joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004d5d
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
sub esi, 0x6763
pop esi
push eax
push ebx
add esp, 4
sub eax, 0xc7fd
pop eax
mov eax, dword [ebp - 0x5bc]
mov dword [ebp - 0x494], eax
jmp 0x10004dc2
push edx
push esi
add esp, 4
xor edx, 0xc47b
pop edx
push edx
push ecx
add esp, 4
or edx, 0xfcba
and edx, 0x8fa6
xor edx, 0xcec1
add edx, 0x10916
pop edx
push edi
add edi, 0xdd20
pop edi
push ecx
call 0x10004e02
add byte [ebx + 0x3a], al
cmp al, 0x3e
xor al, 0x44
add esp, 4
or ecx, 0x9403
pop ecx
push ecx
add ecx, 0x8ddf
sub ecx, 0x2a4
add ecx, 0x1586b
add ecx, 0x16a71
pop ecx
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xdd4]
mov dword [ebp - 0x18e4], eax
push ecx
push ebx
add esp, 4

Function at 0x10004da8
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
sub edx, 0x173f9
xor edx, 0x184ad
pop edx
mov dword [ebp - 0x494], 0

Function at 0x10004e02
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
sub esi, 0x6763
pop esi
push eax
push ebx
add esp, 4
sub eax, 0xc7fd
pop eax
mov eax, dword [ebp - 0x5bc]
mov dword [ebp - 0x494], eax
jmp 0x10004dc2
push edx
push esi
add esp, 4
xor edx, 0xc47b
pop edx
push edx
push ecx
add esp, 4
or edx, 0xfcba
and edx, 0x8fa6
xor edx, 0xcec1
add edx, 0x10916
pop edx
push edi
add edi, 0xdd20
pop edi
push ecx
call 0x10004e02
add byte [ebx + 0x3a], al
cmp al, 0x3e
xor al, 0x44
add esp, 4
or ecx, 0x9403
pop ecx
push ecx
add ecx, 0x8ddf
sub ecx, 0x2a4
add ecx, 0x1586b
add ecx, 0x16a71
pop ecx
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xdd4]
mov dword [ebp - 0x18e4], eax
push ecx
push ebx
add esp, 4
Function at 0x10005183
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x1000518e
pop edx
push ecx
jmp 0x10005199
and ecx, 0x11ebc
pop ecx
mov dword [ebp - 0xbfc], 0

Function at 0x10005340
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [eax + 0x43], al
xor al, 0x4b
inc esi
cmp eax, dword [edi + 0x49]
inc ecx
add esp, 4
call 0x1000535b
add byte [ecx + 0x44], al
inc esp
cmp edi, dword [ebx]
inc esi
inc esi
add esp, 4
pop eax
mov edx, dword fs:[0x18]
mov dword [ebp - 0x2688], edx
mov eax, dword [ebp - 0x2688]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x268c], ecx
mov edx, dword [ebp - 0x268c]
mov dword [ebp - 0x18ec], edx
push esi
push edx
add esp, 4
xor esi, 0xb270
pop esi
push edi
push ebx
add esp, 4
add edi, 0x11f8f
xor edi, 0x1248f
xor edi, 0x13d8e
pop edi
push edi
xor edi, 0xf64
or edi, 0x8e51
pop edi
cmp dword [ebp - 0x18ec], 0
jne 0x100053d1
mov dword [ebp - 0x398], 0
jmp 0x1000568d
invalid
mov eax, dword [ebp - 0x18ec]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xe98], edx
push eax
push ecx
add esp, 4
or eax, 0x83af
pop eax
push ecx
push esi
add esp, 4
xor ecx, 0x9855
add ecx, 0x1135c
xor ecx, 0x17357
xor ecx, 0x4984
pop ecx
push esi
jmp 0x10005414
pop esi
cmp dword [ebp - 0xe98], 0
jne 0x1000542d
mov dword [ebp - 0x398], 0
jmp 0x1000568d
mov eax, dword [ebp - 0xe98]
mov dword [ebp - 0x5c4], eax
push ecx
add ecx, 0x10e55
xor ecx, 0x80f3
and ecx, 0x7015
pop ecx
push ecx
push ecx
add esp, 4
sub ecx, 0x10fd0
add ecx, 0x12c8f
pop ecx
push ebx
push eax
add esp, 4
sub ebx, 0x7636
pop ebx
lea ecx, [ebp - 0x1a68]
mov dword [ebp - 0xe94], ecx
mov edx, dword [ebp - 0x5c4]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xe90], eax
xor ecx, ecx
mov word [ebp - 0x264], cx
xor edx, edx
mov word [ebp - 0x138], dx
push ebx
sub ebx, 0x15eed
pop ebx
push ecx
push eax
add esp, 4
xor ecx, 0x17220
jmp 0x100054b4
and ecx, 0xcdd2
call 0x100054c6
add byte [eax + ecx*2 + 0x44], cl
inc ecx
inc esp
cmp eax, dword [ebx - 0x74a6fb3c]
test dword [eax - 0xf], esi
invalid
push esi
push ecx
add esp, 4
sub esi, 0x7271
add esi, 0x10198
call 0x100056ae
add byte [edx], bh
xor al, 0x40
xor cl, byte [edx + esi + 0x4a]
dec edi
add esp, 4
xor esi, 0x16d22
pop esi
push edi
jmp 0x100056be
pop edi
cmp dword [ebp - 0x398], 0
jne 0x10005fd8
mov edx, 0x6b
mov word [ebp - 0x1ac8], dx
mov eax, 0x65
mov word [ebp - 0x1ac6], ax
mov ecx, 0x72
mov word [ebp - 0x1ac4], cx
Function at 0x1000534b
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [eax + 0x43], al
xor al, 0x4b
inc esi
cmp eax, dword [edi + 0x49]
inc ecx
add esp, 4
call 0x1000535b
add byte [ecx + 0x44], al
inc esp
cmp edi, dword [ebx]
inc esi
inc esi
add esp, 4
pop eax
mov edx, dword fs:[0x18]
mov dword [ebp - 0x2688], edx
mov eax, dword [ebp - 0x2688]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x268c], ecx
mov edx, dword [ebp - 0x268c]
mov dword [ebp - 0x18ec], edx
push esi
push edx
add esp, 4
xor esi, 0xb270
pop esi
push edi
push ebx
add esp, 4
add edi, 0x11f8f
xor edi, 0x1248f
xor edi, 0x13d8e
pop edi
push edi
xor edi, 0xf64
or edi, 0x8e51
pop edi
cmp dword [ebp - 0x18ec], 0
jne 0x100053d1
mov dword [ebp - 0x398], 0
jmp 0x1000568d
invalid
mov eax, dword [ebp - 0x18ec]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xe98], edx
push eax
push ecx
add esp, 4
or eax, 0x83af
pop eax
push ecx
push esi
add esp, 4
xor ecx, 0x9855
add ecx, 0x1135c
xor ecx, 0x17357
xor ecx, 0x4984
pop ecx
push esi
jmp 0x10005414
pop esi
cmp dword [ebp - 0xe98], 0
jne 0x1000542d
mov dword [ebp - 0x398], 0
jmp 0x1000568d
mov eax, dword [ebp - 0xe98]
mov dword [ebp - 0x5c4], eax
push ecx
add ecx, 0x10e55
xor ecx, 0x80f3
and ecx, 0x7015
pop ecx
push ecx
push ecx
add esp, 4
sub ecx, 0x10fd0
add ecx, 0x12c8f
pop ecx
push ebx
push eax
add esp, 4
sub ebx, 0x7636
pop ebx
lea ecx, [ebp - 0x1a68]
mov dword [ebp - 0xe94], ecx
mov edx, dword [ebp - 0x5c4]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xe90], eax
xor ecx, ecx
mov word [ebp - 0x264], cx
xor edx, edx
mov word [ebp - 0x138], dx
push ebx
sub ebx, 0x15eed
pop ebx
push ecx
push eax
add esp, 4
xor ecx, 0x17220
jmp 0x100054b4
and ecx, 0xcdd2
call 0x100054c6
add byte [eax + ecx*2 + 0x44], cl
inc ecx
inc esp
cmp eax, dword [ebx - 0x74a6fb3c]
test dword [eax - 0xf], esi
invalid
push esi
push ecx
add esp, 4
sub esi, 0x7271
add esi, 0x10198
call 0x100056ae
add byte [edx], bh
xor al, 0x40
xor cl, byte [edx + esi + 0x4a]
dec edi
add esp, 4
xor esi, 0x16d22
pop esi
push edi
jmp 0x100056be
pop edi
cmp dword [ebp - 0x398], 0
jne 0x10005fd8
mov edx, 0x6b
mov word [ebp - 0x1ac8], dx
mov eax, 0x65
mov word [ebp - 0x1ac6], ax
mov ecx, 0x72
mov word [ebp - 0x1ac4], cx
Function at 0x1000535b
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [eax + 0x43], al
xor al, 0x4b
inc esi
cmp eax, dword [edi + 0x49]
inc ecx
add esp, 4
call 0x1000535b
add byte [ecx + 0x44], al
inc esp
cmp edi, dword [ebx]
inc esi
inc esi
add esp, 4
pop eax
mov edx, dword fs:[0x18]
mov dword [ebp - 0x2688], edx
mov eax, dword [ebp - 0x2688]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x268c], ecx
mov edx, dword [ebp - 0x268c]
mov dword [ebp - 0x18ec], edx
push esi
push edx
add esp, 4
xor esi, 0xb270
pop esi
push edi
push ebx
add esp, 4
add edi, 0x11f8f
xor edi, 0x1248f
xor edi, 0x13d8e
pop edi
push edi
xor edi, 0xf64
or edi, 0x8e51
pop edi
cmp dword [ebp - 0x18ec], 0
jne 0x100053d1
mov dword [ebp - 0x398], 0
jmp 0x1000568d
invalid
mov eax, dword [ebp - 0x18ec]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xe98], edx
push eax
push ecx
add esp, 4
or eax, 0x83af
pop eax
push ecx
push esi
add esp, 4
xor ecx, 0x9855
add ecx, 0x1135c
xor ecx, 0x17357
xor ecx, 0x4984
pop ecx
push esi
jmp 0x10005414
pop esi
cmp dword [ebp - 0xe98], 0
jne 0x1000542d
mov dword [ebp - 0x398], 0
jmp 0x1000568d
mov eax, dword [ebp - 0xe98]
mov dword [ebp - 0x5c4], eax
push ecx
add ecx, 0x10e55
xor ecx, 0x80f3
and ecx, 0x7015
pop ecx
push ecx
push ecx
add esp, 4
sub ecx, 0x10fd0
add ecx, 0x12c8f
pop ecx
push ebx
push eax
add esp, 4
sub ebx, 0x7636
pop ebx
lea ecx, [ebp - 0x1a68]
mov dword [ebp - 0xe94], ecx
mov edx, dword [ebp - 0x5c4]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xe90], eax
xor ecx, ecx
mov word [ebp - 0x264], cx
xor edx, edx
mov word [ebp - 0x138], dx
push ebx
sub ebx, 0x15eed
pop ebx
push ecx
push eax
add esp, 4
xor ecx, 0x17220
jmp 0x100054b4
and ecx, 0xcdd2
call 0x100054c6
add byte [eax + ecx*2 + 0x44], cl
inc ecx
inc esp
cmp eax, dword [ebx - 0x74a6fb3c]
test dword [eax - 0xf], esi
invalid
push esi
push ecx
add esp, 4
sub esi, 0x7271
add esi, 0x10198
call 0x100056ae
add byte [edx], bh
xor al, 0x40
xor cl, byte [edx + esi + 0x4a]
dec edi
add esp, 4
xor esi, 0x16d22
pop esi
push edi
jmp 0x100056be
pop edi
cmp dword [ebp - 0x398], 0
jne 0x10005fd8
mov edx, 0x6b
mov word [ebp - 0x1ac8], dx
mov eax, 0x65
mov word [ebp - 0x1ac6], ax
mov ecx, 0x72
mov word [ebp - 0x1ac4], cx
Function at 0x100054c6
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [eax + 0x43], al
xor al, 0x4b
inc esi
cmp eax, dword [edi + 0x49]
inc ecx
add esp, 4
call 0x1000535b
add byte [ecx + 0x44], al
inc esp
cmp edi, dword [ebx]
inc esi
inc esi
add esp, 4
pop eax
mov edx, dword fs:[0x18]
mov dword [ebp - 0x2688], edx
mov eax, dword [ebp - 0x2688]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x268c], ecx
mov edx, dword [ebp - 0x268c]
mov dword [ebp - 0x18ec], edx
push esi
push edx
add esp, 4
xor esi, 0xb270
pop esi
push edi
push ebx
add esp, 4
add edi, 0x11f8f
xor edi, 0x1248f
xor edi, 0x13d8e
pop edi
push edi
xor edi, 0xf64
or edi, 0x8e51
pop edi
cmp dword [ebp - 0x18ec], 0
jne 0x100053d1
mov dword [ebp - 0x398], 0
jmp 0x1000568d
invalid
mov eax, dword [ebp - 0x18ec]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xe98], edx
push eax
push ecx
add esp, 4
or eax, 0x83af
pop eax
push ecx
push esi
add esp, 4
xor ecx, 0x9855
add ecx, 0x1135c
xor ecx, 0x17357
xor ecx, 0x4984
pop ecx
push esi
jmp 0x10005414
pop esi
cmp dword [ebp - 0xe98], 0
jne 0x1000542d
mov dword [ebp - 0x398], 0
jmp 0x1000568d
mov eax, dword [ebp - 0xe98]
mov dword [ebp - 0x5c4], eax
push ecx
add ecx, 0x10e55
xor ecx, 0x80f3
and ecx, 0x7015
pop ecx
push ecx
push ecx
add esp, 4
sub ecx, 0x10fd0
add ecx, 0x12c8f
pop ecx
push ebx
push eax
add esp, 4
sub ebx, 0x7636
pop ebx
lea ecx, [ebp - 0x1a68]
mov dword [ebp - 0xe94], ecx
mov edx, dword [ebp - 0x5c4]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xe90], eax
xor ecx, ecx
mov word [ebp - 0x264], cx
xor edx, edx
mov word [ebp - 0x138], dx
push ebx
sub ebx, 0x15eed
pop ebx
push ecx
push eax
add esp, 4
xor ecx, 0x17220
jmp 0x100054b4
and ecx, 0xcdd2
call 0x100054c6
add byte [eax + ecx*2 + 0x44], cl
inc ecx
inc esp
cmp eax, dword [ebx - 0x74a6fb3c]
test dword [eax - 0xf], esi
invalid
push esi
push ecx
add esp, 4
sub esi, 0x7271
add esi, 0x10198
call 0x100056ae
add byte [edx], bh
xor al, 0x40
xor cl, byte [edx + esi + 0x4a]
dec edi
add esp, 4
xor esi, 0x16d22
pop esi
push edi
jmp 0x100056be
pop edi
cmp dword [ebp - 0x398], 0
jne 0x10005fd8
mov edx, 0x6b
mov word [ebp - 0x1ac8], dx
mov eax, 0x65
mov word [ebp - 0x1ac6], ax
mov ecx, 0x72
mov word [ebp - 0x1ac4], cx

Function at 0x1000560d
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
and ecx, 0x13ef9
pop ecx
mov eax, dword [ebp - 0x5c4]
mov dword [ebp - 0x398], eax
jmp 0x1000568d
Function at 0x100056ae
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [eax + 0x43], al
xor al, 0x4b
inc esi
cmp eax, dword [edi + 0x49]
inc ecx
add esp, 4
call 0x1000535b
add byte [ecx + 0x44], al
inc esp
cmp edi, dword [ebx]
inc esi
inc esi
add esp, 4
pop eax
mov edx, dword fs:[0x18]
mov dword [ebp - 0x2688], edx
mov eax, dword [ebp - 0x2688]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x268c], ecx
mov edx, dword [ebp - 0x268c]
mov dword [ebp - 0x18ec], edx
push esi
push edx
add esp, 4
xor esi, 0xb270
pop esi
push edi
push ebx
add esp, 4
add edi, 0x11f8f
xor edi, 0x1248f
xor edi, 0x13d8e
pop edi
push edi
xor edi, 0xf64
or edi, 0x8e51
pop edi
cmp dword [ebp - 0x18ec], 0
jne 0x100053d1
mov dword [ebp - 0x398], 0
jmp 0x1000568d
invalid
mov eax, dword [ebp - 0x18ec]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xe98], edx
push eax
push ecx
add esp, 4
or eax, 0x83af
pop eax
push ecx
push esi
add esp, 4
xor ecx, 0x9855
add ecx, 0x1135c
xor ecx, 0x17357
xor ecx, 0x4984
pop ecx
push esi
jmp 0x10005414
pop esi
cmp dword [ebp - 0xe98], 0
jne 0x1000542d
mov dword [ebp - 0x398], 0
jmp 0x1000568d
mov eax, dword [ebp - 0xe98]
mov dword [ebp - 0x5c4], eax
push ecx
add ecx, 0x10e55
xor ecx, 0x80f3
and ecx, 0x7015
pop ecx
push ecx
push ecx
add esp, 4
sub ecx, 0x10fd0
add ecx, 0x12c8f
pop ecx
push ebx
push eax
add esp, 4
sub ebx, 0x7636
pop ebx
lea ecx, [ebp - 0x1a68]
mov dword [ebp - 0xe94], ecx
mov edx, dword [ebp - 0x5c4]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xe90], eax
xor ecx, ecx
mov word [ebp - 0x264], cx
xor edx, edx
mov word [ebp - 0x138], dx
push ebx
sub ebx, 0x15eed
pop ebx
push ecx
push eax
add esp, 4
xor ecx, 0x17220
jmp 0x100054b4
and ecx, 0xcdd2
call 0x100054c6
add byte [eax + ecx*2 + 0x44], cl
inc ecx
inc esp
cmp eax, dword [ebx - 0x74a6fb3c]
test dword [eax - 0xf], esi
invalid
push esi
push ecx
add esp, 4
sub esi, 0x7271
add esi, 0x10198
call 0x100056ae
add byte [edx], bh
xor al, 0x40
xor cl, byte [edx + esi + 0x4a]
dec edi
add esp, 4
xor esi, 0x16d22
pop esi
push edi
jmp 0x100056be
pop edi
cmp dword [ebp - 0x398], 0
jne 0x10005fd8
mov edx, 0x6b
mov word [ebp - 0x1ac8], dx
mov eax, 0x65
mov word [ebp - 0x1ac6], ax
mov ecx, 0x72
mov word [ebp - 0x1ac4], cx

Function at 0x100056f0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, 0x6e
mov word [ebp - 0x1ac2], dx
mov eax, 0x65
mov word [ebp - 0x1ac0], ax
mov ecx, 0x6c
mov word [ebp - 0x1abe], cx
mov edx, 0x33
mov word [ebp - 0x1abc], dx
mov eax, 0x32
mov word [ebp - 0x1aba], ax
mov ecx, 0x2e
mov word [ebp - 0x1ab8], cx
mov edx, 0x64
mov word [ebp - 0x1ab6], dx
mov eax, 0x6c
mov word [ebp - 0x1ab4], ax
mov ecx, 0x6c
mov word [ebp - 0x1ab2], cx
xor edx, edx
mov word [ebp - 0x1ab0], dx
push ecx
push esi
add esp, 4
call 0x10005777
add byte [esi], dh
dec edx
dec esi
inc esp
inc eax
dec ebx
inc ebx
add esp, 4
xor ecx, 0x14a7
or ecx, 0xf43c
call 0x10005793
add byte [eax], bh
dec eax
inc esp
dec ebx
dec ebp
inc ebp
add esp, 4
pop ecx
mov byte [ebp - 0xb0c], 0x4c
invalid
invalid
Function at 0x10005777
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, 0x6e
mov word [ebp - 0x1ac2], dx
mov eax, 0x65
mov word [ebp - 0x1ac0], ax
mov ecx, 0x6c
mov word [ebp - 0x1abe], cx
mov edx, 0x33
mov word [ebp - 0x1abc], dx
mov eax, 0x32
mov word [ebp - 0x1aba], ax
mov ecx, 0x2e
mov word [ebp - 0x1ab8], cx
mov edx, 0x64
mov word [ebp - 0x1ab6], dx
mov eax, 0x6c
mov word [ebp - 0x1ab4], ax
mov ecx, 0x6c
mov word [ebp - 0x1ab2], cx
xor edx, edx
mov word [ebp - 0x1ab0], dx
push ecx
push esi
add esp, 4
call 0x10005777
add byte [esi], dh
dec edx
dec esi
inc esp
inc eax
dec ebx
inc ebx
add esp, 4
xor ecx, 0x14a7
or ecx, 0xf43c
call 0x10005793
add byte [eax], bh
dec eax
inc esp
dec ebx
dec ebp
inc ebp
add esp, 4
pop ecx
mov byte [ebp - 0xb0c], 0x4c
invalid
invalid

Function at 0x10005793
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, 0x6e
mov word [ebp - 0x1ac2], dx
mov eax, 0x65
mov word [ebp - 0x1ac0], ax
mov ecx, 0x6c
mov word [ebp - 0x1abe], cx
mov edx, 0x33
mov word [ebp - 0x1abc], dx
mov eax, 0x32
mov word [ebp - 0x1aba], ax
mov ecx, 0x2e
mov word [ebp - 0x1ab8], cx
mov edx, 0x64
mov word [ebp - 0x1ab6], dx
mov eax, 0x6c
mov word [ebp - 0x1ab4], ax
mov ecx, 0x6c
mov word [ebp - 0x1ab2], cx
xor edx, edx
mov word [ebp - 0x1ab0], dx
push ecx
push esi
add esp, 4
call 0x10005777
add byte [esi], dh
dec edx
dec esi
inc esp
inc eax
dec ebx
inc ebx
add esp, 4
xor ecx, 0x14a7
or ecx, 0xf43c
call 0x10005793
add byte [eax], bh
dec eax
inc esp
dec ebx
dec ebp
inc ebp
add esp, 4
pop ecx
mov byte [ebp - 0xb0c], 0x4c
invalid
invalid
Function at 0x100059e4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
jmp 0x10005932
jmp 0x10005939
or edi, 0x9545
pop edi
push ecx
xor ecx, 0xedec
jmp 0x10005950
jmp 0x10005955
sub ecx, 0xdb74
pop ecx
mov ecx, dword [ebp - 0xe9c]
mov dx, word [ecx]
mov word [ebp - 0x12b2], dx
mov eax, dword [ebp - 0xe9c]
add eax, 2
mov dword [ebp - 0xe9c], eax
mov cx, word [ebp - 0x12b2]
mov word [ebp - 0x268], cx
mov edx, dword [ebp - 0xea0]
mov ax, word [edx]
mov word [ebp - 0x12b4], ax
mov ecx, dword [ebp - 0xea0]
add ecx, 2
mov dword [ebp - 0xea0], ecx
mov dx, word [ebp - 0x12b4]
mov word [ebp - 0x13c], dx
push ebx
push edx
add esp, 4
and ebx, 0xdb27
jmp 0x100059c8
or ebx, 0x13bf1
xor ebx, 0x12107
pop ebx
push ecx
call fcn.100059e4
add byte [0x334c4746], bh
inc ecx
inc ebx
inc ebp
add esp, 4
pop ecx
movzx eax, word [ebp - 0x13c]
test eax, eax
jne 0x10005a0b
movzx ecx, word [ebp - 0x268]
movzx edx, word [ebp - 0x13c]
sub ecx, edx
mov dword [ebp - 0x1900], ecx
jmp 0x10005a6e
movzx eax, word [ebp - 0x268]
movzx ecx, word [ebp - 0x13c]
cmp eax, ecx
je 0x1000592a
movzx edx, word [ebp - 0x268]
xor edx, 0x20
movzx eax, word [ebp - 0x13c]
cmp edx, eax
je 0x1000592a
movzx ecx, word [ebp - 0x268]
movzx edx, word [ebp - 0x13c]
cmp ecx, edx
jge 0x10005a58
mov dword [ebp - 0x18fc], 0xffffffff
jmp 0x10005a62
mov dword [ebp - 0x18fc], 1
mov eax, dword [ebp - 0x18fc]
mov dword [ebp - 0x1900], eax
cmp dword [ebp - 0x1900], 0
jne 0x10005ab7
push edx
push eax
add esp, 4
and edx, 0x45d6
pop edx
push esi
sub esi, 0x4914
xor esi, 0x242e
pop esi
push edi
push ebx
add esp, 4
sub edi, 0x16c25
or edi, 0x17ca0
and edi, 0x88e4
pop edi
mov ecx, dword [ebp - 0x5c8]
mov dword [ebp - 0x870], ecx
jmp 0x10005b1f
push edi
push ebx
add esp, 4
or edi, 0xa054
pop edi
push eax
call 0x10005ad3
add byte [eax + edx*2 + 0x44], cl
push eax
dec ebp
inc edx
cmp dword [ebp + 0x49], ecx
add esp, 4
and eax, 0xba2c
add eax, 0x152ad
xor eax, 0x12e69
pop eax
mov edx, dword [ebp - 0x5c8]
mov eax, dword [edx]
mov dword [ebp - 0x5c8], eax
mov ecx, dword [ebp - 0x5c8]
cmp ecx, dword [ebp - 0xea4]
je 0x10005b15
mov edx, dword [ebp - 0x5c8]
cmp dword [edx + 0x30], 0
jne 0x100058cb
mov dword [ebp - 0x870], 0
Function at 0x10005ad3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
jmp 0x10005932
jmp 0x10005939
or edi, 0x9545
pop edi
push ecx
xor ecx, 0xedec
jmp 0x10005950
jmp 0x10005955
sub ecx, 0xdb74
pop ecx
mov ecx, dword [ebp - 0xe9c]
mov dx, word [ecx]
mov word [ebp - 0x12b2], dx
mov eax, dword [ebp - 0xe9c]
add eax, 2
mov dword [ebp - 0xe9c], eax
mov cx, word [ebp - 0x12b2]
mov word [ebp - 0x268], cx
mov edx, dword [ebp - 0xea0]
mov ax, word [edx]
mov word [ebp - 0x12b4], ax
mov ecx, dword [ebp - 0xea0]
add ecx, 2
mov dword [ebp - 0xea0], ecx
mov dx, word [ebp - 0x12b4]
mov word [ebp - 0x13c], dx
push ebx
push edx
add esp, 4
and ebx, 0xdb27
jmp 0x100059c8
or ebx, 0x13bf1
xor ebx, 0x12107
pop ebx
push ecx
call fcn.100059e4
add byte [0x334c4746], bh
inc ecx
inc ebx
inc ebp
add esp, 4
pop ecx
movzx eax, word [ebp - 0x13c]
test eax, eax
jne 0x10005a0b
movzx ecx, word [ebp - 0x268]
movzx edx, word [ebp - 0x13c]
sub ecx, edx
mov dword [ebp - 0x1900], ecx
jmp 0x10005a6e
movzx eax, word [ebp - 0x268]
movzx ecx, word [ebp - 0x13c]
cmp eax, ecx
je 0x1000592a
movzx edx, word [ebp - 0x268]
xor edx, 0x20
movzx eax, word [ebp - 0x13c]
cmp edx, eax
je 0x1000592a
movzx ecx, word [ebp - 0x268]
movzx edx, word [ebp - 0x13c]
cmp ecx, edx
jge 0x10005a58
mov dword [ebp - 0x18fc], 0xffffffff
jmp 0x10005a62
mov dword [ebp - 0x18fc], 1
mov eax, dword [ebp - 0x18fc]
mov dword [ebp - 0x1900], eax
cmp dword [ebp - 0x1900], 0
jne 0x10005ab7
push edx
push eax
add esp, 4
and edx, 0x45d6
pop edx
push esi
sub esi, 0x4914
xor esi, 0x242e
pop esi
push edi
push ebx
add esp, 4
sub edi, 0x16c25
or edi, 0x17ca0
and edi, 0x88e4
pop edi
mov ecx, dword [ebp - 0x5c8]
mov dword [ebp - 0x870], ecx
jmp 0x10005b1f
push edi
push ebx
add esp, 4
or edi, 0xa054
pop edi
push eax
call 0x10005ad3
add byte [eax + edx*2 + 0x44], cl
push eax
dec ebp
inc edx
cmp dword [ebp + 0x49], ecx
add esp, 4
and eax, 0xba2c
add eax, 0x152ad
xor eax, 0x12e69
pop eax
mov edx, dword [ebp - 0x5c8]
mov eax, dword [edx]
mov dword [ebp - 0x5c8], eax
mov ecx, dword [ebp - 0x5c8]
cmp ecx, dword [ebp - 0xea4]
je 0x10005b15
mov edx, dword [ebp - 0x5c8]
cmp dword [edx + 0x30], 0
jne 0x100058cb
mov dword [ebp - 0x870], 0
Function at 0x10005ff0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [ecx + 0x1a53ee], al
add al, ch
or al, byte [eax]
add byte [eax], al
Function at 0x1000673a
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor ecx, 0x2416
xor ecx, 0x2900
pop ecx
cmp dword [ebp - 0x494], 0
je 0x1000675c
cmp dword [ebp - 0xbfc], 0
jne 0x100067a2
push edx
sub edx, 0x13916
xor edx, 0xdb92
pop edx
push esi
push esi
add esp, 4
xor esi, 0xd4f3
sub esi, 0x15821
sub esi, 0xeecc
pop esi
push esi
push ecx
add esp, 4
and esi, 0x16e82
pop esi
mov edx, dword [ebp - 0x8bc]
mov dword [ebp - 0x1f44], edx
push 0
call dword [ebp - 0x1f44]
mov dword [ebp - 0x2780], 0xa
push ebx
push edx
add esp, 4
or ebx, 0x1035a
call 0x100067c6
add byte [ecx + 0x37], cl
cmp byte [ebp + 0x46], al
xor al, 0x3a
dec edx
inc ebx
add esp, 4
xor ebx, 0x8e8a
pop ebx
push esi
xor esi, 0x157c5
sub esi, 0x2ff3
pop esi
mov eax, dword [ebp - 0x494]
mov cl, byte [eax + 0xa]
mov byte [ebp - 0x446], cl
mov edx, dword [ebp - 0xbfc]
sub edx, dword [ebp - 0x494]
mov dword [ebp - 0x19a8], edx
mov dword [ebp - 0xee8], 0
push ecx
and ecx, 0x7c40

Function at 0x100067c6
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor ecx, 0x2416
xor ecx, 0x2900
pop ecx
cmp dword [ebp - 0x494], 0
je 0x1000675c
cmp dword [ebp - 0xbfc], 0
jne 0x100067a2
push edx
sub edx, 0x13916
xor edx, 0xdb92
pop edx
push esi
push esi
add esp, 4
xor esi, 0xd4f3
sub esi, 0x15821
sub esi, 0xeecc
pop esi
push esi
push ecx
add esp, 4
and esi, 0x16e82
pop esi
mov edx, dword [ebp - 0x8bc]
mov dword [ebp - 0x1f44], edx
push 0
call dword [ebp - 0x1f44]
mov dword [ebp - 0x2780], 0xa
push ebx
push edx
add esp, 4
or ebx, 0x1035a
call 0x100067c6
add byte [ecx + 0x37], cl
cmp byte [ebp + 0x46], al
xor al, 0x3a
dec edx
inc ebx
add esp, 4
xor ebx, 0x8e8a
pop ebx
push esi
xor esi, 0x157c5
sub esi, 0x2ff3
pop esi
mov eax, dword [ebp - 0x494]
mov cl, byte [eax + 0xa]
mov byte [ebp - 0x446], cl
mov edx, dword [ebp - 0xbfc]
sub edx, dword [ebp - 0x494]
mov dword [ebp - 0x19a8], edx
mov dword [ebp - 0xee8], 0
push ecx
and ecx, 0x7c40

Function at 0x10006810
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
sub ecx, 0xbb64
pop ecx
push edx
call 0x10006825
add byte [0x45423e41], dh
inc esp
inc eax
add esp, 4
call 0x10006837
add byte [edx], bh
dec ebp
cmp al, 0x41
inc ebp
dec edx
xor esi, dword [0x4c48343]
pop edx
mov byte [ebp - 0xb5c], 0x56
call dword [esi - 0x3a]
test dword [ebp + 0x69fffff4], esp
mov byte [ebp - 0xb5a], 0x72
mov byte [ebp - 0xb59], 0x74
mov byte [ebp - 0xb58], 0x75
mov byte [ebp - 0xb57], 0x61
mov byte [ebp - 0xb56], 0x6c
mov byte [ebp - 0xb55], 0x50
mov byte [ebp - 0xb54], 0x72
mov byte [ebp - 0xb53], 0x6f
mov byte [ebp - 0xb52], 0x74
mov byte [ebp - 0xb51], 0x65
mov byte [ebp - 0xb50], 0x63
mov byte [ebp - 0xb4f], 0x74
invalid
invalid
invalid