joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5082c8
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ecx
jmp 0x50821d
sub ecx, 0x1718c
pop ecx
push ecx
xor ecx, 0xc81d
jmp 0x508232
sub ecx, 0x12fe6
pop ecx
push ecx
and ecx, 0xbc90
and ecx, 0xd227
pop ecx
mov eax, dword [ebp - 0xc18]
mov cx, word [eax]
mov word [ebp - 0xf7e], cx
mov edx, dword [ebp - 0xc18]
add edx, 2
mov dword [ebp - 0xc18], edx
mov ax, word [ebp - 0xf7e]
mov word [ebp - 0x1f8], ax
mov ecx, dword [ebp - 0xc1c]
mov dx, word [ecx]
mov word [ebp - 0xf80], dx
mov eax, dword [ebp - 0xc1c]
add eax, 2
mov dword [ebp - 0xc1c], eax
mov cx, word [ebp - 0xf80]
mov word [ebp - 0x100], cx
push ebx
push edi
add esp, 4
add ebx, 0x13fab
add ebx, 0xb40d
pop ebx
push esi
jmp 0x5082b9
call fcn.005082c8
add byte [edi + 0x35493833], dh
dec esp
xor edi, dword [ebx]
add esp, 4
pop esi
push eax
jmp 0x5082d2
pop eax
movzx edx, word [ebp - 0x100]
test edx, edx
jne 0x5082f6
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
sub eax, ecx
mov dword [ebp - 0x1498], eax
jmp 0x508359
movzx edx, word [ebp - 0x1f8]
movzx eax, word [ebp - 0x100]
cmp edx, eax
je 0x508215
movzx ecx, word [ebp - 0x1f8]
xor ecx, 0x20
movzx edx, word [ebp - 0x100]
cmp ecx, edx
je 0x508215
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
cmp eax, ecx
jge 0x508343
mov dword [ebp - 0x14d8], 0xffffffff
jmp 0x50834d
mov dword [ebp - 0x14d8], 1
mov edx, dword [ebp - 0x14d8]
mov dword [ebp - 0x1498], edx
cmp dword [ebp - 0x1498], 0
jne 0x5083a2
push edi
push edx
add esp, 4
jmp 0x50836e
sub edi, 0x105c3
pop edi
push edi
push esi
add esp, 4
sub edi, 0x2795
and edi, 0x8c90
sub edi, 0xaafa
jmp 0x508393
pop edi
mov eax, dword [ebp - 0x4d4]
mov dword [ebp - 0x2e0], eax
jmp 0x50840a
push edx
push edi
add esp, 4
jmp 0x5083ac
pop edx
push esi
or esi, 0x132ea
pop esi
push ecx
push ebx
add esp, 4
add ecx, 0xe521
add ecx, 0xe07d
xor ecx, 0x11e9c
jmp 0x5083d3
pop ecx
mov ecx, dword [ebp - 0x4d4]
mov edx, dword [ecx]
mov dword [ebp - 0x4d4], edx
mov eax, dword [ebp - 0x4d4]
cmp eax, dword [ebp - 0xc20]
je 0x508400
mov ecx, dword [ebp - 0x4d4]
cmp dword [ecx + 0x30], 0
jne 0x5081b6
mov dword [ebp - 0x2e0], 0
Function at 0x5093bc
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x704]
add edx, 1
mov dword [ebp - 0x704], edx
add esp, 4
pop ebx
push eax
xor eax, 0x8ba2
xor eax, 0x151fc
pop eax
mov eax, dword [ebp - 0x708]
add eax, dword [ebp - 0x184]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x184]
movsx eax, byte [ebp + edx - 0x804]
or eax, 0x20
cmp ecx, eax
jge 0x509401
mov dword [ebp - 0xc40], 0xffffffff
jmp 0x50940b
mov dword [ebp - 0xc40], 1
cmp dword [ebp - 0xc40], 0
jne 0x509422
mov ecx, dword [ebp - 0x18cc]
mov dword [ebp - 0x4e0], ecx
jmp 0x509433
jmp 0x50920c
Function at 0x50973f
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push eax
push esi
add esp, 4
jmp 0x509723
pop eax
push edx
add edx, 0x16afb
jmp 0x509730
call fcn.0050973f
add byte [esi + edi + 0x4f], al
push eax
xor bh, byte [ebx]
dec edx
aas
push eax
add esp, 4
and edx, 0x32e1
pop edx
lea edx, [ebp - 0x1628]
mov dword [ebp - 0xc48], edx
mov eax, dword [ebp - 0x4e4]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc44], ecx
xor edx, edx
mov word [ebp - 0x204], dx
xor eax, eax
mov word [ebp - 0x38], ax
push ebx
push edi
add esp, 4
call 0x509784
add byte [esp + eax*2 + 0x3a], al
push eax
inc eax
dec eax
add esp, 4
call 0x509795
add byte [ecx + 0x38], al
inc eax
inc esp
dec eax
inc esp
inc edx
cmp byte [ebx + 0x4eb04c4], al
dec esi
xor al, byte [esi + 0x33]
or ebx, 0x1702
pop ebx
mov ecx, dword [ebp - 0xc44]
mov dx, word [ecx]
mov word [ebp - 0xf8a], dx
mov eax, dword [ebp - 0xc44]
add eax, 2
mov dword [ebp - 0xc44], eax
mov cx, word [ebp - 0xf8a]
mov word [ebp - 0x204], cx
mov edx, dword [ebp - 0xc48]
mov ax, word [edx]
mov word [ebp - 0xf8c], ax
mov ecx, dword [ebp - 0xc48]
add ecx, 2
mov dword [ebp - 0xc48], ecx
mov dx, word [ebp - 0xf8c]
mov word [ebp - 0x38], dx
push esi
push eax
add esp, 4
call 0x509811
add byte [esi], dh
dec esi
xor eax, 0x4d3b4250
dec ebp
dec ebp
dec ebp
add esp, 4
call 0x509824
add byte [ebp + 0x3f], al
xor cl, byte [edx + 0x3c]
aas
dec eax
inc esi
cmp ecx, dword [ecx - 0x7d]
les eax, [ecx + eax*4]
out 0x3f, al
push ss
add dword [eax], eax
pop esi
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x50984b
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x1514], ecx
jmp 0x5098a5
movzx eax, word [ebp - 0x204]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x509773
movzx edx, word [ebp - 0x204]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x509773
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x50988f
mov dword [ebp - 0x1510], 0xffffffff
jmp 0x509899
mov dword [ebp - 0x1510], 1
mov eax, dword [ebp - 0x1510]
mov dword [ebp - 0x1514], eax
cmp dword [ebp - 0x1514], 0
jne 0x5098ee
push edx
push ecx
add esp, 4
call 0x5098c0
add byte [esi], bh
dec ecx
inc ecx
dec edi
inc edx
cmp eax, 0x4c48349
pop edx
push edi
push ecx
add esp, 4
jmp 0x5098d0
call 0x5098dc
add byte [ecx], bh
dec ecx
cmp al, 0x4e
inc ecx
xor eax, dword [ebx - 0x74a0fb3c]
lea ebx, [ebx + edi*8]
invalid
push esi
push esi
add esp, 4
call 0x509902
add byte [esi + 0x34], al
cmp dword [ecx + 0x4d], eax
cmp bh, byte [edi]
dec ebp
inc ecx
add esp, 4
xor esi, 0xb63e
or esi, 0xf48e
sub esi, 0x8b59
pop esi
push eax
add eax, 0x15a21
pop eax
mov edx, dword [ebp - 0x4e4]
mov eax, dword [edx]
mov dword [ebp - 0x4e4], eax
mov ecx, dword [ebp - 0x4e4]
cmp ecx, dword [ebp - 0xc4c]
je 0x50994c
mov edx, dword [ebp - 0x4e4]
cmp dword [edx + 0x30], 0
jne 0x509717
mov dword [ebp - 0x2a8], 0
Function at 0x509784
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push eax
push esi
add esp, 4
jmp 0x509723
pop eax
push edx
add edx, 0x16afb
jmp 0x509730
call fcn.0050973f
add byte [esi + edi + 0x4f], al
push eax
xor bh, byte [ebx]
dec edx
aas
push eax
add esp, 4
and edx, 0x32e1
pop edx
lea edx, [ebp - 0x1628]
mov dword [ebp - 0xc48], edx
mov eax, dword [ebp - 0x4e4]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc44], ecx
xor edx, edx
mov word [ebp - 0x204], dx
xor eax, eax
mov word [ebp - 0x38], ax
push ebx
push edi
add esp, 4
call 0x509784
add byte [esp + eax*2 + 0x3a], al
push eax
inc eax
dec eax
add esp, 4
call 0x509795
add byte [ecx + 0x38], al
inc eax
inc esp
dec eax
inc esp
inc edx
cmp byte [ebx + 0x4eb04c4], al
dec esi
xor al, byte [esi + 0x33]
or ebx, 0x1702
pop ebx
mov ecx, dword [ebp - 0xc44]
mov dx, word [ecx]
mov word [ebp - 0xf8a], dx
mov eax, dword [ebp - 0xc44]
add eax, 2
mov dword [ebp - 0xc44], eax
mov cx, word [ebp - 0xf8a]
mov word [ebp - 0x204], cx
mov edx, dword [ebp - 0xc48]
mov ax, word [edx]
mov word [ebp - 0xf8c], ax
mov ecx, dword [ebp - 0xc48]
add ecx, 2
mov dword [ebp - 0xc48], ecx
mov dx, word [ebp - 0xf8c]
mov word [ebp - 0x38], dx
push esi
push eax
add esp, 4
call 0x509811
add byte [esi], dh
dec esi
xor eax, 0x4d3b4250
dec ebp
dec ebp
dec ebp
add esp, 4
call 0x509824
add byte [ebp + 0x3f], al
xor cl, byte [edx + 0x3c]
aas
dec eax
inc esi
cmp ecx, dword [ecx - 0x7d]
les eax, [ecx + eax*4]
out 0x3f, al
push ss
add dword [eax], eax
pop esi
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x50984b
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x1514], ecx
jmp 0x5098a5
movzx eax, word [ebp - 0x204]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x509773
movzx edx, word [ebp - 0x204]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x509773
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x50988f
mov dword [ebp - 0x1510], 0xffffffff
jmp 0x509899
mov dword [ebp - 0x1510], 1
mov eax, dword [ebp - 0x1510]
mov dword [ebp - 0x1514], eax
cmp dword [ebp - 0x1514], 0
jne 0x5098ee
push edx
push ecx
add esp, 4
call 0x5098c0
add byte [esi], bh
dec ecx
inc ecx
dec edi
inc edx
cmp eax, 0x4c48349
pop edx
push edi
push ecx
add esp, 4
jmp 0x5098d0
call 0x5098dc
add byte [ecx], bh
dec ecx
cmp al, 0x4e
inc ecx
xor eax, dword [ebx - 0x74a0fb3c]
lea ebx, [ebx + edi*8]
invalid
push esi
push esi
add esp, 4
call 0x509902
add byte [esi + 0x34], al
cmp dword [ecx + 0x4d], eax
cmp bh, byte [edi]
dec ebp
inc ecx
add esp, 4
xor esi, 0xb63e
or esi, 0xf48e
sub esi, 0x8b59
pop esi
push eax
add eax, 0x15a21
pop eax
mov edx, dword [ebp - 0x4e4]
mov eax, dword [edx]
mov dword [ebp - 0x4e4], eax
mov ecx, dword [ebp - 0x4e4]
cmp ecx, dword [ebp - 0xc4c]
je 0x50994c
mov edx, dword [ebp - 0x4e4]
cmp dword [edx + 0x30], 0
jne 0x509717
mov dword [ebp - 0x2a8], 0
Function at 0x509795
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push eax
push esi
add esp, 4
jmp 0x509723
pop eax
push edx
add edx, 0x16afb
jmp 0x509730
call fcn.0050973f
add byte [esi + edi + 0x4f], al
push eax
xor bh, byte [ebx]
dec edx
aas
push eax
add esp, 4
and edx, 0x32e1
pop edx
lea edx, [ebp - 0x1628]
mov dword [ebp - 0xc48], edx
mov eax, dword [ebp - 0x4e4]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc44], ecx
xor edx, edx
mov word [ebp - 0x204], dx
xor eax, eax
mov word [ebp - 0x38], ax
push ebx
push edi
add esp, 4
call 0x509784
add byte [esp + eax*2 + 0x3a], al
push eax
inc eax
dec eax
add esp, 4
call 0x509795
add byte [ecx + 0x38], al
inc eax
inc esp
dec eax
inc esp
inc edx
cmp byte [ebx + 0x4eb04c4], al
dec esi
xor al, byte [esi + 0x33]
or ebx, 0x1702
pop ebx
mov ecx, dword [ebp - 0xc44]
mov dx, word [ecx]
mov word [ebp - 0xf8a], dx
mov eax, dword [ebp - 0xc44]
add eax, 2
mov dword [ebp - 0xc44], eax
mov cx, word [ebp - 0xf8a]
mov word [ebp - 0x204], cx
mov edx, dword [ebp - 0xc48]
mov ax, word [edx]
mov word [ebp - 0xf8c], ax
mov ecx, dword [ebp - 0xc48]
add ecx, 2
mov dword [ebp - 0xc48], ecx
mov dx, word [ebp - 0xf8c]
mov word [ebp - 0x38], dx
push esi
push eax
add esp, 4
call 0x509811
add byte [esi], dh
dec esi
xor eax, 0x4d3b4250
dec ebp
dec ebp
dec ebp
add esp, 4
call 0x509824
add byte [ebp + 0x3f], al
xor cl, byte [edx + 0x3c]
aas
dec eax
inc esi
cmp ecx, dword [ecx - 0x7d]
les eax, [ecx + eax*4]
out 0x3f, al
push ss
add dword [eax], eax
pop esi
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x50984b
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x1514], ecx
jmp 0x5098a5
movzx eax, word [ebp - 0x204]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x509773
movzx edx, word [ebp - 0x204]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x509773
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x50988f
mov dword [ebp - 0x1510], 0xffffffff
jmp 0x509899
mov dword [ebp - 0x1510], 1
mov eax, dword [ebp - 0x1510]
mov dword [ebp - 0x1514], eax
cmp dword [ebp - 0x1514], 0
jne 0x5098ee
push edx
push ecx
add esp, 4
call 0x5098c0
add byte [esi], bh
dec ecx
inc ecx
dec edi
inc edx
cmp eax, 0x4c48349
pop edx
push edi
push ecx
add esp, 4
jmp 0x5098d0
call 0x5098dc
add byte [ecx], bh
dec ecx
cmp al, 0x4e
inc ecx
xor eax, dword [ebx - 0x74a0fb3c]
lea ebx, [ebx + edi*8]
invalid
push esi
push esi
add esp, 4
call 0x509902
add byte [esi + 0x34], al
cmp dword [ecx + 0x4d], eax
cmp bh, byte [edi]
dec ebp
inc ecx
add esp, 4
xor esi, 0xb63e
or esi, 0xf48e
sub esi, 0x8b59
pop esi
push eax
add eax, 0x15a21
pop eax
mov edx, dword [ebp - 0x4e4]
mov eax, dword [edx]
mov dword [ebp - 0x4e4], eax
mov ecx, dword [ebp - 0x4e4]
cmp ecx, dword [ebp - 0xc4c]
je 0x50994c
mov edx, dword [ebp - 0x4e4]
cmp dword [edx + 0x30], 0
jne 0x509717
mov dword [ebp - 0x2a8], 0
Function at 0x509811
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push eax
push esi
add esp, 4
jmp 0x509723
pop eax
push edx
add edx, 0x16afb
jmp 0x509730
call fcn.0050973f
add byte [esi + edi + 0x4f], al
push eax
xor bh, byte [ebx]
dec edx
aas
push eax
add esp, 4
and edx, 0x32e1
pop edx
lea edx, [ebp - 0x1628]
mov dword [ebp - 0xc48], edx
mov eax, dword [ebp - 0x4e4]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc44], ecx
xor edx, edx
mov word [ebp - 0x204], dx
xor eax, eax
mov word [ebp - 0x38], ax
push ebx
push edi
add esp, 4
call 0x509784
add byte [esp + eax*2 + 0x3a], al
push eax
inc eax
dec eax
add esp, 4
call 0x509795
add byte [ecx + 0x38], al
inc eax
inc esp
dec eax
inc esp
inc edx
cmp byte [ebx + 0x4eb04c4], al
dec esi
xor al, byte [esi + 0x33]
or ebx, 0x1702
pop ebx
mov ecx, dword [ebp - 0xc44]
mov dx, word [ecx]
mov word [ebp - 0xf8a], dx
mov eax, dword [ebp - 0xc44]
add eax, 2
mov dword [ebp - 0xc44], eax
mov cx, word [ebp - 0xf8a]
mov word [ebp - 0x204], cx
mov edx, dword [ebp - 0xc48]
mov ax, word [edx]
mov word [ebp - 0xf8c], ax
mov ecx, dword [ebp - 0xc48]
add ecx, 2
mov dword [ebp - 0xc48], ecx
mov dx, word [ebp - 0xf8c]
mov word [ebp - 0x38], dx
push esi
push eax
add esp, 4
call 0x509811
add byte [esi], dh
dec esi
xor eax, 0x4d3b4250
dec ebp
dec ebp
dec ebp
add esp, 4
call 0x509824
add byte [ebp + 0x3f], al
xor cl, byte [edx + 0x3c]
aas
dec eax
inc esi
cmp ecx, dword [ecx - 0x7d]
les eax, [ecx + eax*4]
out 0x3f, al
push ss
add dword [eax], eax
pop esi
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x50984b
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x1514], ecx
jmp 0x5098a5
movzx eax, word [ebp - 0x204]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x509773
movzx edx, word [ebp - 0x204]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x509773
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x50988f
mov dword [ebp - 0x1510], 0xffffffff
jmp 0x509899
mov dword [ebp - 0x1510], 1
mov eax, dword [ebp - 0x1510]
mov dword [ebp - 0x1514], eax
cmp dword [ebp - 0x1514], 0
jne 0x5098ee
push edx
push ecx
add esp, 4
call 0x5098c0
add byte [esi], bh
dec ecx
inc ecx
dec edi
inc edx
cmp eax, 0x4c48349
pop edx
push edi
push ecx
add esp, 4
jmp 0x5098d0
call 0x5098dc
add byte [ecx], bh
dec ecx
cmp al, 0x4e
inc ecx
xor eax, dword [ebx - 0x74a0fb3c]
lea ebx, [ebx + edi*8]
invalid
push esi
push esi
add esp, 4
call 0x509902
add byte [esi + 0x34], al
cmp dword [ecx + 0x4d], eax
cmp bh, byte [edi]
dec ebp
inc ecx
add esp, 4
xor esi, 0xb63e
or esi, 0xf48e
sub esi, 0x8b59
pop esi
push eax
add eax, 0x15a21
pop eax
mov edx, dword [ebp - 0x4e4]
mov eax, dword [edx]
mov dword [ebp - 0x4e4], eax
mov ecx, dword [ebp - 0x4e4]
cmp ecx, dword [ebp - 0xc4c]
je 0x50994c
mov edx, dword [ebp - 0x4e4]
cmp dword [edx + 0x30], 0
jne 0x509717
mov dword [ebp - 0x2a8], 0
Function at 0x509824
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push eax
push esi
add esp, 4
jmp 0x509723
pop eax
push edx
add edx, 0x16afb
jmp 0x509730
call fcn.0050973f
add byte [esi + edi + 0x4f], al
push eax
xor bh, byte [ebx]
dec edx
aas
push eax
add esp, 4
and edx, 0x32e1
pop edx
lea edx, [ebp - 0x1628]
mov dword [ebp - 0xc48], edx
mov eax, dword [ebp - 0x4e4]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc44], ecx
xor edx, edx
mov word [ebp - 0x204], dx
xor eax, eax
mov word [ebp - 0x38], ax
push ebx
push edi
add esp, 4
call 0x509784
add byte [esp + eax*2 + 0x3a], al
push eax
inc eax
dec eax
add esp, 4
call 0x509795
add byte [ecx + 0x38], al
inc eax
inc esp
dec eax
inc esp
inc edx
cmp byte [ebx + 0x4eb04c4], al
dec esi
xor al, byte [esi + 0x33]
or ebx, 0x1702
pop ebx
mov ecx, dword [ebp - 0xc44]
mov dx, word [ecx]
mov word [ebp - 0xf8a], dx
mov eax, dword [ebp - 0xc44]
add eax, 2
mov dword [ebp - 0xc44], eax
mov cx, word [ebp - 0xf8a]
mov word [ebp - 0x204], cx
mov edx, dword [ebp - 0xc48]
mov ax, word [edx]
mov word [ebp - 0xf8c], ax
mov ecx, dword [ebp - 0xc48]
add ecx, 2
mov dword [ebp - 0xc48], ecx
mov dx, word [ebp - 0xf8c]
mov word [ebp - 0x38], dx
push esi
push eax
add esp, 4
call 0x509811
add byte [esi], dh
dec esi
xor eax, 0x4d3b4250
dec ebp
dec ebp
dec ebp
add esp, 4
call 0x509824
add byte [ebp + 0x3f], al
xor cl, byte [edx + 0x3c]
aas
dec eax
inc esi
cmp ecx, dword [ecx - 0x7d]
les eax, [ecx + eax*4]
out 0x3f, al
push ss
add dword [eax], eax
pop esi
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x50984b
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x1514], ecx
jmp 0x5098a5
movzx eax, word [ebp - 0x204]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x509773
movzx edx, word [ebp - 0x204]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x509773
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x50988f
mov dword [ebp - 0x1510], 0xffffffff
jmp 0x509899
mov dword [ebp - 0x1510], 1
mov eax, dword [ebp - 0x1510]
mov dword [ebp - 0x1514], eax
cmp dword [ebp - 0x1514], 0
jne 0x5098ee
push edx
push ecx
add esp, 4
call 0x5098c0
add byte [esi], bh
dec ecx
inc ecx
dec edi
inc edx
cmp eax, 0x4c48349
pop edx
push edi
push ecx
add esp, 4
jmp 0x5098d0
call 0x5098dc
add byte [ecx], bh
dec ecx
cmp al, 0x4e
inc ecx
xor eax, dword [ebx - 0x74a0fb3c]
lea ebx, [ebx + edi*8]
invalid
push esi
push esi
add esp, 4
call 0x509902
add byte [esi + 0x34], al
cmp dword [ecx + 0x4d], eax
cmp bh, byte [edi]
dec ebp
inc ecx
add esp, 4
xor esi, 0xb63e
or esi, 0xf48e
sub esi, 0x8b59
pop esi
push eax
add eax, 0x15a21
pop eax
mov edx, dword [ebp - 0x4e4]
mov eax, dword [edx]
mov dword [ebp - 0x4e4], eax
mov ecx, dword [ebp - 0x4e4]
cmp ecx, dword [ebp - 0xc4c]
je 0x50994c
mov edx, dword [ebp - 0x4e4]
cmp dword [edx + 0x30], 0
jne 0x509717
mov dword [ebp - 0x2a8], 0
Function at 0x5098dc
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push eax
push esi
add esp, 4
jmp 0x509723
pop eax
push edx
add edx, 0x16afb
jmp 0x509730
call fcn.0050973f
add byte [esi + edi + 0x4f], al
push eax
xor bh, byte [ebx]
dec edx
aas
push eax
add esp, 4
and edx, 0x32e1
pop edx
lea edx, [ebp - 0x1628]
mov dword [ebp - 0xc48], edx
mov eax, dword [ebp - 0x4e4]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc44], ecx
xor edx, edx
mov word [ebp - 0x204], dx
xor eax, eax
mov word [ebp - 0x38], ax
push ebx
push edi
add esp, 4
call 0x509784
add byte [esp + eax*2 + 0x3a], al
push eax
inc eax
dec eax
add esp, 4
call 0x509795
add byte [ecx + 0x38], al
inc eax
inc esp
dec eax
inc esp
inc edx
cmp byte [ebx + 0x4eb04c4], al
dec esi
xor al, byte [esi + 0x33]
or ebx, 0x1702
pop ebx
mov ecx, dword [ebp - 0xc44]
mov dx, word [ecx]
mov word [ebp - 0xf8a], dx
mov eax, dword [ebp - 0xc44]
add eax, 2
mov dword [ebp - 0xc44], eax
mov cx, word [ebp - 0xf8a]
mov word [ebp - 0x204], cx
mov edx, dword [ebp - 0xc48]
mov ax, word [edx]
mov word [ebp - 0xf8c], ax
mov ecx, dword [ebp - 0xc48]
add ecx, 2
mov dword [ebp - 0xc48], ecx
mov dx, word [ebp - 0xf8c]
mov word [ebp - 0x38], dx
push esi
push eax
add esp, 4
call 0x509811
add byte [esi], dh
dec esi
xor eax, 0x4d3b4250
dec ebp
dec ebp
dec ebp
add esp, 4
call 0x509824
add byte [ebp + 0x3f], al
xor cl, byte [edx + 0x3c]
aas
dec eax
inc esi
cmp ecx, dword [ecx - 0x7d]
les eax, [ecx + eax*4]
out 0x3f, al
push ss
add dword [eax], eax
pop esi
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x50984b
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x1514], ecx
jmp 0x5098a5
movzx eax, word [ebp - 0x204]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x509773
movzx edx, word [ebp - 0x204]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x509773
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x50988f
mov dword [ebp - 0x1510], 0xffffffff
jmp 0x509899
mov dword [ebp - 0x1510], 1
mov eax, dword [ebp - 0x1510]
mov dword [ebp - 0x1514], eax
cmp dword [ebp - 0x1514], 0
jne 0x5098ee
push edx
push ecx
add esp, 4
call 0x5098c0
add byte [esi], bh
dec ecx
inc ecx
dec edi
inc edx
cmp eax, 0x4c48349
pop edx
push edi
push ecx
add esp, 4
jmp 0x5098d0
call 0x5098dc
add byte [ecx], bh
dec ecx
cmp al, 0x4e
inc ecx
xor eax, dword [ebx - 0x74a0fb3c]
lea ebx, [ebx + edi*8]
invalid
push esi
push esi
add esp, 4
call 0x509902
add byte [esi + 0x34], al
cmp dword [ecx + 0x4d], eax
cmp bh, byte [edi]
dec ebp
inc ecx
add esp, 4
xor esi, 0xb63e
or esi, 0xf48e
sub esi, 0x8b59
pop esi
push eax
add eax, 0x15a21
pop eax
mov edx, dword [ebp - 0x4e4]
mov eax, dword [edx]
mov dword [ebp - 0x4e4], eax
mov ecx, dword [ebp - 0x4e4]
cmp ecx, dword [ebp - 0xc4c]
je 0x50994c
mov edx, dword [ebp - 0x4e4]
cmp dword [edx + 0x30], 0
jne 0x509717
mov dword [ebp - 0x2a8], 0
Function at 0x509902
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push eax
push esi
add esp, 4
jmp 0x509723
pop eax
push edx
add edx, 0x16afb
jmp 0x509730
call fcn.0050973f
add byte [esi + edi + 0x4f], al
push eax
xor bh, byte [ebx]
dec edx
aas
push eax
add esp, 4
and edx, 0x32e1
pop edx
lea edx, [ebp - 0x1628]
mov dword [ebp - 0xc48], edx
mov eax, dword [ebp - 0x4e4]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc44], ecx
xor edx, edx
mov word [ebp - 0x204], dx
xor eax, eax
mov word [ebp - 0x38], ax
push ebx
push edi
add esp, 4
call 0x509784
add byte [esp + eax*2 + 0x3a], al
push eax
inc eax
dec eax
add esp, 4
call 0x509795
add byte [ecx + 0x38], al
inc eax
inc esp
dec eax
inc esp
inc edx
cmp byte [ebx + 0x4eb04c4], al
dec esi
xor al, byte [esi + 0x33]
or ebx, 0x1702
pop ebx
mov ecx, dword [ebp - 0xc44]
mov dx, word [ecx]
mov word [ebp - 0xf8a], dx
mov eax, dword [ebp - 0xc44]
add eax, 2
mov dword [ebp - 0xc44], eax
mov cx, word [ebp - 0xf8a]
mov word [ebp - 0x204], cx
mov edx, dword [ebp - 0xc48]
mov ax, word [edx]
mov word [ebp - 0xf8c], ax
mov ecx, dword [ebp - 0xc48]
add ecx, 2
mov dword [ebp - 0xc48], ecx
mov dx, word [ebp - 0xf8c]
mov word [ebp - 0x38], dx
push esi
push eax
add esp, 4
call 0x509811
add byte [esi], dh
dec esi
xor eax, 0x4d3b4250
dec ebp
dec ebp
dec ebp
add esp, 4
call 0x509824
add byte [ebp + 0x3f], al
xor cl, byte [edx + 0x3c]
aas
dec eax
inc esi
cmp ecx, dword [ecx - 0x7d]
les eax, [ecx + eax*4]
out 0x3f, al
push ss
add dword [eax], eax
pop esi
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x50984b
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x1514], ecx
jmp 0x5098a5
movzx eax, word [ebp - 0x204]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x509773
movzx edx, word [ebp - 0x204]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x509773
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x50988f
mov dword [ebp - 0x1510], 0xffffffff
jmp 0x509899
mov dword [ebp - 0x1510], 1
mov eax, dword [ebp - 0x1510]
mov dword [ebp - 0x1514], eax
cmp dword [ebp - 0x1514], 0
jne 0x5098ee
push edx
push ecx
add esp, 4
call 0x5098c0
add byte [esi], bh
dec ecx
inc ecx
dec edi
inc edx
cmp eax, 0x4c48349
pop edx
push edi
push ecx
add esp, 4
jmp 0x5098d0
call 0x5098dc
add byte [ecx], bh
dec ecx
cmp al, 0x4e
inc ecx
xor eax, dword [ebx - 0x74a0fb3c]
lea ebx, [ebx + edi*8]
invalid
push esi
push esi
add esp, 4
call 0x509902
add byte [esi + 0x34], al
cmp dword [ecx + 0x4d], eax
cmp bh, byte [edi]
dec ebp
inc ecx
add esp, 4
xor esi, 0xb63e
or esi, 0xf48e
sub esi, 0x8b59
pop esi
push eax
add eax, 0x15a21
pop eax
mov edx, dword [ebp - 0x4e4]
mov eax, dword [edx]
mov dword [ebp - 0x4e4], eax
mov ecx, dword [ebp - 0x4e4]
cmp ecx, dword [ebp - 0xc4c]
je 0x50994c
mov edx, dword [ebp - 0x4e4]
cmp dword [edx + 0x30], 0
jne 0x509717
mov dword [ebp - 0x2a8], 0
Function at 0x509d82
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x509d94
add byte [edx], bh
dec ecx
inc ebx
cmp ecx, dword [edx + 0x4e]
xor eax, 0xc4833a42
add al, 0x81
jecxz 0x509d4b
int3

Function at 0x509d94
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x509d94
add byte [edx], bh
dec ecx
inc ebx
cmp ecx, dword [edx + 0x4e]
xor eax, 0xc4833a42
add al, 0x81
jecxz 0x509d4b
int3