joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100294f
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x2001f
push 0
push dword [0x1004024]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100298d
push dword [0x1004028]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret

Function at 0x100ac01
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movzx eax, word [esi]
pop esi
add esi, dword [edi + eax*4]
ret 4
mov esi, ebx
mov eax, ebx
add eax, dword [ebx + 0x3c]
add edx, dword [eax + 0x78]
push 0xffffffffffffffff
jmp 0x10060c3
sbb eax, dword [esp + 4]
jne 0x10060c7
lea edi, [ebx]
lea esi, [ebx]
add edi, dword [edx + 0x1c]
jmp 0x100ac19
add esi, dword [edx + 0x20]
pop ecx
lodsd eax, dword [esi]
jmp 0x100abad
cmp byte [edi], 1
pop eax
ja 0x100aca2
xor eax, 0x3993acd1
jmp 0x1006094
inc ecx
cmp ecx, dword [edx + 0x18]
lea edi, [eax + ebx]
je 0x100ac46
push 0
jmp 0x100aca1
mov edx, ebx
jmp 0x1006072
add esi, dword [edx + 0x24]
push ebx
lea esi, [esi + ecx*2]
jmp 0x100601e
ret
pop eax
imul eax, eax, 0xf
push eax
jmp 0x100acab
movzx eax, byte [edi]
lea edi, [edi + 1]
sub dword [esp], eax
jmp 0x10060dc
Function at 0x1000a463
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [fcn.1000a463]
mov dword [0x102db304], 0x1060
mov ecx, dword [0x102db300]
mov edx, ecx
add edx, 0x1bd4
add ecx, 0xc29
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
cmp word [ecx], 0x5a4d
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
jne 0x1000a4c8
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
jne 0x1000a4c8
mov eax, dword [ebp - 0x10]
mov dword [0x102db304], eax
mov eax, dword [ebp - 0x14]
add esp, 0x14
pop ebp
ret
mov eax, dword [ebp - 0x14]
add eax, 0xfffff000
and eax, 0xfffff000
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ecx
jmp 0x1000a496

Function at 0x1000a4f5
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x102db300], 0x13a8
mov dword [0x102db30c], 0
mov byte [0x102db310], 0
mov edi, dword [0x102db304]
add edi, 0xffffea5b
mov dword [0x102db304], edi
mov dword [0x102db308], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x1000a569
xor eax, eax
mov dword [0x102db300], 0x119a
mov dword [0x102db308], 0
mov dword [ebp - 0x20], eax
jmp 0x1000a5a0
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x102db304]
add eax, 0xfffff29d
mov dword [0x102db300], eax
mov eax, dword [0x102db308]
add eax, 1
mov dword [0x102db308], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x1000a569
jmp 0x1000a54e
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [ebp - 0x24], eax
xor edx, edx
mov esi, dword [ebp - 0x10]
div esi
mov dword [0x102db314], 0
mov dword [0x102db300], 0x21a0
mov edi, dword [0x102db30c]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x24]
movzx esi, byte [ebx + esi]
add esi, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add esi, edx
mov dword [0x102db314], esi
mov eax, esi
cdq
idiv ecx
mov dword [0x102db30c], edx
mov dword [0x102db304], 0xd15
mov ecx, dword [ebp - 0x24]
mov cl, byte [ebx + ecx]
mov byte [0x102db310], cl
mov cl, byte [ebx + edx]
mov edx, dword [ebp - 0x24]
mov byte [ebx + edx], cl
mov dword [0x102db300], 0x18ab
mov cl, byte [0x102db310]
mov esi, dword [0x102db30c]
mov byte [ebx + esi], cl
mov esi, dword [0x102db308]
add esi, 1
mov dword [0x102db308], esi
cmp esi, 0x100
mov dword [ebp - 0x20], esi
jl 0x1000a5a0
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1000a6e2
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
lea edx, [0x102d467b]
mov esi, 0xe
lea edi, [ebp - 0x28]
mov dword [0x102db304], 0x780
mov dword [esp], edi
mov dword [esp + 4], edx
mov dword [esp + 8], 0xe
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], esi
call fcn.1000a653
mov eax, dword [0x102db300]
add eax, 0x23bd
mov dword [0x102db300], eax
call fcn.1000afe6
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
call fcn.1000a1b8
xor ecx, ecx
cmp eax, 0
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], ecx
jne 0x1000a764
mov eax, dword [ebp - 0x40]
add esp, 0x4c
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x3c]
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [0x102db300], 0x1a85
mov dword [esp], eax
mov ecx, dword [ebp - 0x2c]
mov dword [esp + 4], ecx
mov dword [ebp - 0x44], eax
call fcn.1000a361
xor eax, eax
mov ecx, dword [ebp - 0x44]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [0x102db304], 0xffffea19
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x30]
mov dword [edx + 0x30], ecx
mov ecx, dword [ebp - 0x44]
mov dword [edx + 0x50], ecx
mov dword [0x102db300], 0x24ae
cmp ecx, 0
mov dword [ebp - 0x40], eax
je 0x1000a75a
mov eax, dword [0x102db304]
mov ecx, dword [ebp - 0x44]
add ecx, 0x17c4
add eax, 0xffffec01
mov dword [0x102db304], eax
mov dword [ebp - 0x40], ecx
jmp 0x1000a75a
Function at 0x1000a8b6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x48
mov eax, dword [ebp + 8]
mov dword [0x102db300], 0xacb
mov dword [ebp - 0x10], eax
call fcn.1000b39a
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov edi, edx
add edi, esi
mov esi, dword [eax + esi]
cmp esi, 0x4550
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edi
je 0x1000a8fc
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x78]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add ecx, dword [edx + eax + 0x20]
mov dword [0x102db304], 0x6ce
mov esi, dword [edx + eax + 0x24]
mov dword [0x102db300], 0xfffffca0
mov edi, dword [edx + eax + 0x18]
cmp edi, 0
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], ebx
je 0x1000a954
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x2c]
add ecx, edx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], eax
jmp 0x1000a95f
mov eax, dword [ebp - 0x34]
add esp, 0x48
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x38]
xor edx, edx
mov esi, dword [ebp - 0x28]
mov edi, dword [esi + eax*4]
mov dword [0x102db300], 0xacb
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x4c]
mov ecx, eax
mov edx, dword [ebp - 0x48]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x50], eax
mov byte [ebp - 0x51], bh
mov byte [ebp - 0x52], cl
je 0x1000a9d4
mov eax, dword [ebp - 0x50]
add eax, 1
mov cl, byte [ebp - 0x51]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x52]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x4c], eax
jne 0x1000a983
mov al, byte [ebp - 0x52]
test al, 1
jne 0x1000aa0a
jmp 0x1000a9dd
xor eax, eax
mov ecx, dword [ebp - 0x40]
add ecx, 1
mov edx, dword [ebp - 0x44]
add edx, 2
mov esi, dword [ebp - 0x30]
cmp ecx, esi
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x3c], ecx
jb 0x1000a95f
jmp 0x1000a954
mov eax, dword [ebp - 0x44]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x24]
add edx, dword [edx + esi + 0x1c]
mov edi, dword [ebp - 0x1c]
add edi, dword [edx + ecx*4]
mov dword [0x102db300], 0x1919
mov dword [ebp - 0x34], edi
jmp 0x1000a954
Function at 0x1000aa32
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x170
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [0x102db300], 0x30f8
mov edx, ecx
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], ecx
jmp 0x1000ab0c
lea eax, [0x102d467b]
mov ecx, 0xe
lea edx, [ebp - 0x2c]
mov dword [0x102db304], 0x2550
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0xe
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x140], ecx
call fcn.1000a653
mov dword [0x102db300], 0x204d
call fcn.1000afe6
mov dword [esp], eax
mov eax, dword [ebp - 0x13c]
mov dword [esp + 4], eax
call fcn.1000a1b8
mov ecx, eax
mov dword [0x102db31c], eax
mov eax, esp
mov edx, dword [ebp - 0x144]
mov dword [eax + 4], edx
mov dword [eax + 0xc], 4
mov dword [eax + 8], 0x1000
mov dword [eax], 0
call ecx
sub esp, 0x10
xor ecx, ecx
mov dword [0x102db300], 0x1ad8
mov edx, ecx
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x14c], edx
mov dword [ebp - 0x150], ecx
jmp 0x1000ab6d
mov eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x134]
lea edx, section..data
imul esi, ecx, 0x34
mov edi, edx
add edi, esi
add edi, 4
imul esi, ecx, 0x34
add edx, esi
add edx, 0x30
add ecx, 1
mov edx, dword [edx]
movzx esi, word [edi]
xor esi, edx
add esi, eax
cmp ecx, 0x1e7
mov eax, esi
mov dword [ebp - 0x144], esi
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x138], eax
je 0x1000aa66
jmp 0x1000ab0c
mov eax, dword [ebp - 0x150]
mov ecx, dword [ebp - 0x14c]
lea edx, section..data
mov esi, dword [ebp - 0x148]
add esi, eax
imul edi, ecx, 0x34
mov ebx, edx
add ebx, edi
add ebx, 4
imul edi, ecx, 0x34
mov dword [ebp - 0x154], eax
mov eax, edx
add eax, edi
imul edi, ecx, 0x34
add edx, edi
add edx, 0x30
add ecx, 1
mov edx, dword [edx]
mov eax, dword [eax]
movzx edi, word [ebx]
xor edi, edx
mov dword [esp], esi
mov dword [esp + 4], eax
mov dword [esp + 8], edi
mov dword [ebp - 0x158], edi
mov dword [ebp - 0x15c], ecx
call fcn.1000b2fc
mov eax, dword [ebp - 0x158]
mov ecx, dword [ebp - 0x154]
add eax, ecx
mov edx, dword [ebp - 0x15c]
cmp edx, 0x1e7
mov dword [ebp - 0x14c], edx
mov dword [ebp - 0x150], eax
jne 0x1000ab6d
lea eax, [0x102d4689]
mov ecx, 0x20
lea edx, [ebp - 0x12c]
mov esi, dword [ebp - 0x148]
add esi, 0x77d6f
mov edi, dword [ebp - 0x148]
add edi, 0xc7166
mov dword [0x102db300], 0xa06
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x20
mov dword [ebp - 0x160], edi
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], edx
mov dword [ebp - 0x16c], esi
call fcn.1000a4f5
mov eax, dword [0x102db304]
add eax, 0xfffff796
mov dword [0x102db300], eax
mov eax, dword [ebp - 0x168]
mov dword [esp], eax
mov ecx, dword [ebp - 0x148]
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov edx, dword [ebp - 0x144]
mov dword [esp + 0xc], edx
call fcn.1000b51a
xor eax, eax
mov ecx, dword [ebp - 0x130]
mov edx, dword [ebp - 0x160]
mov dword [ecx], edx
mov dword [0x102db300], 0x98
mov dword [ecx + 4], 0x151000
mov edx, dword [ebp - 0x16c]
mov dword [ecx + 8], edx
mov dword [0x102db304], 0x1460
mov dword [ecx + 0xc], 0x20b0
add esp, 0x170
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1000b10a
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [0x102db304], 0x1a0e
mov dword [ebp - 4], 0
mov dword [0x102db300], 0x7d0
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, dword [0x102db300]
add edx, 0xfffffa13
mov dword [0x102db300], edx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x102db304], 0x19a
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jmp 0x1000b1d9
mov eax, 0xffffee12
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x18], eax
je 0x1000b28e
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov dword [0x102db304], eax
mov dword [ebp - 0x1c], ecx
jmp 0x1000b2a0
mov eax, 0xffffee12
mov dword [0x102db300], 0x43b
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0x10], 0x6c
mov dword [ebp - 0x18], eax
je 0x1000b166
jmp 0x1000b181
mov eax, 0xfffff83a
mov dword [0x102db300], 0xe63
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0x12], 0x64
mov dword [ebp - 0x18], eax
je 0x1000b193
jmp 0x1000b181
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], edx
je 0x1000b206
mov eax, dword [ebp - 0x20]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x24], eax
jl 0x1000b1d9
mov eax, dword [ebp - 0x24]
mov ecx, 0xffffec88
mov dword [0x102db300], 0x2b1
mov edx, dword [ebp - 0xc]
cmp word [edx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
jne 0x1000b181
mov eax, 0xffffec88
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0x18], 0x6f
mov dword [ebp - 0x18], eax
jne 0x1000b181
mov eax, 0x1137
mov dword [0x102db300], 0x2760
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0x16], 0x61
mov dword [ebp - 0x18], eax
jne 0x1000b181
mov eax, 0x1137
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0x14], 0x64
mov dword [ebp - 0x18], eax
je 0x1000b1b6
jmp 0x1000b181
mov eax, 1
mov dword [0x102db300], 0x26a1
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
add esp, 0x24
pop ebp
ret
Function at 0x1000b51a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov ebx, 0x1541
mov dword [0x102db308], 0
mov dword [0x102db30c], 0
mov dword [0x102db318], 0
mov dword [0x102db300], 0x1541
cmp eax, 0
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov eax, edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], edi
je 0x1000b6ae
jmp 0x1000b5a7
mov eax, dword [0x102db30c]
mov ecx, dword [0x102db308]
mov edx, dword [0x102db300]
mov esi, dword [ebp - 0x30]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x2c], esi
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x14]
mov edi, 0x100
add edx, 0xffffe50f
mov ebx, eax
add ebx, 1
add esi, 1
mov dword [0x102db300], edx
mov dword [ebp - 0x34], eax
mov eax, esi
cdq
idiv edi
mov dword [0x102db308], edx
mov dword [0x102db304], 0x1c5a
mov esi, dword [ebp - 0x24]
movzx esi, byte [esi + edx]
add esi, ecx
mov eax, esi
mov dword [ebp - 0x38], edx
cdq
idiv edi
mov dword [0x102db30c], edx
mov dword [0x102db300], 0xe53
mov ecx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x38]
mov cl, byte [ecx + esi]
mov byte [0x102db310], cl
mov dword [0x102db304], 0x1303
mov edi, dword [ebp - 0x24]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov cl, byte [0x102db310]
mov edx, dword [0x102db30c]
mov byte [edi + edx], cl
mov edx, dword [0x102db300]
mov ecx, edx
add ecx, 0x1414
mov dword [0x102db300], ecx
mov ecx, dword [0x102db308]
movzx ecx, byte [edi + ecx]
mov esi, dword [0x102db30c]
movzx esi, byte [edi + esi]
add esi, ecx
mov ecx, edx
add ecx, 0xfffff366
mov dword [0x102db300], ecx
and esi, 0xff
mov dword [0x102db318], esi
mov cl, byte [edi + esi]
mov esi, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x34]
mov ch, byte [esi + edi]
add edx, 0xffffe34d
mov dword [0x102db300], edx
xor ch, cl
mov edx, dword [ebp - 0x20]
mov byte [edx + edi], ch
mov edx, dword [ebp - 0x10]
cmp ebx, edx
mov dword [ebp - 0x30], ebx
jne 0x1000b587
mov dword [0x102db304], 0xaeb
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10001540
Capabilities:
Manipulate console buffer
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x128
mov eax, esp
lea ecx, [esp + 0x118]

Function at 0x1000271c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x101ec2c0]
jne 0x10002726
repz ret
jmp fcn.100029cd

Function at 0x10003b70
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [fcn.10003b70]
mov dword [ebp - 8], eax
mov dword [0x101ec294], 0x1189
jmp 0x10003b8b
mov eax, dword [ebp - 8]
movzx eax, word [eax]
cmp eax, 0x5a4d
jne 0x10003bbf
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
add eax, dword [ecx + 0x3c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0x4550
jne 0x10003bbd
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x10003be4
jmp 0x10003bbf
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
sub eax, 0x1000
and eax, 0xfffff000
mov dword [ebp - 8], eax
mov al, 1
test al, 1
jne 0x10003b8b
jmp 0x10003bdd
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
add esp, 0x18
pop ebp
ret

Function at 0x10003ea0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [0x101ec294], 0x2433
mov dword [ebp - 0x10], 0
mov dword [0x101ec298], 0xb4
mov eax, dword fs:[0x30]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
jmp 0x10003f53
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
shl ecx, 1
add eax, ecx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx ecx, word [eax - 0x1a]
cmp ecx, 0x6c
je 0x10003f95
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
jmp 0x10003f53
mov dword [0x101ec298], 0x1819
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
movzx eax, word [eax + ecx*2 - 0x16]
cmp eax, 0x61
je 0x10003fba
jmp 0x10004046
cmp dword [ebp - 8], 0x104
jge 0x10003ee4
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov dx, word [eax + ecx*2]
mov word [ebp - 0x16], dx
mov ax, word [ebp - 0x16]
movzx ecx, ax
cmp ecx, 0
jne 0x10003f7e
jmp 0x10003ee4
mov eax, dword [0x101ec294]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
sub eax, 0x2d4
mov dword [0x101ec298], eax
jmp 0x10003f20
mov dword [0x101ec294], 0x1dcf
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
movzx eax, word [eax + ecx*2 - 0x18]
cmp eax, 0x6f
je 0x10003f2d
jmp 0x10003ee2
mov eax, dword [0x101ec294]
add eax, 0x11ea
mov dword [0x101ec294], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
movzx eax, word [eax + ecx*2 - 0x14]
cmp eax, 0x64
jne 0x10003f4e
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
movzx eax, word [eax + ecx*2 - 0x12]
cmp eax, 0x64
jne 0x10004041
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
movzx eax, word [eax + ecx*2 - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
inc ebp
loopne 0x10004040
insb byte es:[edi], dx
add byte [eax], al
add byte [ebp + 0x36], dh
Function at 0x100024f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10063c15
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x100988d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
push dword [esi + 0xc]
mov ecx, dword [0x10099dfc]
lea eax, [ebp - 0x14]
push eax
call fcn.10021f00
mov edi, dword [ebp + 8]
mov ecx, edi
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.ScCore.dll_public:_bool___thiscall_ScCore::String::operator_class_ScCore::String_const__const]
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
mov bl, al
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::String::destructor_void_]
test bl, bl
je 0x1000261b
mov edi, dword [esi + 8]
mov eax, dword [esi + 0xc]
push 0
push 1
mov esi, dword [edi]
push 0
push eax
push eax
mov esi, dword [esi + 4]
mov ecx, esi
call dword [0x10070958]
mov ecx, edi
call esi
mov esi, eax
test esi, esi
je 0x10002605
push 0
push dword [esi + 0x14]
lea ecx, [ebp - 0x10]
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::String::constructor_char_const___class_ScCore::Encoder_const__]
push 0x2c
mov dword [ebp - 4], 1
call dword [sym.imp.ScCore.dll_public:_static_void____cdecl_ScCore::Heap::operator_new_unsigned_int_]
add esp, 4
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x100025e4
push 0
lea ecx, [ebp - 0x10]
push ecx
push dword [esi + 0xc]
mov ecx, eax
push dword [esi + 4]
call fcn.10021f00
lea ecx, [ebp - 0x10]
mov esi, eax
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::String::destructor_void_]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x10]
xor esi, esi
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::String::destructor_void_]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi]
mov ecx, dword [0x10099dfc]
add eax, 0xc
push eax
call fcn.10021f00
mov ecx, dword [esi]
push eax
mov esi, dword [ecx + 0x30]
mov ecx, esi
call dword [0x10070958]
mov ecx, dword [ebp - 0x18]
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10004300
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006408f
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x100988d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
mov eax, esi
and eax, 0xe0000000
cmp eax, 0x20000000
jg 0x100043cc
je 0x100043c7
cmp eax, 0x80000000
je 0x100043c7
test eax, eax
jne 0x100043d3
lea ecx, [ebp - 0x2c]
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Variant::constructor_void_]
mov eax, dword [0x10099e0c]
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0xa
mov ecx, dword [eax]
test ecx, ecx
je 0x1000437e
add ecx, 0x28
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Lock::acquire_void_]
mov ecx, dword [edi]
push esi
mov byte [ebp - 4], 1
call fcn.10021f00
push eax
lea ecx, [ebp - 0x2c]
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Variant::setString_unsigned_short_int_const__]
mov eax, dword [0x10099e0c]
mov byte [ebp - 4], 2
mov ecx, dword [eax]
test ecx, ecx
je 0x100043ac
add ecx, 0x28
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Lock::release_void_]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call dword [sym.imp.ScCore.dll_public:_double___thiscall_ScCore::Variant::getDouble_void_const]
lea ecx, [ebp - 0x2c]
fstp qword [ebp - 0x14]
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Variant::destructor_void_]
jmp 0x100043ef
xorps xmm0, xmm0
jmp 0x100043ea
cmp eax, 0x40000000
je 0x100043df
and esi, 0x1fffffff
movd xmm0, esi
jmp 0x100043e6
movzx eax, si
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [ebp - 0x14], xmm0
fld qword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4