joyce8/EMBER2024-capa huggingface dataset:
Function at 0x61542bc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0xf0
mov edi, dword [0x61547094]
mov esi, dword [ebp + 8]
test edi, edi
je 0x61542d80
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [0x61547094]
movzx eax, al
bt eax, esi
jae 0x61542de0
mov ecx, dword [0x61547084]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], ecx
je 0x61542c86
test byte [0x61544030], 8
jne 0x61542d20
lea ebx, [esp + 0x28]
mov edi, ebx
test byte [0x61544040], 8
jne 0x61542cd0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call dbg.sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x61542c55
cmp esi, 3
jbe 0x61542c90
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
mov dword [esp + 8], str._s:_s:_s
lea edx, [edi + 1]
mov dword [esp], eax
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x615461e0]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x61542c55
mov ecx, dword [0x61547094]
test ecx, ecx
je 0x61542dc0
mov dword [esp], 0x61544040
call dword [0x61547094]
test al, 8
je 0x61542c2c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call dbg.sprintf
add edi, eax
jmp 0x61542c2c
mov ebx, dword [0x61547094]
test ebx, ebx
je 0x61542da0
mov dword [esp], 0x61544030
call dword [0x61547094]
test al, 8
je 0x61542c19
call dword [sym.imp.kernel32.dll_GetTickCount]
lea ebx, [esp + 0x28]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mov eax, 0x10624dd3
mov dword [esp], ebx
mul ecx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call dbg.sprintf
lea edi, [ebx + eax]
jmp 0x61542c1f
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x61547094
call sym._load_func.part.0
jmp 0x61542be0
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x61547094
call sym._load_func.part.0
jmp 0x61542d2a
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x61547094
call sym._load_func.part.0
jmp 0x61542cde
mov eax, 0xffffffff
jmp 0x61542c86
Function at 0x4422e4
Capabilities:
Authenticate hmac

Disassembly:
movsb byte es:[edi], byte [esi]
xor ch, byte [ebp - 0x45cc4cce]
xor ecx, ecx
xor edx, ecx
xor ebx, esp
xor esp, edx
xor ebp, eax
xor esi, edx
xor ecx, dword [edx]
xor al, 0xf
xor al, 0x19
xor al, 0x33
xor al, 0x41
xor al, 0x49
xor al, 0x4f
xor al, 0x92
xor al, 0xa4
xor al, 0
xor eax, 0x352a351b
inc esi
xor eax, 0x365e3658
bound esi, qword [edi]
movsd dword es:[edi], dword [esi]
aaa
fbstp tbyte [edi]
in eax, 0x37
aaa
div dword [edi]
push ss
cmp byte [ebx], ah
cmp byte [eax], dh
cmp byte [edx], bh
cmp byte [eax + edi + 0x4c], al
cmp byte [edx + 0x38], bl
js 0x44236a
xchg ebp, eax
cmp byte [ebp + 0x2538cd38], ch
cmp dword [ebx], edi
cmp dword [esi + 0x39], ebp
salc
cmp ebx, edi
cmp dword [esi], edi
cmp al, byte [edx + edi + 0x4c]
cmp dl, byte [edx + edi + 0x5c]
cmp ch, byte [eax + 0x3a]
insd dword es:[edi], dx
cmp bh, byte [ecx + 0x3a]
cmp dword [edx], 0x3a913a89
cmpsd dword [esi], dword es:[edi]
cmp ch, byte [edi - 0x40c548c6]
cmp al, bh
cmp bl, dl
cmp ah, dl
cmp cl, byte [edi]
cmp ebp, dword [edx]
cmp edi, dword [edx]
cmp eax, dword [eax + 0x3b]
inc edi
cmp edx, dword [edx + 0x3b]
push edi
cmp esp, dword [ecx + 0x3b]
cmp bx, word [esi - 0x4ec455c5]
cmp eax, ecx
cmp bh, byte [ebx]
inc eax
cmp eax, dword [edi + 0x3b]
push edx
cmp edx, dword [edi + 0x3b]
popal
cmp esp, dword [esi + 0x3b]
sahf
cmp ebp, dword [edx - 0x3ec44ec5]
cmp eax, edi
cmp ecx, esi
cmp ebx, eax
cmp esi, ecx
cmp edi, ecx
cmp edi, esi
cmp ecx, dword [edx]
cmp al, 0xf
cmp al, 0x2c
cmp al, 0x32
cmp al, 0x6c
cmp al, 0x74
cmp al, 0x8e
cmp al, 0x94
cmp al, 0xa5
cmp al, 0xbe
cmp al, 0xca
cmp al, 0xd0
cmp al, 0xdd
cmp al, 0xea
cmp al, 3
cmp eax, 0x3d7d3d65
cmp dword [0x3db33dad], 0xffffffd5
cmp eax, 0x3e1b3de9
and bh, byte [esi]
aaa
imul edi, dword ds:[esi], 0x3e943e73
test eax, 0xf73ecd3e
add eax, 0x3c3f363f
aas
dec ecx
aas
push 0x3f
invalid
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
je 0x432072
nop
nop
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x564532dd
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x432060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
je 0x4320d2
nop
nop
nop
mov ebx, 0x42f314
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x479d4474
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4320c0
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x401920
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x4053a0]
test esi, esi
jle 0x401a30
mov edi, dword [0x4053a4]
xor ebx, ebx
lea edx, [edi + 0xc]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x401954
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x4019d5
add ebx, 1
add edx, 0x14
cmp ebx, esi
jne 0x401940
mov dword [esp], eax
mov ebx, eax
call dbg.__mingw_GetSectionForAddress
test eax, eax
mov edi, eax
je 0x401a57
mov eax, dword [0x4053a4]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
add eax, dword [edi + 0xc]
mov edx, dword [0x4053a4]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401a37
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x4019ce
sub eax, 4
and eax, 0xfffffffb
jne 0x4019e0
add dword [0x4053a0], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
add ebx, dword [0x4053a4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x4019ce
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
lea esi, [esi]
xor esi, esi
jmp 0x40195e
mov eax, dword [0x4053a4]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
nop

Function at 0x401e90
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x4053b8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x4053b0]
sub esp, 4
test ebx, ebx
je 0x401ee5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x401ede
test esi, esi
je 0x401ede
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401ec0
mov dword [esp], 0x4053b8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4025b0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
nop
nop
nop
nop
nop

Function at 0x414e60
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xf000]
push edi
jmp 0x414e7a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x414e81
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x414e70
mov eax, 1
add ebx, ebx
jne 0x414e93
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x414e88
jne 0x414ea4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414e88
xor ecx, ecx
sub eax, 3
jb 0x414eb8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x414f2a
mov ebp, eax
add ebx, ebx
jne 0x414ec3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x414ed0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x414ef4
inc ecx
add ebx, ebx
jne 0x414ee0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x414ed5
jne 0x414ef1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414ed5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x414f14
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x414f05
jmp 0x414e76
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x414f14
add edi, ecx
jmp 0x414e76
pop esi
mov edi, esi
mov ecx, 0x5a7
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x414f32
cmp byte [edi], 5
jne 0x414f32
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x414f37
lea edi, [esi + 0x12000]
mov eax, dword [edi]
or eax, eax
je 0x414fa6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x15454]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1551c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x414f64
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x15520]
or eax, eax
je 0x414fa0
mov dword [ebx], eax
add ebx, 4
jmp 0x414f81
call dword [esi + 0x15530]
mov ebp, dword [esi + 0x15524]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x414fda
sub esp, 0xffffff80
jmp 0x40a764
Function at 0x10155e90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x40
mov eax, dword [ebp + 8]
mov dword [0x101c64f0], 0x1b2c
mov dword [ebp - 0x10], eax
call fcn.10154c10
xor ecx, ecx
mov edx, eax
mov dword [0x101c64ec], 0xbd4
mov esi, dword [eax + 0x3c]
mov edi, dword [0x101c64f0]
add edi, 0xffffffaf
mov dword [0x101c64f0], edi
mov esi, dword [eax + esi + 0x78]
mov edi, edx
add edi, dword [eax + esi + 0x20]
mov dword [0x101c64ec], 0x2be
mov ebx, dword [eax + esi + 0x24]
mov dword [0x101c64f0], 0x1a42
mov eax, dword [eax + esi + 0x18]
cmp eax, 0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], ecx
je 0x10155f2e
jmp 0x10155f89
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
xor edx, edx
mov esi, dword [ebp - 0x24]
mov edi, dword [esi + eax*4]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x40], edx
jmp 0x10155f9e
mov eax, dword [ebp - 0x28]
add esp, 0x40
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x44]
add eax, 1
mov cl, byte [ebp - 0x45]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x46]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dl, byte [ebp - 0x46]
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x47], dl
jne 0x10155f9e
jmp 0x10155fd0
mov eax, dword [ebp - 0x38]
add eax, 2
mov ecx, dword [ebp - 0x34]
add ecx, 1
mov edx, dword [ebp - 0x18]
cmp ecx, edx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
jb 0x10155f12
jmp 0x10156007
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add ecx, edx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], eax
jmp 0x10155f12
mov eax, dword [ebp - 0x40]
mov ecx, eax
mov edx, dword [ebp - 0x3c]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov bl, cl
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x45], bh
mov byte [ebp - 0x46], cl
mov byte [ebp - 0x47], bl
jne 0x10155f39
mov al, byte [ebp - 0x47]
test al, 1
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x4c], ecx
jne 0x10155fdf
jmp 0x10155f69
mov eax, dword [ebp - 0x4c]
movzx eax, word [eax]
mov dword [0x101c64ec], 0x1899
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
add ecx, dword [ecx + edx + 0x1c]
mov esi, dword [ebp - 0x1c]
add esi, dword [ecx + eax*4]
mov dword [ebp - 0x28], esi
jmp 0x10155f2e
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x10155f2e
Function at 0x101560a0
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x54
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x24]
mov byte [ebp - 0x24], 0x56
mov esi, edx
add esi, 1
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x34], esi
mov eax, dword [ebp - 0x34]
mov byte [eax], 0x69
mov byte [ebp - 0x22], 0x72
mov byte [ebp - 0x21], 0x74
mov byte [ebp - 0x20], 0x75
mov byte [ebp - 0x1f], 0x61
mov byte [ebp - 0x1e], 0x6c
mov byte [ebp - 0x1d], 0x41
mov byte [ebp - 0x1c], 0x6c
mov byte [ebp - 0x1b], 0x6c
mov byte [ebp - 0x1a], 0x6f
mov byte [ebp - 0x19], 0x63
mov byte [ebp - 0x18], 0
mov byte [ebp - 0x17], 0xdc
mov dword [0x101c64ec], 0x8f3
call fcn.10157450
mov dword [esp], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 4], eax
call fcn.10154f50
mov ecx, dword [0x101c64ec]
add ecx, 0xffffe701
mov dword [0x101c64f0], ecx
cmp eax, 0
mov dword [ebp - 0x38], eax
je 0x101561f3
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov dword [0x101c64f0], 0x1fb0
mov eax, esp
mov dword [eax + 0xc], 0x40
mov dword [eax + 8], 0x1000
mov dword [eax + 4], 0x6000
mov dword [eax], 0
mov eax, dword [ebp - 0x3c]
call eax
sub esp, 0x10
mov dword [0x101c64f0], 0x179d
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x40], eax
call fcn.10155100
xor eax, eax
mov ecx, dword [ebp - 0x40]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [0x101c64f0], 0x2340
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x14], ecx
mov dword [0x101c64ec], 0x2331
mov ecx, dword [ebp - 0x40]
mov dword [edx], ecx
add ecx, 0x17cf
mov esi, dword [ebp - 0x40]
cmp esi, 0
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x48], eax
je 0x101561ea
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
add esp, 0x54
pop esi
pop ebp
ret
xor eax, eax
add esp, 0x54
pop esi
pop ebp
ret
Function at 0x101569f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [0x101c64f4], 0
mov dword [0x101c64f8], 0
mov dword [0x101c6504], 0
mov dword [0x101c64f0], 0x1f46
mov dword [0x101c64ec], 0x6a7
cmp eax, 0
sete bl
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov byte [ebp - 0x1d], bl
mov al, byte [ebp - 0x1d]
test al, 1
jne 0x10156a57
jmp 0x10156a69
mov dword [0x101c64ec], 0x671
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
mov ecx, eax
mov edx, eax
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], eax
jmp 0x10156a93
jmp 0x10156a57
mov eax, dword [0x101c64f4]
mov ecx, dword [0x101c64f8]
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
mov esi, 0x100
add ecx, 1
mov dword [ebp - 0x34], eax
mov eax, ecx
mov dword [ebp - 0x38], edx
cdq
idiv esi
mov dword [0x101c64f4], edx
mov dword [0x101c64ec], 0x1594
mov ecx, dword [ebp - 0x1c]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x38]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x3c], edx
cdq
idiv esi
mov dword [0x101c64f8], edx
mov dword [0x101c64ec], 0xd4b
mov esi, dword [ebp - 0x3c]
mov cl, byte [ecx + esi]
mov byte [0x101c64fc], cl
mov dword [0x101c64ec], 0x1da3
mov edi, dword [ebp - 0x1c]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov edx, dword [0x101c64f0]
add edx, 0xffffdb32
mov dword [0x101c64ec], edx
mov cl, byte [0x101c64fc]
mov edx, dword [0x101c64f8]
mov byte [edi + edx], cl
mov edx, dword [0x101c64f4]
movzx edx, byte [edi + edx]
mov ebx, dword [0x101c64f8]
movzx ebx, byte [edi + ebx]
add ebx, edx
mov dword [0x101c64ec], 0x18e9
and ebx, 0xff
mov dword [0x101c6504], ebx
mov cl, byte [edi + ebx]
mov edx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x34]
mov ch, byte [edx + ebx]
mov edx, dword [0x101c64f0]
add edx, 0xffffe35f
mov dword [0x101c64f0], edx
mov dword [0x101c64ec], 0x136a
xor ch, cl
mov edx, dword [ebp - 0x18]
mov byte [edx + ebx], ch
add ebx, 1
mov edx, dword [ebp - 0x10]
cmp ebx, edx
mov dword [ebp - 0x30], ebx
je 0x10156a7a
jmp 0x10156a7c
Function at 0x10156c80
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x90
lea eax, [esp + 0x80]
lea ecx, [esp + 0x28]
mov dword [0x101c64f0], 0x1312
mov dword [esp], eax
mov dword [esp + 0x24], ecx
call fcn.101553e0
lea ecx, [0x10156bf0]
mov edx, dword [esp + 0x80]
mov dword [esp + 0x58], edx
mov dword [esp + 0x40], 0x146c00
mov edx, dword [0x101c64d8]
mov dword [esp + 0x2c], edx
mov edx, dword [0x101c64dc]
mov dword [esp + 0x78], edx
mov edx, dword [0x101c64e0]
mov dword [esp + 0x34], edx
mov edx, dword [0x101c64e4]
mov dword [esp + 0x70], edx
mov edx, dword [0x101c64e8]
mov dword [esp + 0x48], edx
mov dword [0x101c64ec], 0x174e
mov dword [0x101c64f0], 0x17c6
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
jmp 0x10156d91
mov eax, dword [esp + 0x18]
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x38], eax
mov dword [0x101c64ec], 0xbd4
mov dword [0x101c64f0], 0x1775
mov eax, dword [eax + ecx + 0x50]
mov dword [esp + 0x4c], eax
call fcn.10156fa0
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x18], ecx
jne 0x10156d16
lea eax, [esp + 0x28]
mov ecx, dword [esp + 0x88]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.101560a0
mov ecx, esp
lea edx, [esp + 0x28]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov dword [0x101c64f0], 0x1050
mov dword [esp + 0x18], eax
jmp 0x10156d16
mov eax, dword [esp + 0x1c]
cmp word [eax], 0x5a4d
mov dword [esp + 0xc], eax
jne 0x10156dbc
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
je 0x10156d1e
mov eax, dword [esp + 0xc]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x1c], eax
jmp 0x10156d91
Function at 0x10156fa0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x34
mov eax, dword [0x101c64ec]
add eax, 0xfffff38c
mov dword [0x101c64ec], eax
mov dword [ebp - 8], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x101c64ec], 0x1400
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], ecx
jmp 0x1015704b
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x14], 0x64
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], edx
je 0x101570c6
jmp 0x1015706b
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff4
shl eax, 1
mov ecx, dword [ebp - 0x10]
add ecx, eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
cmp word [eax], 0x6f
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], ecx
je 0x101570ab
jmp 0x1015706b
mov eax, 0x1545
mov ecx, dword [ebp - 0x28]
add ecx, 1
cmp ecx, 0x104
mov edx, ecx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
jge 0x10157082
mov eax, dword [ebp - 0x14]
mov ecx, 0x2324
mov edx, dword [ebp - 0x10]
cmp word [edx + eax*2], 0
mov esi, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], esi
je 0x10157082
jmp 0x1015702a
mov eax, dword [ebp - 0x20]
xor ecx, ecx
add eax, 0xfffff3aa
mov dword [0x101c64ec], eax
mov dword [ebp - 0x34], ecx
jmp 0x1015712e
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
mov dword [0x101c64ec], ecx
mov edx, dword [ebp - 0x10]
cmp word [edx + eax*2 - 0x1a], 0x6c
mov esi, ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], esi
je 0x10157001
jmp 0x1015706b
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x16], 0x61
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], edx
je 0x10156fe6
jmp 0x1015706b
mov eax, dword [ebp - 0x1c]
add eax, 0xffffe8ad
mov dword [0x101c64ec], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
cmp word [ecx + edx*2 - 0x12], 0x64
mov esi, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x20], esi
jne 0x1015706b
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x10], 0x6c
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x20], edx
jne 0x1015706b
mov eax, 1
mov dword [0x101c64f0], 0x10ec
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov esi, dword [ebp - 0x38]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x34], eax
jne 0x1015706b
mov eax, dword [ebp - 0x34]
add esp, 0x34
pop esi
pop ebp
ret