ebx, 0x9bc7
and ebx, 0x7ed6
pop ebx
push edi
push edi
add esp, 4
and edi, 0x248a
and edi, 0x15875
pop edi
movzx eax, word [ebp - 0xc]
test eax, eax
jne 0x509c32
movzx ecx, word [ebp - 0x58]
movzx edx, word [ebp - 0xc]
sub ecx, edx
mov dword [ebp - 0x37c], ecx
jmp 0x509cb5
movzx eax, word [ebp - 0x58]
movzx ecx, word [ebp - 0xc]
cmp eax, ecx
je 0x509b2b
movzx edx, word [ebp - 0x58]
xor edx, 0x20
movzx eax, word [ebp - 0xc]
cmp edx, eax
je 0x509b2b
push edi
call 0x509c65
add byte [eax + 0x48], al
xor eax, dword [esi + 0x34]
dec edi
push eax
cmp dword [eax - 0x7d], ecx
les eax, [ecx + eax*4]
iretd
cmp dword [ebp - 0x37c], 0
jne 0x509d01
push ebx
add ebx, 0xe5d1
and ebx, 0x5e06
pop ebx
push edi
push eax
add esp, 4
sub edi, 0x69e
call 0x509ce6
add byte [eax + ecx*2], bh
aaa
cmp al, 0x4d
inc ebx
cmp al, 0x43
xor al, 0x83
les eax, [ecx + eax*4]
test dword [edx], 0x5f000100
mov edx, dword [ebp - 0xc0]
mov eax, dword [edx]
mov dword [ebp - 0xc0], eax
push ebx
call 0x509d1d
add byte [eax], bh
inc ecx
dec ebp
cmp byte [edi + 0x3a], cl
inc esp
add esp, 4
call 0x509d2f
add byte [0x3b4c4a4b], dh
inc esp
inc ebx
dec eax
cmp al, byte [ebx - 0x347efb3c]
pop edx
sbb al, 0
add bl, ch
push es
inc esi
xor al, 0x49
inc edx
dec edx
pop ebx
mov ecx, dword [ebp - 0xc0]
cmp ecx, dword [ebp - 0x1f8]
je 0x509d5f
mov edx, dword [ebp - 0xc0]
cmp dword [edx + 0x30], 0
jne 0x509aa0
push edx
xor edx, 0x16b6f
and edx, 0x38a8
and edx, 0xe098
pop edx
push eax
push esi
add esp, 4
or eax, 0x4eab
xor eax, 0x2998
sub eax, 0x16973
sub eax, 0x148b1
pop eax
mov dword [ebp - 0x118], 0
Function at 0x50c8af
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x50c8ba
xor ecx, 0x6dbd
pop ecx
push edx
and edx, 0xcc64
pop edx
mov eax, dword [ebp - 0xf0]
mov ecx, dword [ebp - 0x84]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x408], ecx
push ebx
push edi
add esp, 4
or ebx, 0x9ea6
pop ebx
push ebx
call 0x50c8fa
add byte [ebx], bh
inc ecx
cmp al, 0x4d
xor eax, 0x3333504b
add esp, 4
sub ebx, 0x11aff
sub ebx, 0x10efd
add ebx, 0xf3
pop ebx
mov edx, dword [ebp - 0xf0]
mov eax, dword [ebp - 0x84]
add eax, dword [edx + 0x1c]
mov dword [ebp - 0x40c], eax
mov dword [ebp - 0xf4], 0
jmp 0x50c940
mov edx, dword [ebp - 0xf0]
mov eax, dword [ebp - 0xf4]
cmp eax, dword [edx + 0x18]
jae 0x50cc1e
push ecx
jmp 0x50c95b
pop ecx
push ebx
add ebx, 0x13964
pop ebx
push ecx
push ecx
add esp, 4
and ecx, 0x71ce
add ecx, 0x4c00
call 0x50c983
add byte [eax + 0x37], al
dec ebx
cmp cl, byte [esi + 0x49]
push eax
inc edi
add esp, 4
pop ecx
mov ecx, dword [ebp - 0xf4]
mov edx, dword [ebp - 0x404]
mov eax, dword [ebp - 0x84]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0xf8], eax
push esi
push ebx
add esp, 4
xor esi, 0xe49b
pop esi
push ecx
call 0x50c9bb
add byte [ebx + 0x45], al
inc ebp
inc edx
dec esi
add esp, 4
and ecx, 0x17d38
call 0x50c9d0
add byte [0x483f3f32], dh
cmp eax, dword [ebx - 0x74a6fb3c]
lea ecx, [edi + edi*8]
invalid
mov ecx, dword [ebp - 0xfc]
mov dword [ebp - 0x94], ecx

Function at 0x50c8fa
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x50c8ba
xor ecx, 0x6dbd
pop ecx
push edx
and edx, 0xcc64
pop edx
mov eax, dword [ebp - 0xf0]
mov ecx, dword [ebp - 0x84]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x408], ecx
push ebx
push edi
add esp, 4
or ebx, 0x9ea6
pop ebx
push ebx
call 0x50c8fa
add byte [ebx], bh
inc ecx
cmp al, 0x4d
xor eax, 0x3333504b
add esp, 4
sub ebx, 0x11aff
sub ebx, 0x10efd
add ebx, 0xf3
pop ebx
mov edx, dword [ebp - 0xf0]
mov eax, dword [ebp - 0x84]
add eax, dword [edx + 0x1c]
mov dword [ebp - 0x40c], eax
mov dword [ebp - 0xf4], 0
jmp 0x50c940
mov edx, dword [ebp - 0xf0]
mov eax, dword [ebp - 0xf4]
cmp eax, dword [edx + 0x18]
jae 0x50cc1e
push ecx
jmp 0x50c95b
pop ecx
push ebx
add ebx, 0x13964
pop ebx
push ecx
push ecx
add esp, 4
and ecx, 0x71ce
add ecx, 0x4c00
call 0x50c983
add byte [eax + 0x37], al
dec ebx
cmp cl, byte [esi + 0x49]
push eax
inc edi
add esp, 4
pop ecx
mov ecx, dword [ebp - 0xf4]
mov edx, dword [ebp - 0x404]
mov eax, dword [ebp - 0x84]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0xf8], eax
push esi
push ebx
add esp, 4
xor esi, 0xe49b
pop esi
push ecx
call 0x50c9bb
add byte [ebx + 0x45], al
inc ebp
inc edx
dec esi
add esp, 4
and ecx, 0x17d38
call 0x50c9d0
add byte [0x483f3f32], dh
cmp eax, dword [ebx - 0x74a6fb3c]
lea ecx, [edi + edi*8]
invalid
mov ecx, dword [ebp - 0xfc]
mov dword [ebp - 0x94], ecx
Function at 0x50c983
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x50c8ba
xor ecx, 0x6dbd
pop ecx
push edx
and edx, 0xcc64
pop edx
mov eax, dword [ebp - 0xf0]
mov ecx, dword [ebp - 0x84]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x408], ecx
push ebx
push edi
add esp, 4
or ebx, 0x9ea6
pop ebx
push ebx
call 0x50c8fa
add byte [ebx], bh
inc ecx
cmp al, 0x4d
xor eax, 0x3333504b
add esp, 4
sub ebx, 0x11aff
sub ebx, 0x10efd
add ebx, 0xf3
pop ebx
mov edx, dword [ebp - 0xf0]
mov eax, dword [ebp - 0x84]
add eax, dword [edx + 0x1c]
mov dword [ebp - 0x40c], eax
mov dword [ebp - 0xf4], 0
jmp 0x50c940
mov edx, dword [ebp - 0xf0]
mov eax, dword [ebp - 0xf4]
cmp eax, dword [edx + 0x18]
jae 0x50cc1e
push ecx
jmp 0x50c95b
pop ecx
push ebx
add ebx, 0x13964
pop ebx
push ecx
push ecx
add esp, 4
and ecx, 0x71ce
add ecx, 0x4c00
call 0x50c983
add byte [eax + 0x37], al
dec ebx
cmp cl, byte [esi + 0x49]
push eax
inc edi
add esp, 4
pop ecx
mov ecx, dword [ebp - 0xf4]
mov edx, dword [ebp - 0x404]
mov eax, dword [ebp - 0x84]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0xf8], eax
push esi
push ebx
add esp, 4
xor esi, 0xe49b
pop esi
push ecx
call 0x50c9bb
add byte [ebx + 0x45], al
inc ebp
inc edx
dec esi
add esp, 4
and ecx, 0x17d38
call 0x50c9d0
add byte [0x483f3f32], dh
cmp eax, dword [ebx - 0x74a6fb3c]
lea ecx, [edi + edi*8]
invalid
mov ecx, dword [ebp - 0xfc]
mov dword [ebp - 0x94], ecx

Function at 0x50c9bb
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x50c8ba
xor ecx, 0x6dbd
pop ecx
push edx
and edx, 0xcc64
pop edx
mov eax, dword [ebp - 0xf0]
mov ecx, dword [ebp - 0x84]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x408], ecx
push ebx
push edi
add esp, 4
or ebx, 0x9ea6
pop ebx
push ebx
call 0x50c8fa
add byte [ebx], bh
inc ecx
cmp al, 0x4d
xor eax, 0x3333504b
add esp, 4
sub ebx, 0x11aff
sub ebx, 0x10efd
add ebx, 0xf3
pop ebx
mov edx, dword [ebp - 0xf0]
mov eax, dword [ebp - 0x84]
add eax, dword [edx + 0x1c]
mov dword [ebp - 0x40c], eax
mov dword [ebp - 0xf4], 0
jmp 0x50c940
mov edx, dword [ebp - 0xf0]
mov eax, dword [ebp - 0xf4]
cmp eax, dword [edx + 0x18]
jae 0x50cc1e
push ecx
jmp 0x50c95b
pop ecx
push ebx
add ebx, 0x13964
pop ebx
push ecx
push ecx
add esp, 4
and ecx, 0x71ce
add ecx, 0x4c00
call 0x50c983
add byte [eax + 0x37], al
dec ebx
cmp cl, byte [esi + 0x49]
push eax
inc edi
add esp, 4
pop ecx
mov ecx, dword [ebp - 0xf4]
mov edx, dword [ebp - 0x404]
mov eax, dword [ebp - 0x84]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0xf8], eax
push esi
push ebx
add esp, 4
xor esi, 0xe49b
pop esi
push ecx
call 0x50c9bb
add byte [ebx + 0x45], al
inc ebp
inc edx
dec esi
add esp, 4
and ecx, 0x17d38
call 0x50c9d0
add byte [0x483f3f32], dh
cmp eax, dword [ebx - 0x74a6fb3c]
lea ecx, [edi + edi*8]
invalid
mov ecx, dword [ebp - 0xfc]
mov dword [ebp - 0x94], ecx
Function at 0x50c9d0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x50c8ba
xor ecx, 0x6dbd
pop ecx
push edx
and edx, 0xcc64
pop edx
mov eax, dword [ebp - 0xf0]
mov ecx, dword [ebp - 0x84]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x408], ecx
push ebx
push edi
add esp, 4
or ebx, 0x9ea6
pop ebx
push ebx
call 0x50c8fa
add byte [ebx], bh
inc ecx
cmp al, 0x4d
xor eax, 0x3333504b
add esp, 4
sub ebx, 0x11aff
sub ebx, 0x10efd
add ebx, 0xf3
pop ebx
mov edx, dword [ebp - 0xf0]
mov eax, dword [ebp - 0x84]
add eax, dword [edx + 0x1c]
mov dword [ebp - 0x40c], eax
mov dword [ebp - 0xf4], 0
jmp 0x50c940
mov edx, dword [ebp - 0xf0]
mov eax, dword [ebp - 0xf4]
cmp eax, dword [edx + 0x18]
jae 0x50cc1e
push ecx
jmp 0x50c95b
pop ecx
push ebx
add ebx, 0x13964
pop ebx
push ecx
push ecx
add esp, 4
and ecx, 0x71ce
add ecx, 0x4c00
call 0x50c983
add byte [eax + 0x37], al
dec ebx
cmp cl, byte [esi + 0x49]
push eax
inc edi
add esp, 4
pop ecx
mov ecx, dword [ebp - 0xf4]
mov edx, dword [ebp - 0x404]
mov eax, dword [ebp - 0x84]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0xf8], eax
push esi
push ebx
add esp, 4
xor esi, 0xe49b
pop esi
push ecx
call 0x50c9bb
add byte [ebx + 0x45], al
inc ebp
inc edx
dec esi
add esp, 4
and ecx, 0x17d38
call 0x50c9d0
add byte [0x483f3f32], dh
cmp eax, dword [ebx - 0x74a6fb3c]
lea ecx, [edi + edi*8]
invalid
mov ecx, dword [ebp - 0xfc]
mov dword [ebp - 0x94], ecx
Function at 0x50ccad
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ebx
push esi
sub esi, 0x884b
jmp 0x50ccbd
add esi, 0x13cbf
pop esi
mov dword [ebp - 0x1bc], 0
jmp 0x50d77a
Function at 0x50e5d5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x50e5df
pop edi
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x90], eax
jmp 0x50ea10
Function at 0x6ec814d0
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp + 0x10], 0xf0000000
mov dword [esp + 0xc], 0x18
mov dword [esp + 8], 0
mov dword [esp + 4], 0
lea eax, [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
call eax
sub esp, 0x14
test eax, eax
sete al
test al, al
jne 0x6ec81613
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 0x10]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x800c
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
call eax
sub esp, 0x14
test eax, eax
sete al
test al, al
jne 0x6ec81616
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], 0
mov edx, dword [ebp + 0x14]
mov dword [esp + 8], edx
mov edx, dword [ebp + 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_CryptHashData]
call eax
sub esp, 0x10
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 0x14]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], 0x6610
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
call eax
sub esp, 0x14
mov eax, dword [ebp - 0x14]
lea edx, [ebp + 0xc]
mov dword [esp + 0x14], edx
mov edx, dword [ebp + 8]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
call eax
sub esp, 8
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
call eax
sub esp, 4
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
call eax
sub esp, 4
jmp 0x6ec81617
nop
jmp 0x6ec81617
nop
leave
ret