joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100070e4
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
xor eax, 0x33453a44
add esp, 4
pop esi
mov byte [ebp - 0xb74], 0x56
mov byte [ebp - 0xb73], 0x69
mov byte [ebp - 0xb72], 0x72
mov byte [ebp - 0xb71], 0x74
mov byte [ebp - 0xb70], 0x75
mov byte [ebp - 0xb6f], 0x61
invalid
jmp dword [ecx - 0x3a]
test dword [edx + 0x6cfffff4], edx
mov byte [ebp - 0xb6d], 0x50
mov byte [ebp - 0xb6c], 0x72
mov byte [ebp - 0xb6b], 0x6f
mov byte [ebp - 0xb6a], 0x74
mov byte [ebp - 0xb69], 0x65
mov byte [ebp - 0xb68], 0x63
mov byte [ebp - 0xb67], 0x74
mov byte [ebp - 0xb66], 0
push edi
push edx
add esp, 4
add edi, 0x1854d
and edi, 0x9063
call 0x10007041
add byte [ebp + 0x4f], al
inc ebp
dec edi
push eax
aaa
inc esp
aas
add esp, 4
call 0x10007050
add byte [edx], bh
dec esp
cmp eax, 0x834b393e
les eax, [edi + ebx*2]
mov eax, dword fs:[0x18]
mov dword [ebp - 0x1f7c], eax
mov ecx, dword [ebp - 0x1f7c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x1f80], edx
mov eax, dword [ebp - 0x1f80]
test dword [eax - 0x76000020], eax
test dword [eax + 0x57ffffe6], edi
push esi
add esp, 4
or edi, 0x3db1
call 0x10007095
add byte [edi], bh
cmp eax, 0x3d3a4942
inc esi
cmp al, 0x4c
add esp, 4
pop edi
push eax
call 0x100070a9
add byte [ecx + 0x40], cl
dec ebp
dec edi
xor al, 0x3c
inc ebp
xor ecx, dword [ebx - 0x7d]
les eax, [eax + ebx*2]
cmp dword [ebp - 0x1948], 0
jne 0x100070c5
mov dword [ebp - 0x378], 0
jmp 0x10007381
mov ecx, dword [ebp - 0x1948]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xedc], eax
push edx
call 0x100070e4
add byte [esi], dh
dec ebx
dec ebp
inc edi
inc esp
push eax
add esp, 4
pop edx
push ecx
push ebx
add esp, 4
invalid
invalid
stosd dword es:[edi], eax

Function at 0x10007141
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edx
sub edx, 0x3c5b
call 0x10007141
add byte [edi + 0x3e374a4b], dh
dec ebp
add esp, 4
or edx, 0x571d
pop edx
push edx
or edx, 0x15b47
add dword [eax], eax
add dword [eax], eax
and edx, 0x15e3f
xor edx, 0xbc64
pop edx
lea edx, [ebp - 0x1a88]
mov dword [ebp - 0xed8], edx
mov eax, dword [ebp - 0x5e0]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xed4], ecx
xor edx, edx
mov word [ebp - 0x27c], dx
xor eax, eax
mov word [ebp - 0x144], ax
push ecx
push eax
add esp, 4
and ecx, 0x74c5
and ecx, 0x2e62
pop ecx
push ebx
or ebx, 0x183cf
add ebx, 0x178a7
call 0x100071ba

Function at 0x100071b0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [eax + 0x49], al
dec eax
inc esp
cmp byte [edi], dh
cmp eax, 0x4c4833c
pop ebx
invalid
invalid

Function at 0x100071ba
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [eax + 0x49], al
dec eax
inc esp
cmp byte [edi], dh
cmp eax, 0x4c4833c
pop ebx
invalid
invalid

Function at 0x10007250
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
inc dword [ebp + 0xf1875c0]
mov bh, 0x8d
test ch, bh
invalid
Function at 0x10007330
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
pop edx
push esi
add esi, 0x9273
xor esi, 0x1858b
pop esi
push edx
push eax
add esp, 4
add edx, 0xb83c
pop edx
mov edx, dword [ebp - 0x5e0]
mov eax, dword [edx]
mov dword [ebp - 0x5e0], eax
mov ecx, dword [ebp - 0x5e0]
cmp ecx, dword [ebp - 0xedc]
lea esp, [ecx + esi*8]
invalid
invalid
je 0x10007377
mov edx, dword [ebp - 0x5e0]
cmp dword [edx + 0x30], 0
jne 0x1000712d
mov dword [ebp - 0x378], 0
push ecx
add ecx, 0x7aa7
or ecx, 0xb838
and ecx, 0xd47e
pop ecx
push ebx
push edi
add esp, 4
and ebx, 0x92bd

Function at 0x100073a0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
sub ebx, 0x7fd
or ebx, 0x356e
or ebx, 0x16ae4
pop ebx
cmp dword [ebp - 0x378], 0
jne 0x10007ccd
mov eax, 0x6b
mov word [ebp - 0x1b1c], ax
mov ecx, 0x65
mov word [ebp - 0x1b1a], cx
mov edx, 0x72
mov word [ebp - 0x1b18], dx
mov eax, 0x6e
mov word [ebp - 0x1b16], ax
mov ecx, 0x65
mov word [ebp - 0x1b14], cx
mov edx, 0x6c
mov word [ebp - 0x1b12], dx
mov eax, 0x33
mov word [ebp - 0x1b10], ax
mov ecx, 0x32
mov word [ebp - 0x1b0e], cx
mov edx, 0x2e
mov word [ebp - 0x1b0c], dx
mov eax, 0x64
mov word [ebp - 0x1b0a], ax
mov ecx, 0x6c
mov word [ebp - 0x1b08], cx
mov edx, 0x6c
mov word [ebp - 0x1b06], dx
xor eax, eax
mov word [ebp - 0x1b04], ax
push eax
sub eax, 0x93e5
sub eax, 0x41cd
pop eax
push edi
push esi
add esp, 4
and edi, 0xe304
add edi, 0x9c48
sub edi, 0x5c96
pop edi
push edi
push esi
sub esi, 0x13ee2
pop esi
push eax
push ebx
add esp, 4
xor eax, 0x7d43
sub eax, 0x152a6
pop eax
push ebx
push ecx
add esp, 4
xor ebx, 0x4cec
add byte [eax], al
Function at 0x10007cf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
and ebx, 0xeffc
and ebx, 0x7a38
pop ebx
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x1fa0], ecx
mov edx, dword [ebp - 0x1fa0]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x1fa4], eax
mov ecx, dword [ebp - 0x1fa4]
mov dword [ebp - 0x19b0], ecx
push eax
call 0x10007d34
add byte [edi + 0x45], cl
inc ebp
dec edi
inc edx
inc ebx
add esp, 4
jmp 0x10007d3e
jmp 0x10007d47
call 0x10007d55
add byte [eax + 0x45], cl
xor eax, 0x3c384036
dec esp
add esp, 4
pop eax
cmp dword [ebp - 0x19b0], 0
jne 0x10007d71
mov dword [ebp - 0x378], 0
jmp 0x1000802d
mov edx, dword [ebp - 0x19b0]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xef8], ecx
push ebx
call 0x10007d94
add byte [edi + eax*2 + 0x32], al
inc edx
xor al, byte [esi + 0x48]
inc esp
dec ecx
cmp al, 0x83
les eax, [ebx + ebx*2]
push ebx
xor ebx, 0xf69e
xor ebx, 0x890c
call fcn.10007db1
add byte [edi], dh
aaa
dec ebp
dec edi
push esi
add esi, 0xaaa0
or esi, 0x85ba
or esi, 0xcd94
pop esi
push ebx
push edx
add esp, 4
or ebx, 0x9261
add ebx, 0x11a4d
and ebx, 0x180c9
xor ebx, 0xfebe
pop ebx
mov ecx, dword [ebp - 0x378]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x3cc], edx
push edi
call 0x1000807e
add byte [edx], dh
dec edx
xor eax, dword [ebx + eax*2 + 0x42]
dec esp
dec edx
xor eax, dword [ebx - 0x107efb3c]
and eax, esp
add byte [eax], al
pop edi
push ecx
push eax
add esp, 4
sub ecx, 0x1122b
xor ecx, 0xd1c8
sub ecx, 0x518e
pop ecx
mov dword [ebp - 0x8cc], 0
mov eax, dword [ebp - 0x3cc]
mov dword [ebp - 0x19bc], eax
cmp dword [ebp - 0x19bc], 0
jne 0x100080d0
invalid
Function at 0x10007d34
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
and ebx, 0xeffc
and ebx, 0x7a38
pop ebx
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x1fa0], ecx
mov edx, dword [ebp - 0x1fa0]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x1fa4], eax
mov ecx, dword [ebp - 0x1fa4]
mov dword [ebp - 0x19b0], ecx
push eax
call 0x10007d34
add byte [edi + 0x45], cl
inc ebp
dec edi
inc edx
inc ebx
add esp, 4
jmp 0x10007d3e
jmp 0x10007d47
call 0x10007d55
add byte [eax + 0x45], cl
xor eax, 0x3c384036
dec esp
add esp, 4
pop eax
cmp dword [ebp - 0x19b0], 0
jne 0x10007d71
mov dword [ebp - 0x378], 0
jmp 0x1000802d
mov edx, dword [ebp - 0x19b0]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xef8], ecx
push ebx
call 0x10007d94
add byte [edi + eax*2 + 0x32], al
inc edx
xor al, byte [esi + 0x48]
inc esp
dec ecx
cmp al, 0x83
les eax, [ebx + ebx*2]
push ebx
xor ebx, 0xf69e
xor ebx, 0x890c
call fcn.10007db1
add byte [edi], dh
aaa
dec ebp
dec edi
push esi
add esi, 0xaaa0
or esi, 0x85ba
or esi, 0xcd94
pop esi
push ebx
push edx
add esp, 4
or ebx, 0x9261
add ebx, 0x11a4d
and ebx, 0x180c9
xor ebx, 0xfebe
pop ebx
mov ecx, dword [ebp - 0x378]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x3cc], edx
push edi
call 0x1000807e
add byte [edx], dh
dec edx
xor eax, dword [ebx + eax*2 + 0x42]
dec esp
dec edx
xor eax, dword [ebx - 0x107efb3c]
and eax, esp
add byte [eax], al
pop edi
push ecx
push eax
add esp, 4
sub ecx, 0x1122b
xor ecx, 0xd1c8
sub ecx, 0x518e
pop ecx
mov dword [ebp - 0x8cc], 0
mov eax, dword [ebp - 0x3cc]
mov dword [ebp - 0x19bc], eax
cmp dword [ebp - 0x19bc], 0
jne 0x100080d0
invalid
Function at 0x10007d55
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
and ebx, 0xeffc
and ebx, 0x7a38
pop ebx
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x1fa0], ecx
mov edx, dword [ebp - 0x1fa0]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x1fa4], eax
mov ecx, dword [ebp - 0x1fa4]
mov dword [ebp - 0x19b0], ecx
push eax
call 0x10007d34
add byte [edi + 0x45], cl
inc ebp
dec edi
inc edx
inc ebx
add esp, 4
jmp 0x10007d3e
jmp 0x10007d47
call 0x10007d55
add byte [eax + 0x45], cl
xor eax, 0x3c384036
dec esp
add esp, 4
pop eax
cmp dword [ebp - 0x19b0], 0
jne 0x10007d71
mov dword [ebp - 0x378], 0
jmp 0x1000802d
mov edx, dword [ebp - 0x19b0]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xef8], ecx
push ebx
call 0x10007d94
add byte [edi + eax*2 + 0x32], al
inc edx
xor al, byte [esi + 0x48]
inc esp
dec ecx
cmp al, 0x83
les eax, [ebx + ebx*2]
push ebx
xor ebx, 0xf69e
xor ebx, 0x890c
call fcn.10007db1
add byte [edi], dh
aaa
dec ebp
dec edi
push esi
add esi, 0xaaa0
or esi, 0x85ba
or esi, 0xcd94
pop esi
push ebx
push edx
add esp, 4
or ebx, 0x9261
add ebx, 0x11a4d
and ebx, 0x180c9
xor ebx, 0xfebe
pop ebx
mov ecx, dword [ebp - 0x378]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x3cc], edx
push edi
call 0x1000807e
add byte [edx], dh
dec edx
xor eax, dword [ebx + eax*2 + 0x42]
dec esp
dec edx
xor eax, dword [ebx - 0x107efb3c]
and eax, esp
add byte [eax], al
pop edi
push ecx
push eax
add esp, 4
sub ecx, 0x1122b
xor ecx, 0xd1c8
sub ecx, 0x518e
pop ecx
mov dword [ebp - 0x8cc], 0
mov eax, dword [ebp - 0x3cc]
mov dword [ebp - 0x19bc], eax
cmp dword [ebp - 0x19bc], 0
jne 0x100080d0
invalid
Function at 0x10007d94
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
and ebx, 0xeffc
and ebx, 0x7a38
pop ebx
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x1fa0], ecx
mov edx, dword [ebp - 0x1fa0]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x1fa4], eax
mov ecx, dword [ebp - 0x1fa4]
mov dword [ebp - 0x19b0], ecx
push eax
call 0x10007d34
add byte [edi + 0x45], cl
inc ebp
dec edi
inc edx
inc ebx
add esp, 4
jmp 0x10007d3e
jmp 0x10007d47
call 0x10007d55
add byte [eax + 0x45], cl
xor eax, 0x3c384036
dec esp
add esp, 4
pop eax
cmp dword [ebp - 0x19b0], 0
jne 0x10007d71
mov dword [ebp - 0x378], 0
jmp 0x1000802d
mov edx, dword [ebp - 0x19b0]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xef8], ecx
push ebx
call 0x10007d94
add byte [edi + eax*2 + 0x32], al
inc edx
xor al, byte [esi + 0x48]
inc esp
dec ecx
cmp al, 0x83
les eax, [ebx + ebx*2]
push ebx
xor ebx, 0xf69e
xor ebx, 0x890c
call fcn.10007db1
add byte [edi], dh
aaa
dec ebp
dec edi
push esi
add esi, 0xaaa0
or esi, 0x85ba
or esi, 0xcd94
pop esi
push ebx
push edx
add esp, 4
or ebx, 0x9261
add ebx, 0x11a4d
and ebx, 0x180c9
xor ebx, 0xfebe
pop ebx
mov ecx, dword [ebp - 0x378]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x3cc], edx
push edi
call 0x1000807e
add byte [edx], dh
dec edx
xor eax, dword [ebx + eax*2 + 0x42]
dec esp
dec edx
xor eax, dword [ebx - 0x107efb3c]
and eax, esp
add byte [eax], al
pop edi
push ecx
push eax
add esp, 4
sub ecx, 0x1122b
xor ecx, 0xd1c8
sub ecx, 0x518e
pop ecx
mov dword [ebp - 0x8cc], 0
mov eax, dword [ebp - 0x3cc]
mov dword [ebp - 0x19bc], eax
cmp dword [ebp - 0x19bc], 0
jne 0x100080d0
invalid

Function at 0x10007db1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ebx
cmp dword [ebp - 0xef8], 0
jne 0x10007dcd
mov dword [ebp - 0x378], 0
jmp 0x1000802d
mov edx, dword [ebp - 0xef8]
mov dword [ebp - 0x5e8], edx
push ebx
push ecx
add esp, 4
jmp 0x10007de3
pop ebx
push edi
sub edi, 0x12763
jmp 0x10007df1
jmp 0x10007df8
add edi, 0xa1d7
pop edi
push ecx
push edi
add esp, 4
add ecx, 0x1860b
pop ecx
lea eax, [ebp - 0x1a88]
mov dword [ebp - 0xef4], eax
mov ecx, dword [ebp - 0x5e8]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xef0], edx
xor eax, eax
mov word [ebp - 0x284], ax
xor ecx, ecx
mov word [ebp - 0x14c], cx
push ebx
push esi
add esp, 4
and ebx, 0x71d
sub ebx, 0x152d
pop ebx
push edx
push esi
add esp, 4
jmp 0x10007e54
call 0x10007e60
add byte [esp + edi], bh
inc edx
dec edi
inc esp
add esp, 4
xor edx, 0x10cdf
pop edx
mov edx, dword [ebp - 0xef0]
mov ax, word [edx]
mov word [ebp - 0x12da], ax
mov ecx, dword [ebp - 0xef0]
add ecx, 2
mov dword [ebp - 0xef0], ecx
mov dx, word [ebp - 0x12da]
mov word [ebp - 0x284], dx
mov eax, dword [ebp - 0xef4]
mov cx, word [eax]
mov word [ebp - 0x12dc], cx
mov edx, dword [ebp - 0xef4]
add edx, 2
mov dword [ebp - 0xef4], edx
mov ax, word [ebp - 0x12dc]
invalid
invalid
invalid
Function at 0x10007e60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ebx
cmp dword [ebp - 0xef8], 0
jne 0x10007dcd
mov dword [ebp - 0x378], 0
jmp 0x1000802d
mov edx, dword [ebp - 0xef8]
mov dword [ebp - 0x5e8], edx
push ebx
push ecx
add esp, 4
jmp 0x10007de3
pop ebx
push edi
sub edi, 0x12763
jmp 0x10007df1
jmp 0x10007df8
add edi, 0xa1d7
pop edi
push ecx
push edi
add esp, 4
add ecx, 0x1860b
pop ecx
lea eax, [ebp - 0x1a88]
mov dword [ebp - 0xef4], eax
mov ecx, dword [ebp - 0x5e8]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xef0], edx
xor eax, eax
mov word [ebp - 0x284], ax
xor ecx, ecx
mov word [ebp - 0x14c], cx
push ebx
push esi
add esp, 4
and ebx, 0x71d
sub ebx, 0x152d
pop ebx
push edx
push esi
add esp, 4
jmp 0x10007e54
call 0x10007e60
add byte [esp + edi], bh
inc edx
dec edi
inc esp
add esp, 4
xor edx, 0x10cdf
pop edx
mov edx, dword [ebp - 0xef0]
mov ax, word [edx]
mov word [ebp - 0x12da], ax
mov ecx, dword [ebp - 0xef0]
add ecx, 2
mov dword [ebp - 0xef0], ecx
mov dx, word [ebp - 0x12da]
mov word [ebp - 0x284], dx
mov eax, dword [ebp - 0xef4]
mov cx, word [eax]
mov word [ebp - 0x12dc], cx
mov edx, dword [ebp - 0xef4]
add edx, 2
mov dword [ebp - 0xef4], edx
mov ax, word [ebp - 0x12dc]
invalid
invalid
invalid

Function at 0x10007ed2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edx
push ecx
sub ecx, 0xc309
sub ecx, 0xdf7c
pop ecx
push eax
push edx
add esp, 4
xor eax, 0x3b6d
jmp 0x10007ef5
pop eax
movzx ecx, word [ebp - 0x14c]
test ecx, ecx
jne 0x10007f19
movzx edx, word [ebp - 0x284]
movzx eax, word [ebp - 0x14c]
sub edx, eax
mov dword [ebp - 0x19b8], edx
jmp 0x10007f7c
movzx ecx, word [ebp - 0x284]
movzx edx, word [ebp - 0x14c]
cmp ecx, edx
je 0x10007e38
movzx eax, word [ebp - 0x284]
xor eax, 0x20
movzx ecx, word [ebp - 0x14c]
cmp eax, ecx
je 0x10007e38
movzx edx, word [ebp - 0x284]
movzx eax, word [ebp - 0x14c]
cmp edx, eax
jge 0x10007f66
mov dword [ebp - 0x19b4], 0xffffffff
jmp 0x10007f70
mov dword [ebp - 0x19b4], 1
mov ecx, dword [ebp - 0x19b4]
mov dword [ebp - 0x19b8], ecx
cmp dword [ebp - 0x19b8], 0
jne 0x10007fc5
push esi
add esi, 0x9856
and esi, 0x13b8d
call 0x10007fa0
add byte [edx + 0x38], al
inc eax
aaa
dec edi
inc edx
cmp al, byte [ebx + 0x5eb04c4]
cmp dword [ebx + 0x3f], ecx
inc eax
push eax
pop esi
push esi
push esi
add esp, 4
add esi, 0x73c2
pop esi
mov edx, dword [ebp - 0x5e8]
mov dword [ebp - 0x378], edx
jmp 0x1000802d
push ebx
or ebx, 0x760
sub ebx, 0xc6f9
pop ebx
push ebx
push edx
add esp, 4
sub ebx, 0x77f
pop ebx
push ecx
Function at 0x10007fa0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edx
push ecx
sub ecx, 0xc309
sub ecx, 0xdf7c
pop ecx
push eax
push edx
add esp, 4
xor eax, 0x3b6d
jmp 0x10007ef5
pop eax
movzx ecx, word [ebp - 0x14c]
test ecx, ecx
jne 0x10007f19
movzx edx, word [ebp - 0x284]
movzx eax, word [ebp - 0x14c]
sub edx, eax
mov dword [ebp - 0x19b8], edx
jmp 0x10007f7c
movzx ecx, word [ebp - 0x284]
movzx edx, word [ebp - 0x14c]
cmp ecx, edx
je 0x10007e38
movzx eax, word [ebp - 0x284]
xor eax, 0x20
movzx ecx, word [ebp - 0x14c]
cmp eax, ecx
je 0x10007e38
movzx edx, word [ebp - 0x284]
movzx eax, word [ebp - 0x14c]
cmp edx, eax
jge 0x10007f66
mov dword [ebp - 0x19b4], 0xffffffff
jmp 0x10007f70
mov dword [ebp - 0x19b4], 1
mov ecx, dword [ebp - 0x19b4]
mov dword [ebp - 0x19b8], ecx
cmp dword [ebp - 0x19b8], 0
jne 0x10007fc5
push esi
add esi, 0x9856
and esi, 0x13b8d
call 0x10007fa0
add byte [edx + 0x38], al
inc eax
aaa
dec edi
inc edx
cmp al, byte [ebx + 0x5eb04c4]
cmp dword [ebx + 0x3f], ecx
inc eax
push eax
pop esi
push esi
push esi
add esp, 4
add esi, 0x73c2
pop esi
mov edx, dword [ebp - 0x5e8]
mov dword [ebp - 0x378], edx
jmp 0x1000802d
push ebx
or ebx, 0x760
sub ebx, 0xc6f9
pop ebx
push ebx
push edx
add esp, 4
sub ebx, 0x77f
pop ebx
push ecx

Function at 0x10007fe0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
add esp, 4
sub ecx, 0xaffd
xor ecx, 0x46c8
and ecx, 0x120ff
pop ecx
mov eax, dword [ebp - 0x5e8]
mov ecx, dword [eax]
mov dword [ebp - 0x5e8], ecx
mov edx, dword [ebp - 0x5e8]
cmp edx, dword [ebp - 0xef8]
je 0x10008023
mov eax, dword [ebp - 0x5e8]
cmp dword [eax + 0x30], 0
jne 0x10007dd9
mov dword [ebp - 0x378], 0
Function at 0x1000807e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
and ebx, 0xeffc
and ebx, 0x7a38
pop ebx
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x1fa0], ecx
mov edx, dword [ebp - 0x1fa0]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x1fa4], eax
mov ecx, dword [ebp - 0x1fa4]
mov dword [ebp - 0x19b0], ecx
push eax
call 0x10007d34
add byte [edi + 0x45], cl
inc ebp
dec edi
inc edx
inc ebx
add esp, 4
jmp 0x10007d3e
jmp 0x10007d47
call 0x10007d55
add byte [eax + 0x45], cl
xor eax, 0x3c384036
dec esp
add esp, 4
pop eax
cmp dword [ebp - 0x19b0], 0
jne 0x10007d71
mov dword [ebp - 0x378], 0
jmp 0x1000802d
mov edx, dword [ebp - 0x19b0]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xef8], ecx
push ebx
call 0x10007d94
add byte [edi + eax*2 + 0x32], al
inc edx
xor al, byte [esi + 0x48]
inc esp
dec ecx
cmp al, 0x83
les eax, [ebx + ebx*2]
push ebx
xor ebx, 0xf69e
xor ebx, 0x890c
call fcn.10007db1
add byte [edi], dh
aaa
dec ebp
dec edi
push esi
add esi, 0xaaa0
or esi, 0x85ba
or esi, 0xcd94
pop esi
push ebx
push edx
add esp, 4
or ebx, 0x9261
add ebx, 0x11a4d
and ebx, 0x180c9
xor ebx, 0xfebe
pop ebx
mov ecx, dword [ebp - 0x378]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x3cc], edx
push edi
call 0x1000807e
add byte [edx], dh
dec edx
xor eax, dword [ebx + eax*2 + 0x42]
dec esp
dec edx
xor eax, dword [ebx - 0x107efb3c]
and eax, esp
add byte [eax], al
pop edi
push ecx
push eax
add esp, 4
sub ecx, 0x1122b
xor ecx, 0xd1c8
sub ecx, 0x518e
pop ecx
mov dword [ebp - 0x8cc], 0
mov eax, dword [ebp - 0x3cc]
mov dword [ebp - 0x19bc], eax
cmp dword [ebp - 0x19bc], 0
jne 0x100080d0
invalid

Function at 0x10019cd0
Capabilities:
Encode data using xor

Disassembly:
add dword [ecx], eax
mov dl, byte [bp - 0x1b3b]
add byte [eax], al
mov ecx, 0x101016d
mov al, byte [bp - 0x1b39]
add byte [eax], al
xor al, 0xca
mov cl, byte [bp - 0x1b37]
add byte [eax], al
pop eax
push ebx
test ch, al
add eax, 0x820dc882
add al, byte [ecx]
add byte [edx], 1
xor al, 0x5f
add eax, 0x9e90102
add dword [ecx], eax
add dword [ecx], eax
inc esp
dec esi
xor eax, 0x35433c36
test ch, al
add eax, 0x10109e9
add dword [ecx], eax
inc ebx
inc eax
dec eax
dec eax
dec ebx
dec edx
xor eax, 0x6005c584
mov dword [esi + 0xf69d], 0x9e86c74d
test byte [eax], 0
jo 0x10019cf6
xchg byte [edi + 0x620000f6], bl
mov dword [esi + 0xf6a0], 0xa186c765
test byte [eax], 0
dec ebp
mov dword [esi + 0xf6a2], 0xa386c76a
test byte [eax], 0
arpl di, ax
xchg byte [esi + esi*8 - 0x388d0000], ah
xchg byte [ebp + 0x620000f6], ah
mov dword [esi + 0xf6a6], 0xa786c773
test byte [eax], 0
jp 0x10019d35
xchg byte [eax + 0x580000f6], ch
mov dword [esi + 0xf6a9], 0x168c6501
sbb dword [ecx], eax
add dword [ecx], eax
mov dl, byte [esi + 0xde71]
mov word [esi + 0xde71], es
mov word [ecx + 0x31], cs
mov cl, byte [esi + 0xde6d]
mov word [esi + 0xde6d], ss
invalid
xchg esi, eax
invalid
Function at 0x10029310
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x101c56c8
mov eax, dword fs:[0]
push eax
push edi
mov eax, dword [0x102832a0]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
push edx
mov edx, dword [esp + 0x30]
push eax
push ecx
call fcn.10028f20
xor eax, eax
mov dword [esp + 0x10], eax
mov edx, dword [edi + 8]
mov dword [edi], vtable.FormWidgetButton.0
mov dword [edi + 0xc], eax
mov dword [edi + 0x74], edx
mov dword [edi + 0x70], eax
mov dword [edi + 0x78], eax
mov dword [edi + 0x68], eax
mov dword [edi + 0x6c], eax
mov dword [esp + 0x10], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0xc
ret 0x18

Function at 0x10029940
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x101c56c8
mov eax, dword fs:[0]
push eax
push edi
mov eax, dword [0x102832a0]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
push edx
mov edx, dword [esp + 0x30]
push eax
push ecx
call fcn.10028f20
mov dword [esp + 0x10], 0
mov edx, dword [edi + 8]
mov dword [edi], vtable.FormWidgetText.0
mov dword [edi + 0xc], 1
mov dword [edi + 0x68], edx
mov dword [esp + 0x10], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0xc
ret 0x18

Function at 0x10029b70
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x101c56c8
mov eax, dword fs:[0]
push eax
push edi
mov eax, dword [0x102832a0]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
push edx
mov edx, dword [esp + 0x30]
push eax
push ecx
call fcn.10028f20
mov dword [esp + 0x10], 0
mov edx, dword [edi + 8]
mov dword [edi], vtable.FormWidgetChoice.0
mov dword [edi + 0xc], 2
mov dword [edi + 0x68], edx
mov dword [esp + 0x10], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0xc
ret 0x18