joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1007c8f0
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x1015d808
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
mov eax, 0x371
mov dword [esp], ecx
cdq
idiv dword [0x1018c8f8]
mov eax, dword [0x1018c8f4]
mov cl, 0x69
push ebx
xor ebx, ebx
push esi
mov word [esp + 0x3c], 0x6f
mov word [esp + 0x3e], 0x3b
mov word [esp + 0x40], 6
mov word [esp + 0x42], 0x3d
mov word [esp + 0x44], 0x32
mov word [esp + 0x46], 0x19
mov word [esp + 0x48], 0x1d
mov word [esp + 0x4a], 4
mov word [esp + 0x4c], 8
mov word [esp + 0x4e], 0x3a
mov al, byte [edx + eax]
mov dl, 0xc1
imul byte [0x1018c91e]
imul cl
sub dl, al
mov al, byte [0x1019745c]
test al, 1
mov byte [0x1018c920], dl
jne 0x1007c9f2
push ebp
push edi
or al, 1
push 0x16
mov byte [0x1019745c], al
call fcn.1013c2df
add esp, 4
mov dword [0x10197460], eax
mov edi, 0x30
xor esi, esi
mov bp, word [esp + esi + 0x44]
push edi
mov eax, ebp
mov ecx, 0x10197460
and eax, 0xffff
push eax
call fcn.1004a650
mov ecx, dword [0x10197460]
xor eax, ebp
xor eax, edi
xor edi, edi
mov word [esi + ecx], ax
mov eax, dword [0x10197460]
mov di, word [esi + eax]
add esi, 2
cmp esi, 0x14
jb 0x1007c9a6
push 0x1007ecb0
mov word [eax + 0x14], bx
call fcn.1013c36b
add esp, 4
pop edi
pop ebp
mov esi, dword [0x10197460]
mov dl, byte [esp + 0x60]
push esi
mov byte [esp + 0x10], dl
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call fcn.1013c2c2
add esp, 4
lea ecx, [esp + 0xc]
push eax
push esi
call fcn.1000bf40
lea eax, [esp + 0xc]
lea ecx, [esp + 0x2c]
push eax
push ecx
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x60], ebx
call fcn.1007d400
mov edx, dword [esp + 0x60]
mov byte [esp + 0x58], 1
push edx
push eax
lea eax, [esp + 0x24]
push eax
call fcn.1000d050
add esp, 0xc
mov ecx, dword [esp + 0x64]
mov byte [esp + 0x58], 2
push ecx
mov ecx, dword [0x10191a54]
push eax
call fcn.10058e60
mov ecx, eax
call fcn.10067f30
mov eax, dword [esp + 0x20]
mov byte [esp + 0x58], 1
cmp eax, ebx
je 0x1007ca98
mov cl, byte [eax - 1]
cmp cl, bl
je 0x1007ca8c
cmp cl, 0xff
je 0x1007ca8c
dec cl
mov byte [eax - 1], cl
jmp 0x1007ca98
add eax, 0xfffffffe
push eax
call fcn.101307a0
add esp, 4
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
cmp ecx, ebx
mov byte [esp + 0x58], bl
je 0x1007cace
mov al, byte [ecx - 1]
cmp al, bl
je 0x1007cac2
cmp al, 0xff
je 0x1007cac2
dec al
mov byte [ecx - 1], al
jmp 0x1007cace
lea eax, [ecx - 2]
push eax
call fcn.101307a0
add esp, 4
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
cmp ecx, ebx
mov dword [esp + 0x58], 0xffffffff
je 0x1007cb19
mov al, byte [ecx - 1]
cmp al, bl
je 0x1007cb0d
cmp al, 0xff
je 0x1007cb0d
dec al
pop esi
mov byte [ecx - 1], al
pop ebx
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
add esp, 0x54
ret 8
add ecx, 0xfffffffe
push ecx
call fcn.101307a0
add esp, 4
mov ecx, dword [esp + 0x50]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x54
ret 8
Function at 0x10080fd0
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x1015db78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
mov eax, 0xd
mov ecx, 7
mov word [esp + 0x18], ax
mov word [esp + 0x28], ax
mov word [esp + 0x32], ax
mov al, byte [0x10197324]
push ebx
mov word [esp + 0x22], cx
mov word [esp + 0x24], cx
mov ecx, 0x1d
xor ebx, ebx
push esi
test al, 1
push edi
mov word [esp + 0x1c], 0x55
mov word [esp + 0x1e], 0x1f
mov word [esp + 0x20], 0xf
mov word [esp + 0x22], 0x19
mov word [esp + 0x26], 0x3e
mov word [esp + 0x28], 0x36
mov word [esp + 0x2e], cx
mov word [esp + 0x30], cx
mov word [esp + 0x32], 8
mov word [esp + 0x36], 0x33
mov word [esp + 0x38], 0x3b
mov word [esp + 0x3a], 1
mov word [esp + 0x3c], 9
mov word [esp + 0x40], 0x18
jne 0x100810e5
push ebp
or al, 1
push 0x28
mov byte [0x10197324], al
call fcn.1013c2df
add esp, 4
mov dword [0x10197328], eax
mov edi, 0x30
xor esi, esi
mov bp, word [esp + esi + 0x20]
push edi
mov eax, ebp
mov ecx, 0x10197328
and eax, 0xffff
push eax
call fcn.1004a650
mov ecx, dword [0x10197328]
xor eax, ebp
xor eax, edi
xor edi, edi
mov word [esi + ecx], ax
mov eax, dword [0x10197328]
mov di, word [esi + eax]
add esi, 2
cmp esi, 0x26
jb 0x1008109a
push 0x10088060
mov word [eax + 0x26], bx
call fcn.1013c36b
add esp, 4
pop ebp
mov edi, dword [0x10197328]
mov dl, byte [esp + 0x54]
push edi
mov byte [esp + 0x10], dl
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call fcn.1013c2c2
add esp, 4
mov esi, eax
lea ecx, [esp + 0xc]
push 1
push esi
call fcn.1000c010
test al, al
je 0x10081135
mov eax, dword [esp + 0x10]
push esi
push edi
push eax
call fcn.100017d0
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x20], esi
add esp, 0xc
mov word [ecx + esi*2], bx
mov edx, dword [esp + 0x54]
mov ecx, dword [0x10191a54]
lea eax, [esp + 0xc]
push edx
push eax
mov dword [esp + 0x54], ebx
call fcn.10058e60
mov ecx, eax
call fcn.10067f30
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x4c], 0xffffffff
cmp ecx, ebx
je 0x10081183
mov al, byte [ecx - 1]
cmp al, bl
je 0x10081177
cmp al, 0xff
je 0x10081177
dec al
mov byte [ecx - 1], al
jmp 0x10081183
add ecx, 0xfffffffe
push ecx
call fcn.101307a0
add esp, 4
mov ecx, dword [esp + 0x44]
pop edi
pop esi
mov byte [0x1018c954], 0x41
pop ebx
mov dword fs:[0], ecx
add esp, 0x44
ret
Function at 0x10081610
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x1015dbd8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
mov eax, 0x2db
push ebx
cdq
idiv dword [0x1018c92c]
mov eax, dword [0x1018c928]
xor ebx, ebx
push esi
push edi
mov word [esp + 0x1c], 0x47
mov word [esp + 0x1e], 0x58
mov word [esp + 0x22], 0x4e
mov word [esp + 0x28], 0x51
mov word [esp + 0x2a], 0x49
mov word [esp + 0x2c], 0x4b
mov word [esp + 0x2e], 0x52
mov word [esp + 0x34], 0x4f
mov word [esp + 0x36], 0x4d
mov word [esp + 0x3a], 0x4c
mov word [esp + 0x3c], 0x56
mov cl, byte [edx + eax]
mov eax, 0x7d
mov word [esp + 0x26], ax
mov word [esp + 0x30], ax
mov al, byte [0x1019730c]
mov byte [0x1018c953], cl
mov edx, 0x57
mov ecx, 0x43
test al, 1
mov word [esp + 0x20], dx
mov word [esp + 0x24], cx
mov word [esp + 0x32], cx
mov word [esp + 0x38], dx
jne 0x1008172a
or al, 1
push 0x24
mov byte [0x1019730c], al
call fcn.1013c2df
add esp, 4
mov dword [0x10197310], eax
xor esi, esi
mov di, word [esp + esi + 0x1c]
push 0x22
mov edx, edi
mov ecx, 0x10197310
and edx, 0xffff
push edx
call fcn.100a8ee0
mov ecx, dword [0x10197310]
add eax, 0x22
xor eax, edi
mov word [esi + ecx], ax
add esi, 2
cmp esi, 0x22
jb 0x100816e2
mov edx, dword [0x10197310]
push 0x100880a0
mov word [edx + 0x22], bx
call fcn.1013c36b
add esp, 4
mov edi, dword [0x10197310]
mov al, byte [esp + 0x50]
push edi
mov byte [esp + 0x10], al
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call fcn.1013c2c2
add esp, 4
mov esi, eax
lea ecx, [esp + 0xc]
push 1
push esi
call fcn.1000c010
test al, al
je 0x1008177a
mov ecx, dword [esp + 0x10]
push esi
push edi
push ecx
call fcn.100017d0
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x20], esi
add esp, 0xc
mov word [edx + esi*2], bx
mov eax, dword [esp + 0x50]
lea ecx, [esp + 0xc]
push eax
push ecx
mov ecx, dword [0x10191a54]
mov dword [esp + 0x50], ebx
call fcn.10058e60
mov ecx, eax
call fcn.10067f30
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x48], 0xffffffff
cmp ecx, ebx
je 0x100817c8
mov al, byte [ecx - 1]
cmp al, bl
je 0x100817bc
cmp al, 0xff
je 0x100817bc
dec al
mov byte [ecx - 1], al
jmp 0x100817c8
add ecx, 0xfffffffe
push ecx
call fcn.101307a0
add esp, 4
mov eax, 0x143
pop edi
cdq
idiv dword [0x1018c92c]
mov eax, dword [0x1018c928]
pop esi
pop ebx
mov cl, byte [edx + eax]
mov byte [0x1018c955], cl
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
add esp, 0x40
ret
Function at 0x10081800
Capabilities:
Encode data using xor
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x1015dbf8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov cl, byte [0x1018c956]
mov dl, byte [0x1018c957]
dec cl
mov al, dl
imul cl
push ebx
mov bl, byte [0x1018c954]
push esi
push edi
add al, 0x35
push 0x44
push eax
push 0x73
push 0x6c
inc dl
push 0xffffffffffffffcb
inc bl
push 0xffffffffffffffc6
push 0xffffffffffffffea
mov byte [0x1018c956], cl
mov byte [0x1018c957], dl
mov byte [0x1018c954], bl
call fcn.1007f620
mov cl, al
mov eax, 0x380
cdq
idiv dword [0x1018c92c]
mov eax, dword [0x1018c928]
add esp, 0x14
mov dl, byte [edx + eax]
mov al, byte [0x1018c956]
sub dl, cl
sub dl, 0x6f
push edx
push eax
call fcn.1007f5f0
push eax
mov eax, 0x2b5
cdq
idiv dword [0x1018c92c]
mov ecx, dword [0x1018c928]
mov al, byte [0x1018c952]
mov esi, 0x61
mov dl, byte [edx + ecx]
mov cl, byte [0x1018c954]
push edx
push eax
push ecx
push esi
call fcn.1007f620
mov byte [0x1018c952], al
mov eax, 0x4e
mov word [esp + 0x4a], ax
mov word [esp + 0x52], ax
mov al, byte [0x10197304]
add esp, 0x24
mov edx, 0x64
mov ecx, 0x7d
xor ebx, ebx
mov word [esp + 0x1c], 0x74
test al, 1
mov word [esp + 0x1e], 0x6b
mov word [esp + 0x20], dx
mov word [esp + 0x22], cx
mov word [esp + 0x24], 0x70
mov word [esp + 0x28], si
mov word [esp + 0x2a], 0x7e
mov word [esp + 0x2c], si
mov word [esp + 0x30], dx
mov word [esp + 0x32], 0x63
mov word [esp + 0x34], cx
jne 0x10081983
or al, 1
push 0x1c
mov byte [0x10197304], al
call fcn.1013c2df
add esp, 4
mov dword [0x10197308], eax
xor esi, esi
mov di, word [esp + esi + 0x1c]
push 0x11
mov edx, edi
mov ecx, 0x10197308
and edx, 0xffff
push edx
call fcn.100a8ee0
mov ecx, dword [0x10197308]
add eax, 0x11
xor eax, edi
mov word [esi + ecx], ax
add esi, 2
cmp esi, 0x1a
jb 0x1008193b
mov edx, dword [0x10197308]
push 0x100880b0
mov word [edx + 0x1a], bx
call fcn.1013c36b
add esp, 4
mov edi, dword [0x10197308]
mov al, byte [esp + 0x48]
push edi
mov byte [esp + 0x10], al
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call fcn.1013c2c2
add esp, 4
mov esi, eax
lea ecx, [esp + 0xc]
push 1
push esi
call fcn.1000c010
test al, al
je 0x100819d3
mov ecx, dword [esp + 0x10]
push esi
push edi
push ecx
call fcn.100017d0
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x20], esi
add esp, 0xc
mov word [edx + esi*2], bx
mov eax, dword [esp + 0x48]
lea ecx, [esp + 0xc]
push eax
push ecx
mov ecx, dword [0x10191a54]
mov dword [esp + 0x48], ebx
call fcn.10058e60
mov ecx, eax
call fcn.10068200
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x40], 0xffffffff
cmp ecx, ebx
je 0x10081a31
mov al, byte [ecx - 1]
cmp al, bl
je 0x10081a25
cmp al, 0xff
je 0x10081a25
dec al
pop edi
pop esi
mov byte [ecx - 1], al
pop ebx
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
add esp, 0x38
ret
add ecx, 0xfffffffe
push ecx
call fcn.101307a0
add esp, 4
mov ecx, dword [esp + 0x38]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret
Function at 0x10089f80
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x1015e480
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
mov al, byte [esp + 3]
push ebx
xor ebx, ebx
push esi
push edi
mov dword [esp + 0x10], ecx
mov byte [esp + 0x24], al
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov al, byte [0x1018c986]
mov dword [esp + 0x54], ebx
inc al
mov cl, 0xc8
mov byte [0x1018c986], al
imul cl
mov byte [str.x4_b_], al
mov al, byte [0x10197274]
test al, 1
mov word [esp + 0x34], 0x58
mov word [esp + 0x36], 0x1c
mov word [esp + 0x38], 0x19
mov word [esp + 0x3a], 1
mov word [esp + 0x3c], 0x33
mov word [esp + 0x3e], 0x36
mov word [esp + 0x40], 7
mov word [esp + 0x42], 4
mov word [esp + 0x44], 0x35
mov word [esp + 0x46], 0x3b
mov word [esp + 0x48], 6
jne 0x1008a08e
push ebp
or al, 1
push 0x18
mov byte [0x10197274], al
call fcn.1013c2df
add esp, 4
mov dword [0x10197278], eax
mov edi, 0x30
xor esi, esi
mov bp, word [esp + esi + 0x38]
push edi
mov edx, ebp
mov ecx, 0x10197278
and edx, 0xffff
push edx
call fcn.1004a650
mov ecx, dword [0x10197278]
xor eax, ebp
xor eax, edi
xor edi, edi
mov word [esi + ecx], ax
mov eax, dword [0x10197278]
mov di, word [esi + eax]
add esi, 2
cmp esi, 0x16
jb 0x1008a042
push 0x1008c3a0
mov word [eax + 0x16], bx
call fcn.1013c36b
add esp, 4
pop ebp
mov edi, dword [0x10197278]
mov dl, byte [esp + 0xf]
push edi
mov byte [esp + 0x18], dl
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call fcn.1013c2c2
add esp, 4
mov esi, eax
lea ecx, [esp + 0x14]
push 1
push esi
call fcn.1000c010
test al, al
je 0x1008a0dc
mov eax, dword [esp + 0x18]
push esi
push edi
push eax
call fcn.100017d0
add esp, 0xc
lea ecx, [esp + 0x14]
push esi
call fcn.1000bff0
lea ecx, [esp + 0x24]
lea edx, [esp + 0x14]
push ecx
mov ecx, dword [0x10191a54]
push edx
mov byte [esp + 0x5c], 1
call fcn.10058e60
mov ecx, eax
call fcn.10068300
mov ecx, dword [esp + 0x18]
mov byte [esp + 0x54], bl
cmp ecx, ebx
je 0x1008a127
mov al, byte [ecx - 1]
cmp al, bl
je 0x1008a11b
cmp al, 0xff
je 0x1008a11b
dec al
mov byte [ecx - 1], al
jmp 0x1008a127
add ecx, 0xfffffffe
push ecx
call fcn.101307a0
add esp, 4
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x24]
push eax
call fcn.1008a180
mov edi, dword [esp + 0x2c]
mov esi, dword [esp + 0x28]
mov byte [0x1018c985], 0x84
cmp esi, edi
mov dword [esp + 0x54], 0xffffffff
je 0x1008a164
push 1
mov ecx, esi
call fcn.1000bc70
add esi, 0x10
cmp esi, edi
jne 0x1008a150
mov esi, dword [esp + 0x28]
push esi
call fcn.101307a0
mov ecx, dword [esp + 0x50]
add esp, 4
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x4c
ret
Function at 0x10095a40
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x1015f358
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov dl, byte [0x1018c9d5]
mov eax, dword [esp + 0x30]
push ebx
dec dl
push esi
mov esi, ecx
mov byte [0x1018c9d5], dl
mov edx, dword [0x1016a210]
mov cl, byte [eax]
xor ebx, ebx
push edx
mov byte [esp + 0xc], cl
push ebx
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
call fcn.1000ba60
mov eax, dword [esp + 0x3c]
mov edx, dword [0x1016a210]
mov dword [esp + 0x30], ebx
push edx
mov cl, byte [eax]
push ebx
mov byte [esp + 0x20], cl
push eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call fcn.1000ba60
mov eax, dword [esp + 0x40]
lea ecx, [esp + 8]
push eax
push ecx
mov ecx, esi
mov dword [esp + 0x38], 2
call fcn.10095810
mov esi, eax
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x30], 3
cmp ecx, ebx
je 0x10095b09
mov al, byte [ecx - 1]
cmp al, bl
je 0x10095afd
cmp al, 0xff
je 0x10095afd
dec al
mov byte [ecx - 1], al
jmp 0x10095b09
lea eax, [ecx - 2]
push eax
call fcn.101307a0
add esp, 4
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
cmp ecx, ebx
mov dword [esp + 0x30], 0xffffffff
je 0x10095b43
mov al, byte [ecx - 1]
cmp al, bl
je 0x10095b37
cmp al, 0xff
je 0x10095b37
dec al
mov byte [ecx - 1], al
jmp 0x10095b43
add ecx, 0xfffffffe
push ecx
call fcn.101307a0
add esp, 4
mov ecx, dword [esp + 0x28]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 0xc
Function at 0x100985e0
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x1015f668
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
mov ecx, dword [0x1018ca10]
mov eax, 0x268
cdq
idiv ecx
push ebx
push esi
mov esi, 7
push edi
mov eax, esi
push 0x1c
mov edi, edx
cdq
idiv ecx
mov eax, dword [0x1018ca0c]
mov cl, byte [edx + eax]
mov dl, byte [edi + eax]
sub cl, dl
push ecx
call fcn.100980c0
mov cl, byte [0x1018ca3c]
add esp, 8
mov dl, cl
xor ebx, ebx
add dl, 0x53
mov word [esp + 0x1c], 0x59
imul dl
mov dl, 0x5f
mov word [esp + 0x1e], si
imul dl
add al, 0x15
mov word [esp + 0x20], si
imul cl
mov byte [0x1018ca39], al
mov eax, 0x1d
mov word [esp + 0x22], ax
mov word [esp + 0x24], ax
mov eax, 0x1f
mov ecx, 0xd
mov word [esp + 0x2e], ax
mov word [esp + 0x30], ax
mov eax, 5
mov word [esp + 0x26], 8
mov word [esp + 0x32], ax
mov word [esp + 0x34], ax
mov al, byte [0x10197094]
mov word [esp + 0x28], cx
test al, 1
mov word [esp + 0x2a], 0x33
mov word [esp + 0x2c], 0x2f
mov word [esp + 0x36], 3
mov word [esp + 0x38], 0x2c
mov word [esp + 0x3a], 0x3b
mov word [esp + 0x3c], 1
mov word [esp + 0x3e], 9
mov word [esp + 0x40], cx
mov word [esp + 0x42], 0x18
jne 0x10098747
push ebp
or al, 1
push 0x2a
mov byte [0x10197094], al
call fcn.1013c2df
add esp, 4
mov dword [0x10197098], eax
mov edi, 0x30
xor esi, esi
mov bp, word [esp + esi + 0x20]
push edi
mov eax, ebp
mov ecx, 0x10197098
and eax, 0xffff
push eax
call fcn.1004a650
mov ecx, dword [0x10197098]
xor eax, ebp
xor eax, edi
xor edi, edi
mov word [esi + ecx], ax
mov eax, dword [0x10197098]
mov di, word [esi + eax]
add esi, 2
cmp esi, 0x28
jb 0x100986fc
push 0x100a81e0
mov word [eax + 0x28], bx
call fcn.1013c36b
add esp, 4
pop ebp
mov edi, dword [0x10197098]
mov dl, byte [esp + 0x54]
push edi
mov byte [esp + 0x10], dl
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call fcn.1013c2c2
add esp, 4
mov esi, eax
lea ecx, [esp + 0xc]
push 1
push esi
call fcn.1000c010
test al, al
je 0x10098797
mov eax, dword [esp + 0x10]
push esi
push edi
push eax
call fcn.100017d0
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x20], esi
add esp, 0xc
mov word [ecx + esi*2], bx
mov edx, dword [esp + 0x54]
mov ecx, dword [0x10191a54]
lea eax, [esp + 0xc]
push edx
push eax
mov dword [esp + 0x54], ebx
call fcn.10058e60
mov ecx, eax
call fcn.10067f30
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x4c], 0xffffffff
cmp ecx, ebx
je 0x100987f5
mov al, byte [ecx - 1]
cmp al, bl
je 0x100987e9
cmp al, 0xff
je 0x100987e9
dec al
pop edi
pop esi
mov byte [ecx - 1], al
pop ebx
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
add esp, 0x44
ret
add ecx, 0xfffffffe
push ecx
call fcn.101307a0
add esp, 4
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x44
ret
Function at 0x10098810
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x1015f688
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov eax, 0xa9
push ebx
push esi
mov esi, dword [0x1018ca10]
cdq
idiv esi
mov cl, byte [0x1018ca36]
mov bl, byte [0x1018ca35]
push edi
mov edi, dword [0x1018ca0c]
dec cl
dec bl
mov byte [0x1018ca36], cl
mov byte [0x1018ca35], bl
sub cl, 0x7e
mov al, byte [edx + edi]
push eax
mov eax, 0x34f
cdq
idiv esi
push ecx
push ebx
mov cl, byte [edx + edi]
push ecx
push 0xfffffffffffffff8
push 0x52
push 0x64
push 0x7f
call fcn.100980e0
mov dl, 0xd6
add esp, 0x10
imul dl
push eax
call fcn.100980d0
mov eax, 0x6f
add esp, 0x14
mov word [esp + 0x1c], ax
mov word [esp + 0x20], ax
mov word [esp + 0x24], ax
mov eax, 0x6c
mov word [esp + 0x2a], ax
mov word [esp + 0x36], ax
mov al, byte [0x1019708c]
mov edx, 0x74
mov ecx, 0x5e
xor ebx, ebx
test al, 1
mov word [esp + 0x1e], 0x6e
mov word [esp + 0x22], dx
mov word [esp + 0x26], 0x72
mov word [esp + 0x28], cx
mov word [esp + 0x2c], 0x60
mov word [esp + 0x2e], 0x77
mov word [esp + 0x30], cx
mov word [esp + 0x32], 0x6d
mov word [esp + 0x34], dx
jne 0x10098959
or al, 1
push 0x1e
mov byte [0x1019708c], al
call fcn.1013c2df
add esp, 4
mov dword [0x10197090], eax
xor edi, edi
mov si, word [esp + edi + 0x1c]
push 1
mov eax, esi
mov ecx, 0x10197090
and eax, 0xffff
push eax
call fcn.1002ea10
mov ecx, dword [0x10197090]
sub esi, eax
inc esi
mov word [edi + ecx], si
add edi, 2
cmp edi, 0x1c
jb 0x10098914
mov edx, dword [0x10197090]
push 0x100a81d0
mov word [edx + 0x1c], bx
call fcn.1013c36b
add esp, 4
mov edi, dword [0x10197090]
mov al, byte [esp + 0x48]
push edi
mov byte [esp + 0x10], al
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call fcn.1013c2c2
add esp, 4
mov esi, eax
lea ecx, [esp + 0xc]
push 1
push esi
call fcn.1000c010
test al, al
je 0x100989a9
mov ecx, dword [esp + 0x10]
push esi
push edi
push ecx
call fcn.100017d0
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x20], esi
add esp, 0xc
mov word [edx + esi*2], bx
mov eax, dword [esp + 0x48]
lea ecx, [esp + 0xc]
push eax
push ecx
mov ecx, dword [0x10191a54]
mov dword [esp + 0x48], ebx
call fcn.10058e60
mov ecx, eax
call fcn.10067f30
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x40], 0xffffffff
cmp ecx, ebx
je 0x100989f7
mov al, byte [ecx - 1]
cmp al, bl
je 0x100989eb
cmp al, 0xff
je 0x100989eb
dec al
mov byte [ecx - 1], al
jmp 0x100989f7
add ecx, 0xfffffffe
push ecx
call fcn.101307a0
add esp, 4
mov al, byte [0x1018ca34]
mov ecx, dword [esp + 0x38]
dec al
pop edi
pop esi
mov byte [0x1018ca34], al
mov byte [0x1018ca35], al
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret
Function at 0x10098be0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x1015f6c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
mov eax, 0x1a4
push ebx
cdq
idiv dword [0x1018ca10]
mov eax, dword [0x1018ca0c]
mov bl, byte [0x1018ca37]
push esi
push edi
mov word [esp + 0x20], 0x59
mov word [esp + 0x2a], 8
mov word [esp + 0x2e], 0x33
mov word [esp + 0x30], 0x2f
mov word [esp + 0x3a], 3
mov word [esp + 0x3c], 0x2c
mov word [esp + 0x3e], 0x3b
mov word [esp + 0x42], 9
mov word [esp + 0x46], 0x18
mov cl, byte [edx + eax]
mov eax, 7
mov word [esp + 0x22], ax
mov word [esp + 0x24], ax
mov eax, 0x1d
add cl, bl
mov word [esp + 0x26], ax
mov word [esp + 0x28], ax
mov eax, 0x1f
add cl, 2
mov word [esp + 0x32], ax
mov word [esp + 0x34], ax
mov eax, 5
mov byte [0x1018ca35], cl
mov word [esp + 0x36], ax
mov word [esp + 0x38], ax
mov al, byte [0x10197094]
mov ebx, 1
mov ecx, 0xd
mov word [esp + 0x40], bx
test bl, al
mov word [esp + 0x2c], cx
mov word [esp + 0x44], cx
jne 0x10098d52
push ebp
or al, bl
push 0x2a
mov byte [0x10197094], al
call fcn.1013c2df
mov edx, eax
add esp, 4
mov dword [0x10197098], edx
mov esi, 0x30
xor edi, edi
mov cx, word [esp + edi + 0x24]
mov ebp, esi
mov eax, ecx
and eax, 0xffff
xor eax, esi
test esi, esi
jne 0x10098cfb
mov ebp, 4
test eax, eax
jge 0x10098d01
neg eax
test ebp, ebp
jge 0x10098d07
neg ebp
test eax, eax
je 0x10098d1b
lea ebx, [eax + ebp]
cdq
idiv ebx
test eax, eax
jne 0x10098d0b
mov edx, dword [0x10197098]
xor ecx, eax
add edi, 2
xor ecx, esi
xor esi, esi
mov word [edi + edx - 2], cx
mov edx, dword [0x10197098]
cmp edi, 0x28
mov si, word [edi + edx - 2]
jb 0x10098ce2
push 0x100a81e0
mov word [edx + 0x28], 0
call fcn.1013c36b
add esp, 4
mov ebx, 1
pop ebp
mov edi, dword [0x10197098]
mov dl, byte [esp + 0xf]
push edi
mov byte [esp + 0x14], dl
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call fcn.1013c2c2
add esp, 4
mov esi, eax
lea ecx, [esp + 0x10]
push ebx
push esi
call fcn.1000c010
test al, al
je 0x10098dbb
mov eax, dword [esp + 0x14]
mov ecx, edi
test esi, esi
jbe 0x10098dad
mov edx, esi
mov di, word [ecx]
add ecx, 2
mov word [eax], di
add eax, 2
dec edx
jne 0x10098d9e
mov eax, dword [esp + 0x14]
mov dword [esp + 0x18], esi
mov word [eax + esi*2], 0
lea ecx, [esp + 0x10]
push 0xa
push ecx
mov dword [esp + 0x58], 0
call fcn.1006a360
mov ecx, dword [esp + 0x1c]
add esp, 8
test ecx, ecx
mov esi, eax
mov dword [esp + 0x50], 0xffffffff
je 0x10098e14
mov al, byte [ecx - 1]
test al, al
je 0x10098e08
cmp al, 0xff
je 0x10098e08
dec al
pop edi
mov byte [ecx - 1], al
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
add esp, 0x48
ret
add ecx, 0xfffffffe
push ecx
call fcn.101307a0
add esp, 4
mov ecx, dword [esp + 0x48]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x48
ret