joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d4ba0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x51e204]
test esi, esi
jle 0x4d4cc0
mov eax, dword [0x51e208]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x4d4bd4
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x4d4c57
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x4d4bc0
mov dword [esp], ebx
call fcn.004d5590
mov edi, eax
test eax, eax
je 0x4d4ce7
mov eax, dword [0x51e208]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.004d56d0
mov edx, dword [0x51e208]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x4d4cc7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x4d4c50
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x4d4c60
add dword [0x51e204], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x51e208]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x4d4c50
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.004d4b40
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x4d4bde
mov eax, dword [0x51e208]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.004d4b40
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.004d4b40
lea esi, [esi]
nop

Function at 0x4d5200
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x51e220
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x51e218]
sub esp, 4
test ebx, ebx
je 0x4d5255
mov ebp, dword [sym.imp.kernel32.dll_TlsGetValue]
mov edi, dword [sym.imp.kernel32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x4d524e
test esi, esi
je 0x4d524e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4d5230
mov dword [esp], 0x51e220
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4d5590
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x4d55b5
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x4d55c0
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x4d55b5
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x4d5608
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x4d55fe
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x4d560a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x4d55f0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x407d9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407e75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407dd4
mov eax, dword [ebp - 4]
call fcn.004071d0
jmp 0x407ddc
mov eax, dword [ebp - 4]
call fcn.00407bd4
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407e28
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407e12
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.004071d0
jmp 0x407e24
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407bd4
inc ebx
dec esi
jne 0x407dec
push 1
push dword [ebp - 4]
push 0x407e8c
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f34
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e7c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
mov esi, 0x205d7b18
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e3d0
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x1ea003d0
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x412c40
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00412abf

Function at 0x416f89
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004168f7

Function at 0x416f94
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00416b32

Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x209960fc
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e3d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x3d0e46f1
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x4010b8
Capabilities:
Extract resource via kernel32 functions
Get common file path

Disassembly:
push edi
sub esp, 0x200
mov edi, esp
push 0x7c
push edi
call sub.KERNEL32.dll_GetSystemDirectoryA
lea ecx, [edi + 0x7c]
push ecx
push 0
push edi
add edi, eax
mov eax, 0x69636d5c
stosd dword es:[edi], eax
mov eax, 0x337a7471
stosd dword es:[edi], eax
mov eax, 0x6c642e32
stosd dword es:[edi], eax
mov eax, 0x6c
stosd dword es:[edi], eax
call sub.KERNEL32.dll_GetFileAttributesExA
add esp, 0x200
pop edi
test eax, eax
je 0x401100
pushal
jmp fcn.00401338
ret

Function at 0x401470
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
lea edi, [ecx - 0x8c]
push ebp
mov ebx, esp
push ebx
mov eax, 0x2b
push eax
add dword [esp], 0x15
push 0xfffffe70
add dword [esp], 0xaec
push section..data
xor ebx, ebx
add ebx, sym.imp.KERNEL32.dll_VirtualProtect
call dword [ebx]
pop esi
mov edx, 0x403400
mov dword [edi + 0x34], edx
lea ecx, [edx - 0x70]
mov eax, 0x40252f
push 0x55c
pop edx
cmp edx, 0
je 0x4014de
add edx, 0xfffffffc
inc eax
inc eax
inc eax
inc eax
mov esi, dword [eax - 4]
mov dword [ecx + 0x70], esi
add ecx, 4
xor dword [ecx + 0x6c], 0x378a9256
add dword [ecx + 0x6c], 0x5ae34687
jmp 0x4014b9
call sub.KERNEL32.dll_GetLogicalDrives
pop ebp
ret 8
Function at 0x412310
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4cf084]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [ebp - 0x10], eax
push edi
mov edi, dword [ebp + 0x1c]
mov eax, dword [esi + 4]
add eax, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp byte [ebp + 0x18], 0
push 0
je 0x412364
mov ecx, dword [esi + 4]
push 0
push edi
call fcn.004124a0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00477136
mov esp, ebp
pop ebp
ret 0x18
mov ecx, dword [ebx]
cmp ecx, 0xffffffff
jne 0x41238c
mov ecx, dword [esi + 4]
push 0x2719
push edi
call fcn.004124a0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00477136
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [ebp + 0x14]
push edi
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x10]
push ecx
call dword [sym.imp.WS2_32.dll_WSARecv]
mov ebx, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x40
jne 0x4123c3
mov eax, 0x2746
jmp 0x4123d0
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test ebx, ebx
je 0x4123fb
cmp eax, 0x3e5
je 0x4123fb
push dword [ebp - 8]
mov ecx, dword [esi + 4]
push eax
push edi
call fcn.004124a0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00477136
mov esp, ebp
pop ebp
ret 0x18
mov ecx, dword [esi + 4]
push edi
call fcn.00412520
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00477136
mov esp, ebp
pop ebp
ret 0x18

Function at 0x4150a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
invalid
cmp dword [ebp - 8], eax
jae 0x4150a9
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x41509a
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
Function at 0x416b50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
and byte [ebp - 0x7ab], 0
mov byte [ebp - 0x7aa], 0xed
and byte [ebp - 0x7a9], 0
mov byte [ebp - 0x7a8], 0x4e
mov byte [ebp - 0x7a7], 0x55
mov byte [ebp - 0x7a6], 0x56
mov byte [ebp - 0x7a5], 0x7e
mov byte [ebp - 0x7a4], 0x21
mov byte [ebp - 0x7a3], 0x20
mov byte [ebp - 0x7a2], 0x3c
mov byte [ebp - 0x7a1], 0x76
mov byte [ebp - 0x7a0], 0x7e
mov byte [ebp - 0x79f], 0x7e
mov byte [ebp - 0x79e], 0x12
push 0xb
lea eax, [ebp - 0x7ac]
push eax
call fcn.00414e65
pop ecx
push eax
mov eax, dword [ebp - 0x338]
lea eax, [ebp + eax - 0x230]
push eax
call fcn.00414dc6
add esp, 0xc
jmp 0x416dcd
mov eax, dword [ebp - 0x6fc]
inc eax
mov dword [ebp - 0x6fc], eax
and dword [ebp - 0x37c], 0
call fcn.00414e55
les eax, [ebp - 0x6b]
sbb edi, edi
mov ch, 0x60
cld
invalid
Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..idata
nop
nop
mov ebx, 0x408ecc
mov ecx, 0x14df45a3
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
mov ecx, 0x23fe3ef6
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0xd201b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00d20140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00d20140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00d20140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00d20140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xd20bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xd20c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xd3287c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xd20c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xd20c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43200c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x432030
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x100065f1
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor ecx, 0x1fe9
or ecx, 0x14fc0
pop ecx
mov ecx, dword [ebp - 0x5cc]
mov dword [ebp - 0x398], ecx
jmp 0x10006677

Function at 0x10006629
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edi
push esi
sub esi, 0x13e0f
sub esi, 0x10e0d
xor esi, 0x14188
pop esi
mov edx, dword [ebp - 0x5cc]
mov eax, dword [edx]
mov dword [ebp - 0x5cc], eax
mov ecx, dword [ebp - 0x5cc]
cmp ecx, dword [ebp - 0xeb4]
je 0x1000666d
mov edx, dword [ebp - 0x5cc]
cmp dword [edx + 0x30], 0
jne 0x10006423
mov dword [ebp - 0x398], 0
Function at 0x10007620
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x89c]
add eax, 1
mov dword [ebp - 0x89c], eax
mov ecx, dword [ebp - 0x898]
mov edx, dword [ebp - 0x89c]
cmp edx, dword [ecx + 0x18]
jae 0x1000777e
mov eax, dword [ebp - 0x89c]
mov ecx, dword [ebp - 0x1f58]
mov edx, dword [ebp - 0x3d0]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x8a0], edx
mov eax, dword [ebp - 0x89c]
mov ecx, dword [ebp - 0x2364]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x1f5c]
mov ecx, dword [ebp - 0x3d0]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x1f60], ecx
mov dword [ebp - 0x1e0], 0
jmp 0x100075e2
mov edx, dword [ebp - 0x1e0]
add edx, 1
mov dword [ebp - 0x1e0], edx
mov eax, dword [ebp - 0x8a0]
add eax, dword [ebp - 0x1e0]
movsx ecx, byte [eax]
test ecx, ecx
je 0x10007694
mov edx, dword [ebp - 0x1e0]
movsx eax, byte [ebp + edx - 0xafc]
test eax, eax
je 0x10007694
push eax
call 0x10007620
add byte [eax + 0x34], dl
dec edi
aaa
xor eax, 0x4046353b
dec esi
add esp, 4
jmp 0x1000762b
sub eax, 0xa9e0
jmp 0x10007638
pop eax
push eax
or eax, 0x9df2
pop eax
mov ecx, dword [ebp - 0x8a0]
add ecx, dword [ebp - 0x1e0]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x1e0]
movsx ecx, byte [ebp + eax - 0xafc]
cmp edx, ecx
je 0x10007686
mov edx, dword [ebp - 0x8a0]
add edx, dword [ebp - 0x1e0]
movsx eax, byte [edx]
xor eax, 0x20
mov ecx, dword [ebp - 0x1e0]
movsx edx, byte [ebp + ecx - 0xafc]
cmp eax, edx
jne fcn.1000768d
jmp 0x100075d3
jmp 0x10007694
push ecx
push esi
add esp, 4
call 0x100076a6
add byte [edi], bh
xor ecx, dword [eax + 0x3d]
cmp ecx, dword [ecx + 0x38]
add esp, 4
xor ecx, 0x54ca
call 0x100076bc
add byte [edx], bh
dec ebp
aas
inc eax
dec eax
cmp bh, byte [esi]
add esp, 4
and ecx, 0x7c86
pop ecx
mov eax, dword [ebp - 0x8a0]
add eax, dword [ebp - 0x1e0]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x1e0]
movsx eax, byte [ebp + edx - 0xafc]
cmp ecx, eax
jne 0x100076f3
mov dword [ebp - 0xed4], 0
jmp 0x10007762
push eax
push edx
add esp, 4
and eax, 0x1e8a
and eax, 0x3419
and eax, 0x17e46
pop eax
push edx
push ecx
add esp, 4
or edx, 0xe2a0
sub edx, 0x22d7
pop edx
push edi
or edi, 0x9a42
pop edi
mov ecx, dword [ebp - 0x8a0]
add ecx, dword [ebp - 0x1e0]
movsx edx, byte [ecx]
invalid
invalid
Function at 0x100076a6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x89c]
add eax, 1
mov dword [ebp - 0x89c], eax
mov ecx, dword [ebp - 0x898]
mov edx, dword [ebp - 0x89c]
cmp edx, dword [ecx + 0x18]
jae 0x1000777e
mov eax, dword [ebp - 0x89c]
mov ecx, dword [ebp - 0x1f58]
mov edx, dword [ebp - 0x3d0]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x8a0], edx
mov eax, dword [ebp - 0x89c]
mov ecx, dword [ebp - 0x2364]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x1f5c]
mov ecx, dword [ebp - 0x3d0]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x1f60], ecx
mov dword [ebp - 0x1e0], 0
jmp 0x100075e2
mov edx, dword [ebp - 0x1e0]
add edx, 1
mov dword [ebp - 0x1e0], edx
mov eax, dword [ebp - 0x8a0]
add eax, dword [ebp - 0x1e0]
movsx ecx, byte [eax]
test ecx, ecx
je 0x10007694
mov edx, dword [ebp - 0x1e0]
movsx eax, byte [ebp + edx - 0xafc]
test eax, eax
je 0x10007694
push eax
call 0x10007620
add byte [eax + 0x34], dl
dec edi
aaa
xor eax, 0x4046353b
dec esi
add esp, 4
jmp 0x1000762b
sub eax, 0xa9e0
jmp 0x10007638
pop eax
push eax
or eax, 0x9df2
pop eax
mov ecx, dword [ebp - 0x8a0]
add ecx, dword [ebp - 0x1e0]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x1e0]
movsx ecx, byte [ebp + eax - 0xafc]
cmp edx, ecx
je 0x10007686
mov edx, dword [ebp - 0x8a0]
add edx, dword [ebp - 0x1e0]
movsx eax, byte [edx]
xor eax, 0x20
mov ecx, dword [ebp - 0x1e0]
movsx edx, byte [ebp + ecx - 0xafc]
cmp eax, edx
jne fcn.1000768d
jmp 0x100075d3
jmp 0x10007694
push ecx
push esi
add esp, 4
call 0x100076a6
add byte [edi], bh
xor ecx, dword [eax + 0x3d]
cmp ecx, dword [ecx + 0x38]
add esp, 4
xor ecx, 0x54ca
call 0x100076bc
add byte [edx], bh
dec ebp
aas
inc eax
dec eax
cmp bh, byte [esi]
add esp, 4
and ecx, 0x7c86
pop ecx
mov eax, dword [ebp - 0x8a0]
add eax, dword [ebp - 0x1e0]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x1e0]
movsx eax, byte [ebp + edx - 0xafc]
cmp ecx, eax
jne 0x100076f3
mov dword [ebp - 0xed4], 0
jmp 0x10007762
push eax
push edx
add esp, 4
and eax, 0x1e8a
and eax, 0x3419
and eax, 0x17e46
pop eax
push edx
push ecx
add esp, 4
or edx, 0xe2a0
sub edx, 0x22d7
pop edx
push edi
or edi, 0x9a42
pop edi
mov ecx, dword [ebp - 0x8a0]
add ecx, dword [ebp - 0x1e0]
movsx edx, byte [ecx]
invalid
invalid
Function at 0x100076bc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x89c]
add eax, 1
mov dword [ebp - 0x89c], eax
mov ecx, dword [ebp - 0x898]
mov edx, dword [ebp - 0x89c]
cmp edx, dword [ecx + 0x18]
jae 0x1000777e
mov eax, dword [ebp - 0x89c]
mov ecx, dword [ebp - 0x1f58]
mov edx, dword [ebp - 0x3d0]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x8a0], edx
mov eax, dword [ebp - 0x89c]
mov ecx, dword [ebp - 0x2364]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x1f5c]
mov ecx, dword [ebp - 0x3d0]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x1f60], ecx
mov dword [ebp - 0x1e0], 0
jmp 0x100075e2
mov edx, dword [ebp - 0x1e0]
add edx, 1
mov dword [ebp - 0x1e0], edx
mov eax, dword [ebp - 0x8a0]
add eax, dword [ebp - 0x1e0]
movsx ecx, byte [eax]
test ecx, ecx
je 0x10007694
mov edx, dword [ebp - 0x1e0]
movsx eax, byte [ebp + edx - 0xafc]
test eax, eax
je 0x10007694
push eax
call 0x10007620
add byte [eax + 0x34], dl
dec edi
aaa
xor eax, 0x4046353b
dec esi
add esp, 4
jmp 0x1000762b
sub eax, 0xa9e0
jmp 0x10007638
pop eax
push eax
or eax, 0x9df2
pop eax
mov ecx, dword [ebp - 0x8a0]
add ecx, dword [ebp - 0x1e0]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x1e0]
movsx ecx, byte [ebp + eax - 0xafc]
cmp edx, ecx
je 0x10007686
mov edx, dword [ebp - 0x8a0]
add edx, dword [ebp - 0x1e0]
movsx eax, byte [edx]
xor eax, 0x20
mov ecx, dword [ebp - 0x1e0]
movsx edx, byte [ebp + ecx - 0xafc]
cmp eax, edx
jne fcn.1000768d
jmp 0x100075d3
jmp 0x10007694
push ecx
push esi
add esp, 4
call 0x100076a6
add byte [edi], bh
xor ecx, dword [eax + 0x3d]
cmp ecx, dword [ecx + 0x38]
add esp, 4
xor ecx, 0x54ca
call 0x100076bc
add byte [edx], bh
dec ebp
aas
inc eax
dec eax
cmp bh, byte [esi]
add esp, 4
and ecx, 0x7c86
pop ecx
mov eax, dword [ebp - 0x8a0]
add eax, dword [ebp - 0x1e0]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x1e0]
movsx eax, byte [ebp + edx - 0xafc]
cmp ecx, eax
jne 0x100076f3
mov dword [ebp - 0xed4], 0
jmp 0x10007762
push eax
push edx
add esp, 4
and eax, 0x1e8a
and eax, 0x3419
and eax, 0x17e46
pop eax
push edx
push ecx
add esp, 4
or edx, 0xe2a0
sub edx, 0x22d7
pop edx
push edi
or edi, 0x9a42
pop edi
mov ecx, dword [ebp - 0x8a0]
add ecx, dword [ebp - 0x1e0]
movsx edx, byte [ecx]
invalid
invalid

Function at 0x10007736
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and byte [ebx - 0x1df7b], cl
dec dword [edi]
mov esi, 0xf504058c
invalid

Function at 0x100077a2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
dec dword [ecx - 0x48f7b]
inc dword [ebx - 0x48f43]
inc dword [eax]
je 0x10007865
push edi
jmp 0x1000779e
call 0x100077ac
add byte [eax], bh
inc ebx
inc ebp
xor edi, dword [edi]
dec edi
cmp al, byte [ebx + 0xbe804c4]
add byte [eax], al
add byte [eax], al
dec ebp
dec ecx
dec esp
inc edx
push eax
inc edx
cmp ecx, dword [edx + eax*2 - 0x7d]
les eax, [ecx + eax*4]
add al, 0x81
out 0x7f, eax
xchg esp, eax
add byte [eax], al
pop edi
mov ecx, dword [ebp - 0x490]
mov dword [ebp - 0x1f64], ecx