joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10007f67
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp dword [ebp - 0x3e0], 0
je 0x10008021
push esi
jmp 0x10007f5a
call 0x10007f67
add byte [edi + 0x3c], al
dec esi
inc edx
xor bh, byte [0x4c48338]
pop esi
push ebx
or ebx, 0xd915
xor ebx, 0xfca9
pop ebx
push eax
push ecx
add esp, 4
add eax, 0xefbe
pop eax
mov ecx, dword [ebp - 0x3e0]
mov dword [ebp - 0x1998], ecx
push eax
push ebx
add esp, 4
xor eax, 0xecfd
or eax, 0x1308e
add eax, 0xacab
and eax, 0x17cc5
pop eax
push esi
and esi, 0x766a
add esi, 0xba85
sub esi, 0x8bcd
pop esi
mov edx, dword [ebp - 0x1998]
mov dword [ebp - 0x199c], edx
lea eax, [ebp - 0x1754]
push eax
call dword [ebp - 0x199c]
test eax, eax
jne 0x10008021
push eax
push edi
add esp, 4
jmp 0x10007fee
and eax, 0xe9ed
xor eax, 0x7e40
xor eax, 0x14a69
pop eax
push eax
call 0x1000800e
add byte [esi], dh
aas
push eax
push eax
dec esi
cmp byte [ebx - 0x38a7fb3c], al
test dword [eax - 8], esp
invalid

Function at 0x1000800e
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp dword [ebp - 0x3e0], 0
je 0x10008021
push esi
jmp 0x10007f5a
call 0x10007f67
add byte [edi + 0x3c], al
dec esi
inc edx
xor bh, byte [0x4c48338]
pop esi
push ebx
or ebx, 0xd915
xor ebx, 0xfca9
pop ebx
push eax
push ecx
add esp, 4
add eax, 0xefbe
pop eax
mov ecx, dword [ebp - 0x3e0]
mov dword [ebp - 0x1998], ecx
push eax
push ebx
add esp, 4
xor eax, 0xecfd
or eax, 0x1308e
add eax, 0xacab
and eax, 0x17cc5
pop eax
push esi
and esi, 0x766a
add esi, 0xba85
sub esi, 0x8bcd
pop esi
mov edx, dword [ebp - 0x1998]
mov dword [ebp - 0x199c], edx
lea eax, [ebp - 0x1754]
push eax
call dword [ebp - 0x199c]
test eax, eax
jne 0x10008021
push eax
push edi
add esp, 4
jmp 0x10007fee
and eax, 0xe9ed
xor eax, 0x7e40
xor eax, 0x14a69
pop eax
push eax
call 0x1000800e
add byte [esi], dh
aas
push eax
push eax
dec esi
cmp byte [ebx - 0x38a7fb3c], al
test dword [eax - 8], esp
invalid
Function at 0x100085d6
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x1cc]
add edx, 1
mov dword [ebp - 0x1cc], edx
je 0x100085fc
mov edx, dword [ebp - 0x770]
add edx, dword [ebp - 0x1cc]
movsx eax, byte [edx]
xor eax, 0x20
mov ecx, dword [ebp - 0x1cc]
movsx edx, byte [ebp + ecx - 0x87c]
jmp 0x10008549

Function at 0x1000860b
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x76c]
add eax, 1
mov dword [ebp - 0x76c], eax
push edx
add esp, 4
or edx, 0x1aa8
add edx, 0x8da6
add edx, 0x13ee4
add edx, 0x32ef
add byte [edx + 0x56], bl
add esi, 0x110ce
sub esi, 0x111d7
sub esi, 0x16e53
pop esi
mov eax, dword [ebp - 0x770]
add eax, dword [ebp - 0x1cc]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x1cc]
movsx eax, byte [ebp + edx - 0x87c]
cmp ecx, eax
jne 0x10008669
mov dword [ebp - 0xccc], 0
jmp 0x100086d8
push edi
or edi, 0x56c7
jmp 0x10008675
pop edi
push eax
call 0x10008683
add byte [edx + 0x45], al
aaa
inc eax
cmp bh, byte [eax]
add esp, 4
or eax, 0xb8bf
or eax, 0xa770
jmp 0x1000869a
pop eax
mov ecx, dword [ebp - 0x770]
add ecx, dword [ebp - 0x1cc]
movsx edx, byte [ecx]
or edx, 0x20
mov eax, dword [ebp - 0x1cc]
movsx ecx, byte [ebp + eax - 0x87c]
or ecx, 0x20
cmp edx, ecx
jge 0x100086ce
mov dword [ebp - 0xccc], 0xffffffff
jmp 0x100086d8
mov dword [ebp - 0xccc], 1
cmp dword [ebp - 0xccc], 0
jne 0x100086ef
mov edx, dword [ebp - 0x19b4]
mov dword [ebp - 0x50c], edx
jmp 0x10008700
jmp 0x100084d9

Function at 0x10008683
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x76c]
add eax, 1
mov dword [ebp - 0x76c], eax
push edx
add esp, 4
or edx, 0x1aa8
add edx, 0x8da6
add edx, 0x13ee4
add edx, 0x32ef
add byte [edx + 0x56], bl
add esi, 0x110ce
sub esi, 0x111d7
sub esi, 0x16e53
pop esi
mov eax, dword [ebp - 0x770]
add eax, dword [ebp - 0x1cc]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x1cc]
movsx eax, byte [ebp + edx - 0x87c]
cmp ecx, eax
jne 0x10008669
mov dword [ebp - 0xccc], 0
jmp 0x100086d8
push edi
or edi, 0x56c7
jmp 0x10008675
pop edi
push eax
call 0x10008683
add byte [edx + 0x45], al
aaa
inc eax
cmp bh, byte [eax]
add esp, 4
or eax, 0xb8bf
or eax, 0xa770
jmp 0x1000869a
pop eax
mov ecx, dword [ebp - 0x770]
add ecx, dword [ebp - 0x1cc]
movsx edx, byte [ecx]
or edx, 0x20
mov eax, dword [ebp - 0x1cc]
movsx ecx, byte [ebp + eax - 0x87c]
or ecx, 0x20
cmp edx, ecx
jge 0x100086ce
mov dword [ebp - 0xccc], 0xffffffff
jmp 0x100086d8
mov dword [ebp - 0xccc], 1
cmp dword [ebp - 0xccc], 0
jne 0x100086ef
mov edx, dword [ebp - 0x19b4]
mov dword [ebp - 0x50c], edx
jmp 0x10008700
jmp 0x100084d9
Function at 0x10008809
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
or ebx, 0x325d
and ebx, 0x7a97
pop ebx
push ecx
push ebx
add esp, 4
call 0x1000872c
add byte [eax + 0x39], al
cmp dword [0x83464649], edi
cmp eax, 0x83464649
les eax, [ecx + ebx*2]
push ecx
and ecx, 0x1411e
add ecx, 0x74e8
pop ecx
mov edx, dword [ebp - 0x3fc]
add edx, 0xe
mov dword [ebp - 0x1a04], edx
push ecx
push esi
add esp, 4
xor ecx, 0xc80c
pop ecx
push eax
xor eax, 0xe4d3
pop eax
push ebx
push esi
add esp, 4
sub ebx, 0x63fa
and ebx, 0x1fbd
jmp 0x10008778
add ebx, 0x117ec
pop ebx
cmp dword [ebp - 0x3fc], 0
je 0x10008791
cmp dword [ebp - 0xae4], 0
jne 0x100087d7
push eax
push eax
add esp, 4
xor eax, 0x12468
sub eax, 0xc0a9
and eax, 0x16f12
jmp 0x100087ae
pop eax
push edi
and edi, 0x1ef4
add edi, 0xd84c
or edi, 0x1249c
pop edi
mov eax, dword [ebp - 0x7a0]
mov dword [ebp - 0x19b8], eax
push 0
call dword [ebp - 0x19b8]
test dword [eax - 8], esp
invalid
mov dword [ebp - 0x2054], 0xa
push ecx
and ecx, 0x1a15
add ecx, 0xb480
pop ecx
push ebx
add ebx, 0xe2a6
sub ebx, 0xa9ac
call 0x10008809
add byte [ebp + 0x50], al
cmp dh, byte [0x8348433e]
les eax, [ecx + eax*4]
jmp 0x100087c4

Function at 0x1000881b
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
or cl, byte [eax - 0x3af6b]
dec dword [ebx - 0xae37b]
jmp [ebx]

Function at 0x10008916
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x10008929
add byte [eax + 0x4f], cl
aaa
cmp eax, 0x45334e40
dec ebx
inc ebp
add esp, 4
add esi, 0x16472
pop esi
cmp dword [ebp - 0x1624], 0
jne 0x1000894b
mov dword [ebp - 0x300], 0
jmp 0x10008bf2
mov edx, dword [ebp - 0x1624]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xcd8], ecx
push ecx
xor ecx, 0x27a1
jmp 0x1000896c
add ecx, 0xa78e
jmp 0x10008978
pop ecx
push eax
xor eax, 0xc6a0
pop eax
push eax
add eax, 0x11fa3
or eax, 0xf668
pop eax
cmp dword [ebp - 0xcd8], 0
jne 0x100089a7
mov dword [ebp - 0x300], 0
jmp 0x10008bf2
mov edx, dword [ebp - 0xcd8]
mov dword [ebp - 0x510], edx

Function at 0x10008929
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x10008929
add byte [eax + 0x4f], cl
aaa
cmp eax, 0x45334e40
dec ebx
inc ebp
add esp, 4
add esi, 0x16472
pop esi
cmp dword [ebp - 0x1624], 0
jne 0x1000894b
mov dword [ebp - 0x300], 0
jmp 0x10008bf2
mov edx, dword [ebp - 0x1624]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xcd8], ecx
push ecx
xor ecx, 0x27a1
jmp 0x1000896c
add ecx, 0xa78e
jmp 0x10008978
pop ecx
push eax
xor eax, 0xc6a0
pop eax
push eax
add eax, 0x11fa3
or eax, 0xf668
pop eax
cmp dword [ebp - 0xcd8], 0
jne 0x100089a7
mov dword [ebp - 0x300], 0
jmp 0x10008bf2
mov edx, dword [ebp - 0xcd8]
mov dword [ebp - 0x510], edx
Function at 0x10008a10
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ecx
and ecx, 0x12f85
jmp 0x100089c0
pop ecx
push ecx
xor ecx, 0x10994
pop ecx
push edx
sub edx, 0xecd8
xor edx, 0x12ccf
pop edx
push esi
xor esi, 0xd0a7
and esi, 0x720f
pop esi
lea eax, [ebp - 0x1754]
mov dword [ebp - 0xcd4], eax
mov ecx, dword [ebp - 0x510]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xcd0], edx
xor eax, eax
mov word [ebp - 0x238], ax
xor ecx, ecx
mov word [ebp - 0x4c], cx
push esi
push edi
add esp, 4
xor esi, 0xbb37
jmp 0x10008a20
add esi, 0xc0b0
pop esi
push ebx
and ebx, 0x9ae2
add ebx, 0x134b3
xor ebx, 0xcdf0
xor ebx, 0xb042
pop ebx
mov edx, dword [ebp - 0xcd0]
mov ax, word [edx]
mov word [ebp - 0x1052], ax
mov ecx, dword [ebp - 0xcd0]
add ecx, 2
mov dword [ebp - 0xcd0], ecx
invalid
invalid
Function at 0x10008b6c
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
xor dh, byte [0x3d3b3c32]
inc edi
dec eax
add esp, 4
jmp 0x10008b75
xor eax, 0xa972
pop eax
mov edx, dword [ebp - 0x510]
mov dword [ebp - 0x300], edx
jmp 0x10008bf2
push esi
push esi
add esp, 4
sub esi, 0x1270
xor esi, 0xdcab
pop esi
push esi
push ecx
add esp, 4
add esi, 0x17fbf
sub esi, 0xfc6b
xor esi, 0x17042
pop esi
push ebx
sub ebx, 0xc2f6
pop ebx
cmp dword [ebp - 0x300], 0
jne 0x100094f7
or byte [eax], al
invalid
mov ecx, 0x6b
mov word [ebp - 0x17ac], cx
mov edx, 0x65
mov word [ebp - 0x17aa], dx
mov eax, 0x72
mov word [ebp - 0x17a8], ax
mov ecx, 0x6e
mov word [ebp - 0x17a6], cx
mov edx, 0x65
mov word [ebp - 0x17a4], dx
mov eax, 0x6c
mov word [ebp - 0x17a2], ax
mov ecx, 0x33
mov word [ebp - 0x17a0], cx
mov edx, 0x32
mov word [ebp - 0x179e], dx
mov eax, 0x2e
mov word [ebp - 0x179c], ax
mov ecx, 0x64
mov word [ebp - 0x179a], cx
mov edx, 0x6c
mov word [ebp - 0x1798], dx
mov eax, 0x6c
mov word [ebp - 0x1796], ax
xor ecx, ecx
mov word [ebp - 0x1794], cx
push edi
and edi, 0xbaf6
pop edi
push ecx
push edi
add esp, 4
sub ecx, 0x7520
add byte [eax], al
call 0x10008cec
add byte [eax + 0x48], al
dec edx
dec ebx
cmp bh, byte [eax]
inc edi
cmp eax, 0x4c48346
and ecx, 0x137fa
and ecx, 0x12eae
pop ecx
mov byte [ebp - 0x8a8], 0x4c
mov byte [ebp - 0x8a7], 0x6f
invalid
jmp [edi - 0x3a]
test dword [edx - 9], ebx
invalid
jmp dword [ecx - 0x3a]
test dword [ebx - 9], ebx
invalid
jmp dword [esi + eax*8 - 0x7b]
pop esp
idiv edi
dec dword [esi + eax*8 - 0x7b]
pop ebp
idiv edi
jmp [ecx - 0x3a]
test dword [esi - 9], ebx
invalid
jmp dword [edx - 0x3a]
test dword [edi - 9], ebx
invalid
push dword [edx - 0x3a]
test dword [eax - 9], esp
invalid
jmp dword [ecx - 0x3a]
test dword [ecx - 9], esp
invalid
push dword [edx - 0x3a]
test dword [edx - 9], esp
invalid
invalid
jns 0x10008d10
test dword [ebx - 9], esp
invalid
call dword [edi - 0x3a]
test dword [edi + esi*8 - 1], esp
inc dword [eax]
mov edx, dword fs:[0x18]
mov dword [ebp - 0x19c4], edx
mov eax, dword [ebp - 0x19c4]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x19c8], ecx
mov edx, dword [ebp - 0x19c8]
mov dword [ebp - 0x1630], edx
push edx
or edx, 3
and edx, 0x6778
xor edx, 0xe44f
xor edx, 0xa2a9
pop edx
push esi
add esi, 0xae27
jmp 0x10008da8
Function at 0x10008cec
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
xor dh, byte [0x3d3b3c32]
inc edi
dec eax
add esp, 4
jmp 0x10008b75
xor eax, 0xa972
pop eax
mov edx, dword [ebp - 0x510]
mov dword [ebp - 0x300], edx
jmp 0x10008bf2
push esi
push esi
add esp, 4
sub esi, 0x1270
xor esi, 0xdcab
pop esi
push esi
push ecx
add esp, 4
add esi, 0x17fbf
sub esi, 0xfc6b
xor esi, 0x17042
pop esi
push ebx
sub ebx, 0xc2f6
pop ebx
cmp dword [ebp - 0x300], 0
jne 0x100094f7
or byte [eax], al
invalid
mov ecx, 0x6b
mov word [ebp - 0x17ac], cx
mov edx, 0x65
mov word [ebp - 0x17aa], dx
mov eax, 0x72
mov word [ebp - 0x17a8], ax
mov ecx, 0x6e
mov word [ebp - 0x17a6], cx
mov edx, 0x65
mov word [ebp - 0x17a4], dx
mov eax, 0x6c
mov word [ebp - 0x17a2], ax
mov ecx, 0x33
mov word [ebp - 0x17a0], cx
mov edx, 0x32
mov word [ebp - 0x179e], dx
mov eax, 0x2e
mov word [ebp - 0x179c], ax
mov ecx, 0x64
mov word [ebp - 0x179a], cx
mov edx, 0x6c
mov word [ebp - 0x1798], dx
mov eax, 0x6c
mov word [ebp - 0x1796], ax
xor ecx, ecx
mov word [ebp - 0x1794], cx
push edi
and edi, 0xbaf6
pop edi
push ecx
push edi
add esp, 4
sub ecx, 0x7520
add byte [eax], al
call 0x10008cec
add byte [eax + 0x48], al
dec edx
dec ebx
cmp bh, byte [eax]
inc edi
cmp eax, 0x4c48346
and ecx, 0x137fa
and ecx, 0x12eae
pop ecx
mov byte [ebp - 0x8a8], 0x4c
mov byte [ebp - 0x8a7], 0x6f
invalid
jmp [edi - 0x3a]
test dword [edx - 9], ebx
invalid
jmp dword [ecx - 0x3a]
test dword [ebx - 9], ebx
invalid
jmp dword [esi + eax*8 - 0x7b]
pop esp
idiv edi
dec dword [esi + eax*8 - 0x7b]
pop ebp
idiv edi
jmp [ecx - 0x3a]
test dword [esi - 9], ebx
invalid
jmp dword [edx - 0x3a]
test dword [edi - 9], ebx
invalid
push dword [edx - 0x3a]
test dword [eax - 9], esp
invalid
jmp dword [ecx - 0x3a]
test dword [ecx - 9], esp
invalid
push dword [edx - 0x3a]
test dword [edx - 9], esp
invalid
invalid
jns 0x10008d10
test dword [ebx - 9], esp
invalid
call dword [edi - 0x3a]
test dword [edi + esi*8 - 1], esp
inc dword [eax]
mov edx, dword fs:[0x18]
mov dword [ebp - 0x19c4], edx
mov eax, dword [ebp - 0x19c4]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x19c8], ecx
mov edx, dword [ebp - 0x19c8]
mov dword [ebp - 0x1630], edx
push edx
or edx, 3
and edx, 0x6778
xor edx, 0xe44f
xor edx, 0xa2a9
pop edx
push esi
add esi, 0xae27
jmp 0x10008da8
Function at 0x10009440
Capabilities:
Resolve function by parsing pe exports

Disassembly:
adc al, byte [eax]
add byte [esi + 0x53], bl
push ebx
add esp, 4
sub ebx, 0x151f5
sub ebx, 0xbeb0
xor ebx, 0x10453
pop ebx
mov ecx, dword [ebp - 0x784]
add ecx, dword [ebp - 0x1d0]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x1d0]
movsx ecx, byte [ebp + eax - 0x8a8]
cmp edx, ecx
jne 0x10009385
mov dword [ebp - 0xce8], 0
jmp 0x100093f4
push ecx
push esi
add esp, 4
xor ecx, 0x945b
pop ecx
push eax
push esi
add esp, 4
sub eax, 0x5a40
and eax, 0x15d3e
pop eax
push eax
xor eax, 0x10673
or eax, 0x36c9
add eax, 0x2d61
pop eax
mov edx, dword [ebp - 0x784]
add edx, dword [ebp - 0x1d0]
movsx eax, byte [edx]
or eax, 0x20
mov ecx, dword [ebp - 0x1d0]
movsx edx, byte [ebp + ecx - 0x8a8]
or edx, 0x20
cmp eax, edx
jge 0x100093ea
mov dword [ebp - 0xce8], 0xffffffff
jmp 0x100093f4
mov dword [ebp - 0xce8], 1
cmp dword [ebp - 0xce8], 0
jne 0x1000940b
mov eax, dword [ebp - 0x19d8]
mov dword [ebp - 0x3f8], eax
jmp 0x1000941c
jmp 0x100091f5
cmp dword [ebp - 0x3f8], 0
je 0x100094f7
push eax
or eax, 0x13237
call 0x10009440
add byte [esi + 0x39], cl
xor cl, byte [edx + 0x46]
dec edi
dec edi
push eax
inc ecx
cmp byte [ebx - 0xf7efb3c], al
wait
mov word [eax], es
add al, ch
or dword [eax], eax
add byte [eax], al
add byte [eax + edi + 0x4a], cl
dec eax
dec esi
dec ebp
inc eax
cmp dword [ebx - 0x74a7fb3c], eax
xchg ebp, eax
or ah, bh
invalid
push edi
jmp 0x100094fe
pop edi
push ebx
push esi
add esp, 4
sub ebx, 0x9545
pop ebx
push esi
push ecx
add esp, 4
and esi, 0x16805
sub esi, 0xb948
sub esi, 0xf26c
sub esi, 0x2982
pop esi
mov edx, dword fs:[0x18]
mov dword [ebp - 0x19e4], edx
mov eax, dword [ebp - 0x19e4]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x19e8], ecx
mov edx, dword [ebp - 0x19e8]
mov dword [ebp - 0x1688], edx
push esi
xor esi, 0x5437
sub esi, 0x1161d
add esi, 0x2dee
pop esi
push eax
push esi
add esp, 4
xor eax, 0x2d91
add eax, 0x6164
add eax, 0x16cb4
sub eax, 0xd937
pop eax
cmp dword [ebp - 0x1688], 0
jne 0x1000959b
mov dword [ebp - 0x300], 0
jmp 0x10009842
mov eax, dword [ebp - 0x1688]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xcf4], edx
push eax
push esi
add esp, 4
sub eax, 0x15395
or eax, 0x16dec
xor eax, 0x117f6
jmp 0x100095cb
pop eax
push esi
jmp 0x100095d2
add esi, 0xdb55
or esi, 0x1de6
pop esi
cmp dword [ebp - 0xcf4], 0
jne 0x100095f7
mov dword [ebp - 0x300], 0
jmp 0x10009842
mov eax, dword [ebp - 0xcf4]
mov dword [ebp - 0x518], eax
push ecx
add ecx, 0x8dd9
add ecx, 0x1557f
xor ecx, 0x61b7
jmp 0x1000961b
pop ecx
push eax
push edx
add esp, 4
jmp 0x10009628
jmp 0x1000962f
jmp 0x10009634
pop eax
lea ecx, [ebp - 0x1754]
mov dword [ebp - 0xcf0], ecx
mov edx, dword [ebp - 0x518]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xcec], eax
xor ecx, ecx
mov word [ebp - 0x240], cx
xor edx, edx
mov word [ebp - 0x54], dx
push ecx
push ebx
add esp, 4
xor ecx, 0x124a5
pop ecx
push edx
add edx, 0x3011
xor edx, 0x18456
or edx, 0x91b2
call 0x1000968d
add byte [ecx + eax*2 + 0x4f], cl
inc edx
dec ebx
dec esp
dec ebp
aaa
aas
add esp, 4
pop edx
invalid
invalid
invalid
Function at 0x10009457
Capabilities:
Resolve function by parsing pe exports

Disassembly:
adc al, byte [eax]
add byte [esi + 0x53], bl
push ebx
add esp, 4
sub ebx, 0x151f5
sub ebx, 0xbeb0
xor ebx, 0x10453
pop ebx
mov ecx, dword [ebp - 0x784]
add ecx, dword [ebp - 0x1d0]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x1d0]
movsx ecx, byte [ebp + eax - 0x8a8]
cmp edx, ecx
jne 0x10009385
mov dword [ebp - 0xce8], 0
jmp 0x100093f4
push ecx
push esi
add esp, 4
xor ecx, 0x945b
pop ecx
push eax
push esi
add esp, 4
sub eax, 0x5a40
and eax, 0x15d3e
pop eax
push eax
xor eax, 0x10673
or eax, 0x36c9
add eax, 0x2d61
pop eax
mov edx, dword [ebp - 0x784]
add edx, dword [ebp - 0x1d0]
movsx eax, byte [edx]
or eax, 0x20
mov ecx, dword [ebp - 0x1d0]
movsx edx, byte [ebp + ecx - 0x8a8]
or edx, 0x20
cmp eax, edx
jge 0x100093ea
mov dword [ebp - 0xce8], 0xffffffff
jmp 0x100093f4
mov dword [ebp - 0xce8], 1
cmp dword [ebp - 0xce8], 0
jne 0x1000940b
mov eax, dword [ebp - 0x19d8]
mov dword [ebp - 0x3f8], eax
jmp 0x1000941c
jmp 0x100091f5
cmp dword [ebp - 0x3f8], 0
je 0x100094f7
push eax
or eax, 0x13237
call 0x10009440
add byte [esi + 0x39], cl
xor cl, byte [edx + 0x46]
dec edi
dec edi
push eax
inc ecx
cmp byte [ebx - 0xf7efb3c], al
wait
mov word [eax], es
add al, ch
or dword [eax], eax
add byte [eax], al
add byte [eax + edi + 0x4a], cl
dec eax
dec esi
dec ebp
inc eax
cmp dword [ebx - 0x74a7fb3c], eax
xchg ebp, eax
or ah, bh
invalid
push edi
jmp 0x100094fe
pop edi
push ebx
push esi
add esp, 4
sub ebx, 0x9545
pop ebx
push esi
push ecx
add esp, 4
and esi, 0x16805
sub esi, 0xb948
sub esi, 0xf26c
sub esi, 0x2982
pop esi
mov edx, dword fs:[0x18]
mov dword [ebp - 0x19e4], edx
mov eax, dword [ebp - 0x19e4]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x19e8], ecx
mov edx, dword [ebp - 0x19e8]
mov dword [ebp - 0x1688], edx
push esi
xor esi, 0x5437
sub esi, 0x1161d
add esi, 0x2dee
pop esi
push eax
push esi
add esp, 4
xor eax, 0x2d91
add eax, 0x6164
add eax, 0x16cb4
sub eax, 0xd937
pop eax
cmp dword [ebp - 0x1688], 0
jne 0x1000959b
mov dword [ebp - 0x300], 0
jmp 0x10009842
mov eax, dword [ebp - 0x1688]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xcf4], edx
push eax
push esi
add esp, 4
sub eax, 0x15395
or eax, 0x16dec
xor eax, 0x117f6
jmp 0x100095cb
pop eax
push esi
jmp 0x100095d2
add esi, 0xdb55
or esi, 0x1de6
pop esi
cmp dword [ebp - 0xcf4], 0
jne 0x100095f7
mov dword [ebp - 0x300], 0
jmp 0x10009842
mov eax, dword [ebp - 0xcf4]
mov dword [ebp - 0x518], eax
push ecx
add ecx, 0x8dd9
add ecx, 0x1557f
xor ecx, 0x61b7
jmp 0x1000961b
pop ecx
push eax
push edx
add esp, 4
jmp 0x10009628
jmp 0x1000962f
jmp 0x10009634
pop eax
lea ecx, [ebp - 0x1754]
mov dword [ebp - 0xcf0], ecx
mov edx, dword [ebp - 0x518]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xcec], eax
xor ecx, ecx
mov word [ebp - 0x240], cx
xor edx, edx
mov word [ebp - 0x54], dx
push ecx
push ebx
add esp, 4
xor ecx, 0x124a5
pop ecx
push edx
add edx, 0x3011
xor edx, 0x18456
or edx, 0x91b2
call 0x1000968d
add byte [ecx + eax*2 + 0x4f], cl
inc edx
dec ebx
dec esp
dec ebp
aaa
aas
add esp, 4
pop edx
invalid
invalid
invalid
Function at 0x1000968d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
adc al, byte [eax]
add byte [esi + 0x53], bl
push ebx
add esp, 4
sub ebx, 0x151f5
sub ebx, 0xbeb0
xor ebx, 0x10453
pop ebx
mov ecx, dword [ebp - 0x784]
add ecx, dword [ebp - 0x1d0]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x1d0]
movsx ecx, byte [ebp + eax - 0x8a8]
cmp edx, ecx
jne 0x10009385
mov dword [ebp - 0xce8], 0
jmp 0x100093f4
push ecx
push esi
add esp, 4
xor ecx, 0x945b
pop ecx
push eax
push esi
add esp, 4
sub eax, 0x5a40
and eax, 0x15d3e
pop eax
push eax
xor eax, 0x10673
or eax, 0x36c9
add eax, 0x2d61
pop eax
mov edx, dword [ebp - 0x784]
add edx, dword [ebp - 0x1d0]
movsx eax, byte [edx]
or eax, 0x20
mov ecx, dword [ebp - 0x1d0]
movsx edx, byte [ebp + ecx - 0x8a8]
or edx, 0x20
cmp eax, edx
jge 0x100093ea
mov dword [ebp - 0xce8], 0xffffffff
jmp 0x100093f4
mov dword [ebp - 0xce8], 1
cmp dword [ebp - 0xce8], 0
jne 0x1000940b
mov eax, dword [ebp - 0x19d8]
mov dword [ebp - 0x3f8], eax
jmp 0x1000941c
jmp 0x100091f5
cmp dword [ebp - 0x3f8], 0
je 0x100094f7
push eax
or eax, 0x13237
call 0x10009440
add byte [esi + 0x39], cl
xor cl, byte [edx + 0x46]
dec edi
dec edi
push eax
inc ecx
cmp byte [ebx - 0xf7efb3c], al
wait
mov word [eax], es
add al, ch
or dword [eax], eax
add byte [eax], al
add byte [eax + edi + 0x4a], cl
dec eax
dec esi
dec ebp
inc eax
cmp dword [ebx - 0x74a7fb3c], eax
xchg ebp, eax
or ah, bh
invalid
push edi
jmp 0x100094fe
pop edi
push ebx
push esi
add esp, 4
sub ebx, 0x9545
pop ebx
push esi
push ecx
add esp, 4
and esi, 0x16805
sub esi, 0xb948
sub esi, 0xf26c
sub esi, 0x2982
pop esi
mov edx, dword fs:[0x18]
mov dword [ebp - 0x19e4], edx
mov eax, dword [ebp - 0x19e4]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x19e8], ecx
mov edx, dword [ebp - 0x19e8]
mov dword [ebp - 0x1688], edx
push esi
xor esi, 0x5437
sub esi, 0x1161d
add esi, 0x2dee
pop esi
push eax
push esi
add esp, 4
xor eax, 0x2d91
add eax, 0x6164
add eax, 0x16cb4
sub eax, 0xd937
pop eax
cmp dword [ebp - 0x1688], 0
jne 0x1000959b
mov dword [ebp - 0x300], 0
jmp 0x10009842
mov eax, dword [ebp - 0x1688]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xcf4], edx
push eax
push esi
add esp, 4
sub eax, 0x15395
or eax, 0x16dec
xor eax, 0x117f6
jmp 0x100095cb
pop eax
push esi
jmp 0x100095d2
add esi, 0xdb55
or esi, 0x1de6
pop esi
cmp dword [ebp - 0xcf4], 0
jne 0x100095f7
mov dword [ebp - 0x300], 0
jmp 0x10009842
mov eax, dword [ebp - 0xcf4]
mov dword [ebp - 0x518], eax
push ecx
add ecx, 0x8dd9
add ecx, 0x1557f
xor ecx, 0x61b7
jmp 0x1000961b
pop ecx
push eax
push edx
add esp, 4
jmp 0x10009628
jmp 0x1000962f
jmp 0x10009634
pop eax
lea ecx, [ebp - 0x1754]
mov dword [ebp - 0xcf0], ecx
mov edx, dword [ebp - 0x518]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xcec], eax
xor ecx, ecx
mov word [ebp - 0x240], cx
xor edx, edx
mov word [ebp - 0x54], dx
push ecx
push ebx
add esp, 4
xor ecx, 0x124a5
pop ecx
push edx
add edx, 0x3011
xor edx, 0x18456
or edx, 0x91b2
call 0x1000968d
add byte [ecx + eax*2 + 0x4f], cl
inc edx
dec ebx
dec esp
dec ebp
aaa
aas
add esp, 4
pop edx
invalid
invalid
invalid
Function at 0x10077f66
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x100ea4cc
call fcn.100d5e28
push ecx
mov dword [ebp - 0x10], ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
lea edi, [ecx + 0x18]
mov eax, dword [ebx]
lea esi, [ebx + 0x18]
mov dword [ecx], eax
mov eax, dword [ebx + 8]
mov dword [ecx + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [ecx + 0xc], eax
mov eax, dword [ebx + 0x10]
mov dword [ecx + 0x10], eax
mov eax, dword [ebx + 0x14]
mov dword [ecx + 0x14], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edi, [ecx + 0x24]
lea esi, [ebx + 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov al, byte [ebx + 0x30]
mov byte [ecx + 0x30], al
lea eax, [ebx + 0x34]
push eax
add ecx, 0x34
call fcn.10014a54
mov esi, dword [ebp - 0x10]
lea eax, [ebx + 0x3c]
and dword [ebp - 4], 0
push eax
lea ecx, [esi + 0x3c]
call fcn.10057954
lea eax, [ebx + 0x48]
mov byte [ebp - 4], 1
push eax
lea ecx, [esi + 0x48]
call fcn.10077e90
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x10082eaa
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100ea915
call fcn.100d5e28
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [ebp - 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
or dword [esi + 0x20], 0xffffffff
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
call fcn.10002327
mov ecx, dword [ebp - 0xc]
mov eax, esi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret