joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417310
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.QCYiaatN
lea edi, [esi - 0xe000]
mov dword [edi + 0xe6f8], 0x58b40b67
push edi
or ebp, 0xffffffff
jmp 0x41733a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x417341
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x417330
mov eax, 1
add ebx, ebx
jne 0x417353
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x417348
jne 0x417364
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x417348
xor ecx, ecx
sub eax, 3
jb 0x417378
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4173ea
mov ebp, eax
add ebx, ebx
jne 0x417383
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x417390
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4173b4
inc ecx
add ebx, ebx
jne 0x4173a0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x417395
jne 0x4173b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x417395
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4173d4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4173c5
jmp 0x417336
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4173d4
add edi, ecx
jmp 0x417336
pop esi
mov edi, esi
mov ecx, 0x446
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4173f2
cmp byte [edi], 5
jne 0x4173f2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4173f7
lea edi, [esi + 0x15000]
mov eax, dword [edi]
or eax, eax
je 0x417466
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x17704]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x17784]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x417424
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1778c]
or eax, eax
je 0x417460
mov dword [ebx], eax
add ebx, 4
jmp 0x417441
call dword [esi + 0x17788]
mov ebp, dword [esi + 0x17790]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41749a
sub esp, 0xffffff80
jmp 0x40d86c

Function at 0x401c2e
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
and byte [ebp - 0x100], 0
push edi
push 0x3f
xor eax, eax
pop ecx
lea edi, [ebp - 0xff]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 8
lea eax, [ebp - 0x100]
push 0x404008
push eax
call fcn.00401ca0
mov ecx, 0x401bdc
mov eax, 0x4017fd
sub ecx, eax
push ecx
push eax
lea eax, [ebp - 0x100]
push eax
call fcn.00401d18
push 0x100
lea eax, [ebp - 0x100]
push 0
push eax
call fcn.004020d0
add esp, 0x24
call fcn.00401846
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x401080
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x40600c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 8], 0
call fcn.004016c0
mov ebx, eax
test ebx, ebx
je 0x4010d8
lea eax, [ebp - 8]
mov ecx, 0x200
push eax
push 0x40
push 0x800
mov esi, 0x406028
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x4010d8
push 0xbb8
push ebx
call ebx
mov ecx, ebx
call fcn.00401820
push str.main_program_running.._n
call fcn.00401050
add esp, 4
jmp 0x401093
Function at 0x4016c0
Capabilities:
Access peb ldr_data
Get process heap flags
Hash data using djb2
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dl, 0x6e
push ebx
push esi
push edi
mov edi, 0x1505
mov esi, str.ntdll.dll
lea eax, [edx - 0x20]
cmp dl, 0x61
movzx ecx, al
lea esi, [esi + 1]
movzx eax, dl
mov dl, byte [esi]
cmovb ecx, eax
mov eax, edi
movzx ecx, cl
shl eax, 5
add edi, eax
add edi, ecx
test dl, dl
jne 0x4016d5
mov ebx, 0x1505
mov esi, str.RtlAllocateHeap
mov dl, 0x52
lea eax, [edx - 0x20]
cmp dl, 0x61
movzx ecx, al
lea esi, [esi + 1]
movzx eax, dl
mov dl, byte [esi]
cmovb ecx, eax
mov eax, ebx
movzx ecx, cl
shl eax, 5
add ebx, eax
add ebx, ecx
test dl, dl
jne 0x401705
mov eax, dword fs:[0x18]
xor ecx, ecx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ecx
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0xc
mov esi, dword [ebx]
cmp esi, ebx
je 0x401771
nop word [eax + eax]
movzx edx, word [esi + 0x2c]
mov ecx, dword [esi + 0x30]
call fcn.00401d30
cmp eax, edi
jne 0x401768
mov ecx, dword [esi + 0x18]
mov dword [ebp - 4], ecx
jmp 0x40176b
mov ecx, dword [ebp - 4]
mov esi, dword [esi]
cmp esi, ebx
jne 0x401750
mov eax, dword [ecx + 0x3c]
xor edi, edi
mov eax, dword [eax + ecx + 0x78]
add eax, ecx
je 0x4017ea
mov ebx, dword [eax + 0x1c]
mov edx, dword [eax + 0x20]
add ebx, ecx
mov dword [ebp - 0x18], ebx
add edx, ecx
mov ebx, dword [eax + 0x24]
mov eax, dword [eax + 0x18]
add ebx, ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], eax
test eax, eax
je 0x4017ea
mov eax, dword [ebp - 8]
mov edx, dword [edx + edi*4]
mov esi, 0x1505
add edx, ecx
mov bl, byte [edx]
test bl, bl
je 0x4017dd
lea eax, [ebx - 0x20]
cmp bl, 0x61
movzx ecx, al
lea edx, [edx + 1]
movzx eax, bl
mov bl, byte [edx]
cmovb ecx, eax
mov eax, esi
movzx ecx, cl
shl eax, 5
add esi, eax
add esi, ecx
test bl, bl
jne 0x4017b3
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 8]
cmp esi, eax
je 0x4017f3
mov edx, dword [ebp - 0x10]
inc edi
cmp edi, dword [ebp - 0xc]
jb 0x4017a3
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
movzx eax, word [eax + edi*2]
mov edx, dword [edx + eax*4]
add edx, ecx
je 0x4017ea
mov eax, dword fs:[0x18]
push 0x800
push 8
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401d30
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov ecx, 0x1505
xor edi, edi
mov dword [ebp - 4], ecx
mov al, byte [esi]
test ebx, ebx
jne 0x401d6f
test al, al
je 0x401d7b
lea ecx, [eax - 0x20]
cmp al, 0x61
movzx edx, cl
movzx ecx, al
mov eax, dword [ebp - 4]
cmovb edx, ecx
shl eax, 5
inc esi
add eax, dword [ebp - 4]
movzx ecx, dl
add ecx, eax
inc edi
jmp 0x401d42
cmp edi, ebx
jae 0x401d7b
test al, al
jne 0x401d4f
inc esi
inc edi
jmp 0x401d45
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401ed7
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x40600c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
mov esi, ecx
push edi
push 4
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x401fd9
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x401fd2
inc edi
cmp dword [ebp - 0x20], 0x10
jb 0x401f96
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x14], eax
jne 0x401f96
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x401f96
mov edx, dword [esi]
test edx, edx
jne 0x401f62
push 0x200
push edx
push dword [0x406e24]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x401fbb
jmp 0x401f8a
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
jb 0x401f8a
add eax, eax
mov dword [esi + 4], eax
shl eax, 2
push eax
push edx
push 0
push dword [0x406e24]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x401fbb
mov dword [esi], edx
mov ecx, dword [esi + 8]
mov eax, dword [ebp - 0x18]
mov dword [edx + ecx*4], eax
inc dword [esi + 8]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x401f1d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x401fd2
xor edi, edi
cmp dword [esi], edi
je 0x401fd2
push dword [esi]
push edi
push dword [0x406e24]
call dword [sym.imp.KERNEL32.dll_HeapFree]
and dword [esi], edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004021c3
leave
ret
Function at 0x401fea
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
xor esi, esi
mov dword [edi], esi
mov dword [edi + 4], esi
mov dword [edi + 8], esi
call fcn.00401ed7
test eax, eax
jne 0x40200e
push 9
pop esi
jmp 0x402055
cmp dword [edi], esi
je 0x402055
push ebx
mov ebx, esi
cmp dword [edi + 8], esi
jbe 0x402054
mov eax, dword [edi]
push dword [eax + ebx*4]
push esi
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [ebp - 4], eax
test eax, eax
je 0x40204e
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [ebp + 8]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
call fcn.00401d84
pop ecx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, dword [edi + 8]
jb 0x40201a
pop ebx
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x40205b
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
test eax, eax
je 0x4020a9
push edi
xor edi, edi
cmp dword [esi + 8], edi
jbe 0x402099
push ebx
mov eax, dword [esi]
push dword [eax + edi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x402090
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [esi + 8]
jb 0x40206d
mov eax, dword [esi]
pop ebx
push eax
push 0
push dword [0x406e24]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
ret

Function at 0x4020ab
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
imul esi, ecx, 0x2c
push edi
add esi, dword [0x406e60]
mov dword [ebp - 8], esi
mov al, byte [esi + 0x14]
mov ebx, dword [esi]
and al, 1
je 0x4020cc
sub ebx, 5
movzx eax, al
lea edi, [eax*2 + 5]
lea eax, [ebp - 4]
mov dword [ebp - 0xc], edi
push eax
push 0x40
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x4020f0
push 0xa
pop eax
jmp 0x402136
test byte [esi + 0x14], 1
je 0x402107
lea esi, [esi + 0xc]
mov edi, ebx
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 0xc]
jmp 0x402112
mov eax, dword [esi + 0xc]
mov dword [ebx], eax
mov al, byte [esi + 0x10]
mov byte [ebx + 4], al
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
and byte [esi + 0x14], 0xf9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401afe
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov esi, dword [edx + 0x28]
xor edi, edi
dec dword [edi]
mov bh, 0x4a
invalid
dec dword [edi]
mov bh, 0x4a
xor eax, eax
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x401b0c
sub al, 0x20
ror edi, 0xd
add edi, eax
dec ecx
jne 0x401b03
push edx
push edi
mov edx, dword [edx + 0x10]
mov eax, dword [edx + 0x3c]
add eax, edx
mov eax, dword [eax + 0x78]
test eax, eax
je 0x401b71
add eax, edx
mov ebx, dword [eax + 0x20]
mov ecx, dword [eax + 0x18]
push eax
add ebx, edx
test ecx, ecx
je 0x401b70
dec ecx
xor edi, edi
mov esi, dword [ebx + ecx*4]
add esi, edx
xor eax, eax
lodsb al, byte [esi]
ror edi, 0xd
add edi, eax
cmp al, ah
jne 0x401b3c
add edi, dword [ebp - 8]
cmp edi, dword [ebp + 0x24]
jne 0x401b30
pop eax
mov ebx, dword [eax + 0x24]
add ebx, edx
mov cx, word [ebx + ecx*2]
mov ebx, dword [eax + 0x1c]
add ebx, edx
mov eax, dword [ebx + ecx*4]
add eax, edx
mov dword [esp + 0x24], eax
pop ebx
pop ebx
popal
pop ecx
pop edx
push ecx
jmp eax
pop eax
pop edi
pop edx
mov edx, dword [edx]
jmp 0x401afa
Function at 0x402706
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
push esi
imul eax, eax, 0x61c88647
mov esi, dword [esp + 0xc]
test eax, eax
mov edx, dword [esi]
mov ecx, dword [esi + 4]
je 0x40276e
mov esi, dword [esp + 8]
push ebx
push edi
mov edi, edx
mov ebx, edx
sar edi, 5
shl ebx, 4
xor edi, ebx
mov ebx, eax
sar ebx, 0xb
and ebx, 3
add edi, dword [esi + ebx*4]
mov ebx, eax
xor ebx, edx
add eax, 0x61c88647
add edi, ebx
sub ecx, edi
mov edi, ecx
mov ebx, ecx
sar edi, 5
shl ebx, 4
xor edi, ebx
mov ebx, eax
and ebx, 3
add edi, dword [esi + ebx*4]
mov ebx, eax
xor ebx, ecx
add edi, ebx
sub edx, edi
test eax, eax
jne 0x402724
mov esi, dword [esp + 0x14]
pop edi
pop ebx
mov dword [esi], edx
mov dword [esi + 4], ecx
pop esi
ret

Function at 0x40da10
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xb000]
push edi
or ebp, 0xffffffff
jmp 0x40da32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40da39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40da28
mov eax, 1
add ebx, ebx
jne 0x40da4b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40da40
jne 0x40da5c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40da40
xor ecx, ecx
sub eax, 3
jb 0x40da70
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40dae2
mov ebp, eax
add ebx, ebx
jne 0x40da7b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40da88
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40daac
inc ecx
add ebx, ebx
jne 0x40da98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40da8d
jne 0x40daa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40da8d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40dacc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40dabd
jmp 0x40da2e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40dacc
add edi, ecx
jmp 0x40da2e
pop esi
lea edi, [esi + 0xb000]
mov eax, dword [edi]
or eax, eax
je 0x40db2b
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xd000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xd064]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40dae9
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xd068]
or eax, eax
je 0x40db25
mov dword [ebx], eax
add ebx, 4
jmp 0x40db06
call dword [esi + 0xd078]
mov ebp, dword [esi + 0xd06c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40db5f
sub esp, 0xffffff80
jmp 0x40b1e6
Function at 0x1000906f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10026618]
jne 0x10009079
repz ret
jmp fcn.1000d1fb

Function at 0x1000f57f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1000910a
and dword [ebp - 4], 0
cmp dword [0x10028264], 0
mov ebx, eax
jne 0x1000f630
push 0x1001be60
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1000f6e1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1001be54
push edi
call esi
test eax, eax
je 0x1000f6e1
push eax
call fcn.10009098
mov dword [esp], 0x1001be44
push edi
mov dword [0x10028264], eax
call esi
push eax
call fcn.10009098
mov dword [esp], 0x1001be30
push edi
mov dword [0x10028268], eax
call esi
push eax
call fcn.10009098
mov dword [esp], 0x1001be14
push edi
mov dword [0x1002826c], eax
call esi
push eax
call fcn.10009098
pop ecx
mov dword [0x10028274], eax
test eax, eax
je 0x1000f630
push 0x1001bdfc
push edi
call esi
push eax
call fcn.10009098
pop ecx
mov dword [0x10028270], eax
mov eax, dword [0x10028270]
cmp eax, ebx
je 0x1000f688
cmp dword [0x10028274], ebx
je 0x1000f688
push eax
call fcn.10009113
push dword [0x10028274]
mov esi, eax
call fcn.10009113
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1000f688
test edi, edi
je 0x1000f688
call esi
test eax, eax
je 0x1000f67f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1000f67f
test byte [ebp - 0xc], 1
jne 0x1000f688
or dword [ebp + 0x10], 0x200000
jmp 0x1000f6c1
mov eax, dword [0x10028268]
cmp eax, ebx
je 0x1000f6c1
push eax
call fcn.10009113
pop ecx
test eax, eax
je 0x1000f6c1
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1000f6c1
mov eax, dword [0x1002826c]
cmp eax, ebx
je 0x1000f6c1
push eax
call fcn.10009113
pop ecx
test eax, eax
je 0x1000f6c1
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10028264]
call fcn.10009113
pop ecx
test eax, eax
je 0x1000f6e1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1000f6e3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10019a84
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [0x100260a0], 0x1e87
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
mov ecx, eax
add ecx, 1
mov dl, byte [eax + 0x1001b56a]
mov dh, byte [eax + 0x1001b53b]
sub dh, dl
mov byte [ebp + eax - 0x24], dh
cmp ecx, 0xe
mov dword [ebp - 0x30], ecx
jne 0x10019aa6
lea eax, [ebp - 0x24]
mov dword [0x100260a0], 0x1579
mov dword [ebp - 0x34], eax
call fcn.10019f3e
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
call fcn.10019944
mov ecx, dword [0x100260a0]
add ecx, 0xffffe209
mov dword [0x100260a0], ecx
cmp eax, 0
mov dword [ebp - 0x38], eax
je 0x10019bce
mov eax, dword [ebp - 0x38]
mov dword [0x100260a4], 0x2144
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x3c], eax
call fcn.1001a0dc
xor eax, eax
mov ecx, dword [ebp - 0x3c]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [0x100260a4], 0xfffff8da
mov dword [ecx + 0xd0], 0x4550
mov dword [0x100260a0], 0xfffff0f0
add ecx, 0xffc00000
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x30], ecx
mov ecx, dword [ebp - 0x3c]
mov dword [edx + 0xc], ecx
mov esi, dword [0x100260a0]
add esi, 0x1007
mov dword [0x100260a0], esi
add ecx, 0x2098
mov esi, dword [ebp - 0x3c]
cmp esi, 0
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], eax
je 0x10019bc5
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
add esp, 0x50
pop esi
pop ebp
ret
xor eax, eax
add esp, 0x50
pop esi
pop ebp
ret
Function at 0x1001a1dc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x44
mov eax, dword [ebp + 8]
mov ecx, dword [0x100260a0]
add ecx, 0xffffeadb
mov dword [0x100260a4], ecx
mov dword [ebp - 0x10], eax
call fcn.1001aaa3
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov edi, edx
add edi, esi
mov esi, dword [eax + esi]
cmp esi, 0x4550
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edi
je 0x1001a22a
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x78]
mov dword [0x100260a0], 0x1e82
mov dword [0x100260a4], 0xfffff9ef
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add ecx, dword [edx + eax + 0x20]
mov esi, dword [edx + eax + 0x18]
cmp esi, 0
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], edi
je 0x1001a337
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x24]
add ecx, dword [ecx + edx + 0x24]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
xor edx, edx
mov esi, dword [ebp - 0x28]
mov edi, dword [esi + ecx*4]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x48]
mov ecx, eax
mov edx, dword [ebp - 0x44]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x4d], bh
mov byte [ebp - 0x4e], cl
je 0x1001a2eb
mov al, byte [ebp - 0x4d]
cmp al, 0
setne cl
mov edx, dword [ebp - 0x4c]
add edx, 1
mov ah, byte [ebp - 0x4e]
and ah, cl
cmp edx, 0x20
setb cl
and ah, cl
test ah, 1
mov dword [ebp - 0x48], edx
jne 0x1001a299
mov al, byte [ebp - 0x4e]
test al, 1
jne 0x1001a31e
jmp 0x1001a2f4
xor eax, eax
mov ecx, dword [ebp - 0x40]
add ecx, 1
mov edx, dword [ebp - 0x3c]
add edx, 2
mov esi, dword [ebp - 0x2c]
cmp ecx, esi
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], eax
jb 0x1001a27f
jmp 0x1001a337
mov eax, dword [ebp - 0x3c]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x24]
add edx, dword [edx + esi + 0x1c]
mov edi, dword [ebp - 0x1c]
add edi, dword [edx + ecx*4]
mov dword [ebp - 0x30], edi
mov eax, dword [ebp - 0x30]
add esp, 0x44
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1001a342
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x20
mov dword [ebp - 8], 0
mov dword [0x100260a4], 0x425
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov esi, dword [0x100260a4]
add esi, 0x1910
mov dword [0x100260a4], esi
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], ecx
jmp 0x1001a39f
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x16], 0x61
je 0x1001a3f9
jmp 0x1001a447
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], edx
je 0x1001a3cc
mov eax, dword [ebp - 0x1c]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x20], eax
jl 0x1001a39f
mov eax, dword [ebp - 0x20]
mov dword [0x100260a4], 0x114c
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x18], eax
jne 0x1001a447
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x18], 0x6f
je 0x1001a38b
jmp 0x1001a447
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x14], 0x64
jne 0x1001a447
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x12], 0x64
jne 0x1001a447
mov dword [0x100260a0], 0x1a68
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x1001a447
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x24], eax
je 0x1001a456
xor eax, eax
mov dword [0x100260a0], 0xffffeb02
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
add esp, 0x20
pop esi
pop ebp
ret