joyce8/EMBER2024-capa huggingface dataset:
Function at 0x456520
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4566cb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x4566ac
mov dl, 1
mov eax, dword [0x418f80]
call fcn.00403510
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.004042b4
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x45669b
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00443fb4
test al, al
je 0x45668e
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x4566dc
lea eax, [ebp - 0x254]
call fcn.004090a4
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x45668e
xor eax, eax
push ebp
push 0x456687
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x456714
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x456670
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.0040451c
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x456670
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.0040451c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45668e
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x456591
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0041d0dc
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4566d2
lea eax, [ebp - 0x260]
call fcn.004042b4
ret

Function at 0x457000
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x461c60]
cmp byte [eax + 0xa5], 0
jne 0x457071
cmp dword [0x461c78], 0
jne 0x457032
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x456fbc
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x461c78], eax
cmp dword [0x461c74], 0
jne 0x45704d
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x461c74], eax
cmp dword [0x461c7c], 0
jne 0x457071
push esp
push 0
push 0
push 0x456f60
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x461c7c], eax
pop edx
ret
Function at 0x457168
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x45717f
add esp, 0xfffffff0
call fcn.0040388c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00422aec
mov eax, dword [0x460050]
cmp word [eax + 2], 0
jne 0x4571a7
mov eax, dword [0x460050]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045879c
mov eax, dword [0x4600e4]
cmp word [eax + 2], 0
jne 0x4571c1
mov eax, dword [0x4600e4]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00458994
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x418a90]
call fcn.00403510
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x418a90]
call fcn.00403510
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0x80000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x424c8c]
call fcn.0042a9cc
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x457348
mov eax, dword [0x45ff80]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042ad9c
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x458f04
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x45ff80]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040c610
test eax, eax
je 0x4572b6
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408a00
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040c638
test eax, eax
je 0x4572ca
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.0040451c
mov eax, dword [0x45fe78]
cmp byte [eax], 0
jne 0x4572fe
mov eax, ebx
call fcn.00457470
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.004590e0
mov eax, ebx
call fcn.00459a90
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45733e
call fcn.004038e4
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4576e4
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x461c60]
cmp dword [eax + 0x30], 0
je 0x45778e
cmp dword [ebx + 0x94], 0
jne 0x457788
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x457674
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x457788
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45774e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x457788
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041b130
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45775d
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45826c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x4582a1
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004043a4
jmp 0x4582ae
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404308
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4592bc
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4592fd
mov eax, esi
call fcn.0043f734
test al, al
je 0x4592fd
mov eax, dword [ebx + 0x84]
call fcn.0043f430
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4592fd
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043f430
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x45b364
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x418360]
call fcn.00404c90
xor eax, eax
push ebp
push 0x45b4a8
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x45fdec], 0
jne 0x45b3b7
mov ecx, dword [0x45fe88]
mov dl, 1
mov eax, dword [0x4075a0]
call fcn.0040ba60
call fcn.00403cf4
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00402e4c
mov eax, ebx
call fcn.00404b00
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x45b4b8
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00405fe8
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404b10
test eax, eax
jle 0x45b44f
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x45b448
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404534
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.0040451c
mov eax, dword [ebp - 0x48]
pop edx
call fcn.0040836c
test eax, eax
jne 0x45b448
mov ebx, 0x15
jmp 0x45b454
mov ebx, 0x10
jmp 0x45b454
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x45fdec]
call fcn.0045b2bc
mov eax, dword [ebp - 8]
call fcn.0045b2bc
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00406000
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45b4af
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.004042d8
lea eax, [ebp - 0x10]
mov edx, dword [0x418360]
call fcn.00404d54
ret
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x10006a40
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x10006c0d
pushal
mov esi, 0x4ed6000
lea edi, [esi - 0x5000]
push edi
jmp 0x10006a6a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x10006a71
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10006a60
mov eax, 1
add ebx, ebx
jne 0x10006a83
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x10006a78
jne 0x10006a94
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10006a78
xor ecx, ecx
sub eax, 3
jb 0x10006aa8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x10006b1a
mov ebp, eax
add ebx, ebx
jne 0x10006ab3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x10006ac0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x10006ae4
inc ecx
add ebx, ebx
jne 0x10006ad0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x10006ac5
jne 0x10006ae1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10006ac5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x10006b04
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x10006af5
jmp 0x10006a66
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x10006b04
add edi, ecx
jmp 0x10006a66
pop esi
mov edi, esi
mov ecx, 0xe
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x10006b22
cmp byte [edi], 0
jne 0x10006b22
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x10006b27
lea edi, [esi + 0x4000]
mov eax, dword [edi]
or eax, eax
je 0x10006b9f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x6000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x6050]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x10006b54
mov ecx, edi
jns 0x10006b83
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x6054]
or eax, eax
je 0x10006b99
mov dword [ebx], eax
add ebx, 4
jmp 0x10006b71
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x10006bd0
cmp al, 0xef
ja 0x10006bc3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x10006ba5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x10006bb2
mov ebp, dword [esi + 0x6058]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x10006c04
sub esp, 0xffffff80
jmp 0x10001802
Function at 0x10004db6
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
and al, byte [ecx]
add al, ch
pop es
add byte [eax], al
add byte [eax], al
dec edx
inc ecx
add esp, 4
pop ebx
push edx
call 0x10004d50
add byte [edx], bh
inc ebp
inc eax
inc esi
dec ebx
dec esi
add esp, 4
pop edx
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xddc]
mov dword [ebp - 0x18d8], eax
push edx
jmp 0x10004d70
jmp 0x10004d78
or edx, 0x9c35
call 0x10004d8b
add byte [ebx + 0x37], cl
inc eax
inc esp
aas
dec edi
add esp, 4
pop edx
push ebx
push edx
add esp, 4
xor ebx, 0x15753
pop ebx
mov dword [ebp - 0x2778], 0xffffffff
push ecx
call 0x10004db6
add byte [edx + ecx*2], dh
inc edx
inc esp
xor bh, byte [esi]
inc ecx
cmp dword ds:[edi - 0x7d], eax
les eax, [ecx + eax*4]
int1
xchg byte [esi], al
add byte [eax], al
call 0x10004dcd
add byte [ecx], bh
inc ebp
xor eax, 0x3a334749
dec esi
add esp, 4
or ecx, 0x40d7
pop ecx
mov ecx, dword [ebp - 0x488]
mov dword [ebp - 0x5bc], ecx
jmp 0x10004df4
mov edx, dword [ebp - 0x5bc]
add edx, 1
mov dword [ebp - 0x5bc], edx
push ebx
push esi
add esp, 4
add ebx, 0x15a82
pop ebx
push ecx
and ecx, 0xbcf1
call 0x10004e16
add byte [edx], bh
dec ecx
dec ebx
inc esi
aas
aas
xor eax, dword [ecx + 0x48]
add esp, 4
and ecx, 0x10b4c
xor ecx, 0x9b20
pop ecx
mov eax, dword [ebp - 0x5bc]
invalid
test dword [eax - 5], edi

Function at 0x10004dcd
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
and al, byte [ecx]
add al, ch
pop es
add byte [eax], al
add byte [eax], al
dec edx
inc ecx
add esp, 4
pop ebx
push edx
call 0x10004d50
add byte [edx], bh
inc ebp
inc eax
inc esi
dec ebx
dec esi
add esp, 4
pop edx
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xddc]
mov dword [ebp - 0x18d8], eax
push edx
jmp 0x10004d70
jmp 0x10004d78
or edx, 0x9c35
call 0x10004d8b
add byte [ebx + 0x37], cl
inc eax
inc esp
aas
dec edi
add esp, 4
pop edx
push ebx
push edx
add esp, 4
xor ebx, 0x15753
pop ebx
mov dword [ebp - 0x2778], 0xffffffff
push ecx
call 0x10004db6
add byte [edx + ecx*2], dh
inc edx
inc esp
xor bh, byte [esi]
inc ecx
cmp dword ds:[edi - 0x7d], eax
les eax, [ecx + eax*4]
int1
xchg byte [esi], al
add byte [eax], al
call 0x10004dcd
add byte [ecx], bh
inc ebp
xor eax, 0x3a334749
dec esi
add esp, 4
or ecx, 0x40d7
pop ecx
mov ecx, dword [ebp - 0x488]
mov dword [ebp - 0x5bc], ecx
jmp 0x10004df4
mov edx, dword [ebp - 0x5bc]
add edx, 1
mov dword [ebp - 0x5bc], edx
push ebx
push esi
add esp, 4
add ebx, 0x15a82
pop ebx
push ecx
and ecx, 0xbcf1
call 0x10004e16
add byte [edx], bh
dec ecx
dec ebx
inc esi
aas
aas
xor eax, dword [ecx + 0x48]
add esp, 4
and ecx, 0x10b4c
xor ecx, 0x9b20
pop ecx
mov eax, dword [ebp - 0x5bc]
invalid
test dword [eax - 5], edi
Function at 0x10004e16
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
and al, byte [ecx]
add al, ch
pop es
add byte [eax], al
add byte [eax], al
dec edx
inc ecx
add esp, 4
pop ebx
push edx
call 0x10004d50
add byte [edx], bh
inc ebp
inc eax
inc esi
dec ebx
dec esi
add esp, 4
pop edx
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xddc]
mov dword [ebp - 0x18d8], eax
push edx
jmp 0x10004d70
jmp 0x10004d78
or edx, 0x9c35
call 0x10004d8b
add byte [ebx + 0x37], cl
inc eax
inc esp
aas
dec edi
add esp, 4
pop edx
push ebx
push edx
add esp, 4
xor ebx, 0x15753
pop ebx
mov dword [ebp - 0x2778], 0xffffffff
push ecx
call 0x10004db6
add byte [edx + ecx*2], dh
inc edx
inc esp
xor bh, byte [esi]
inc ecx
cmp dword ds:[edi - 0x7d], eax
les eax, [ecx + eax*4]
int1
xchg byte [esi], al
add byte [eax], al
call 0x10004dcd
add byte [ecx], bh
inc ebp
xor eax, 0x3a334749
dec esi
add esp, 4
or ecx, 0x40d7
pop ecx
mov ecx, dword [ebp - 0x488]
mov dword [ebp - 0x5bc], ecx
jmp 0x10004df4
mov edx, dword [ebp - 0x5bc]
add edx, 1
mov dword [ebp - 0x5bc], edx
push ebx
push esi
add esp, 4
add ebx, 0x15a82
pop ebx
push ecx
and ecx, 0xbcf1
call 0x10004e16
add byte [edx], bh
dec ecx
dec ebx
inc esi
aas
aas
xor eax, dword [ecx + 0x48]
add esp, 4
and ecx, 0x10b4c
xor ecx, 0x9b20
pop ecx
mov eax, dword [ebp - 0x5bc]
invalid
test dword [eax - 5], edi
Function at 0x10005c51
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edx
call 0x10005c51
add byte [edi + 0x3f], cl
cmp al, 0x43
cmp dword [eax + 0x3b], ecx
inc edx
inc ecx
inc ebp
add esp, 4
and edx, 0x172db
call fcn.10005c68
add byte [edi], bh
dec ebx
dec ecx
xor eax, 0x36504b41
add esp, 4
sub edx, 0x17447
pop edx
mov ecx, dword [ebp - 0xe9c]
mov dx, word [ecx]
mov word [ebp - 0x12b2], dx
mov eax, dword [ebp - 0xe9c]
add eax, 2
mov dword [ebp - 0xe9c], eax
mov cx, word [ebp - 0x12b2]
mov word [ebp - 0x268], cx
mov edx, dword [ebp - 0xea0]
mov ax, word [edx]
mov word [ebp - 0x12b4], ax
mov ecx, dword [ebp - 0xea0]
add ecx, 2
mov dword [ebp - 0xea0], ecx
mov dx, word [ebp - 0x12b4]
mov word [ebp - 0x13c], dx
push esi
push ebx
add esp, 4
sub esi, 0xbdb6
jmp 0x10005cdd
sub esi, 0x11946
pop esi
push edi
and edi, 0xf2ba
sub edi, 0x72d9
pop edi
push ebx
push eax
add esp, 4
add ebx, 0xc821
pop ebx
movzx eax, word [ebp - 0x13c]
test eax, eax
jne 0x10005d21
movzx ecx, word [ebp - 0x268]
movzx edx, word [ebp - 0x13c]
sub ecx, edx
mov dword [ebp - 0x1900], ecx
jmp 0x10005d84
movzx eax, word [ebp - 0x268]
movzx ecx, word [ebp - 0x13c]
cmp eax, ecx
je 0x10005c40
movzx edx, word [ebp - 0x268]
xor edx, 0x20
movzx eax, word [ebp - 0x13c]
cmp edx, eax
je 0x10005c40
movzx ecx, word [ebp - 0x268]
movzx edx, word [ebp - 0x13c]
cmp ecx, edx
jge 0x10005d6e
mov dword [ebp - 0x18fc], 0xffffffff
jmp 0x10005d78
mov dword [ebp - 0x18fc], 1
mov eax, dword [ebp - 0x18fc]
mov dword [ebp - 0x1900], eax
cmp dword [ebp - 0x1900], 0
jne 0x10005dcd
push edx
push edx
add esp, 4
sub edx, 0x1dab
jmp 0x10005d9d
pop edx
push eax
push ecx
add esp, 4
and eax, 0x87d3
pop eax
push ebx
jmp 0x10005db2
add ebx, 0x15970
sub ebx, 0xdfbe
pop ebx
mov ecx, dword [ebp - 0x5c8]
mov dword [ebp - 0x870], ecx
jmp 0x10005e35
push ebx
push esi
add esp, 4
and ebx, 0x2df8
sub ebx, 0xa3e0
pop ebx
push esi
push ebx
add esp, 4
jmp 0x10005ded
jmp 0x10005df2
add esi, 0x878
add esi, 0xfe47
pop esi
mov edx, dword [ebp - 0x5c8]
mov eax, dword [edx]
mov dword [ebp - 0x5c8], eax
mov ecx, dword [ebp - 0x5c8]
cmp ecx, dword [ebp - 0xea4]
je 0x10005e2b
mov edx, dword [ebp - 0x5c8]
cmp dword [edx + 0x30], 0
jne 0x10005be1
mov dword [ebp - 0x870], 0
Function at 0x10005c68
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edx
call 0x10005c51
add byte [edi + 0x3f], cl
cmp al, 0x43
cmp dword [eax + 0x3b], ecx
inc edx
inc ecx
inc ebp
add esp, 4
and edx, 0x172db
call fcn.10005c68
add byte [edi], bh
dec ebx
dec ecx
xor eax, 0x36504b41
add esp, 4
sub edx, 0x17447
pop edx
mov ecx, dword [ebp - 0xe9c]
mov dx, word [ecx]
mov word [ebp - 0x12b2], dx
mov eax, dword [ebp - 0xe9c]
add eax, 2
mov dword [ebp - 0xe9c], eax
mov cx, word [ebp - 0x12b2]
mov word [ebp - 0x268], cx
mov edx, dword [ebp - 0xea0]
mov ax, word [edx]
mov word [ebp - 0x12b4], ax
mov ecx, dword [ebp - 0xea0]
add ecx, 2
mov dword [ebp - 0xea0], ecx
mov dx, word [ebp - 0x12b4]
mov word [ebp - 0x13c], dx
push esi
push ebx
add esp, 4
sub esi, 0xbdb6
jmp 0x10005cdd
sub esi, 0x11946
pop esi
push edi
and edi, 0xf2ba
sub edi, 0x72d9
pop edi
push ebx
push eax
add esp, 4
add ebx, 0xc821
pop ebx
movzx eax, word [ebp - 0x13c]
test eax, eax
jne 0x10005d21
movzx ecx, word [ebp - 0x268]
movzx edx, word [ebp - 0x13c]
sub ecx, edx
mov dword [ebp - 0x1900], ecx
jmp 0x10005d84
movzx eax, word [ebp - 0x268]
movzx ecx, word [ebp - 0x13c]
cmp eax, ecx
je 0x10005c40
movzx edx, word [ebp - 0x268]
xor edx, 0x20
movzx eax, word [ebp - 0x13c]
cmp edx, eax
je 0x10005c40
movzx ecx, word [ebp - 0x268]
movzx edx, word [ebp - 0x13c]
cmp ecx, edx
jge 0x10005d6e
mov dword [ebp - 0x18fc], 0xffffffff
jmp 0x10005d78
mov dword [ebp - 0x18fc], 1
mov eax, dword [ebp - 0x18fc]
mov dword [ebp - 0x1900], eax
cmp dword [ebp - 0x1900], 0
jne 0x10005dcd
push edx
push edx
add esp, 4
sub edx, 0x1dab
jmp 0x10005d9d
pop edx
push eax
push ecx
add esp, 4
and eax, 0x87d3
pop eax
push ebx
jmp 0x10005db2
add ebx, 0x15970
sub ebx, 0xdfbe
pop ebx
mov ecx, dword [ebp - 0x5c8]
mov dword [ebp - 0x870], ecx
jmp 0x10005e35
push ebx
push esi
add esp, 4
and ebx, 0x2df8
sub ebx, 0xa3e0
pop ebx
push esi
push ebx
add esp, 4
jmp 0x10005ded
jmp 0x10005df2
add esi, 0x878
add esi, 0xfe47
pop esi
mov edx, dword [ebp - 0x5c8]
mov eax, dword [edx]
mov dword [ebp - 0x5c8], eax
mov ecx, dword [ebp - 0x5c8]
cmp ecx, dword [ebp - 0xea4]
je 0x10005e2b
mov edx, dword [ebp - 0x5c8]
cmp dword [edx + 0x30], 0
jne 0x10005be1
mov dword [ebp - 0x870], 0
Function at 0x10006919
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x888]
add edx, 1
mov dword [ebp - 0x888], edx
mov eax, dword [ebp - 0x884]
mov ecx, dword [ebp - 0x888]
cmp ecx, dword [eax + 0x18]
jae 0x100069d5
mov edx, dword [ebp - 0x888]
mov eax, dword [ebp - 0x26d4]
mov ecx, dword [ebp - 0x3ac]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x88c], ecx
mov edx, dword [ebp - 0x888]
mov eax, dword [ebp - 0x26d8]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x1f3c]
mov eax, dword [ebp - 0x3ac]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x1f40], eax
mov dword [ebp - 0x1dc], 0
jmp 0x10006839
mov ecx, dword [ebp - 0x1dc]
add ecx, 1
mov dword [ebp - 0x1dc], ecx
mov edx, dword [ebp - 0x88c]
add edx, dword [ebp - 0x1dc]
movsx eax, byte [edx]
test eax, eax
je 0x100068eb
mov ecx, dword [ebp - 0x1dc]
movsx edx, byte [ebp + ecx - 0x9c0]
test edx, edx
je 0x100068eb
push ebx
push eax
add esp, 4
sub ebx, 0xbcc5
or ebx, 0xce94
pop ebx
push ebx
push ecx
add esp, 4
or ebx, 0x16654
add ebx, 0xf20c
pop ebx
push ebx
xor ebx, 0x14bac
or ebx, 0xefc1
pop ebx
mov eax, dword [ebp - 0x88c]
add eax, dword [ebp - 0x1dc]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x1dc]
movsx eax, byte [ebp + edx - 0x9c0]
cmp ecx, eax
je 0x100068dd
mov ecx, dword [ebp - 0x88c]
add ecx, dword [ebp - 0x1dc]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x1dc]
movsx ecx, byte [ebp + eax - 0x9c0]
cmp edx, ecx
jne 0x100068e4
jmp 0x1000682a
jmp 0x100068eb
push esi
push ecx
add esp, 4
jmp 0x100068f5
pop esi
push eax
add eax, 0x17cd5
sub eax, 0x1095b
xor eax, 0x13eff
call fcn.10006919
add byte [edx + eax*2 + 0x32], cl
aas
inc eax
cmp dword [0x8348333d], esi
add esp, 4
pop eax
add esp, 4
pop eax
mov edx, dword [ebp - 0x88c]
add edx, dword [ebp - 0x1dc]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x1dc]
movsx edx, byte [ebp + ecx - 0x9c0]
cmp eax, edx
jne 0x1000694a
mov dword [ebp - 0xeb8], 0
jmp 0x100069b9
push edx
xor edx, 0x97a0
and edx, 0x14cb
call 0x10006963
add byte [edx + 0x37], al
dec ebx
inc ecx
aas
xor al, 0x83
les eax, [edx + ebx*2]
push ecx
push edi
add esp, 4
jmp 0x10006975
jmp 0x1000697b
pop ecx
mov eax, dword [ebp - 0x88c]
add eax, dword [ebp - 0x1dc]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x1dc]
movsx eax, byte [ebp + edx - 0x9c0]
or eax, 0x20
cmp ecx, eax
jge 0x100069af
mov dword [ebp - 0xeb8], 0xffffffff
jmp 0x100069b9
mov dword [ebp - 0xeb8], 1
cmp dword [ebp - 0xeb8], 0
jne 0x100069d0
mov ecx, dword [ebp - 0x1f40]
mov dword [ebp - 0x5d0], ecx
jmp 0x100069e1
jmp 0x100067ba
mov edx, dword [ebp - 0x890]
mov dword [ebp - 0x5d0], edx
mov eax, dword [ebp - 0x5d0]
mov dword [ebp - 0x8bc], eax