joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001c85
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add ecx, 0x6230
sub ecx, 0x157f8
sub ecx, 0xae01
pop ecx
cmp dword [ebp - 0xc1c], 0
jne 0x10001c4b
mov dword [ebp - 0x29c], 0
jmp 0x10001eab
mov edx, dword [ebp - 0xc1c]
mov dword [ebp - 0x4bc], edx
push ecx
push edi
add esp, 4
add ecx, 0x16244
pop ecx
push ebx
push ebx
add esp, 4
call 0x10001c74
add byte [esi], bh
inc ecx
aas
dec edi
dec ebp
inc edi
add esp, 4
pop ebx
push ebx
call 0x10001c85
add byte [esi + 0x4c], al
xor al, 0x3c
inc ecx
cmp eax, dword [ebx - 0x72a4fb3c]
test dword [eax], esi
ljmp 0xf3e8

Function at 0x10001cc6
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edx
call fcn.10001cc6
add byte [ebx], bh
aaa
aaa
cmp eax, 0x423c4836
cmp eax, dword [ebx + 0x505a04c4]
add esp, 4
pop edx
push eax
add esp, 4
pop edx
push eax
push ecx
add esp, 4
and eax, 0xdf55
pop eax
push edi
push esi
add esp, 4
and edi, 0xfeb2
jmp 0x10001ce7
pop edi
mov edx, dword [ebp - 0xc14]
mov ax, word [edx]
mov word [ebp - 0xfb6], ax
mov ecx, dword [ebp - 0xc14]
add ecx, 2
mov dword [ebp - 0xc14], ecx
mov dx, word [ebp - 0xfb6]
mov word [ebp - 0x1ac], dx
mov eax, dword [ebp - 0xc18]
mov cx, word [eax]
mov word [ebp - 0xfb8], cx
mov edx, dword [ebp - 0xc18]
add edx, 2
mov dword [ebp - 0xc18], edx
call 0x77001d28
mov eax, dword [ebp - 0xfb8]
mov word [ebp - 0x100], ax
push eax
add eax, 0x17e79
jmp 0x10001d4e
add eax, 0xf188
add eax, 0x177ee
pop eax
push ebx
call 0x10001d6a
add byte [edx + 0x37], al
cmp byte [ecx + 0x3d], al
dec esp
cmp eax, 0x4c4834b
xor ebx, 0xe57
pop ebx
movzx ecx, word [ebp - 0x100]
test ecx, ecx
jne 0x10001d97
movzx edx, word [ebp - 0x1ac]
movzx eax, word [ebp - 0x100]
sub edx, eax
mov dword [ebp - 0x1510], edx
jmp 0x10001dfa
movzx ecx, word [ebp - 0x1ac]
movzx edx, word [ebp - 0x100]
cmp ecx, edx
je 0x10001cb6
movzx eax, word [ebp - 0x1ac]
xor eax, 0x20
movzx ecx, word [ebp - 0x100]
cmp eax, ecx
je 0x10001cb6
movzx edx, word [ebp - 0x1ac]
movzx eax, word [ebp - 0x100]
cmp edx, eax
jge 0x10001de4
mov dword [ebp - 0x1508], 0xffffffff
jmp 0x10001dee
mov dword [ebp - 0x1508], 1
mov ecx, dword [ebp - 0x1508]
mov dword [ebp - 0x1510], ecx
cmp dword [ebp - 0x1510], 0
jne 0x10001e43
push ebx
and ebx, 0x4474
add ebx, 0x14b33
pop ebx
push edx
push edi
add esp, 4
jmp 0x10001e1b
sub edx, 0xb209
xor edx, 0x142b4
sub edx, 0xdb4d
pop edx
push ebx
jmp 0x10001e34
pop ebx
mov edx, dword [ebp - 0x4bc]
mov dword [ebp - 0x29c], edx
jmp 0x10001eab
push edi
add edi, 0x7b46
xor edi, 0xe0fb
and edi, 0x993f
jmp 0x10001e5b
pop edi
push ebx
xor ebx, 0x1152f
call 0x10001e71
add byte [edx], bh
inc ebp
cmp eax, 0x3d383c34
add esp, 4
pop ebx
mov eax, dword [ebp - 0x4bc]
mov ecx, dword [eax]
mov dword [ebp - 0x4bc], ecx
mov edx, dword [ebp - 0x4bc]
cmp edx, dword [ebp - 0xc1c]
je 0x10001ea1
mov eax, dword [ebp - 0x4bc]
cmp dword [eax + 0x30], 0
jne 0x10001c57
mov dword [ebp - 0x29c], 0
Function at 0x10001d6a
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edx
call fcn.10001cc6
add byte [ebx], bh
aaa
aaa
cmp eax, 0x423c4836
cmp eax, dword [ebx + 0x505a04c4]
add esp, 4
pop edx
push eax
add esp, 4
pop edx
push eax
push ecx
add esp, 4
and eax, 0xdf55
pop eax
push edi
push esi
add esp, 4
and edi, 0xfeb2
jmp 0x10001ce7
pop edi
mov edx, dword [ebp - 0xc14]
mov ax, word [edx]
mov word [ebp - 0xfb6], ax
mov ecx, dword [ebp - 0xc14]
add ecx, 2
mov dword [ebp - 0xc14], ecx
mov dx, word [ebp - 0xfb6]
mov word [ebp - 0x1ac], dx
mov eax, dword [ebp - 0xc18]
mov cx, word [eax]
mov word [ebp - 0xfb8], cx
mov edx, dword [ebp - 0xc18]
add edx, 2
mov dword [ebp - 0xc18], edx
call 0x77001d28
mov eax, dword [ebp - 0xfb8]
mov word [ebp - 0x100], ax
push eax
add eax, 0x17e79
jmp 0x10001d4e
add eax, 0xf188
add eax, 0x177ee
pop eax
push ebx
call 0x10001d6a
add byte [edx + 0x37], al
cmp byte [ecx + 0x3d], al
dec esp
cmp eax, 0x4c4834b
xor ebx, 0xe57
pop ebx
movzx ecx, word [ebp - 0x100]
test ecx, ecx
jne 0x10001d97
movzx edx, word [ebp - 0x1ac]
movzx eax, word [ebp - 0x100]
sub edx, eax
mov dword [ebp - 0x1510], edx
jmp 0x10001dfa
movzx ecx, word [ebp - 0x1ac]
movzx edx, word [ebp - 0x100]
cmp ecx, edx
je 0x10001cb6
movzx eax, word [ebp - 0x1ac]
xor eax, 0x20
movzx ecx, word [ebp - 0x100]
cmp eax, ecx
je 0x10001cb6
movzx edx, word [ebp - 0x1ac]
movzx eax, word [ebp - 0x100]
cmp edx, eax
jge 0x10001de4
mov dword [ebp - 0x1508], 0xffffffff
jmp 0x10001dee
mov dword [ebp - 0x1508], 1
mov ecx, dword [ebp - 0x1508]
mov dword [ebp - 0x1510], ecx
cmp dword [ebp - 0x1510], 0
jne 0x10001e43
push ebx
and ebx, 0x4474
add ebx, 0x14b33
pop ebx
push edx
push edi
add esp, 4
jmp 0x10001e1b
sub edx, 0xb209
xor edx, 0x142b4
sub edx, 0xdb4d
pop edx
push ebx
jmp 0x10001e34
pop ebx
mov edx, dword [ebp - 0x4bc]
mov dword [ebp - 0x29c], edx
jmp 0x10001eab
push edi
add edi, 0x7b46
xor edi, 0xe0fb
and edi, 0x993f
jmp 0x10001e5b
pop edi
push ebx
xor ebx, 0x1152f
call 0x10001e71
add byte [edx], bh
inc ebp
cmp eax, 0x3d383c34
add esp, 4
pop ebx
mov eax, dword [ebp - 0x4bc]
mov ecx, dword [eax]
mov dword [ebp - 0x4bc], ecx
mov edx, dword [ebp - 0x4bc]
cmp edx, dword [ebp - 0xc1c]
je 0x10001ea1
mov eax, dword [ebp - 0x4bc]
cmp dword [eax + 0x30], 0
jne 0x10001c57
mov dword [ebp - 0x29c], 0
Function at 0x10001e71
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edx
call fcn.10001cc6
add byte [ebx], bh
aaa
aaa
cmp eax, 0x423c4836
cmp eax, dword [ebx + 0x505a04c4]
add esp, 4
pop edx
push eax
add esp, 4
pop edx
push eax
push ecx
add esp, 4
and eax, 0xdf55
pop eax
push edi
push esi
add esp, 4
and edi, 0xfeb2
jmp 0x10001ce7
pop edi
mov edx, dword [ebp - 0xc14]
mov ax, word [edx]
mov word [ebp - 0xfb6], ax
mov ecx, dword [ebp - 0xc14]
add ecx, 2
mov dword [ebp - 0xc14], ecx
mov dx, word [ebp - 0xfb6]
mov word [ebp - 0x1ac], dx
mov eax, dword [ebp - 0xc18]
mov cx, word [eax]
mov word [ebp - 0xfb8], cx
mov edx, dword [ebp - 0xc18]
add edx, 2
mov dword [ebp - 0xc18], edx
call 0x77001d28
mov eax, dword [ebp - 0xfb8]
mov word [ebp - 0x100], ax
push eax
add eax, 0x17e79
jmp 0x10001d4e
add eax, 0xf188
add eax, 0x177ee
pop eax
push ebx
call 0x10001d6a
add byte [edx + 0x37], al
cmp byte [ecx + 0x3d], al
dec esp
cmp eax, 0x4c4834b
xor ebx, 0xe57
pop ebx
movzx ecx, word [ebp - 0x100]
test ecx, ecx
jne 0x10001d97
movzx edx, word [ebp - 0x1ac]
movzx eax, word [ebp - 0x100]
sub edx, eax
mov dword [ebp - 0x1510], edx
jmp 0x10001dfa
movzx ecx, word [ebp - 0x1ac]
movzx edx, word [ebp - 0x100]
cmp ecx, edx
je 0x10001cb6
movzx eax, word [ebp - 0x1ac]
xor eax, 0x20
movzx ecx, word [ebp - 0x100]
cmp eax, ecx
je 0x10001cb6
movzx edx, word [ebp - 0x1ac]
movzx eax, word [ebp - 0x100]
cmp edx, eax
jge 0x10001de4
mov dword [ebp - 0x1508], 0xffffffff
jmp 0x10001dee
mov dword [ebp - 0x1508], 1
mov ecx, dword [ebp - 0x1508]
mov dword [ebp - 0x1510], ecx
cmp dword [ebp - 0x1510], 0
jne 0x10001e43
push ebx
and ebx, 0x4474
add ebx, 0x14b33
pop ebx
push edx
push edi
add esp, 4
jmp 0x10001e1b
sub edx, 0xb209
xor edx, 0x142b4
sub edx, 0xdb4d
pop edx
push ebx
jmp 0x10001e34
pop ebx
mov edx, dword [ebp - 0x4bc]
mov dword [ebp - 0x29c], edx
jmp 0x10001eab
push edi
add edi, 0x7b46
xor edi, 0xe0fb
and edi, 0x993f
jmp 0x10001e5b
pop edi
push ebx
xor ebx, 0x1152f
call 0x10001e71
add byte [edx], bh
inc ebp
cmp eax, 0x3d383c34
add esp, 4
pop ebx
mov eax, dword [ebp - 0x4bc]
mov ecx, dword [eax]
mov dword [ebp - 0x4bc], ecx
mov edx, dword [ebp - 0x4bc]
cmp edx, dword [ebp - 0xc1c]
je 0x10001ea1
mov eax, dword [ebp - 0x4bc]
cmp dword [eax + 0x30], 0
jne 0x10001c57
mov dword [ebp - 0x29c], 0
Function at 0x10001eb0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
or edx, 0xc489
and edx, 0x13ab3
pop edx
push ebx
push edi
add esp, 4
sub ebx, 0xa61e
add ebx, 0x12dd7
add ebx, 0xa83e
jmp 0x10001edc
pop ebx
cmp dword [ebp - 0x29c], 0
jne 0x100027e2
mov ecx, 0x6b
mov word [ebp - 0x1650], cx
mov edx, 0x65
mov word [ebp - 0x164e], dx
mov eax, 0x72
mov word [ebp - 0x164c], ax
mov ecx, 0x6e
mov word [ebp - 0x164a], cx
mov edx, 0x65
mov word [ebp - 0x1648], dx
mov eax, 0x6c
mov word [ebp - 0x1646], ax
mov ecx, 0x33
mov word [ebp - 0x1644], cx
mov edx, 0x32
mov word [ebp - 0x1642], dx
mov eax, 0x2e
mov word [ebp - 0x1640], ax
mov ecx, 0x64
mov word [ebp - 0x163e], cx
mov edx, 0x6c
mov word [ebp - 0x163c], dx
mov eax, 0x6c
mov word [ebp - 0x163a], ax
xor ecx, ecx
mov word [ebp - 0x1638], cx
push ecx
push eax
add esp, 4
sub ecx, 0xf242
pop ecx
push edx

Function at 0x10001f90
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add edx, 0x8621
xor edx, 0x8a83
xor edx, 0xf6e6
pop edx
push edx
push ebx
add esp, 4
xor edx, 0x11b59
and edx, 0x73
pop edx
mov byte [ebp - 0x84c], 0x4c
mov byte [ebp - 0x84b], 0x6f
mov byte [ebp - 0x84a], 0x61
mov byte [ebp - 0x849], 0x64
mov byte [ebp - 0x848], 0x4c
mov byte [ebp - 0x847], 0x69
mov byte [ebp - 0x846], 0x62
mov byte [ebp - 0x845], 0x72
mov byte [ebp - 0x844], 0x61
mov byte [ebp - 0x843], 0x72
invalid
invalid
invalid
idiv edi
Function at 0x10002010
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword fs:[0x18]
mov dword [ebp - 0x1be4], edx
mov eax, dword [ebp - 0x1be4]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x1be8], ecx
mov edx, dword [ebp - 0x1be8]
mov dword [ebp - 0x1514], edx
push esi
push eax
add esp, 4
add esi, 0x146ca
xor esi, 0x26e
pop esi
push esi
push esi
add esp, 4
jmp 0x10002055
add esi, 0x5896
pop esi
push edi
and edi, 0xb414
sub edi, 0x2765
pop edi
cmp dword [ebp - 0x1514], 0
jne 0x10002082
mov dword [ebp - 0x728], 0
jmp 0x10002329
mov eax, dword [ebp - 0x1514]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xc28], edx
push edx
sub edx, 0x147fe
pop edx
push ebx
push ebx
add esp, 4
jmp 0x100020a9
call 0x100020b6
add byte [esi], dh
cmp dword [ebx + 0x50], eax
inc edi
dec edx
inc esp
add esp, 4
add ebx, 0xcb40
add ebx, 0x129db
pop ebx
cmp dword [ebp - 0xc28], 0
jne 0x100020de
mov dword [ebp - 0x728], 0
jmp 0x10002329
mov eax, dword [ebp - 0xc28]
mov dword [ebp - 0x4c0], eax
push edi
push edx
add esp, 4
xor edi, 0x109a2
or edi, 0x374c
pop edi
push ebx
push eax
add esp, 4
add ebx, 0x5428
and ebx, 0xb0dd
jmp 0x10002112
jmp 0x1000211b
pop ebx
lea ecx, [ebp - 0x1650]
mov dword [ebp - 0xc24], ecx
mov edx, dword [ebp - 0x4c0]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xc20], eax
xor ecx, ecx
mov word [ebp - 0x1b0], cx
xor edx, edx
mov word [ebp - 0x24], dx
push esi
call 0x10002154
add byte [0x43474536], bh
push eax
cmp byte [ebx + 0x9e804c4], al
add byte [eax], al
add byte [eax], al
dec ebx
inc ecx
aaa
xor bh, byte [ebx]
inc edx
cmp dword [ecx - 0x7d], ecx
les eax, [ecx + eax*4]
out 0xed, al
mov al, byte [0x7eb0000]
dec eax
inc ebx
xor eax, 0x413b4932
pop esi
mov eax, dword [ebp - 0xc20]
invalid
invalid
Function at 0x100020b6
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword fs:[0x18]
mov dword [ebp - 0x1be4], edx
mov eax, dword [ebp - 0x1be4]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x1be8], ecx
mov edx, dword [ebp - 0x1be8]
mov dword [ebp - 0x1514], edx
push esi
push eax
add esp, 4
add esi, 0x146ca
xor esi, 0x26e
pop esi
push esi
push esi
add esp, 4
jmp 0x10002055
add esi, 0x5896
pop esi
push edi
and edi, 0xb414
sub edi, 0x2765
pop edi
cmp dword [ebp - 0x1514], 0
jne 0x10002082
mov dword [ebp - 0x728], 0
jmp 0x10002329
mov eax, dword [ebp - 0x1514]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xc28], edx
push edx
sub edx, 0x147fe
pop edx
push ebx
push ebx
add esp, 4
jmp 0x100020a9
call 0x100020b6
add byte [esi], dh
cmp dword [ebx + 0x50], eax
inc edi
dec edx
inc esp
add esp, 4
add ebx, 0xcb40
add ebx, 0x129db
pop ebx
cmp dword [ebp - 0xc28], 0
jne 0x100020de
mov dword [ebp - 0x728], 0
jmp 0x10002329
mov eax, dword [ebp - 0xc28]
mov dword [ebp - 0x4c0], eax
push edi
push edx
add esp, 4
xor edi, 0x109a2
or edi, 0x374c
pop edi
push ebx
push eax
add esp, 4
add ebx, 0x5428
and ebx, 0xb0dd
jmp 0x10002112
jmp 0x1000211b
pop ebx
lea ecx, [ebp - 0x1650]
mov dword [ebp - 0xc24], ecx
mov edx, dword [ebp - 0x4c0]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xc20], eax
xor ecx, ecx
mov word [ebp - 0x1b0], cx
xor edx, edx
mov word [ebp - 0x24], dx
push esi
call 0x10002154
add byte [0x43474536], bh
push eax
cmp byte [ebx + 0x9e804c4], al
add byte [eax], al
add byte [eax], al
dec ebx
inc ecx
aaa
xor bh, byte [ebx]
inc edx
cmp dword [ecx - 0x7d], ecx
les eax, [ecx + eax*4]
out 0xed, al
mov al, byte [0x7eb0000]
dec eax
inc ebx
xor eax, 0x413b4932
pop esi
mov eax, dword [ebp - 0xc20]
invalid
invalid
Function at 0x10002165
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword fs:[0x18]
mov dword [ebp - 0x1be4], edx
mov eax, dword [ebp - 0x1be4]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x1be8], ecx
mov edx, dword [ebp - 0x1be8]
mov dword [ebp - 0x1514], edx
push esi
push eax
add esp, 4
add esi, 0x146ca
xor esi, 0x26e
pop esi
push esi
push esi
add esp, 4
jmp 0x10002055
add esi, 0x5896
pop esi
push edi
and edi, 0xb414
sub edi, 0x2765
pop edi
cmp dword [ebp - 0x1514], 0
jne 0x10002082
mov dword [ebp - 0x728], 0
jmp 0x10002329
mov eax, dword [ebp - 0x1514]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xc28], edx
push edx
sub edx, 0x147fe
pop edx
push ebx
push ebx
add esp, 4
jmp 0x100020a9
call 0x100020b6
add byte [esi], dh
cmp dword [ebx + 0x50], eax
inc edi
dec edx
inc esp
add esp, 4
add ebx, 0xcb40
add ebx, 0x129db
pop ebx
cmp dword [ebp - 0xc28], 0
jne 0x100020de
mov dword [ebp - 0x728], 0
jmp 0x10002329
mov eax, dword [ebp - 0xc28]
mov dword [ebp - 0x4c0], eax
push edi
push edx
add esp, 4
xor edi, 0x109a2
or edi, 0x374c
pop edi
push ebx
push eax
add esp, 4
add ebx, 0x5428
and ebx, 0xb0dd
jmp 0x10002112
jmp 0x1000211b
pop ebx
lea ecx, [ebp - 0x1650]
mov dword [ebp - 0xc24], ecx
mov edx, dword [ebp - 0x4c0]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xc20], eax
xor ecx, ecx
mov word [ebp - 0x1b0], cx
xor edx, edx
mov word [ebp - 0x24], dx
push esi
call 0x10002154
add byte [0x43474536], bh
push eax
cmp byte [ebx + 0x9e804c4], al
add byte [eax], al
add byte [eax], al
dec ebx
inc ecx
aaa
xor bh, byte [ebx]
inc edx
cmp dword [ecx - 0x7d], ecx
les eax, [ecx + eax*4]
out 0xed, al
mov al, byte [0x7eb0000]
dec eax
inc ebx
xor eax, 0x413b4932
pop esi
mov eax, dword [ebp - 0xc20]
invalid
invalid
Function at 0x10002490
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
jmp 0x10002707
cmp dword [ebp - 0x380], 0
je 0x100027e2
push esi
push edi
add esp, 4
call 0x10002726
add byte [ecx], bh
inc esi
cmp al, 0x36
inc ebp
cmp dword [ebx - 0x7d], eax
les eax, [esi + ebx*2]
push edx
jmp 0x10002733
sub edx, 0xa89f
pop edx
push esi
push eax
add esp, 4
xor esi, 0x162f2
pop esi
mov edx, dword [ebp - 0x380]
mov dword [ebp - 0x1bfc], edx
push edx
call 0x10002763
add byte [edx + 0x4f], cl
dec esi
dec esi
dec esi
aas
push eax
cmp byte [0x5a04c483], dh
push esi
push ecx
add esp, 4
add esi, 0xc3cf
add esi, 0x1871
add esi, 0x14020
jmp 0x10002783
pop esi
mov eax, dword [ebp - 0x1bfc]
mov dword [ebp - 0x1c00], eax
lea ecx, [ebp - 0x15d0]
push ecx
call dword [ebp - 0x1c00]
test eax, eax
jne 0x100027e2
push edx
call 0x100027b1
add byte [esi], dh
push eax
inc esi
dec esp
xor eax, 0x4b42444e
add esp, 4
pop edx
push edi
push edx
add esp, 4
or edi, 0x8235
sub edi, 0x2c5a
or edi, 0x162f3
and edi, 0x176a8
pop edi
mov dword [ebp - 0x774], 0
jmp 0x10002ecd
push edi
xor edi, 0x5147
pop edi
push ebx
jmp 0x100027f2
call 0x100027fe
add byte [edx], dh
cmp byte [ebx], bh
push eax
dec ebx
dec ebx
add esp, 4
pop ebx
push eax
push eax
add esp, 4
or eax, 0x15222
sub eax, 0xeeb8
pop eax
mov edx, dword fs:[0x18]
mov dword [ebp - 0x1c04], edx
dec dword [ebx - 0x1c037b]
dec dword [ebx - 0x7276cfb8]
clc
jecxz 0x1000282e
dec dword [ebx - 0x1c076b]
dec dword [ecx - 0x152b6b]
call dword [ecx + 0x56]
add esp, 4
call fcn.10002850
add byte [edi], bh
aaa
dec esi
dec eax
cmp dh, byte [ebx]
dec esi
inc edi
dec ebp
Function at 0x10002726
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
jmp 0x10002707
cmp dword [ebp - 0x380], 0
je 0x100027e2
push esi
push edi
add esp, 4
call 0x10002726
add byte [ecx], bh
inc esi
cmp al, 0x36
inc ebp
cmp dword [ebx - 0x7d], eax
les eax, [esi + ebx*2]
push edx
jmp 0x10002733
sub edx, 0xa89f
pop edx
push esi
push eax
add esp, 4
xor esi, 0x162f2
pop esi
mov edx, dword [ebp - 0x380]
mov dword [ebp - 0x1bfc], edx
push edx
call 0x10002763
add byte [edx + 0x4f], cl
dec esi
dec esi
dec esi
aas
push eax
cmp byte [0x5a04c483], dh
push esi
push ecx
add esp, 4
add esi, 0xc3cf
add esi, 0x1871
add esi, 0x14020
jmp 0x10002783
pop esi
mov eax, dword [ebp - 0x1bfc]
mov dword [ebp - 0x1c00], eax
lea ecx, [ebp - 0x15d0]
push ecx
call dword [ebp - 0x1c00]
test eax, eax
jne 0x100027e2
push edx
call 0x100027b1
add byte [esi], dh
push eax
inc esi
dec esp
xor eax, 0x4b42444e
add esp, 4
pop edx
push edi
push edx
add esp, 4
or edi, 0x8235
sub edi, 0x2c5a
or edi, 0x162f3
and edi, 0x176a8
pop edi
mov dword [ebp - 0x774], 0
jmp 0x10002ecd
push edi
xor edi, 0x5147
pop edi
push ebx
jmp 0x100027f2
call 0x100027fe
add byte [edx], dh
cmp byte [ebx], bh
push eax
dec ebx
dec ebx
add esp, 4
pop ebx
push eax
push eax
add esp, 4
or eax, 0x15222
sub eax, 0xeeb8
pop eax
mov edx, dword fs:[0x18]
mov dword [ebp - 0x1c04], edx
dec dword [ebx - 0x1c037b]
dec dword [ebx - 0x7276cfb8]
clc
jecxz 0x1000282e
dec dword [ebx - 0x1c076b]
dec dword [ecx - 0x152b6b]
call dword [ecx + 0x56]
add esp, 4
call fcn.10002850
add byte [edi], bh
aaa
dec esi
dec eax
cmp dh, byte [ebx]
dec esi
inc edi
dec ebp
Function at 0x10002763
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
jmp 0x10002707
cmp dword [ebp - 0x380], 0
je 0x100027e2
push esi
push edi
add esp, 4
call 0x10002726
add byte [ecx], bh
inc esi
cmp al, 0x36
inc ebp
cmp dword [ebx - 0x7d], eax
les eax, [esi + ebx*2]
push edx
jmp 0x10002733
sub edx, 0xa89f
pop edx
push esi
push eax
add esp, 4
xor esi, 0x162f2
pop esi
mov edx, dword [ebp - 0x380]
mov dword [ebp - 0x1bfc], edx
push edx
call 0x10002763
add byte [edx + 0x4f], cl
dec esi
dec esi
dec esi
aas
push eax
cmp byte [0x5a04c483], dh
push esi
push ecx
add esp, 4
add esi, 0xc3cf
add esi, 0x1871
add esi, 0x14020
jmp 0x10002783
pop esi
mov eax, dword [ebp - 0x1bfc]
mov dword [ebp - 0x1c00], eax
lea ecx, [ebp - 0x15d0]
push ecx
call dword [ebp - 0x1c00]
test eax, eax
jne 0x100027e2
push edx
call 0x100027b1
add byte [esi], dh
push eax
inc esi
dec esp
xor eax, 0x4b42444e
add esp, 4
pop edx
push edi
push edx
add esp, 4
or edi, 0x8235
sub edi, 0x2c5a
or edi, 0x162f3
and edi, 0x176a8
pop edi
mov dword [ebp - 0x774], 0
jmp 0x10002ecd
push edi
xor edi, 0x5147
pop edi
push ebx
jmp 0x100027f2
call 0x100027fe
add byte [edx], dh
cmp byte [ebx], bh
push eax
dec ebx
dec ebx
add esp, 4
pop ebx
push eax
push eax
add esp, 4
or eax, 0x15222
sub eax, 0xeeb8
pop eax
mov edx, dword fs:[0x18]
mov dword [ebp - 0x1c04], edx
dec dword [ebx - 0x1c037b]
dec dword [ebx - 0x7276cfb8]
clc
jecxz 0x1000282e
dec dword [ebx - 0x1c076b]
dec dword [ecx - 0x152b6b]
call dword [ecx + 0x56]
add esp, 4
call fcn.10002850
add byte [edi], bh
aaa
dec esi
dec eax
cmp dh, byte [ebx]
dec esi
inc edi
dec ebp
Function at 0x100027b1
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
jmp 0x10002707
cmp dword [ebp - 0x380], 0
je 0x100027e2
push esi
push edi
add esp, 4
call 0x10002726
add byte [ecx], bh
inc esi
cmp al, 0x36
inc ebp
cmp dword [ebx - 0x7d], eax
les eax, [esi + ebx*2]
push edx
jmp 0x10002733
sub edx, 0xa89f
pop edx
push esi
push eax
add esp, 4
xor esi, 0x162f2
pop esi
mov edx, dword [ebp - 0x380]
mov dword [ebp - 0x1bfc], edx
push edx
call 0x10002763
add byte [edx + 0x4f], cl
dec esi
dec esi
dec esi
aas
push eax
cmp byte [0x5a04c483], dh
push esi
push ecx
add esp, 4
add esi, 0xc3cf
add esi, 0x1871
add esi, 0x14020
jmp 0x10002783
pop esi
mov eax, dword [ebp - 0x1bfc]
mov dword [ebp - 0x1c00], eax
lea ecx, [ebp - 0x15d0]
push ecx
call dword [ebp - 0x1c00]
test eax, eax
jne 0x100027e2
push edx
call 0x100027b1
add byte [esi], dh
push eax
inc esi
dec esp
xor eax, 0x4b42444e
add esp, 4
pop edx
push edi
push edx
add esp, 4
or edi, 0x8235
sub edi, 0x2c5a
or edi, 0x162f3
and edi, 0x176a8
pop edi
mov dword [ebp - 0x774], 0
jmp 0x10002ecd
push edi
xor edi, 0x5147
pop edi
push ebx
jmp 0x100027f2
call 0x100027fe
add byte [edx], dh
cmp byte [ebx], bh
push eax
dec ebx
dec ebx
add esp, 4
pop ebx
push eax
push eax
add esp, 4
or eax, 0x15222
sub eax, 0xeeb8
pop eax
mov edx, dword fs:[0x18]
mov dword [ebp - 0x1c04], edx
dec dword [ebx - 0x1c037b]
dec dword [ebx - 0x7276cfb8]
clc
jecxz 0x1000282e
dec dword [ebx - 0x1c076b]
dec dword [ecx - 0x152b6b]
call dword [ecx + 0x56]
add esp, 4
call fcn.10002850
add byte [edi], bh
aaa
dec esi
dec eax
cmp dh, byte [ebx]
dec esi
inc edi
dec ebp
Function at 0x100027fe
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
jmp 0x10002707
cmp dword [ebp - 0x380], 0
je 0x100027e2
push esi
push edi
add esp, 4
call 0x10002726
add byte [ecx], bh
inc esi
cmp al, 0x36
inc ebp
cmp dword [ebx - 0x7d], eax
les eax, [esi + ebx*2]
push edx
jmp 0x10002733
sub edx, 0xa89f
pop edx
push esi
push eax
add esp, 4
xor esi, 0x162f2
pop esi
mov edx, dword [ebp - 0x380]
mov dword [ebp - 0x1bfc], edx
push edx
call 0x10002763
add byte [edx + 0x4f], cl
dec esi
dec esi
dec esi
aas
push eax
cmp byte [0x5a04c483], dh
push esi
push ecx
add esp, 4
add esi, 0xc3cf
add esi, 0x1871
add esi, 0x14020
jmp 0x10002783
pop esi
mov eax, dword [ebp - 0x1bfc]
mov dword [ebp - 0x1c00], eax
lea ecx, [ebp - 0x15d0]
push ecx
call dword [ebp - 0x1c00]
test eax, eax
jne 0x100027e2
push edx
call 0x100027b1
add byte [esi], dh
push eax
inc esi
dec esp
xor eax, 0x4b42444e
add esp, 4
pop edx
push edi
push edx
add esp, 4
or edi, 0x8235
sub edi, 0x2c5a
or edi, 0x162f3
and edi, 0x176a8
pop edi
mov dword [ebp - 0x774], 0
jmp 0x10002ecd
push edi
xor edi, 0x5147
pop edi
push ebx
jmp 0x100027f2
call 0x100027fe
add byte [edx], dh
cmp byte [ebx], bh
push eax
dec ebx
dec ebx
add esp, 4
pop ebx
push eax
push eax
add esp, 4
or eax, 0x15222
sub eax, 0xeeb8
pop eax
mov edx, dword fs:[0x18]
mov dword [ebp - 0x1c04], edx
dec dword [ebx - 0x1c037b]
dec dword [ebx - 0x7276cfb8]
clc
jecxz 0x1000282e
dec dword [ebx - 0x1c076b]
dec dword [ecx - 0x152b6b]
call dword [ecx + 0x56]
add esp, 4
call fcn.10002850
add byte [edi], bh
aaa
dec esi
dec eax
cmp dh, byte [ebx]
dec esi
inc edi
dec ebp
Function at 0x10002820
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
jmp 0x10002707
cmp dword [ebp - 0x380], 0
je 0x100027e2
push esi
push edi
add esp, 4
call 0x10002726
add byte [ecx], bh
inc esi
cmp al, 0x36
inc ebp
cmp dword [ebx - 0x7d], eax
les eax, [esi + ebx*2]
push edx
jmp 0x10002733
sub edx, 0xa89f
pop edx
push esi
push eax
add esp, 4
xor esi, 0x162f2
pop esi
mov edx, dword [ebp - 0x380]
mov dword [ebp - 0x1bfc], edx
push edx
call 0x10002763
add byte [edx + 0x4f], cl
dec esi
dec esi
dec esi
aas
push eax
cmp byte [0x5a04c483], dh
push esi
push ecx
add esp, 4
add esi, 0xc3cf
add esi, 0x1871
add esi, 0x14020
jmp 0x10002783
pop esi
mov eax, dword [ebp - 0x1bfc]
mov dword [ebp - 0x1c00], eax
lea ecx, [ebp - 0x15d0]
push ecx
call dword [ebp - 0x1c00]
test eax, eax
jne 0x100027e2
push edx
call 0x100027b1
add byte [esi], dh
push eax
inc esi
dec esp
xor eax, 0x4b42444e
add esp, 4
pop edx
push edi
push edx
add esp, 4
or edi, 0x8235
sub edi, 0x2c5a
or edi, 0x162f3
and edi, 0x176a8
pop edi
mov dword [ebp - 0x774], 0
jmp 0x10002ecd
push edi
xor edi, 0x5147
pop edi
push ebx
jmp 0x100027f2
call 0x100027fe
add byte [edx], dh
cmp byte [ebx], bh
push eax
dec ebx
dec ebx
add esp, 4
pop ebx
push eax
push eax
add esp, 4
or eax, 0x15222
sub eax, 0xeeb8
pop eax
mov edx, dword fs:[0x18]
mov dword [ebp - 0x1c04], edx
dec dword [ebx - 0x1c037b]
dec dword [ebx - 0x7276cfb8]
clc
jecxz 0x1000282e
dec dword [ebx - 0x1c076b]
dec dword [ecx - 0x152b6b]
call dword [ecx + 0x56]
add esp, 4
call fcn.10002850
add byte [edi], bh
aaa
dec esi
dec eax
cmp dh, byte [ebx]
dec esi
inc edi
dec ebp