joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1c8f250
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x1d12014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0x1c67c10
lea eax, [ebp - 0x14]
push 0
push eax
push 0x1c67ac0
push 0x1d40260
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x1c8f2ca
xor esi, esi
cmp dword [0x1d40264], 0
jne 0x1c8f2b6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push dword [0x1d40268]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
je 0x1c8f2b6
mov eax, dword [ebp + 8]
mov esi, dword [edi + eax*4]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c92fe3
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.01ca5ba0
int3

Function at 0x1c8f700
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
test ecx, ecx
je 0x1c8f738
mov edx, dword [ebp + 0xc]
xor esi, esi
nop word cs:[eax + eax]
movzx edi, al
movzx ebx, byte [edx + esi]
xor ebx, edi
shr eax, 8
xor eax, dword [ebx*4 + 0x1d0b958]
inc esi
cmp ecx, esi
jne 0x1c8f720
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1c9ab27
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push edi
sub edi, 0x110d3
and edi, 0x75ff
pop edi
imul edx, dword [ebp - 0x18], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x18], 0xfe
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x18]
imul ecx, dword [ebp - 0x18], 0xfe
sub edx, ecx
mov dword [ebp - 0x1c], edx
push edi
xor edi, 0x10a98
or edi, 0x1380c
call 0x1c9ab7b
add byte [edi + 0x46], cl
xor al, 0x4d
inc ecx
dec ebx
inc edi
add esp, 4
pop edi
push eax
and eax, 0x163a8
add eax, 0x17a4d
sub eax, 0x5386
pop eax
push esi
push edi
add esp, 4
call 0x1c9aba7
add byte [ecx], bh
xor eax, dword [esi + 0x37]
dec eax
aas
xor eax, 0xc4833237
add al, 0x81
invalid

Function at 0x1c9ab7b
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push edi
sub edi, 0x110d3
and edi, 0x75ff
pop edi
imul edx, dword [ebp - 0x18], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x18], 0xfe
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x18]
imul ecx, dword [ebp - 0x18], 0xfe
sub edx, ecx
mov dword [ebp - 0x1c], edx
push edi
xor edi, 0x10a98
or edi, 0x1380c
call 0x1c9ab7b
add byte [edi + 0x46], cl
xor al, 0x4d
inc ecx
dec ebx
inc edi
add esp, 4
pop edi
push eax
and eax, 0x163a8
add eax, 0x17a4d
sub eax, 0x5386
pop eax
push esi
push edi
add esp, 4
call 0x1c9aba7
add byte [ecx], bh
xor eax, dword [esi + 0x37]
dec eax
aas
xor eax, 0xc4833237
add al, 0x81
invalid
Function at 0x1c9aba7
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push edi
sub edi, 0x110d3
and edi, 0x75ff
pop edi
imul edx, dword [ebp - 0x18], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x18], 0xfe
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x18]
imul ecx, dword [ebp - 0x18], 0xfe
sub edx, ecx
mov dword [ebp - 0x1c], edx
push edi
xor edi, 0x10a98
or edi, 0x1380c
call 0x1c9ab7b
add byte [edi + 0x46], cl
xor al, 0x4d
inc ecx
dec ebx
inc edi
add esp, 4
pop edi
push eax
and eax, 0x163a8
add eax, 0x17a4d
sub eax, 0x5386
pop eax
push esi
push edi
add esp, 4
call 0x1c9aba7
add byte [ecx], bh
xor eax, dword [esi + 0x37]
dec eax
aas
xor eax, 0xc4833237
add al, 0x81
invalid
Function at 0x1c9e443
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edx
push ebx
push edx
add esp, 4
xor ebx, 0x15823
pop ebx
mov edx, dword [ebp - 0xe80]
sub edx, 1
mov dword [ebp - 0xe80], edx
mov eax, dword [ebp - 0xc0c]
add eax, 1
mov dword [ebp - 0xc0c], eax
mov ecx, dword [ebp - 0xc08]
add ecx, 1
mov dword [ebp - 0xc08], ecx
jmp 0x1c9e360
Function at 0x1c9e5ad
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ecx
push eax
or eax, 0xc3bb
or eax, 0x15f2d
jmp 0x1c9e5c5
pop eax
mov dword [ebp - 0x277c], 0xffffffff
push edi
or edi, 0x431d
and edi, 0x13eb0
and edi, 0x2ec2
pop edi
push edx
push ebx
add esp, 4
call 0x1c9e5f8
add byte [esi + 0x4b], al
inc eax
aas
cmp al, 0x4b
aas
cmp eax, 0x4c48339
add edx, 0x121fb
pop edx
mov ecx, dword [ebp - 0x488]
mov dword [ebp - 0x5c0], ecx
jmp 0x1c9e61f
push ebx
add ebx, 0x10ff7
or ebx, 0x1436f
pop ebx
push ebx
jmp 0x1c9e635
call 0x1c9e641
add byte [edx + 0x35], cl
cmp al, 0x4d
xor esi, dword [ebx + eax*4]
les eax, [ecx + eax*4]
retf

Function at 0x1c9e5f8
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ecx
push eax
or eax, 0xc3bb
or eax, 0x15f2d
jmp 0x1c9e5c5
pop eax
mov dword [ebp - 0x277c], 0xffffffff
push edi
or edi, 0x431d
and edi, 0x13eb0
and edi, 0x2ec2
pop edi
push edx
push ebx
add esp, 4
call 0x1c9e5f8
add byte [esi + 0x4b], al
inc eax
aas
cmp al, 0x4b
aas
cmp eax, 0x4c48339
add edx, 0x121fb
pop edx
mov ecx, dword [ebp - 0x488]
mov dword [ebp - 0x5c0], ecx
jmp 0x1c9e61f
push ebx
add ebx, 0x10ff7
or ebx, 0x1436f
pop ebx
push ebx
jmp 0x1c9e635
call 0x1c9e641
add byte [edx + 0x35], cl
cmp al, 0x4d
xor esi, dword [ebx + eax*4]
les eax, [ecx + eax*4]
retf

Function at 0x1c9e641
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ecx
push eax
or eax, 0xc3bb
or eax, 0x15f2d
jmp 0x1c9e5c5
pop eax
mov dword [ebp - 0x277c], 0xffffffff
push edi
or edi, 0x431d
and edi, 0x13eb0
and edi, 0x2ec2
pop edi
push edx
push ebx
add esp, 4
call 0x1c9e5f8
add byte [esi + 0x4b], al
inc eax
aas
cmp al, 0x4b
aas
cmp eax, 0x4c48339
add edx, 0x121fb
pop edx
mov ecx, dword [ebp - 0x488]
mov dword [ebp - 0x5c0], ecx
jmp 0x1c9e61f
push ebx
add ebx, 0x10ff7
or ebx, 0x1436f
pop ebx
push ebx
jmp 0x1c9e635
call 0x1c9e641
add byte [edx + 0x35], cl
cmp al, 0x4d
xor esi, dword [ebx + eax*4]
les eax, [ecx + eax*4]
retf
Function at 0x1c9e6c9
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x5c0]
add edx, 1
mov dword [ebp - 0x5c0], edx
add esp, 4
pop esi
push edx
push edi
add esp, 4
sub edx, 0x4526
pop edx
push ebx
and ebx, 0x11dca
pop ebx
mov edx, dword [ebp - 0x18e4]
mov dword [ebp - 0xc00], edx
mov dword [ebp - 0xe8c], 0
mov eax, dword [ebp - 0x5c0]
cmp eax, dword [ebp - 0x18e4]
jne 0x1c9e748
push edx
jmp 0x1c9e70d
pop edx
push eax
push esi
add esp, 4
jmp 0x1c9e718
xor eax, 0xfa22
xor eax, 0x10806
or eax, 0xb05d
pop eax
push edx
push edi
add esp, 4
and edx, 0x162f6
pop edx
mov ecx, dword [ebp - 0xe8c]
mov dword [ebp - 0x18b0], ecx
jmp 0x1c9e879
cmp dword [ebp - 0xe88], 0
jle 0x1c9e86d
push eax
push ebx
add esp, 4
and eax, 0xa8f6
call 0x1c9e76c
add byte [ebx], dh
inc ebp
dec eax
cmp cl, byte [esp + ecx*2 - 0x7d]
les eax, [ecx + eax*4]
rcr byte [ecx + 0x73], 1
add byte [ecx + 0x1395ee0], al
add byte [eax + 0x50], bl
push edi
add esp, 4
jmp 0x1c9e786
pop eax
mov edx, dword [ebp - 0xc04]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0xc00]
movzx edx, byte [ecx]
cmp eax, edx
je 0x1c9e809
push esi
push edx
add esp, 4
and esi, 0x11bfd
pop esi
push eax
or eax, 0x5990
call 0x1c9e7bf
add byte [edx + 0x3c], cl
push eax
dec edx
cmp al, byte [ebp + 0x38]
dec eax
cmp eax, dword [ebx + 0x4eb04c4]
xor ecx, dword [edi + 0x48]
dec esi
xor eax, 0x1339b
pop eax
mov eax, dword [ebp - 0xc04]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0xc00]
movzx eax, byte [edx]
cmp ecx, eax
jle 0x1c9e7f1
mov dword [ebp - 0x18e8], 1
jmp 0x1c9e7fb
mov dword [ebp - 0x18e8], 0xffffffff
mov ecx, dword [ebp - 0x18e8]
mov dword [ebp - 0xe8c], ecx
jmp 0x1c9e86d
push edi
and edi, 0xd2f1
and edi, 0x7a55
and edi, 0xee12
pop edi
push edi
push ecx
add esp, 4
xor edi, 0x7720
call 0x1c9e837
add byte [0x463b3542], dh
dec esp
inc ebx
inc ebx
cmp eax, 0x5f04c483
mov edx, dword [ebp - 0xe88]
sub edx, 1
mov dword [ebp - 0xe88], edx
mov eax, dword [ebp - 0xc04]
add eax, 1
mov dword [ebp - 0xc04], eax
mov ecx, dword [ebp - 0xc00]
add ecx, 1
mov dword [ebp - 0xc00], ecx
jmp 0x1c9e748
mov edx, dword [ebp - 0xe8c]
mov dword [ebp - 0x18b0], edx
cmp dword [ebp - 0x18b0], 0
jne 0x1c9e8c2
push edx
push ecx
add esp, 4
xor edx, 0x14fb5
sub edx, 0x66a7
pop edx
push edx
sub edx, 0x178a9
and edx, 0x5e21
sub edx, 0xe978
pop edx
push ebx
push edi
add esp, 4
add ebx, 0x5e6b
pop ebx
mov eax, dword [ebp - 0x5c0]
mov dword [ebp - 0xbfc], eax
jmp 0x1c9e903
jmp 0x1c9e610
Function at 0x1c9e76c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x5c0]
add edx, 1
mov dword [ebp - 0x5c0], edx
add esp, 4
pop esi
push edx
push edi
add esp, 4
sub edx, 0x4526
pop edx
push ebx
and ebx, 0x11dca
pop ebx
mov edx, dword [ebp - 0x18e4]
mov dword [ebp - 0xc00], edx
mov dword [ebp - 0xe8c], 0
mov eax, dword [ebp - 0x5c0]
cmp eax, dword [ebp - 0x18e4]
jne 0x1c9e748
push edx
jmp 0x1c9e70d
pop edx
push eax
push esi
add esp, 4
jmp 0x1c9e718
xor eax, 0xfa22
xor eax, 0x10806
or eax, 0xb05d
pop eax
push edx
push edi
add esp, 4
and edx, 0x162f6
pop edx
mov ecx, dword [ebp - 0xe8c]
mov dword [ebp - 0x18b0], ecx
jmp 0x1c9e879
cmp dword [ebp - 0xe88], 0
jle 0x1c9e86d
push eax
push ebx
add esp, 4
and eax, 0xa8f6
call 0x1c9e76c
add byte [ebx], dh
inc ebp
dec eax
cmp cl, byte [esp + ecx*2 - 0x7d]
les eax, [ecx + eax*4]
rcr byte [ecx + 0x73], 1
add byte [ecx + 0x1395ee0], al
add byte [eax + 0x50], bl
push edi
add esp, 4
jmp 0x1c9e786
pop eax
mov edx, dword [ebp - 0xc04]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0xc00]
movzx edx, byte [ecx]
cmp eax, edx
je 0x1c9e809
push esi
push edx
add esp, 4
and esi, 0x11bfd
pop esi
push eax
or eax, 0x5990
call 0x1c9e7bf
add byte [edx + 0x3c], cl
push eax
dec edx
cmp al, byte [ebp + 0x38]
dec eax
cmp eax, dword [ebx + 0x4eb04c4]
xor ecx, dword [edi + 0x48]
dec esi
xor eax, 0x1339b
pop eax
mov eax, dword [ebp - 0xc04]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0xc00]
movzx eax, byte [edx]
cmp ecx, eax
jle 0x1c9e7f1
mov dword [ebp - 0x18e8], 1
jmp 0x1c9e7fb
mov dword [ebp - 0x18e8], 0xffffffff
mov ecx, dword [ebp - 0x18e8]
mov dword [ebp - 0xe8c], ecx
jmp 0x1c9e86d
push edi
and edi, 0xd2f1
and edi, 0x7a55
and edi, 0xee12
pop edi
push edi
push ecx
add esp, 4
xor edi, 0x7720
call 0x1c9e837
add byte [0x463b3542], dh
dec esp
inc ebx
inc ebx
cmp eax, 0x5f04c483
mov edx, dword [ebp - 0xe88]
sub edx, 1
mov dword [ebp - 0xe88], edx
mov eax, dword [ebp - 0xc04]
add eax, 1
mov dword [ebp - 0xc04], eax
mov ecx, dword [ebp - 0xc00]
add ecx, 1
mov dword [ebp - 0xc00], ecx
jmp 0x1c9e748
mov edx, dword [ebp - 0xe8c]
mov dword [ebp - 0x18b0], edx
cmp dword [ebp - 0x18b0], 0
jne 0x1c9e8c2
push edx
push ecx
add esp, 4
xor edx, 0x14fb5
sub edx, 0x66a7
pop edx
push edx
sub edx, 0x178a9
and edx, 0x5e21
sub edx, 0xe978
pop edx
push ebx
push edi
add esp, 4
add ebx, 0x5e6b
pop ebx
mov eax, dword [ebp - 0x5c0]
mov dword [ebp - 0xbfc], eax
jmp 0x1c9e903
jmp 0x1c9e610
Function at 0x1c9e7bf
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x5c0]
add edx, 1
mov dword [ebp - 0x5c0], edx
add esp, 4
pop esi
push edx
push edi
add esp, 4
sub edx, 0x4526
pop edx
push ebx
and ebx, 0x11dca
pop ebx
mov edx, dword [ebp - 0x18e4]
mov dword [ebp - 0xc00], edx
mov dword [ebp - 0xe8c], 0
mov eax, dword [ebp - 0x5c0]
cmp eax, dword [ebp - 0x18e4]
jne 0x1c9e748
push edx
jmp 0x1c9e70d
pop edx
push eax
push esi
add esp, 4
jmp 0x1c9e718
xor eax, 0xfa22
xor eax, 0x10806
or eax, 0xb05d
pop eax
push edx
push edi
add esp, 4
and edx, 0x162f6
pop edx
mov ecx, dword [ebp - 0xe8c]
mov dword [ebp - 0x18b0], ecx
jmp 0x1c9e879
cmp dword [ebp - 0xe88], 0
jle 0x1c9e86d
push eax
push ebx
add esp, 4
and eax, 0xa8f6
call 0x1c9e76c
add byte [ebx], dh
inc ebp
dec eax
cmp cl, byte [esp + ecx*2 - 0x7d]
les eax, [ecx + eax*4]
rcr byte [ecx + 0x73], 1
add byte [ecx + 0x1395ee0], al
add byte [eax + 0x50], bl
push edi
add esp, 4
jmp 0x1c9e786
pop eax
mov edx, dword [ebp - 0xc04]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0xc00]
movzx edx, byte [ecx]
cmp eax, edx
je 0x1c9e809
push esi
push edx
add esp, 4
and esi, 0x11bfd
pop esi
push eax
or eax, 0x5990
call 0x1c9e7bf
add byte [edx + 0x3c], cl
push eax
dec edx
cmp al, byte [ebp + 0x38]
dec eax
cmp eax, dword [ebx + 0x4eb04c4]
xor ecx, dword [edi + 0x48]
dec esi
xor eax, 0x1339b
pop eax
mov eax, dword [ebp - 0xc04]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0xc00]
movzx eax, byte [edx]
cmp ecx, eax
jle 0x1c9e7f1
mov dword [ebp - 0x18e8], 1
jmp 0x1c9e7fb
mov dword [ebp - 0x18e8], 0xffffffff
mov ecx, dword [ebp - 0x18e8]
mov dword [ebp - 0xe8c], ecx
jmp 0x1c9e86d
push edi
and edi, 0xd2f1
and edi, 0x7a55
and edi, 0xee12
pop edi
push edi
push ecx
add esp, 4
xor edi, 0x7720
call 0x1c9e837
add byte [0x463b3542], dh
dec esp
inc ebx
inc ebx
cmp eax, 0x5f04c483
mov edx, dword [ebp - 0xe88]
sub edx, 1
mov dword [ebp - 0xe88], edx
mov eax, dword [ebp - 0xc04]
add eax, 1
mov dword [ebp - 0xc04], eax
mov ecx, dword [ebp - 0xc00]
add ecx, 1
mov dword [ebp - 0xc00], ecx
jmp 0x1c9e748
mov edx, dword [ebp - 0xe8c]
mov dword [ebp - 0x18b0], edx
cmp dword [ebp - 0x18b0], 0
jne 0x1c9e8c2
push edx
push ecx
add esp, 4
xor edx, 0x14fb5
sub edx, 0x66a7
pop edx
push edx
sub edx, 0x178a9
and edx, 0x5e21
sub edx, 0xe978
pop edx
push ebx
push edi
add esp, 4
add ebx, 0x5e6b
pop ebx
mov eax, dword [ebp - 0x5c0]
mov dword [ebp - 0xbfc], eax
jmp 0x1c9e903
jmp 0x1c9e610
Function at 0x1c9e837
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x5c0]
add edx, 1
mov dword [ebp - 0x5c0], edx
add esp, 4
pop esi
push edx
push edi
add esp, 4
sub edx, 0x4526
pop edx
push ebx
and ebx, 0x11dca
pop ebx
mov edx, dword [ebp - 0x18e4]
mov dword [ebp - 0xc00], edx
mov dword [ebp - 0xe8c], 0
mov eax, dword [ebp - 0x5c0]
cmp eax, dword [ebp - 0x18e4]
jne 0x1c9e748
push edx
jmp 0x1c9e70d
pop edx
push eax
push esi
add esp, 4
jmp 0x1c9e718
xor eax, 0xfa22
xor eax, 0x10806
or eax, 0xb05d
pop eax
push edx
push edi
add esp, 4
and edx, 0x162f6
pop edx
mov ecx, dword [ebp - 0xe8c]
mov dword [ebp - 0x18b0], ecx
jmp 0x1c9e879
cmp dword [ebp - 0xe88], 0
jle 0x1c9e86d
push eax
push ebx
add esp, 4
and eax, 0xa8f6
call 0x1c9e76c
add byte [ebx], dh
inc ebp
dec eax
cmp cl, byte [esp + ecx*2 - 0x7d]
les eax, [ecx + eax*4]
rcr byte [ecx + 0x73], 1
add byte [ecx + 0x1395ee0], al
add byte [eax + 0x50], bl
push edi
add esp, 4
jmp 0x1c9e786
pop eax
mov edx, dword [ebp - 0xc04]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0xc00]
movzx edx, byte [ecx]
cmp eax, edx
je 0x1c9e809
push esi
push edx
add esp, 4
and esi, 0x11bfd
pop esi
push eax
or eax, 0x5990
call 0x1c9e7bf
add byte [edx + 0x3c], cl
push eax
dec edx
cmp al, byte [ebp + 0x38]
dec eax
cmp eax, dword [ebx + 0x4eb04c4]
xor ecx, dword [edi + 0x48]
dec esi
xor eax, 0x1339b
pop eax
mov eax, dword [ebp - 0xc04]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0xc00]
movzx eax, byte [edx]
cmp ecx, eax
jle 0x1c9e7f1
mov dword [ebp - 0x18e8], 1
jmp 0x1c9e7fb
mov dword [ebp - 0x18e8], 0xffffffff
mov ecx, dword [ebp - 0x18e8]
mov dword [ebp - 0xe8c], ecx
jmp 0x1c9e86d
push edi
and edi, 0xd2f1
and edi, 0x7a55
and edi, 0xee12
pop edi
push edi
push ecx
add esp, 4
xor edi, 0x7720
call 0x1c9e837
add byte [0x463b3542], dh
dec esp
inc ebx
inc ebx
cmp eax, 0x5f04c483
mov edx, dword [ebp - 0xe88]
sub edx, 1
mov dword [ebp - 0xe88], edx
mov eax, dword [ebp - 0xc04]
add eax, 1
mov dword [ebp - 0xc04], eax
mov ecx, dword [ebp - 0xc00]
add ecx, 1
mov dword [ebp - 0xc00], ecx
jmp 0x1c9e748
mov edx, dword [ebp - 0xe8c]
mov dword [ebp - 0x18b0], edx
cmp dword [ebp - 0x18b0], 0
jne 0x1c9e8c2
push edx
push ecx
add esp, 4
xor edx, 0x14fb5
sub edx, 0x66a7
pop edx
push edx
sub edx, 0x178a9
and edx, 0x5e21
sub edx, 0xe978
pop edx
push ebx
push edi
add esp, 4
add ebx, 0x5e6b
pop ebx
mov eax, dword [ebp - 0x5c0]
mov dword [ebp - 0xbfc], eax
jmp 0x1c9e903
jmp 0x1c9e610
Function at 0x1ca017a
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
or ebx, 0x18461
call fcn.01ca017a
add byte [eax + edx*2], bh
dec esi
dec ebp
inc ebp
inc esp
inc ecx
dec ebp
add esp, 4
pop ebx
push edx
push edx
add esp, 4
xor edx, 0xeb17
or edx, 0x11c21
xor edx, 0x16b78
pop edx
mov ecx, dword [ebp - 0xebc]
mov dx, word [ecx]
mov word [ebp - 0x12ba], dx
mov eax, dword [ebp - 0xebc]
add eax, 2
mov dword [ebp - 0xebc], eax
mov cx, word [ebp - 0x12ba]
mov word [ebp - 0x270], cx
mov edx, dword [ebp - 0xec0]
mov ax, word [edx]
mov word [ebp - 0x12bc], ax
mov ecx, dword [ebp - 0xec0]
add ecx, 2
mov dword [ebp - 0xec0], ecx
mov dx, word [ebp - 0x12bc]
mov word [ebp - 0x40], dx
push esi
xor esi, 0xf0dd
and esi, 0x419c
or esi, 0x95e5
pop esi
push esi
push esi
add esp, 4
xor esi, 0xebaa
xor esi, 0x9971
and esi, 0xa02d
or esi, 0x10079
pop esi
movzx eax, word [ebp - 0x40]
test eax, eax
jne 0x1ca023c
movzx ecx, word [ebp - 0x270]
movzx edx, word [ebp - 0x40]
sub ecx, edx
mov dword [ebp - 0x1930], ecx
jmp 0x1ca0296
movzx eax, word [ebp - 0x270]
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x1ca0164
movzx edx, word [ebp - 0x270]
xor edx, 0x20
movzx eax, word [ebp - 0x40]
cmp edx, eax
je 0x1ca0164
movzx ecx, word [ebp - 0x270]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
jge 0x1ca0280
mov dword [ebp - 0x192c], 0xffffffff
jmp 0x1ca028a
mov dword [ebp - 0x192c], 1
mov eax, dword [ebp - 0x192c]
mov dword [ebp - 0x1930], eax
cmp dword [ebp - 0x1930], 0
jne 0x1ca02df
push edx
or edx, 0x1158b
pop edx
push ebx
xor ebx, 0x15ff1
add ebx, 0x33c6
call 0x1ca02c2
add byte [ebp + 0x3c], al
inc esi
dec ecx
dec edx
cmp ecx, dword [esi + esi - 0x7d]
les eax, [ebx + ebx*2]
push ecx
jmp 0x1ca02d0
pop ecx
mov ecx, dword [ebp - 0x5d4]
mov dword [ebp - 0x394], ecx
jmp 0x1ca0347
push eax
push ebx
add esp, 4
add eax, 0x5ff9
call 0x1ca02f6
add byte [edx + 0x3d], cl
inc eax
cmp byte [eax - 0x7d], al
les eax, [eax + ebp*8]
or dword [eax], eax
add byte [eax], al
add byte [ebx], bh
dec ecx
inc edx
cmp al, byte [esi + 0x49]
xor eax, dword ss:[ebx - 0x3f7efb3c]
invalid
Function at 0x1ca02c2
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
or ebx, 0x18461
call fcn.01ca017a
add byte [eax + edx*2], bh
dec esi
dec ebp
inc ebp
inc esp
inc ecx
dec ebp
add esp, 4
pop ebx
push edx
push edx
add esp, 4
xor edx, 0xeb17
or edx, 0x11c21
xor edx, 0x16b78
pop edx
mov ecx, dword [ebp - 0xebc]
mov dx, word [ecx]
mov word [ebp - 0x12ba], dx
mov eax, dword [ebp - 0xebc]
add eax, 2
mov dword [ebp - 0xebc], eax
mov cx, word [ebp - 0x12ba]
mov word [ebp - 0x270], cx
mov edx, dword [ebp - 0xec0]
mov ax, word [edx]
mov word [ebp - 0x12bc], ax
mov ecx, dword [ebp - 0xec0]
add ecx, 2
mov dword [ebp - 0xec0], ecx
mov dx, word [ebp - 0x12bc]
mov word [ebp - 0x40], dx
push esi
xor esi, 0xf0dd
and esi, 0x419c
or esi, 0x95e5
pop esi
push esi
push esi
add esp, 4
xor esi, 0xebaa
xor esi, 0x9971
and esi, 0xa02d
or esi, 0x10079
pop esi
movzx eax, word [ebp - 0x40]
test eax, eax
jne 0x1ca023c
movzx ecx, word [ebp - 0x270]
movzx edx, word [ebp - 0x40]
sub ecx, edx
mov dword [ebp - 0x1930], ecx
jmp 0x1ca0296
movzx eax, word [ebp - 0x270]
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x1ca0164
movzx edx, word [ebp - 0x270]
xor edx, 0x20
movzx eax, word [ebp - 0x40]
cmp edx, eax
je 0x1ca0164
movzx ecx, word [ebp - 0x270]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
jge 0x1ca0280
mov dword [ebp - 0x192c], 0xffffffff
jmp 0x1ca028a
mov dword [ebp - 0x192c], 1
mov eax, dword [ebp - 0x192c]
mov dword [ebp - 0x1930], eax
cmp dword [ebp - 0x1930], 0
jne 0x1ca02df
push edx
or edx, 0x1158b
pop edx
push ebx
xor ebx, 0x15ff1
add ebx, 0x33c6
call 0x1ca02c2
add byte [ebp + 0x3c], al
inc esi
dec ecx
dec edx
cmp ecx, dword [esi + esi - 0x7d]
les eax, [ebx + ebx*2]
push ecx
jmp 0x1ca02d0
pop ecx
mov ecx, dword [ebp - 0x5d4]
mov dword [ebp - 0x394], ecx
jmp 0x1ca0347
push eax
push ebx
add esp, 4
add eax, 0x5ff9
call 0x1ca02f6
add byte [edx + 0x3d], cl
inc eax
cmp byte [eax - 0x7d], al
les eax, [eax + ebp*8]
or dword [eax], eax
add byte [eax], al
add byte [ebx], bh
dec ecx
inc edx
cmp al, byte [esi + 0x49]
xor eax, dword ss:[ebx - 0x3f7efb3c]
invalid
Function at 0x1ca02f6
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
or ebx, 0x18461
call fcn.01ca017a
add byte [eax + edx*2], bh
dec esi
dec ebp
inc ebp
inc esp
inc ecx
dec ebp
add esp, 4
pop ebx
push edx
push edx
add esp, 4
xor edx, 0xeb17
or edx, 0x11c21
xor edx, 0x16b78
pop edx
mov ecx, dword [ebp - 0xebc]
mov dx, word [ecx]
mov word [ebp - 0x12ba], dx
mov eax, dword [ebp - 0xebc]
add eax, 2
mov dword [ebp - 0xebc], eax
mov cx, word [ebp - 0x12ba]
mov word [ebp - 0x270], cx
mov edx, dword [ebp - 0xec0]
mov ax, word [edx]
mov word [ebp - 0x12bc], ax
mov ecx, dword [ebp - 0xec0]
add ecx, 2
mov dword [ebp - 0xec0], ecx
mov dx, word [ebp - 0x12bc]
mov word [ebp - 0x40], dx
push esi
xor esi, 0xf0dd
and esi, 0x419c
or esi, 0x95e5
pop esi
push esi
push esi
add esp, 4
xor esi, 0xebaa
xor esi, 0x9971
and esi, 0xa02d
or esi, 0x10079
pop esi
movzx eax, word [ebp - 0x40]
test eax, eax
jne 0x1ca023c
movzx ecx, word [ebp - 0x270]
movzx edx, word [ebp - 0x40]
sub ecx, edx
mov dword [ebp - 0x1930], ecx
jmp 0x1ca0296
movzx eax, word [ebp - 0x270]
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x1ca0164
movzx edx, word [ebp - 0x270]
xor edx, 0x20
movzx eax, word [ebp - 0x40]
cmp edx, eax
je 0x1ca0164
movzx ecx, word [ebp - 0x270]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
jge 0x1ca0280
mov dword [ebp - 0x192c], 0xffffffff
jmp 0x1ca028a
mov dword [ebp - 0x192c], 1
mov eax, dword [ebp - 0x192c]
mov dword [ebp - 0x1930], eax
cmp dword [ebp - 0x1930], 0
jne 0x1ca02df
push edx
or edx, 0x1158b
pop edx
push ebx
xor ebx, 0x15ff1
add ebx, 0x33c6
call 0x1ca02c2
add byte [ebp + 0x3c], al
inc esi
dec ecx
dec edx
cmp ecx, dword [esi + esi - 0x7d]
les eax, [ebx + ebx*2]
push ecx
jmp 0x1ca02d0
pop ecx
mov ecx, dword [ebp - 0x5d4]
mov dword [ebp - 0x394], ecx
jmp 0x1ca0347
push eax
push ebx
add esp, 4
add eax, 0x5ff9
call 0x1ca02f6
add byte [edx + 0x3d], cl
inc eax
cmp byte [eax - 0x7d], al
les eax, [eax + ebp*8]
or dword [eax], eax
add byte [eax], al
add byte [ebx], bh
dec ecx
inc edx
cmp al, byte [esi + 0x49]
xor eax, dword ss:[ebx - 0x3f7efb3c]
invalid