joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4123f1
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x448190]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00410f18
mov dword [ebp - 0x14], eax
cmp dword [0x2d4d8f8], esi
jne 0x4124e4
push 0x800
push esi
push 0x4052ac
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x412471
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4125c4
push esi
push esi
push 0x4052ac
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4125c4
push 0x4052c4
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4125c4
push eax
call ebx
push 0x4052d0
push edi
mov dword [0x2d4d8f8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x4052e0
push edi
mov dword [0x2d4d8fc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x4052f4
push edi
mov dword [0x2d4d900], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x2d4d908], eax
test eax, eax
je 0x4124e1
push 0x405310
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x2d4d904], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x412509
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4124fc
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x41251e
push 4
pop eax
jmp 0x4125c6
cmp dword [ebp - 0x14], esi
je 0x41251e
push dword [0x2d4d8f8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x412503
mov eax, dword [0x2d4d904]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x41257c
cmp dword [0x2d4d908], edi
je 0x41257c
push eax
call ebx
push dword [0x2d4d908]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x41257c
test eax, eax
je 0x41257c
call ecx
test eax, eax
je 0x412571
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x412571
test byte [ebp - 8], 1
jne 0x41257c
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4125ac
mov eax, dword [0x2d4d8fc]
cmp eax, edi
je 0x4125a9
push eax
call ebx
test eax, eax
je 0x4125a9
call eax
mov esi, eax
test esi, esi
je 0x4125a9
mov eax, dword [0x2d4d900]
cmp eax, edi
je 0x4125a9
push eax
call ebx
test eax, eax
je 0x4125a9
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x2d4d8f8]
call ebx
test eax, eax
je 0x4125c4
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x4125c6
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b3ae
mov esp, ebp
pop ebp
ret
Function at 0x401100
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
push esi
push ebx
sub esp, 0x684
mov dword [ebp - 0x678], edx
mov dword [ebp - 0x674], 0
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_wcslen]
mov ebx, eax
mov eax, dword [ebp - 0x678]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcslen]
add ebx, eax
mov eax, dword [ebp - 0x674]
mov esi, dword [eax*4 + 0x40308c]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_wcslen]
lea eax, [ebx + eax + 2]
cmp eax, 0x104
ja 0x401280
lea ebx, [ebp - 0x66c]
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_wcscpy]
mov dword [esp + 4], 0x403014
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_wcscat]
mov eax, dword [ebp - 0x678]
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.ucrtbase.dll_wcscat]
mov dword [esp + 4], esi
lea esi, [ebp - 0x25c]
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_wcscat]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], esi
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_FindFirstFileExW]
sub esp, 0x18
cmp eax, 0xffffffff
jne 0x401200
add dword [ebp - 0x674], 1
mov eax, dword [ebp - 0x674]
cmp eax, 5
jne 0x40111e
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea ebx, [ebp - 0x464]
mov dword [ebp - 0x670], eax
lea esi, [esi]
lea eax, [ebp - 0x230]
mov dword [esp + 4], edi
mov dword [esp + 8], eax
mov dword [esp], ebx
call dword [sym.imp.shlwapi.dll_PathCombineW]
sub esp, 0xc
test eax, eax
je 0x401248
mov dword [esp + 4], ebx
mov dword [esp], str._ls_n
call fcn.00401000
mov dword [section..bss], 1
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x670]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_FindNextFileW]
sub esp, 8
test eax, eax
jne 0x401210
mov edx, dword [ebp - 0x670]
mov dword [esp], edx
call dword [sym.imp.kernel32.dll_FindClose]
sub esp, 4
jmp 0x4011de
test byte [section..data], 2
je 0x4011f4
mov dword [esp + 0xc], str.Path_too_long_n
mov dword [esp + 8], str.search
mov dword [esp + 4], 0x402000
mov dword [esp], 1
call fcn.004010b0
jmp 0x4011f4
Function at 0x4012c0
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x228
mov ecx, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
test ecx, ecx
jle 0x401310
xor eax, eax
jmp 0x4012e7
add eax, 1
cmp ecx, eax
je 0x401350
mov edx, dword [ebx + eax*4]
cmp word [edx], 0x2f
jne 0x4012e0
test byte [section..data], 1
jne 0x401450
mov eax, 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [section..bss]
xor eax, eax
test edx, edx
jne 0x401302
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], 0xf
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.File_not_found_n
call sub.ucrtbase.dll_fwrite
jmp 0x4012fd
cmp ecx, 1
je 0x401310
lea eax, [ebx + ecx*4]
lea edi, [ebx + 4]
mov dword [ebp - 0x21c], eax
jmp 0x401373
add edi, 4
cmp dword [ebp - 0x21c], edi
je 0x401310
mov esi, dword [edi]
mov dword [esp + 4], 0x3a
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_wcsrchr]
test eax, eax
je 0x4013f0
lea ebx, [eax + 2]
xor ecx, ecx
mov word [eax], cx
mov dword [esp + 4], str.__r_n
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_wcspbrk]
test eax, eax
jne 0x401368
mov dword [esp], esi
lea esi, [ebp - 0x218]
call dword [sym.imp.ucrtbase.dll__wcsdup]
mov dword [ebp - 0x218], eax
jmp 0x4013c7
mov edx, ebx
call fcn.00401100
mov dword [esp + 8], esi
mov dword [esp + 4], 0x403044
mov dword [esp], 0
call dword [sym.imp.ucrtbase.dll_wcstok]
test eax, eax
jne 0x4013c0
jmp 0x401368
mov dword [esp], str.PATH
call dword [sym.imp.ucrtbase.dll__wgetenv]
mov dword [ebp - 0x220], eax
mov dword [esp + 4], str.__r_n
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_wcspbrk]
test eax, eax
jne 0x401368
lea ebx, [ebp - 0x214]
mov dword [esp], 0x104
mov dword [esp + 4], ebx
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
sub esp, 8
test eax, eax
jne 0x40147d
mov ebx, esi
mov esi, dword [ebp - 0x220]
jmp 0x4013a7
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], str.Unsupported_option__ls_n
mov dword [esp + 8], str.wmain
mov dword [esp + 4], 0x402000
mov dword [esp], 0
call fcn.004010b0
jmp 0x4012fd
mov edx, esi
mov eax, ebx
call fcn.00401100
jmp 0x40143a

Function at 0x401e10
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sub.ucrtbase.dll__configure_wide_argv
call sub.ucrtbase.dll__initialize_wide_environment
call 0x401e80
mov esi, dword [eax]
call sub.ucrtbase.dll___p___wargv
mov edi, dword [eax]
call sub.ucrtbase.dll__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.004012c0
mov dword [esp], eax
call sub.ucrtbase.dll_exit
nop
nop
nop
jmp dword [sym.imp.ucrtbase.dll___p___argc]
Function at 0x40129f
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
and dword [ebp - 0x10], 0
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x10]
push edi
mov dword [ebp - 0x38], esi
mov eax, dword [esi + 4]
mov edi, dword [esi]
mov dword [ebp - 0x20], eax
mov eax, dword [0x41b5c0]
mov dword [ebp - 0x30], eax
mov eax, dword [0x41b5c4]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x34], eax
call fcn.00401298
mov ebx, dword [ebp - 0x10]
mov eax, dword [0x41b5c8]
add ebx, 0x23f
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [0x41b5cc]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], 0x20
mov dword [ebp - 0x1c], 2
add dword [ebp - 0x1c], 3
mov ecx, dword [0xae3504]
mov eax, edi
shl eax, 4
mov dword [ebp - 4], eax
cmp ecx, 0xc
jne 0x40132c
push 0x418300
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov eax, dword [ebp - 4]
mov ecx, dword [0xae3504]
add eax, dword [ebp - 0x28]
mov edx, 0xedeb2e40
mov dword [ebp - 4], eax
cmp ecx, 0xfa9
mov eax, dword [0xae3500]
cmove eax, edx
xor edx, edx
mov dword [0xae3500], eax
cmp ecx, 0x3eb
mov eax, dword [0xae3458]
cmove eax, edx
mov dword [0xae3458], eax
lea eax, [ebx + edi]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
shr eax, 5
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
and dword [ebp - 0x14], edx
mov dword [0xae34fc], 0xf4ea3dee
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x20]
add dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
xor dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
xor eax, dword [ebp - 0x18]
sub esi, eax
mov dword [ebp - 0xc], eax
mov eax, esi
mov dword [ebp - 0x18], esi
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x30]
add dword [ebp - 4], eax
and dword [ebp - 8], edx
mov eax, dword [ebp - 0x10]
add dword [ebp - 8], eax
mov eax, dword [ebp - 0x18]
nop
add dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
mov edx, esi
mov eax, dword [ebp - 4]
add ebx, 0x61c88647
shr edx, cl
add edx, dword [ebp - 0x34]
mov dword [ebp - 0xc], edx
xor edx, dword [ebp - 0x20]
xor eax, edx
mov dword [ebp - 0x10], ebx
sub edi, eax
mov dword [ebp - 4], eax
dec dword [ebp - 0x24]
mov dword [ebp - 0x18], edi
jne 0x4012fa
mov dword [ebp - 0x20], esi
mov esi, dword [ebp - 0x38]
mov eax, dword [ebp - 0x20]
mov dword [esi], edi
pop edi
mov dword [esi + 4], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40d328
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41a35c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00405145
mov dword [ebp - 0x14], eax
cmp dword [0x43ecb8], esi
jne 0x40d41b
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d3a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d4fb
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d4fb
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d4fb
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x43ecb8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x43ecbc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x43ecc0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43ecc8], eax
test eax, eax
je 0x40d418
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43ecc4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d440
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d433
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d455
push 4
pop eax
jmp 0x40d4fd
cmp dword [ebp - 0x14], esi
je 0x40d455
push dword [0x43ecb8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d43a
mov eax, dword [0x43ecc4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d4b3
cmp dword [0x43ecc8], edi
je 0x40d4b3
push eax
call ebx
push dword [0x43ecc8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d4b3
test eax, eax
je 0x40d4b3
call ecx
test eax, eax
je 0x40d4a8
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d4a8
test byte [ebp - 8], 1
jne 0x40d4b3
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d4e3
mov eax, dword [0x43ecbc]
cmp eax, edi
je 0x40d4e0
push eax
call ebx
test eax, eax
je 0x40d4e0
call eax
mov esi, eax
test esi, esi
je 0x40d4e0
mov eax, dword [0x43ecc0]
cmp eax, edi
je 0x40d4e0
push eax
call ebx
test eax, eax
je 0x40d4e0
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x43ecb8]
call ebx
test eax, eax
je 0x40d4fb
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d4fd
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404457
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov al, byte [ecx]
and dword [esp + 0x18], 0
push ebx
push esi
mov byte [edx], al
lea eax, [edx + 1]
push edi
xor edi, edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], edx
mov esi, dword [esp + 0x14]
xor ebx, ebx
lea eax, [ecx + 1]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x18]
call fcn.004011b2
test eax, eax
je 0x401164
lea ecx, [esp + 0x18]
call fcn.004011b2
lea ecx, [esp + 0x18]
test eax, eax
je 0x4010d3
jmp loc.00441000
call fcn.00401191
test edi, edi
jne 0x401108
cmp eax, 2
jne 0x401103
lea ecx, [esp + 0x18]
call fcn.00401191
mov edx, dword [esp + 0x1c]
mov edi, eax
test edi, edi
je 0x40115f
mov ecx, edx
sub ecx, esi
mov al, byte [ecx]
mov byte [edx], al
inc edx
inc ecx
dec edi
jne 0x4010f8
jmp 0x40115b
sub eax, 3
jmp 0x40110b
sub eax, 2
mov ecx, dword [esp + 0x18]
mov esi, eax
movzx eax, byte [ecx]
shl esi, 8
add esi, eax
inc ecx
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x18]
call fcn.00401191
mov ecx, eax
cmp esi, 0x7d00
jb 0x401132
inc ecx
cmp esi, 0x500
jb 0x40113b
inc ecx
cmp esi, 0x80
jae 0x401146
add ecx, 2
mov edx, dword [esp + 0x1c]
test ecx, ecx
je 0x40115f
mov edi, edx
sub edi, esi
mov al, byte [edi]
mov byte [edx], al
inc edx
inc edi
dec ecx
jne 0x401152
mov dword [esp + 0x1c], edx
xor edi, edi
inc edi
jmp 0x40117c
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov al, byte [ecx]
mov byte [edx], al
inc edx
inc ecx
mov dword [esp + 0x18], ecx
xor edi, edi
mov dword [esp + 0x1c], edx
test ebx, ebx
je 0x401033
sub edx, dword [esp + 0x14]
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10008592
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100267c8]
jne 0x1000859c
repz ret
jmp fcn.1000c3f3

Function at 0x1000ec2f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1000862d
and dword [ebp - 4], 0
cmp dword [0x10027ce8], 0
mov ebx, eax
jne 0x1000ece0
push 0x1001be60
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1000ed91
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1001be54
push edi
call esi
test eax, eax
je 0x1000ed91
push eax
call fcn.100085bb
mov dword [esp], 0x1001be44
push edi
mov dword [0x10027ce8], eax
call esi
push eax
call fcn.100085bb
mov dword [esp], 0x1001be30
push edi
mov dword [0x10027cec], eax
call esi
push eax
call fcn.100085bb
mov dword [esp], 0x1001be14
push edi
mov dword [0x10027cf0], eax
call esi
push eax
call fcn.100085bb
pop ecx
mov dword [0x10027cf8], eax
test eax, eax
je 0x1000ece0
push 0x1001bdfc
push edi
call esi
push eax
call fcn.100085bb
pop ecx
mov dword [0x10027cf4], eax
mov eax, dword [0x10027cf4]
cmp eax, ebx
je 0x1000ed38
cmp dword [0x10027cf8], ebx
je 0x1000ed38
push eax
call fcn.10008636
push dword [0x10027cf8]
mov esi, eax
call fcn.10008636
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1000ed38
test edi, edi
je 0x1000ed38
call esi
test eax, eax
je 0x1000ed2f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1000ed2f
test byte [ebp - 0xc], 1
jne 0x1000ed38
or dword [ebp + 0x10], 0x200000
jmp 0x1000ed71
mov eax, dword [0x10027cec]
cmp eax, ebx
je 0x1000ed71
push eax
call fcn.10008636
pop ecx
test eax, eax
je 0x1000ed71
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1000ed71
mov eax, dword [0x10027cf0]
cmp eax, ebx
je 0x1000ed71
push eax
call fcn.10008636
pop ecx
test eax, eax
je 0x1000ed71
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10027ce8]
call fcn.10008636
pop ecx
test eax, eax
je 0x1000ed91
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1000ed93
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10019258
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [0x10026148], 0x1e87
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
jmp 0x10019339
mov eax, dword [ebp - 0x34]
mov dword [0x1002614c], 0x2144
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x38], eax
call fcn.100198b5
xor eax, eax
mov ecx, dword [ebp - 0x38]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [0x1002614c], 0xfffff8da
mov dword [ecx + 0xd0], 0x4550
mov dword [0x10026148], 0xfffff0f0
add ecx, 0xffc00000
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x38], ecx
mov ecx, dword [ebp - 0x38]
mov dword [edx + 0x34], ecx
mov esi, dword [0x10026148]
add esi, 0x1007
mov dword [0x10026148], esi
add ecx, 0x141a
mov esi, dword [ebp - 0x38]
cmp esi, 0
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x40], eax
je 0x10019330
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
add esp, 0x50
pop esi
pop ebp
ret
mov eax, dword [ebp - 0x30]
mov ecx, eax
add ecx, 1
mov dl, byte [eax + 0x1001b56a]
mov dh, byte [eax + 0x1001b53b]
sub dh, dl
mov byte [ebp + eax - 0x24], dh
cmp ecx, 0xe
mov dword [ebp - 0x30], ecx
jne 0x10019339
lea eax, [ebp - 0x24]
mov dword [0x10026148], 0x1579
mov dword [ebp - 0x44], eax
call fcn.1001971a
mov dword [esp], eax
mov eax, dword [ebp - 0x44]
mov dword [esp + 4], eax
call fcn.10019130
mov ecx, dword [0x10026148]
add ecx, 0xffffe209
mov dword [0x10026148], ecx
cmp eax, 0
mov dword [ebp - 0x34], eax
jne 0x1001927f
xor eax, eax
add esp, 0x50
pop esi
pop ebp
ret
Function at 0x100199aa
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x44
mov eax, dword [ebp + 8]
mov ecx, dword [0x10026148]
add ecx, 0xffffeadb
mov dword [0x1002614c], ecx
mov dword [ebp - 0x10], eax
call fcn.1001a26b
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov edi, edx
add edi, esi
mov esi, dword [eax + esi]
cmp esi, 0x4550
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edi
je 0x100199f8
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x78]
mov dword [0x10026148], 0x1e82
mov dword [0x1002614c], 0xfffff9ef
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add ecx, dword [edx + eax + 0x20]
mov esi, dword [edx + eax + 0x18]
cmp esi, 0
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], edi
je 0x10019b0a
jmp 0x10019a59
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
xor edx, edx
mov esi, dword [ebp - 0x28]
mov edi, dword [esi + ecx*4]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x48], edx
jmp 0x10019a6d
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x24]
add ecx, dword [ecx + edx + 0x24]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], ecx
jmp 0x10019a3d
mov eax, dword [ebp - 0x48]
mov ecx, eax
mov edx, dword [ebp - 0x44]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x4d], bh
mov byte [ebp - 0x4e], cl
je 0x10019abe
mov eax, dword [ebp - 0x4c]
add eax, 1
mov cl, byte [ebp - 0x4d]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x4e]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x48], eax
jne 0x10019a6d
mov al, byte [ebp - 0x4e]
test al, 1
jne 0x10019af1
jmp 0x10019ac7
xor eax, eax
mov ecx, dword [ebp - 0x3c]
add ecx, 2
mov edx, dword [ebp - 0x40]
add edx, 1
mov esi, dword [ebp - 0x2c]
cmp edx, esi
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x30], eax
jb 0x10019a3d
jmp 0x10019b0a
mov eax, dword [ebp - 0x3c]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x24]
add edx, dword [edx + esi + 0x1c]
mov edi, dword [ebp - 0x1c]
add edi, dword [edx + ecx*4]
mov dword [ebp - 0x30], edi
mov eax, dword [ebp - 0x30]
add esp, 0x44
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10019b15
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x20
mov dword [ebp - 8], 0
mov dword [0x1002614c], 0x425
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov esi, dword [0x1002614c]
add esi, 0x1910
mov dword [0x1002614c], esi
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], ecx
jmp 0x10019b7f
mov eax, dword [ebp - 0x18]
mov dword [0x1002614c], 0x114c
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x1c], eax
je 0x10019bae
jmp 0x10019c1a
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], edx
je 0x10019b5e
mov eax, dword [ebp - 0x20]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
jl 0x10019b7f
jmp 0x10019b5e
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x18], 0x6f
jne 0x10019c1a
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x10019c1a
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x14], 0x64
jne 0x10019c1a
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x12], 0x64
jne 0x10019c1a
mov dword [0x10026148], 0x1a68
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x10019c1a
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x24], eax
je 0x10019c29
xor eax, eax
mov dword [0x10026148], 0xffffeb02
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
add esp, 0x20
pop esi
pop ebp
ret