joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4005cffa
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x4005d044
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x4005cfeb
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x4005cffa
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x40462c9d
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x4005d04b
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.40043ec1
cmp eax, dword [ebp + 0xc]
pop eax
je 0x4005d0ea
add edi, 4
add eax, 2
dec ecx
jne 0x4005d030
call 0x4005d097
loope 0x4005d08d
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x4005d0e7
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x4005d0f8
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x4005d0ab
cmp eax, ecx
ja 0x4005d0ab
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x4005d135
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x4005d12b
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.400443a0
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x40b670
Capabilities:
Hash data using sha256

Disassembly:
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov edi, dword [esi + 0x20]
and edi, 0x3f
mov byte [edi + esi + 0x28], 0x80
inc edi
xor ebx, ebx
mov ebp, edx
cmp edi, 0x38
je 0x40b6a5
jmp 0x40b690
and edi, 0x3f
jne 0x40b69b
push esi
call fcn.0040b1b0
mov byte [esi + edi + 0x28], bl
inc edi
cmp edi, 0x38
jne 0x40b690
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x24]
shld ecx, eax, 3
add eax, eax
add eax, eax
add eax, eax
bswap ecx
bswap eax
push esi
mov dword [esi + 0x60], ecx
mov dword [esi + 0x64], eax
call fcn.0040b1b0
xor eax, eax
mov ecx, dword [esi + eax*4 + 4]
mov edx, dword [esi + eax*4]
bswap edx
bswap ecx
mov dword [ebp], edx
mov dword [ebp + 4], ecx
add eax, 2
add ebp, 8
cmp eax, 8
jb 0x40b6c7
pop edi
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
pop esi
pop ebp
pop ebx
ret
Function at 0x40b880
Capabilities:
Hash data using sha256

Disassembly:
sub esp, 0x74
push esi
mov esi, ecx
cmp dword [esi], 0x3f
jne 0x40b8e6
xor eax, eax
cmp dword [esi + 4], eax
jbe 0x40b8a0
mov cl, byte [esi + eax + 8]
mov byte [esi + eax + 0x20], cl
inc eax
cmp eax, dword [esi + 4]
jb 0x40b892
xor ecx, ecx
cmp dword [esi + 0x1c], ecx
jbe 0x40b8c1
cmp eax, 0x20
jae 0x40b9e9
mov edx, dword [esi + 0x18]
mov dl, byte [ecx + edx]
mov byte [eax + esi + 0x20], dl
inc ecx
inc eax
cmp ecx, dword [esi + 0x1c]
jb 0x40b8a7
cmp eax, 0x20
jae 0x40b9e9
mov edx, 0x20
sub edx, eax
push edx
lea ecx, [eax + esi + 0x20]
push 0
push ecx
call fcn.004185c0
add esp, 0xc
pop esi
add esp, 0x74
ret
mov eax, dword [esi + 4]
mov ecx, dword [esi + 0x1c]
push ebx
push ebp
lea eax, [eax + ecx + 8]
xor ebp, ebp
xor ebx, ebx
push edi
mov dword [esp + 0x10], eax
cmp eax, ebp
je 0x40b90a
push eax
call fcn.0041857c
add esp, 4
mov ebx, eax
mov edx, dword [esi + 4]
push edx
lea eax, [esi + 8]
push eax
push ebx
call fcn.004185c6
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 0x18]
mov eax, dword [esi + 4]
push ecx
push edx
add eax, ebx
push eax
call fcn.004185c6
mov edi, dword [esi + 4]
add edi, ebx
add edi, dword [esi + 0x1c]
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov ecx, dword [esi]
add esp, 0x18
mov eax, 1
xor edx, edx
mov dword [esp + 0x1c], 0x6a09e667
mov dword [esp + 0x20], 0xbb67ae85
mov dword [esp + 0x24], 0x3c6ef372
mov dword [esp + 0x28], 0xa54ff53a
mov dword [esp + 0x2c], 0x510e527f
mov dword [esp + 0x30], 0x9b05688c
mov dword [esp + 0x34], 0x1f83d9ab
mov dword [esp + 0x38], 0x5be0cd19
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x40], ebp
call 0x418700
mov ebp, eax
mov dword [esp + 0x18], edx
lea esp, [esp]
mov ecx, dword [esp + 0x10]
push ecx
mov edx, ebx
lea ecx, [esp + 0x20]
call fcn.0040b3c0
xor eax, eax
inc byte [eax + edi]
jne 0x40b9bd
inc eax
cmp eax, 8
jb 0x40b9b2
mov eax, dword [esp + 0x18]
add ebp, 0xffffffff
adc eax, 0xffffffff
mov edx, ebp
or edx, eax
mov dword [esp + 0x18], eax
jne 0x40b9a0
lea edx, [esi + 0x20]
lea ecx, [esp + 0x1c]
call fcn.0040b670
push ebx
call fcn.00418570
add esp, 4
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x74
ret
Function at 0x40b883
Capabilities:
Hash data using sha256

Disassembly:
sub esp, 0x74
push esi
mov esi, ecx
cmp dword [esi], 0x3f
jne 0x40b8e6
xor eax, eax
cmp dword [esi + 4], eax
jbe 0x40b8a0
mov cl, byte [esi + eax + 8]
mov byte [esi + eax + 0x20], cl
inc eax
cmp eax, dword [esi + 4]
jb 0x40b892
xor ecx, ecx
cmp dword [esi + 0x1c], ecx
jbe 0x40b8c1
cmp eax, 0x20
jae 0x40b9e9
mov edx, dword [esi + 0x18]
mov dl, byte [ecx + edx]
mov byte [eax + esi + 0x20], dl
inc ecx
inc eax
cmp ecx, dword [esi + 0x1c]
jb 0x40b8a7
cmp eax, 0x20
jae 0x40b9e9
mov edx, 0x20
sub edx, eax
push edx
lea ecx, [eax + esi + 0x20]
push 0
push ecx
call fcn.004185c0
add esp, 0xc
pop esi
add esp, 0x74
ret
mov eax, dword [esi + 4]
mov ecx, dword [esi + 0x1c]
push ebx
push ebp
lea eax, [eax + ecx + 8]
xor ebp, ebp
xor ebx, ebx
push edi
mov dword [esp + 0x10], eax
cmp eax, ebp
je 0x40b90a
push eax
call fcn.0041857c
add esp, 4
mov ebx, eax
mov edx, dword [esi + 4]
push edx
lea eax, [esi + 8]
push eax
push ebx
call fcn.004185c6
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 0x18]
mov eax, dword [esi + 4]
push ecx
push edx
add eax, ebx
push eax
call fcn.004185c6
mov edi, dword [esi + 4]
add edi, ebx
add edi, dword [esi + 0x1c]
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov ecx, dword [esi]
add esp, 0x18
mov eax, 1
xor edx, edx
mov dword [esp + 0x1c], 0x6a09e667
mov dword [esp + 0x20], 0xbb67ae85
mov dword [esp + 0x24], 0x3c6ef372
mov dword [esp + 0x28], 0xa54ff53a
mov dword [esp + 0x2c], 0x510e527f
mov dword [esp + 0x30], 0x9b05688c
mov dword [esp + 0x34], 0x1f83d9ab
mov dword [esp + 0x38], 0x5be0cd19
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x40], ebp
call 0x418700
mov ebp, eax
mov dword [esp + 0x18], edx
lea esp, [esp]
mov ecx, dword [esp + 0x10]
push ecx
mov edx, ebx
lea ecx, [esp + 0x20]
call fcn.0040b3c0
xor eax, eax
inc byte [eax + edi]
jne 0x40b9bd
inc eax
cmp eax, 8
jb 0x40b9b2
mov eax, dword [esp + 0x18]
add ebp, 0xffffffff
adc eax, 0xffffffff
mov edx, ebp
or edx, eax
mov dword [esp + 0x18], eax
jne 0x40b9a0
lea edx, [esi + 0x20]
lea ecx, [esp + 0x1c]
call fcn.0040b670
push ebx
call fcn.00418570
add esp, 4
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x74
ret
Function at 0x40eb80
Capabilities:
Encode data using xor
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov ebx, edx
mov dword [ebp - 4], ecx
or eax, 0xffffffff
xor edi, edi
test ebx, ebx
jle 0x40ec43
push esi
nop dword [eax]
movzx edx, byte [edi + ecx]
mov ecx, eax
shl edx, 0x18
and ecx, 0xff000000
xor edx, ecx
shl eax, 8
mov esi, edx
inc edi
sar esi, 0x1f
and esi, 0x4c11db7
lea ecx, [edx + edx]
xor esi, ecx
mov edx, esi
sar edx, 0x1f
and edx, 0x4c11db7
lea ecx, [esi + esi]
xor edx, ecx
mov esi, edx
sar esi, 0x1f
and esi, 0x4c11db7
lea ecx, [edx + edx]
xor esi, ecx
mov edx, esi
sar edx, 0x1f
and edx, 0x4c11db7
lea ecx, [esi + esi]
xor edx, ecx
mov esi, edx
sar esi, 0x1f
and esi, 0x4c11db7
lea ecx, [edx + edx]
xor esi, ecx
mov edx, esi
sar edx, 0x1f
and edx, 0x4c11db7
lea ecx, [esi + esi]
xor edx, ecx
mov esi, edx
sar esi, 0x1f
and esi, 0x4c11db7
lea ecx, [edx + edx]
xor esi, ecx
mov edx, esi
sar edx, 0x1f
and edx, 0x4c11db7
lea ecx, [esi + esi]
xor edx, ecx
mov ecx, dword [ebp - 4]
xor eax, edx
cmp edi, ebx
jl 0x40eba0
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40eee0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, edx
mov ecx, dword [ebx]
cmp ecx, 0xbc
je 0x40ef54
cmp ecx, 0xc0
je 0x40ef54
cmp ecx, 0xcc
je 0x40ef54
xor edi, edi
mov ecx, 0xc0
nop dword [eax]
test edi, edi
jne 0x40ef1b
mov eax, 0xbc
jmp 0x40ef26
cmp edi, 1
mov eax, 0xcc
cmove eax, ecx
push ebx
mov edx, esi
mov dword [ebx], eax
mov ecx, 0x436250
call fcn.0040eee0
add esp, 4
cmp eax, esi
jl 0x40ef4f
inc edi
mov ecx, 0xc0
cmp edi, 3
jl 0x40ef10
mov dword [ebx], 0
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret
xor edx, edx
test esi, esi
jle 0x40ef4d
nop word [eax + eax]
cmp edx, ecx
jge 0x40ef4d
mov eax, edx
cmp byte [eax + 0x436250], 0x47
jne 0x40ef7c
add eax, ecx
cmp eax, esi
jl 0x40ef66
pop edi
pop esi
mov eax, edx
pop ebx
pop ebp
ret
inc edx
cmp edx, esi
jl 0x40ef60
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret

Function at 0x415c82
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x415cc1
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x415cc1
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x415cc1
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x415cc1
cmp dword [ecx + 0x74], 0xe
jbe 0x415cc1
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x421d45
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.00421cc1
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x421eb4
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x421eb4
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x421e69
jg 0x421da1
test eax, eax
je 0x421e5f
push 1
push 0x1000
call fcn.0041983f
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x421dc4
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x421e56
push 0x8000
push ebx
call fcn.004156a5
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x421ded
jg 0x421de8
cmp ecx, 0x1000
jb 0x421ded
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.00417db4
add esp, 0x10
cmp eax, 0xffffffff
je 0x421e32
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x421de8
jl 0x421e19
test ecx, ecx
jne 0x421dda
push dword [ebp - 0xc]
push ebx
call fcn.004156a5
push esi
call fcn.00418080
add esp, 0xc
xor ebx, ebx
jmp 0x421ec2
cmp byte [edi + 0x24], 0
je 0x421e49
cmp dword [edi + 0x20], 5
jne 0x421e49
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x421e54
mov ebx, dword [edi + 0x18]
jmp 0x421e56
xor ebx, ebx
push esi
call fcn.00418080
pop ecx
jmp 0x421ec2
test ecx, ecx
jg 0x421e2b
jl 0x421e69
test eax, eax
jae 0x421e2b
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0041d2df
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x421e89
cmp byte [edi + 0x1c], 0
je 0x421e2b
jmp 0x421eba
push ebx
call fcn.0041a689
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x421e2b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x421ec2
cmp byte [edi + 0x1c], 0
je 0x421ebf
mov ebx, dword [edi + 0x18]
jmp 0x421ec2
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.0041d2df
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp int.00401219
Function at 0x101d6b90
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x101e99bc], 0
mov byte [0x101e99c0], 0
mov dword [0x101e99b0], 0x25ec
mov dword [0x101e99b8], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x101d6bfe
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov dword [0x101e99b8], 0
mov edx, eax
add edx, 0xffffd26b
add eax, 0x2417
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], eax
jmp 0x101d6c4a
mov eax, dword [ebp - 0x1c]
mov dword [0x101e99b4], 0xaf6
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x101e99b4]
mov esi, eax
add esi, 0xffffe4f3
mov dword [0x101e99b0], esi
mov esi, dword [0x101e99b8]
add esi, 1
mov dword [0x101e99b8], esi
cmp esi, 0x100
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], esi
jl 0x101d6bfe
jmp 0x101d6bd7
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
mov esi, 0xfffff02c
mov edi, 0x1b14
mov ebx, 0x100
mov dword [ebp - 0x30], eax
mov eax, ecx
mov dword [ebp - 0x34], ecx
xor ecx, ecx
mov dword [ebp - 0x38], edx
mov edx, ecx
mov ecx, dword [ebp - 0x10]
div ecx
mov dword [0x101e99c4], 0
mov ecx, dword [ebp - 0x38]
mov dword [0x101e99b0], ecx
mov ecx, dword [0x101e99bc]
mov dword [ebp - 0x3c], ecx
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x40], edx
mov edx, dword [ebp - 0x34]
movzx ecx, byte [ecx + edx]
mov edx, dword [ebp - 0x3c]
add ecx, edx
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x44], ecx
mov ecx, dword [ebp - 0x40]
movzx ecx, byte [edx + ecx]
mov edx, dword [ebp - 0x44]
add edx, ecx
mov dword [0x101e99c4], edx
mov eax, edx
cdq
idiv ebx
mov dword [0x101e99bc], edx
mov dword [0x101e99b0], 0x1802
mov ecx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x34]
mov cl, byte [ecx + ebx]
mov byte [0x101e99c0], cl
mov ecx, dword [ebp - 0x30]
mov dword [0x101e99b0], ecx
mov ecx, dword [ebp - 0x18]
mov cl, byte [ecx + edx]
mov edx, dword [ebp - 0x18]
mov byte [edx + ebx], cl
mov cl, byte [0x101e99c0]
mov edx, dword [0x101e99bc]
mov ebx, dword [ebp - 0x18]
mov byte [ebx + edx], cl
mov dword [0x101e99b0], 0x2b4
mov dword [0x101e99b4], 0xfffff6fd
mov edx, dword [0x101e99b8]
add edx, 1
mov dword [0x101e99b8], edx
cmp edx, 0x100
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x2c], edi
jl 0x101d6c4a
mov dword [0x101e99b0], 0xffffeb3b
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x101d6df0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [0x101e99b8], 0
mov dword [0x101e99bc], 0
mov dword [0x101e99c8], 0
mov edi, dword [0x101e99b0]
add edi, 0x3c3
mov dword [0x101e99b0], edi
mov dword [0x101e99b4], 0x5f1
cmp eax, 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
je 0x101d6fce
jmp 0x101d6f97
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
mov esi, 0x100
mov dword [0x101e99b4], 0x1cfd
add ecx, 1
mov dword [ebp - 0x2c], eax
mov eax, ecx
mov dword [ebp - 0x30], edx
cdq
idiv esi
mov dword [0x101e99b8], edx
mov dword [0x101e99b0], 0x18db
mov ecx, dword [ebp - 0x1c]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x30]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x101e99bc], edx
mov dword [0x101e99b4], 0x198a
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x101e99c0], cl
mov dword [0x101e99b0], 0x13a5
mov edi, dword [ebp - 0x1c]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov dword [0x101e99b4], 0x1ce8
mov dword [0x101e99b0], 0x15f
mov cl, byte [0x101e99c0]
mov edx, dword [0x101e99bc]
mov byte [edi + edx], cl
mov edx, dword [0x101e99b0]
add edx, 0xffffedd6
mov dword [0x101e99b0], edx
mov edx, dword [0x101e99b8]
movzx edx, byte [edi + edx]
mov ebx, dword [0x101e99bc]
movzx ebx, byte [edi + ebx]
add ebx, edx
and ebx, 0xff
mov dword [0x101e99c8], ebx
mov dword [0x101e99b0], 0x2cc
mov cl, byte [edi + ebx]
mov edx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x2c]
mov ch, byte [edx + ebx]
mov edx, dword [0x101e99b4]
mov bl, cl
add bl, byte [0x101e99cd]
mov byte [0x101e99cc], bl
mov byte [0x101e99cd], ch
mov byte [0x101e99ce], cl
xor ch, cl
add edx, 0xffffee6e
mov dword [0x101e99b4], edx
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x2c]
mov byte [edx + esi], ch
mov dword [0x101e99b0], 0x13c3
add esi, 1
mov edx, dword [ebp - 0x10]
cmp esi, edx
mov dword [ebp - 0x38], esi
je 0x101d6fcc
jmp 0x101d6fab
xor eax, eax
mov ecx, eax
mov edx, eax
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x20], eax
jmp 0x101d6e5b
mov eax, dword [0x101e99b8]
mov dword [ebp - 0x3c], eax
mov eax, dword [0x101e99bc]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], edx
jmp 0x101d6e5b
jmp 0x101d6fce
mov dword [0x101e99b0], 0xb60
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x101d77b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x50
mov eax, dword [ebp + 8]
mov dword [0x101e99b4], 0x1626
mov ecx, dword [0x101e99b0]
add ecx, 0x31
mov dword [0x101e99b0], ecx
mov dword [ebp - 0x10], eax
call fcn.101d7190
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov dword [0x101e99b0], 0xd6b
mov esi, dword [eax + esi + 0x78]
mov dword [0x101e99b0], 0x12
mov edi, edx
add edi, dword [eax + esi + 0x20]
mov ebx, dword [eax + esi + 0x24]
mov dword [0x101e99b4], 0x40a
mov eax, dword [eax + esi + 0x18]
cmp eax, 0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], ecx
je 0x101d793a
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
add eax, ecx
mov dword [ebp - 0x2c], eax
xor eax, eax
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], eax
jmp 0x101d784c
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
xor edx, edx
mov esi, dword [ebp - 0x24]
mov edi, dword [esi + eax*4]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x44]
mov ecx, eax
mov edx, dword [ebp - 0x40]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov bl, cl
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x49], bh
mov byte [ebp - 0x4a], cl
mov byte [ebp - 0x4b], bl
je 0x101d78ce
mov eax, dword [ebp - 0x48]
add eax, 1
mov cl, byte [ebp - 0x49]
cmp cl, 0
setne dl
mov dword [ebp - 0x50], eax
mov byte [ebp - 0x51], dl
mov al, byte [ebp - 0x4a]
mov cl, byte [ebp - 0x51]
and al, cl
mov edx, dword [ebp - 0x50]
cmp edx, 0x20
setb ah
and al, ah
test al, 1
mov al, byte [ebp - 0x4a]
mov dword [ebp - 0x44], edx
mov byte [ebp - 0x4b], al
jne 0x101d7866
mov al, byte [ebp - 0x4b]
test al, 1
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x58], ecx
jne 0x101d7904
mov eax, dword [ebp - 0x3c]
add eax, 2
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x38]
add eax, 1
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
mov edx, dword [ebp - 0x5c]
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x34], eax
jb 0x101d784c
jmp 0x101d7933
mov eax, dword [ebp - 0x58]
movzx eax, word [eax]
mov dword [0x101e99b4], 0x182a
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
add ecx, dword [ecx + edx + 0x1c]
mov esi, dword [ebp - 0x1c]
add esi, dword [ecx + eax*4]
mov dword [0x101e99b0], 0x274
mov dword [ebp - 0x28], esi
jmp 0x101d793a
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x101d793a
mov eax, dword [ebp - 0x28]
add esp, 0x50
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x101d7950
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
mov eax, dword [0x101e99b4]
add eax, 0x1c78
mov dword [0x101e99b4], eax
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov dword [0x101e99b4], 0x19
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jmp 0x101d79b6
mov eax, dword [ebp - 0x14]
mov dword [0x101e99b4], 0x56e
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x18], eax
je 0x101d79e5
jmp 0x101d7a93
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], edx
je 0x101d7995
mov eax, dword [ebp - 0x1c]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], eax
jl 0x101d79b6
jmp 0x101d7995
mov dword [0x101e99b0], 0x582
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff4
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2], 0x6f
jne 0x101d7a93
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x101d7a93
mov dword [0x101e99b0], 0x7df
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x14], 0x64
jne 0x101d7a93
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x12], 0x64
jne 0x101d7a93
mov dword [0x101e99b0], 0x91c
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff8
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x24]
cmp word [eax + ecx*2], 0x6c
jne 0x101d7a93
mov dword [0x101e99b4], 0x153e
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0xe], 0x6c
jne 0x101d7a93
mov dword [0x101e99b4], 0x190e
mov eax, 1
mov dword [ebp - 0x28], eax
jmp 0x101d7aa4
mov dword [0x101e99b0], 0x10e3
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x101d7aa4
mov eax, dword [ebp - 0x28]
add esp, 0x28
pop ebp
ret