joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100075c9
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edx
push ecx
add ecx, 0x14385
jmp 0x100074f9
pop ecx
lea edx, [ebp - 0x1754]
mov dword [ebp - 0xca8], edx
mov eax, dword [ebp - 0x500]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xca4], ecx
xor edx, edx
mov word [ebp - 0x22c], dx
xor eax, eax
mov word [ebp - 0x128], ax
push ecx
and ecx, 0x14475
and ecx, 0x480a
call 0x10007540
add byte [esp + esi + 0x3b], cl
inc eax
cmp esi, dword [ebx + eax*4]
les eax, [ecx + eax*4]
leave
sbb byte [eax], 1
add byte [ecx + 0x50], bl
and eax, 0x7dae
jmp 0x10007558
pop eax
mov ecx, dword [ebp - 0xca4]
mov dx, word [ecx]
mov word [ebp - 0x1046], dx
mov eax, dword [ebp - 0xca4]
add eax, 2
mov dword [ebp - 0xca4], eax
mov cx, word [ebp - 0x1046]
mov word [ebp - 0x22c], cx
mov edx, dword [ebp - 0xca8]
mov ax, word [edx]
mov word [ebp - 0x1048], ax
mov ecx, dword [ebp - 0xca8]
add ecx, 2
mov dword [ebp - 0xca8], ecx
mov dx, word [ebp - 0x1048]
mov word [ebp - 0x128], dx
push ebx
push esi
add esp, 4
jmp 0x100075bd
call 0x100075c9
add byte [edx], dh
inc ebx
inc ecx
cmp eax, 0xc4834532
add al, 0x81
retf

Function at 0x100076a2
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edx
mov ecx, dword [ebp - 0x500]
mov dword [ebp - 0x2f0], ecx
jmp 0x1000771c
Function at 0x10007b4e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop eax
push edx
push eax
add esp, 4
add edx, 0x1319a
add edx, 0x1f
pop edx
mov eax, dword [ebp - 0x504]
mov ecx, dword [eax]
mov dword [ebp - 0x504], ecx
mov edx, dword [ebp - 0x504]
cmp edx, dword [ebp - 0xcb8]
je 0x10007b90
mov eax, dword [ebp - 0x504]
cmp dword [eax + 0x30], 0
jne 0x1000795b
mov dword [ebp - 0x754], 0
Function at 0x10007def
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ebp - 0x3a8]
add ecx, dword [ebp - 0x1608]
mov dword [ebp - 0x758], ecx
jne 0x10007cd4
mov edx, dword [ebp - 0x764]
mov dword [ebp - 0x3e0], edx
jmp 0x10007f46
mov eax, dword [ebp - 0x758]
mov ecx, dword [ebp - 0x3a8]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x198c], ecx
mov edx, dword [ebp - 0x758]
mov eax, dword [ebp - 0x3a8]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x1990], eax
mov ecx, dword [ebp - 0x758]
mov edx, dword [ebp - 0x3a8]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0x1994], edx
mov dword [ebp - 0x75c], 0
jmp 0x10007d2e
mov eax, dword [ebp - 0x75c]
add eax, 1
mov dword [ebp - 0x75c], eax
mov ecx, dword [ebp - 0x758]
mov edx, dword [ebp - 0x75c]
cmp edx, dword [ecx + 0x18]
jae 0x10007f3a
mov eax, dword [ebp - 0x75c]
mov ecx, dword [ebp - 0x198c]
mov edx, dword [ebp - 0x3a8]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x760], edx
mov eax, dword [ebp - 0x75c]
mov ecx, dword [ebp - 0x1990]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x1994]
mov ecx, dword [ebp - 0x3a8]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x1d20], ecx
mov dword [ebp - 0x1c8], 0
jmp 0x10007d9e
mov edx, dword [ebp - 0x1c8]
add edx, 1
mov dword [ebp - 0x1c8], edx
mov eax, dword [ebp - 0x760]
add eax, dword [ebp - 0x1c8]
movsx ecx, byte [eax]
test ecx, ecx
je 0x10007e50
mov edx, dword [ebp - 0x1c8]
movsx eax, byte [ebp + edx - 0x898]
test eax, eax
je 0x10007e50
push esi
push ecx
add esp, 4
xor esi, 0x7999
and esi, 0xf3f4
pop esi
push esi
push ecx
add esp, 4
call 0x10007def
add byte [esp + ecx*2], dh
inc eax
inc esi
cmp al, 0x32
inc ebp
add esp, 4
pop esi
push edi
jmp 0x10007dfc
pop edi
mov ecx, dword [ebp - 0x760]
add ecx, dword [ebp - 0x1c8]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x1c8]
movsx ecx, byte [ebp + eax - 0x898]
cmp edx, ecx
je 0x10007e42
mov edx, dword [ebp - 0x760]
add edx, dword [ebp - 0x1c8]
movsx eax, byte [edx]
xor eax, 0x20
mov ecx, dword [ebp - 0x1c8]
movsx edx, byte [ebp + ecx - 0x898]
cmp eax, edx
jne 0x10007e49
jmp 0x10007d8f
jmp 0x10007e50
push esi
push esi
add esp, 4
sub esi, 0x3f9c
sub esi, 0x12761
pop esi
push edx
push ecx
add esp, 4
xor edx, 0x11c16
pop edx
push esi
add esi, 0x940b
add esi, 0x118ff
sub esi, 0x5ef2
pop esi
mov eax, dword [ebp - 0x760]
add eax, dword [ebp - 0x1c8]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x1c8]
movsx eax, byte [ebp + edx - 0x898]
cmp ecx, eax
jne 0x10007eaf
mov dword [ebp - 0xcbc], 0
jmp 0x10007f1e
push ecx
jmp 0x10007eb6
or ecx, 0x40c3
pop ecx
push esi
push eax
add esp, 4
sub esi, 0x7466
add esi, 0x13460
pop esi
push ecx
push edx
add esp, 4
and ecx, 0xb048
sub ecx, 0x8b1b
pop ecx
mov ecx, dword [ebp - 0x760]
add ecx, dword [ebp - 0x1c8]
movsx edx, byte [ecx]
or edx, 0x20
mov eax, dword [ebp - 0x1c8]
movsx ecx, byte [ebp + eax - 0x898]
or ecx, 0x20
cmp edx, ecx
jge 0x10007f14
mov dword [ebp - 0xcbc], 0xffffffff
jmp 0x10007f1e
mov dword [ebp - 0xcbc], 1
cmp dword [ebp - 0xcbc], 0
jne 0x10007f35
mov edx, dword [ebp - 0x1d20]
mov dword [ebp - 0x3e0], edx
jmp 0x10007f46
jmp 0x10007d1f
mov eax, dword [ebp - 0x764]
mov dword [ebp - 0x3e0], eax
Function at 0x1000859a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x1cc]
add edx, 1
mov dword [ebp - 0x1cc], edx
mov eax, dword [ebp - 0x770]
add eax, dword [ebp - 0x1cc]
movsx ecx, byte [eax]
test ecx, ecx
je 0x1000860a
mov edx, dword [ebp - 0x1cc]
movsx eax, byte [ebp + edx - 0x87c]
test eax, eax
je 0x1000860a
push edx
push edi
add esp, 4
call 0x1000859a
add byte [eax + 0x4b], cl
inc eax
push eax
cmp byte [edx], dh
inc edx
inc esi
inc ebp
add esp, 4
or edx, 0x7674
call 0x100085b3
add byte [edi + 0x3e], al
aas
cmp byte [ecx], bh
xor eax, dword [edi + 0x3b]
cmp edi, dword [ebx + eax*4]
les eax, [edx + ebx*2]
mov ecx, dword [ebp - 0x770]
add ecx, dword [ebp - 0x1cc]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x1cc]
movsx ecx, byte [ebp + eax - 0x87c]
cmp edx, ecx
je 0x100085fc
mov edx, dword [ebp - 0x770]
add edx, dword [ebp - 0x1cc]
movsx eax, byte [edx]
xor eax, 0x20
mov ecx, dword [ebp - 0x1cc]
movsx edx, byte [ebp + ecx - 0x87c]
jmp 0x10008549
push esi

Function at 0x100085b3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x1cc]
add edx, 1
mov dword [ebp - 0x1cc], edx
mov eax, dword [ebp - 0x770]
add eax, dword [ebp - 0x1cc]
movsx ecx, byte [eax]
test ecx, ecx
je 0x1000860a
mov edx, dword [ebp - 0x1cc]
movsx eax, byte [ebp + edx - 0x87c]
test eax, eax
je 0x1000860a
push edx
push edi
add esp, 4
call 0x1000859a
add byte [eax + 0x4b], cl
inc eax
push eax
cmp byte [edx], dh
inc edx
inc esi
inc ebp
add esp, 4
or edx, 0x7674
call 0x100085b3
add byte [edi + 0x3e], al
aas
cmp byte [ecx], bh
xor eax, dword [edi + 0x3b]
cmp edi, dword [ebx + eax*4]
les eax, [edx + ebx*2]
mov ecx, dword [ebp - 0x770]
add ecx, dword [ebp - 0x1cc]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x1cc]
movsx ecx, byte [ebp + eax - 0x87c]
cmp edx, ecx
je 0x100085fc
mov edx, dword [ebp - 0x770]
add edx, dword [ebp - 0x1cc]
movsx eax, byte [edx]
xor eax, 0x20
mov ecx, dword [ebp - 0x1cc]
movsx edx, byte [ebp + ecx - 0x87c]
jmp 0x10008549
push esi

Function at 0x100085d6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x1cc]
add edx, 1
mov dword [ebp - 0x1cc], edx
mov eax, dword [ebp - 0x770]
add eax, dword [ebp - 0x1cc]
movsx ecx, byte [eax]
test ecx, ecx
je 0x1000860a
mov edx, dword [ebp - 0x1cc]
movsx eax, byte [ebp + edx - 0x87c]
test eax, eax
je 0x1000860a
push edx
push edi
add esp, 4
call 0x1000859a
add byte [eax + 0x4b], cl
inc eax
push eax
cmp byte [edx], dh
inc edx
inc esi
inc ebp
add esp, 4
or edx, 0x7674
call 0x100085b3
add byte [edi + 0x3e], al
aas
cmp byte [ecx], bh
xor eax, dword [edi + 0x3b]
cmp edi, dword [ebx + eax*4]
les eax, [edx + ebx*2]
mov ecx, dword [ebp - 0x770]
add ecx, dword [ebp - 0x1cc]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x1cc]
movsx ecx, byte [ebp + eax - 0x87c]
cmp edx, ecx
je 0x100085fc
mov edx, dword [ebp - 0x770]
add edx, dword [ebp - 0x1cc]
movsx eax, byte [edx]
xor eax, 0x20
mov ecx, dword [ebp - 0x1cc]
movsx edx, byte [ebp + ecx - 0x87c]
jmp 0x10008549
push esi
Function at 0x1000860b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x76c]
add eax, 1
mov dword [ebp - 0x76c], eax
mov ecx, dword [ebp - 0x768]
mov edx, dword [ebp - 0x76c]
cmp edx, dword [ecx + 0x18]
jae 0x100086f4
mov eax, dword [ebp - 0x76c]
mov ecx, dword [ebp - 0x19a8]
mov edx, dword [ebp - 0x338]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x770], edx
mov eax, dword [ebp - 0x76c]
mov ecx, dword [ebp - 0x19ac]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x19b0]
mov ecx, dword [ebp - 0x338]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x19b4], ecx
mov dword [ebp - 0x1cc], 0
jmp 0x10008558
add esi, 0x7a55
add esi, 0x11bf9
pop esi
push eax
push edi
add esp, 4
sub eax, 0x2471
or eax, 0xab5
or al, byte [eax]
add byte [eax + 0x51], bl
push eax
add esp, 4
or ecx, 0x1343f
or ecx, 0x9c82
pop ecx
mov eax, dword [ebp - 0x770]
add eax, dword [ebp - 0x1cc]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x1cc]
movsx eax, byte [ebp + edx - 0x87c]
cmp ecx, eax
jne 0x10008669
mov dword [ebp - 0xccc], 0
jmp 0x100086d8
push edx
and edx, 0xa8a6
pop edx
push ecx
add ecx, 0x139e5
pop ecx
push eax
push eax
add esp, 4
call 0x1000868b
add byte [ecx], bh
dec eax
cmp dword [eax + 0x46], ecx
dec edi
inc ecx
add esp, 4
pop eax
push ecx
push edi
add esp, 4
xor ecx, 0x29fd
pop ecx
mov ecx, dword [ebp - 0x770]
add ecx, dword [ebp - 0x1cc]
movsx edx, byte [ecx]
or edx, 0x20
mov eax, dword [ebp - 0x1cc]
movsx ecx, byte [ebp + eax - 0x87c]
or ecx, 0x20
cmp edx, ecx
jge 0x100086ce
mov dword [ebp - 0xccc], 0xffffffff
jmp 0x100086d8
mov dword [ebp - 0xccc], 1
cmp dword [ebp - 0xccc], 0
jne 0x100086ef
mov edx, dword [ebp - 0x19b4]
mov dword [ebp - 0x50c], edx
jmp 0x10008700
jmp 0x100084d9
mov eax, dword [ebp - 0x774]
mov dword [ebp - 0x50c], eax
mov ecx, dword [ebp - 0x50c]
mov dword [ebp - 0x7a0], ecx
push esi
and esi, 0x5dbc
sub esi, 0x13f6b
xor esi, 0x124de
or esi, 0xb2b2
pop esi
push edx
and edx, 0xa9f2
call 0x1000873a
add byte [ebx + 0x42], cl
inc ebx
xor cl, byte [edi + 0x36]
push eax
add esp, 4
pop edx
mov edx, dword [ebp - 0x3fc]
add edx, 0xe
mov dword [ebp - 0x1a04], edx
push edx
sub edx, 0x54b5
pop edx
push eax
push ebx
add esp, 4
and eax, 0x16335
xor eax, 0x12d59
pop eax
push eax
push ebx
add esp, 4
and eax, 0xc6bb
or eax, 0x162f4
and eax, 0x5ea8
pop eax
cmp dword [ebp - 0x3fc], 0
je 0x10008791
cmp dword [ebp - 0xae4], 0
jne 0x100087d7
push eax
add eax, 0xc499
xor eax, 0xa952
pop eax
push eax
push edx
add esp, 4
jmp 0x100087a9
pop eax
push eax
xor eax, 0x16a57
and eax, 0x42d7
jmp 0x100087bc
sub eax, 0xc073
pop eax
mov eax, dword [ebp - 0x7a0]
mov dword [ebp - 0x19b8], eax
push 0
call dword [ebp - 0x19b8]
mov dword [ebp - 0x2054], 0xa
push esi
sub esi, 0x17e43
pop esi
push esi
push eax
add esp, 4
add esi, 0x4c90
xor esi, 0xc022
jmp 0x10008801
call 0x1000880f
add byte [eax + 0x34], al
inc esi
cmp eax, 0x4f4e384a
add esp, 4
pop esi
mov ecx, dword [ebp - 0x3fc]
invalid
push ecx
Function at 0x1000868b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x76c]
add eax, 1
mov dword [ebp - 0x76c], eax
mov ecx, dword [ebp - 0x768]
mov edx, dword [ebp - 0x76c]
cmp edx, dword [ecx + 0x18]
jae 0x100086f4
mov eax, dword [ebp - 0x76c]
mov ecx, dword [ebp - 0x19a8]
mov edx, dword [ebp - 0x338]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x770], edx
mov eax, dword [ebp - 0x76c]
mov ecx, dword [ebp - 0x19ac]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x19b0]
mov ecx, dword [ebp - 0x338]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x19b4], ecx
mov dword [ebp - 0x1cc], 0
jmp 0x10008558
add esi, 0x7a55
add esi, 0x11bf9
pop esi
push eax
push edi
add esp, 4
sub eax, 0x2471
or eax, 0xab5
or al, byte [eax]
add byte [eax + 0x51], bl
push eax
add esp, 4
or ecx, 0x1343f
or ecx, 0x9c82
pop ecx
mov eax, dword [ebp - 0x770]
add eax, dword [ebp - 0x1cc]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x1cc]
movsx eax, byte [ebp + edx - 0x87c]
cmp ecx, eax
jne 0x10008669
mov dword [ebp - 0xccc], 0
jmp 0x100086d8
push edx
and edx, 0xa8a6
pop edx
push ecx
add ecx, 0x139e5
pop ecx
push eax
push eax
add esp, 4
call 0x1000868b
add byte [ecx], bh
dec eax
cmp dword [eax + 0x46], ecx
dec edi
inc ecx
add esp, 4
pop eax
push ecx
push edi
add esp, 4
xor ecx, 0x29fd
pop ecx
mov ecx, dword [ebp - 0x770]
add ecx, dword [ebp - 0x1cc]
movsx edx, byte [ecx]
or edx, 0x20
mov eax, dword [ebp - 0x1cc]
movsx ecx, byte [ebp + eax - 0x87c]
or ecx, 0x20
cmp edx, ecx
jge 0x100086ce
mov dword [ebp - 0xccc], 0xffffffff
jmp 0x100086d8
mov dword [ebp - 0xccc], 1
cmp dword [ebp - 0xccc], 0
jne 0x100086ef
mov edx, dword [ebp - 0x19b4]
mov dword [ebp - 0x50c], edx
jmp 0x10008700
jmp 0x100084d9
mov eax, dword [ebp - 0x774]
mov dword [ebp - 0x50c], eax
mov ecx, dword [ebp - 0x50c]
mov dword [ebp - 0x7a0], ecx
push esi
and esi, 0x5dbc
sub esi, 0x13f6b
xor esi, 0x124de
or esi, 0xb2b2
pop esi
push edx
and edx, 0xa9f2
call 0x1000873a
add byte [ebx + 0x42], cl
inc ebx
xor cl, byte [edi + 0x36]
push eax
add esp, 4
pop edx
mov edx, dword [ebp - 0x3fc]
add edx, 0xe
mov dword [ebp - 0x1a04], edx
push edx
sub edx, 0x54b5
pop edx
push eax
push ebx
add esp, 4
and eax, 0x16335
xor eax, 0x12d59
pop eax
push eax
push ebx
add esp, 4
and eax, 0xc6bb
or eax, 0x162f4
and eax, 0x5ea8
pop eax
cmp dword [ebp - 0x3fc], 0
je 0x10008791
cmp dword [ebp - 0xae4], 0
jne 0x100087d7
push eax
add eax, 0xc499
xor eax, 0xa952
pop eax
push eax
push edx
add esp, 4
jmp 0x100087a9
pop eax
push eax
xor eax, 0x16a57
and eax, 0x42d7
jmp 0x100087bc
sub eax, 0xc073
pop eax
mov eax, dword [ebp - 0x7a0]
mov dword [ebp - 0x19b8], eax
push 0
call dword [ebp - 0x19b8]
mov dword [ebp - 0x2054], 0xa
push esi
sub esi, 0x17e43
pop esi
push esi
push eax
add esp, 4
add esi, 0x4c90
xor esi, 0xc022
jmp 0x10008801
call 0x1000880f
add byte [eax + 0x34], al
inc esi
cmp eax, 0x4f4e384a
add esp, 4
pop esi
mov ecx, dword [ebp - 0x3fc]
invalid
push ecx
Function at 0x1000873a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x76c]
add eax, 1
mov dword [ebp - 0x76c], eax
mov ecx, dword [ebp - 0x768]
mov edx, dword [ebp - 0x76c]
cmp edx, dword [ecx + 0x18]
jae 0x100086f4
mov eax, dword [ebp - 0x76c]
mov ecx, dword [ebp - 0x19a8]
mov edx, dword [ebp - 0x338]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x770], edx
mov eax, dword [ebp - 0x76c]
mov ecx, dword [ebp - 0x19ac]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x19b0]
mov ecx, dword [ebp - 0x338]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x19b4], ecx
mov dword [ebp - 0x1cc], 0
jmp 0x10008558
add esi, 0x7a55
add esi, 0x11bf9
pop esi
push eax
push edi
add esp, 4
sub eax, 0x2471
or eax, 0xab5
or al, byte [eax]
add byte [eax + 0x51], bl
push eax
add esp, 4
or ecx, 0x1343f
or ecx, 0x9c82
pop ecx
mov eax, dword [ebp - 0x770]
add eax, dword [ebp - 0x1cc]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x1cc]
movsx eax, byte [ebp + edx - 0x87c]
cmp ecx, eax
jne 0x10008669
mov dword [ebp - 0xccc], 0
jmp 0x100086d8
push edx
and edx, 0xa8a6
pop edx
push ecx
add ecx, 0x139e5
pop ecx
push eax
push eax
add esp, 4
call 0x1000868b
add byte [ecx], bh
dec eax
cmp dword [eax + 0x46], ecx
dec edi
inc ecx
add esp, 4
pop eax
push ecx
push edi
add esp, 4
xor ecx, 0x29fd
pop ecx
mov ecx, dword [ebp - 0x770]
add ecx, dword [ebp - 0x1cc]
movsx edx, byte [ecx]
or edx, 0x20
mov eax, dword [ebp - 0x1cc]
movsx ecx, byte [ebp + eax - 0x87c]
or ecx, 0x20
cmp edx, ecx
jge 0x100086ce
mov dword [ebp - 0xccc], 0xffffffff
jmp 0x100086d8
mov dword [ebp - 0xccc], 1
cmp dword [ebp - 0xccc], 0
jne 0x100086ef
mov edx, dword [ebp - 0x19b4]
mov dword [ebp - 0x50c], edx
jmp 0x10008700
jmp 0x100084d9
mov eax, dword [ebp - 0x774]
mov dword [ebp - 0x50c], eax
mov ecx, dword [ebp - 0x50c]
mov dword [ebp - 0x7a0], ecx
push esi
and esi, 0x5dbc
sub esi, 0x13f6b
xor esi, 0x124de
or esi, 0xb2b2
pop esi
push edx
and edx, 0xa9f2
call 0x1000873a
add byte [ebx + 0x42], cl
inc ebx
xor cl, byte [edi + 0x36]
push eax
add esp, 4
pop edx
mov edx, dword [ebp - 0x3fc]
add edx, 0xe
mov dword [ebp - 0x1a04], edx
push edx
sub edx, 0x54b5
pop edx
push eax
push ebx
add esp, 4
and eax, 0x16335
xor eax, 0x12d59
pop eax
push eax
push ebx
add esp, 4
and eax, 0xc6bb
or eax, 0x162f4
and eax, 0x5ea8
pop eax
cmp dword [ebp - 0x3fc], 0
je 0x10008791
cmp dword [ebp - 0xae4], 0
jne 0x100087d7
push eax
add eax, 0xc499
xor eax, 0xa952
pop eax
push eax
push edx
add esp, 4
jmp 0x100087a9
pop eax
push eax
xor eax, 0x16a57
and eax, 0x42d7
jmp 0x100087bc
sub eax, 0xc073
pop eax
mov eax, dword [ebp - 0x7a0]
mov dword [ebp - 0x19b8], eax
push 0
call dword [ebp - 0x19b8]
mov dword [ebp - 0x2054], 0xa
push esi
sub esi, 0x17e43
pop esi
push esi
push eax
add esp, 4
add esi, 0x4c90
xor esi, 0xc022
jmp 0x10008801
call 0x1000880f
add byte [eax + 0x34], al
inc esi
cmp eax, 0x4f4e384a
add esp, 4
pop esi
mov ecx, dword [ebp - 0x3fc]
invalid
push ecx
Function at 0x1000880f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x76c]
add eax, 1
mov dword [ebp - 0x76c], eax
mov ecx, dword [ebp - 0x768]
mov edx, dword [ebp - 0x76c]
cmp edx, dword [ecx + 0x18]
jae 0x100086f4
mov eax, dword [ebp - 0x76c]
mov ecx, dword [ebp - 0x19a8]
mov edx, dword [ebp - 0x338]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x770], edx
mov eax, dword [ebp - 0x76c]
mov ecx, dword [ebp - 0x19ac]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x19b0]
mov ecx, dword [ebp - 0x338]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x19b4], ecx
mov dword [ebp - 0x1cc], 0
jmp 0x10008558
add esi, 0x7a55
add esi, 0x11bf9
pop esi
push eax
push edi
add esp, 4
sub eax, 0x2471
or eax, 0xab5
or al, byte [eax]
add byte [eax + 0x51], bl
push eax
add esp, 4
or ecx, 0x1343f
or ecx, 0x9c82
pop ecx
mov eax, dword [ebp - 0x770]
add eax, dword [ebp - 0x1cc]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x1cc]
movsx eax, byte [ebp + edx - 0x87c]
cmp ecx, eax
jne 0x10008669
mov dword [ebp - 0xccc], 0
jmp 0x100086d8
push edx
and edx, 0xa8a6
pop edx
push ecx
add ecx, 0x139e5
pop ecx
push eax
push eax
add esp, 4
call 0x1000868b
add byte [ecx], bh
dec eax
cmp dword [eax + 0x46], ecx
dec edi
inc ecx
add esp, 4
pop eax
push ecx
push edi
add esp, 4
xor ecx, 0x29fd
pop ecx
mov ecx, dword [ebp - 0x770]
add ecx, dword [ebp - 0x1cc]
movsx edx, byte [ecx]
or edx, 0x20
mov eax, dword [ebp - 0x1cc]
movsx ecx, byte [ebp + eax - 0x87c]
or ecx, 0x20
cmp edx, ecx
jge 0x100086ce
mov dword [ebp - 0xccc], 0xffffffff
jmp 0x100086d8
mov dword [ebp - 0xccc], 1
cmp dword [ebp - 0xccc], 0
jne 0x100086ef
mov edx, dword [ebp - 0x19b4]
mov dword [ebp - 0x50c], edx
jmp 0x10008700
jmp 0x100084d9
mov eax, dword [ebp - 0x774]
mov dword [ebp - 0x50c], eax
mov ecx, dword [ebp - 0x50c]
mov dword [ebp - 0x7a0], ecx
push esi
and esi, 0x5dbc
sub esi, 0x13f6b
xor esi, 0x124de
or esi, 0xb2b2
pop esi
push edx
and edx, 0xa9f2
call 0x1000873a
add byte [ebx + 0x42], cl
inc ebx
xor cl, byte [edi + 0x36]
push eax
add esp, 4
pop edx
mov edx, dword [ebp - 0x3fc]
add edx, 0xe
mov dword [ebp - 0x1a04], edx
push edx
sub edx, 0x54b5
pop edx
push eax
push ebx
add esp, 4
and eax, 0x16335
xor eax, 0x12d59
pop eax
push eax
push ebx
add esp, 4
and eax, 0xc6bb
or eax, 0x162f4
and eax, 0x5ea8
pop eax
cmp dword [ebp - 0x3fc], 0
je 0x10008791
cmp dword [ebp - 0xae4], 0
jne 0x100087d7
push eax
add eax, 0xc499
xor eax, 0xa952
pop eax
push eax
push edx
add esp, 4
jmp 0x100087a9
pop eax
push eax
xor eax, 0x16a57
and eax, 0x42d7
jmp 0x100087bc
sub eax, 0xc073
pop eax
mov eax, dword [ebp - 0x7a0]
mov dword [ebp - 0x19b8], eax
push 0
call dword [ebp - 0x19b8]
mov dword [ebp - 0x2054], 0xa
push esi
sub esi, 0x17e43
pop esi
push esi
push eax
add esp, 4
add esi, 0x4c90
xor esi, 0xc022
jmp 0x10008801
call 0x1000880f
add byte [eax + 0x34], al
inc esi
cmp eax, 0x4f4e384a
add esp, 4
pop esi
mov ecx, dword [ebp - 0x3fc]
invalid
push ecx
Function at 0x10008859
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp byte [ecx + 0x45], cl
dec esp
dec edx
cmp bh, byte [esi]
dec ebp
add esp, 4
call 0x1000886c
add byte [esp + edi + 0x3f], cl
inc esi
dec ebx
xor eax, 0x39393234
add esp, 4
pop ebx
mov byte [ebp - 0x9d8], 0x56
mov byte [ebp - 0x9d7], 0x69
mov byte [ebp - 0x9d6], 0x72
mov byte [ebp - 0x9d5], 0x74
mov byte [ebp - 0x9d4], 0x75
mov byte [ebp - 0x9d3], 0x61
mov byte [ebp - 0x9d2], 0x6c
mov byte [ebp - 0x9d1], 0x50
mov byte [ebp - 0x9d0], 0x72
mov byte [ebp - 0x9cf], 0x6f
invalid
invalid

Function at 0x1000886c
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
cmp byte [ecx + 0x45], cl
dec esp
dec edx
cmp bh, byte [esi]
dec ebp
add esp, 4
call 0x1000886c
add byte [esp + edi + 0x3f], cl
inc esi
dec ebx
xor eax, 0x39393234
add esp, 4
pop ebx
mov byte [ebp - 0x9d8], 0x56
mov byte [ebp - 0x9d7], 0x69
mov byte [ebp - 0x9d6], 0x72
mov byte [ebp - 0x9d5], 0x74
mov byte [ebp - 0x9d4], 0x75
mov byte [ebp - 0x9d3], 0x61
mov byte [ebp - 0x9d2], 0x6c
mov byte [ebp - 0x9d1], 0x50
mov byte [ebp - 0x9d0], 0x72
mov byte [ebp - 0x9cf], 0x6f
invalid
invalid

Function at 0x100089ca
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
add ecx, 0x182cc
call 0x100089ca
add byte [esi + 0x34], al
inc eax
inc ebp
inc esi
inc edi
dec ebp
dec edi
xor eax, 0x4c4833d
and ecx, 0xb44f
sub ecx, 0x17d2c
pop ecx
push esi
jmp 0x100089e4
pop esi
lea eax, [ebp - 0x1754]
mov dword [ebp - 0xcd4], eax
mov ecx, dword [ebp - 0x510]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xcd0], edx
xor eax, eax
mov word [ebp - 0x238], ax
xor ecx, ecx
mov word [ebp - 0x4c], cx
push edi
or edi, 0x134e8
pop edi
push edi
push esi
add esp, 4
xor edi, 0x7ade
and edi, 0xe030
add edi, 0x16259
or edi, 0x8ef2
pop edi
push esi
push ebx
add esp, 4
or esi, 0x52c3
pop esi
mov edx, dword [ebp - 0xcd0]
mov ax, word [edx]
mov word [ebp - 0x1052], ax
mov ecx, dword [ebp - 0xcd0]
add ecx, 2
mov dword [ebp - 0xcd0], ecx
invalid
invalid

Function at 0x10008a10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
add ecx, 0x182cc
call 0x100089ca
add byte [esi + 0x34], al
inc eax
inc ebp
inc esi
inc edi
dec ebp
dec edi
xor eax, 0x4c4833d
and ecx, 0xb44f
sub ecx, 0x17d2c
pop ecx
push esi
jmp 0x100089e4
pop esi
lea eax, [ebp - 0x1754]
mov dword [ebp - 0xcd4], eax
mov ecx, dword [ebp - 0x510]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xcd0], edx
xor eax, eax
mov word [ebp - 0x238], ax
xor ecx, ecx
mov word [ebp - 0x4c], cx
push edi
or edi, 0x134e8
pop edi
push edi
push esi
add esp, 4
xor edi, 0x7ade
and edi, 0xe030
add edi, 0x16259
or edi, 0x8ef2
pop edi
push esi
push ebx
add esp, 4
or esi, 0x52c3
pop esi
mov edx, dword [ebp - 0xcd0]
mov ax, word [edx]
mov word [ebp - 0x1052], ax
mov ecx, dword [ebp - 0xcd0]
add ecx, 2
mov dword [ebp - 0xcd0], ecx
invalid
invalid