joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50b57c
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x50b6a4
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, word [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.0050b468
mov eax, dword [esi]
call fcn.004086d4
add eax, 0x28
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x417780]
call fcn.00408888
add esp, 4
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1c]
mov ecx, 0x1c
call fcn.004046e0
mov ebx, 0x1c
mov eax, dword [ebp - 4]
lea edx, [eax + ebx]
lea eax, [ebp - 0x2c]
mov ecx, 0x1c
call fcn.004046e0
add ebx, 0x1c
mov eax, dword [esi]
call fcn.004086d4
mov dword [ebp - 0xc], eax
mov eax, dword [0x5a21a4]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
lea edx, [ebp - 4]
mov ecx, ebx
call fcn.004fa670
add ebx, 4
mov eax, dword [ebp - 4]
add eax, ebx
xor ecx, ecx
mov edx, 3
call fcn.00404ae4
add ebx, 3
mov eax, dword [ebp - 4]
mov byte [eax + ebx], 0x3a
inc ebx
mov eax, dword [esi]
mov byte [eax + 2], 0
mov eax, dword [esi]
mov byte [eax + 3], 0
push ebx
mov eax, dword [esi]
call fcn.004086d4
push eax
lea ecx, [ebp - 4]
mov eax, dword [esi]
xor edx, edx
call fcn.004fa64c
mov edx, dword [ebp - 4]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x98]
mov ebx, eax
mov eax, ebx
call fcn.004fa38c
mov edx, esi
mov ecx, dword [ebp + 0x10]
call fcn.004fa668
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50b6ab
lea eax, [ebp - 4]
mov edx, dword [0x417780]
call fcn.00408894
ret

Function at 0x535978
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
mov eax, ebx
mov edx, 0x10
call fcn.00407840
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
test eax, eax
je 0x53599d
sub eax, 4
mov eax, dword [eax]
mov dword [esp], eax
push esp
mov eax, dword [ebx]
call fcn.004076c4
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x5359bc
mov eax, ebx
mov edx, dword [esp]
call fcn.00407840
pop ecx
pop edx
pop ebx
ret
Function at 0x53c544
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, 0x59d1b0
test edx, edx
jne 0x53c563
xor eax, eax
jmp 0x53c681
mov dword [ebp - 4], 1
cmp byte [ebp - 4], 0
je 0x53c580
push esi
push edx
push eax
call fcn.0053c688
add esp, 0xc
jmp 0x53c681
push esi
push edx
push eax
call fcn.0053c948
add esp, 0xc
jmp 0x53c681
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x58747c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x58758d
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x58756a
push 0xa
mov eax, ebx
call fcn.004076c4
push eax
mov eax, dword [0x5a5c50]
push eax
call sub.kernel32.dll_FindResourceW
mov ebx, eax
push ebx
mov eax, dword [0x5a5c50]
push eax
call sub.kernel32.dll_LoadResource
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x587563
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x58754c
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_LockResource
mov esi, eax
xor eax, eax
push ebp
push 0x587545
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
mov eax, dword [0x5a5c50]
push eax
call sub.kernel32.dll_SizeofResource
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, esi
call fcn.004076fc
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.004077b8
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 8]
mov edx, ebx
call fcn.0044e8b4
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.004077a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58754c
mov eax, dword [ebp - 4]
call fcn.0040d628
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58756a
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_FreeResource
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x587594
lea eax, [ebp - 0x10]
call fcn.00406b24
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00406be4
ret
Function at 0x42e6f0
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x42e8b4
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1f000]
push edi
jmp 0x42e71a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x42e721
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x42e710
mov eax, 1
add ebx, ebx
jne 0x42e733
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x42e728
jne 0x42e744
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42e728
xor ecx, ecx
sub eax, 3
jb 0x42e758
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42e7ca
mov ebp, eax
add ebx, ebx
jne 0x42e763
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x42e770
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x42e794
inc ecx
add ebx, ebx
jne 0x42e780
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x42e775
jne 0x42e791
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42e775
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x42e7b4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x42e7a5
jmp 0x42e716
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42e7b4
add edi, ecx
jmp 0x42e716
pop esi
mov edi, esi
mov ecx, 0x63d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x42e7d2
cmp byte [edi], 5
jne 0x42e7d2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x42e7d7
lea edi, [esi + 0x28000]
mov eax, dword [edi]
or eax, eax
je 0x42e846
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2e4fc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2e5c4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x42e804
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2e5c8]
or eax, eax
je 0x42e840
mov dword [ebx], eax
add ebx, 4
jmp 0x42e821
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x42e877
cmp al, 0xef
ja 0x42e86a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x42e84c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x42e859
mov ebp, dword [esi + 0x2e5cc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42e8ab
sub esp, 0xffffff80
jmp 0x41cdd8
Function at 0x1f8a7413
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor edx, 0x61b0
jmp 0x1f8a7425
pop edx
push edx
xor edx, 0x8bfb
xor edx, 0x2f5a
pop edx
mov eax, dword [ebp - 0x196c]
add eax, 0xfe
imul ecx, dword [ebp - 0x1968], 0xfe
add ecx, 0x56f3663b
imul edx, dword [ebp - 0x1968], 0xfe
sub ecx, edx
xor eax, ecx
imul eax, dword [ebp - 0x1968]
mov dword [ebp - 0x2520], eax
mov eax, dword [ebp - 0x2520]
mov dword [ebp - 0x2528], eax
mov ecx, dword [ebp - 0x2524]
cmp ecx, dword [ebp - 0x2528]
jae 0x1f8a7490
mov dword [ebp - 0x18d8], 1
jmp 0x1f8a749a
mov dword [ebp - 0x18d8], 0
mov dl, byte [ebp - 0x18d8]
mov byte [ebp - 0x45a], dl
movzx eax, byte [ebp - 0x45a]
test eax, eax
je 0x1f8aa50d
push ecx
push ecx
add esp, 4
and ecx, 0xf303
jmp 0x1f8a74c7
call 0x1f8a74d5
add byte [esi + edi + 0x3f], al
xor eax, 0x49484032
add esp, 4
add ecx, 0x19dd
pop ecx
push ecx
sub ecx, 0x15e0e
pop ecx
push ebx
push eax
add esp, 4
jmp 0x1f8a74f1
and ebx, 0x1444
pop ebx
push esi
push edi
add esp, 4
and esi, 0x163ed
and esi, 0xdd17
jmp 0x1f8a7512
xor esi, 0x7038
pop esi
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x484], 0
call 0x1f8aa51c
mov eax, 0x13379797
pop eax
mov dword [ebp - 0x484], eax
push ebx
push eax
add esp, 4
xor ebx, 0xcf8f
jmp 0x1f8aa538
pop ebx
push edx
push esi
add esp, 4
invalid
Function at 0x1f8aa5ce
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x26d4]
add eax, dword [ebp - 0x18f4]
mov dword [ebp - 0x484], eax
mov ecx, 0x6b
mov word [ebp - 0xda4], cx
mov edx, 0x65
mov word [ebp - 0xda2], dx
mov eax, 0x72
mov word [ebp - 0xda0], ax
mov ecx, 0x6e
mov word [ebp - 0xd9e], cx
mov edx, 0x65
mov word [ebp - 0xd9c], dx
mov eax, 0x6c
mov word [ebp - 0xd9a], ax
mov ecx, 0x33
mov word [ebp - 0xd98], cx
mov edx, 0x32
mov word [ebp - 0xd96], dx
mov eax, 0x2e
mov word [ebp - 0xd94], ax
mov ecx, 0x64
mov word [ebp - 0xd92], cx
mov edx, 0x6c
mov word [ebp - 0xd90], dx
mov eax, 0x6c
mov word [ebp - 0xd8e], ax
xor ecx, ecx
mov word [ebp - 0xd8c], cx
push edx
push edi
add esp, 4
sub edx, 0x10b26
xor edx, 0xa7d0
pop edx
push ebx
call 0x1f8aa69b
add byte [ecx + 0x35], cl
cmp byte [eax + 0x49], al
push eax
cmp dword [edi], esi
add esp, 4
sub ebx, 0x10e27
xor ebx, 0x832e
pop ebx
mov byte [ebp - 0xdf4], 0x52
mov byte [ebp - 0xdf3], 0xb9
mov byte [ebp - 0xdf2], 0x10
mov byte [ebp - 0xdf1], 0x10
mov byte [ebp - 0xdf0], 0x10
call dword [eax]
mov byte [ebp - 0xdef], 0x10
mov byte [ebp - 0xdee], 0x5a
push ecx
xor ecx, 0xaa13
pop ecx
push eax
push eax
add esp, 4
and eax, 0x839a
or eax, 0x409e
sub eax, 0x14342
pop eax
push ebx
push ebx
add esp, 4
or ebx, 0x167b
and ebx, 0xef49
pop ebx
mov byte [ebp - 0xdec], 0x52
mov byte [ebp - 0xdeb], 0xb9
mov byte [ebp - 0xdea], 0x20
mov byte [ebp - 0xde9], 0x20
mov byte [ebp - 0xde8], 0x20
mov byte [ebp - 0xde7], 0x20
mov byte [ebp - 0xde6], 0x5a
push edi
jmp 0x1f8aa749
add edi, 0x808b
xor edi, 0x17eb7
pop edi
push edi
push eax
add esp, 4
and edi, 0x16cf2
and edi, 0x92ba
jmp 0x1f8aa770
pop edi
mov dword [ebp - 0x27c8], 0xe
push ebx
push eax
add esp, 4
jmp 0x1f8aa789
and ebx, 0x11ed3
or ebx, 0x102b6
add dword [eax], eax
xor ebx, 0x61a8
pop ebx
push esi
jmp 0x1f8aa7a6
sub esi, 0x90be
pop esi
mov edx, 1
imul eax, edx, 0
lea ecx, [ebp + eax - 0xdf4]
mov dword [ebp - 0x18f8], ecx
push ebx
push edi
add esp, 4
and ebx, 0xabc7
add byte [ebx + 0x52], bl
Function at 0x1f8aa69b
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x26d4]
add eax, dword [ebp - 0x18f4]
mov dword [ebp - 0x484], eax
mov ecx, 0x6b
mov word [ebp - 0xda4], cx
mov edx, 0x65
mov word [ebp - 0xda2], dx
mov eax, 0x72
mov word [ebp - 0xda0], ax
mov ecx, 0x6e
mov word [ebp - 0xd9e], cx
mov edx, 0x65
mov word [ebp - 0xd9c], dx
mov eax, 0x6c
mov word [ebp - 0xd9a], ax
mov ecx, 0x33
mov word [ebp - 0xd98], cx
mov edx, 0x32
mov word [ebp - 0xd96], dx
mov eax, 0x2e
mov word [ebp - 0xd94], ax
mov ecx, 0x64
mov word [ebp - 0xd92], cx
mov edx, 0x6c
mov word [ebp - 0xd90], dx
mov eax, 0x6c
mov word [ebp - 0xd8e], ax
xor ecx, ecx
mov word [ebp - 0xd8c], cx
push edx
push edi
add esp, 4
sub edx, 0x10b26
xor edx, 0xa7d0
pop edx
push ebx
call 0x1f8aa69b
add byte [ecx + 0x35], cl
cmp byte [eax + 0x49], al
push eax
cmp dword [edi], esi
add esp, 4
sub ebx, 0x10e27
xor ebx, 0x832e
pop ebx
mov byte [ebp - 0xdf4], 0x52
mov byte [ebp - 0xdf3], 0xb9
mov byte [ebp - 0xdf2], 0x10
mov byte [ebp - 0xdf1], 0x10
mov byte [ebp - 0xdf0], 0x10
call dword [eax]
mov byte [ebp - 0xdef], 0x10
mov byte [ebp - 0xdee], 0x5a
push ecx
xor ecx, 0xaa13
pop ecx
push eax
push eax
add esp, 4
and eax, 0x839a
or eax, 0x409e
sub eax, 0x14342
pop eax
push ebx
push ebx
add esp, 4
or ebx, 0x167b
and ebx, 0xef49
pop ebx
mov byte [ebp - 0xdec], 0x52
mov byte [ebp - 0xdeb], 0xb9
mov byte [ebp - 0xdea], 0x20
mov byte [ebp - 0xde9], 0x20
mov byte [ebp - 0xde8], 0x20
mov byte [ebp - 0xde7], 0x20
mov byte [ebp - 0xde6], 0x5a
push edi
jmp 0x1f8aa749
add edi, 0x808b
xor edi, 0x17eb7
pop edi
push edi
push eax
add esp, 4
and edi, 0x16cf2
and edi, 0x92ba
jmp 0x1f8aa770
pop edi
mov dword [ebp - 0x27c8], 0xe
push ebx
push eax
add esp, 4
jmp 0x1f8aa789
and ebx, 0x11ed3
or ebx, 0x102b6
add dword [eax], eax
xor ebx, 0x61a8
pop ebx
push esi
jmp 0x1f8aa7a6
sub esi, 0x90be
pop esi
mov edx, 1
imul eax, edx, 0
lea ecx, [ebp + eax - 0xdf4]
mov dword [ebp - 0x18f8], ecx
push ebx
push edi
add esp, 4
and ebx, 0xabc7
add byte [ebx + 0x52], bl
Function at 0x1f8aadd3
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x5cc]
add eax, 1
mov dword [ebp - 0x5cc], eax
add esp, 4
pop edi
push ebx
xor ebx, 0x15f76
and ebx, 0x1805b
pop ebx
mov ecx, dword [ebp - 0xc28]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0xc24]
movzx ecx, byte [eax]
cmp edx, ecx
jle 0x1f8aae07
mov dword [ebp - 0x18d0], 1
jmp 0x1f8aae11
mov dword [ebp - 0x18d0], 0xffffffff
mov edx, dword [ebp - 0x18d0]
mov dword [ebp - 0xea4], edx
jmp 0x1f8aae83
mov eax, dword [ebp - 0xea4]
mov dword [ebp - 0x1908], eax
cmp dword [ebp - 0x1908], 0
jne 0x1f8aaed8
push ecx
and ecx, 0x1937
or ecx, 0x93f0
add ecx, 0x18102
pop ecx
push eax
or eax, 0x7c9
pop eax
push ebx
or ebx, 0xd851
pop ebx
push ebx
and ebx, 0xec42
or ebx, 0x51e9
pop ebx
mov ecx, dword [ebp - 0x5cc]
mov dword [ebp - 0xc20], ecx
jmp 0x1f8aaf19
jmp 0x1f8aac26
Function at 0x1f8ab668
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ecx
xor ecx, 0x2229
jmp 0x1f8ab646
and ecx, 0x52ce
pop ecx
push ecx
and ecx, 0x14093
or ecx, 0x1beb
call fcn.1f8ab668
add byte [ecx + 0x46], cl
xor al, 0x4b
cmp byte [edi + 0x33], al
cmp al, byte [ebx - 0x72a6fb3c]
add esp, 4
pop ecx
lea eax, [ebp - 0x1b38]
mov dword [ebp - 0xeb8], eax
invalid
lea ebp, [edx + edi*8]
invalid
add esp, 4
pop ecx
lea eax, [ebp - 0x1b38]
mov dword [ebp - 0xeb8], eax
mov ecx, dword [ebp - 0x5d4]
dec dword [ebx - 0x6a76cfaf]
dec esp
int1
invalid
push dword [ebx]
shl byte [esi - 0x77], 0x85
invalid
std
invalid
push dword [ebx]
leave
mov word [ebp - 0x13c], cx
mov dword [ebp - 0x13c], ecx
push edx
push edi
add esp, 4
or edx, 0xe480
call 0x1f8ab6b2

Function at 0x1f8ab67d
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
dec dword [ebx - 0x6a76cfaf]
dec esp
int1
invalid

Function at 0x1f8ab693
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ecx
xor ecx, 0x2229
jmp 0x1f8ab646
and ecx, 0x52ce
pop ecx
push ecx
and ecx, 0x14093
or ecx, 0x1beb
call fcn.1f8ab668
add byte [ecx + 0x46], cl
xor al, 0x4b
cmp byte [edi + 0x33], al
cmp al, byte [ebx - 0x72a6fb3c]
add esp, 4
pop ecx
lea eax, [ebp - 0x1b38]
mov dword [ebp - 0xeb8], eax
invalid
lea ebp, [edx + edi*8]
invalid
add esp, 4
pop ecx
lea eax, [ebp - 0x1b38]
mov dword [ebp - 0xeb8], eax
mov ecx, dword [ebp - 0x5d4]
dec dword [ebx - 0x6a76cfaf]
dec esp
int1
invalid
push dword [ebx]
shl byte [esi - 0x77], 0x85
invalid
std
invalid
push dword [ebx]
leave
mov word [ebp - 0x13c], cx
mov dword [ebp - 0x13c], ecx
push edx
push edi
add esp, 4
or edx, 0xe480
call 0x1f8ab6b2

Function at 0x1f8ab6a9
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [ebx + 0x4a], cl
aaa
dec edi
inc esi
dec esp
aaa
add esp, 4
call 0x1f8ab6c1
add byte [ebx], dh
cmp dword [ecx + ecx*2], esi
cmp al, 0x4e
add esp, 4
or edx, 0x25f8
pop edx
mov edx, dword [ebp - 0xeb4]
mov ax, word [edx]
mov eax, dword [edx]
mov word [ebp - 0x12ca], ax
mov ecx, dword [ebp - 0xeb4]
add ecx, 2
mov dword [ebp - 0xeb4], ecx
mov dx, word [ebp - 0x12ca]
mov word [ebp - 0x274], dx
invalid
invalid
dec eax

Function at 0x1f8ab6b2
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [ebx + 0x4a], cl
aaa
dec edi
inc esi
dec esp
aaa
add esp, 4
call 0x1f8ab6c1
add byte [ebx], dh
cmp dword [ecx + ecx*2], esi
cmp al, 0x4e
add esp, 4
or edx, 0x25f8
pop edx
mov edx, dword [ebp - 0xeb4]
mov ax, word [edx]
mov eax, dword [edx]
mov word [ebp - 0x12ca], ax
mov ecx, dword [ebp - 0xeb4]
add ecx, 2
mov dword [ebp - 0xeb4], ecx
mov dx, word [ebp - 0x12ca]
mov word [ebp - 0x274], dx
invalid
invalid
dec eax
Function at 0x1f8ab6c1
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [ebx + 0x4a], cl
aaa
dec edi
inc esi
dec esp
aaa
add esp, 4
call 0x1f8ab6c1
add byte [ebx], dh
cmp dword [ecx + ecx*2], esi
cmp al, 0x4e
add esp, 4
or edx, 0x25f8
pop edx
mov edx, dword [ebp - 0xeb4]
mov ax, word [edx]
mov eax, dword [edx]
mov word [ebp - 0x12ca], ax
mov ecx, dword [ebp - 0xeb4]
add ecx, 2
mov dword [ebp - 0xeb4], ecx
mov dx, word [ebp - 0x12ca]
mov word [ebp - 0x274], dx
invalid
invalid
dec eax

Function at 0x1f8ab7de
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 0x13c], ecx
movzx edx, word [ebp - 0x274]
movzx eax, word [ebp - 0x13c]
sub edx, eax
mov dword [ebp - 0x1920], edx
jmp 0x1f8ab7dd
movzx ecx, word [ebp - 0x274]
movzx edx, word [ebp - 0x13c]
cmp ecx, edx
je 0x1f8ab699
movzx eax, word [ebp - 0x274]
xor eax, 0x20
movzx ecx, word [ebp - 0x13c]
invalid
movzx edx, word [ebp - 0x274]
movzx eax, word [ebp - 0x13c]
cmp edx, eax
jge 0x1f8ab7c7
mov dword [ebp - 0x191c], 0xffffffff
jmp 0x1f8ab7d1
mov dword [ebp - 0x191c], 1
mov ecx, dword [ebp - 0x191c]
mov dword [ebp - 0x1920], ecx
cmp dword [ebp - 0x1920], 0
jne 0x1f8ab826
push esi
push esi
add esp, 4
xor esi, 0x60ad
sub esi, 0x141af
add esi, 0x143d8
sub esi, 0x5903
pop esi
push edi
call 0x1f8ab814
add byte [ebx + 0x42], cl
push eax
inc edi
cmp eax, 0x374c333c
add esp, 4
pop edi
mov edx, dword [ebp - 0x5d4]
mov dword [ebp - 0x888], edx
jmp 0x1f8ab88e
push ecx
sub ecx, 0xcf72
add ecx, 0x13091
xor ecx, 0x11ec
pop ecx
push ecx
push ebx
add esp, 4
and ecx, 0x13323
jmp 0x1f8ab84a
pop ecx
push ebx
push ecx
add esp, 4
jmp 0x1f8ab857
pop ebx
mov eax, dword [ebp - 0x5d4]
mov ecx, dword [eax]
mov dword [ebp - 0x5d4], ecx
invalid
xchg ebp, eax
sub al, 0xfa
invalid

Function at 0x1f8ab814
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 0x13c], ecx
movzx edx, word [ebp - 0x274]
movzx eax, word [ebp - 0x13c]
sub edx, eax
mov dword [ebp - 0x1920], edx
jmp 0x1f8ab7dd
movzx ecx, word [ebp - 0x274]
movzx edx, word [ebp - 0x13c]
cmp ecx, edx
je 0x1f8ab699
movzx eax, word [ebp - 0x274]
xor eax, 0x20
movzx ecx, word [ebp - 0x13c]
invalid
movzx edx, word [ebp - 0x274]
movzx eax, word [ebp - 0x13c]
cmp edx, eax
jge 0x1f8ab7c7
mov dword [ebp - 0x191c], 0xffffffff
jmp 0x1f8ab7d1
mov dword [ebp - 0x191c], 1
mov ecx, dword [ebp - 0x191c]
mov dword [ebp - 0x1920], ecx
cmp dword [ebp - 0x1920], 0
jne 0x1f8ab826
push esi
push esi
add esp, 4
xor esi, 0x60ad
sub esi, 0x141af
add esi, 0x143d8
sub esi, 0x5903
pop esi
push edi
call 0x1f8ab814
add byte [ebx + 0x42], cl
push eax
inc edi
cmp eax, 0x374c333c
add esp, 4
pop edi
mov edx, dword [ebp - 0x5d4]
mov dword [ebp - 0x888], edx
jmp 0x1f8ab88e
push ecx
sub ecx, 0xcf72
add ecx, 0x13091
xor ecx, 0x11ec
pop ecx
push ecx
push ebx
add esp, 4
and ecx, 0x13323
jmp 0x1f8ab84a
pop ecx
push ebx
push ecx
add esp, 4
jmp 0x1f8ab857
pop ebx
mov eax, dword [ebp - 0x5d4]
mov ecx, dword [eax]
mov dword [ebp - 0x5d4], ecx
invalid
xchg ebp, eax
sub al, 0xfa
invalid
Function at 0x1f8ac253
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x8a0]
add eax, 1
mov dword [ebp - 0x8a0], eax
mov ecx, dword [ebp - 0x89c]
mov edx, dword [ebp - 0x8a0]
cmp edx, dword [ecx + 0x18]
jae 0x1f8ac42f
mov eax, dword [ebp - 0x8a0]
mov ecx, dword [ebp - 0x2724]
mov edx, dword [ebp - 0x3d4]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x8a4], edx
mov eax, dword [ebp - 0x8a0]
mov ecx, dword [ebp - 0x2728]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x272c]
mov ecx, dword [ebp - 0x3d4]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x1fa4], ecx
mov dword [ebp - 0x1e4], 0
jmp 0x1f8ac293
mov edx, dword [ebp - 0x1e4]
add edx, 1
mov dword [ebp - 0x1e4], edx
mov eax, dword [ebp - 0x8a4]
add eax, dword [ebp - 0x1e4]
movsx ecx, byte [eax]
test ecx, ecx
je 0x1f8ac345
mov edx, dword [ebp - 0x1e4]
movsx eax, byte [ebp + edx - 0x9d8]
test eax, eax
je 0x1f8ac345
push esi
push ebx
add esp, 4
and esi, 0x1659b
add esi, 0x64a1
jmp 0x1f8ac2d9
call 0x1f8ac2e7
add byte [ebx + 0x3d], cl
xor eax, dword [ecx + 0x3c]
inc edi
dec eax
dec esi
add esp, 4
pop esi
push ecx
jmp 0x1f8ac2f1
pop ecx
mov ecx, dword [ebp - 0x8a4]
add ecx, dword [ebp - 0x1e4]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x1e4]
movsx ecx, byte [ebp + eax - 0x9d8]
cmp edx, ecx
je 0x1f8ac337
mov edx, dword [ebp - 0x8a4]
add edx, dword [ebp - 0x1e4]
movsx eax, byte [edx]
xor eax, 0x20
mov ecx, dword [ebp - 0x1e4]
movsx edx, byte [ebp + ecx - 0x9d8]
cmp eax, edx
jne 0x1f8ac33e
jmp 0x1f8ac284
jmp 0x1f8ac345
push ebx
push esi
add esp, 4
xor ebx, 0xe7b0
xor ebx, 0x4b0b
xor ebx, 0x127cd
xor ebx, 0x2268
pop ebx
push ebx
or ebx, 0xff20
add ebx, 0xbffe
or ebx, 0xe819
pop ebx
mov eax, dword [ebp - 0x8a4]
add eax, dword [ebp - 0x1e4]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x1e4]
movsx eax, byte [ebp + edx - 0x9d8]
cmp ecx, eax
jne 0x1f8ac3a4
mov dword [ebp - 0xed0], 0
jmp 0x1f8ac413
push ecx
push edx
add esp, 4
add ecx, 0x7295
call fcn.1f8ac3bb
add byte [esi + 0x3d], cl
xor eax, 0x833f3f40
add esp, 4
call 0x1f8ac3cc
add byte [edi + 0x4d], al
cmp edx, dword [eax + 0x3b]
cmp byte ds:[eax], bh
add esp, 4
or ecx, 0xf839
pop ecx
mov ecx, dword [ebp - 0x8a4]
add ecx, dword [ebp - 0x1e4]
movsx edx, byte [ecx]
or edx, 0x20
mov eax, dword [ebp - 0x1e4]
movsx ecx, byte [ebp + eax - 0x9d8]
or ecx, 0x20
cmp edx, ecx
jge 0x1f8ac409
mov dword [ebp - 0xed0], 0xffffffff
jmp 0x1f8ac413
mov dword [ebp - 0xed0], 1
cmp dword [ebp - 0xed0], 0
jne 0x1f8ac42a
mov edx, dword [ebp - 0x1fa4]
mov dword [ebp - 0x5dc], edx
jmp 0x1f8ac43b
jmp 0x1f8ac214
mov eax, dword [ebp - 0x8a8]
mov dword [ebp - 0x5dc], eax
mov ecx, dword [ebp - 0x5dc]
mov dword [ebp - 0x8d4], ecx
push edx
xor edx, 0x1498f
add edx, 0xa497
xor edx, 0x3e48
jmp 0x1f8ac461
pop edx
push ebx
push edx
add esp, 4
jmp 0x1f8ac46c
sub ebx, 0x10d0e
xor ebx, 0x12d79
pop ebx
mov edx, dword [ebp - 0x494]
add edx, 0xe
mov dword [ebp - 0x1ff0], edx
push edx
push ecx
add esp, 4
call 0x1f8ac49c
add byte [eax + 0x32], dl
cmp eax, 0x443c3a45
xor bh, byte [ecx]
add esp, 4
add edx, 0xf30e
pop edx
push edi
add edi, 0x1007a
xor edi, 0x184db
add edi, 0x11a60