joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7003f91
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x7003fa0
pop dword [ebp - 0x20]
mov eax, 0x7003fa0
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x5b5bee4e
add dword [ebp - 0x30], 0xf2f656fd
mov dword [ebp - 0x2c], 0x1414e40a
sub dword [ebp - 0x2c], 0xe1e197c5
mov dword [ebp - 0x28], 0x4b72a6d6
add dword [ebp - 0x28], 0xd99d58
mov dword [ebp - 0x24], 0xfa072d7
add dword [ebp - 0x24], 0xf05f8d29
lea eax, [ebp - 0x30]
push eax
mov eax, 0x44492dac
sub eax, 0x3d480d7c
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x6d511585
sub dword [ebp - 0x30], 0xf8deac2f
mov dword [ebp - 0x2c], 0x8171b303
sub dword [ebp - 0x2c], 0x4005518e
mov dword [ebp - 0x28], 0x28d4d902
add dword [ebp - 0x28], 0x3a9a936a
mov dword [ebp - 0x24], 0xdffc850e
sub dword [ebp - 0x24], 0xdffc850e
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0xf6b386ab
sub eax, 0xefb26677
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x396e1
push 0
call eax
mov ecx, 0xdbbc58c2
sub ecx, 0xdbbc158d
mov esi, eax
mov edx, 0x519b0a9f
add edx, 0xb566d561
add edx, dword [ebp - 0x20]
mov edi, 0x2e3ad984
sub edi, 0xf8c2f9ec
sub dword [ebp - 0x10], ebx
mov ebx, dword [edx]
add dword [ebp - 0x10], 0x6b8e6fa4
add ebx, edi
xor dword [ebp - 0xc], 0x451301b0
mov dword [esi], ebx
sub dword [ebp - 0xc], 0xfcc77a17
add esi, 4
add edx, 0xae52e1c9
sub edx, 0xae52e1c5
loop 0x70040bd
add eax, 0x94f52f2
add eax, 0xf6b1acb5
xor ebx, ebx
add ebx, eax
add eax, 0x777b5876
sub eax, 0x777b5871
mov ecx, 0x1a3717f8
sub ecx, 0x133717f8
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x700c938
Capabilities:
Set current directory

Disassembly:
push 8
mov eax, 0x7010cdd
call fcn.07001ea6
mov edi, ecx
mov dword [ebp - 0x14], edi
mov esi, dword [ebp + 8]
push esi
call fcn.0700cc00
xor ebx, ebx
mov dword [edi], vtable.FileSharedStream.0
mov dword [edi + 0xc], ebx
mov byte [edi + 0x10], bl
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
lea eax, [edi + 0x18]
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.0700d3f5
lea ecx, [ebp - 0x10]
call fcn.0700c8d5
mov eax, dword [edi + 0x14]
mov byte [ebp - 4], 2
push dword [eax + 0x14]
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
mov eax, dword [edi + 0x14]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x700c9a5
mov eax, dword [eax + 0x14]
jmp 0x700c9aa
mov eax, 0x70127b2
push 0x701411c
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov dword [edi + 0xc], eax
pop ecx
pop ecx
test eax, eax
je 0x700c9dc
mov ecx, dword [edi + 4]
call fcn.07007826
lea ecx, [ebp - 0x10]
mov dword [edi + 8], eax
call fcn.07003f91
mov eax, edi
call fcn.07002b7f
ret 4
push str.file_does_not_exist
push ebx
call fcn.07003f91
int3
Function at 0xa81058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00a811a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xa8107e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa8106a
add dl, dl
jne 0xa81089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa810dc
xor eax, eax
add dl, dl
jne 0xa81096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa8117d
add dl, dl
jne 0xa810a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa810b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa810bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa810c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xa810d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xa81075
mov eax, 1
add dl, dl
jne 0xa810ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa810f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa810e1
sub eax, ebx
mov ebx, 1
jne 0xa81128
mov ecx, 1
add dl, dl
jne 0xa8110e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa81119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa81105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa81075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xa8113f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa8114a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa81136
cmp eax, 0x7d00
jae 0xa8116d
cmp eax, 0x500
jb 0xa81168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa81075
cmp eax, 0x7f
ja 0xa81170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa81075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xa8119e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xa81075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10003bdc
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop eax
push eax
call 0x10003bef
add byte [esi + 0x44], cl
inc eax
dec ecx
dec esi
dec edx
cmp al, 0x3e
add esp, 4
pop eax
mov eax, 0x4d
mov word [ebp - 0x2008], ax
mov ecx, 0x42
mov word [ebp - 0x2006], cx
mov edx, 0x53
mov word [ebp - 0x2004], dx
mov eax, 0x65
mov word [ebp - 0x2002], ax
mov ecx, 0x72
mov word [ebp - 0x2000], cx
mov edx, 0x76
mov word [ebp - 0x1ffe], dx
mov eax, 0x69
mov word [ebp - 0x1ffc], ax
mov ecx, 0x63
mov word [ebp - 0x1ffa], cx
mov edx, 0x65
mov word [ebp - 0x1ff8], dx
mov eax, 0x2e
mov word [ebp - 0x1ff6], ax
mov ecx, 0x65
mov word [ebp - 0x1ff4], cx
mov edx, 0x78
mov word [ebp - 0x1ff2], dx
mov eax, 0x65
mov word [ebp - 0x1ff0], ax
xor ecx, ecx
mov word [ebp - 0x1fee], cx
mov dword [ebp - 0x1064], 1
push edx
push esi
add esp, 4
add edx, 0xbd0f
pop edx
push edi
and edi, 0xe08a
and edi, 0x4308
xor edi, 0xbec2
call 0x10003cd0
add byte [ebx], dh
cmp ecx, dword [edx + 0x4a]
dec esp
xor ecx, dword [esi + 0x4b]
cmp byte [ebx + 0x695f04c4], al
xchg ebp, eax
pushfd
out dx, eax
invalid

Function at 0x10003bef
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop eax
push eax
call 0x10003bef
add byte [esi + 0x44], cl
inc eax
dec ecx
dec esi
dec edx
cmp al, 0x3e
add esp, 4
pop eax
mov eax, 0x4d
mov word [ebp - 0x2008], ax
mov ecx, 0x42
mov word [ebp - 0x2006], cx
mov edx, 0x53
mov word [ebp - 0x2004], dx
mov eax, 0x65
mov word [ebp - 0x2002], ax
mov ecx, 0x72
mov word [ebp - 0x2000], cx
mov edx, 0x76
mov word [ebp - 0x1ffe], dx
mov eax, 0x69
mov word [ebp - 0x1ffc], ax
mov ecx, 0x63
mov word [ebp - 0x1ffa], cx
mov edx, 0x65
mov word [ebp - 0x1ff8], dx
mov eax, 0x2e
mov word [ebp - 0x1ff6], ax
mov ecx, 0x65
mov word [ebp - 0x1ff4], cx
mov edx, 0x78
mov word [ebp - 0x1ff2], dx
mov eax, 0x65
mov word [ebp - 0x1ff0], ax
xor ecx, ecx
mov word [ebp - 0x1fee], cx
mov dword [ebp - 0x1064], 1
push edx
push esi
add esp, 4
add edx, 0xbd0f
pop edx
push edi
and edi, 0xe08a
and edi, 0x4308
xor edi, 0xbec2
call 0x10003cd0
add byte [ebx], dh
cmp ecx, dword [edx + 0x4a]
dec esp
xor ecx, dword [esi + 0x4b]
cmp byte [ebx + 0x695f04c4], al
xchg ebp, eax
pushfd
out dx, eax
invalid
Function at 0x10003cd0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop eax
push eax
call 0x10003bef
add byte [esi + 0x44], cl
inc eax
dec ecx
dec esi
dec edx
cmp al, 0x3e
add esp, 4
pop eax
mov eax, 0x4d
mov word [ebp - 0x2008], ax
mov ecx, 0x42
mov word [ebp - 0x2006], cx
mov edx, 0x53
mov word [ebp - 0x2004], dx
mov eax, 0x65
mov word [ebp - 0x2002], ax
mov ecx, 0x72
mov word [ebp - 0x2000], cx
mov edx, 0x76
mov word [ebp - 0x1ffe], dx
mov eax, 0x69
mov word [ebp - 0x1ffc], ax
mov ecx, 0x63
mov word [ebp - 0x1ffa], cx
mov edx, 0x65
mov word [ebp - 0x1ff8], dx
mov eax, 0x2e
mov word [ebp - 0x1ff6], ax
mov ecx, 0x65
mov word [ebp - 0x1ff4], cx
mov edx, 0x78
mov word [ebp - 0x1ff2], dx
mov eax, 0x65
mov word [ebp - 0x1ff0], ax
xor ecx, ecx
mov word [ebp - 0x1fee], cx
mov dword [ebp - 0x1064], 1
push edx
push esi
add esp, 4
add edx, 0xbd0f
pop edx
push edi
and edi, 0xe08a
and edi, 0x4308
xor edi, 0xbec2
call 0x10003cd0
add byte [ebx], dh
cmp ecx, dword [edx + 0x4a]
dec esp
xor ecx, dword [esi + 0x4b]
cmp byte [ebx + 0x695f04c4], al
xchg ebp, eax
pushfd
out dx, eax
invalid
Function at 0x10003d56
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
and ecx, 0x11f58
pop ecx
push ecx
push edi
add esp, 4
and ecx, 0x56b5
or ecx, 0x178d9
pop ecx
push ebx
sub ebx, 0xddfb
pop ebx
imul edx, dword [ebp - 0x10], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x10], 0xfe
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0xfe
sub edx, ecx
mov dword [ebp - 0x14], edx
push edx
push edi
add esp, 4
and edx, 0x81aa
or edx, 0x15066
pop edx
push edx
push edi
add esp, 4
sub edx, 0xf963
pop edx
push ebx
or ebx, 0x180fa
or ebx, 0x11a60
or ebx, 0xa1bc
pop ebx
push edx
sub edx, 0xfda0
xor edx, 0x264c
or edx, 0x7f7e
pop edx
push ecx
push eax
add esp, 4
and ecx, 0x44c1
or ecx, 0xc5ba
or ecx, 0xb562
xor ecx, 0x449d
pop ecx
mov dword [ebp - 0x2c], 1
push edx
and edx, 0x15c0e
and edx, 0x127ee
add edx, 0x113ba
add edx, 0x5758
pop edx
push ebx
push ebx
add esp, 4
add ebx, 0x152b6
or ebx, 0x3c99
xor ebx, 0x16598
pop ebx
imul edx, dword [ebp - 0x2c], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x2c], 0xfe
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0xfe
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x10004024
mov ecx, dword [ebp - 0x1068]
mov edx, dword [ebp - 0x1064]
mov dword [ebp - 0x163c], ecx
mov dword [ebp - 0x1638], edx
push edx
push ebx
add esp, 4
call 0x10004050
add byte [esi], bh
aaa
cmp al, 0x46
xor edi, dword [edx + ecx*2]
dec ebx
push eax
add esp, 4
xor edx, 0x98dd
pop edx
push eax
or eax, 0x25d2
sub eax, 0xd10
and eax, 0x304a
pop eax
push edi
push esi
add esp, 4
and edi, 0x182c8
pop edi
push edi
push ecx
add esp, 4
xor edi, 0x8c3
call 0x10004091
add byte [ecx], bh
inc edi
cmp esi, dword [edi]
inc ebx
cmp eax, dword [ebx + 0x3eb04c4]
dec eax
dec edi
and edi, 0x4bdf
pop edi
mov eax, dword [ebp - 0x30]
add eax, 0xfe
imul ecx, dword [ebp - 0x2c], 0xfe
add ecx, 0x56f3663b
imul edx, dword [ebp - 0x2c], 0xfe
sub ecx, edx
xor eax, ecx
imul eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1e3c], eax
push eax
or eax, 0xa2bb
or eax, 0x1267d
add eax, 0x1279c
pop eax
push ecx
push edx
add esp, 4
or ecx, 0x1773
jmp 0x100040f0
pop ecx
push ebx
jmp 0x100040fb
pop ebx
mov eax, dword [ebp - 0x163c]
add eax, 0xfe
imul ecx, dword [ebp - 0x1638], 0xfe
add ecx, 0x56f3663b
imul edx, dword [ebp - 0x1638], 0xfe
sub ecx, edx
xor eax, ecx
imul eax, dword [ebp - 0x1638]
mov dword [ebp - 0x1e38], eax
mov eax, dword [ebp - 0x1e38]
mov dword [ebp - 0x1e40], eax
mov ecx, dword [ebp - 0x1e3c]
cmp ecx, dword [ebp - 0x1e40]
jae 0x10004158
mov dword [ebp - 0x15ac], 1
jmp 0x10004162
mov dword [ebp - 0x15ac], 0
mov dl, byte [ebp - 0x15ac]
mov byte [ebp - 0x3ad], dl
movzx eax, byte [ebp - 0x3ad]
test eax, eax
je 0x100071d5
push ebx
jmp 0x10004184
call 0x10004193
add byte [ecx + 0x40], al
dec esp
inc ecx
inc edx
push eax
xor eax, 0xc4833446
add al, 0x81
jmp 0x100041f8
inc ebp
aam 0xfe
add byte [eax], al
add byte [ebx], ch
sal byte [ebx], 1
retf 0xaf0f
mov dword [ebp - 0x3f4], 0
call 0x100071e4
mov eax, 0x13379797
pop eax
mov dword [ebp - 0x3f4], eax
Function at 0x10004050
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
and ecx, 0x11f58
pop ecx
push ecx
push edi
add esp, 4
and ecx, 0x56b5
or ecx, 0x178d9
pop ecx
push ebx
sub ebx, 0xddfb
pop ebx
imul edx, dword [ebp - 0x10], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x10], 0xfe
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0xfe
sub edx, ecx
mov dword [ebp - 0x14], edx
push edx
push edi
add esp, 4
and edx, 0x81aa
or edx, 0x15066
pop edx
push edx
push edi
add esp, 4
sub edx, 0xf963
pop edx
push ebx
or ebx, 0x180fa
or ebx, 0x11a60
or ebx, 0xa1bc
pop ebx
push edx
sub edx, 0xfda0
xor edx, 0x264c
or edx, 0x7f7e
pop edx
push ecx
push eax
add esp, 4
and ecx, 0x44c1
or ecx, 0xc5ba
or ecx, 0xb562
xor ecx, 0x449d
pop ecx
mov dword [ebp - 0x2c], 1
push edx
and edx, 0x15c0e
and edx, 0x127ee
add edx, 0x113ba
add edx, 0x5758
pop edx
push ebx
push ebx
add esp, 4
add ebx, 0x152b6
or ebx, 0x3c99
xor ebx, 0x16598
pop ebx
imul edx, dword [ebp - 0x2c], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x2c], 0xfe
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0xfe
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x10004024
mov ecx, dword [ebp - 0x1068]
mov edx, dword [ebp - 0x1064]
mov dword [ebp - 0x163c], ecx
mov dword [ebp - 0x1638], edx
push edx
push ebx
add esp, 4
call 0x10004050
add byte [esi], bh
aaa
cmp al, 0x46
xor edi, dword [edx + ecx*2]
dec ebx
push eax
add esp, 4
xor edx, 0x98dd
pop edx
push eax
or eax, 0x25d2
sub eax, 0xd10
and eax, 0x304a
pop eax
push edi
push esi
add esp, 4
and edi, 0x182c8
pop edi
push edi
push ecx
add esp, 4
xor edi, 0x8c3
call 0x10004091
add byte [ecx], bh
inc edi
cmp esi, dword [edi]
inc ebx
cmp eax, dword [ebx + 0x3eb04c4]
dec eax
dec edi
and edi, 0x4bdf
pop edi
mov eax, dword [ebp - 0x30]
add eax, 0xfe
imul ecx, dword [ebp - 0x2c], 0xfe
add ecx, 0x56f3663b
imul edx, dword [ebp - 0x2c], 0xfe
sub ecx, edx
xor eax, ecx
imul eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1e3c], eax
push eax
or eax, 0xa2bb
or eax, 0x1267d
add eax, 0x1279c
pop eax
push ecx
push edx
add esp, 4
or ecx, 0x1773
jmp 0x100040f0
pop ecx
push ebx
jmp 0x100040fb
pop ebx
mov eax, dword [ebp - 0x163c]
add eax, 0xfe
imul ecx, dword [ebp - 0x1638], 0xfe
add ecx, 0x56f3663b
imul edx, dword [ebp - 0x1638], 0xfe
sub ecx, edx
xor eax, ecx
imul eax, dword [ebp - 0x1638]
mov dword [ebp - 0x1e38], eax
mov eax, dword [ebp - 0x1e38]
mov dword [ebp - 0x1e40], eax
mov ecx, dword [ebp - 0x1e3c]
cmp ecx, dword [ebp - 0x1e40]
jae 0x10004158
mov dword [ebp - 0x15ac], 1
jmp 0x10004162
mov dword [ebp - 0x15ac], 0
mov dl, byte [ebp - 0x15ac]
mov byte [ebp - 0x3ad], dl
movzx eax, byte [ebp - 0x3ad]
test eax, eax
je 0x100071d5
push ebx
jmp 0x10004184
call 0x10004193
add byte [ecx + 0x40], al
dec esp
inc ecx
inc edx
push eax
xor eax, 0xc4833446
add al, 0x81
jmp 0x100041f8
inc ebp
aam 0xfe
add byte [eax], al
add byte [ebx], ch
sal byte [ebx], 1
retf 0xaf0f
mov dword [ebp - 0x3f4], 0
call 0x100071e4
mov eax, 0x13379797
pop eax
mov dword [ebp - 0x3f4], eax
Function at 0x10004091
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
and ecx, 0x11f58
pop ecx
push ecx
push edi
add esp, 4
and ecx, 0x56b5
or ecx, 0x178d9
pop ecx
push ebx
sub ebx, 0xddfb
pop ebx
imul edx, dword [ebp - 0x10], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x10], 0xfe
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0xfe
sub edx, ecx
mov dword [ebp - 0x14], edx
push edx
push edi
add esp, 4
and edx, 0x81aa
or edx, 0x15066
pop edx
push edx
push edi
add esp, 4
sub edx, 0xf963
pop edx
push ebx
or ebx, 0x180fa
or ebx, 0x11a60
or ebx, 0xa1bc
pop ebx
push edx
sub edx, 0xfda0
xor edx, 0x264c
or edx, 0x7f7e
pop edx
push ecx
push eax
add esp, 4
and ecx, 0x44c1
or ecx, 0xc5ba
or ecx, 0xb562
xor ecx, 0x449d
pop ecx
mov dword [ebp - 0x2c], 1
push edx
and edx, 0x15c0e
and edx, 0x127ee
add edx, 0x113ba
add edx, 0x5758
pop edx
push ebx
push ebx
add esp, 4
add ebx, 0x152b6
or ebx, 0x3c99
xor ebx, 0x16598
pop ebx
imul edx, dword [ebp - 0x2c], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x2c], 0xfe
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0xfe
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x10004024
mov ecx, dword [ebp - 0x1068]
mov edx, dword [ebp - 0x1064]
mov dword [ebp - 0x163c], ecx
mov dword [ebp - 0x1638], edx
push edx
push ebx
add esp, 4
call 0x10004050
add byte [esi], bh
aaa
cmp al, 0x46
xor edi, dword [edx + ecx*2]
dec ebx
push eax
add esp, 4
xor edx, 0x98dd
pop edx
push eax
or eax, 0x25d2
sub eax, 0xd10
and eax, 0x304a
pop eax
push edi
push esi
add esp, 4
and edi, 0x182c8
pop edi
push edi
push ecx
add esp, 4
xor edi, 0x8c3
call 0x10004091
add byte [ecx], bh
inc edi
cmp esi, dword [edi]
inc ebx
cmp eax, dword [ebx + 0x3eb04c4]
dec eax
dec edi
and edi, 0x4bdf
pop edi
mov eax, dword [ebp - 0x30]
add eax, 0xfe
imul ecx, dword [ebp - 0x2c], 0xfe
add ecx, 0x56f3663b
imul edx, dword [ebp - 0x2c], 0xfe
sub ecx, edx
xor eax, ecx
imul eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1e3c], eax
push eax
or eax, 0xa2bb
or eax, 0x1267d
add eax, 0x1279c
pop eax
push ecx
push edx
add esp, 4
or ecx, 0x1773
jmp 0x100040f0
pop ecx
push ebx
jmp 0x100040fb
pop ebx
mov eax, dword [ebp - 0x163c]
add eax, 0xfe
imul ecx, dword [ebp - 0x1638], 0xfe
add ecx, 0x56f3663b
imul edx, dword [ebp - 0x1638], 0xfe
sub ecx, edx
xor eax, ecx
imul eax, dword [ebp - 0x1638]
mov dword [ebp - 0x1e38], eax
mov eax, dword [ebp - 0x1e38]
mov dword [ebp - 0x1e40], eax
mov ecx, dword [ebp - 0x1e3c]
cmp ecx, dword [ebp - 0x1e40]
jae 0x10004158
mov dword [ebp - 0x15ac], 1
jmp 0x10004162
mov dword [ebp - 0x15ac], 0
mov dl, byte [ebp - 0x15ac]
mov byte [ebp - 0x3ad], dl
movzx eax, byte [ebp - 0x3ad]
test eax, eax
je 0x100071d5
push ebx
jmp 0x10004184
call 0x10004193
add byte [ecx + 0x40], al
dec esp
inc ecx
inc edx
push eax
xor eax, 0xc4833446
add al, 0x81
jmp 0x100041f8
inc ebp
aam 0xfe
add byte [eax], al
add byte [ebx], ch
sal byte [ebx], 1
retf 0xaf0f
mov dword [ebp - 0x3f4], 0
call 0x100071e4
mov eax, 0x13379797
pop eax
mov dword [ebp - 0x3f4], eax
Function at 0x10009460
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edi
push eax
add esp, 4
add edi, 0x4cbe
jmp 0x1000934b
and edi, 0x97fc
xor edi, 0x3c7f
pop edi
push edx
push edx
add esp, 4
or edx, 0x3faf
xor edx, 0x3aa5
pop edx
lea edx, [ebp - 0x1740]
mov dword [ebp - 0xcc4], edx
mov eax, dword [ebp - 0x518]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcc0], ecx
xor edx, edx
mov word [ebp - 0x21c], dx
xor eax, eax
mov word [ebp - 0x38], ax
push ebx
xor ebx, 0x1191e
pop ebx
push ecx
push edx
add esp, 4
or ecx, 0xc37a
xor ecx, 0x16fbf
pop ecx
push ecx
push edi
add esp, 4
or ecx, 0x5f8a
and ecx, 0x722e
or ecx, 0x390f
pop ecx
mov ecx, dword [ebp - 0xcc0]
mov dx, word [ecx]
mov word [ebp - 0x1042], dx
mov eax, dword [ebp - 0xcc0]
add eax, 2
mov dword [ebp - 0xcc0], eax
mov cx, word [ebp - 0x1042]
mov word [ebp - 0x21c], cx
mov edx, dword [ebp - 0xcc4]
mov ax, word [edx]
mov word [ebp - 0x1044], ax
mov ecx, dword [ebp - 0xcc4]
add ecx, 2
mov dword [ebp - 0xcc4], ecx
mov dx, word [ebp - 0x1044]
mov word [ebp - 0x38], dx
push ebx
push esi
add esp, 4
and ebx, 0x7394
xor ebx, 0x6e0f
pop ebx
push eax
xor eax, 0x794e
pop eax
push edx
push ebx
add esp, 4
xor edx, 0x17fb5
add edx, 0x2952
jmp 0x1000944e
pop edx
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x1000946c
movzx ecx, word [ebp - 0x21c]
movzx edx, word [ebp - 0x38]
push ebp
enter 0xffffffffffffca2b, 0xffffffffffffff89
invalid
fsub st(1), st(0)
invalid
invalid
jmp 0x100094c6
movzx eax, word [ebp - 0x21c]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x10009394
movzx edx, word [ebp - 0x21c]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x10009394
movzx ecx, word [ebp - 0x21c]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x100094b0
mov dword [ebp - 0x1620], 0xffffffff
jmp 0x100094ba
mov dword [ebp - 0x1620], 1
mov eax, dword [ebp - 0x1620]
mov dword [ebp - 0x1624], eax
cmp dword [ebp - 0x1624], 0
jne 0x1000950f
push ecx
push esi
add esp, 4
call fcn.100094e3
add byte [0x3d4f323a], dh
xor al, 0x34
dec esi
inc esp
push edx
call fcn.1000951f
add byte [eax + 0x43], al
dec edi
dec ecx
aaa
cmp dh, byte [0xc4833e3b]
add esp, 4
invalid
add esp, 4
xor edx, 0x11379
bnd jns 0x10009539
add dword [eax], eax
pop edx
push eax
add eax, 0xaae4
jmp 0x10009538
pop eax
push ebx
add ebx, 0x55aa
pop ebx
mov edx, dword [ebp - 0x518]
mov eax, dword [edx]
mov dword [ebp - 0x518], eax
mov ecx, dword [ebp - 0x518]
cmp ecx, dword [ebp - 0xcc8]
je 0x1000956d
mov edx, dword [ebp - 0x518]
cmp dword [edx + 0x30], 0
jne 0x10009338
mov dword [ebp - 0x2f4], 0

Function at 0x100094e3
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor ecx, 0x4dee
pop ecx
push ebx
jmp 0x100094f4
sub ebx, 0x171cc
and ebx, 0x1673c
pop ebx
mov ecx, dword [ebp - 0x518]
mov dword [ebp - 0x2f4], ecx
jmp 0x10009577
Function at 0x1000951f
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edi
push eax
add esp, 4
add edi, 0x4cbe
jmp 0x1000934b
and edi, 0x97fc
xor edi, 0x3c7f
pop edi
push edx
push edx
add esp, 4
or edx, 0x3faf
xor edx, 0x3aa5
pop edx
lea edx, [ebp - 0x1740]
mov dword [ebp - 0xcc4], edx
mov eax, dword [ebp - 0x518]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcc0], ecx
xor edx, edx
mov word [ebp - 0x21c], dx
xor eax, eax
mov word [ebp - 0x38], ax
push ebx
xor ebx, 0x1191e
pop ebx
push ecx
push edx
add esp, 4
or ecx, 0xc37a
xor ecx, 0x16fbf
pop ecx
push ecx
push edi
add esp, 4
or ecx, 0x5f8a
and ecx, 0x722e
or ecx, 0x390f
pop ecx
mov ecx, dword [ebp - 0xcc0]
mov dx, word [ecx]
mov word [ebp - 0x1042], dx
mov eax, dword [ebp - 0xcc0]
add eax, 2
mov dword [ebp - 0xcc0], eax
mov cx, word [ebp - 0x1042]
mov word [ebp - 0x21c], cx
mov edx, dword [ebp - 0xcc4]
mov ax, word [edx]
mov word [ebp - 0x1044], ax
mov ecx, dword [ebp - 0xcc4]
add ecx, 2
mov dword [ebp - 0xcc4], ecx
mov dx, word [ebp - 0x1044]
mov word [ebp - 0x38], dx
push ebx
push esi
add esp, 4
and ebx, 0x7394
xor ebx, 0x6e0f
pop ebx
push eax
xor eax, 0x794e
pop eax
push edx
push ebx
add esp, 4
xor edx, 0x17fb5
add edx, 0x2952
jmp 0x1000944e
pop edx
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x1000946c
movzx ecx, word [ebp - 0x21c]
movzx edx, word [ebp - 0x38]
push ebp
enter 0xffffffffffffca2b, 0xffffffffffffff89
invalid
fsub st(1), st(0)
invalid
invalid
jmp 0x100094c6
movzx eax, word [ebp - 0x21c]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x10009394
movzx edx, word [ebp - 0x21c]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x10009394
movzx ecx, word [ebp - 0x21c]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x100094b0
mov dword [ebp - 0x1620], 0xffffffff
jmp 0x100094ba
mov dword [ebp - 0x1620], 1
mov eax, dword [ebp - 0x1620]
mov dword [ebp - 0x1624], eax
cmp dword [ebp - 0x1624], 0
jne 0x1000950f
push ecx
push esi
add esp, 4
call fcn.100094e3
add byte [0x3d4f323a], dh
xor al, 0x34
dec esi
inc esp
push edx
call fcn.1000951f
add byte [eax + 0x43], al
dec edi
dec ecx
aaa
cmp dh, byte [0xc4833e3b]
add esp, 4
invalid
add esp, 4
xor edx, 0x11379
bnd jns 0x10009539
add dword [eax], eax
pop edx
push eax
add eax, 0xaae4
jmp 0x10009538
pop eax
push ebx
add ebx, 0x55aa
pop ebx
mov edx, dword [ebp - 0x518]
mov eax, dword [edx]
mov dword [ebp - 0x518], eax
mov ecx, dword [ebp - 0x518]
cmp ecx, dword [ebp - 0xcc8]
je 0x1000956d
mov edx, dword [ebp - 0x518]
cmp dword [edx + 0x30], 0
jne 0x10009338
mov dword [ebp - 0x2f4], 0
Function at 0x10009630
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
add byte [esi - 0x77], ah
lea esi, [eax + ebp*8 - 1]
invalid