joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44fe70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, dword [esp + 0x70]
mov edi, dword [esp + 0x78]
mov eax, dword [esp + 0x60]
mov edx, dword [esp + 0x64]
mov esi, dword [0x50f0e8]
mov dword [esp + 0x3c], esi
mov esi, dword [ebx + 0xc]
mov dword [esp + 0x2c], edi
mov edi, dword [esp + 0x68]
mov ebp, esi
and ebp, 0xffffffb5
or ebp, 8
mov dword [ebx + 0xc], ebp
lea ebp, [esp + 0x38]
mov dword [esp + 0x18], ebp
mov ebp, dword [esp + 0x74]
mov dword [esp + 8], edi
mov dword [esp + 0x14], ebp
mov ebp, dword [esp + 0x6c]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], ebp
mov dword [esp], eax
mov dword [esp + 4], edx
call method.std::istreambuf_iterator_char__std::char_traits_char____std::num_get_char__std::istreambuf_iterator_char__std::char_traits_char_____._M_extract_int_unsigned_long__std::istreambuf_iterator_char__std::char_traits_char_____std::istreambuf_iterator_cha
mov dword [ebx + 0xc], esi
sub esp, 0x1c
mov ecx, dword [esp + 0x38]
mov edi, dword [esp + 0x2c]
mov dword [edi], ecx
mov ecx, dword [esp + 0x3c]
sub ecx, dword [0x50f0e8]
jne 0x44fef9
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
call dbg.__stack_chk_fail
nop
nop
Function at 0x45a730
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov esi, dword [esp + 0x70]
mov ebx, dword [esp + 0x64]
mov dword [esp + 0x20], ecx
mov edx, dword [0x50f0e8]
mov dword [esp + 0x3c], edx
xor edx, edx
mov ecx, dword [esp + 0x6c]
mov eax, dword [esp + 0x60]
mov edi, dword [esi + 0xc]
mov ebp, dword [esp + 0x78]
mov edx, edi
and edx, 0xffffffb5
or edx, 8
mov dword [esi + 0xc], edx
lea edx, [esp + 0x38]
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x74]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x68]
mov dword [esp + 4], ebx
xor bx, bx
mov dword [esp + 0x10], esi
mov dword [esp + 8], edx
mov dword [esp], eax
call method.std::istreambuf_iterator_wchar_t__std::char_traits_wchar_t____std::num_get_wchar_t__std::istreambuf_iterator_wchar_t__std::char_traits_wchar_t_____._M_extract_int_unsigned_long__std::istreambuf_iterator_wchar_t__std::char_traits_wchar_t_____std::is
sub esp, 0x1c
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x28], edx
mov eax, edx
mov dword [esp + 0x2c], ecx
movzx edx, word [esp + 0x2c]
mov dword [esi + 0xc], edi
or ebx, edx
mov edx, dword [esp + 0x38]
mov dword [ebp], edx
mov edx, dword [esp + 0x3c]
sub edx, dword [0x50f0e8]
jne 0x45a7e2
add esp, 0x4c
mov edx, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
call dbg.__stack_chk_fail
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x45f3d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x6c
mov eax, dword [esp + 0x80]
mov ebp, dword [esp + 0x98]
mov dword [esp + 0x48], ecx
mov ecx, 0x4c261c
mov edi, dword [esp + 0x90]
mov edx, dword [esp + 0x94]
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x8c]
mov dword [esp + 0x3c], ebp
mov ebx, dword [esp + 0x84]
mov dword [esp + 0x40], eax
mov esi, dword [esp + 0x88]
mov eax, dword [0x50f0e8]
mov dword [esp + 0x5c], eax
xor eax, eax
mov dword [esp + 0x44], edx
call method.std::locale::id._M_id___const
mov ecx, dword [edi + 0x6c]
mov ebp, dword [ecx + 4]
cmp eax, dword [ecx + 8]
jae 0x45f5a4
mov eax, dword [ebp + eax*4]
test eax, eax
je 0x45f5a4
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x4c9458
mov dword [esp + 4], 0x4c915c
mov dword [esp], eax
call sym.___dynamic_cast
test eax, eax
je 0x45f5a4
mov eax, dword [eax + 8]
mov edx, dword [esp + 0x44]
lea ebp, [esp + 0x50]
mov dword [esp + 0x50], 0
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x54], 0
mov eax, dword [eax + 0x10]
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x4c]
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], edi
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 4], ebx
mov dword [esp + 0x14], edx
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
mov dword [esp + 0x58], 0
call fcn.00460940
mov ecx, ebp
sub esp, 0x24
mov ebx, edx
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call method.std::__time_get_state._M_finalize_state_tm_
sub esp, 4
cmp ebx, 0xffffffff
mov edx, dword [esp + 0x48]
sete al
mov edi, eax
test edx, edx
mov ecx, edi
setne al
and al, cl
mov ebp, eax
jne 0x45f578
cmp dword [esp + 0x40], 0xffffffff
sete al
test esi, esi
je 0x45f515
test al, al
jne 0x45f550
mov ecx, edi
cmp cl, al
je 0x45f540
mov eax, dword [esp + 0x5c]
sub eax, dword [0x50f0e8]
jne 0x45f5b5
add esp, 0x6c
mov eax, edx
mov edx, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
mov eax, dword [esp + 0x44]
or dword [eax], 2
jmp 0x45f51b
mov ecx, dword [esi + 0xc]
xor eax, eax
cmp dword [esi + 8], ecx
jb 0x45f515
mov eax, dword [esi]
mov dword [esp + 0x3c], edx
mov ecx, esi
call dword [eax + 0x24]
mov edx, dword [esp + 0x3c]
cmp eax, 0xffffffff
sete al
jmp 0x45f515
mov eax, dword [edx + 0xc]
xor edi, edi
cmp dword [edx + 8], eax
jb 0x45f505
mov eax, dword [edx]
mov dword [esp + 0x3c], edx
mov ecx, edx
call dword [eax + 0x24]
mov edx, dword [esp + 0x3c]
cmp eax, 0xffffffff
mov eax, 0
cmove edi, ebp
cmove edx, eax
jmp 0x45f505
mov eax, dword [esp + 0x5c]
sub eax, dword [0x50f0e8]
jne 0x45f5b5
call method.std.__throw_bad_cast__
call dbg.__stack_chk_fail
nop
nop
nop
nop
nop
nop
Function at 0x467850
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ecx, 0x4c2760
push edi
push esi
push ebx
sub esp, 0xcc
mov eax, dword [esp + 0xe4]
mov edi, dword [esp + 0xf8]
mov ebp, dword [esp + 0xe8]
mov esi, dword [esp + 0xe0]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xf0]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0xf4]
mov dword [esp + 0x28], eax
mov byte [esp + 0x1e], al
mov eax, edi
mov byte [esp + 0x1f], al
mov eax, dword [0x50f0e8]
mov dword [esp + 0xbc], eax
xor eax, eax
call method.std::locale::id._M_id___const
mov ecx, eax
mov eax, dword [ebp + 0x6c]
mov eax, dword [eax + 4]
mov ebx, dword [eax + ecx*4]
test ebx, ebx
je 0x467a1d
mov ecx, 0x4c261c
call method.std::locale::id._M_id___const
mov edx, dword [ebp + 0x6c]
mov ecx, dword [edx + 4]
cmp eax, dword [edx + 8]
jae 0x467a1d
mov eax, dword [ecx + eax*4]
test eax, eax
je 0x467a1d
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x4c9458
mov dword [esp + 4], 0x4c915c
mov dword [esp], eax
call sym.___dynamic_cast
mov edx, eax
test eax, eax
je 0x467a1d
cmp byte [ebx + 0x1c], 0
je 0x4679e0
movzx ecx, byte [ebx + 0x42]
mov eax, edi
mov byte [esp + 0x38], cl
test al, al
jne 0x4679c8
movzx eax, byte [esp + 0x1f]
lea ebx, [esp + 0x3c]
mov dword [esp + 4], pe_nt_image_headers32
mov ecx, edx
mov dword [esp], ebx
mov byte [esp + 0x3a], al
movzx eax, byte [esp + 0x1e]
mov byte [esp + 0x39], al
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x38]
mov dword [esp + 8], eax
call method.std::__timepunct_char_._M_put_char__unsigned_int__char_const__tm_const__const
sub esp, 0x10
mov dword [esp], ebx
call sym._strlen
mov edi, eax
mov eax, dword [esp + 0x24]
mov edx, eax
test al, al
jne 0x4679a2
mov byte [esp + 0x1e], al
mov eax, dword [esi]
mov ecx, esi
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [eax + 0x30]
sub esp, 8
cmp edi, eax
mov eax, 1
movzx edx, byte [esp + 0x1e]
cmovne edx, eax
movzx ecx, dl
mov eax, dword [esp + 0xbc]
sub eax, dword [0x50f0e8]
jne 0x467a31
add esp, 0xcc
mov eax, esi
mov edx, ecx
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
mov byte [esp + 0x1e], al
movzx eax, byte [esp + 0x28]
mov byte [esp + 0x3b], 0
mov byte [esp + 0x1f], al
jmp 0x46792f
mov ecx, ebx
mov dword [esp + 0x2c], eax
call method.std::ctype_char_._M_widen_init___const
mov eax, dword [ebx]
mov edx, dword [esp + 0x2c]
mov ecx, 0x25
mov eax, dword [eax + 0x18]
cmp eax, method.std::ctype_char_.do_widen_char__const
je 0x467921
mov ecx, ebx
mov dword [esp], 0x25
call eax
sub esp, 4
mov ecx, eax
mov edx, dword [esp + 0x2c]
jmp 0x467921
mov eax, dword [esp + 0xbc]
sub eax, dword [0x50f0e8]
jne 0x467a31
call method.std.__throw_bad_cast__
call dbg.__stack_chk_fail
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x47e490
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x2c
mov esi, dword [sym.imp.msvcrt.dll__read]
mov ebp, dword [esp + 0x40]
mov edi, dword [esp + 0x44]
mov ecx, ebx
call method.std::__basic_file_char_.fd__
mov dword [esp + 8], edi
mov dword [esp + 4], ebp
mov dword [esp], eax
call esi
mov edx, eax
cmp eax, 0xffffffff
je 0x47e4d0
add esp, 0x2c
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret 8
mov dword [esp + 0x1c], eax
call dword [sym.imp.msvcrt.dll__errno]
mov edx, dword [esp + 0x1c]
cmp dword [eax], 4
je 0x47e4a7
add esp, 0x2c
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x4b7540
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [0x50f0e8]
mov dword [esp + 0x4c], eax
xor eax, eax
mov esi, dword [esp + 0x70]
mov ebp, dword [esp + 0x74]
mov edi, dword [esp + 0x78]
test esi, esi
je 0x4b7616
mov edx, dword [esi]
mov eax, dword [edx - 8]
mov ecx, dword [edx - 4]
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
lea ebx, [esi + eax]
mov dword [esp + 0x40], 0
mov edx, dword [ebx]
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0x10
cmp dword [edx - 4], ecx
jne 0x4b7616
mov edx, dword [esp + 0x7c]
test edx, edx
js 0x4b75b2
add eax, dword [esp + 0x7c]
je 0x4b7660
mov eax, dword [ecx]
mov dword [esp + 0xc], ebx
lea edx, [esp + 0x38]
mov ebx, dword [esp + 0x7c]
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], esi
mov dword [esp], ebx
mov dword [esp + 0x10], ebp
mov dword [esp + 8], edi
mov dword [esp + 4], 6
call dword [eax + 0x1c]
sub esp, 0x1c
mov ebx, dword [esp + 0x38]
mov dword [esp + 0x2c], ebx
test ebx, ebx
je 0x4b7616
mov ecx, dword [esp + 0x44]
mov eax, ecx
not eax
test al, 6
je 0x4b7618
mov eax, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
and edx, eax
not edx
and edx, 6
je 0x4b7618
and eax, 5
cmp eax, 4
je 0x4b7616
test ecx, ecx
je 0x4b7638
xor ebx, ebx
mov eax, dword [esp + 0x4c]
sub eax, dword [0x50f0e8]
jne 0x4b76bc
add esp, 0x5c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x7c]
test eax, eax
js 0x4b7680
add ebx, dword [esp + 0x7c]
cmp esi, ebx
jne 0x4b7616
lea esi, cs:[esi]
mov ebx, dword [esp + 0x2c]
jmp 0x4b7618
mov dword [esp], edi
mov dword [esp + 0x2c], ecx
call method.std::type_info.operator_std::type_info_const__const
sub esp, 4
test al, al
mov ecx, dword [esp + 0x2c]
je 0x4b75b2
jmp 0x4b7618
cmp dword [esp + 0x7c], 0xfffffffe
je 0x4b7616
mov eax, dword [edi]
mov dword [esp + 0xc], esi
mov ecx, edi
mov esi, dword [esp + 0x2c]
mov dword [esp + 8], ebp
mov dword [esp + 4], esi
mov esi, dword [esp + 0x7c]
mov dword [esp], esi
call dword [eax + 0x20]
not eax
sub esp, 0x10
test al, 6
jne 0x4b7616
mov eax, dword [esp + 0x38]
mov dword [esp + 0x2c], eax
jmp 0x4b7650
call dbg.__stack_chk_fail
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x4b94d0
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [0x50f0e8]
mov dword [esp + 0x2c], eax
xor eax, eax
mov dword [esp + 4], 0
mov dword [esp], 0x4c1578
call sym._pthread_mutex_init
mov dword [esp], str.GLIBCXX_TUNABLES
mov dword [0x4c157c], 0
mov dword [0x4c1580], 0
mov dword [0x4c1584], 0
call sym._getenv
mov dword [esp + 0x14], 8
mov dword [esp + 0x18], str.obj_size
mov ebx, eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 9
mov dword [esp + 0x24], str.obj_count
mov dword [esp + 0x28], 0x40
test eax, eax
jne 0x4b9576
jmp 0x4b9647
mov dword [esp], ebx
mov dword [esp + 4], 0x3a
call sym._strchr
mov ebx, eax
test eax, eax
je 0x4b95f0
xor eax, eax
cmp byte [ebx], 0x3a
sete al
add ebx, eax
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
xor eax, 0x62696c67
xor edx, 0x2e787863
or eax, edx
jne 0x4b9560
mov eax, dword [ebx + 7]
mov edx, dword [ebx + 0xb]
xor eax, 0x5f68652e
xor edx, 0x6c6f6f70
or eax, edx
jne 0x4b9560
cmp byte [ebx + 0xf], 0x2e
jne 0x4b9560
add ebx, 0x10
lea esi, [esp + 0x14]
lea ebp, [esp + 0x2c]
mov edi, dword [esi]
mov eax, dword [esi + 4]
test edi, edi
je 0x4b95d7
mov dword [esp + 8], edi
mov dword [esp + 4], ebx
mov dword [esp], eax
call sym._memcmp
test eax, eax
jne 0x4b95e1
cmp byte [ebx + edi], 0x3d
je 0x4b9675
add esi, 0xc
cmp esi, ebp
jne 0x4b95ba
jmp 0x4b9560
mov eax, dword [esp + 0x28]
mov edx, 0x100
mov ecx, 6
cmp eax, edx
cmovle edx, eax
mov eax, dword [esp + 0x1c]
test eax, eax
cmove eax, ecx
add eax, 0x2c
imul eax, edx
lea ebx, [eax*4]
mov dword [0x4c1584], ebx
test ebx, ebx
jne 0x4b9656
mov dword [esp], sym.___tcf_0_3
call dbg.atexit
mov eax, dword [esp + 0x2c]
sub eax, dword [0x50f0e8]
jne 0x4b96c0
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [0x4c1584], 0x3200
mov ebx, 0x3200
mov dword [esp], ebx
call sym._malloc
mov dword [0x4c1580], eax
test eax, eax
je 0x4b96b3
xor edx, edx
mov dword [0x4c157c], eax
mov dword [eax], ebx
mov dword [eax + 4], edx
jmp 0x4b9623
lea eax, [esp + 0x10]
xor ebp, ebp
mov dword [esp + 4], eax
lea eax, [ebx + edi + 1]
mov dword [esp + 8], ebp
mov dword [esp], eax
call sym._strtoul
mov ebx, dword [esp + 0x10]
movzx edx, byte [ebx]
cmp dl, 0x3a
je 0x4b96a3
test dl, dl
jne 0x4b9560
test eax, eax
js 0x4b9560
mov dword [esi + 8], eax
jmp 0x4b9560
xor ecx, ecx
mov dword [0x4c1584], ecx
jmp 0x4b9623
call dbg.__stack_chk_fail
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x10f340b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.10f34200
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x10f340d6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10f340c2
add dl, dl
jne 0x10f340e1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10f34134
xor eax, eax
add dl, dl
jne 0x10f340ee
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10f341d5
add dl, dl
jne 0x10f340fd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10f34108
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10f34113
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10f3411e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x10f3412a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10f340cd
mov eax, 1
add dl, dl
jne 0x10f34142
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10f3414d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10f34139
sub eax, ebx
mov ebx, 1
jne 0x10f34180
mov ecx, 1
add dl, dl
jne 0x10f34166
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10f34171
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10f3415d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10f340cd
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x10f34197
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10f341a2
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10f3418e
cmp eax, 0x7d00
jae 0x10f341c5
cmp eax, 0x500
jb 0x10f341c0
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10f340cd
cmp eax, 0x7f
ja 0x10f341c8
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10f340cd
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x10f341f6
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10f340cd
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x100016e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [0x101ecc58], esp
dec eax
xor edx, 5
mov ecx, 2
loop 0x10001715
mov edx, eax
inc eax
sub eax, 6
inc edx
add dword [0x101ecc54], ebp
add eax, 7
lea eax, [0x101ecc50]
add dword [eax], ebx
xor dword [0x101ecc4c], edi
jmp fcn.10001190
add dword [0x101ecc48], esi
mov ecx, 2
loop 0x100016f1
mov dword [ebp], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebp
mov ebp, esp
mov eax, 1
pop ebp
ret

Function at 0x101b6580
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x101ecc5c], 0x795
mov dword [0x101ecc68], 0
mov byte [0x101ecc6c], 0
mov dword [0x101ecc64], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x101b669c
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov edx, 0xf92
mov esi, 0x100
mov dword [0x101ecc70], 0
mov dword [0x101ecc60], eax
mov eax, dword [0x101ecc68]
mov edi, dword [ebp - 0x18]
movzx ebx, byte [edi + ecx]
add ebx, eax
mov eax, ecx
xor edi, edi
mov dword [ebp - 0x28], edx
mov edx, edi
mov edi, dword [ebp - 0x10]
div edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add ebx, edx
mov dword [0x101ecc70], ebx
mov eax, ebx
cdq
idiv esi
mov dword [0x101ecc68], edx
mov dword [0x101ecc5c], 0x1e22
mov esi, dword [ebp - 0x18]
mov bl, byte [esi + ecx]
mov byte [0x101ecc6c], bl
mov dword [0x101ecc5c], 0x112f
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov bl, byte [0x101ecc6c]
mov ecx, dword [0x101ecc68]
mov byte [esi + ecx], bl
mov dword [0x101ecc5c], 0xa8a
mov dword [0x101ecc60], 0xfffffb26
mov ecx, dword [0x101ecc64]
add ecx, 1
mov dword [0x101ecc64], ecx
cmp ecx, 0x100
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], edx
jl 0x101b65d2
jmp 0x101b65ca
mov eax, dword [ebp - 0x1c]
mov dword [0x101ecc5c], 0xc9a
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x101ecc64]
add eax, 1
mov dword [0x101ecc64], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x101b669c
mov dword [0x101ecc5c], 0x9b7
mov dword [0x101ecc64], 0
mov eax, dword [0x101ecc60]
add eax, 0x146c
mov dword [ebp - 0x2c], eax
xor eax, eax
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ecx
jmp 0x101b65d2
Function at 0x101b70b0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
mov dword [0x101ecc5c], 0xa55
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x101ecc5c], 0xa74
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jmp 0x101b7150
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff6
mov dword [ebp - 0x18], eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x18]
cmp word [ecx + edx*2], 0x64
mov dword [ebp - 0x1c], eax
jne 0x101b721d
xor eax, eax
mov dword [0x101ecc5c], 0xfffff436
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0x12], 0x64
mov dword [ebp - 0x1c], eax
je 0x101b71d5
jmp 0x101b721d
mov eax, dword [ebp - 0x20]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x24], eax
jge 0x101b7166
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], edx
jne 0x101b7139
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov dword [0x101ecc5c], 0x21ff
mov edx, dword [0x101ecc60]
add edx, 0xfffffbd3
mov dword [0x101ecc60], edx
mov edx, dword [ebp - 0xc]
cmp word [edx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], ecx
jne 0x101b721d
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0x18], 0x6f
mov dword [ebp - 0x1c], eax
jne 0x101b721d
xor eax, eax
mov dword [0x101ecc5c], 0xfffffc44
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0x16], 0x61
mov dword [ebp - 0x1c], eax
je 0x101b70f0
jmp 0x101b721d
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x10], 0x6c
sete dl
mov byte [ebp - 0x25], dl
xor eax, eax
mov cl, byte [ebp - 0x25]
test cl, 1
mov dword [ebp - 0x1c], eax
jne 0x101b71f7
jmp 0x101b721d
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x1c], eax
jne 0x101b721d
mov eax, 1
mov dword [0x101ecc5c], 0x12d7
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
add esp, 0x28
pop ebp
ret
Function at 0x101b7230
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xbc
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dl, 0x6b
xor esi, esi
lea edi, [ebp - 0x6c]
lea ebx, [ebp - 0x2c]
mov dword [ebp - 0x90], eax
lea eax, [ebp - 0x8c]
mov byte [ebp - 0x8c], 0x56
mov byte [ebp - 0x8b], 0x69
mov byte [ebp - 0x8a], 0x72
mov byte [ebp - 0x89], 0x74
mov byte [ebp - 0x88], 0x75
mov byte [ebp - 0x87], 0x61
mov byte [ebp - 0x86], 0x6c
mov byte [ebp - 0x85], 0x41
mov byte [ebp - 0x84], 0x6c
mov byte [ebp - 0x83], 0x6c
mov byte [ebp - 0x82], 0x6f
mov byte [ebp - 0x81], 0x63
mov byte [ebp - 0x80], 0
mov byte [ebp - 0x7f], 0xb2
mov byte [ebp - 0x2c], 0x6b
mov byte [ebp - 0x2b], 0x65
mov byte [ebp - 0x2a], 0x72
mov byte [ebp - 0x29], 0x6e
mov byte [ebp - 0x28], 0x65
mov byte [ebp - 0x27], 0x6c
mov byte [ebp - 0x26], 0x33
mov byte [ebp - 0x25], 0x32
mov byte [ebp - 0x24], 0x2e
mov byte [ebp - 0x23], 0x64
mov byte [ebp - 0x22], 0x6c
mov byte [ebp - 0x21], 0x6c
mov byte [ebp - 0x20], 0
mov byte [ebp - 0x1f], 0xb2
mov dword [0x101ecc60], 0xd93
mov dword [0x101ecc5c], 0x642
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x98], ecx
mov dword [ebp - 0x9c], edi
mov byte [ebp - 0x9d], dl
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 0xa8], esi
jmp 0x101b738a
xor eax, eax
lea ecx, [ebp - 0x6c]
mov dword [0x101ecc60], 0x956
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [ebp - 0xac], eax
call fcn.101b5e10
mov dword [esp], eax
mov eax, dword [ebp - 0x94]
mov dword [esp + 4], eax
call fcn.101b6210
xor ecx, ecx
mov edx, dword [0x101ecc60]
add edx, 0xffffe8c4
mov dword [0x101ecc60], edx
cmp eax, 0
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xb4], ecx
je 0x101b7480
jmp 0x101b73c4
mov eax, dword [ebp - 0xa8]
mov cl, byte [ebp - 0x9d]
movsx edx, cl
mov si, dx
mov word [ebp + eax*2 - 0x6c], si
mov edx, eax
add edx, 1
mov cl, byte [ebp + eax - 0x2b]
cmp cl, 0
mov byte [ebp - 0x9d], cl
mov dword [ebp - 0xa8], edx
je 0x101b7326
jmp 0x101b738a
mov eax, dword [ebp - 0xb0]
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [0x101ecc60], 0x1cc2
mov dword [esp], eax
mov ecx, dword [ebp - 0x90]
mov dword [esp + 4], ecx
mov dword [ebp - 0xb8], eax
call fcn.101b63b0
xor eax, eax
mov ecx, dword [ebp - 0xb8]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x98]
mov dword [edx + 0x44], ecx
mov ecx, dword [ebp - 0xb8]
mov dword [edx], ecx
mov dword [0x101ecc5c], 0x1b22
mov dword [0x101ecc60], 0x10
cmp ecx, 0
mov dword [ebp - 0xb4], eax
je 0x101b7480
mov eax, dword [ebp - 0xb8]
add eax, 0x16ec
mov dword [0x101ecc5c], 0x1d80
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0xb4]
add esp, 0xbc
pop esi
pop edi
pop ebx
pop ebp
ret