joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6f6cf0
Capabilities:
Hash data using djb2

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x10
push ebx
push esi
push eax
xor ebx, ebx
push ebx
push 0x3f800000
mov esi, ecx
call fcn.006fcac0
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x10]
push eax
mov dword [esi], 0x87de00
mov dword [esi + 0x40], ecx
call fcn.006f9c50
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
cmp eax, ecx
mov dword [esi + 0x44], eax
jl 0x6f6d3c
mov ecx, dword [esp + 0x10]
cmp eax, ecx
jle 0x6f6d3f
mov dword [esi + 0x44], ecx
mov eax, dword [0x8d878c]
cmp eax, ebx
push ebp
push edi
jle 0x6f6e77
cmp eax, 2
jg 0x6f6e77
mov eax, dword [esi + 0x44]
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [esi + 0x40]
lea edx, [esp + 0x30]
push edx
push eax
mov dword [esp + 0x38], ebx
mov dword [esp + 0x30], ebx
call fcn.006f9d00
fstp dword [esp + 0x10]
cmp dword [0x8d878c], 1
jne 0x6f6dbd
mov ebp, dword [esp + 0x24]
mov ecx, ebp
call fcn.005ff930
fstp dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
mov ecx, edi
call fcn.005ff930
fsubr dword [esp + 0x28]
mov ecx, edi
fmul dword [esp + 0x10]
fstp dword [esp + 0x28]
call fcn.005ff930
fadd dword [esp + 0x28]
call fcn.0081cba0
jmp 0x6f6e59
mov ebp, dword [esp + 0x2c]
lea ecx, [esp + 0x28]
push ecx
mov ecx, ebp
mov dword [esp + 0x2c], ebx
call fcn.00628a00
test al, al
je 0x6f6de3
mov edx, dword [esp + 0x28]
movsx eax, word [edx + 2]
mov dword [esp + 0x28], eax
jmp 0x6f6de7
mov dword [esp + 0x28], ebx
mov edi, dword [esi + 0x44]
mov ecx, ebp
mov dword [esp + 0x1c], edi
call fcn.005ff930
fild dword [esp + 0x28]
fidiv dword [esp + 0x1c]
fmul dword [esi + 0x18]
fdivp st(1)
call fcn.0081cba0
mov ebp, dword [esp + 0x24]
lea ecx, [esp + 0x28]
push ecx
mov ecx, ebp
mov ebx, eax
mov dword [esp + 0x2c], 0
call fcn.00628a00
test al, al
je 0x6f6e33
mov edx, dword [esp + 0x28]
movsx eax, word [edx + 2]
mov dword [esp + 0x28], eax
jmp 0x6f6e3b
mov dword [esp + 0x28], 0
mov ecx, ebp
call fcn.005ff930
call fcn.0081cba0
sub edi, dword [esp + 0x28]
add eax, edi
cmp ebx, eax
jge 0x6f6e53
mov eax, ebx
mov edi, dword [esp + 0x2c]
xor ebx, ebx
fld dword [esp + 0x10]
mov dword [esi + 0x48], eax
fcomp dword [0x846698]
fnstsw ax
test ah, 0x41
jne 0x6f6e72
mov dword [esi + 0x3c], ebp
jmp 0x6f6e86
mov dword [esi + 0x3c], edi
jmp 0x6f6e86
mov ecx, dword [esi + 0x44]
push ecx
mov ecx, dword [esi + 0x40]
call fcn.006f9e50
mov dword [esi + 0x3c], eax
mov ecx, dword [0xaacac8]
cmp ecx, ebx
pop edi
pop ebp
jne 0x6f6eb3
mov ecx, 0x1505
mov edx, str.BlendedContactInstance
lea esp, [esp]
movzx eax, byte [edx]
imul ecx, ecx, 0x21
inc edx
add ecx, eax
cmp eax, ebx
jne 0x6f6ea0
mov dword [0xaacac8], ecx
push ecx
mov ecx, dword [0xaacab4]
push esi
call fcn.006f47a0
mov eax, esi
pop esi
pop ebx
add esp, 0x10
ret 0xc

Function at 0x6f6ff0
Capabilities:
Hash data using djb2

Disassembly:
mov eax, dword [0xaacacc]
test eax, eax
jne 0x6f7016
mov ecx, 0x1505
mov edx, str.BranchingTouch
movzx eax, byte [edx]
imul ecx, ecx, 0x21
inc edx
add ecx, eax
test eax, eax
jne 0x6f7003
mov dword [0xaacacc], ecx
mov eax, 0xaacacc
ret
Function at 0x6f78a0
Capabilities:
Hash data using djb2

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 0xc]
push esi
mov esi, ecx
mov ecx, dword [esp + 0xc]
push edi
xor edi, edi
mov dword [esi + 0x14], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi], 0x87de78
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x30], edx
mov ecx, dword [0xaacab4]
push edi
call fcn.006f4740
cmp eax, edi
je 0x6f78f8
mov ecx, dword [esp + 0x18]
mov edx, dword [esi + 0x30]
push ecx
push edx
mov ecx, eax
call fcn.006f45d0
jmp 0x6f78fa
xor eax, eax
mov dword [esi + 0x18], eax
mov ecx, dword [0xaacacc]
cmp ecx, edi
jne 0x6f7924
mov ecx, 0x1505
mov edx, str.BranchingTouch
movzx eax, byte [edx]
imul ecx, ecx, 0x21
inc edx
add ecx, eax
cmp eax, edi
jne 0x6f7911
mov dword [0xaacacc], ecx
push ecx
mov ecx, dword [0xaacab4]
push esi
call fcn.006f47a0
pop edi
mov eax, esi
pop esi
ret 0x10
Function at 0x6fcdd0
Capabilities:
Hash data using djb2

Disassembly:
mov eax, dword [esp + 0xc]
push esi
mov esi, ecx
mov cl, byte [esp + 0x18]
mov byte [esi + 0x1c], cl
mov dword [esi + 0x18], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 0x24], eax
xor edx, edx
mov ecx, eax
mov eax, dword [esp + 8]
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x3c], eax
mov dword [esi + 0x14], edx
mov dword [esi + 0x30], edx
mov dword [esi + 0x38], edx
mov dword [esi + 0x10], edx
mov dword [esi + 0x28], edx
mov dword [esi + 4], edx
mov dword [esi + 8], edx
mov dword [esi + 0xc], edx
mov dword [esi], 0x87dfd0
mov eax, dword [eax + 0x3c]
movzx ecx, byte [eax + 0x34]
mov eax, dword [eax + 0x3c]
imul ecx, ecx, 0x1c
lea eax, [ecx + eax - 0x1c]
movsx ecx, word [eax + 0xc]
push edi
movsx edi, word [eax + 8]
add ecx, edi
mov dword [esp + 0x1c], ecx
xor ecx, ecx
mov cx, word [eax + 0x10]
movzx ax, byte [eax + 0x12]
fild dword [esp + 0x1c]
sar ecx, 4
and ecx, 0xf00
or ecx, eax
movsx ecx, cx
mov dword [esp + 0x1c], ecx
fisub dword [esp + 0x1c]
fld dword [esp + 0x18]
fcomp dword [0x84669c]
fnstsw ax
test ah, 5
jp 0x6fceb7
mov dword [esi + 0x2c], edx
fstp st(0)
mov eax, dword [esp + 0x10]
mov dword [esi + 0x40], eax
mov ecx, dword [0xaacb3c]
cmp ecx, edx
jne 0x6fcea3
mov ecx, 0x1505
mov edi, str.CompositeSequenceInstance
lea ebx, [ebx]
movzx eax, byte [edi]
imul ecx, ecx, 0x21
inc edi
add ecx, eax
cmp eax, edx
jne 0x6fce90
mov dword [0xaacb3c], ecx
push ecx
mov ecx, dword [0xaacab4]
push esi
call fcn.006f47a0
pop edi
mov eax, esi
pop esi
ret 0x14
fld dword [esp + 0x18]
fcomp st(1)
fnstsw ax
test ah, 0x41
jne 0x6fce6d
fstp dword [esi + 0x2c]
jmp 0x6fce6f
Function at 0x6fcdd4
Capabilities:
Hash data using djb2

Disassembly:
mov eax, dword [esp + 0xc]
push esi
mov esi, ecx
mov cl, byte [esp + 0x18]
mov byte [esi + 0x1c], cl
mov dword [esi + 0x18], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 0x24], eax
xor edx, edx
mov ecx, eax
mov eax, dword [esp + 8]
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x3c], eax
mov dword [esi + 0x14], edx
mov dword [esi + 0x30], edx
mov dword [esi + 0x38], edx
mov dword [esi + 0x10], edx
mov dword [esi + 0x28], edx
mov dword [esi + 4], edx
mov dword [esi + 8], edx
mov dword [esi + 0xc], edx
mov dword [esi], 0x87dfd0
mov eax, dword [eax + 0x3c]
movzx ecx, byte [eax + 0x34]
mov eax, dword [eax + 0x3c]
imul ecx, ecx, 0x1c
lea eax, [ecx + eax - 0x1c]
movsx ecx, word [eax + 0xc]
push edi
movsx edi, word [eax + 8]
add ecx, edi
mov dword [esp + 0x1c], ecx
xor ecx, ecx
mov cx, word [eax + 0x10]
movzx ax, byte [eax + 0x12]
fild dword [esp + 0x1c]
sar ecx, 4
and ecx, 0xf00
or ecx, eax
movsx ecx, cx
mov dword [esp + 0x1c], ecx
fisub dword [esp + 0x1c]
fld dword [esp + 0x18]
fcomp dword [0x84669c]
fnstsw ax
test ah, 5
jp 0x6fceb7
mov dword [esi + 0x2c], edx
fstp st(0)
mov eax, dword [esp + 0x10]
mov dword [esi + 0x40], eax
mov ecx, dword [0xaacb3c]
cmp ecx, edx
jne 0x6fcea3
mov ecx, 0x1505
mov edi, str.CompositeSequenceInstance
lea ebx, [ebx]
movzx eax, byte [edi]
imul ecx, ecx, 0x21
inc edi
add ecx, eax
cmp eax, edx
jne 0x6fce90
mov dword [0xaacb3c], ecx
push ecx
mov ecx, dword [0xaacab4]
push esi
call fcn.006f47a0
pop edi
mov eax, esi
pop esi
ret 0x14
fld dword [esp + 0x18]
fcomp st(1)
fnstsw ax
test ah, 0x41
jne 0x6fce6d
fstp dword [esi + 0x2c]
jmp 0x6fce6f

Function at 0x7052b6
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x200]
push eax
call fcn.0081d00b
add esp, 0xc
lea eax, [ebp - 0x200]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
leave
ret

Function at 0x706ea0
Capabilities:
Hash data using fnv

Disassembly:
mov edx, dword [esp + 4]
movsx ecx, byte [edx]
test ecx, ecx
mov eax, 0x811c9dc5
je 0x706ed8
inc edx
cmp ecx, 0x5a
jg 0x706ebe
cmp ecx, 0x41
jl 0x706ebe
add ecx, 0x20
xor ecx, eax
imul ecx, ecx, 0x1000193
mov eax, ecx
movsx ecx, byte [edx]
test ecx, ecx
jne 0x706eb0
test ax, ax
jne 0x706ed8
mov ax, 0x4567
ret

Function at 0x70b730
Capabilities:
Hash data using fnv

Disassembly:
push esi
mov esi, dword [ecx]
movsx eax, byte [esi + 8]
test eax, eax
lea ecx, [esi + 8]
mov edx, 0x811c9dc5
je 0x70b772
inc ecx
cmp eax, 0x5a
jg 0x70b751
cmp eax, 0x41
jl 0x70b751
add eax, 0x20
xor eax, edx
imul eax, eax, 0x1000193
mov edx, eax
movsx eax, byte [ecx]
test eax, eax
jne 0x70b743
test dx, dx
jne 0x70b772
mov eax, 0x4567
mov word [esi + 6], ax
pop esi
ret
mov word [esi + 6], dx
pop esi
ret
Function at 0x70f1d0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
dec dword [0x8d9cf4]
jns 0x70f1dd
jmp fcn.0070f0b0
mov eax, dword [0xaae2d8]
mov ecx, dword [eax]
add eax, 4
mov dword [0xaae2d8], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov edx, ecx
and edx, 0xff3a58ad
shl edx, 7
xor ecx, edx
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
ret

Function at 0x72a59e
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1fbc
push ebx
push esi
push edi
push edx
or edx, 0x1098c
call fcn.0072a5be
add byte [ecx], bh
xor cl, byte [esp + eax*2 + 0x33]
inc esi
push eax
Function at 0x72e83a
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edx
push esi
add esp, 4
xor edx, 0x100cc
call fcn.0072e83a
add byte [ecx], bh
dec ebx
aas
cmp byte [ebx + 0x4b], al
dec esp
cmp dword [esi], edi
add esp, 4
call 0x72e84d
add byte [eax + 0x50], cl
dec ebp
aaa
cmp eax, 0x4b3c4444
dec eax
add esp, 4
pop edx
mov eax, dword [ebp - 0xc18]
mov cx, word [eax]
mov word [ebp - 0xf7e], cx
mov edx, dword [ebp - 0xc18]
add edx, 2
mov dword [ebp - 0xc18], edx
mov ax, word [ebp - 0xf7e]
mov word [ebp - 0x1f8], ax
mov ecx, dword [ebp - 0xc1c]
mov dx, word [ecx]
mov word [ebp - 0xf80], dx
mov eax, dword [ebp - 0xc1c]
add eax, 2
mov dword [ebp - 0xc1c], eax
mov cx, word [ebp - 0xf80]
mov word [ebp - 0x100], cx
push edx
push eax
add esp, 4
jmp 0x72e8b6
or edx, 0x158f8
add edx, 0xdcea
add edx, 0x10698
pop edx
push ecx
call 0x72e8d9
add byte [edx + 0x3d], cl
dec esp
dec edx
dec edi
dec eax
dec esi
aaa
add esp, 4
pop ecx
movzx edx, word [ebp - 0x100]
test edx, edx
jne 0x72e900
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
sub eax, ecx
mov dword [ebp - 0x1498], eax
jmp 0x72e963
movzx edx, word [ebp - 0x1f8]
movzx eax, word [ebp - 0x100]
cmp edx, eax
je 0x72e81f
movzx ecx, word [ebp - 0x1f8]
xor ecx, 0x20
movzx edx, word [ebp - 0x100]
cmp ecx, edx
je 0x72e81f
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
cmp eax, ecx
jge 0x72e94d
mov dword [ebp - 0x14d8], 0xffffffff
jmp 0x72e957
mov dword [ebp - 0x14d8], 1
mov edx, dword [ebp - 0x14d8]
mov dword [ebp - 0x1498], edx
cmp dword [ebp - 0x1498], 0
jne 0x72e9ac
push eax
push eax
add esp, 4
or eax, 0x2990
xor eax, 0x12082
xor eax, 0x3541
pop eax
push ebx
add ebx, 0x9ca0
or ebx, 0xa8ff
jmp 0x72e997
and ebx, 0x1e5b
pop ebx
mov eax, dword [ebp - 0x4d4]
mov dword [ebp - 0x2e0], eax
jmp 0x72ea14
push edi
push eax
add esp, 4
add edi, 0x1854f
add edi, 0xa44f
add edi, 0x8c8d
sub edi, 0x6a77
pop edi
push esi
push ebx
add esp, 4
or esi, 0x9e26
pop esi
push esi
or esi, 0xe6c1
pop esi
mov ecx, dword [ebp - 0x4d4]
mov edx, dword [ecx]
mov dword [ebp - 0x4d4], edx
mov eax, dword [ebp - 0x4d4]
cmp eax, dword [ebp - 0xc20]
je 0x72ea0a
mov ecx, dword [ebp - 0x4d4]
cmp dword [ecx + 0x30], 0
jne 0x72e7c0
mov dword [ebp - 0x2e0], 0
Function at 0x72e84d
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edx
push esi
add esp, 4
xor edx, 0x100cc
call fcn.0072e83a
add byte [ecx], bh
dec ebx
aas
cmp byte [ebx + 0x4b], al
dec esp
cmp dword [esi], edi
add esp, 4
call 0x72e84d
add byte [eax + 0x50], cl
dec ebp
aaa
cmp eax, 0x4b3c4444
dec eax
add esp, 4
pop edx
mov eax, dword [ebp - 0xc18]
mov cx, word [eax]
mov word [ebp - 0xf7e], cx
mov edx, dword [ebp - 0xc18]
add edx, 2
mov dword [ebp - 0xc18], edx
mov ax, word [ebp - 0xf7e]
mov word [ebp - 0x1f8], ax
mov ecx, dword [ebp - 0xc1c]
mov dx, word [ecx]
mov word [ebp - 0xf80], dx
mov eax, dword [ebp - 0xc1c]
add eax, 2
mov dword [ebp - 0xc1c], eax
mov cx, word [ebp - 0xf80]
mov word [ebp - 0x100], cx
push edx
push eax
add esp, 4
jmp 0x72e8b6
or edx, 0x158f8
add edx, 0xdcea
add edx, 0x10698
pop edx
push ecx
call 0x72e8d9
add byte [edx + 0x3d], cl
dec esp
dec edx
dec edi
dec eax
dec esi
aaa
add esp, 4
pop ecx
movzx edx, word [ebp - 0x100]
test edx, edx
jne 0x72e900
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
sub eax, ecx
mov dword [ebp - 0x1498], eax
jmp 0x72e963
movzx edx, word [ebp - 0x1f8]
movzx eax, word [ebp - 0x100]
cmp edx, eax
je 0x72e81f
movzx ecx, word [ebp - 0x1f8]
xor ecx, 0x20
movzx edx, word [ebp - 0x100]
cmp ecx, edx
je 0x72e81f
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
cmp eax, ecx
jge 0x72e94d
mov dword [ebp - 0x14d8], 0xffffffff
jmp 0x72e957
mov dword [ebp - 0x14d8], 1
mov edx, dword [ebp - 0x14d8]
mov dword [ebp - 0x1498], edx
cmp dword [ebp - 0x1498], 0
jne 0x72e9ac
push eax
push eax
add esp, 4
or eax, 0x2990
xor eax, 0x12082
xor eax, 0x3541
pop eax
push ebx
add ebx, 0x9ca0
or ebx, 0xa8ff
jmp 0x72e997
and ebx, 0x1e5b
pop ebx
mov eax, dword [ebp - 0x4d4]
mov dword [ebp - 0x2e0], eax
jmp 0x72ea14
push edi
push eax
add esp, 4
add edi, 0x1854f
add edi, 0xa44f
add edi, 0x8c8d
sub edi, 0x6a77
pop edi
push esi
push ebx
add esp, 4
or esi, 0x9e26
pop esi
push esi
or esi, 0xe6c1
pop esi
mov ecx, dword [ebp - 0x4d4]
mov edx, dword [ecx]
mov dword [ebp - 0x4d4], edx
mov eax, dword [ebp - 0x4d4]
cmp eax, dword [ebp - 0xc20]
je 0x72ea0a
mov ecx, dword [ebp - 0x4d4]
cmp dword [ecx + 0x30], 0
jne 0x72e7c0
mov dword [ebp - 0x2e0], 0
Function at 0x72e8d9
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edx
push esi
add esp, 4
xor edx, 0x100cc
call fcn.0072e83a
add byte [ecx], bh
dec ebx
aas
cmp byte [ebx + 0x4b], al
dec esp
cmp dword [esi], edi
add esp, 4
call 0x72e84d
add byte [eax + 0x50], cl
dec ebp
aaa
cmp eax, 0x4b3c4444
dec eax
add esp, 4
pop edx
mov eax, dword [ebp - 0xc18]
mov cx, word [eax]
mov word [ebp - 0xf7e], cx
mov edx, dword [ebp - 0xc18]
add edx, 2
mov dword [ebp - 0xc18], edx
mov ax, word [ebp - 0xf7e]
mov word [ebp - 0x1f8], ax
mov ecx, dword [ebp - 0xc1c]
mov dx, word [ecx]
mov word [ebp - 0xf80], dx
mov eax, dword [ebp - 0xc1c]
add eax, 2
mov dword [ebp - 0xc1c], eax
mov cx, word [ebp - 0xf80]
mov word [ebp - 0x100], cx
push edx
push eax
add esp, 4
jmp 0x72e8b6
or edx, 0x158f8
add edx, 0xdcea
add edx, 0x10698
pop edx
push ecx
call 0x72e8d9
add byte [edx + 0x3d], cl
dec esp
dec edx
dec edi
dec eax
dec esi
aaa
add esp, 4
pop ecx
movzx edx, word [ebp - 0x100]
test edx, edx
jne 0x72e900
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
sub eax, ecx
mov dword [ebp - 0x1498], eax
jmp 0x72e963
movzx edx, word [ebp - 0x1f8]
movzx eax, word [ebp - 0x100]
cmp edx, eax
je 0x72e81f
movzx ecx, word [ebp - 0x1f8]
xor ecx, 0x20
movzx edx, word [ebp - 0x100]
cmp ecx, edx
je 0x72e81f
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
cmp eax, ecx
jge 0x72e94d
mov dword [ebp - 0x14d8], 0xffffffff
jmp 0x72e957
mov dword [ebp - 0x14d8], 1
mov edx, dword [ebp - 0x14d8]
mov dword [ebp - 0x1498], edx
cmp dword [ebp - 0x1498], 0
jne 0x72e9ac
push eax
push eax
add esp, 4
or eax, 0x2990
xor eax, 0x12082
xor eax, 0x3541
pop eax
push ebx
add ebx, 0x9ca0
or ebx, 0xa8ff
jmp 0x72e997
and ebx, 0x1e5b
pop ebx
mov eax, dword [ebp - 0x4d4]
mov dword [ebp - 0x2e0], eax
jmp 0x72ea14
push edi
push eax
add esp, 4
add edi, 0x1854f
add edi, 0xa44f
add edi, 0x8c8d
sub edi, 0x6a77
pop edi
push esi
push ebx
add esp, 4
or esi, 0x9e26
pop esi
push esi
or esi, 0xe6c1
pop esi
mov ecx, dword [ebp - 0x4d4]
mov edx, dword [ecx]
mov dword [ebp - 0x4d4], edx
mov eax, dword [ebp - 0x4d4]
cmp eax, dword [ebp - 0xc20]
je 0x72ea0a
mov ecx, dword [ebp - 0x4d4]
cmp dword [ecx + 0x30], 0
jne 0x72e7c0
mov dword [ebp - 0x2e0], 0
Function at 0x72fee6
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edx
mov ecx, dword [ebp - 0x4e4]
mov dword [ebp - 0x2a8], ecx
jmp 0x72ff60

Function at 0x72ff1a
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ebx
push ebx
push ebx
add esp, 4
xor ebx, 0x1b55
pop ebx
mov edx, dword [ebp - 0x4e4]
mov eax, dword [edx]
mov dword [ebp - 0x4e4], eax
mov ecx, dword [ebp - 0x4e4]
cmp ecx, dword [ebp - 0xc4c]
je 0x72ff56
mov edx, dword [ebp - 0x4e4]
cmp dword [edx + 0x30], 0
jne 0x72fd21
mov dword [ebp - 0x2a8], 0
Function at 0x73082f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
and ecx, 0x6b0e
pop ecx
mov edx, dword [ebp - 0x18f0]
mov dword [ebp - 0x18f4], edx
lea eax, [ebp - 0x1628]
push eax
call dword [ebp - 0x18f4]
test eax, eax
jne 0x730897
push eax
push eax
add esp, 4
and eax, 0xaa45
and eax, 0x31a8
or eax, 0x1ede
pop eax
push ecx
push ecx
add esp, 4
call 0x73087f
add byte [edx], bh
xor al, byte [ebx + 0x39]
inc edx
dec ebx
add esp, 4
jmp 0x730887
pop ecx
mov dword [ebp - 0xa58], 0
jmp 0x730f82
Function at 0x730a19
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
sub ecx, 0x169ab
jmp 0x730a0c
call fcn.00730a19
add byte [ebp + 0x32], cl
dec ecx
aaa
dec ebx
dec ecx
add esp, 4
pop ecx
push esi
and esi, 0x177a8
xor esi, 0x34a6
add esi, 0x3c6d
pop esi
mov edx, dword [ebp - 0xc60]
mov ax, word [edx]
mov word [ebp - 0xf92], ax
mov ecx, dword [ebp - 0xc60]
add ecx, 2
mov dword [ebp - 0xc60], ecx
mov dx, word [ebp - 0xf92]
mov word [ebp - 0x20c], dx
mov eax, dword [ebp - 0xc64]
mov cx, word [eax]
mov word [ebp - 0xf94], cx
mov edx, dword [ebp - 0xc64]
add edx, 2
mov dword [ebp - 0xc64], edx
mov ax, word [ebp - 0xf94]
mov word [ebp - 0x40], ax
push ecx
sub ecx, 0x116b8
jmp 0x730a95
pop ecx
push eax
push edi
add esp, 4
or eax, 0x15940
jmp 0x730aa6
xor eax, 0x98e1
pop eax
push esi
push edx
add esp, 4
jmp 0x730ab9
pop esi
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x730ad7
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x157c], edx
jmp 0x730b31
movzx ecx, word [ebp - 0x20c]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x7309ff
movzx eax, word [ebp - 0x20c]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x7309ff
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x730b1b
mov dword [ebp - 0x1578], 0xffffffff
jmp 0x730b25
mov dword [ebp - 0x1578], 1
mov ecx, dword [ebp - 0x1578]
mov dword [ebp - 0x157c], ecx
cmp dword [ebp - 0x157c], 0
jne 0x730b7a
push eax
push ecx
add esp, 4
call 0x730b4e
add byte [0x3a494f3f], dh
dec edx
cmp byte [ecx + 0x34], al
add esp, 4
add eax, 0xdb15
pop eax
push edi
add edi, 0xfeb8
add edi, 0x17307
sub edi, 0x4387
pop edi
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x2a8], edx
jmp 0x730be2
push ebx
push edi
add esp, 4
sub ebx, 0xf67f
xor ebx, 0x8ceb
sub ebx, 0x11f73
and ebx, 0xeeff
pop ebx
push eax
call 0x730ba8
add byte [ebp + esi + 0x3b], al
aas
dec esp
cmp al, 0x4a
xor al, 0x83
les eax, [eax + ebx*2]
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [eax]
mov dword [ebp - 0x4ec], ecx
mov edx, dword [ebp - 0x4ec]
cmp edx, dword [ebp - 0xc68]
je 0x730bd8
mov eax, dword [ebp - 0x4ec]
cmp dword [eax + 0x30], 0
jne 0x7309a3
mov dword [ebp - 0x2a8], 0
Function at 0x730b4e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
sub ecx, 0x169ab
jmp 0x730a0c
call fcn.00730a19
add byte [ebp + 0x32], cl
dec ecx
aaa
dec ebx
dec ecx
add esp, 4
pop ecx
push esi
and esi, 0x177a8
xor esi, 0x34a6
add esi, 0x3c6d
pop esi
mov edx, dword [ebp - 0xc60]
mov ax, word [edx]
mov word [ebp - 0xf92], ax
mov ecx, dword [ebp - 0xc60]
add ecx, 2
mov dword [ebp - 0xc60], ecx
mov dx, word [ebp - 0xf92]
mov word [ebp - 0x20c], dx
mov eax, dword [ebp - 0xc64]
mov cx, word [eax]
mov word [ebp - 0xf94], cx
mov edx, dword [ebp - 0xc64]
add edx, 2
mov dword [ebp - 0xc64], edx
mov ax, word [ebp - 0xf94]
mov word [ebp - 0x40], ax
push ecx
sub ecx, 0x116b8
jmp 0x730a95
pop ecx
push eax
push edi
add esp, 4
or eax, 0x15940
jmp 0x730aa6
xor eax, 0x98e1
pop eax
push esi
push edx
add esp, 4
jmp 0x730ab9
pop esi
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x730ad7
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x157c], edx
jmp 0x730b31
movzx ecx, word [ebp - 0x20c]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x7309ff
movzx eax, word [ebp - 0x20c]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x7309ff
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x730b1b
mov dword [ebp - 0x1578], 0xffffffff
jmp 0x730b25
mov dword [ebp - 0x1578], 1
mov ecx, dword [ebp - 0x1578]
mov dword [ebp - 0x157c], ecx
cmp dword [ebp - 0x157c], 0
jne 0x730b7a
push eax
push ecx
add esp, 4
call 0x730b4e
add byte [0x3a494f3f], dh
dec edx
cmp byte [ecx + 0x34], al
add esp, 4
add eax, 0xdb15
pop eax
push edi
add edi, 0xfeb8
add edi, 0x17307
sub edi, 0x4387
pop edi
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x2a8], edx
jmp 0x730be2
push ebx
push edi
add esp, 4
sub ebx, 0xf67f
xor ebx, 0x8ceb
sub ebx, 0x11f73
and ebx, 0xeeff
pop ebx
push eax
call 0x730ba8
add byte [ebp + esi + 0x3b], al
aas
dec esp
cmp al, 0x4a
xor al, 0x83
les eax, [eax + ebx*2]
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [eax]
mov dword [ebp - 0x4ec], ecx
mov edx, dword [ebp - 0x4ec]
cmp edx, dword [ebp - 0xc68]
je 0x730bd8
mov eax, dword [ebp - 0x4ec]
cmp dword [eax + 0x30], 0
jne 0x7309a3
mov dword [ebp - 0x2a8], 0
Function at 0x730ba8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
sub ecx, 0x169ab
jmp 0x730a0c
call fcn.00730a19
add byte [ebp + 0x32], cl
dec ecx
aaa
dec ebx
dec ecx
add esp, 4
pop ecx
push esi
and esi, 0x177a8
xor esi, 0x34a6
add esi, 0x3c6d
pop esi
mov edx, dword [ebp - 0xc60]
mov ax, word [edx]
mov word [ebp - 0xf92], ax
mov ecx, dword [ebp - 0xc60]
add ecx, 2
mov dword [ebp - 0xc60], ecx
mov dx, word [ebp - 0xf92]
mov word [ebp - 0x20c], dx
mov eax, dword [ebp - 0xc64]
mov cx, word [eax]
mov word [ebp - 0xf94], cx
mov edx, dword [ebp - 0xc64]
add edx, 2
mov dword [ebp - 0xc64], edx
mov ax, word [ebp - 0xf94]
mov word [ebp - 0x40], ax
push ecx
sub ecx, 0x116b8
jmp 0x730a95
pop ecx
push eax
push edi
add esp, 4
or eax, 0x15940
jmp 0x730aa6
xor eax, 0x98e1
pop eax
push esi
push edx
add esp, 4
jmp 0x730ab9
pop esi
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x730ad7
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x157c], edx
jmp 0x730b31
movzx ecx, word [ebp - 0x20c]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x7309ff
movzx eax, word [ebp - 0x20c]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x7309ff
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x730b1b
mov dword [ebp - 0x1578], 0xffffffff
jmp 0x730b25
mov dword [ebp - 0x1578], 1
mov ecx, dword [ebp - 0x1578]
mov dword [ebp - 0x157c], ecx
cmp dword [ebp - 0x157c], 0
jne 0x730b7a
push eax
push ecx
add esp, 4
call 0x730b4e
add byte [0x3a494f3f], dh
dec edx
cmp byte [ecx + 0x34], al
add esp, 4
add eax, 0xdb15
pop eax
push edi
add edi, 0xfeb8
add edi, 0x17307
sub edi, 0x4387
pop edi
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x2a8], edx
jmp 0x730be2
push ebx
push edi
add esp, 4
sub ebx, 0xf67f
xor ebx, 0x8ceb
sub ebx, 0x11f73
and ebx, 0xeeff
pop ebx
push eax
call 0x730ba8
add byte [ebp + esi + 0x3b], al
aas
dec esp
cmp al, 0x4a
xor al, 0x83
les eax, [eax + ebx*2]
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [eax]
mov dword [ebp - 0x4ec], ecx
mov edx, dword [ebp - 0x4ec]
cmp edx, dword [ebp - 0xc68]
je 0x730bd8
mov eax, dword [ebp - 0x4ec]
cmp dword [eax + 0x30], 0
jne 0x7309a3
mov dword [ebp - 0x2a8], 0

Function at 0x74e4e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov cl, byte [edx]
xor eax, eax
test cl, cl
je 0x74e515
push esi
lea esp, [esp]
movsx ecx, cl
shl eax, 4
add eax, ecx
mov ecx, eax
inc edx
and ecx, 0xf0000000
je 0x74e50a
mov esi, ecx
shr esi, 0x18
xor eax, esi
not ecx
and eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x74e4f0
pop esi
and eax, 0xff
ret