joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100383b0
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x10052004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
push ebx
push ebx
push ebx
push esi
mov dword [ebp - 0x214], eax
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_SetFilePointer]
test eax, eax
jne 0x10038404
push ebx
lea eax, [ebp - 0x20c]
mov edi, 0x200
push eax
push edi
lea eax, [ebp - 0x208]
push eax
push esi
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_ReadFile]
test eax, eax
jne 0x10038418
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov ecx, eax
call fcn.10004c0d
mov edi, eax
jmp 0x10038599
cmp dword [ebp - 0x20c], edi
je 0x1003842a
mov edi, 0x800300fb
jmp 0x10038599
lea ecx, [ebp - 0x208]
call fcn.1000aa30
mov edi, eax
test edi, edi
js 0x10038599
xor edx, edx
lea ecx, [ebp - 0x210]
inc edx
call fcn.10006be6
mov edi, eax
test edi, edi
js 0x10038599
push 0x40
pop ecx
call fcn.100057a2
test eax, eax
je 0x10038472
push dword [ebp - 0x210]
mov ecx, eax
call fcn.1001109f
mov ebx, eax
test ebx, ebx
jne 0x10038480
mov edi, 0x80030008
jmp 0x10038583
push 0
push 0
mov ecx, ebx
call fcn.100110fa
mov edi, eax
test edi, edi
js 0x10038573
push esi
mov ecx, ebx
call fcn.1003a208
mov edi, eax
test edi, edi
js 0x10038573
lea eax, [ebp - 0x218]
mov ecx, ebx
push eax
push 1
push 0x40
pop edx
call fcn.10003c10
mov edi, eax
test edi, edi
js 0x10038573
lea eax, [ebp - 0x21c]
mov ecx, ebx
push eax
push 0x40
pop edx
call fcn.1000968c
mov edi, eax
test edi, edi
js 0x10038563
mov eax, dword [ebp - 0x1d8]
xor edx, edx
movzx ecx, word [ebp - 0x1ea]
inc eax
call fcn.10028ac0
mov esi, dword [ebx]
lea ecx, [ebp - 0x20c]
push ecx
push 0x80
lea ecx, [ebp - 0x208]
push ecx
mov ecx, dword [esi + 0xc]
push edx
push eax
push ebx
call dword [0x100532e8]
call dword [esi + 0xc]
mov edi, eax
test edi, edi
js 0x10038553
cmp dword [ebp - 0x20c], 0x80
je 0x10038531
mov edi, 0x8003001e
jmp 0x10038553
cmp byte [ebp - 0x1c6], 5
je 0x10038541
mov edi, 0x80030109
jmp 0x10038553
mov edi, dword [ebp - 0x214]
lea esi, [ebp - 0x1b8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor edi, edi
push dword [ebp - 0x21c]
mov ecx, ebx
push 0x40
pop edx
call fcn.1002227f
push dword [ebp - 0x218]
mov ecx, ebx
push 0x40
pop edx
call fcn.1000adbc
mov eax, dword [ebx]
push ebx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x100532e8]
call esi
mov ecx, dword [ebp - 0x210]
push ecx
mov eax, dword [ecx]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x100532e8]
call esi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100281a0
mov esp, ebp
pop ebp
ret 8
Function at 0x1003d2dc
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 8], eax
xor esi, esi
push esi
neg eax
mov dword [ebp - 0xc], 0xc
push 0x80
mov edi, ecx
mov dword [ebp - 4], esi
push 4
sbb eax, eax
lea ecx, [ebp - 0xc]
and eax, ecx
push eax
push esi
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_CreateFileW]
mov dword [edi + 0x28], eax
cmp eax, 0xffffffff
jne 0x1003d332
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov ecx, eax
call fcn.10004c0d
jmp 0x1003d35b
push eax
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_SetEndOfFile]
test eax, eax
je 0x1003d323
mov dword [edi + 0x238], esi
mov esi, 0x10001cc0
mov dword [edi + 0x2c], 1
add edi, 0x23c
xor eax, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x1003ebd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
mov byte [ebp - 0x6a6], 9
mov byte [ebp - 0x6a5], 0xb
mov byte [ebp - 0x6a4], 0x16
mov byte [ebp - 0x6a3], 0x1d
mov byte [ebp - 0x6a2], 0x64
lea eax, [ebp - 0x6b8]
push eax
call fcn.1003ded6
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1003de8b
add esp, 0xc
mov dword [ebp - 0x690], eax
mov byte [ebp - 0x6a0], 0x8b
or byte [ebp - 0x69f], 0xff
mov byte [ebp - 0x69e], 0x55
mov byte [ebp - 0x69d], 0x8b
mov byte [ebp - 0x69c], 0xec
lea eax, [ebp - 0x694]
push eax
push 5
lea eax, [ebp - 0x6a0]
push eax
push dword [ebp - 0x33c]
push 0xffffffffffffffff
call dword [ebp - 0x690]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x6c0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x6bc], eax
push 0x1000
invalid

Function at 0x1004273b
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x10052004]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
mov eax, edx
mov ebx, ecx
push esi
push edi
xor edi, edi
mov dword [esp + 0x18], eax
mov dword [eax], edi
mov ecx, 0x800
mov eax, dword [ebp + 8]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ecx
mov dword [eax], edi
jmp 0x10042778
mov ebx, dword [esp + 0x14]
mov esi, dword [fcn.10004ca0]
push ecx
push edi
push dword [0x10052460]
mov ecx, esi
call dword [0x100532e8]
call esi
mov esi, eax
test esi, esi
je 0x1004283c
mov eax, dword [esp + 0x10]
push 0x16
add eax, 0xfffffffe
push eax
push esi
lea eax, [esp + 0x28]
push eax
push ebx
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov ebx, eax
test ebx, ebx
jns 0x100427dd
push esi
mov esi, dword [0x10052018]
mov ecx, esi
push edi
push dword [0x10052460]
call dword [0x100532e8]
call esi
mov ecx, dword [esp + 0x10]
mov esi, edi
add ecx, ecx
mov dword [esp + 0x10], ecx
jmp 0x100427e1
mov ecx, dword [esp + 0x10]
cmp ebx, 0x80000005
je 0x10042774
cmp ebx, 0xc0000023
je 0x10042774
test ebx, ebx
js 0x10042831
cmp dword [esp + 0x20], edi
jne 0x10042820
push esi
mov esi, dword [0x10052018]
mov ecx, esi
push edi
push dword [0x10052460]
call dword [0x100532e8]
call esi
mov eax, dword [esp + 0x18]
mov dword [eax], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
jmp 0x10042841
mov eax, dword [esp + 0x18]
mov ecx, dword [ebp + 8]
mov dword [eax], esi
mov eax, dword [esp + 0x1c]
mov dword [ecx], eax
jmp 0x10042841
mov ecx, ebx
call fcn.100213df
mov edi, eax
jmp 0x10042841
mov edi, 0x80030008
mov ecx, dword [esp + 0x24]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100281a0
mov esp, ebp
pop ebp
ret 8
Function at 0x100429ff
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov esi, 0x80004005
push 0x212
mov dword [ebp - 4], edi
call dword [sym.imp.api_ms_win_core_com_l1_1_1.dll_CoTaskMemAlloc]
mov ebx, eax
test ebx, ebx
jne 0x10042a2f
mov esi, 0x80030008
jmp 0x10042af6
push 9
push 0x212
push ebx
lea eax, [ebp - 0xc]
push eax
push dword [edi + 0x40]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
jns 0x10042a67
cmp eax, 0x80000005
jne 0x10042a59
mov esi, 0x80010135
jmp 0x10042aef
mov ecx, eax
call fcn.100213df
mov esi, eax
jmp 0x10042aef
mov eax, dword [ebx]
test eax, eax
jne 0x10042a74
mov esi, 0x800300fb
jmp 0x10042aef
add eax, 6
push eax
call dword [sym.imp.api_ms_win_core_com_l1_1_1.dll_CoTaskMemAlloc]
mov edi, eax
test edi, edi
jne 0x10042a8b
mov esi, 0x80030008
jmp 0x10042aef
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x30]
push eax
call dword [sym.imp.api_ms_win_core_string_l2_1_0.dll_IsCharAlphaW]
test eax, eax
je 0x10042ab9
mov eax, dword [ebp - 4]
push 0x3a
mov ax, word [eax + 0x30]
mov word [edi], ax
pop eax
mov word [edi + 2], ax
xor eax, eax
push 2
mov word [edi + 4], ax
pop ecx
jmp 0x10042ac8
push 0x5c
pop eax
mov word [edi], ax
xor ecx, ecx
xor eax, eax
inc ecx
mov word [edi + 2], ax
push dword [ebx]
lea eax, [ebx + 4]
mov dword [ebp - 4], ecx
push eax
lea eax, [edi + ecx*2]
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebx]
add esp, 0xc
shr eax, 1
add eax, dword [ebp - 4]
xor ecx, ecx
mov word [edi + eax*2], cx
mov eax, dword [ebp + 8]
mov dword [eax], edi
push ebx
call dword [sym.imp.api_ms_win_core_com_l1_1_1.dll_CoTaskMemFree]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10043011
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x10052004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 4
push 0x28
lea eax, [ebp - 0x30]
xor esi, esi
push eax
lea eax, [ebp - 0x38]
push eax
push ecx
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
jns 0x10043048
mov ecx, eax
call fcn.100213df
mov esi, eax
jmp 0x10043054
test dword [ebp - 0x10], 0x1000
jne 0x10043054
xor esi, esi
inc esi
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.100281a0
mov esp, ebp
pop ebp
ret
Function at 0x10043696
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x23c
mov eax, dword [0x10052004]
xor eax, esp
mov dword [esp + 0x238], eax
or dword [esp], 0xffffffff
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
and dword [esp + 0x18], ebx
lea ecx, [esp + 0x38]
push 0x10003498
mov dword [esp + 0x14], esi
call fcn.100491d0
cmp dword [esi + 0x44], 0xffffffff
jne 0x10043793
mov edi, dword [ebp + 8]
test edi, edi
jne 0x10043748
test byte [esi + 0x2c], 3
jne 0x10043748
mov ecx, dword [esi + 0x40]
cmp ecx, 0xffffffff
je 0x10043748
and dword [esp + 0x1c], ebx
lea eax, [esp + 0x14]
and dword [esp + 0x14], ebx
lea edx, [esp + 0x1c]
push ecx
push eax
call fcn.1004273b
test eax, eax
js 0x10043748
mov ebx, dword [esp + 0x1c]
mov ecx, ebx
call fcn.10042ed0
mov dword [esp + 0x14], eax
test ebx, ebx
je 0x10043740
mov esi, dword [0x10052018]
mov ecx, esi
push ebx
push edi
push dword [0x10052460]
call dword [0x100532e8]
call esi
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x10043748
xor ebx, ebx
jmp 0x10043793
mov eax, dword [esi + 0x2c]
test edi, edi
jne 0x10043758
test al, 3
je 0x10043758
or eax, 0x1000
lea ecx, [esp + 0xc]
push ecx
push edi
push 1
push eax
lea eax, [esp + 0x48]
mov ecx, esi
push eax
call fcn.1004384e
mov ebx, eax
cmp ebx, 0x80030002
jne 0x100437ac
test edi, edi
jne 0x10043783
test byte [esi + 0x2c], 3
jne 0x10043783
xor ebx, ebx
mov eax, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x10043793
push eax
call dword [sym.imp.ntdll.dll_NtClose]
mov ecx, dword [esp + 0x244]
mov eax, ebx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100281a0
mov esp, ebp
pop ebp
ret 4
test ebx, ebx
js 0x10043783
push 6
pop ecx
xor eax, eax
lea edi, [esp + 0x20]
push eax
rep stosd dword es:[edi], eax
lea eax, [esp + 0x1c]
push eax
push 0x18
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x1c]
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_ReadFile]
test eax, eax
jne 0x100437f1
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov ebx, eax
mov eax, dword [esp + 0xc]
test ebx, ebx
jle 0x10043787
movzx ebx, bx
or ebx, 0x80070000
jmp 0x10043787
cmp dword [esp + 0x18], 0x18
jne 0x10043820
xor eax, eax
cmp ax, word [esp + 0x20]
je 0x1004380b
mov ebx, 0x800300fb
jmp 0x10043783
mov eax, dword [esp + 0x24]
lea edi, [esi + 0x50]
mov dword [esi + 0x4c], eax
lea esi, [esp + 0x28]
mov ax, word [esp + 0x22]
jmp 0x1004382e
and dword [esi + 0x4c], 0
lea edi, [esi + 0x50]
mov esi, 0x10001cc0
xor eax, eax
mov ecx, dword [esp + 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov word [ecx + 0x48], ax
mov eax, dword [esp + 0xc]
mov dword [ecx + 0x44], eax
or eax, 0xffffffff
jmp 0x10043787
Function at 0x10044308
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10052004]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x24], ecx
mov word [ebp - 0x1c], ax
mov edx, 0x10001cc0
mov ax, word [ecx + 0x48]
mov word [ebp - 0x1a], ax
mov eax, dword [ecx + 0x4c]
add ecx, 0x50
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x18], eax
lea edi, [ebp - 0x14]
xor ebx, ebx
mov dword [ebp - 0x20], ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.10005f7b
mov edi, dword [ebp - 0x24]
neg eax
push ebx
push ebx
sbb esi, esi
push ebx
push dword [edi + 0x44]
and esi, 0xfffffff0
add esi, 0x18
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x10044384
push ebx
lea eax, [ebp - 0x20]
push eax
push esi
lea eax, [ebp - 0x1c]
push eax
push dword [edi + 0x44]
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_WriteFile]
test eax, eax
jne 0x10044399
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x10044399
movzx ebx, bx
or ebx, 0x80070000
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100281a0
mov esp, ebp
pop ebp
ret

Function at 0x100481f0
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
push 0xd
push 1
lea eax, [ebp - 1]
mov byte [ebp - 1], 1
push eax
mov esi, ecx
lea eax, [ebp - 0xc]
push eax
xor edi, edi
push dword [esi]
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
test eax, eax
jns 0x10048225
mov ecx, eax
call fcn.100213df
mov edi, eax
jmp 0x10048230
push dword [esi]
call dword [sym.imp.ntdll.dll_NtClose]
or dword [esi], 0xffffffff
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1004881c
Capabilities:
Set file attributes

Disassembly:
push 0x228
push 0x10051540
call fcn.100283dc
mov ebx, ecx
mov dword [ebp - 0x224], ebx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x228], edi
push edi
lea ecx, [ebp - 0x220]
call fcn.100491d0
mov eax, dword [ebx + 0x38]
mov ecx, dword [eax]
push 0xffffffffffffffff
push eax
mov esi, dword [ecx + 0xc]
mov ecx, esi
call dword [0x100532e8]
call esi
cmp dword [ebx + 0x34], 0xffffffff
jne 0x1004886d
mov edi, 0x80030102
jmp 0x1004895f
mov eax, dword [ebp - 0x220]
lea eax, [eax*2 + 0xe]
mov dword [ebp - 0x22c], eax
xor ecx, ecx
mov dword [ebp - 4], ecx
call fcn.10028a80
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [ebp - 0x230], esi
mov dword [ebp - 4], 0xfffffffe
mov al, byte [ebp + 0xc]
mov byte [esi], al
xor eax, eax
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x220]
add eax, eax
mov dword [esi + 8], eax
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [esi + 0xc]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
push 0xa
push dword [ebp - 0x22c]
push esi
lea eax, [ebp - 0x238]
push eax
push dword [ebx + 0x34]
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
test eax, eax
jns 0x100488f5
mov ecx, eax
call fcn.100213df
mov edi, eax
test edi, edi
js 0x1004895f
mov edi, dword [ebp - 0x228]
push dword [ebx + 8]
call dword [sym.imp.api_ms_win_core_com_l1_1_1.dll_CoTaskMemFree]
mov ecx, edi
lea edx, [ecx + 2]
xor esi, esi
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x10048905
sub ecx, edx
sar ecx, 1
lea esi, [ecx*2 + 2]
push esi
call dword [sym.imp.api_ms_win_core_com_l1_1_1.dll_CoTaskMemAlloc]
mov dword [ebx + 8], eax
test eax, eax
jne 0x10048930
mov edi, 0x80030008
jmp 0x1004895f
push edi
mov edx, esi
mov ecx, eax
call fcn.100070a9
xor eax, eax
mov edi, eax
jmp 0x1004895f
mov eax, dword [ebx + 0x38]
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 0x10]
mov ecx, esi
call dword [0x100532e8]
call esi
mov eax, edi
lea esp, [ebp - 0x248]
call fcn.10028424
ret 8
Function at 0x1004b0b9
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
push edi
xor edi, edi
test byte [esi + 8], 4
je 0x1004b17f
mov eax, dword [esi + 0x20]
add eax, 4
push eax
call fcn.10048240
mov edi, eax
test edi, edi
js 0x1004b17f
and dword [ebp - 8], 0
lea eax, [ebp - 8]
and dword [ebp - 4], 0
push 0x14
push 8
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [esi + 4]
push dword [eax + 0x34]
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
test eax, eax
jns 0x1004b114
mov ecx, eax
call fcn.100213df
jmp 0x1004b17d
mov eax, dword [esi + 4]
push dword [eax + 0x34]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, dword [esi + 4]
push 1
or dword [eax + 0x34], 0xffffffff
mov eax, dword [esi + 4]
mov ecx, dword [esi + 0x20]
push dword [eax + 8]
call fcn.1004881c
mov edi, eax
mov eax, dword [esi + 0x20]
test edi, edi
jns 0x1004b15a
push dword [eax + 0x34]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, dword [esi + 0x20]
or dword [eax + 0x34], 0xffffffff
cmp dword [ebp + 0xc], 0
je 0x1004b17f
xor edi, edi
jmp 0x1004b17f
mov ecx, dword [esi + 4]
mov eax, dword [eax + 0x34]
mov dword [ecx + 0x34], eax
mov eax, dword [esi + 0x20]
or dword [eax + 0x34], 0xffffffff
and dword [esi + 8], 0xfffffffb
cmp dword [ebp + 8], 1
jne 0x1004b17f
push 1
mov ecx, esi
call fcn.1004adf5
mov edi, eax
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x10003aa6
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ecx
push edx
add esp, 4
call fcn.10003aa6
add byte [edi + esi + 0x33], cl
dec ebp
aas
dec ebx
add esp, 4
or ecx, 0x10836
pop ecx
push esi
call 0x10003abd
add byte [eax], bh
aaa
aaa
cmp byte [0x4c4833d], bh
sub esi, 0x12a91
pop esi
lea edx, [ebp - 0x18dc]
mov dword [ebp - 0xe28], edx
mov eax, dword [ebp - 0x57c]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xe24], ecx
xor edx, edx
mov word [ebp - 0x1f4], dx
xor eax, eax
mov word [ebp - 0x2c], ax
push edx
push edi
add esp, 4
and edx, 0xd6f4
and edx, 0x1260
sub edx, 0x6c36
pop edx
push edx
sub edx, 0x25f8
and edx, 0x1329b
sub edx, 0xa1ce
sub edx, 0x68b1
pop edx
mov ecx, dword [ebp - 0xe24]
mov dx, word [ecx]
mov word [ebp - 0x1222], dx
mov eax, dword [ebp - 0xe24]
add eax, 2
mov dword [ebp - 0xe24], eax
mov cx, word [ebp - 0x1222]
mov word [ebp - 0x1f4], cx
mov edx, dword [ebp - 0xe28]
mov ax, word [edx]
mov word [ebp - 0x1224], ax
mov ecx, dword [ebp - 0xe28]
add ecx, 2
mov dword [ebp - 0xe28], ecx
mov dx, word [ebp - 0x1224]
mov word [ebp - 0x2c], dx
push eax
push esi
add esp, 4
xor eax, 0xcf5c
or eax, 0x1084b
or eax, 0x1713f
pop eax
push ebx
sub ebx, 0x4e11
pop ebx
push esi
push ebx
add esp, 4
and esi, 0x7955
xor esi, 0x5924
pop esi
movzx eax, word [ebp - 0x2c]
test eax, eax
jne 0x10003bc9
movzx ecx, word [ebp - 0x1f4]
movzx edx, word [ebp - 0x2c]
sub ecx, edx
mov dword [ebp - 0x1840], ecx
jmp 0x10003c23
movzx eax, word [ebp - 0x1f4]
movzx ecx, word [ebp - 0x2c]
cmp eax, ecx
je 0x10003af1
movzx edx, word [ebp - 0x1f4]
xor edx, 0x20
movzx eax, word [ebp - 0x2c]
cmp edx, eax
je 0x10003af1
movzx ecx, word [ebp - 0x1f4]
movzx edx, word [ebp - 0x2c]
cmp ecx, edx
jge 0x10003c0d
mov dword [ebp - 0x183c], 0xffffffff
jmp 0x10003c17
mov dword [ebp - 0x183c], 1
mov eax, dword [ebp - 0x183c]
mov dword [ebp - 0x1840], eax
cmp dword [ebp - 0x1840], 0
jne 0x10003c6c
push edi
push ebx
add esp, 4
or edi, 0x7680
pop edi
push edi
call 0x10003c45
add byte [ecx + 0x50], cl
inc ebp
cmp cl, byte [ecx + 0x4d]
add esp, 4
jmp 0x10003c51
and edi, 0x571f
and edi, 0x8cd5
pop edi
mov ecx, dword [ebp - 0x57c]
mov dword [ebp - 0x300], ecx
jmp 0x10003cd4
push esi
call 0x10003c7c
add byte [ebx + 0x36], al
xor bh, byte [edx + edi]
cmp byte [ebx + 0x34], cl
inc ebp
add esp, 4
call 0x10003c8e
add byte [eax + 0x33], dl
inc ecx
xor bh, byte [esi]
xor al, byte [edx + edi + 0x4e]
add esp, 4
add esi, 0x6b98
xor esi, 0x5059
pop esi
mov edx, dword [ebp - 0x57c]
mov eax, dword [edx]
mov dword [ebp - 0x57c], eax
mov ecx, dword [ebp - 0x57c]
cmp ecx, dword [ebp - 0xe2c]
je 0x10003cca
mov edx, dword [ebp - 0x57c]
cmp dword [edx + 0x30], 0
jne 0x10003a95
mov dword [ebp - 0x300], 0
Function at 0x10003abd
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ecx
push edx
add esp, 4
call fcn.10003aa6
add byte [edi + esi + 0x33], cl
dec ebp
aas
dec ebx
add esp, 4
or ecx, 0x10836
pop ecx
push esi
call 0x10003abd
add byte [eax], bh
aaa
aaa
cmp byte [0x4c4833d], bh
sub esi, 0x12a91
pop esi
lea edx, [ebp - 0x18dc]
mov dword [ebp - 0xe28], edx
mov eax, dword [ebp - 0x57c]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xe24], ecx
xor edx, edx
mov word [ebp - 0x1f4], dx
xor eax, eax
mov word [ebp - 0x2c], ax
push edx
push edi
add esp, 4
and edx, 0xd6f4
and edx, 0x1260
sub edx, 0x6c36
pop edx
push edx
sub edx, 0x25f8
and edx, 0x1329b
sub edx, 0xa1ce
sub edx, 0x68b1
pop edx
mov ecx, dword [ebp - 0xe24]
mov dx, word [ecx]
mov word [ebp - 0x1222], dx
mov eax, dword [ebp - 0xe24]
add eax, 2
mov dword [ebp - 0xe24], eax
mov cx, word [ebp - 0x1222]
mov word [ebp - 0x1f4], cx
mov edx, dword [ebp - 0xe28]
mov ax, word [edx]
mov word [ebp - 0x1224], ax
mov ecx, dword [ebp - 0xe28]
add ecx, 2
mov dword [ebp - 0xe28], ecx
mov dx, word [ebp - 0x1224]
mov word [ebp - 0x2c], dx
push eax
push esi
add esp, 4
xor eax, 0xcf5c
or eax, 0x1084b
or eax, 0x1713f
pop eax
push ebx
sub ebx, 0x4e11
pop ebx
push esi
push ebx
add esp, 4
and esi, 0x7955
xor esi, 0x5924
pop esi
movzx eax, word [ebp - 0x2c]
test eax, eax
jne 0x10003bc9
movzx ecx, word [ebp - 0x1f4]
movzx edx, word [ebp - 0x2c]
sub ecx, edx
mov dword [ebp - 0x1840], ecx
jmp 0x10003c23
movzx eax, word [ebp - 0x1f4]
movzx ecx, word [ebp - 0x2c]
cmp eax, ecx
je 0x10003af1
movzx edx, word [ebp - 0x1f4]
xor edx, 0x20
movzx eax, word [ebp - 0x2c]
cmp edx, eax
je 0x10003af1
movzx ecx, word [ebp - 0x1f4]
movzx edx, word [ebp - 0x2c]
cmp ecx, edx
jge 0x10003c0d
mov dword [ebp - 0x183c], 0xffffffff
jmp 0x10003c17
mov dword [ebp - 0x183c], 1
mov eax, dword [ebp - 0x183c]
mov dword [ebp - 0x1840], eax
cmp dword [ebp - 0x1840], 0
jne 0x10003c6c
push edi
push ebx
add esp, 4
or edi, 0x7680
pop edi
push edi
call 0x10003c45
add byte [ecx + 0x50], cl
inc ebp
cmp cl, byte [ecx + 0x4d]
add esp, 4
jmp 0x10003c51
and edi, 0x571f
and edi, 0x8cd5
pop edi
mov ecx, dword [ebp - 0x57c]
mov dword [ebp - 0x300], ecx
jmp 0x10003cd4
push esi
call 0x10003c7c
add byte [ebx + 0x36], al
xor bh, byte [edx + edi]
cmp byte [ebx + 0x34], cl
inc ebp
add esp, 4
call 0x10003c8e
add byte [eax + 0x33], dl
inc ecx
xor bh, byte [esi]
xor al, byte [edx + edi + 0x4e]
add esp, 4
add esi, 0x6b98
xor esi, 0x5059
pop esi
mov edx, dword [ebp - 0x57c]
mov eax, dword [edx]
mov dword [ebp - 0x57c], eax
mov ecx, dword [ebp - 0x57c]
cmp ecx, dword [ebp - 0xe2c]
je 0x10003cca
mov edx, dword [ebp - 0x57c]
cmp dword [edx + 0x30], 0
jne 0x10003a95
mov dword [ebp - 0x300], 0