joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1016316
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0x18]
add eax, eax
push ebx
xor ebx, ebx
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 4], ebx
mov dword [ebp + 0x18], ebx
cmp eax, ebx
je 0x1016429
cmp word [eax], bx
je 0x1016429
mov edi, dword [ebp + 0x10]
cmp edi, ebx
je 0x101640e
cmp word [edi], bx
je 0x101640e
cmp dword [ebp + 0x14], ebx
jne 0x1016382
mov eax, dword [section..data]
cmp eax, section..data
je 0x101644d
test byte [eax + 0x1c], 1
je 0x101644d
push 0x1002e28
push 0xc
jmp 0x1016442
push esi
lea ecx, [ebp + 0x18]
push ecx
mov ecx, dword [0x101aa9c]
neg ecx
sbb ecx, ecx
and ecx, 0x100
add ecx, 0x20019
push ecx
push ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, ebx
jne 0x10163fb
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 4]
push eax
push ebx
push edi
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
cmp esi, ebx
jne 0x10163fb
cmp dword [ebp - 4], 1
je 0x10163fb
mov eax, dword [section..data]
push 0xd
pop esi
cmp eax, section..data
je 0x10163fb
test byte [eax + 0x1c], 1
je 0x10163fb
push dword [ebp - 4]
push edi
push 0x1002e28
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01003300
cmp dword [ebp + 0x18], ebx
je 0x1016409
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
jmp 0x1016450
mov eax, dword [section..data]
cmp eax, section..data
je 0x101644d
test byte [eax + 0x1c], 1
je 0x101644d
push 0x1002e28
push 0xb
jmp 0x1016442
mov eax, dword [section..data]
cmp eax, section..data
je 0x101644d
test byte [eax + 0x1c], 1
je 0x101644d
push 0x1002e28
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100e41b
push 0x57
pop eax
pop edi
pop ebx
leave
ret 0x14

Function at 0x10165d0
Capabilities:
Hash data using sha1

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x101aaa0], 0
push ebx
jne 0x101664d
push eax
push ebx
push ecx
push edx
xor eax, eax
cpuid
xor eax, eax
xor ebx, 0x756e6547
sete al
xor ebx, ebx
xor ecx, 0x6c65746e
sete bl
and eax, ebx
xor ecx, ecx
xor edx, 0x49656e69
sete cl
and eax, ecx
mov dword [ebp - 4], eax
mov eax, 1
cpuid
xor ecx, ecx
xor edx, edx
mov ebx, 0xff0
and ebx, eax
mov dword [ebp - 8], ebx
pop edx
pop ecx
pop ebx
pop eax
cmp dword [ebp - 4], 0
mov eax, 1
je 0x1016641
cmp dword [ebp - 8], 0x660
jae 0x1016641
xor eax, eax
mov eax, dword [eax*4 + 0x101a440]
mov dword [0x101aaa0], eax
mov eax, dword [ebp + 8]
mov dword [eax + 0x54], 0
mov dword [eax + 0x58], 0
mov dword [eax + 0x40], 0x67452301
mov dword [eax + 0x44], 0xefcdab89
mov dword [eax + 0x48], 0x98badcfe
mov dword [eax + 0x4c], 0x10325476
mov dword [eax + 0x50], 0xc3d2e1f0
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4b7620
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x75000]
push edi
jmp 0x4b763a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4b7641
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b7630
mov eax, 1
add ebx, ebx
jne 0x4b7653
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4b7664
jne 0x4b7683
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b7683
dec eax
add ebx, ebx
jne 0x4b7670
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4b7648
add ebx, ebx
jne 0x4b767f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4b76d5
xor ecx, ecx
sub eax, 3
jb 0x4b769b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4b770a
sar eax, 1
mov ebp, eax
jmp 0x4b76a6
add ebx, ebx
jne 0x4b76a6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b7674
inc ecx
add ebx, ebx
jne 0x4b76b4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b7674
add ebx, ebx
jne 0x4b76c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4b76b6
jne 0x4b76d2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4b76b6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4b76f4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4b76e6
jmp 0x4b7636
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4b76f4
add edi, ecx
jmp 0x4b7636
pop esi
mov edi, esi
mov ecx, 0x379b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4b7712
cmp byte [edi], 0x13
jne 0x4b7712
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4b7717
lea edi, [esi + 0xb3000]
mov eax, dword [edi]
or eax, eax
je 0x4b778f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xbfe3c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xbff90]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4b7744
mov ecx, edi
jns 0x4b7773
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xbff94]
or eax, eax
je 0x4b7789
mov dword [ebx], eax
add ebx, 4
jmp 0x4b7761
call dword [esi + 0xbffa4]
mov ebp, dword [esi + 0xbff98]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4b77c3
sub esp, 0xffffff80
jmp 0x4165c1
Function at 0x431003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43100c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x431030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp fcn.00401219
Function at 0x4035ca
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 1
xor bl, bl
call esi
test ax, ax
jns 0x4035e1
inc bl
jmp 0x4035ec
push 2
call esi
test ax, ax
jns 0x4035ec
mov bl, 2
pop esi
mov al, bl
pop ebx
ret

Function at 0x4058ee
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0x22
pop edi
mov ebx, eax
call fcn.004016a3
mov esi, eax
cmp word [esi], di
jne 0x40590c
inc esi
inc esi
jmp 0x40590f
push 0x20
pop edi
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov edi, eax
test edi, edi
je 0x40592b
and word [edi], 0
lea eax, [edi + 2]
call fcn.004016a3
mov edi, eax
mov eax, esi
call fcn.004016a3
mov cx, word [eax]
mov word [ebx], cx
mov cx, word [eax]
inc ebx
inc ebx
inc eax
inc eax
test cx, cx
jne 0x405932
push edi
call fcn.004058d0
pop ecx
pop edi
pop esi
pop ebx
jmp fcn.004016a3
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x1a150121
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
mov ecx, 0x57b7206
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x1000ee66
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x98
mov eax, dword [0x10031444]
add eax, 0xffffda07
mov dword [0x10031444], eax
call fcn.10001070
cmp eax, 0
sete cl
mov byte [esp + 0x2f], cl
xor eax, eax
mov cl, byte [esp + 0x2f]
test cl, 1
mov dword [esp + 0x28], eax
jne 0x1000eea6
jmp 0x1000efeb
lea eax, [esp + 0x30]
mov dword [0x10031444], 0xbdc
mov dword [esp + 0x24], eax
call fcn.10010151
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x20], ecx
jne 0x1000efe3
lea eax, [esp + 0x88]
mov dword [esp], eax
call fcn.1000f098
lea ecx, [0x100103c9]
mov dword [0x10031448], 0xb1d
mov edx, dword [esp + 0x88]
mov dword [esp + 0x7c], edx
mov dword [esp + 0x84], 0x139c00
mov edx, dword [0x10031430]
mov dword [esp + 0x64], edx
mov edx, dword [0x10031434]
mov dword [esp + 0x38], edx
mov edx, dword [0x10031438]
mov dword [esp + 0x6c], edx
mov edx, dword [0x1003143c]
mov dword [esp + 0x54], edx
mov dword [0x10031444], 0x135a
mov edx, dword [0x10031440]
mov dword [esp + 0x34], edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x18]
cmp word [eax], 0x5a4d
mov dword [esp + 0x14], eax
jne 0x1000ef6a
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0x10], ecx
je 0x1000ef7e
mov eax, dword [esp + 0x14]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x18], eax
jmp 0x1000ef47
mov eax, dword [esp + 0x14]
mov dword [esp + 0x48], eax
mov ecx, dword [esp + 0x10]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0xc], edx
lea eax, [esp + 0x30]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x74], ecx
mov dword [0x10031444], 0x111c
mov edx, dword [esp + 0x90]
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.1000f357
mov ecx, esp
lea edx, [esp + 0x30]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov ecx, dword [0x10031444]
add ecx, 0xfffff0fe
mov dword [0x10031444], ecx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
mov esp, ebp
pop ebp
ret
Function at 0x1000f357
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
lea edx, str.JHa_r_n
mov esi, 0xe
lea edi, [ebp - 0x28]
mov dword [0x10031444], 0x90d
mov dword [0x10031448], 0xb59
mov dword [esp], edi
mov dword [esp + 4], edx
mov dword [esp + 8], 0xe
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], esi
call fcn.1000fa7a
mov eax, dword [0x10031444]
add eax, 0x1da2
mov dword [0x10031448], eax
call fcn.1000f615
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
call fcn.1000f86e
xor ecx, ecx
cmp eax, 0
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], ecx
jne 0x1000f3e3
mov eax, dword [ebp - 0x40]
add esp, 0x50
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x3c]
mov dword [0x10031448], 0xc01
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [0x10031444], 0x1a95
mov dword [esp], eax
mov ecx, dword [ebp - 0x2c]
mov dword [esp + 4], ecx
mov dword [ebp - 0x44], eax
call fcn.1000f6b9
mov eax, dword [ebp - 0x44]
mov word [eax], 0x5a4d
add eax, 0x3c
mov dword [ebp - 0x48], eax
xor eax, eax
mov ecx, dword [ebp - 0x48]
mov dword [ecx], 0xc0
mov edx, dword [ebp - 0x44]
mov dword [edx + 0xc0], 0x4550
mov dword [0x10031448], 0x539
add edx, 0xffc00000
mov esi, dword [ebp - 0x30]
mov dword [esi + 0x30], edx
mov edx, dword [0x10031448]
add edx, 0xffffeed3
mov dword [0x10031448], edx
mov edx, dword [ebp - 0x44]
mov dword [esi + 0x20], edx
mov dword [0x10031444], 0x147
cmp edx, 0
mov dword [ebp - 0x40], eax
je 0x1000f3d9
mov dword [0x10031448], 0x1479
mov eax, dword [ebp - 0x44]
add eax, 0x11a2
mov dword [ebp - 0x40], eax
jmp 0x1000f3d9
Function at 0x1000fbde
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x1003144c], 0
mov dword [0x10031450], 0
mov dword [0x1003145c], 0
mov ebx, dword [0x10031444]
add ebx, 0x5f1
mov dword [0x10031444], ebx
cmp eax, 0
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov eax, edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], edi
jne 0x1000fc5f
mov eax, dword [0x10031448]
add eax, 0x221
mov dword [0x10031448], eax
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x14]
mov edi, 0x100
add ecx, 0x214e
mov dword [0x10031444], ecx
add edx, 1
mov dword [ebp - 0x30], eax
mov eax, edx
cdq
idiv edi
mov dword [0x1003144c], edx
mov dword [0x10031448], 0xe94
mov ecx, dword [ebp - 0x24]
movzx ebx, byte [ecx + edx]
add ebx, esi
mov eax, ebx
mov dword [ebp - 0x34], edx
cdq
idiv edi
mov dword [0x10031450], edx
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x10031454], cl
mov edi, dword [ebp - 0x24]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov dword [0x10031444], 0x20fe
mov cl, byte [0x10031454]
mov edx, dword [0x10031450]
mov byte [edi + edx], cl
mov edx, dword [0x1003144c]
movzx edx, byte [edi + edx]
mov ebx, dword [0x10031450]
movzx ebx, byte [edi + ebx]
add ebx, edx
and ebx, 0xff
mov dword [0x1003145c], ebx
mov dword [0x10031444], 0x211
mov cl, byte [edi + ebx]
mov edx, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x30]
mov ch, byte [edx + ebx]
mov byte [0x10031461], ch
mov byte [0x10031462], cl
mov dword [0x10031444], 0x1106
xor ch, cl
mov byte [0x10031460], ch
mov edx, dword [ebp - 0x20]
mov byte [edx + ebx], ch
add ebx, 1
mov edx, dword [ebp - 0x10]
cmp ebx, edx
mov dword [ebp - 0x38], ebx
je 0x1000fc48
mov eax, dword [0x10031444]
mov ecx, dword [0x1003144c]
mov edx, dword [0x10031450]
mov esi, dword [ebp - 0x38]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], esi
jmp 0x1000fc5f
Function at 0x1000fe1b
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [0x10031450], 0
mov byte [0x10031454], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
xor eax, eax
mov dword [0x10031444], 0x9b7
mov dword [0x1003144c], 0
mov dword [ebp - 0x1c], eax
jmp 0x1000ff36
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [0x10031458], 0
mov dword [0x10031448], 0xa70
mov edx, dword [0x10031450]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + eax]
add edi, edx
mov dword [ebp - 0x24], eax
xor edx, edx
mov ebx, dword [ebp - 0x10]
div ebx
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add edi, edx
mov dword [0x10031458], edi
mov dword [0x10031444], 0x2605
mov eax, edi
cdq
idiv ecx
mov dword [0x10031450], edx
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x24]
mov cl, byte [ecx + edi]
mov byte [0x10031454], cl
mov dword [0x10031448], 0x1d7f
mov ecx, dword [ebp - 0x18]
mov cl, byte [ecx + edx]
mov edx, dword [ebp - 0x18]
mov byte [edx + edi], cl
mov dword [0x10031444], 0x14bd
mov cl, byte [0x10031454]
mov edx, dword [0x10031450]
mov esi, dword [ebp - 0x18]
mov byte [esi + edx], cl
mov edx, dword [0x1003144c]
add edx, 1
mov dword [0x1003144c], edx
cmp edx, 0x100
mov dword [ebp - 0x20], edx
jl 0x1000fe65
jmp 0x1000ff68
xor eax, eax
mov dword [0x1003144c], 0
mov dword [ebp - 0x20], eax
jmp 0x1000fe65
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x10031444], 0x1a34
mov eax, dword [0x1003144c]
add eax, 1
mov dword [0x1003144c], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x1000ff36
jmp 0x1000ff22
mov dword [0x10031444], 0x20f6
mov dword [0x10031448], 0xbda
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1000ff84
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x5c
mov eax, dword [ebp + 8]
mov ecx, dword [0x10031444]
add ecx, 0x89f
mov dword [0x10031444], ecx
mov dword [0x10031448], 0x1fa4
mov dword [ebp - 0x10], eax
call fcn.1000ed17
mov ecx, eax
mov edx, dword [eax + 0x3c]
mov esi, ecx
add esi, edx
cmp dword [eax + edx], 0x4550
sete bl
mov byte [ebp - 0x11], bl
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], esi
xor eax, eax
mov cl, byte [ebp - 0x11]
test cl, 1
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], edx
jne 0x1000ffe9
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x78]
mov dword [0x10031444], 0xfffff354
mov ecx, dword [ebp - 0x18]
add ecx, dword [ecx + eax + 0x20]
mov edx, dword [ebp - 0x18]
mov esi, dword [edx + eax + 0x24]
mov dword [0x10031448], 0x1e93
mov edi, dword [edx + eax + 0x18]
cmp edi, 0
mov ebx, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], ebx
je 0x10010146
mov eax, 0xfffff354
xor ecx, ecx
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x30]
add edx, esi
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x3c]
xor esi, esi
mov edi, dword [ebp - 0x2c]
mov ebx, dword [edi + eax*4]
add edx, 0x89f
mov dword [0x10031444], edx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x58], esi
mov eax, dword [ebp - 0x58]
mov ecx, eax
mov edx, dword [ebp - 0x50]
add ecx, edx
mov esi, dword [ebp - 0x18]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x5d], bh
mov byte [ebp - 0x5e], cl
je 0x100100c8
mov eax, dword [ebp - 0x5c]
add eax, 1
mov cl, byte [ebp - 0x5d]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x5e]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x58], eax
jne 0x10010077
mov al, byte [ebp - 0x5e]
test al, 1
jne 0x10010101
jmp 0x100100d1
xor eax, eax
mov ecx, dword [ebp - 0x4c]
add ecx, 2
mov edx, dword [ebp - 0x48]
add edx, 1
mov esi, dword [ebp - 0x34]
cmp edx, esi
mov edi, dword [ebp - 0x54]
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x38], eax
jb 0x1001004b
jmp 0x10010146
mov eax, dword [ebp - 0x4c]
mov cx, word [eax]
mov edx, dword [ebp - 0x28]
add edx, 0x1c
movzx esi, cx
mov edi, dword [ebp - 0x18]
add edi, edx
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x68], edi
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x68]
add eax, dword [ecx]
mov dword [0x10031444], 0x5ea
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x64]
add edx, dword [eax + esi*4]
mov dword [0x10031448], 0x19e
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10010151
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [0x10031444]
add eax, 0xfffff2a7
mov dword [0x10031444], eax
mov dword [ebp - 0x10], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 0x10], eax
xor ecx, ecx
mov dword [0x10031448], 0x1944
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x10031444], 0x2173
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], ecx
jmp 0x100101c6
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x10], 0x6c
sete dl
mov byte [ebp - 0x21], dl
mov al, byte [ebp - 0x21]
test al, 1
jne 0x1001026d
jmp 0x100102b9
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], edx
je 0x100101f3
mov eax, dword [ebp - 0x28]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x2c], eax
jl 0x100101c6
mov eax, dword [ebp - 0x2c]
mov dword [0x10031448], 0x1341
mov dword [0x10031444], 0x356f
mov ecx, dword [ebp - 0x18]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x20], eax
jne 0x100102b9
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x18], 0x6f
jne 0x100102b9
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x100102b9
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x14], 0x64
jne 0x100102b9
mov dword [0x10031444], 0x8c1
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x12], 0x64
je 0x100101a3
jmp 0x100102b9
mov eax, 0xb8a
mov ecx, 0x23bc
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x20]
mov di, word [edx + esi*2 - 0xe]
cmp di, 0x6c
sete bl
cmp di, 0x6c
mov byte [ebp - 0x2d], bl
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], eax
je 0x100102a0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [0x10031444], eax
mov cl, byte [ebp - 0x2d]
and cl, 1
movzx eax, cl
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10001f83
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
xor esi, esi
mov ecx, dword [edi + 0x3c]
lea eax, [ecx + eax*8]
mov eax, dword [eax + edi + 0x78]
add eax, edi
mov ecx, dword [eax + 0x20]
mov ebx, dword [eax + 0x1c]
add ecx, edi
mov ebp, dword [eax + 0x24]
add ebx, edi
mov eax, dword [eax + 0x18]
add ebp, edi
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
test eax, eax
je 0x10001fdd
mov eax, dword [ecx + esi*4]
add eax, edi
push eax
push dword [esp + 0x24]
call fcn.10001f59
pop ecx
pop ecx
cmp eax, dword [esp + 0x1c]
je 0x10001fe4
mov ecx, dword [esp + 0x14]
inc esi
cmp esi, dword [esp + 0x18]
jb 0x10001fbb
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
movzx eax, word [ebp + esi*2]
mov eax, dword [ebx + eax*4]
add eax, edi
jmp 0x10001fdf

Function at 0x1000202f
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
push esi
push edi
mov edi, dword [eax + 0xc]
add edi, 0xc
mov esi, dword [edi]
jmp 0x10002052
push dword [esi + 0x30]
call fcn.10002091
pop ecx
cmp dword [esp + 0xc], eax
je 0x1000205b
mov esi, dword [esi]
cmp esi, edi
jne 0x10002041
xor eax, eax
pop edi
pop esi
ret
mov eax, dword [esi + 0x18]
jmp 0x10002058
Function at 0x1000c94b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10024b00]
jne 0x1000c955
repz ret
jmp fcn.1001366c

Function at 0x10017aa0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
invalid
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.100158cd
aaa
dec eax
cmp eax, 0x348b49db
mov eax, dword [ebx]
idiv dword [eax + 0x50746547]
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x10017aba
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x10017aba
call fcn.100158cd
push 0x1a
je 0x10017a68
pop edx
and al, 3
fbld tbyte [esi - 0x75]
or al, 0x4b
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax